Extracted from libressl 3.4.2