Merge changes from upstream.

Replaced convert_bazel with convert_for_cobalt.

convert_for_cobalt has two main differences with convert_bazel:
1. convert_for_cobalt uses the fact that BUILD.blaze files are written
in StarLark which is a subset of Python. Instead of directly parsing the
files, we create a python environment which gathers the necessary
information and execute the BUILD.blaze files in that environment.

2. convert_for_cobalt does not attempt to convert every single target in
the tink repository. Instead, it takes a list of starting targets and
attempts to convert those targets and their transitive dependencies.
This makes updating Tink easier since we try to convert much fewer
targets.

In addition, convert_for_cobalt has the ability to exclude certain
targets that are unused and problematic, even if they are in the
transitive closure of the targets we do want. This is handled only when
it comes to build files. If a build target is actually needed by the
build, you're on your own.

Finally, convert_for_cobalt can symbolically move targets in order to
cope with CMake's idiosyncracies.

Note: convert_for_cobalt does not currentl support BUILD.gn.
I will add BUILD.gn support later.

Commands:
git clone https://fuchsia.googlesource.com/third_party/tink
cd tink
git checkout origin/master -b ${USER}-merge
git merge FETCH_HEAD
./tools/convert_for_cobalt

Manual Change:
It looks like Tink has adopted a dependency on a version of boringssl we
don't have yet. In order to cope with this, I had to create a dummy
function called EVP_aead_xchacha20_poly1305 which can be found in
cc/subtle/xchacha20_poly1305_boringssl.cc
It should crash the program if used. We can upgrade BoringSSL
separately.

Change-Id: I1204520b74e87b73ecaa6533245ffe82d34e3474
diff --git a/CMakeLists.txt b/CMakeLists.txt
new file mode 100644
index 0000000..c5c7445
--- /dev/null
+++ b/CMakeLists.txt
@@ -0,0 +1,87 @@
+# Copyright 2018 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+###############################################################################
+#
+# This CMake file is intended to be used in order to build Tink as part of the
+# Cobalt stand-alone build. It is not intended to work to build Tink
+# in isolation and it is not intended to build Tink as part of the
+# Fuchsia build.
+###############################################################################
+
+cmake_minimum_required (VERSION 3.0.0)
+
+PROJECT (tink)
+
+set(TINK_ROOT_DIR ${CMAKE_CURRENT_SOURCE_DIR})
+set(TINK_INCLUDE_DIR ${CMAKE_CURRENT_BINARY_DIR}/include)
+set(TINK_PROTO_DIR ${TINK_INCLUDE_DIR}/proto)
+
+# Runs the protoc compiler on a set of .proto files to generate c++ files.
+# Compiles the c++ files into a static library.
+#
+# Args:
+# LIB_NAME: The name of the CMake target for the generated static library
+# HDRS_OUT: A variable in which to write the list of names of the generated
+#           header files
+# <remaining args>: List of simple names of .proto files to include from the
+#                   current source directory. The names should not include
+#                   ".proto"
+# example usage:
+#
+# tink_make_protobuf_cpp_lib(report_master_proto_lib
+#                             REPORT_PROTO_HDRS
+#                             report_master report_internal)
+#
+# This will compile the files report_master.proto and report_internal.proto in
+# the current source directory and generate a static library with a
+# target name of report_master_proto_lib containing the ReportMaster gRPC
+# service as well as the compiled protos from report_internal. The variable
+# REPORT_PROTO_HDRS will contain the list of strings:
+# { <some-path>/report_internal.grpc.pb.h
+#   <some-path>/report_internal.pb.h
+#   <some-path>/report_master.grpc.pb.h
+#   <some-path>/report_master.pb.h}
+# (Note that report_internal.proto does not contain a gRPC service definition
+#  so that report_internal.grpc.pb.h is essentially empty.)
+macro(tink_make_protobuf_cpp_lib LIB_NAME HDRS_OUT)
+  set(_protofiles)
+  set(_generated_srcs)
+  set(_generated_hdrs)
+  file(RELATIVE_PATH
+       _file_path
+       "${PROJECT_SOURCE_DIR}"
+       "${CMAKE_CURRENT_SOURCE_DIR}")
+  foreach(name ${ARGN})
+      list(APPEND _protofiles "${CMAKE_CURRENT_SOURCE_DIR}/${name}.proto")
+      list(APPEND _generated_srcs "${TINK_INCLUDE_DIR}/${_file_path}/${name}.pb.cc")
+      list(APPEND _generated_hdrs "${TINK_INCLUDE_DIR}/${_file_path}/${name}.pb.h")
+      set_source_files_properties("${TINK_INCLUDE_DIR}/${_file_path}/${name}.pb.cc" PROPERTIES GENERATED TRUE)
+      set_source_files_properties("${TINK_INCLUDE_DIR}/${_file_path}/${name}.pb.h" PROPERTIES GENERATED TRUE)
+  endforeach()
+  add_custom_command(OUTPUT ${_generated_srcs} ${_generated_hdrs}
+    COMMAND ${PROTOC} ${_protofiles}
+            -I ${PROJECT_SOURCE_DIR}
+            --cpp_out=lite:${TINK_INCLUDE_DIR}
+    DEPENDS ${_protofiles}
+  )
+  add_library(${LIB_NAME}
+    ${_generated_srcs}
+  )
+  add_dependencies(${LIB_NAME} build_external_projects)
+  target_link_libraries(${LIB_NAME}
+                        protobuf_lite)
+  set(${HDRS_OUT} ${_generated_hdrs})
+endmacro()
+
+macro(tink_export_hdrs)
+  file(RELATIVE_PATH _file_path "${PROJECT_SOURCE_DIR}/cc"
+       "${CMAKE_CURRENT_SOURCE_DIR}")
+  foreach(name ${ARGN})
+    file(COPY "${name}" DESTINATION ${TINK_INCLUDE_DIR}/tink/${_file_path})
+   endforeach()
+endmacro()
+
+add_subdirectory(proto)
+add_subdirectory(cc)
diff --git a/cc/BUILD.gn b/cc/BUILD.gn
new file mode 100644
index 0000000..3276598
--- /dev/null
+++ b/cc/BUILD.gn
@@ -0,0 +1,946 @@
+# Copyright 2018 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+config("tink_config") {
+  cflags = [
+    "-Wno-ignored-qualifiers",
+    "-frtti",
+  ]
+  include_dirs = [
+    "$target_gen_dir/include",
+    "$target_gen_dir/..",
+  ]
+}
+
+copy("tink_copyfiles") {
+  outputs = [
+    "$target_gen_dir/include/tink/{{source_file_part}}",
+  ]
+  sources = [
+    "aead.h",
+    "aead_config.h",
+    "aead_factory.h",
+    "aead_key_templates.h",
+    "binary_keyset_reader.h",
+    "binary_keyset_writer.h",
+    "catalogue.h",
+    "cleartext_keyset_handle.h",
+    "config.h",
+    "crypto_format.h",
+    "hybrid_config.h",
+    "hybrid_decrypt.h",
+    "hybrid_decrypt_factory.h",
+    "hybrid_encrypt.h",
+    "hybrid_encrypt_factory.h",
+    "hybrid_key_templates.h",
+    "json_keyset_reader.h",
+    "json_keyset_writer.h",
+    "key_manager.h",
+    "keyset_handle.h",
+    "keyset_manager.h",
+    "keyset_reader.h",
+    "keyset_writer.h",
+    "kms_client.h",
+    "mac.h",
+    "mac_config.h",
+    "mac_factory.h",
+    "mac_key_templates.h",
+    "primitive_set.h",
+    "public_key_sign.h",
+    "public_key_sign_factory.h",
+    "public_key_verify.h",
+    "public_key_verify_factory.h",
+    "registry.h",
+    "signature_config.h",
+    "signature_key_templates.h",
+    "tink_config.h",
+  ]
+}
+
+source_set("cc") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_cc_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":aead",
+    ":binary_keyset_reader",
+    ":binary_keyset_writer",
+    ":hybrid_decrypt",
+    ":hybrid_encrypt",
+    ":json_keyset_reader",
+    ":json_keyset_writer",
+    ":key_manager",
+    ":keyset_handle",
+    ":keyset_manager",
+    ":public_key_sign",
+    ":public_key_verify",
+    ":keyset_reader",
+    ":keyset_writer",
+    ":kms_client",
+    ":mac",
+    ":primitive_set",
+    ":registry",
+    "//third_party/tink/cc/aead:aead_config",
+    "//third_party/tink/cc/aead:aead_factory",
+    "//third_party/tink/cc/aead:aead_key_templates",
+    "//third_party/tink/cc/config:tink_config",
+    "//third_party/tink/cc/hybrid:hybrid_config",
+    "//third_party/tink/cc/hybrid:hybrid_decrypt_factory",
+    "//third_party/tink/cc/hybrid:hybrid_encrypt_factory",
+    "//third_party/tink/cc/hybrid:hybrid_key_templates",
+    "//third_party/tink/cc/mac:mac_config",
+    "//third_party/tink/cc/mac:mac_factory",
+    "//third_party/tink/cc/mac:mac_key_templates",
+    "//third_party/tink/cc/signature:public_key_sign_factory",
+    "//third_party/tink/cc/signature:public_key_verify_factory",
+    "//third_party/tink/cc/signature:signature_config",
+    "//third_party/tink/cc/signature:signature_key_templates",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:validation",
+    "//third_party/abseil-cpp/absl/memory",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_copyfiles",
+  ]
+  sources = [
+    "aead.h",
+    "aead_config.h",
+    "aead_factory.h",
+    "aead_key_templates.h",
+    "binary_keyset_reader.h",
+    "binary_keyset_writer.h",
+    "catalogue.h",
+    "config.h",
+    "hybrid_config.h",
+    "hybrid_decrypt.h",
+    "hybrid_decrypt_factory.h",
+    "hybrid_encrypt.h",
+    "hybrid_encrypt_factory.h",
+    "hybrid_key_templates.h",
+    "json_keyset_reader.h",
+    "json_keyset_writer.h",
+    "key_manager.h",
+    "keyset_handle.h",
+    "keyset_manager.h",
+    "keyset_reader.h",
+    "keyset_writer.h",
+    "kms_client.h",
+    "mac.h",
+    "mac_config.h",
+    "mac_factory.h",
+    "mac_key_templates.h",
+    "public_key_sign.h",
+    "public_key_sign_factory.h",
+    "public_key_verify.h",
+    "public_key_verify_factory.h",
+    "registry.h",
+    "signature_config.h",
+    "signature_key_templates.h",
+    "tink_config.h",
+  ]
+  testonly = false
+}
+
+source_set("aead") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_aead_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_copyfiles",
+  ]
+  sources = [
+    "aead.h",
+  ]
+  testonly = false
+}
+
+source_set("hybrid_decrypt") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_hybrid_decrypt_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_copyfiles",
+  ]
+  sources = [
+    "hybrid_decrypt.h",
+  ]
+  testonly = false
+}
+
+source_set("hybrid_encrypt") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_hybrid_encrypt_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_copyfiles",
+  ]
+  sources = [
+    "hybrid_encrypt.h",
+  ]
+  testonly = false
+}
+
+source_set("mac") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_mac_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_copyfiles",
+  ]
+  sources = [
+    "mac.h",
+  ]
+  testonly = false
+}
+
+source_set("public_key_sign") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_public_key_sign_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_copyfiles",
+  ]
+  sources = [
+    "public_key_sign.h",
+  ]
+  testonly = false
+}
+
+source_set("public_key_verify") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_public_key_verify_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/cc/util:status",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_copyfiles",
+  ]
+  sources = [
+    "public_key_verify.h",
+  ]
+  testonly = false
+}
+
+source_set("keyset_reader") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_keyset_reader_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/proto:tink_proto",
+    ":tink_copyfiles",
+  ]
+  sources = [
+    "keyset_reader.h",
+  ]
+  testonly = false
+}
+
+source_set("keyset_writer") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_keyset_writer_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/proto:tink_proto",
+    ":tink_copyfiles",
+  ]
+  sources = [
+    "keyset_writer.h",
+  ]
+  testonly = false
+}
+
+source_set("binary_keyset_reader") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_binary_keyset_reader_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":keyset_reader",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/abseil-cpp/absl/memory",
+    "//third_party/abseil-cpp/absl/strings",
+    "//third_party/protobuf:protobuf_lite",
+    ":tink_copyfiles",
+  ]
+  sources = [
+    "binary_keyset_reader.h",
+    "core/binary_keyset_reader.cc",
+  ]
+  testonly = false
+}
+
+source_set("binary_keyset_writer") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_binary_keyset_writer_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":keyset_writer",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_copyfiles",
+  ]
+  sources = [
+    "binary_keyset_writer.h",
+    "core/binary_keyset_writer.cc",
+  ]
+  testonly = false
+}
+
+source_set("json_keyset_reader") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_json_keyset_reader_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":keyset_reader",
+    "//third_party/tink/cc/util:enums",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/abseil-cpp/absl/memory",
+    "//third_party/abseil-cpp/absl/strings",
+    "//third_party/rapidjson",
+    ":tink_copyfiles",
+  ]
+  sources = [
+    "core/json_keyset_reader.cc",
+    "json_keyset_reader.h",
+  ]
+  testonly = false
+}
+
+source_set("json_keyset_writer") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_json_keyset_writer_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":keyset_writer",
+    "//third_party/tink/cc/util:enums",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/abseil-cpp/absl/strings",
+    "//third_party/rapidjson",
+    ":tink_copyfiles",
+  ]
+  sources = [
+    "core/json_keyset_writer.cc",
+    "json_keyset_writer.h",
+  ]
+  testonly = false
+}
+
+source_set("catalogue") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_catalogue_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":key_manager",
+    "//third_party/tink/cc/util:statusor",
+    ":tink_copyfiles",
+  ]
+  sources = [
+    "catalogue.h",
+  ]
+  testonly = false
+}
+
+source_set("config") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_config_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":aead",
+    ":catalogue",
+    ":hybrid_decrypt",
+    ":hybrid_encrypt",
+    ":key_manager",
+    ":mac",
+    ":public_key_sign",
+    ":public_key_verify",
+    ":registry",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/proto:config_proto",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_copyfiles",
+  ]
+  sources = [
+    "config.h",
+    "core/config.cc",
+  ]
+  testonly = false
+}
+
+source_set("crypto_format") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_crypto_format_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/proto:tink_proto",
+    ":tink_copyfiles",
+  ]
+  sources = [
+    "core/crypto_format.cc",
+    "crypto_format.h",
+  ]
+  testonly = false
+}
+
+source_set("primitive_set") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_primitive_set_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":crypto_format",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/abseil-cpp/absl/memory",
+    ":tink_copyfiles",
+  ]
+  sources = [
+    "primitive_set.h",
+    "primitive_set.h",
+  ]
+  testonly = false
+}
+
+source_set("registry") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_registry_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":catalogue",
+    ":key_manager",
+    ":keyset_handle_hdr",
+    ":primitive_set",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:validation",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_copyfiles",
+  ]
+  sources = [
+    "core/registry.cc",
+    "registry.h",
+  ]
+  testonly = false
+}
+
+source_set("keyset_handle_hdr") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_keyset_handle_hdr_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":aead",
+    ":keyset_reader",
+    ":keyset_writer",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/abseil-cpp/absl/memory",
+    ":tink_copyfiles",
+  ]
+  sources = [
+    "keyset_handle.h",
+    "keyset_handle.h",
+  ]
+  testonly = false
+}
+
+source_set("keyset_handle") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_keyset_handle_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":aead",
+    ":keyset_manager",
+    ":keyset_reader",
+    ":keyset_writer",
+    ":registry",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/abseil-cpp/absl/memory",
+    ":tink_copyfiles",
+  ]
+  sources = [
+    "core/keyset_handle.cc",
+    "keyset_handle.h",
+  ]
+  testonly = false
+}
+
+source_set("cleartext_keyset_handle") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_cleartext_keyset_handle_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":keyset_handle_hdr",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/proto:tink_proto",
+    ":tink_copyfiles",
+  ]
+  sources = [
+    "cleartext_keyset_handle.h",
+    "core/cleartext_keyset_handle.cc",
+  ]
+  testonly = false
+}
+
+source_set("key_manager") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_key_manager_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_copyfiles",
+  ]
+  sources = [
+    "key_manager.h",
+    "key_manager.h",
+  ]
+  testonly = false
+}
+
+source_set("keyset_manager") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_keyset_manager_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":keyset_handle_hdr",
+    ":keyset_reader",
+    ":registry",
+    "//third_party/tink/cc/util:enums",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/abseil-cpp/absl/memory",
+    ":tink_copyfiles",
+  ]
+  sources = [
+    "core/keyset_manager.cc",
+    "keyset_manager.h",
+  ]
+  testonly = false
+}
+
+source_set("kms_client") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_kms_client_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":aead",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_copyfiles",
+  ]
+  sources = [
+    "kms_client.h",
+  ]
+  testonly = false
+}
+
+executable("registry_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_registry_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":aead",
+    ":catalogue",
+    ":crypto_format",
+    ":registry",
+    "//third_party/tink/cc/aead:aead_catalogue",
+    "//third_party/tink/cc/aead:aes_gcm_key_manager",
+    "//third_party/tink/cc/hybrid:ecies_aead_hkdf_private_key_manager",
+    "//third_party/tink/cc/hybrid:ecies_aead_hkdf_public_key_manager",
+    "//third_party/tink/cc/util:keyset_util",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/tink/proto:aes_ctr_hmac_aead_proto",
+    "//third_party/tink/proto:aes_gcm_proto",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/abseil-cpp/absl/memory",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "core/registry_test.cc",
+  ]
+  testonly = true
+}
+
+executable("binary_keyset_reader_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_binary_keyset_reader_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":binary_keyset_reader",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "core/binary_keyset_reader_test.cc",
+  ]
+  testonly = true
+}
+
+executable("binary_keyset_writer_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_binary_keyset_writer_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":binary_keyset_writer",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "core/binary_keyset_writer_test.cc",
+  ]
+  testonly = true
+}
+
+executable("json_keyset_reader_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_json_keyset_reader_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":json_keyset_reader",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/tink/proto:aes_eax_proto",
+    "//third_party/tink/proto:aes_gcm_proto",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/abseil-cpp/absl/strings",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "core/json_keyset_reader_test.cc",
+  ]
+  testonly = true
+}
+
+executable("json_keyset_writer_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_json_keyset_writer_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":json_keyset_reader",
+    ":json_keyset_writer",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/tink/proto:aes_eax_proto",
+    "//third_party/tink/proto:aes_gcm_proto",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/abseil-cpp/absl/strings",
+    "//third_party/googletest:gtest_main",
+    "//third_party/rapidjson",
+  ]
+  sources = [
+    "core/json_keyset_writer_test.cc",
+  ]
+  testonly = true
+}
+
+executable("config_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_config_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":config",
+    ":mac",
+    "//third_party/tink/proto:config_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "core/config_test.cc",
+  ]
+  testonly = true
+}
+
+executable("crypto_format_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_crypto_format_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":crypto_format",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "core/crypto_format_test.cc",
+  ]
+  testonly = true
+}
+
+executable("keyset_handle_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_keyset_handle_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":binary_keyset_reader",
+    ":cleartext_keyset_handle",
+    ":config",
+    ":json_keyset_reader",
+    ":json_keyset_writer",
+    ":keyset_handle",
+    "//third_party/tink/cc:cc",
+    "//third_party/tink/cc/aead:aead_key_templates",
+    "//third_party/tink/cc/aead:aes_gcm_key_manager",
+    "//third_party/tink/cc/config:tink_config",
+    "//third_party/tink/cc/signature:ecdsa_sign_key_manager",
+    "//third_party/tink/cc/signature:signature_key_templates",
+    "//third_party/tink/cc/util:keyset_util",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "core/keyset_handle_test.cc",
+  ]
+  testonly = true
+}
+
+executable("keyset_manager_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_keyset_manager_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":config",
+    ":keyset_handle",
+    ":keyset_manager",
+    "//third_party/tink/cc/aead:aead_config",
+    "//third_party/tink/cc/aead:aes_gcm_key_manager",
+    "//third_party/tink/cc/util:keyset_util",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/tink/proto:aes_gcm_proto",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "core/keyset_manager_test.cc",
+  ]
+  testonly = true
+}
+
+executable("cleartext_keyset_handle_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_cleartext_keyset_handle_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":binary_keyset_reader",
+    ":cleartext_keyset_handle",
+    ":keyset_handle",
+    ":keyset_reader",
+    "//third_party/tink/cc/util:keyset_util",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "core/cleartext_keyset_handle_test.cc",
+  ]
+  testonly = true
+}
+
+executable("primitive_set_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_primitive_set_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":crypto_format",
+    ":mac",
+    ":primitive_set",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "core/primitive_set_test.cc",
+  ]
+  testonly = true
+}
+
diff --git a/cc/CMakeLists.txt b/cc/CMakeLists.txt
new file mode 100644
index 0000000..5e5082b
--- /dev/null
+++ b/cc/CMakeLists.txt
@@ -0,0 +1,295 @@
+# Copyright 2019 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+add_subdirectory(aead)
+add_subdirectory(core)
+add_subdirectory(daead)
+add_subdirectory(hybrid)
+add_subdirectory(mac)
+add_subdirectory(signature)
+add_subdirectory(subtle)
+add_subdirectory(util)
+
+# CC Library : aead
+add_library(tink_cc_aead aead.h)
+set_target_properties(tink_cc_aead PROPERTIES LINKER_LANGUAGE CXX)
+tink_export_hdrs(aead.h)
+add_dependencies(tink_cc_aead tink_cc_util_statusor)
+target_link_libraries(tink_cc_aead tink_cc_util_statusor absl::strings)
+
+# CC Library : deterministic_aead
+add_library(tink_cc_deterministic_aead deterministic_aead.h)
+set_target_properties(tink_cc_deterministic_aead PROPERTIES LINKER_LANGUAGE CXX)
+tink_export_hdrs(deterministic_aead.h)
+add_dependencies(tink_cc_deterministic_aead tink_cc_util_statusor)
+target_link_libraries(
+  tink_cc_deterministic_aead
+  tink_cc_util_statusor
+  absl::strings
+)
+
+# CC Library : hybrid_decrypt
+add_library(tink_cc_hybrid_decrypt hybrid_decrypt.h)
+set_target_properties(tink_cc_hybrid_decrypt PROPERTIES LINKER_LANGUAGE CXX)
+tink_export_hdrs(hybrid_decrypt.h)
+add_dependencies(tink_cc_hybrid_decrypt tink_cc_util_statusor)
+target_link_libraries(
+  tink_cc_hybrid_decrypt
+  tink_cc_util_statusor
+  absl::strings
+)
+
+# CC Library : hybrid_encrypt
+add_library(tink_cc_hybrid_encrypt hybrid_encrypt.h)
+set_target_properties(tink_cc_hybrid_encrypt PROPERTIES LINKER_LANGUAGE CXX)
+tink_export_hdrs(hybrid_encrypt.h)
+add_dependencies(tink_cc_hybrid_encrypt tink_cc_util_statusor)
+target_link_libraries(
+  tink_cc_hybrid_encrypt
+  tink_cc_util_statusor
+  absl::strings
+)
+
+# CC Library : mac
+add_library(tink_cc_mac mac.h)
+set_target_properties(tink_cc_mac PROPERTIES LINKER_LANGUAGE CXX)
+tink_export_hdrs(mac.h)
+add_dependencies(tink_cc_mac tink_cc_util_status tink_cc_util_statusor)
+target_link_libraries(
+  tink_cc_mac
+  tink_cc_util_status
+  tink_cc_util_statusor
+  absl::strings
+)
+
+# CC Library : public_key_sign
+add_library(tink_cc_public_key_sign public_key_sign.h)
+set_target_properties(tink_cc_public_key_sign PROPERTIES LINKER_LANGUAGE CXX)
+tink_export_hdrs(public_key_sign.h)
+add_dependencies(tink_cc_public_key_sign tink_cc_util_statusor)
+target_link_libraries(
+  tink_cc_public_key_sign
+  tink_cc_util_statusor
+  absl::strings
+)
+
+# CC Library : public_key_verify
+add_library(tink_cc_public_key_verify public_key_verify.h)
+set_target_properties(tink_cc_public_key_verify PROPERTIES LINKER_LANGUAGE CXX)
+tink_export_hdrs(public_key_verify.h)
+add_dependencies(tink_cc_public_key_verify tink_cc_util_status)
+target_link_libraries(
+  tink_cc_public_key_verify
+  tink_cc_util_status
+  absl::strings
+)
+
+# CC Library : keyset_reader
+add_library(tink_cc_keyset_reader keyset_reader.h)
+set_target_properties(tink_cc_keyset_reader PROPERTIES LINKER_LANGUAGE CXX)
+tink_export_hdrs(keyset_reader.h)
+add_dependencies(
+  tink_cc_keyset_reader
+  tink_cc_util_statusor
+  tink_proto_tink_lib
+)
+target_link_libraries(
+  tink_cc_keyset_reader
+  tink_cc_util_statusor
+  tink_proto_tink_lib
+)
+
+# CC Library : keyset_writer
+add_library(tink_cc_keyset_writer keyset_writer.h)
+set_target_properties(tink_cc_keyset_writer PROPERTIES LINKER_LANGUAGE CXX)
+tink_export_hdrs(keyset_writer.h)
+add_dependencies(tink_cc_keyset_writer tink_cc_util_status tink_proto_tink_lib)
+target_link_libraries(
+  tink_cc_keyset_writer
+  tink_cc_util_status
+  tink_proto_tink_lib
+)
+
+# CC Library : catalogue
+add_library(tink_cc_catalogue catalogue.h)
+set_target_properties(tink_cc_catalogue PROPERTIES LINKER_LANGUAGE CXX)
+tink_export_hdrs(catalogue.h)
+add_dependencies(tink_cc_catalogue tink_cc_key_manager tink_cc_util_statusor)
+target_link_libraries(
+  tink_cc_catalogue
+  tink_cc_key_manager
+  tink_cc_util_statusor
+)
+
+# CC Library : config
+add_library(tink_cc_config config.h core/config.cc)
+tink_export_hdrs(config.h)
+add_dependencies(
+  tink_cc_config
+  tink_cc_aead
+  tink_cc_catalogue
+  tink_cc_deterministic_aead
+  tink_cc_hybrid_decrypt
+  tink_cc_hybrid_encrypt
+  tink_cc_key_manager
+  tink_cc_mac
+  tink_cc_public_key_sign
+  tink_cc_public_key_verify
+  tink_cc_registry
+  tink_cc_aead_aead_wrapper
+  tink_cc_daead_deterministic_aead_wrapper
+  tink_cc_hybrid_hybrid_decrypt_wrapper
+  tink_cc_hybrid_hybrid_encrypt_wrapper
+  tink_cc_mac_mac_wrapper
+  tink_cc_signature_public_key_sign_wrapper
+  tink_cc_signature_public_key_verify_wrapper
+  tink_cc_util_errors
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_proto_config_lib
+)
+target_link_libraries(
+  tink_cc_config
+  tink_cc_aead
+  tink_cc_catalogue
+  tink_cc_deterministic_aead
+  tink_cc_hybrid_decrypt
+  tink_cc_hybrid_encrypt
+  tink_cc_key_manager
+  tink_cc_mac
+  tink_cc_public_key_sign
+  tink_cc_public_key_verify
+  tink_cc_registry
+  tink_cc_aead_aead_wrapper
+  tink_cc_daead_deterministic_aead_wrapper
+  tink_cc_hybrid_hybrid_decrypt_wrapper
+  tink_cc_hybrid_hybrid_encrypt_wrapper
+  tink_cc_mac_mac_wrapper
+  tink_cc_signature_public_key_sign_wrapper
+  tink_cc_signature_public_key_verify_wrapper
+  tink_cc_util_errors
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_proto_config_lib
+  absl::strings
+)
+
+# CC Library : crypto_format
+add_library(tink_cc_crypto_format crypto_format.h core/crypto_format.cc)
+tink_export_hdrs(crypto_format.h)
+add_dependencies(
+  tink_cc_crypto_format
+  tink_cc_util_errors
+  tink_cc_util_statusor
+  tink_proto_tink_lib
+)
+target_link_libraries(
+  tink_cc_crypto_format
+  tink_cc_util_errors
+  tink_cc_util_statusor
+  tink_proto_tink_lib
+)
+
+# CC Library : primitive_set
+add_library(tink_cc_primitive_set primitive_set.h primitive_set.h)
+tink_export_hdrs(primitive_set.h)
+add_dependencies(
+  tink_cc_primitive_set
+  tink_cc_crypto_format
+  tink_cc_util_errors
+  tink_cc_util_statusor
+  tink_proto_tink_lib
+)
+target_link_libraries(
+  tink_cc_primitive_set
+  tink_cc_crypto_format
+  tink_cc_util_errors
+  tink_cc_util_statusor
+  tink_proto_tink_lib
+  absl::memory
+  absl::synchronization
+)
+
+# CC Library : primitive_wrapper
+add_library(tink_cc_primitive_wrapper primitive_wrapper.h)
+set_target_properties(tink_cc_primitive_wrapper PROPERTIES LINKER_LANGUAGE CXX)
+tink_export_hdrs(primitive_wrapper.h)
+add_dependencies(
+  tink_cc_primitive_wrapper
+  tink_cc_primitive_set
+  tink_cc_util_statusor
+)
+target_link_libraries(
+  tink_cc_primitive_wrapper
+  tink_cc_primitive_set
+  tink_cc_util_statusor
+)
+
+# CC Library : registry
+add_library(tink_cc_registry registry.h)
+set_target_properties(tink_cc_registry PROPERTIES LINKER_LANGUAGE CXX)
+tink_export_hdrs(registry.h)
+add_dependencies(
+  tink_cc_registry
+  tink_cc_core_registry_impl
+  tink_cc_util_status
+  tink_cc_util_statusor
+)
+target_link_libraries(
+  tink_cc_registry
+  tink_cc_core_registry_impl
+  tink_cc_util_status
+  tink_cc_util_statusor
+  absl::strings
+)
+
+# CC Library : keyset_handle
+add_library(tink_cc_keyset_handle keyset_handle.h core/keyset_handle.cc)
+tink_export_hdrs(keyset_handle.h)
+add_dependencies(
+  tink_cc_keyset_handle
+  tink_cc_aead
+  tink_cc_key_manager
+  tink_cc_keyset_reader
+  tink_cc_keyset_writer
+  tink_cc_primitive_set
+  tink_cc_registry
+  tink_cc_util_errors
+  tink_proto_tink_lib
+)
+target_link_libraries(
+  tink_cc_keyset_handle
+  tink_cc_aead
+  tink_cc_key_manager
+  tink_cc_keyset_reader
+  tink_cc_keyset_writer
+  tink_cc_primitive_set
+  tink_cc_registry
+  tink_cc_util_errors
+  tink_proto_tink_lib
+  absl::memory
+)
+
+# CC Library : key_manager
+add_library(tink_cc_key_manager key_manager.h core/key_manager.cc)
+tink_export_hdrs(key_manager.h)
+add_dependencies(
+  tink_cc_key_manager
+  tink_cc_util_errors
+  tink_cc_util_protobuf_helper
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_proto_tink_lib
+)
+target_link_libraries(
+  tink_cc_key_manager
+  tink_cc_util_errors
+  tink_cc_util_protobuf_helper
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_proto_tink_lib
+  absl::memory
+  absl::strings
+)
+
diff --git a/cc/aead/BUILD.gn b/cc/aead/BUILD.gn
new file mode 100644
index 0000000..36d1a62
--- /dev/null
+++ b/cc/aead/BUILD.gn
@@ -0,0 +1,437 @@
+# Copyright 2018 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+copy("tink_aead_copyfiles") {
+  outputs = [
+    "$target_gen_dir/../include/tink/aead/{{source_file_part}}",
+  ]
+  sources = [
+    "aead_catalogue.h",
+    "aead_config.h",
+    "aead_factory.h",
+    "aead_key_templates.h",
+    "aead_set_wrapper.h",
+    "aes_ctr_hmac_aead_key_manager.h",
+    "aes_eax_key_manager.h",
+    "aes_gcm_key_manager.h",
+  ]
+}
+
+source_set("aead_set_wrapper") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_aead_aead_set_wrapper_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:crypto_format",
+    "//third_party/tink/cc:primitive_set",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/subtle:subtle_util_boringssl",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_aead_copyfiles",
+  ]
+  sources = [
+    "aead_set_wrapper.cc",
+    "aead_set_wrapper.h",
+  ]
+  testonly = false
+}
+
+source_set("aead_catalogue") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_aead_aead_catalogue_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":aes_ctr_hmac_aead_key_manager",
+    ":aes_eax_key_manager",
+    ":aes_gcm_key_manager",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:catalogue",
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc/util:status",
+    ":tink_aead_copyfiles",
+  ]
+  sources = [
+    "aead_catalogue.cc",
+    "aead_catalogue.h",
+  ]
+  testonly = false
+}
+
+source_set("aead_config") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_aead_aead_config_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":aead_catalogue",
+    "//third_party/tink/cc:config",
+    "//third_party/tink/cc/mac:mac_config",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/proto:config_proto",
+    ":tink_aead_copyfiles",
+  ]
+  sources = [
+    "aead_config.cc",
+    "aead_config.h",
+  ]
+  testonly = false
+}
+
+source_set("aead_factory") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_aead_aead_factory_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":aead_set_wrapper",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc:keyset_handle",
+    "//third_party/tink/cc:primitive_set",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    ":tink_aead_copyfiles",
+  ]
+  sources = [
+    "aead_factory.cc",
+    "aead_factory.h",
+  ]
+  testonly = false
+}
+
+source_set("aead_key_templates") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_aead_aead_key_templates_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/proto:aes_ctr_hmac_aead_proto",
+    "//third_party/tink/proto:aes_eax_proto",
+    "//third_party/tink/proto:aes_gcm_proto",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:tink_proto",
+    ":tink_aead_copyfiles",
+  ]
+  sources = [
+    "aead_key_templates.cc",
+    "aead_key_templates.h",
+  ]
+  testonly = false
+}
+
+source_set("aes_eax_key_manager") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_aead_aes_eax_key_manager_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc/subtle:aes_eax_boringssl",
+    "//third_party/tink/cc/subtle:random",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:validation",
+    "//third_party/tink/proto:aes_eax_proto",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:tink_proto",
+    ":tink_aead_copyfiles",
+  ]
+  sources = [
+    "aes_eax_key_manager.cc",
+    "aes_eax_key_manager.h",
+  ]
+  testonly = false
+}
+
+source_set("aes_gcm_key_manager") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_aead_aes_gcm_key_manager_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc/subtle:aes_gcm_boringssl",
+    "//third_party/tink/cc/subtle:random",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:validation",
+    "//third_party/tink/proto:aes_gcm_proto",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:tink_proto",
+    ":tink_aead_copyfiles",
+  ]
+  sources = [
+    "aes_gcm_key_manager.cc",
+    "aes_gcm_key_manager.h",
+  ]
+  testonly = false
+}
+
+source_set("aes_ctr_hmac_aead_key_manager") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_aead_aes_ctr_hmac_aead_key_manager_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc:mac",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/subtle:aes_ctr_boringssl",
+    "//third_party/tink/cc/subtle:encrypt_then_authenticate",
+    "//third_party/tink/cc/subtle:hmac_boringssl",
+    "//third_party/tink/cc/subtle:random",
+    "//third_party/tink/cc/util:enums",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:validation",
+    "//third_party/tink/proto:aes_ctr_hmac_aead_proto",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:tink_proto",
+    ":tink_aead_copyfiles",
+  ]
+  sources = [
+    "aes_ctr_hmac_aead_key_manager.cc",
+    "aes_ctr_hmac_aead_key_manager.h",
+  ]
+  testonly = false
+}
+
+executable("aead_set_wrapper_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_aead_aead_set_wrapper_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":aead_set_wrapper",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:primitive_set",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "aead_set_wrapper_test.cc",
+  ]
+  testonly = true
+}
+
+executable("aead_catalogue_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_aead_aead_catalogue_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":aead_catalogue",
+    ":aead_config",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:catalogue",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "aead_catalogue_test.cc",
+  ]
+  testonly = true
+}
+
+executable("aead_config_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_aead_aead_config_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":aead_config",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:catalogue",
+    "//third_party/tink/cc:config",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/util:status",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "aead_config_test.cc",
+  ]
+  testonly = true
+}
+
+executable("aead_factory_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_aead_aead_factory_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":aead_config",
+    ":aead_factory",
+    ":aes_gcm_key_manager",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:crypto_format",
+    "//third_party/tink/cc:keyset_handle",
+    "//third_party/tink/cc/util:keyset_util",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/tink/proto:aes_gcm_proto",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "aead_factory_test.cc",
+  ]
+  testonly = true
+}
+
+executable("aead_key_templates_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_aead_aead_key_templates_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":aead_key_templates",
+    ":aes_ctr_hmac_aead_key_manager",
+    ":aes_eax_key_manager",
+    ":aes_gcm_key_manager",
+    "//third_party/tink/proto:aes_ctr_hmac_aead_proto",
+    "//third_party/tink/proto:aes_eax_proto",
+    "//third_party/tink/proto:aes_gcm_proto",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "aead_key_templates_test.cc",
+  ]
+  testonly = true
+}
+
+executable("aes_eax_key_manager_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_aead_aes_eax_key_manager_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":aes_eax_key_manager",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/proto:aes_eax_proto",
+    "//third_party/tink/proto:aes_gcm_proto",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "aes_eax_key_manager_test.cc",
+  ]
+  testonly = true
+}
+
+executable("aes_gcm_key_manager_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_aead_aes_gcm_key_manager_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":aes_gcm_key_manager",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/proto:aes_eax_proto",
+    "//third_party/tink/proto:aes_gcm_proto",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "aes_gcm_key_manager_test.cc",
+  ]
+  testonly = true
+}
+
+executable("aes_ctr_hmac_aead_key_manager_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_aead_aes_ctr_hmac_aead_key_manager_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":aes_ctr_hmac_aead_key_manager",
+    "//third_party/tink/cc:config",
+    "//third_party/tink/cc/mac:mac_config",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/proto:aes_ctr_hmac_aead_proto",
+    "//third_party/tink/proto:aes_gcm_proto",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "aes_ctr_hmac_aead_key_manager_test.cc",
+  ]
+  testonly = true
+}
+
diff --git a/cc/aead/CMakeLists.txt b/cc/aead/CMakeLists.txt
new file mode 100644
index 0000000..c4ac266
--- /dev/null
+++ b/cc/aead/CMakeLists.txt
@@ -0,0 +1,257 @@
+# Copyright 2019 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+
+# CC Library : aead_wrapper
+add_library(tink_cc_aead_aead_wrapper aead_wrapper.h aead_wrapper.cc)
+tink_export_hdrs(aead_wrapper.h)
+add_dependencies(
+  tink_cc_aead_aead_wrapper
+  tink_cc_aead
+  tink_cc_crypto_format
+  tink_cc_primitive_set
+  tink_cc_primitive_wrapper
+  tink_cc_registry
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_proto_tink_lib
+)
+target_link_libraries(
+  tink_cc_aead_aead_wrapper
+  tink_cc_aead
+  tink_cc_crypto_format
+  tink_cc_primitive_set
+  tink_cc_primitive_wrapper
+  tink_cc_registry
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_proto_tink_lib
+  absl::strings
+)
+
+# CC Library : aead_catalogue
+add_library(tink_cc_aead_aead_catalogue aead_catalogue.h aead_catalogue.cc)
+tink_export_hdrs(aead_catalogue.h)
+add_dependencies(
+  tink_cc_aead_aead_catalogue
+  tink_cc_aead_aes_ctr_hmac_aead_key_manager
+  tink_cc_aead_aes_eax_key_manager
+  tink_cc_aead_aes_gcm_key_manager
+  tink_cc_aead_xchacha20_poly1305_key_manager
+  tink_cc_aead
+  tink_cc_catalogue
+  tink_cc_key_manager
+  tink_cc_util_status
+)
+target_link_libraries(
+  tink_cc_aead_aead_catalogue
+  tink_cc_aead_aes_ctr_hmac_aead_key_manager
+  tink_cc_aead_aes_eax_key_manager
+  tink_cc_aead_aes_gcm_key_manager
+  tink_cc_aead_xchacha20_poly1305_key_manager
+  tink_cc_aead
+  tink_cc_catalogue
+  tink_cc_key_manager
+  tink_cc_util_status
+)
+
+# CC Library : aead_config
+add_library(tink_cc_aead_aead_config aead_config.h aead_config.cc)
+tink_export_hdrs(aead_config.h)
+add_dependencies(
+  tink_cc_aead_aead_config
+  tink_cc_aead_aead_catalogue
+  tink_cc_aead_aead_wrapper
+  tink_cc_config
+  tink_cc_mac_mac_config
+  tink_cc_util_status
+  tink_proto_config_lib
+)
+target_link_libraries(
+  tink_cc_aead_aead_config
+  tink_cc_aead_aead_catalogue
+  tink_cc_aead_aead_wrapper
+  tink_cc_config
+  tink_cc_mac_mac_config
+  tink_cc_util_status
+  tink_proto_config_lib
+  absl::memory
+)
+
+# CC Library : aes_eax_key_manager
+add_library(
+  tink_cc_aead_aes_eax_key_manager
+  aes_eax_key_manager.h
+  aes_eax_key_manager.cc
+)
+tink_export_hdrs(aes_eax_key_manager.h)
+add_dependencies(
+  tink_cc_aead_aes_eax_key_manager
+  tink_cc_aead
+  tink_cc_key_manager
+  tink_cc_core_key_manager_base
+  tink_cc_subtle_aes_eax_boringssl
+  tink_cc_subtle_random
+  tink_cc_util_errors
+  tink_cc_util_protobuf_helper
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_cc_util_validation
+  tink_proto_aes_eax_lib
+  tink_proto_common_lib
+  tink_proto_tink_lib
+)
+target_link_libraries(
+  tink_cc_aead_aes_eax_key_manager
+  tink_cc_aead
+  tink_cc_key_manager
+  tink_cc_core_key_manager_base
+  tink_cc_subtle_aes_eax_boringssl
+  tink_cc_subtle_random
+  tink_cc_util_errors
+  tink_cc_util_protobuf_helper
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_cc_util_validation
+  tink_proto_aes_eax_lib
+  tink_proto_common_lib
+  tink_proto_tink_lib
+  absl::base
+)
+
+# CC Library : aes_gcm_key_manager
+add_library(
+  tink_cc_aead_aes_gcm_key_manager
+  aes_gcm_key_manager.h
+  aes_gcm_key_manager.cc
+)
+tink_export_hdrs(aes_gcm_key_manager.h)
+add_dependencies(
+  tink_cc_aead_aes_gcm_key_manager
+  tink_cc_aead
+  tink_cc_key_manager
+  tink_cc_core_key_manager_base
+  tink_cc_subtle_aes_gcm_boringssl
+  tink_cc_subtle_random
+  tink_cc_util_errors
+  tink_cc_util_protobuf_helper
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_cc_util_validation
+  tink_proto_aes_gcm_lib
+  tink_proto_common_lib
+  tink_proto_tink_lib
+)
+target_link_libraries(
+  tink_cc_aead_aes_gcm_key_manager
+  tink_cc_aead
+  tink_cc_key_manager
+  tink_cc_core_key_manager_base
+  tink_cc_subtle_aes_gcm_boringssl
+  tink_cc_subtle_random
+  tink_cc_util_errors
+  tink_cc_util_protobuf_helper
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_cc_util_validation
+  tink_proto_aes_gcm_lib
+  tink_proto_common_lib
+  tink_proto_tink_lib
+  absl::base
+)
+
+# CC Library : aes_ctr_hmac_aead_key_manager
+add_library(
+  tink_cc_aead_aes_ctr_hmac_aead_key_manager
+  aes_ctr_hmac_aead_key_manager.h
+  aes_ctr_hmac_aead_key_manager.cc
+)
+tink_export_hdrs(aes_ctr_hmac_aead_key_manager.h)
+add_dependencies(
+  tink_cc_aead_aes_ctr_hmac_aead_key_manager
+  tink_cc_aead
+  tink_cc_key_manager
+  tink_cc_core_key_manager_base
+  tink_cc_mac
+  tink_cc_registry
+  tink_cc_subtle_aes_ctr_boringssl
+  tink_cc_subtle_encrypt_then_authenticate
+  tink_cc_subtle_hmac_boringssl
+  tink_cc_subtle_random
+  tink_cc_util_enums
+  tink_cc_util_errors
+  tink_cc_util_protobuf_helper
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_cc_util_validation
+  tink_proto_aes_ctr_hmac_aead_lib
+  tink_proto_common_lib
+  tink_proto_tink_lib
+)
+target_link_libraries(
+  tink_cc_aead_aes_ctr_hmac_aead_key_manager
+  tink_cc_aead
+  tink_cc_key_manager
+  tink_cc_core_key_manager_base
+  tink_cc_mac
+  tink_cc_registry
+  tink_cc_subtle_aes_ctr_boringssl
+  tink_cc_subtle_encrypt_then_authenticate
+  tink_cc_subtle_hmac_boringssl
+  tink_cc_subtle_random
+  tink_cc_util_enums
+  tink_cc_util_errors
+  tink_cc_util_protobuf_helper
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_cc_util_validation
+  tink_proto_aes_ctr_hmac_aead_lib
+  tink_proto_common_lib
+  tink_proto_tink_lib
+  absl::base
+)
+
+# CC Library : xchacha20_poly1305_key_manager
+add_library(
+  tink_cc_aead_xchacha20_poly1305_key_manager
+  xchacha20_poly1305_key_manager.h
+  xchacha20_poly1305_key_manager.cc
+)
+tink_export_hdrs(xchacha20_poly1305_key_manager.h)
+add_dependencies(
+  tink_cc_aead_xchacha20_poly1305_key_manager
+  tink_cc_aead
+  tink_cc_key_manager
+  tink_cc_core_key_manager_base
+  tink_cc_subtle_random
+  tink_cc_subtle_xchacha20_poly1305_boringssl
+  tink_cc_util_errors
+  tink_cc_util_protobuf_helper
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_cc_util_validation
+  tink_proto_empty_lib
+  tink_proto_tink_lib
+  tink_proto_xchacha20_poly1305_lib
+)
+target_link_libraries(
+  tink_cc_aead_xchacha20_poly1305_key_manager
+  tink_cc_aead
+  tink_cc_key_manager
+  tink_cc_core_key_manager_base
+  tink_cc_subtle_random
+  tink_cc_subtle_xchacha20_poly1305_boringssl
+  tink_cc_util_errors
+  tink_cc_util_protobuf_helper
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_cc_util_validation
+  tink_proto_empty_lib
+  tink_proto_tink_lib
+  tink_proto_xchacha20_poly1305_lib
+  absl::strings
+)
+
diff --git a/cc/config/BUILD.gn b/cc/config/BUILD.gn
new file mode 100644
index 0000000..cab6a66
--- /dev/null
+++ b/cc/config/BUILD.gn
@@ -0,0 +1,63 @@
+# Copyright 2018 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+copy("tink_config_copyfiles") {
+  outputs = [
+    "$target_gen_dir/../include/tink/config/{{source_file_part}}",
+  ]
+  sources = [
+    "tink_config.h",
+  ]
+}
+
+source_set("tink_config") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_config_tink_config_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/cc:config",
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc/hybrid:hybrid_config",
+    "//third_party/tink/cc/signature:signature_config",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/proto:config_proto",
+    ":tink_config_copyfiles",
+  ]
+  sources = [
+    "tink_config.cc",
+    "tink_config.h",
+  ]
+  testonly = false
+}
+
+executable("tink_config_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_config_tink_config_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":tink_config",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:catalogue",
+    "//third_party/tink/cc:config",
+    "//third_party/tink/cc:hybrid_decrypt",
+    "//third_party/tink/cc:hybrid_encrypt",
+    "//third_party/tink/cc:mac",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/util:status",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "tink_config_test.cc",
+  ]
+  testonly = true
+}
+
diff --git a/cc/core/CMakeLists.txt b/cc/core/CMakeLists.txt
new file mode 100644
index 0000000..2915aa0
--- /dev/null
+++ b/cc/core/CMakeLists.txt
@@ -0,0 +1,67 @@
+# Copyright 2019 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+
+# CC Library : registry_impl
+add_library(tink_cc_core_registry_impl registry_impl.h registry_impl.cc)
+tink_export_hdrs(registry_impl.h)
+add_dependencies(
+  tink_cc_core_registry_impl
+  tink_cc_catalogue
+  tink_cc_key_manager
+  tink_cc_primitive_set
+  tink_cc_primitive_wrapper
+  tink_cc_util_errors
+  tink_cc_util_protobuf_helper
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_cc_util_validation
+  tink_proto_tink_lib
+)
+target_link_libraries(
+  tink_cc_core_registry_impl
+  tink_cc_catalogue
+  tink_cc_key_manager
+  tink_cc_primitive_set
+  tink_cc_primitive_wrapper
+  tink_cc_util_errors
+  tink_cc_util_protobuf_helper
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_cc_util_validation
+  tink_proto_tink_lib
+  absl::base
+  absl::strings
+  absl::synchronization
+)
+
+# CC Library : key_manager_base
+add_library(tink_cc_core_key_manager_base key_manager_base.h)
+set_target_properties(
+  tink_cc_core_key_manager_base
+  PROPERTIES
+  LINKER_LANGUAGE
+  CXX
+)
+tink_export_hdrs(key_manager_base.h)
+add_dependencies(
+  tink_cc_core_key_manager_base
+  tink_cc_key_manager
+  tink_cc_util_constants
+  tink_cc_util_errors
+  tink_cc_util_statusor
+  tink_proto_tink_lib
+)
+target_link_libraries(
+  tink_cc_core_key_manager_base
+  tink_cc_key_manager
+  tink_cc_util_constants
+  tink_cc_util_errors
+  tink_cc_util_statusor
+  tink_proto_tink_lib
+  absl::base
+  absl::memory
+  absl::strings
+)
+
diff --git a/cc/daead/CMakeLists.txt b/cc/daead/CMakeLists.txt
new file mode 100644
index 0000000..2bb5738
--- /dev/null
+++ b/cc/daead/CMakeLists.txt
@@ -0,0 +1,36 @@
+# Copyright 2019 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+
+# CC Library : deterministic_aead_wrapper
+add_library(
+  tink_cc_daead_deterministic_aead_wrapper
+  deterministic_aead_wrapper.h
+  deterministic_aead_wrapper.cc
+)
+tink_export_hdrs(deterministic_aead_wrapper.h)
+add_dependencies(
+  tink_cc_daead_deterministic_aead_wrapper
+  tink_cc_crypto_format
+  tink_cc_deterministic_aead
+  tink_cc_primitive_set
+  tink_cc_primitive_wrapper
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_proto_tink_lib
+)
+target_link_libraries(
+  tink_cc_daead_deterministic_aead_wrapper
+  tink_cc_crypto_format
+  tink_cc_deterministic_aead
+  tink_cc_primitive_set
+  tink_cc_primitive_wrapper
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_proto_tink_lib
+  absl::strings
+)
+
diff --git a/cc/hybrid/BUILD.gn b/cc/hybrid/BUILD.gn
new file mode 100644
index 0000000..6c6097f
--- /dev/null
+++ b/cc/hybrid/BUILD.gn
@@ -0,0 +1,683 @@
+# Copyright 2018 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+copy("tink_hybrid_copyfiles") {
+  outputs = [
+    "$target_gen_dir/../include/tink/hybrid/{{source_file_part}}",
+  ]
+  sources = [
+    "ecies_aead_hkdf_dem_helper.h",
+    "ecies_aead_hkdf_hybrid_decrypt.h",
+    "ecies_aead_hkdf_hybrid_encrypt.h",
+    "ecies_aead_hkdf_private_key_manager.h",
+    "ecies_aead_hkdf_public_key_manager.h",
+    "hybrid_config.h",
+    "hybrid_decrypt_catalogue.h",
+    "hybrid_decrypt_factory.h",
+    "hybrid_decrypt_set_wrapper.h",
+    "hybrid_encrypt_catalogue.h",
+    "hybrid_encrypt_factory.h",
+    "hybrid_encrypt_set_wrapper.h",
+    "hybrid_key_templates.h",
+  ]
+}
+
+source_set("hybrid_config") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_hybrid_hybrid_config_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":hybrid_decrypt_catalogue",
+    ":hybrid_encrypt_catalogue",
+    "//third_party/tink/cc:config",
+    "//third_party/tink/cc/aead:aead_config",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/proto:config_proto",
+    ":tink_hybrid_copyfiles",
+  ]
+  sources = [
+    "hybrid_config.cc",
+    "hybrid_config.h",
+  ]
+  testonly = false
+}
+
+source_set("hybrid_decrypt_set_wrapper") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_hybrid_hybrid_decrypt_set_wrapper_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/cc:crypto_format",
+    "//third_party/tink/cc:hybrid_decrypt",
+    "//third_party/tink/cc:primitive_set",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/subtle:subtle_util_boringssl",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_hybrid_copyfiles",
+  ]
+  sources = [
+    "hybrid_decrypt_set_wrapper.cc",
+    "hybrid_decrypt_set_wrapper.h",
+  ]
+  testonly = false
+}
+
+source_set("hybrid_encrypt_set_wrapper") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_hybrid_hybrid_encrypt_set_wrapper_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/cc:crypto_format",
+    "//third_party/tink/cc:hybrid_encrypt",
+    "//third_party/tink/cc:primitive_set",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/subtle:subtle_util_boringssl",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_hybrid_copyfiles",
+  ]
+  sources = [
+    "hybrid_encrypt_set_wrapper.cc",
+    "hybrid_encrypt_set_wrapper.h",
+  ]
+  testonly = false
+}
+
+source_set("hybrid_decrypt_catalogue") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_hybrid_hybrid_decrypt_catalogue_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":ecies_aead_hkdf_private_key_manager",
+    "//third_party/tink/cc:catalogue",
+    "//third_party/tink/cc:hybrid_decrypt",
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    ":tink_hybrid_copyfiles",
+  ]
+  sources = [
+    "hybrid_decrypt_catalogue.cc",
+    "hybrid_decrypt_catalogue.h",
+  ]
+  testonly = false
+}
+
+source_set("hybrid_decrypt_factory") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_hybrid_hybrid_decrypt_factory_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":hybrid_decrypt_set_wrapper",
+    "//third_party/tink/cc:hybrid_decrypt",
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc:keyset_handle",
+    "//third_party/tink/cc:primitive_set",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    ":tink_hybrid_copyfiles",
+  ]
+  sources = [
+    "hybrid_decrypt_factory.cc",
+    "hybrid_decrypt_factory.h",
+  ]
+  testonly = false
+}
+
+source_set("hybrid_encrypt_catalogue") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_hybrid_hybrid_encrypt_catalogue_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":ecies_aead_hkdf_public_key_manager",
+    "//third_party/tink/cc:catalogue",
+    "//third_party/tink/cc:hybrid_encrypt",
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    ":tink_hybrid_copyfiles",
+  ]
+  sources = [
+    "hybrid_encrypt_catalogue.cc",
+    "hybrid_encrypt_catalogue.h",
+  ]
+  testonly = false
+}
+
+source_set("hybrid_encrypt_factory") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_hybrid_hybrid_encrypt_factory_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":hybrid_encrypt_set_wrapper",
+    "//third_party/tink/cc:hybrid_encrypt",
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc:keyset_handle",
+    "//third_party/tink/cc:primitive_set",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    ":tink_hybrid_copyfiles",
+  ]
+  sources = [
+    "hybrid_encrypt_factory.cc",
+    "hybrid_encrypt_factory.h",
+  ]
+  testonly = false
+}
+
+source_set("hybrid_key_templates") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_hybrid_hybrid_key_templates_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/cc/aead:aead_key_templates",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:ecies_aead_hkdf_proto",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_hybrid_copyfiles",
+  ]
+  sources = [
+    "hybrid_key_templates.cc",
+    "hybrid_key_templates.h",
+  ]
+  testonly = false
+}
+
+source_set("ecies_aead_hkdf_dem_helper") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_hybrid_ecies_aead_hkdf_dem_helper_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/proto:aes_ctr_hmac_aead_proto",
+    "//third_party/tink/proto:aes_gcm_proto",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/abseil-cpp/absl/memory",
+    ":tink_hybrid_copyfiles",
+  ]
+  sources = [
+    "ecies_aead_hkdf_dem_helper.cc",
+    "ecies_aead_hkdf_dem_helper.h",
+  ]
+  testonly = false
+}
+
+source_set("ecies_aead_hkdf_hybrid_decrypt") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_hybrid_ecies_aead_hkdf_hybrid_decrypt_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":ecies_aead_hkdf_dem_helper",
+    "//third_party/tink/cc:hybrid_decrypt",
+    "//third_party/tink/cc/subtle:ec_util",
+    "//third_party/tink/cc/subtle:ecies_hkdf_recipient_kem_boringssl",
+    "//third_party/tink/cc/util:enums",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:ecies_aead_hkdf_proto",
+    "//third_party/tink/proto:tink_proto",
+    ":tink_hybrid_copyfiles",
+  ]
+  sources = [
+    "ecies_aead_hkdf_hybrid_decrypt.cc",
+    "ecies_aead_hkdf_hybrid_decrypt.h",
+  ]
+  testonly = false
+}
+
+source_set("ecies_aead_hkdf_hybrid_encrypt") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_hybrid_ecies_aead_hkdf_hybrid_encrypt_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":ecies_aead_hkdf_dem_helper",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:hybrid_encrypt",
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/subtle:ecies_hkdf_sender_kem_boringssl",
+    "//third_party/tink/cc/util:enums",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:ecies_aead_hkdf_proto",
+    "//third_party/tink/proto:tink_proto",
+    ":tink_hybrid_copyfiles",
+  ]
+  sources = [
+    "ecies_aead_hkdf_hybrid_encrypt.cc",
+    "ecies_aead_hkdf_hybrid_encrypt.h",
+  ]
+  testonly = false
+}
+
+source_set("ecies_aead_hkdf_private_key_manager") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_hybrid_ecies_aead_hkdf_private_key_manager_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":ecies_aead_hkdf_hybrid_decrypt",
+    ":ecies_aead_hkdf_public_key_manager",
+    "//third_party/tink/cc:hybrid_decrypt",
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc/subtle:subtle_util_boringssl",
+    "//third_party/tink/cc/util:enums",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/proto:ecies_aead_hkdf_proto",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/abseil-cpp/absl/memory",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_hybrid_copyfiles",
+  ]
+  sources = [
+    "ecies_aead_hkdf_private_key_manager.cc",
+    "ecies_aead_hkdf_private_key_manager.h",
+  ]
+  testonly = false
+}
+
+source_set("ecies_aead_hkdf_public_key_manager") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_hybrid_ecies_aead_hkdf_public_key_manager_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":ecies_aead_hkdf_hybrid_encrypt",
+    "//third_party/tink/cc:hybrid_encrypt",
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:ecies_aead_hkdf_proto",
+    "//third_party/tink/proto:tink_proto",
+    ":tink_hybrid_copyfiles",
+  ]
+  sources = [
+    "ecies_aead_hkdf_public_key_manager.cc",
+    "ecies_aead_hkdf_public_key_manager.h",
+  ]
+  testonly = false
+}
+
+executable("hybrid_config_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_hybrid_hybrid_config_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":hybrid_config",
+    "//third_party/tink/cc:catalogue",
+    "//third_party/tink/cc:config",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/util:status",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "hybrid_config_test.cc",
+  ]
+  testonly = true
+}
+
+executable("hybrid_decrypt_set_wrapper_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_hybrid_hybrid_decrypt_set_wrapper_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":hybrid_decrypt_set_wrapper",
+    "//third_party/tink/cc:hybrid_decrypt",
+    "//third_party/tink/cc:primitive_set",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "hybrid_decrypt_set_wrapper_test.cc",
+  ]
+  testonly = true
+}
+
+executable("hybrid_encrypt_set_wrapper_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_hybrid_hybrid_encrypt_set_wrapper_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":hybrid_encrypt_set_wrapper",
+    "//third_party/tink/cc:hybrid_encrypt",
+    "//third_party/tink/cc:primitive_set",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "hybrid_encrypt_set_wrapper_test.cc",
+  ]
+  testonly = true
+}
+
+executable("hybrid_decrypt_catalogue_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_hybrid_hybrid_decrypt_catalogue_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":hybrid_decrypt_catalogue",
+    "//third_party/tink/cc:catalogue",
+    "//third_party/tink/cc:hybrid_decrypt",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "hybrid_decrypt_catalogue_test.cc",
+  ]
+  testonly = true
+}
+
+executable("hybrid_decrypt_factory_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_hybrid_hybrid_decrypt_factory_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":ecies_aead_hkdf_public_key_manager",
+    ":hybrid_config",
+    ":hybrid_decrypt_factory",
+    "//third_party/tink/cc:config",
+    "//third_party/tink/cc:hybrid_decrypt",
+    "//third_party/tink/cc:hybrid_encrypt",
+    "//third_party/tink/cc:keyset_handle",
+    "//third_party/tink/cc/util:keyset_util",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/tink/proto:ecies_aead_hkdf_proto",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/abseil-cpp/absl/memory",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "hybrid_decrypt_factory_test.cc",
+  ]
+  testonly = true
+}
+
+executable("hybrid_encrypt_catalogue_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_hybrid_hybrid_encrypt_catalogue_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":hybrid_encrypt_catalogue",
+    "//third_party/tink/cc:catalogue",
+    "//third_party/tink/cc:hybrid_encrypt",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "hybrid_encrypt_catalogue_test.cc",
+  ]
+  testonly = true
+}
+
+executable("hybrid_encrypt_factory_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_hybrid_hybrid_encrypt_factory_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":hybrid_config",
+    ":hybrid_encrypt_factory",
+    "//third_party/tink/cc:config",
+    "//third_party/tink/cc:hybrid_encrypt",
+    "//third_party/tink/cc:keyset_handle",
+    "//third_party/tink/cc/util:keyset_util",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/tink/proto:ecies_aead_hkdf_proto",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "hybrid_encrypt_factory_test.cc",
+  ]
+  testonly = true
+}
+
+executable("hybrid_key_templates_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_hybrid_hybrid_key_templates_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":ecies_aead_hkdf_private_key_manager",
+    ":hybrid_config",
+    ":hybrid_key_templates",
+    "//third_party/tink/cc/aead:aead_key_templates",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:ecies_aead_hkdf_proto",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "hybrid_key_templates_test.cc",
+  ]
+  testonly = true
+}
+
+executable("ecies_aead_hkdf_hybrid_decrypt_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_hybrid_ecies_aead_hkdf_hybrid_decrypt_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":ecies_aead_hkdf_hybrid_decrypt",
+    ":ecies_aead_hkdf_hybrid_encrypt",
+    "//third_party/tink/cc:hybrid_decrypt",
+    "//third_party/tink/cc/aead:aes_gcm_key_manager",
+    "//third_party/tink/cc/subtle:random",
+    "//third_party/tink/cc/subtle:subtle_util_boringssl",
+    "//third_party/tink/cc/util:enums",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:ecies_aead_hkdf_proto",
+    "//third_party/abseil-cpp/absl/memory",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "ecies_aead_hkdf_hybrid_decrypt_test.cc",
+  ]
+  testonly = true
+}
+
+executable("ecies_aead_hkdf_hybrid_encrypt_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_hybrid_ecies_aead_hkdf_hybrid_encrypt_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":ecies_aead_hkdf_hybrid_encrypt",
+    "//third_party/tink/cc:hybrid_encrypt",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/aead:aes_gcm_key_manager",
+    "//third_party/tink/cc/subtle:random",
+    "//third_party/tink/cc/subtle:subtle_util_boringssl",
+    "//third_party/tink/cc/util:enums",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:ecies_aead_hkdf_proto",
+    "//third_party/abseil-cpp/absl/memory",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "ecies_aead_hkdf_hybrid_encrypt_test.cc",
+  ]
+  testonly = true
+}
+
+executable("ecies_aead_hkdf_private_key_manager_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_hybrid_ecies_aead_hkdf_private_key_manager_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":ecies_aead_hkdf_private_key_manager",
+    ":ecies_aead_hkdf_public_key_manager",
+    ":hybrid_key_templates",
+    "//third_party/tink/cc:hybrid_decrypt",
+    "//third_party/tink/cc/aead:aead_key_templates",
+    "//third_party/tink/cc/aead:aes_ctr_hmac_aead_key_manager",
+    "//third_party/tink/cc/aead:aes_gcm_key_manager",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/tink/proto:aes_eax_proto",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:ecies_aead_hkdf_proto",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "ecies_aead_hkdf_private_key_manager_test.cc",
+  ]
+  testonly = true
+}
+
+executable("ecies_aead_hkdf_public_key_manager_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_hybrid_ecies_aead_hkdf_public_key_manager_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":ecies_aead_hkdf_public_key_manager",
+    "//third_party/tink/cc:hybrid_encrypt",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/aead:aes_gcm_key_manager",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/tink/proto:aes_eax_proto",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:ecies_aead_hkdf_proto",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "ecies_aead_hkdf_public_key_manager_test.cc",
+  ]
+  testonly = true
+}
+
diff --git a/cc/hybrid/CMakeLists.txt b/cc/hybrid/CMakeLists.txt
new file mode 100644
index 0000000..d4875cb
--- /dev/null
+++ b/cc/hybrid/CMakeLists.txt
@@ -0,0 +1,391 @@
+# Copyright 2019 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+
+# CC Library : hybrid_config
+add_library(tink_cc_hybrid_hybrid_config hybrid_config.h hybrid_config.cc)
+tink_export_hdrs(hybrid_config.h)
+add_dependencies(
+  tink_cc_hybrid_hybrid_config
+  tink_cc_hybrid_hybrid_decrypt_catalogue
+  tink_cc_hybrid_hybrid_encrypt_catalogue
+  tink_cc_config
+  tink_cc_aead_aead_config
+  tink_cc_util_status
+  tink_proto_config_lib
+)
+target_link_libraries(
+  tink_cc_hybrid_hybrid_config
+  tink_cc_hybrid_hybrid_decrypt_catalogue
+  tink_cc_hybrid_hybrid_encrypt_catalogue
+  tink_cc_config
+  tink_cc_aead_aead_config
+  tink_cc_util_status
+  tink_proto_config_lib
+  absl::memory
+)
+
+# CC Library : hybrid_decrypt_wrapper
+add_library(
+  tink_cc_hybrid_hybrid_decrypt_wrapper
+  hybrid_decrypt_wrapper.h
+  hybrid_decrypt_wrapper.cc
+)
+tink_export_hdrs(hybrid_decrypt_wrapper.h)
+add_dependencies(
+  tink_cc_hybrid_hybrid_decrypt_wrapper
+  tink_cc_crypto_format
+  tink_cc_hybrid_decrypt
+  tink_cc_primitive_set
+  tink_cc_primitive_wrapper
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_proto_tink_lib
+)
+target_link_libraries(
+  tink_cc_hybrid_hybrid_decrypt_wrapper
+  tink_cc_crypto_format
+  tink_cc_hybrid_decrypt
+  tink_cc_primitive_set
+  tink_cc_primitive_wrapper
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_proto_tink_lib
+  absl::strings
+)
+
+# CC Library : hybrid_encrypt_wrapper
+add_library(
+  tink_cc_hybrid_hybrid_encrypt_wrapper
+  hybrid_encrypt_wrapper.h
+  hybrid_encrypt_wrapper.cc
+)
+tink_export_hdrs(hybrid_encrypt_wrapper.h)
+add_dependencies(
+  tink_cc_hybrid_hybrid_encrypt_wrapper
+  tink_cc_crypto_format
+  tink_cc_hybrid_encrypt
+  tink_cc_primitive_set
+  tink_cc_primitive_wrapper
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_proto_tink_lib
+)
+target_link_libraries(
+  tink_cc_hybrid_hybrid_encrypt_wrapper
+  tink_cc_crypto_format
+  tink_cc_hybrid_encrypt
+  tink_cc_primitive_set
+  tink_cc_primitive_wrapper
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_proto_tink_lib
+  absl::strings
+)
+
+# CC Library : hybrid_decrypt_catalogue
+add_library(
+  tink_cc_hybrid_hybrid_decrypt_catalogue
+  hybrid_decrypt_catalogue.h
+  hybrid_decrypt_catalogue.cc
+)
+tink_export_hdrs(hybrid_decrypt_catalogue.h)
+add_dependencies(
+  tink_cc_hybrid_hybrid_decrypt_catalogue
+  tink_cc_hybrid_ecies_aead_hkdf_private_key_manager
+  tink_cc_catalogue
+  tink_cc_hybrid_decrypt
+  tink_cc_key_manager
+  tink_cc_util_status
+  tink_cc_util_statusor
+)
+target_link_libraries(
+  tink_cc_hybrid_hybrid_decrypt_catalogue
+  tink_cc_hybrid_ecies_aead_hkdf_private_key_manager
+  tink_cc_catalogue
+  tink_cc_hybrid_decrypt
+  tink_cc_key_manager
+  tink_cc_util_status
+  tink_cc_util_statusor
+)
+
+# CC Library : hybrid_decrypt_factory
+add_library(
+  tink_cc_hybrid_hybrid_decrypt_factory
+  hybrid_decrypt_factory.h
+  hybrid_decrypt_factory.cc
+)
+tink_export_hdrs(hybrid_decrypt_factory.h)
+add_dependencies(
+  tink_cc_hybrid_hybrid_decrypt_factory
+  tink_cc_hybrid_hybrid_decrypt_wrapper
+  tink_cc_hybrid_decrypt
+  tink_cc_key_manager
+  tink_cc_keyset_handle
+  tink_cc_primitive_set
+  tink_cc_registry
+  tink_cc_util_status
+  tink_cc_util_statusor
+)
+target_link_libraries(
+  tink_cc_hybrid_hybrid_decrypt_factory
+  tink_cc_hybrid_hybrid_decrypt_wrapper
+  tink_cc_hybrid_decrypt
+  tink_cc_key_manager
+  tink_cc_keyset_handle
+  tink_cc_primitive_set
+  tink_cc_registry
+  tink_cc_util_status
+  tink_cc_util_statusor
+  absl::base
+)
+
+# CC Library : hybrid_encrypt_catalogue
+add_library(
+  tink_cc_hybrid_hybrid_encrypt_catalogue
+  hybrid_encrypt_catalogue.h
+  hybrid_encrypt_catalogue.cc
+)
+tink_export_hdrs(hybrid_encrypt_catalogue.h)
+add_dependencies(
+  tink_cc_hybrid_hybrid_encrypt_catalogue
+  tink_cc_hybrid_ecies_aead_hkdf_public_key_manager
+  tink_cc_catalogue
+  tink_cc_hybrid_encrypt
+  tink_cc_key_manager
+  tink_cc_util_status
+  tink_cc_util_statusor
+)
+target_link_libraries(
+  tink_cc_hybrid_hybrid_encrypt_catalogue
+  tink_cc_hybrid_ecies_aead_hkdf_public_key_manager
+  tink_cc_catalogue
+  tink_cc_hybrid_encrypt
+  tink_cc_key_manager
+  tink_cc_util_status
+  tink_cc_util_statusor
+)
+
+# CC Library : hybrid_encrypt_factory
+add_library(
+  tink_cc_hybrid_hybrid_encrypt_factory
+  hybrid_encrypt_factory.h
+  hybrid_encrypt_factory.cc
+)
+tink_export_hdrs(hybrid_encrypt_factory.h)
+add_dependencies(
+  tink_cc_hybrid_hybrid_encrypt_factory
+  tink_cc_hybrid_hybrid_encrypt_wrapper
+  tink_cc_hybrid_encrypt
+  tink_cc_key_manager
+  tink_cc_keyset_handle
+  tink_cc_primitive_set
+  tink_cc_registry
+  tink_cc_util_status
+  tink_cc_util_statusor
+)
+target_link_libraries(
+  tink_cc_hybrid_hybrid_encrypt_factory
+  tink_cc_hybrid_hybrid_encrypt_wrapper
+  tink_cc_hybrid_encrypt
+  tink_cc_key_manager
+  tink_cc_keyset_handle
+  tink_cc_primitive_set
+  tink_cc_registry
+  tink_cc_util_status
+  tink_cc_util_statusor
+  absl::base
+)
+
+# CC Library : ecies_aead_hkdf_dem_helper
+add_library(
+  tink_cc_hybrid_ecies_aead_hkdf_dem_helper
+  ecies_aead_hkdf_dem_helper.h
+  ecies_aead_hkdf_dem_helper.cc
+)
+tink_export_hdrs(ecies_aead_hkdf_dem_helper.h)
+add_dependencies(
+  tink_cc_hybrid_ecies_aead_hkdf_dem_helper
+  tink_cc_aead
+  tink_cc_key_manager
+  tink_cc_registry
+  tink_cc_util_protobuf_helper
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_proto_aes_ctr_hmac_aead_lib
+  tink_proto_aes_gcm_lib
+  tink_proto_common_lib
+  tink_proto_tink_lib
+)
+target_link_libraries(
+  tink_cc_hybrid_ecies_aead_hkdf_dem_helper
+  tink_cc_aead
+  tink_cc_key_manager
+  tink_cc_registry
+  tink_cc_util_protobuf_helper
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_proto_aes_ctr_hmac_aead_lib
+  tink_proto_aes_gcm_lib
+  tink_proto_common_lib
+  tink_proto_tink_lib
+  absl::memory
+)
+
+# CC Library : ecies_aead_hkdf_hybrid_decrypt
+add_library(
+  tink_cc_hybrid_ecies_aead_hkdf_hybrid_decrypt
+  ecies_aead_hkdf_hybrid_decrypt.h
+  ecies_aead_hkdf_hybrid_decrypt.cc
+)
+tink_export_hdrs(ecies_aead_hkdf_hybrid_decrypt.h)
+add_dependencies(
+  tink_cc_hybrid_ecies_aead_hkdf_hybrid_decrypt
+  tink_cc_hybrid_ecies_aead_hkdf_dem_helper
+  tink_cc_hybrid_decrypt
+  tink_cc_subtle_ec_util
+  tink_cc_subtle_ecies_hkdf_recipient_kem_boringssl
+  tink_cc_util_enums
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_proto_common_lib
+  tink_proto_ecies_aead_hkdf_lib
+  tink_proto_tink_lib
+)
+target_link_libraries(
+  tink_cc_hybrid_ecies_aead_hkdf_hybrid_decrypt
+  tink_cc_hybrid_ecies_aead_hkdf_dem_helper
+  tink_cc_hybrid_decrypt
+  tink_cc_subtle_ec_util
+  tink_cc_subtle_ecies_hkdf_recipient_kem_boringssl
+  tink_cc_util_enums
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_proto_common_lib
+  tink_proto_ecies_aead_hkdf_lib
+  tink_proto_tink_lib
+)
+
+# CC Library : ecies_aead_hkdf_hybrid_encrypt
+add_library(
+  tink_cc_hybrid_ecies_aead_hkdf_hybrid_encrypt
+  ecies_aead_hkdf_hybrid_encrypt.h
+  ecies_aead_hkdf_hybrid_encrypt.cc
+)
+tink_export_hdrs(ecies_aead_hkdf_hybrid_encrypt.h)
+add_dependencies(
+  tink_cc_hybrid_ecies_aead_hkdf_hybrid_encrypt
+  tink_cc_hybrid_ecies_aead_hkdf_dem_helper
+  tink_cc_aead
+  tink_cc_hybrid_encrypt
+  tink_cc_key_manager
+  tink_cc_registry
+  tink_cc_subtle_ecies_hkdf_sender_kem_boringssl
+  tink_cc_util_enums
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_proto_common_lib
+  tink_proto_ecies_aead_hkdf_lib
+  tink_proto_tink_lib
+)
+target_link_libraries(
+  tink_cc_hybrid_ecies_aead_hkdf_hybrid_encrypt
+  tink_cc_hybrid_ecies_aead_hkdf_dem_helper
+  tink_cc_aead
+  tink_cc_hybrid_encrypt
+  tink_cc_key_manager
+  tink_cc_registry
+  tink_cc_subtle_ecies_hkdf_sender_kem_boringssl
+  tink_cc_util_enums
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_proto_common_lib
+  tink_proto_ecies_aead_hkdf_lib
+  tink_proto_tink_lib
+)
+
+# CC Library : ecies_aead_hkdf_private_key_manager
+add_library(
+  tink_cc_hybrid_ecies_aead_hkdf_private_key_manager
+  ecies_aead_hkdf_private_key_manager.h
+  ecies_aead_hkdf_private_key_manager.cc
+)
+tink_export_hdrs(ecies_aead_hkdf_private_key_manager.h)
+add_dependencies(
+  tink_cc_hybrid_ecies_aead_hkdf_private_key_manager
+  tink_cc_hybrid_ecies_aead_hkdf_hybrid_decrypt
+  tink_cc_hybrid_ecies_aead_hkdf_public_key_manager
+  tink_cc_hybrid_decrypt
+  tink_cc_key_manager
+  tink_cc_core_key_manager_base
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_util_enums
+  tink_cc_util_errors
+  tink_cc_util_protobuf_helper
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_cc_util_validation
+  tink_proto_ecies_aead_hkdf_lib
+  tink_proto_tink_lib
+)
+target_link_libraries(
+  tink_cc_hybrid_ecies_aead_hkdf_private_key_manager
+  tink_cc_hybrid_ecies_aead_hkdf_hybrid_decrypt
+  tink_cc_hybrid_ecies_aead_hkdf_public_key_manager
+  tink_cc_hybrid_decrypt
+  tink_cc_key_manager
+  tink_cc_core_key_manager_base
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_util_enums
+  tink_cc_util_errors
+  tink_cc_util_protobuf_helper
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_cc_util_validation
+  tink_proto_ecies_aead_hkdf_lib
+  tink_proto_tink_lib
+  absl::memory
+  absl::strings
+)
+
+# CC Library : ecies_aead_hkdf_public_key_manager
+add_library(
+  tink_cc_hybrid_ecies_aead_hkdf_public_key_manager
+  ecies_aead_hkdf_public_key_manager.h
+  ecies_aead_hkdf_public_key_manager.cc
+)
+tink_export_hdrs(ecies_aead_hkdf_public_key_manager.h)
+add_dependencies(
+  tink_cc_hybrid_ecies_aead_hkdf_public_key_manager
+  tink_cc_hybrid_ecies_aead_hkdf_hybrid_encrypt
+  tink_cc_hybrid_encrypt
+  tink_cc_key_manager
+  tink_cc_core_key_manager_base
+  tink_cc_registry
+  tink_cc_util_protobuf_helper
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_proto_common_lib
+  tink_proto_ecies_aead_hkdf_lib
+  tink_proto_tink_lib
+)
+target_link_libraries(
+  tink_cc_hybrid_ecies_aead_hkdf_public_key_manager
+  tink_cc_hybrid_ecies_aead_hkdf_hybrid_encrypt
+  tink_cc_hybrid_encrypt
+  tink_cc_key_manager
+  tink_cc_core_key_manager_base
+  tink_cc_registry
+  tink_cc_util_protobuf_helper
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_proto_common_lib
+  tink_proto_ecies_aead_hkdf_lib
+  tink_proto_tink_lib
+)
+
diff --git a/cc/mac/BUILD.gn b/cc/mac/BUILD.gn
new file mode 100644
index 0000000..3c1cfc7
--- /dev/null
+++ b/cc/mac/BUILD.gn
@@ -0,0 +1,312 @@
+# Copyright 2018 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+copy("tink_mac_copyfiles") {
+  outputs = [
+    "$target_gen_dir/../include/tink/mac/{{source_file_part}}",
+  ]
+  sources = [
+    "hmac_key_manager.h",
+    "mac_catalogue.h",
+    "mac_config.h",
+    "mac_factory.h",
+    "mac_key_templates.h",
+    "mac_set_wrapper.h",
+  ]
+}
+
+source_set("mac_set_wrapper") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_mac_mac_set_wrapper_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/cc:crypto_format",
+    "//third_party/tink/cc:mac",
+    "//third_party/tink/cc:primitive_set",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/subtle:subtle_util_boringssl",
+    "//third_party/tink/proto:tink_proto",
+    ":tink_mac_copyfiles",
+  ]
+  sources = [
+    "mac_set_wrapper.cc",
+    "mac_set_wrapper.h",
+  ]
+  testonly = false
+}
+
+source_set("mac_config") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_mac_mac_config_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":mac_catalogue",
+    "//third_party/tink/cc:config",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/proto:config_proto",
+    ":tink_mac_copyfiles",
+  ]
+  sources = [
+    "mac_config.cc",
+    "mac_config.h",
+  ]
+  testonly = false
+}
+
+source_set("mac_catalogue") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_mac_mac_catalogue_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":hmac_key_manager",
+    "//third_party/tink/cc:catalogue",
+    "//third_party/tink/cc/util:status",
+    ":tink_mac_copyfiles",
+  ]
+  sources = [
+    "mac_catalogue.cc",
+    "mac_catalogue.h",
+  ]
+  testonly = false
+}
+
+source_set("mac_factory") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_mac_mac_factory_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":mac_set_wrapper",
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc:keyset_handle",
+    "//third_party/tink/cc:mac",
+    "//third_party/tink/cc:primitive_set",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    ":tink_mac_copyfiles",
+  ]
+  sources = [
+    "mac_factory.cc",
+    "mac_factory.h",
+  ]
+  testonly = false
+}
+
+source_set("mac_key_templates") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_mac_mac_key_templates_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:hmac_proto",
+    "//third_party/tink/proto:tink_proto",
+    ":tink_mac_copyfiles",
+  ]
+  sources = [
+    "mac_key_templates.cc",
+    "mac_key_templates.h",
+  ]
+  testonly = false
+}
+
+source_set("hmac_key_manager") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_mac_hmac_key_manager_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc:mac",
+    "//third_party/tink/cc/subtle:hmac_boringssl",
+    "//third_party/tink/cc/subtle:random",
+    "//third_party/tink/cc/util:enums",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:validation",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:hmac_proto",
+    "//third_party/tink/proto:tink_proto",
+    ":tink_mac_copyfiles",
+  ]
+  sources = [
+    "hmac_key_manager.cc",
+    "hmac_key_manager.h",
+  ]
+  testonly = false
+}
+
+executable("mac_set_wrapper_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_mac_mac_set_wrapper_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":mac_set_wrapper",
+    "//third_party/tink/cc:mac",
+    "//third_party/tink/cc:primitive_set",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "mac_set_wrapper_test.cc",
+  ]
+  testonly = true
+}
+
+executable("mac_catalogue_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_mac_mac_catalogue_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":mac_catalogue",
+    ":mac_config",
+    "//third_party/tink/cc:catalogue",
+    "//third_party/tink/cc:config",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "mac_catalogue_test.cc",
+  ]
+  testonly = true
+}
+
+executable("mac_config_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_mac_mac_config_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":mac_config",
+    "//third_party/tink/cc:catalogue",
+    "//third_party/tink/cc:config",
+    "//third_party/tink/cc:mac",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/util:status",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "mac_config_test.cc",
+  ]
+  testonly = true
+}
+
+executable("mac_factory_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_mac_mac_factory_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":mac_config",
+    ":mac_factory",
+    ":mac_set_wrapper",
+    "//third_party/tink/cc:config",
+    "//third_party/tink/cc:crypto_format",
+    "//third_party/tink/cc:keyset_handle",
+    "//third_party/tink/cc:mac",
+    "//third_party/tink/cc/mac:hmac_key_manager",
+    "//third_party/tink/cc/util:keyset_util",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:hmac_proto",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "mac_factory_test.cc",
+  ]
+  testonly = true
+}
+
+executable("mac_key_templates_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_mac_mac_key_templates_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":hmac_key_manager",
+    ":mac_key_templates",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:hmac_proto",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "mac_key_templates_test.cc",
+  ]
+  testonly = true
+}
+
+executable("hmac_key_manager_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_mac_hmac_key_manager_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":hmac_key_manager",
+    "//third_party/tink/cc:mac",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/proto:aes_ctr_proto",
+    "//third_party/tink/proto:aes_ctr_hmac_aead_proto",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:hmac_proto",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "hmac_key_manager_test.cc",
+  ]
+  testonly = true
+}
+
diff --git a/cc/mac/CMakeLists.txt b/cc/mac/CMakeLists.txt
new file mode 100644
index 0000000..6e28f9c
--- /dev/null
+++ b/cc/mac/CMakeLists.txt
@@ -0,0 +1,104 @@
+# Copyright 2019 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+
+# CC Library : mac_wrapper
+add_library(tink_cc_mac_mac_wrapper mac_wrapper.h mac_wrapper.cc)
+tink_export_hdrs(mac_wrapper.h)
+add_dependencies(
+  tink_cc_mac_mac_wrapper
+  tink_cc_crypto_format
+  tink_cc_mac
+  tink_cc_primitive_set
+  tink_cc_primitive_wrapper
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_proto_tink_lib
+)
+target_link_libraries(
+  tink_cc_mac_mac_wrapper
+  tink_cc_crypto_format
+  tink_cc_mac
+  tink_cc_primitive_set
+  tink_cc_primitive_wrapper
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_proto_tink_lib
+)
+
+# CC Library : mac_config
+add_library(tink_cc_mac_mac_config mac_config.h mac_config.cc)
+tink_export_hdrs(mac_config.h)
+add_dependencies(
+  tink_cc_mac_mac_config
+  tink_cc_mac_mac_catalogue
+  tink_cc_config
+  tink_cc_util_status
+  tink_proto_config_lib
+)
+target_link_libraries(
+  tink_cc_mac_mac_config
+  tink_cc_mac_mac_catalogue
+  tink_cc_config
+  tink_cc_util_status
+  tink_proto_config_lib
+  absl::memory
+)
+
+# CC Library : mac_catalogue
+add_library(tink_cc_mac_mac_catalogue mac_catalogue.h mac_catalogue.cc)
+tink_export_hdrs(mac_catalogue.h)
+add_dependencies(
+  tink_cc_mac_mac_catalogue
+  tink_cc_mac_hmac_key_manager
+  tink_cc_catalogue
+  tink_cc_util_status
+)
+target_link_libraries(
+  tink_cc_mac_mac_catalogue
+  tink_cc_mac_hmac_key_manager
+  tink_cc_catalogue
+  tink_cc_util_status
+)
+
+# CC Library : hmac_key_manager
+add_library(tink_cc_mac_hmac_key_manager hmac_key_manager.h hmac_key_manager.cc)
+tink_export_hdrs(hmac_key_manager.h)
+add_dependencies(
+  tink_cc_mac_hmac_key_manager
+  tink_cc_key_manager
+  tink_cc_core_key_manager_base
+  tink_cc_mac
+  tink_cc_subtle_hmac_boringssl
+  tink_cc_subtle_random
+  tink_cc_util_enums
+  tink_cc_util_errors
+  tink_cc_util_protobuf_helper
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_cc_util_validation
+  tink_proto_common_lib
+  tink_proto_hmac_lib
+  tink_proto_tink_lib
+)
+target_link_libraries(
+  tink_cc_mac_hmac_key_manager
+  tink_cc_key_manager
+  tink_cc_core_key_manager_base
+  tink_cc_mac
+  tink_cc_subtle_hmac_boringssl
+  tink_cc_subtle_random
+  tink_cc_util_enums
+  tink_cc_util_errors
+  tink_cc_util_protobuf_helper
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_cc_util_validation
+  tink_proto_common_lib
+  tink_proto_hmac_lib
+  tink_proto_tink_lib
+)
+
diff --git a/cc/signature/BUILD.gn b/cc/signature/BUILD.gn
new file mode 100644
index 0000000..404e212
--- /dev/null
+++ b/cc/signature/BUILD.gn
@@ -0,0 +1,599 @@
+# Copyright 2018 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+copy("tink_signature_copyfiles") {
+  outputs = [
+    "$target_gen_dir/../include/tink/signature/{{source_file_part}}",
+  ]
+  sources = [
+    "ecdsa_sign_key_manager.h",
+    "ecdsa_verify_key_manager.h",
+    "public_key_sign_catalogue.h",
+    "public_key_sign_factory.h",
+    "public_key_sign_set_wrapper.h",
+    "public_key_verify_catalogue.h",
+    "public_key_verify_factory.h",
+    "public_key_verify_set_wrapper.h",
+    "rsa_ssa_pss_verify_key_manager.h",
+    "signature_config.h",
+    "signature_key_templates.h",
+  ]
+}
+
+source_set("public_key_verify_set_wrapper") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_signature_public_key_verify_set_wrapper_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/cc:crypto_format",
+    "//third_party/tink/cc:primitive_set",
+    "//third_party/tink/cc:public_key_verify",
+    "//third_party/tink/cc/subtle:subtle_util_boringssl",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_signature_copyfiles",
+  ]
+  sources = [
+    "public_key_verify_set_wrapper.cc",
+    "public_key_verify_set_wrapper.h",
+  ]
+  testonly = false
+}
+
+source_set("public_key_verify_factory") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_signature_public_key_verify_factory_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":public_key_verify_set_wrapper",
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc:keyset_handle",
+    "//third_party/tink/cc:primitive_set",
+    "//third_party/tink/cc:public_key_verify",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    ":tink_signature_copyfiles",
+  ]
+  sources = [
+    "public_key_verify_factory.cc",
+    "public_key_verify_factory.h",
+  ]
+  testonly = false
+}
+
+source_set("public_key_sign_set_wrapper") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_signature_public_key_sign_set_wrapper_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/cc:crypto_format",
+    "//third_party/tink/cc:primitive_set",
+    "//third_party/tink/cc:public_key_sign",
+    "//third_party/tink/cc/subtle:subtle_util_boringssl",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_signature_copyfiles",
+  ]
+  sources = [
+    "public_key_sign_set_wrapper.cc",
+    "public_key_sign_set_wrapper.h",
+  ]
+  testonly = false
+}
+
+source_set("public_key_sign_factory") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_signature_public_key_sign_factory_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":public_key_sign_set_wrapper",
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc:keyset_handle",
+    "//third_party/tink/cc:primitive_set",
+    "//third_party/tink/cc:public_key_sign",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    ":tink_signature_copyfiles",
+  ]
+  sources = [
+    "public_key_sign_factory.cc",
+    "public_key_sign_factory.h",
+  ]
+  testonly = false
+}
+
+source_set("signature_key_templates") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_signature_signature_key_templates_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:ecdsa_proto",
+    "//third_party/tink/proto:tink_proto",
+    ":tink_signature_copyfiles",
+  ]
+  sources = [
+    "signature_key_templates.cc",
+    "signature_key_templates.h",
+  ]
+  testonly = false
+}
+
+source_set("ecdsa_sign_key_manager") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_signature_ecdsa_sign_key_manager_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":ecdsa_verify_key_manager",
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc:public_key_sign",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/subtle:ecdsa_sign_boringssl",
+    "//third_party/tink/cc/subtle:subtle_util_boringssl",
+    "//third_party/tink/cc/util:enums",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:ecdsa_proto",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/abseil-cpp/absl/memory",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_signature_copyfiles",
+  ]
+  sources = [
+    "ecdsa_sign_key_manager.cc",
+    "ecdsa_sign_key_manager.h",
+  ]
+  testonly = false
+}
+
+source_set("ecdsa_verify_key_manager") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_signature_ecdsa_verify_key_manager_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc:public_key_verify",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/subtle:ecdsa_verify_boringssl",
+    "//third_party/tink/cc/subtle:subtle_util_boringssl",
+    "//third_party/tink/cc/util:enums",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:ecdsa_proto",
+    "//third_party/tink/proto:tink_proto",
+    ":tink_signature_copyfiles",
+  ]
+  sources = [
+    "ecdsa_verify_key_manager.cc",
+    "ecdsa_verify_key_manager.h",
+  ]
+  testonly = false
+}
+
+source_set("rsa_ssa_pss_verify_key_manager") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_signature_rsa_ssa_pss_verify_key_manager_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc:public_key_verify",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/subtle:rsa_ssa_pss_verify_boringssl",
+    "//third_party/tink/cc/subtle:subtle_util_boringssl",
+    "//third_party/tink/cc/util:enums",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:rsa_ssa_pss_proto",
+    "//third_party/tink/proto:tink_proto",
+    ":tink_signature_copyfiles",
+  ]
+  sources = [
+    "rsa_ssa_pss_verify_key_manager.cc",
+    "rsa_ssa_pss_verify_key_manager.h",
+  ]
+  testonly = false
+}
+
+source_set("public_key_sign_catalogue") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_signature_public_key_sign_catalogue_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":ecdsa_sign_key_manager",
+    "//third_party/tink/cc:catalogue",
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc:public_key_sign",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    ":tink_signature_copyfiles",
+  ]
+  sources = [
+    "public_key_sign_catalogue.cc",
+    "public_key_sign_catalogue.h",
+  ]
+  testonly = false
+}
+
+source_set("public_key_verify_catalogue") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_signature_public_key_verify_catalogue_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":ecdsa_verify_key_manager",
+    "//third_party/tink/cc:catalogue",
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc:public_key_verify",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    ":tink_signature_copyfiles",
+  ]
+  sources = [
+    "public_key_verify_catalogue.cc",
+    "public_key_verify_catalogue.h",
+  ]
+  testonly = false
+}
+
+source_set("signature_config") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_signature_signature_config_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":public_key_sign_catalogue",
+    ":public_key_verify_catalogue",
+    "//third_party/tink/cc:config",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/proto:config_proto",
+    ":tink_signature_copyfiles",
+  ]
+  sources = [
+    "signature_config.cc",
+    "signature_config.h",
+  ]
+  testonly = false
+}
+
+executable("public_key_verify_set_wrapper_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_signature_public_key_verify_set_wrapper_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":public_key_verify_set_wrapper",
+    "//third_party/tink/cc:primitive_set",
+    "//third_party/tink/cc:public_key_sign",
+    "//third_party/tink/cc:public_key_verify",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "public_key_verify_set_wrapper_test.cc",
+  ]
+  testonly = true
+}
+
+executable("public_key_verify_factory_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_signature_public_key_verify_factory_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":ecdsa_verify_key_manager",
+    ":public_key_verify_factory",
+    ":signature_config",
+    "//third_party/tink/cc:config",
+    "//third_party/tink/cc:keyset_handle",
+    "//third_party/tink/cc:public_key_verify",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/util:keyset_util",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/tink/proto:ecdsa_proto",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "public_key_verify_factory_test.cc",
+  ]
+  testonly = true
+}
+
+executable("public_key_sign_set_wrapper_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_signature_public_key_sign_set_wrapper_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":public_key_sign_set_wrapper",
+    "//third_party/tink/cc:primitive_set",
+    "//third_party/tink/cc:public_key_sign",
+    "//third_party/tink/cc:public_key_verify",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "public_key_sign_set_wrapper_test.cc",
+  ]
+  testonly = true
+}
+
+executable("public_key_sign_factory_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_signature_public_key_sign_factory_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":ecdsa_sign_key_manager",
+    ":public_key_sign_factory",
+    ":signature_config",
+    "//third_party/tink/cc:config",
+    "//third_party/tink/cc:keyset_handle",
+    "//third_party/tink/cc:public_key_sign",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/util:keyset_util",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/tink/proto:ecdsa_proto",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "public_key_sign_factory_test.cc",
+  ]
+  testonly = true
+}
+
+executable("ecdsa_verify_key_manager_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_signature_ecdsa_verify_key_manager_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":ecdsa_sign_key_manager",
+    ":ecdsa_verify_key_manager",
+    "//third_party/tink/cc:config",
+    "//third_party/tink/cc:public_key_sign",
+    "//third_party/tink/cc:public_key_verify",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/tink/proto:aes_eax_proto",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:ecdsa_proto",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "ecdsa_verify_key_manager_test.cc",
+  ]
+  testonly = true
+}
+
+executable("rsa_ssa_pss_verify_key_manager_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_signature_rsa_ssa_pss_verify_key_manager_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":rsa_ssa_pss_verify_key_manager",
+    "//third_party/tink/cc:config",
+    "//third_party/tink/cc:public_key_sign",
+    "//third_party/tink/cc:public_key_verify",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/tink/proto:aes_eax_proto",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:rsa_ssa_pss_proto",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/abseil-cpp/absl/strings",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "rsa_ssa_pss_verify_key_manager_test.cc",
+  ]
+  testonly = true
+}
+
+executable("ecdsa_sign_key_manager_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_signature_ecdsa_sign_key_manager_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":ecdsa_sign_key_manager",
+    ":ecdsa_verify_key_manager",
+    ":signature_key_templates",
+    "//third_party/tink/cc:config",
+    "//third_party/tink/cc:public_key_sign",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/aead:aead_key_templates",
+    "//third_party/tink/cc/aead:aes_gcm_key_manager",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/tink/proto:aes_eax_proto",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:ecdsa_proto",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "ecdsa_sign_key_manager_test.cc",
+  ]
+  testonly = true
+}
+
+executable("public_key_sign_catalogue_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_signature_public_key_sign_catalogue_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":public_key_sign_catalogue",
+    "//third_party/tink/cc:catalogue",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "public_key_sign_catalogue_test.cc",
+  ]
+  testonly = true
+}
+
+executable("public_key_verify_catalogue_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_signature_public_key_verify_catalogue_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":public_key_verify_catalogue",
+    "//third_party/tink/cc:catalogue",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "public_key_verify_catalogue_test.cc",
+  ]
+  testonly = true
+}
+
+executable("signature_config_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_signature_signature_config_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":signature_config",
+    "//third_party/tink/cc:catalogue",
+    "//third_party/tink/cc:config",
+    "//third_party/tink/cc:public_key_sign",
+    "//third_party/tink/cc:public_key_verify",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/util:status",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "signature_config_test.cc",
+  ]
+  testonly = true
+}
+
+executable("signature_key_templates_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_signature_signature_key_templates_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":ecdsa_sign_key_manager",
+    ":signature_key_templates",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:ecdsa_proto",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "signature_key_templates_test.cc",
+  ]
+  testonly = true
+}
+
diff --git a/cc/signature/CMakeLists.txt b/cc/signature/CMakeLists.txt
new file mode 100644
index 0000000..426fb57
--- /dev/null
+++ b/cc/signature/CMakeLists.txt
@@ -0,0 +1,67 @@
+# Copyright 2019 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+
+# CC Library : public_key_verify_wrapper
+add_library(
+  tink_cc_signature_public_key_verify_wrapper
+  public_key_verify_wrapper.h
+  public_key_verify_wrapper.cc
+)
+tink_export_hdrs(public_key_verify_wrapper.h)
+add_dependencies(
+  tink_cc_signature_public_key_verify_wrapper
+  tink_cc_crypto_format
+  tink_cc_primitive_set
+  tink_cc_primitive_wrapper
+  tink_cc_public_key_verify
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_proto_tink_lib
+)
+target_link_libraries(
+  tink_cc_signature_public_key_verify_wrapper
+  tink_cc_crypto_format
+  tink_cc_primitive_set
+  tink_cc_primitive_wrapper
+  tink_cc_public_key_verify
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_proto_tink_lib
+  absl::strings
+)
+
+# CC Library : public_key_sign_wrapper
+add_library(
+  tink_cc_signature_public_key_sign_wrapper
+  public_key_sign_wrapper.h
+  public_key_sign_wrapper.cc
+)
+tink_export_hdrs(public_key_sign_wrapper.h)
+add_dependencies(
+  tink_cc_signature_public_key_sign_wrapper
+  tink_cc_crypto_format
+  tink_cc_primitive_set
+  tink_cc_primitive_wrapper
+  tink_cc_public_key_sign
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_proto_tink_lib
+)
+target_link_libraries(
+  tink_cc_signature_public_key_sign_wrapper
+  tink_cc_crypto_format
+  tink_cc_primitive_set
+  tink_cc_primitive_wrapper
+  tink_cc_public_key_sign
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_util_status
+  tink_cc_util_statusor
+  tink_proto_tink_lib
+  absl::strings
+)
+
diff --git a/cc/subtle/BUILD.gn b/cc/subtle/BUILD.gn
new file mode 100644
index 0000000..3c3b7a5
--- /dev/null
+++ b/cc/subtle/BUILD.gn
@@ -0,0 +1,839 @@
+# Copyright 2018 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+copy("tink_subtle_copyfiles") {
+  outputs = [
+    "$target_gen_dir/../include/tink/subtle/{{source_file_part}}",
+  ]
+  sources = [
+    "aes_ctr_boringssl.h",
+    "aes_eax_boringssl.h",
+    "aes_gcm_boringssl.h",
+    "common_enums.h",
+    "ec_util.h",
+    "ecdsa_sign_boringssl.h",
+    "ecdsa_verify_boringssl.h",
+    "ecies_hkdf_recipient_kem_boringssl.h",
+    "ecies_hkdf_sender_kem_boringssl.h",
+    "encrypt_then_authenticate.h",
+    "hkdf.h",
+    "hmac_boringssl.h",
+    "ind_cpa_cipher.h",
+    "random.h",
+    "rsa_ssa_pss_verify_boringssl.h",
+    "subtle_util_boringssl.h",
+    "wycheproof_util.h",
+  ]
+}
+
+source_set("subtle") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_subtle_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":aes_gcm_boringssl",
+    ":common_enums",
+    ":encrypt_then_authenticate",
+    ":hkdf",
+    ":hmac_boringssl",
+    ":random",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:hybrid_decrypt",
+    "//third_party/tink/cc:hybrid_encrypt",
+    "//third_party/tink/cc:mac",
+    "//third_party/tink/cc:public_key_sign",
+    "//third_party/tink/cc:public_key_verify",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/boringssl:crypto",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_subtle_copyfiles",
+  ]
+  sources = [
+    "aes_gcm_boringssl.h",
+    "common_enums.h",
+    "encrypt_then_authenticate.h",
+    "hkdf.h",
+    "hmac_boringssl.h",
+    "ind_cpa_cipher.h",
+    "random.h",
+  ]
+  testonly = false
+}
+
+source_set("ind_cpa_cipher") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_ind_cpa_cipher_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_subtle_copyfiles",
+  ]
+  sources = [
+    "ind_cpa_cipher.h",
+  ]
+  testonly = false
+}
+
+source_set("ecies_hkdf_recipient_kem_boringssl") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_ecies_hkdf_recipient_kem_boringssl_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":common_enums",
+    ":hkdf",
+    ":subtle_util_boringssl",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/boringssl:crypto",
+    "//third_party/abseil-cpp/absl/memory",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_subtle_copyfiles",
+  ]
+  sources = [
+    "ecies_hkdf_recipient_kem_boringssl.cc",
+    "ecies_hkdf_recipient_kem_boringssl.h",
+  ]
+  testonly = false
+}
+
+source_set("ecies_hkdf_sender_kem_boringssl") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_ecies_hkdf_sender_kem_boringssl_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":common_enums",
+    ":hkdf",
+    ":subtle_util_boringssl",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/boringssl:crypto",
+    "//third_party/abseil-cpp/absl/memory",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_subtle_copyfiles",
+  ]
+  sources = [
+    "ecies_hkdf_sender_kem_boringssl.cc",
+    "ecies_hkdf_sender_kem_boringssl.h",
+  ]
+  testonly = false
+}
+
+source_set("ec_util") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_ec_util_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":common_enums",
+    ":subtle_util_boringssl",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/boringssl:crypto",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_subtle_copyfiles",
+  ]
+  sources = [
+    "ec_util.cc",
+    "ec_util.h",
+  ]
+  testonly = false
+}
+
+source_set("hkdf") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_hkdf_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":common_enums",
+    ":subtle_util_boringssl",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/boringssl:crypto",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_subtle_copyfiles",
+  ]
+  sources = [
+    "hkdf.cc",
+    "hkdf.h",
+  ]
+  testonly = false
+}
+
+source_set("hmac_boringssl") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_hmac_boringssl_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":common_enums",
+    ":subtle_util_boringssl",
+    "//third_party/tink/cc:mac",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/boringssl:crypto",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_subtle_copyfiles",
+  ]
+  sources = [
+    "hmac_boringssl.cc",
+    "hmac_boringssl.h",
+  ]
+  testonly = false
+}
+
+source_set("ecdsa_sign_boringssl") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_ecdsa_sign_boringssl_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":common_enums",
+    ":subtle_util_boringssl",
+    "//third_party/tink/cc:public_key_sign",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/boringssl:crypto",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_subtle_copyfiles",
+  ]
+  sources = [
+    "ecdsa_sign_boringssl.cc",
+    "ecdsa_sign_boringssl.h",
+  ]
+  testonly = false
+}
+
+source_set("ecdsa_verify_boringssl") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_ecdsa_verify_boringssl_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":common_enums",
+    ":subtle_util_boringssl",
+    "//third_party/tink/cc:public_key_verify",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/boringssl:crypto",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_subtle_copyfiles",
+  ]
+  sources = [
+    "ecdsa_verify_boringssl.cc",
+    "ecdsa_verify_boringssl.h",
+  ]
+  testonly = false
+}
+
+source_set("rsa_ssa_pss_verify_boringssl") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_rsa_ssa_pss_verify_boringssl_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":common_enums",
+    ":subtle_util_boringssl",
+    "//third_party/tink/cc:public_key_verify",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/boringssl:crypto",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_subtle_copyfiles",
+  ]
+  sources = [
+    "rsa_ssa_pss_verify_boringssl.cc",
+    "rsa_ssa_pss_verify_boringssl.h",
+  ]
+  testonly = false
+}
+
+source_set("aes_gcm_boringssl") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_aes_gcm_boringssl_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":random",
+    ":subtle_util_boringssl",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/boringssl:crypto",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_subtle_copyfiles",
+  ]
+  sources = [
+    "aes_gcm_boringssl.cc",
+    "aes_gcm_boringssl.h",
+  ]
+  testonly = false
+}
+
+source_set("aes_eax_boringssl") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_aes_eax_boringssl_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":random",
+    ":subtle_util_boringssl",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/boringssl:crypto",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_subtle_copyfiles",
+  ]
+  sources = [
+    "aes_eax_boringssl.cc",
+    "aes_eax_boringssl.h",
+  ]
+  testonly = false
+}
+
+source_set("encrypt_then_authenticate") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_encrypt_then_authenticate_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":aes_ctr_boringssl",
+    ":ind_cpa_cipher",
+    ":subtle_util_boringssl",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:mac",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_subtle_copyfiles",
+  ]
+  sources = [
+    "encrypt_then_authenticate.cc",
+    "encrypt_then_authenticate.h",
+  ]
+  testonly = false
+}
+
+source_set("aes_ctr_boringssl") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_aes_ctr_boringssl_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":ind_cpa_cipher",
+    ":random",
+    ":subtle_util_boringssl",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/boringssl:crypto",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_subtle_copyfiles",
+  ]
+  sources = [
+    "aes_ctr_boringssl.cc",
+    "aes_ctr_boringssl.h",
+  ]
+  testonly = false
+}
+
+source_set("random") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_random_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/boringssl:crypto",
+    ":tink_subtle_copyfiles",
+  ]
+  sources = [
+    "random.cc",
+    "random.h",
+  ]
+  testonly = false
+}
+
+source_set("common_enums") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_common_enums_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":tink_subtle_copyfiles",
+  ]
+  sources = [
+    "common_enums.cc",
+    "common_enums.h",
+  ]
+  testonly = false
+}
+
+source_set("subtle_util_boringssl") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_subtle_util_boringssl_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":common_enums",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/boringssl:crypto",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_subtle_copyfiles",
+  ]
+  sources = [
+    "subtle_util_boringssl.cc",
+    "subtle_util_boringssl.h",
+  ]
+  testonly = false
+}
+
+source_set("wycheproof_util") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_wycheproof_util_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":common_enums",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/abseil-cpp/absl/strings",
+    "//third_party/rapidjson",
+    ":tink_subtle_copyfiles",
+  ]
+  sources = [
+    "wycheproof_util.cc",
+    "wycheproof_util.h",
+  ]
+  testonly = false
+}
+
+executable("ecies_hkdf_recipient_kem_boringssl_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_ecies_hkdf_recipient_kem_boringssl_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":common_enums",
+    ":ecies_hkdf_recipient_kem_boringssl",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "ecies_hkdf_recipient_kem_boringssl_test.cc",
+  ]
+  testonly = true
+}
+
+executable("ecies_hkdf_sender_kem_boringssl_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_ecies_hkdf_sender_kem_boringssl_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":common_enums",
+    ":ecies_hkdf_recipient_kem_boringssl",
+    ":ecies_hkdf_sender_kem_boringssl",
+    ":subtle_util_boringssl",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "ecies_hkdf_sender_kem_boringssl_test.cc",
+  ]
+  testonly = true
+}
+
+executable("ec_util_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_ec_util_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":ec_util",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "ec_util_test.cc",
+  ]
+  testonly = true
+}
+
+executable("hkdf_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_hkdf_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":common_enums",
+    ":hkdf",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "hkdf_test.cc",
+  ]
+  testonly = true
+}
+
+executable("hmac_boringssl_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_hmac_boringssl_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":common_enums",
+    ":hmac_boringssl",
+    "//third_party/tink/cc:mac",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "hmac_boringssl_test.cc",
+  ]
+  testonly = true
+}
+
+executable("aes_gcm_boringssl_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_aes_gcm_boringssl_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":aes_gcm_boringssl",
+    ":wycheproof_util",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/abseil-cpp/absl/strings",
+    "//third_party/googletest:gtest_main",
+    "//third_party/rapidjson",
+  ]
+  sources = [
+    "aes_gcm_boringssl_test.cc",
+  ]
+  testonly = true
+}
+
+executable("aes_eax_boringssl_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_aes_eax_boringssl_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":aes_eax_boringssl",
+    ":common_enums",
+    ":wycheproof_util",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/abseil-cpp/absl/strings",
+    "//third_party/googletest:gtest_main",
+    "//third_party/rapidjson",
+  ]
+  sources = [
+    "aes_eax_boringssl_test.cc",
+  ]
+  testonly = true
+}
+
+executable("encrypt_then_authenticate_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_encrypt_then_authenticate_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":aes_ctr_boringssl",
+    ":common_enums",
+    ":encrypt_then_authenticate",
+    ":hmac_boringssl",
+    ":random",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:mac",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "encrypt_then_authenticate_test.cc",
+  ]
+  testonly = true
+}
+
+executable("aes_ctr_boringssl_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_aes_ctr_boringssl_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":aes_ctr_boringssl",
+    ":random",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "aes_ctr_boringssl_test.cc",
+  ]
+  testonly = true
+}
+
+executable("ecdsa_sign_boringssl_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_ecdsa_sign_boringssl_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":common_enums",
+    ":ec_util",
+    ":ecdsa_sign_boringssl",
+    ":ecdsa_verify_boringssl",
+    "//third_party/tink/cc:public_key_sign",
+    "//third_party/tink/cc:public_key_verify",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "ecdsa_sign_boringssl_test.cc",
+  ]
+  testonly = true
+}
+
+executable("ecdsa_verify_boringssl_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_ecdsa_verify_boringssl_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":common_enums",
+    ":ecdsa_sign_boringssl",
+    ":ecdsa_verify_boringssl",
+    ":wycheproof_util",
+    "//third_party/tink/cc:public_key_sign",
+    "//third_party/tink/cc:public_key_verify",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/abseil-cpp/absl/strings",
+    "//third_party/googletest:gtest_main",
+    "//third_party/rapidjson",
+  ]
+  sources = [
+    "ecdsa_verify_boringssl_test.cc",
+  ]
+  testonly = true
+}
+
+executable("rsa_ssa_pss_verify_boringssl_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_rsa_ssa_pss_verify_boringssl_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":common_enums",
+    ":rsa_ssa_pss_verify_boringssl",
+    ":wycheproof_util",
+    "//third_party/tink/cc:public_key_sign",
+    "//third_party/tink/cc:public_key_verify",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/abseil-cpp/absl/strings",
+    "//third_party/googletest:gtest_main",
+    "//third_party/rapidjson",
+  ]
+  sources = [
+    "rsa_ssa_pss_verify_boringssl_test.cc",
+  ]
+  testonly = true
+}
+
+executable("random_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_random_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":random",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "random_test.cc",
+  ]
+  testonly = true
+}
+
+executable("common_enums_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_common_enums_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":common_enums",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "common_enums_test.cc",
+  ]
+  testonly = true
+}
+
+executable("subtle_util_boringssl_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_subtle_subtle_util_boringssl_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":ec_util",
+    ":subtle_util_boringssl",
+    ":wycheproof_util",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:test_matchers",
+    "//third_party/tink/cc/util:test_util",
+    "//third_party/boringssl:crypto",
+    "//third_party/abseil-cpp/absl/strings",
+    "//third_party/googletest:gtest_main",
+    "//third_party/rapidjson",
+  ]
+  sources = [
+    "subtle_util_boringssl_test.cc",
+  ]
+  testonly = true
+}
+
diff --git a/cc/subtle/CMakeLists.txt b/cc/subtle/CMakeLists.txt
new file mode 100644
index 0000000..367fa54
--- /dev/null
+++ b/cc/subtle/CMakeLists.txt
@@ -0,0 +1,323 @@
+# Copyright 2019 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+
+# CC Library : ind_cpa_cipher
+add_library(tink_cc_subtle_ind_cpa_cipher ind_cpa_cipher.h)
+set_target_properties(
+  tink_cc_subtle_ind_cpa_cipher
+  PROPERTIES
+  LINKER_LANGUAGE
+  CXX
+)
+tink_export_hdrs(ind_cpa_cipher.h)
+add_dependencies(tink_cc_subtle_ind_cpa_cipher tink_cc_util_statusor)
+target_link_libraries(
+  tink_cc_subtle_ind_cpa_cipher
+  tink_cc_util_statusor
+  absl::strings
+)
+
+# CC Library : ecies_hkdf_recipient_kem_boringssl
+add_library(
+  tink_cc_subtle_ecies_hkdf_recipient_kem_boringssl
+  ecies_hkdf_recipient_kem_boringssl.h
+  ecies_hkdf_recipient_kem_boringssl.cc
+)
+tink_export_hdrs(ecies_hkdf_recipient_kem_boringssl.h)
+add_dependencies(
+  tink_cc_subtle_ecies_hkdf_recipient_kem_boringssl
+  tink_cc_subtle_common_enums
+  tink_cc_subtle_hkdf
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_util_errors
+  tink_cc_util_status
+  tink_cc_util_statusor
+)
+target_link_libraries(
+  tink_cc_subtle_ecies_hkdf_recipient_kem_boringssl
+  tink_cc_subtle_common_enums
+  tink_cc_subtle_hkdf
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_util_errors
+  tink_cc_util_status
+  tink_cc_util_statusor
+  crypto
+  absl::memory
+  absl::strings
+)
+
+# CC Library : ecies_hkdf_sender_kem_boringssl
+add_library(
+  tink_cc_subtle_ecies_hkdf_sender_kem_boringssl
+  ecies_hkdf_sender_kem_boringssl.h
+  ecies_hkdf_sender_kem_boringssl.cc
+)
+tink_export_hdrs(ecies_hkdf_sender_kem_boringssl.h)
+add_dependencies(
+  tink_cc_subtle_ecies_hkdf_sender_kem_boringssl
+  tink_cc_subtle_common_enums
+  tink_cc_subtle_hkdf
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_util_status
+  tink_cc_util_statusor
+)
+target_link_libraries(
+  tink_cc_subtle_ecies_hkdf_sender_kem_boringssl
+  tink_cc_subtle_common_enums
+  tink_cc_subtle_hkdf
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_util_status
+  tink_cc_util_statusor
+  crypto
+  absl::memory
+  absl::strings
+)
+
+# CC Library : ec_util
+add_library(tink_cc_subtle_ec_util ec_util.h ec_util.cc)
+tink_export_hdrs(ec_util.h)
+add_dependencies(
+  tink_cc_subtle_ec_util
+  tink_cc_subtle_common_enums
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_util_errors
+  tink_cc_util_status
+  tink_cc_util_statusor
+)
+target_link_libraries(
+  tink_cc_subtle_ec_util
+  tink_cc_subtle_common_enums
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_util_errors
+  tink_cc_util_status
+  tink_cc_util_statusor
+  crypto
+  absl::strings
+)
+
+# CC Library : hkdf
+add_library(tink_cc_subtle_hkdf hkdf.h hkdf.cc)
+tink_export_hdrs(hkdf.h)
+add_dependencies(
+  tink_cc_subtle_hkdf
+  tink_cc_subtle_common_enums
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_util_errors
+  tink_cc_util_status
+  tink_cc_util_statusor
+)
+target_link_libraries(
+  tink_cc_subtle_hkdf
+  tink_cc_subtle_common_enums
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_util_errors
+  tink_cc_util_status
+  tink_cc_util_statusor
+  crypto
+  absl::strings
+)
+
+# CC Library : hmac_boringssl
+add_library(tink_cc_subtle_hmac_boringssl hmac_boringssl.h hmac_boringssl.cc)
+tink_export_hdrs(hmac_boringssl.h)
+add_dependencies(
+  tink_cc_subtle_hmac_boringssl
+  tink_cc_subtle_common_enums
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_mac
+  tink_cc_util_errors
+  tink_cc_util_status
+  tink_cc_util_statusor
+)
+target_link_libraries(
+  tink_cc_subtle_hmac_boringssl
+  tink_cc_subtle_common_enums
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_mac
+  tink_cc_util_errors
+  tink_cc_util_status
+  tink_cc_util_statusor
+  crypto
+  absl::strings
+)
+
+# CC Library : aes_gcm_boringssl
+add_library(
+  tink_cc_subtle_aes_gcm_boringssl
+  aes_gcm_boringssl.h
+  aes_gcm_boringssl.cc
+)
+tink_export_hdrs(aes_gcm_boringssl.h)
+add_dependencies(
+  tink_cc_subtle_aes_gcm_boringssl
+  tink_cc_subtle_random
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_aead
+  tink_cc_util_errors
+  tink_cc_util_status
+  tink_cc_util_statusor
+)
+target_link_libraries(
+  tink_cc_subtle_aes_gcm_boringssl
+  tink_cc_subtle_random
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_aead
+  tink_cc_util_errors
+  tink_cc_util_status
+  tink_cc_util_statusor
+  crypto
+  absl::strings
+)
+
+# CC Library : aes_eax_boringssl
+add_library(
+  tink_cc_subtle_aes_eax_boringssl
+  aes_eax_boringssl.h
+  aes_eax_boringssl.cc
+)
+tink_export_hdrs(aes_eax_boringssl.h)
+add_dependencies(
+  tink_cc_subtle_aes_eax_boringssl
+  tink_cc_subtle_random
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_aead
+  tink_cc_util_errors
+  tink_cc_util_status
+  tink_cc_util_statusor
+)
+target_link_libraries(
+  tink_cc_subtle_aes_eax_boringssl
+  tink_cc_subtle_random
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_aead
+  tink_cc_util_errors
+  tink_cc_util_status
+  tink_cc_util_statusor
+  crypto
+  absl::strings
+)
+
+# CC Library : encrypt_then_authenticate
+add_library(
+  tink_cc_subtle_encrypt_then_authenticate
+  encrypt_then_authenticate.h
+  encrypt_then_authenticate.cc
+)
+tink_export_hdrs(encrypt_then_authenticate.h)
+add_dependencies(
+  tink_cc_subtle_encrypt_then_authenticate
+  tink_cc_subtle_aes_ctr_boringssl
+  tink_cc_subtle_ind_cpa_cipher
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_aead
+  tink_cc_mac
+  tink_cc_util_errors
+  tink_cc_util_status
+  tink_cc_util_statusor
+)
+target_link_libraries(
+  tink_cc_subtle_encrypt_then_authenticate
+  tink_cc_subtle_aes_ctr_boringssl
+  tink_cc_subtle_ind_cpa_cipher
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_aead
+  tink_cc_mac
+  tink_cc_util_errors
+  tink_cc_util_status
+  tink_cc_util_statusor
+  absl::strings
+)
+
+# CC Library : aes_ctr_boringssl
+add_library(
+  tink_cc_subtle_aes_ctr_boringssl
+  aes_ctr_boringssl.h
+  aes_ctr_boringssl.cc
+)
+tink_export_hdrs(aes_ctr_boringssl.h)
+add_dependencies(
+  tink_cc_subtle_aes_ctr_boringssl
+  tink_cc_subtle_ind_cpa_cipher
+  tink_cc_subtle_random
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_util_errors
+  tink_cc_util_status
+  tink_cc_util_statusor
+)
+target_link_libraries(
+  tink_cc_subtle_aes_ctr_boringssl
+  tink_cc_subtle_ind_cpa_cipher
+  tink_cc_subtle_random
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_util_errors
+  tink_cc_util_status
+  tink_cc_util_statusor
+  crypto
+  absl::strings
+)
+
+# CC Library : random
+add_library(tink_cc_subtle_random random.h random.cc)
+tink_export_hdrs(random.h)
+target_link_libraries(tink_cc_subtle_random crypto)
+
+# CC Library : xchacha20_poly1305_boringssl
+add_library(
+  tink_cc_subtle_xchacha20_poly1305_boringssl
+  xchacha20_poly1305_boringssl.h
+  xchacha20_poly1305_boringssl.cc
+)
+tink_export_hdrs(xchacha20_poly1305_boringssl.h)
+add_dependencies(
+  tink_cc_subtle_xchacha20_poly1305_boringssl
+  tink_cc_subtle_common_enums
+  tink_cc_subtle_random
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_aead
+  tink_cc_util_errors
+  tink_cc_util_status
+  tink_cc_util_statusor
+)
+target_link_libraries(
+  tink_cc_subtle_xchacha20_poly1305_boringssl
+  tink_cc_subtle_common_enums
+  tink_cc_subtle_random
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_aead
+  tink_cc_util_errors
+  tink_cc_util_status
+  tink_cc_util_statusor
+  crypto
+  absl::strings
+)
+
+# CC Library : common_enums
+add_library(tink_cc_subtle_common_enums common_enums.h common_enums.cc)
+tink_export_hdrs(common_enums.h)
+
+# CC Library : subtle_util_boringssl
+add_library(
+  tink_cc_subtle_subtle_util_boringssl
+  subtle_util_boringssl.h
+  subtle_util_boringssl.cc
+)
+tink_export_hdrs(subtle_util_boringssl.h)
+add_dependencies(
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_subtle_common_enums
+  tink_cc_util_errors
+  tink_cc_util_status
+  tink_cc_util_statusor
+)
+target_link_libraries(
+  tink_cc_subtle_subtle_util_boringssl
+  tink_cc_subtle_common_enums
+  tink_cc_util_errors
+  tink_cc_util_status
+  tink_cc_util_statusor
+  crypto
+  absl::strings
+)
+
diff --git a/cc/subtle/xchacha20_poly1305_boringssl.cc b/cc/subtle/xchacha20_poly1305_boringssl.cc
index 3a2fb6a..6376782 100644
--- a/cc/subtle/xchacha20_poly1305_boringssl.cc
+++ b/cc/subtle/xchacha20_poly1305_boringssl.cc
@@ -32,6 +32,11 @@
 namespace tink {
 namespace subtle {
 
+// TODO(azani): Remove after we upgrade BoringSSL.
+EVP_AEAD* EVP_aead_xchacha20_poly1305() {
+  return nullptr;
+}
+
 static const bool IsValidKeySize(uint32_t size_in_bytes) {
   return size_in_bytes == 32;
 }
diff --git a/cc/util/BUILD.gn b/cc/util/BUILD.gn
new file mode 100644
index 0000000..bc5892e
--- /dev/null
+++ b/cc/util/BUILD.gn
@@ -0,0 +1,257 @@
+# Copyright 2018 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+copy("tink_util_copyfiles") {
+  outputs = [
+    "$target_gen_dir/../include/tink/util/{{source_file_part}}",
+  ]
+  sources = [
+    "enums.h",
+    "errors.h",
+    "keyset_util.h",
+    "protobuf_helper.h",
+    "status.h",
+    "statusor.h",
+    "test_matchers.h",
+    "test_util.h",
+    "validation.h",
+  ]
+}
+
+source_set("errors") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_util_errors_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":status",
+    ":tink_util_copyfiles",
+  ]
+  sources = [
+    "errors.cc",
+    "errors.h",
+  ]
+  testonly = false
+}
+
+source_set("enums") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_util_enums_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/cc/subtle:common_enums",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:ecdsa_proto",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_util_copyfiles",
+  ]
+  sources = [
+    "enums.cc",
+    "enums.h",
+  ]
+  testonly = false
+}
+
+source_set("status") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_util_status_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":tink_util_copyfiles",
+  ]
+  sources = [
+    "status.cc",
+    "status.h",
+  ]
+  testonly = false
+}
+
+source_set("statusor") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_util_statusor_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":status",
+    ":tink_util_copyfiles",
+  ]
+  sources = [
+    "statusor.h",
+    "statusor.h",
+  ]
+  testonly = false
+}
+
+source_set("validation") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_util_validation_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":errors",
+    ":status",
+    "//third_party/tink/proto:tink_proto",
+    ":tink_util_copyfiles",
+  ]
+  sources = [
+    "validation.cc",
+    "validation.h",
+  ]
+  testonly = false
+}
+
+source_set("test_util") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_util_test_util_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":enums",
+    ":protobuf_helper",
+    ":status",
+    ":statusor",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:cleartext_keyset_handle",
+    "//third_party/tink/cc:hybrid_decrypt",
+    "//third_party/tink/cc:hybrid_encrypt",
+    "//third_party/tink/cc:keyset_handle",
+    "//third_party/tink/cc:mac",
+    "//third_party/tink/cc:public_key_sign",
+    "//third_party/tink/cc:public_key_verify",
+    "//third_party/tink/cc/aead:aes_gcm_key_manager",
+    "//third_party/tink/cc/subtle:subtle_util_boringssl",
+    "//third_party/tink/proto:aes_gcm_proto",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/tink/proto:ecdsa_proto",
+    "//third_party/tink/proto:ecies_aead_hkdf_proto",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/abseil-cpp/absl/memory",
+    "//third_party/abseil-cpp/absl/strings",
+    ":tink_util_copyfiles",
+  ]
+  sources = [
+    "test_util.cc",
+    "test_util.h",
+  ]
+  testonly = false
+}
+
+source_set("test_matchers") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_util_test_matchers_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":status",
+    "//third_party/googletest:gtest_main",
+    ":tink_util_copyfiles",
+  ]
+  sources = [
+    "test_matchers.h",
+  ]
+  testonly = true
+}
+
+source_set("keyset_util") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_util_keyset_util_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/tink/cc:keyset_handle",
+    "//third_party/tink/proto:tink_proto",
+    "//third_party/abseil-cpp/absl/memory",
+    ":tink_util_copyfiles",
+  ]
+  sources = [
+    "keyset_util.cc",
+    "keyset_util.h",
+  ]
+  testonly = false
+}
+
+source_set("protobuf_helper") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_util_protobuf_helper_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    "//third_party/protobuf:protobuf_lite",
+    ":tink_util_copyfiles",
+  ]
+  sources = [
+    "protobuf_helper.h",
+  ]
+  testonly = false
+}
+
+executable("enums_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_util_enums_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":enums",
+    "//third_party/tink/cc/subtle:common_enums",
+    "//third_party/tink/proto:common_proto",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "enums_test.cc",
+  ]
+  testonly = true
+}
+
+executable("errors_test") {
+  configs -= [
+    "//build/config:no_rtti",
+  ]
+  output_name = "tink_util_errors_test_unittest"
+  public_configs = [
+    "//third_party/tink/cc:tink_config",
+  ]
+  public_deps = [
+    ":errors",
+    ":status",
+    "//third_party/googletest:gtest_main",
+  ]
+  sources = [
+    "errors_test.cc",
+  ]
+  testonly = true
+}
+
diff --git a/cc/util/CMakeLists.txt b/cc/util/CMakeLists.txt
new file mode 100644
index 0000000..bf5ddf2
--- /dev/null
+++ b/cc/util/CMakeLists.txt
@@ -0,0 +1,72 @@
+# Copyright 2019 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+
+# CC Library : constants
+add_library(tink_cc_util_constants constants.h constants.cc)
+tink_export_hdrs(constants.h)
+target_link_libraries(tink_cc_util_constants absl::base)
+
+# CC Library : errors
+add_library(tink_cc_util_errors errors.h errors.cc)
+tink_export_hdrs(errors.h)
+add_dependencies(tink_cc_util_errors tink_cc_util_status)
+target_link_libraries(tink_cc_util_errors tink_cc_util_status)
+
+# CC Library : enums
+add_library(tink_cc_util_enums enums.h enums.cc)
+tink_export_hdrs(enums.h)
+add_dependencies(
+  tink_cc_util_enums
+  tink_cc_subtle_common_enums
+  tink_proto_common_lib
+  tink_proto_ecdsa_lib
+  tink_proto_tink_lib
+)
+target_link_libraries(
+  tink_cc_util_enums
+  tink_cc_subtle_common_enums
+  tink_proto_common_lib
+  tink_proto_ecdsa_lib
+  tink_proto_tink_lib
+  absl::strings
+)
+
+# CC Library : status
+add_library(tink_cc_util_status status.h status.cc)
+tink_export_hdrs(status.h)
+
+# CC Library : statusor
+add_library(tink_cc_util_statusor statusor.h statusor.h)
+tink_export_hdrs(statusor.h)
+add_dependencies(tink_cc_util_statusor tink_cc_util_status)
+target_link_libraries(tink_cc_util_statusor tink_cc_util_status)
+
+# CC Library : validation
+add_library(tink_cc_util_validation validation.h validation.cc)
+tink_export_hdrs(validation.h)
+add_dependencies(
+  tink_cc_util_validation
+  tink_cc_util_errors
+  tink_cc_util_status
+  tink_proto_tink_lib
+)
+target_link_libraries(
+  tink_cc_util_validation
+  tink_cc_util_errors
+  tink_cc_util_status
+  tink_proto_tink_lib
+)
+
+# CC Library : protobuf_helper
+add_library(tink_cc_util_protobuf_helper protobuf_helper.h)
+set_target_properties(
+  tink_cc_util_protobuf_helper
+  PROPERTIES
+  LINKER_LANGUAGE
+  CXX
+)
+tink_export_hdrs(protobuf_helper.h)
+target_link_libraries(tink_cc_util_protobuf_helper protobuf_lite)
+
diff --git a/proto/BUILD.gn b/proto/BUILD.gn
new file mode 100644
index 0000000..5466925
--- /dev/null
+++ b/proto/BUILD.gn
@@ -0,0 +1,205 @@
+import("//third_party/protobuf/proto_library.gni")
+
+proto_library("common_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink/cc:tink_config" ]
+  sources = [
+    "common.proto"
+  ]
+}
+
+proto_library("tink_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink/cc:tink_config" ]
+  sources = [
+    "tink.proto"
+  ]
+  deps = [
+    ":common_proto"
+  ]
+}
+
+proto_library("config_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink/cc:tink_config" ]
+  sources = [
+    "config.proto"
+  ]
+}
+
+proto_library("aes_siv_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink/cc:tink_config" ]
+  sources = [
+    "aes_siv.h"
+  ]
+}
+
+proto_library("rsa_ssa_pkcs1_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink/cc:tink_config" ]
+  sources = [
+    "rsa_ssa_pkcs1.proto"
+  ]
+  deps = [
+    ":common_proto"
+  ]
+}
+
+proto_library("rsa_ssa_pss_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink/cc:tink_config" ]
+  sources = [
+    "rsa_ssa_pss.proto"
+  ]
+  deps = [
+    ":common_proto"
+  ]
+}
+
+proto_library("ecdsa_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink/cc:tink_config" ]
+  sources = [
+    "ecdsa.proto"
+  ]
+  deps = [
+    ":common_proto"
+  ]
+}
+
+proto_library("ed25519_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink/cc:tink_config" ]
+  sources = [
+    "ed25519.proto"
+  ]
+}
+
+proto_library("hmac_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink/cc:tink_config" ]
+  sources = [
+    "hmac.proto"
+  ]
+  deps = [
+    ":common_proto"
+  ]
+}
+
+proto_library("aes_ctr_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink/cc:tink_config" ]
+  sources = [
+    "aes_ctr.proto"
+  ]
+}
+
+proto_library("aes_ctr_hmac_aead_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink/cc:tink_config" ]
+  sources = [
+    "aes_ctr_hmac_aead.proto",
+  ]
+  deps = [
+    ":aes_ctr_proto",
+    ":hmac_proto",
+  ]
+}
+
+proto_library("aes_gcm_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink/cc:tink_config" ]
+  sources = [
+    "aes_gcm.proto"
+  ]
+}
+
+proto_library("aes_ctr_hmac_streaming_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink/cc:tink_config" ]
+  sources = [
+    "aes_ctr_hmac_streaming.proto",
+  ]
+  deps = [
+    ":common_proto",
+    ":hmac_proto",
+  ]
+}
+
+proto_library("aes_gcm_hkdf_streaming_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink/cc:tink_config" ]
+  sources = [
+    "aes_gcm_hkdf_streaming.proto",
+  ]
+  deps = [
+    ":common_proto"
+  ]
+}
+
+proto_library("aes_eax_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink/cc:tink_config" ]
+  sources = [
+    "aes_eax.proto"
+  ]
+}
+
+proto_library("chacha20_poly1305_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink/cc:tink_config" ]
+  sources = [
+    "chacha20_poly1305.proto",
+  ]
+}
+
+proto_library("kms_aead_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink/cc:tink_config" ]
+  sources = [
+    "kms_aead.proto"
+  ]
+}
+
+proto_library("kms_envelope_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink/cc:tink_config" ]
+  sources = [
+    "kms_envelope.proto"
+  ]
+  deps = [
+    ":tink_proto",
+  ]
+}
+
+proto_library("ecies_aead_hkdf_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink/cc:tink_config" ]
+  sources = [
+    "ecies_aead_hkdf.proto",
+  ]
+  deps = [
+    ":common_proto",
+    ":tink_proto",
+  ]
+}
diff --git a/proto/CMakeLists.txt b/proto/CMakeLists.txt
new file mode 100644
index 0000000..68cabdd
--- /dev/null
+++ b/proto/CMakeLists.txt
@@ -0,0 +1,115 @@
+# Copyright 2019 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+
+# Proto Library : common_proto
+tink_make_protobuf_cpp_lib(
+  tink_proto_common_lib
+  TINK_PROTO_COMMON_LIB_PROTO_HDRS
+  common
+)
+
+# Proto Library : tink_proto
+tink_make_protobuf_cpp_lib(
+  tink_proto_tink_lib
+  TINK_PROTO_TINK_LIB_PROTO_HDRS
+  tink
+)
+add_dependencies(tink_proto_tink_lib tink_proto_common_lib)
+target_link_libraries(tink_proto_tink_lib tink_proto_common_lib)
+
+# Proto Library : config_proto
+tink_make_protobuf_cpp_lib(
+  tink_proto_config_lib
+  TINK_PROTO_CONFIG_LIB_PROTO_HDRS
+  config
+)
+
+# Proto Library : ecdsa_proto
+tink_make_protobuf_cpp_lib(
+  tink_proto_ecdsa_lib
+  TINK_PROTO_ECDSA_LIB_PROTO_HDRS
+  ecdsa
+)
+add_dependencies(tink_proto_ecdsa_lib tink_proto_common_lib)
+target_link_libraries(tink_proto_ecdsa_lib tink_proto_common_lib)
+
+# Proto Library : hmac_proto
+tink_make_protobuf_cpp_lib(
+  tink_proto_hmac_lib
+  TINK_PROTO_HMAC_LIB_PROTO_HDRS
+  hmac
+)
+add_dependencies(tink_proto_hmac_lib tink_proto_common_lib)
+target_link_libraries(tink_proto_hmac_lib tink_proto_common_lib)
+
+# Proto Library : aes_ctr_proto
+tink_make_protobuf_cpp_lib(
+  tink_proto_aes_ctr_lib
+  TINK_PROTO_AES_CTR_LIB_PROTO_HDRS
+  aes_ctr
+)
+
+# Proto Library : aes_ctr_hmac_aead_proto
+tink_make_protobuf_cpp_lib(
+  tink_proto_aes_ctr_hmac_aead_lib
+  TINK_PROTO_AES_CTR_HMAC_AEAD_LIB_PROTO_HDRS
+  aes_ctr_hmac_aead
+)
+add_dependencies(
+  tink_proto_aes_ctr_hmac_aead_lib
+  tink_proto_aes_ctr_lib
+  tink_proto_hmac_lib
+)
+target_link_libraries(
+  tink_proto_aes_ctr_hmac_aead_lib
+  tink_proto_aes_ctr_lib
+  tink_proto_hmac_lib
+)
+
+# Proto Library : aes_gcm_proto
+tink_make_protobuf_cpp_lib(
+  tink_proto_aes_gcm_lib
+  TINK_PROTO_AES_GCM_LIB_PROTO_HDRS
+  aes_gcm
+)
+
+# Proto Library : aes_eax_proto
+tink_make_protobuf_cpp_lib(
+  tink_proto_aes_eax_lib
+  TINK_PROTO_AES_EAX_LIB_PROTO_HDRS
+  aes_eax
+)
+
+# Proto Library : ecies_aead_hkdf_proto
+tink_make_protobuf_cpp_lib(
+  tink_proto_ecies_aead_hkdf_lib
+  TINK_PROTO_ECIES_AEAD_HKDF_LIB_PROTO_HDRS
+  ecies_aead_hkdf
+)
+add_dependencies(
+  tink_proto_ecies_aead_hkdf_lib
+  tink_proto_common_lib
+  tink_proto_tink_lib
+)
+target_link_libraries(
+  tink_proto_ecies_aead_hkdf_lib
+  tink_proto_common_lib
+  tink_proto_tink_lib
+)
+
+# Proto Library : xchacha20_poly1305_proto
+tink_make_protobuf_cpp_lib(
+  tink_proto_xchacha20_poly1305_lib
+  TINK_PROTO_XCHACHA20_POLY1305_LIB_PROTO_HDRS
+  xchacha20_poly1305
+)
+
+# Proto Library : empty_proto
+tink_make_protobuf_cpp_lib(
+  tink_proto_empty_lib
+  TINK_PROTO_EMPTY_LIB_PROTO_HDRS
+  empty
+)
+
diff --git a/tools/convert_bazel b/tools/convert_bazel
new file mode 100755
index 0000000..12dce2e
--- /dev/null
+++ b/tools/convert_bazel
@@ -0,0 +1,487 @@
+#! /usr/bin/env python3
+
+# Copyright 2018 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+"""
+convert_bazel is a tool for converting tink's BUILD.bazel files to
+CMakeLists.txt and BUILD.gn files. The system is very naive and likely brittle,
+but it works with the current BUILD.bazel files in /cc as of this writing.
+
+In order to re-generate all of the build files, you can simply run:
+
+tools/convert_bazel -r cc
+
+from the root directory of the repository.
+
+In order to only build specific build files, you can use --nogn or --nocmake to
+disable one or the other.
+
+To build only a single directory's files, omit the -r flag and pass the
+directory you want to use.
+"""
+
+import argparse
+import os
+import re
+import sys
+
+TEST = re.compile("^\s*cc_test\(?")
+LIB = re.compile("^\s*cc_library\(?")
+SIMPLE_ASSIGN = re.compile(r"""^ *(?P<key>[^ =\s]+) *= *"?(?P<value>[^[ ,"]+|\["?(?P<braced>[^]"]*)"?\])"?,?$""")
+MULTILINE_ASSIGN = re.compile(r"""^ *(?P<key>[^ =\s]+) *= *\[ *$""")
+MULTILINE_END = re.compile(" *\],?")
+END = re.compile("\)")
+
+def emit(name, *values, file=None, **flags):
+  parts = []
+  for value in values:
+    if isinstance(value, str):
+      parts.append(value)
+    else:
+      for v in value:
+        if isinstance(v, DepSpec):
+          val = v.get_cmake()
+          if val and val != "":
+            parts.append(val)
+        else:
+          parts.append(v)
+
+  simple = flags.get('simple', False) or len(parts) <= 3
+  print("{}(".format(name),end='' if simple else None, file=file)
+
+  contents = ""
+  for part in parts:
+    if contents:
+      if simple:
+        contents += " "
+      else:
+        contents += "\n  "
+    contents += part
+
+  if not simple:
+    print("  ",end='', file=file)
+    print(contents, file=file)
+    print(")", file=file)
+  if simple:
+    print("{})".format(contents), file=file)
+
+def emit_gn(target_type, name, file=None, **attributes):
+  print('{}("{}") {{'.format(target_type, name), file=file)
+  for key,value in sorted(attributes.items()):
+    if key.startswith("REMOVE_"):
+      print('  {} -= '.format(key[len("REMOVE_"):]), end='', file=file)
+    else:
+      print('  {} = '.format(key), end='', file=file)
+    if isinstance(value, str):
+      print('"{}"'.format(value), file=file)
+    elif isinstance(value, list) or isinstance(value, set):
+      print('[', file=file)
+      for entry in value:
+        print('    "{}",'.format(entry), file=file)
+      print('  ]', file=file)
+    elif isinstance(value, bool):
+      if value:
+        print('true', file=file)
+      else:
+        print('false', file=file)
+    else:
+      print(value, file=file)
+  print("}", file=file)
+  print(file=file)
+
+class Target:
+  def __init__(self, base_name, current_path):
+    self._data = {}
+    self._base_name = base_name or ""
+    self._current_path = current_path or ""
+    if self._current_path != "":
+      self._current_path += "/"
+
+  def srcs(self):
+    return self._data.get('srcs', [])
+
+  def hdrs(self):
+    return self._data.get('hdrs', [])
+
+  def deps(self):
+    return self._data.get('deps', [])
+
+  def local_deps(self):
+    return [dep for dep in self.deps() if isinstance(dep, LocalDep) or
+        isinstance(dep, RelativeLocalDep) or isinstance(dep, RootDep) or
+        isinstance(dep, ProtoDep)]
+
+  def cmake_name(self):
+    return self._base_name + self.name()
+
+  def name(self):
+    return self._data.get('name', "UNKNOWN_TARGET")
+
+  def add_value(self, key, value):
+    self._data[key] = value
+
+  def write_cmake(self, file, target_type, add_function):
+    print("# {}: '{}'".format(target_type, self.cmake_name()), file=file)
+    emit(add_function, self.cmake_name(), self.srcs(), self.hdrs(), file=file)
+    if not self.srcs():
+      emit('set_target_properties', self.cmake_name(),
+           'PROPERTIES LINKER_LANGUAGE CXX', file=file)
+    if self.hdrs():
+      emit('tink_export_hdrs', self.hdrs(), file=file)
+    if self.local_deps():
+      emit('add_dependencies', self.cmake_name(), self.local_deps(), file=file)
+    if any(isinstance(x, GtestDep) for x in self.deps()):
+      emit('add_dependencies', self.cmake_name(), 'build_external_projects',
+          file=file)
+    if self.deps():
+      emit('target_link_libraries', self.cmake_name(), self.deps(), file=file)
+    print(file=file)
+
+  def write_gn(self, file, target_type):
+    deps = self.deps().copy()
+    if self.hdrs():
+        deps.append(DepSpec(":{}copyfiles".format(self._base_name)))
+    emit_gn(
+        target_type,
+        self.name(),
+        output_name=self.cmake_name() + "_unittest",
+        testonly=any(isinstance(x, GtestDep) for x in deps),
+        sources=sorted(self.srcs() + self.hdrs()),
+        public_deps=[dep.get_gn() for dep in deps],
+        REMOVE_configs=["//build/config:no_rtti"],
+        public_configs=["//third_party/tink/cc:tink_config"],
+        file=file,
+    )
+
+class GlobalState(Target):
+  def __init__(self):
+    super(GlobalState, self).__init__(None, None)
+
+  def resolve(self, value):
+    if value in self._data:
+      return self._data[value]
+    return value
+
+class BazelTest(Target):
+  def write_cmake(self, file):
+    super(BazelTest, self).write_cmake(file, "Test Binary", "add_executable")
+
+  def write_gn(self, file):
+    super(BazelTest, self).write_gn(file, 'executable')
+
+class BazelLibrary(Target):
+  def write_cmake(self, file):
+    super(BazelLibrary, self).write_cmake(file, "Library", "add_library")
+
+  def write_gn(self, file):
+    super(BazelLibrary, self).write_gn(file, 'source_set')
+
+class DepSpec:
+  def __init__(self, value):
+    self._value = value
+
+  def get_cmake(self):
+    print("Unable to do depspec for " + self._value)
+    raise NotImplementedError
+
+  def get_gn(self):
+    return self._value
+
+  @staticmethod
+  def create(lib_prefix, current_path, value):
+    if isinstance(value, DepSpec):
+      return value
+    if value[0] == ':':
+      return LocalDep(lib_prefix, current_path, value[1:])
+    if value == "//cc":
+      return RootDep()
+    if value.startswith("//cc"):
+      return RelativeLocalDep("tink_", current_path, value[len("//cc:"):])
+    if value.startswith("@com_google_absl"):
+      return AbseilDep(value[len("@com_google_absl//absl/"):])
+    if value.startswith("//proto"):
+      return ProtoDep(value[len("//proto:"):-len("_cc_proto")])
+    if value == "@rapidjson":
+      return RapidjsonDep()
+    if value.startswith("@com_google_protobuf"):
+      return ProtobufDep()
+    if value.startswith("@com_google_googletest//:gtest"):
+      return GtestDep()
+    if value.startswith("@boringssl"):
+      return BoringsslDep(value[len("@boringssl//:"):])
+    return UnknownDep(value)
+
+class UnknownDep(DepSpec):
+  def get_cmake(self):
+    return "UNKNOWN DEPENDENCY!!!! ==== " + self._value
+
+class BoringsslDep(DepSpec):
+  def get_cmake(self):
+    return self._value
+
+  def get_gn(self):
+    return "//third_party/boringssl:{}".format(self._value)
+
+class AbseilDep(DepSpec):
+  def get_cmake(self):
+    return "absl::" + self._value
+
+  def get_gn(self):
+    return "//third_party/abseil-cpp/absl/{0}".format(self._value)
+
+class ProtoDep(DepSpec):
+  def get_cmake(self):
+    return "tink_proto_" + self._value + "_lib"
+
+  def get_gn(self):
+    return "//third_party/tink/proto:{}_proto".format(self._value)
+
+class GtestDep(DepSpec):
+  def __init__(self):
+    super(GtestDep, self).__init__("gtest gtest_main")
+
+  def get_cmake(self):
+    return "gtest gtest_main"
+
+  def get_gn(self):
+    return "//third_party/googletest:gtest_main"
+
+class ProtobufDep(DepSpec):
+  def __init__(self):
+    super(ProtobufDep, self).__init__("protobuf_lite")
+
+  def get_cmake(self):
+    return "protobuf_lite"
+
+  def get_gn(self):
+    return "//third_party/protobuf:protobuf_lite"
+
+class RapidjsonDep(DepSpec):
+  def __init__(self):
+    super(RapidjsonDep, self).__init__("rapidjson")
+
+  def get_cmake(self):
+    return "rapidjson"
+
+  def get_gn(self):
+    return "//third_party/rapidjson"
+
+class LocalDep(DepSpec):
+  def __init__(self, lib_prefix, current_path, value):
+    super(LocalDep, self).__init__(value)
+
+    self._lib_prefix = lib_prefix
+    self._current_path = current_path
+    if self._current_path != "":
+      self._current_path = "/{}".format(self._current_path)
+
+  def get_cmake(self):
+    return self._lib_prefix + self._value.replace("/", "_").replace(":", "_")
+
+  def get_gn(self):
+    return ":{}".format(self._value)
+
+class RelativeLocalDep(LocalDep):
+  def get_gn(self):
+    if ':' in self._value:
+      return '//third_party/tink/cc/{}'.format(self._value)
+    else:
+      return '//third_party/tink/cc:{}'.format(self._value)
+
+
+class RootDep(DepSpec):
+  def __init__(self):
+    super(RootDep, self).__init__("root")
+
+  def get_cmake(self):
+    return "tink_cc"
+
+  def get_gn(self):
+    return "//third_party/tink/cc:cc"
+
+
+class BuildFile:
+  def __init__(self, module_name, current_path):
+    self._global_state = GlobalState()
+    self._targets = []
+    self._module_name = module_name
+    self._current_path = current_path
+    self._current_target = None
+    self._current_multiline = None
+    self._multiline_values = None
+
+  def start_lib(self):
+    lib = BazelLibrary(self._module_name, self._current_path)
+    self._current_target = lib
+
+  def start_test(self):
+    test = BazelTest(self._module_name, self._current_path)
+    self._current_target = test
+
+  def end(self):
+    if self._current_target:
+      self._targets.append(self._current_target)
+      self._current_target = None
+
+  def add_value(self, key, value):
+    if key == "deps":
+      value = [DepSpec.create(self._module_name, self._current_path, v)
+          for v in value]
+
+    if self._current_target:
+      self._current_target.add_value(key, value)
+    else:
+      self._global_state.add_value(key, value)
+
+  def start_multiline(self, name):
+    self._current_multiline = name
+    self._multiline_values = []
+
+  def end_multiline(self):
+    self.add_value(self._current_multiline, self._multiline_values)
+    self._current_multiline = None
+    self._multiline_values = None
+
+  def multiline_in_progress(self):
+    return self._current_multiline
+
+  def add_multiline(self, value):
+    self._multiline_values.append(value)
+
+  def resolve(self, value):
+    return self._global_state.resolve(value)
+
+  def read_file(self, filename):
+    current_multiline = None
+    multiline_values = None
+    with open(filename) as f:
+      for line in f:
+        if END.match(line):
+          self.end()
+        elif TEST.match(line):
+          self.start_test()
+        elif LIB.match(line):
+          self.start_lib()
+        elif SIMPLE_ASSIGN.match(line):
+          result = SIMPLE_ASSIGN.search(line)
+          key = result.group("key")
+          value = result.group("value")
+          if result.group("braced"):
+            value = [result.group("braced")]
+          if isinstance(value, str):
+            value = self.resolve(value)
+            if value == "[]":
+              value = []
+          self.add_value(key, value)
+        elif MULTILINE_ASSIGN.match(line):
+          result = MULTILINE_ASSIGN.search(line)
+          self.start_multiline(result.group("key"))
+        elif MULTILINE_END.match(line):
+          self.end_multiline()
+        elif self.multiline_in_progress():
+          value = line.strip(' ",\n')
+          self.add_multiline(value)
+
+  @staticmethod
+  def write_license(file):
+    print("""# Copyright 2018 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+""", file=file)
+
+  def write_cmake(self, filename):
+    with open(filename, 'w') as f:
+      BuildFile.write_license(f)
+      if self._module_name == "tink_":
+        emit("add_subdirectory", "util", file=f)
+        emit("add_subdirectory", "aead", file=f)
+        emit("add_subdirectory", "mac", file=f)
+        emit("add_subdirectory", "hybrid", file=f)
+        emit("add_subdirectory", "config", file=f)
+        emit("add_subdirectory", "subtle", file=f)
+        emit("add_subdirectory", "signature", file=f)
+        print(file=f)
+
+      for target in self._targets:
+        target.write_cmake(f)
+
+  def write_gn(self, filename):
+    with open(filename, 'w') as f:
+      BuildFile.write_license(f)
+
+      if self._module_name == "tink_":
+        emit_gn(
+            'config',
+            'tink_config',
+            include_dirs=[
+              "$target_gen_dir/include",
+              "$target_gen_dir/.."
+            ],
+            cflags=[
+              "-Wno-ignored-qualifiers",
+              "-frtti",
+            ],
+            file=f,
+        )
+
+      hdrs_to_export = set()
+      for target in self._targets:
+        hdrs_to_export = hdrs_to_export.union(target.hdrs())
+      emit_gn(
+          'copy',
+          '{}copyfiles'.format(self._module_name),
+          sources=sorted(hdrs_to_export),
+          outputs=[
+            '$target_gen_dir/{}include/tink/{}'.format(
+              "" if self._current_path == "" else "../",
+              "" if self._current_path == "" else self._current_path + "/") + "{{source_file_part}}"
+          ],
+          file=f,
+      )
+
+      for target in self._targets:
+        target.write_gn(f)
+
+
+if __name__ == "__main__":
+  parser = argparse.ArgumentParser(description='Convert BUILD.bazel to CMakeLists.txt and BUILD.gn')
+  parser.add_argument('directories', metavar='DIR', type=str, nargs='*',
+                      help='The directories for which build files should be created')
+  parser.add_argument('--cmake', action='store_true', default=True,
+                      help='enable CMakeLists.txt output (default)')
+  parser.add_argument('--nocmake', action='store_const', const=False,
+                      dest='cmake',
+                      help='disable CMakeLists.txt output')
+  parser.add_argument('--gn', action='store_true', default=True,
+                      help='enable BUILD.gn output (default)')
+  parser.add_argument('--nogn', action='store_const', const=False, dest='gn',
+                      help='disable BUILD.gn output')
+  parser.add_argument('-r', '--recursive', action='store_true', dest='recursive')
+  args = parser.parse_args()
+
+  if not args.directories:
+    args.directories = ['.']
+
+  resolved_directories = args.directories
+  if args.recursive:
+    resolved_directories = []
+    for d in args.directories:
+      for root, dirs, files in os.walk(d):
+        if 'BUILD.bazel' in files:
+          resolved_directories.append(root)
+
+  for directory in resolved_directories:
+    directory = os.path.abspath(directory)
+    module_path = directory.split("cc")[1]
+    lib_prefix = "tink{}_".format(module_path.replace('/', '_'))
+    build_file = BuildFile(lib_prefix, module_path.lstrip('/'))
+    print("Parsing BUILD.bazel for `{}`".format(module_path))
+    build_file.read_file(os.path.join(directory, "BUILD.bazel"))
+    if args.gn:
+      print("  - Writing BUILD.gn")
+      build_file.write_gn(os.path.join(directory, "BUILD.gn"))
+    if args.cmake:
+      print("  - Writing CMakeLists.txt")
+      build_file.write_cmake(os.path.join(directory, "CMakeLists.txt"))
diff --git a/tools/convert_for_cobalt b/tools/convert_for_cobalt
new file mode 100755
index 0000000..4bd4235
--- /dev/null
+++ b/tools/convert_for_cobalt
@@ -0,0 +1,723 @@
+#! /usr/bin/env python3
+
+# Copyright 2019 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import os.path
+import sys
+import datetime
+
+
+def TargetNameFromInTreeSpec(spec):
+  dirname, name = ParseTargetSpec(spec)
+  head = dirname
+  path_list = [name]
+  while head != '':
+    head, tail = os.path.split(head)
+    path_list.insert(0, tail)
+  return '_'.join(path_list)
+
+
+def IsSubdir(parent, child):
+  if parent == child:
+    return False
+  return (os.path.commonpath([parent, child]) == parent)
+
+
+class BazelGlobals(object):
+  IGNORABLES = frozenset([
+      'load',
+      'package',
+      'licenses',
+      'exports_files',
+      'select',
+  ])
+
+  def __init__(self, build_graph, dirpath):
+    self._build_graph = build_graph
+    self._dirpath = dirpath
+    self._set_objects = {}
+
+  def __getitem__(self, key):
+    if key in self._set_objects:
+      return self._set_objects[key]
+
+    if key == '__builtins__':
+      raise KeyError(key)
+
+    if key in self.IGNORABLES:
+      return lambda *args, **kwargs: None
+
+    return self._build_graph.GetTargetAdder(self._dirpath, key)
+
+  def __setitem__(self, key, value):
+    self._set_objects[key] = value
+
+  def __contains__(self, key):
+    if key == '__builtins__':
+      raise KeyError(key)
+
+    return True
+
+  def __len__(self):
+    return 1
+
+
+class BuildGraph(object):
+
+  def __init__(self, root_path, ignored_targets):
+    self._targets = {}
+    if not os.path.isabs(root_path):
+      raise Exception('{} is not an absolute path.'.format(root_path))
+    self._root_path = root_path
+    self._ignored_targets = ignored_targets
+
+    # These are specs that will be remapped.
+    self._spec_map_old_to_new = {}
+
+  def AddTarget(self, target_cls, dirpath, name, deps=None, **kwargs):
+    if deps:
+      deps = [MakeTargetRef(dep, dirpath) for dep in deps]
+      deps = [dep for dep in deps if dep.spec() not in self._ignored_targets]
+      for i in range(len(deps)):
+        if deps[i].spec() not in self._spec_map_old_to_new:
+          continue
+        deps[i] = MakeTargetRef(self._spec_map_old_to_new[deps[i].spec()], dirpath)
+
+    target = target_cls(
+        dirpath=dirpath,
+        name=name,
+        sort_id=len(self._targets),
+        deps=deps,
+        **kwargs)
+    assert(isinstance(target, Target))
+    target = self.RemapTarget(target)
+    assert(isinstance(target, Target))
+    self._targets[target.spec()] = target
+
+  def RemapTarget(self, target):
+    "CMake does not like it if a cc_library has headers in a subdir. So we move the target."
+    if not isinstance(target, CcLibTarget):
+      return target
+
+    dirnames = [os.path.dirname(hdr) for hdr in target.hdrs]
+    if not any(d != '' for d in dirnames):
+      return target
+
+    if not all(d != '' for d in dirnames):
+      raise Exception('I do not know how to deal with targets that have some headers and sources in a subdirectory and some not: ' + target.spec)
+
+    if not all(d == dirnames[0] for d in dirnames):
+      raise Exception('I do not know how to deal with targets that have headers and sources in different subdirectories: ' + target.spec)
+
+    subdir = dirnames[0]
+
+    old_spec = target.spec()
+    dirpath = os.path.join(target.dirpath(), subdir)
+    name = target.name()
+    sort_id = target.sort_id()
+    deps = target.deps()
+    srcs = [os.path.relpath(src, subdir) for src in target.srcs]
+    hdrs = [os.path.relpath(hdr, subdir) for hdr in target.hdrs]
+    target = CcLibTarget(dirpath, name, sort_id, deps, srcs=srcs, hdrs=hdrs)
+
+    new_spec = target.spec()
+
+    self._spec_map_old_to_new[old_spec] = new_spec
+
+    for t in self._targets.values():
+      t.RemapDep(old_spec, new_spec)
+
+    return target
+
+
+  def GetTargetAdder(self, absdirpath, target_type):
+    if not IsSubdir(self._root_path, absdirpath):
+      Exception(
+          'GetTargetAdder expected a path under {} which {} is not.'.format(
+              self._root_path, absdirpath))
+    dirpath = os.path.relpath(absdirpath, self._root_path)
+    if target_type == 'proto_library':
+      return self.GetProtoLibraryAdder(dirpath)
+    elif target_type == 'cc_library':
+      return self.GetCcLibraryAdder(dirpath)
+    elif target_type == 'cc_proto_library':
+      return self.GetCcProtoLibraryAdder(dirpath)
+    return self.GetUnknownTargetAdder(dirpath, target_type)
+
+  def GetUnknownTargetAdder(self, dirpath, target_type):
+
+    def Add(*args, **kwargs):
+      if 'name' not in kwargs or args:
+        raise Exception(
+            '"{}" is not a target type. Please add to IGNORABLES.'.format(
+                target_type))
+      name = kwargs['name']
+      deps = kwargs.get('deps', [])
+      self.AddTarget(
+          UnknownTarget, dirpath, name, deps=deps, target_type=target_type)
+
+    return Add
+
+  def GetCcProtoLibraryAdder(self, dirpath):
+
+    def Add(name, deps=None, **kwargs):
+      self.AddTarget(CcProtoLibTarget, dirpath, name, deps=deps)
+
+    return Add
+
+  def GetProtoLibraryAdder(self, dirpath):
+
+    def Add(name, srcs, deps=None, **kwargs):
+      self.AddTarget(ProtoLibTarget, dirpath, name, srcs=srcs, deps=deps)
+
+    return Add
+
+  def GetCcLibraryAdder(self, dirpath):
+
+    def Add(name, srcs=None, hdrs=None, deps=None, **kwargs):
+      self.AddTarget(
+          CcLibTarget, dirpath, name, hdrs=hdrs, srcs=srcs, deps=deps)
+
+    return Add
+
+  def AddToGraph(self, dirpath):
+    filepath = os.path.join(dirpath, 'BUILD.bazel')
+    fp = open(filepath, 'r')
+    content = fp.read()
+    gs = BazelGlobals(self, dirpath)
+    exec(content, {}, gs)
+
+  def GetTarget(self, target_spec):
+    target_spec = self._spec_map_old_to_new.get(target_spec, target_spec)
+    if target_spec in self._ignored_targets:
+      raise Exception('{} is being ignored'.format(target_spec))
+    ref = MakeTargetRef(target_spec, '')
+    if not ref.InTree():
+      raise Exception('{} is not in the tree.'.format(target_spec))
+    if target_spec not in self._targets:
+      dirpath, _ = ParseTargetSpec(target_spec)
+      absdirpath = os.path.join(self._root_path, dirpath)
+      self.AddToGraph(absdirpath)
+      if target_spec not in self._targets:
+        print(self._targets.keys())
+        raise Exception('{} could not be found in {}'.format(
+            target_spec, absdirpath))
+
+    return self._targets[target_spec]
+
+
+##############################################################
+# The Targets themselves.
+##############################################################
+class Target(object):
+
+  def __init__(self, dirpath, name, sort_id, deps):
+    assert (isinstance(sort_id, int))
+    self._sort_id = sort_id
+    assert (isinstance(name, str))
+    self._name = name
+    assert (isinstance(dirpath, str))
+    self._dirpath = dirpath
+    self._deps = deps or []
+    assert (all(isinstance(dep, TargetRef) for dep in self._deps))
+
+  def __repr__(self):
+    raise NotImplementedError
+
+  def name(self):
+    return self._name
+
+  def spec(self):
+    return '//{}:{}'.format(self._dirpath, self._name)
+
+  def deps(self):
+    return self._deps
+
+  def dirpath(self):
+    return self._dirpath
+
+  def sort_id(self):
+    return self._sort_id
+
+  def target_type(self):
+    raise NotImplementedError
+
+  def IsUnknown(self):
+    return False
+
+  def IsProto(self):
+    return False
+
+  def RemapDep(self, old, new):
+    for i in range(len(self._deps)):
+      if self._deps[i].spec() == old:
+        self._deps[i] = MakeTargetRef(new, self._dirpath)
+
+
+class UnknownTarget(Target):
+
+  def __init__(self, dirpath, name, sort_id, target_type, deps):
+    super(UnknownTarget, self).__init__(dirpath, name, sort_id, deps=deps)
+    assert (isinstance(target_type, str))
+    self._target_type = target_type
+
+  def __repr__(self):
+    return 'UnknownTarget<{}: {}>'.format(self._target_type, self.spec())
+
+  def IsUnknown(self):
+    return True
+
+
+class LibTarget(Target):
+
+  def __init__(self, dirpath, name, sort_id, deps, srcs=None):
+    super(LibTarget, self).__init__(dirpath, name, sort_id, deps)
+    self.srcs = srcs or []
+
+  def __repr__(self):
+    return 'LibTarget<{}>'.format(self.spec())
+
+
+class ProtoLibTarget(LibTarget):
+
+  def IsProto(self):
+    return True
+
+  def __repr__(self):
+    return 'ProtoLibTarget<{}>'.format(self.spec())
+
+  def target_type(self):
+    return 'Proto Library'
+
+  def GetCMakeDep(self):
+    spec = self.spec()
+    suffix = '_proto'
+    if not spec.endswith(suffix):
+      raise Exception('Unexpected name for proto_library: ' + self.spec())
+    spec = spec[:-len(suffix)] + '_lib'
+
+    return TargetNameFromInTreeSpec(spec)
+
+
+class CcProtoLibTarget(Target):
+
+  def IsProto(self):
+    return True
+
+  def __repr__(self):
+    return 'CcProtoLibTarget<{}>'.format(self.spec())
+
+  def target_type(self):
+    return 'CC Proto Library'
+
+  def GetCMakeDep(self):
+    spec = self.spec()
+    suffix = '_cc_proto'
+    if not spec.endswith(suffix):
+      raise Exception('Unexpected name for cc_proto_library: ' + self.spec())
+    spec = spec[:-len(suffix)] + '_lib'
+
+    return TargetNameFromInTreeSpec(spec)
+
+
+class CcLibTarget(LibTarget):
+
+  def __init__(self, dirpath, name, sort_id, deps, srcs=None, hdrs=None):
+    super(CcLibTarget, self).__init__(
+        dirpath, name, sort_id, srcs=srcs, deps=deps)
+    self.hdrs = hdrs or []
+
+  def __repr__(self):
+    return 'CcLibTarget<{}>'.format(self.spec())
+
+  def target_type(self):
+    return 'CC Library'
+
+  def GetCMakeDep(self):
+    return TargetNameFromInTreeSpec(self.spec())
+
+
+##############################################################
+# Target references. (Used mostly for dependencies)
+##############################################################
+def ParseTargetSpec(dep):
+  parts = dep.split(':')
+  dirpath = parts[0][2:]
+  if len(parts) == 1:
+    name = os.path.basename(dep)
+  elif len(parts) == 2:
+    name = parts[1]
+  else:
+    raise Exception('I do not know how to deal with this dep: "{}"'.format(dep))
+
+  return dirpath, name
+
+
+def MakeTargetRef(dep, dirpath):
+  if dep[0] == ':':
+    return InTreeTargetRef(dirpath, dep[1:])
+  if dep[:2] == '//':
+    dirpath, name = ParseTargetSpec(dep)
+    return InTreeTargetRef(dirpath, name)
+
+  absl_prefix = '@com_google_absl'
+  if dep.startswith(absl_prefix):
+    dep = dep[len(absl_prefix):]
+    dirpath, name = ParseTargetSpec(dep)
+    return AbslTargetRef(dirpath, name)
+
+  if dep == '@com_google_protobuf//:protobuf_lite':
+    return ProtobufLiteTargetRef()
+
+  if dep == '@rapidjson':
+    return RapidJsonTargetRef()
+
+  googletest_prefix = '@com_google_googletest'
+  if dep.startswith(googletest_prefix):
+    dep = dep[len(googletest_prefix):]
+    dirpath, name = ParseTargetSpec(dep)
+    return GoogleTestTargetRef(dirpath, name)
+
+  boringssl_prefix = '@boringssl'
+  if dep.startswith(boringssl_prefix):
+    dep = dep[len(boringssl_prefix):]
+    dirpath, name = ParseTargetSpec(dep)
+    return BoringSslTargetRef(dirpath, name)
+
+  raise Exception('I do not know how to deal with this dep: "{}"'.format(dep))
+
+
+class TargetRef(object):
+
+  def InTree(self):
+    return False
+
+
+class PathTargetRef(TargetRef):
+
+  def __init__(self, dirpath, name):
+    self._dirpath = dirpath
+    self._name = name
+
+  def spec(self):
+    return '//{}:{}'.format(self._dirpath, self._name)
+
+  def dirpath(self):
+    return self._dirpath
+
+  def __repr__(self):
+    return '{}<{}>'.format(type(self).__name__, self.spec())
+
+
+class InTreeTargetRef(PathTargetRef):
+
+  def InTree(self):
+    return True
+
+
+class AbslTargetRef(PathTargetRef):
+
+  def GetCMakeDep(self):
+    return '::'.join(self._dirpath.split('/'))
+
+
+class GoogleTestTargetRef(PathTargetRef):
+  pass
+
+
+class ProtobufLiteTargetRef(TargetRef):
+
+  def GetCMakeDep(self):
+    return 'protobuf_lite'
+
+  def spec(self):
+    return '@protobuf_lite'
+
+
+class RapidJsonTargetRef(TargetRef):
+
+  def spec(self):
+    return '@rapidjson'
+
+
+class BoringSslTargetRef(PathTargetRef):
+
+  def GetCMakeDep(self):
+    return self._name
+
+  pass
+
+
+##############################################################
+# TargetFetcher grabs all the targets we need.
+##############################################################
+class TargetFetcher(object):
+
+  def __init__(self, build_graph, initial_targets, error_on_unknown):
+    # _to_fetch is a list of target specs.
+    self._to_fetch = initial_targets
+    self._targets = []
+    self._fetched = set()
+    self._build_graph = build_graph
+    self._error_on_unknown = error_on_unknown
+
+  def FetchAll(self):
+    while self._to_fetch:
+      self.FetchNext()
+    return self._targets
+
+  def FetchNext(self):
+    spec = self._to_fetch.pop(0)
+    if spec in self._fetched:
+      return
+
+    target = self._build_graph.GetTarget(spec)
+    if target.IsUnknown() and self._error_on_unknown:
+      raise Exception('Found unknown target: {}'.format(target))
+    self._targets.append(target)
+
+    # We add both the actual spec and the spec we tried to fetch just in
+    # case there was a remapping.
+    self._fetched.add(target.spec())
+    self._fetched.add(spec)
+    for dep in target.deps():
+      if not dep.InTree():
+        continue
+      if dep.spec() not in self._fetched:
+        self._to_fetch.append(dep.spec())
+
+
+##############################################################
+# BuildFile holds the information necessary to create a build file.
+##############################################################
+class BuildFile(object):
+
+  def __init__(self, dirpath, targets, subdirs):
+    self.dirpath = dirpath
+    self.targets = targets
+    self.subdirs = sorted(subdirs)
+
+  def HasProto(self):
+    return any(t.IsProto() for t in self.targets.values())
+
+
+def CreateBuildFiles(targets):
+  build_file_targets = {}
+  for t in targets:
+    if t.dirpath() not in build_file_targets:
+      build_file_targets[t.dirpath()] = {}
+    build_file_targets[t.dirpath()][t.spec()] = t
+
+  dirpaths = [k for k in build_file_targets.keys()]
+  build_files = []
+
+  for dirpath, targets in build_file_targets.items():
+    subdirs = []
+    for d in dirpaths:
+      # If d is an immediate subdirectory of dirpath, add it to subdirs
+      if not IsSubdir(dirpath, d):
+        continue
+      rel = os.path.relpath(d, dirpath)
+      if os.path.basename(rel) == rel:
+        subdirs.append(rel)
+
+    build_files.append(BuildFile(dirpath, targets, subdirs))
+
+  return build_files
+
+
+class BuildFileWriter(object):
+
+  def __init__(self, rootdir, build_graph, max_line):
+    self._rootdir = rootdir
+    self._max_line = max_line
+    self._build_graph = build_graph
+
+  def GetBuildFilePath(self, dirpath):
+    raise NotImplementedError
+
+  def WriteBuildFile(self, build_file):
+    self._indent = 0
+    self._filepath = self.GetBuildFilePath(build_file)
+    self._fp = open(self._filepath, 'w+')
+    self._build_file = build_file
+    self._nl = False
+
+    print('Writing to {},'.format(self._filepath))
+    self.WriteHeader()
+    targets = sorted(
+        build_file.targets.values(), key=lambda target: target.sort_id())
+
+    for target in targets:
+      self.WriteTarget(target)
+
+    assert (self._indent == 0)
+
+  def WriteHeader(self):
+    year = datetime.datetime.today().year
+    self.emitlines([
+        '# Copyright {} The Fuchsia Authors. All rights reserved.'.format(year),
+        '# Use of this source code is governed by a BSD-style license that can be',
+        '# found in the LICENSE file.'
+    ])
+
+  def WriteTarget(self, target):
+    self.emitnl('# {} : {}'.format(target.target_type(), target.name()))
+
+  def emit(self, s):
+    if self._nl:
+      self._fp.write('  ' * self._indent)
+      self._nl = False
+    if not isinstance(s, str):
+      raise Exception('emit expected a string, not {}'.format(s))
+    self._fp.write(s)
+
+  def emitnl(self, s):
+    self.emit(s)
+    self.nl()
+
+  def emitlines(self, lines):
+    for line in lines:
+      self.emitnl(line)
+
+  def nl(self):
+    self._fp.write('\n')
+    self._nl = True
+
+  def indent(self):
+    self._indent += 1
+
+  def deindent(self):
+    self._indent -= 1
+
+
+class CMakeWriter(BuildFileWriter):
+
+  def __init__(self, rootdir, target_prefix, build_graph, max_line):
+    super(CMakeWriter, self).__init__(
+        rootdir=rootdir, build_graph=build_graph, max_line=max_line)
+    self._target_prefix = target_prefix
+
+  def GetBuildFilePath(self, build_file):
+    return os.path.join(self._rootdir, build_file.dirpath, 'CMakeLists.txt')
+
+  def SingleLineFunction(self, func, *args):
+    return '{}({})'.format(func, ' '.join(args))
+
+  def WriteFunction(self, func, *args):
+    single = self.SingleLineFunction(func, *args)
+    if len(single) <= self._max_line:
+      self.emitnl(single)
+      return
+
+    self.emitnl('{}('.format(func))
+    self.indent()
+
+    for arg in args:
+      self.emitnl(arg)
+
+    self.deindent()
+    self.emitnl(')')
+
+  def WriteHeader(self):
+    super(CMakeWriter, self).WriteHeader()
+    self.nl()
+    for subdir in self._build_file.subdirs:
+      self.WriteFunction('add_subdirectory', subdir)
+    self.nl()
+
+    if not self._build_file.HasProto():
+      return
+
+  def WriteTarget(self, target):
+    # Skip cc_proto_lib targets.
+    if isinstance(target, CcProtoLibTarget):
+      return
+    super(CMakeWriter, self).WriteTarget(target)
+    if isinstance(target, CcLibTarget):
+      self.WriteCcLibTarget(target)
+      return
+    if isinstance(target, ProtoLibTarget):
+      self.WriteProtoLibTarget(target)
+      return
+    raise NotImplementedError('I do not know how to write {}'.format(
+        str(target)))
+
+  def WriteLibTargetDeps(self, target):
+    name = self.TargetName(target)
+    in_tree_deps = [self.DepName(dep) for dep in target.deps() if dep.InTree()]
+    deps = [self.DepName(dep) for dep in target.deps()]
+
+    if in_tree_deps:
+      self.WriteFunction('add_dependencies', name, *in_tree_deps)
+    if deps:
+      self.WriteFunction('target_link_libraries', name, *deps)
+
+  def WriteCcLibTarget(self, target):
+    name = self.TargetName(target)
+    self.WriteFunction('add_library', name, *target.hdrs, *target.srcs)
+    if not target.srcs:
+      self.WriteFunction('set_target_properties', name, 'PROPERTIES',
+                         'LINKER_LANGUAGE', 'CXX')
+    if target.hdrs:
+      self.WriteFunction('tink_export_hdrs', *target.hdrs)
+    self.WriteLibTargetDeps(target)
+    self.nl()
+
+  def WriteProtoLibTarget(self, target):
+    name = self.TargetName(target)
+    srcs = []
+    for src in target.srcs:
+      suffix = '.proto'
+      if not src.endswith(suffix):
+        raise Exception('Unexpected name {} for proto in {}'.format(
+            src, target.spec()))
+      srcs.append(src[:-len(suffix)])
+    hdrs_out = name.upper() + '_PROTO_HDRS'
+    self.WriteFunction('tink_make_protobuf_cpp_lib', name, hdrs_out, *srcs)
+    self.WriteLibTargetDeps(target)
+    self.nl()
+
+  def TargetName(self, target):
+    return self._target_prefix + '_' + target.GetCMakeDep()
+
+  def DepName(self, dep):
+    if dep.InTree():
+      target = self._build_graph.GetTarget(dep.spec())
+      return self._target_prefix + '_' + target.GetCMakeDep()
+    return dep.GetCMakeDep()
+
+
+def main(args):
+  script_path = os.path.abspath(args[0])
+  tools_path = os.path.dirname(script_path)
+  tink_path = os.path.dirname(tools_path)
+  cc_path = os.path.join(tink_path, 'cc')
+
+  # Targets listed her are the start of the fetch. Put all the targets you plan
+  # on directly depending upon here.
+  targets = [
+      '//cc/hybrid:hybrid_config',
+      '//cc/hybrid:hybrid_encrypt_factory',
+      '//cc/hybrid:hybrid_decrypt_factory',
+      '//cc:hybrid_decrypt',
+      '//cc:hybrid_encrypt',
+      '//cc:keyset_handle',
+  ]
+  # Targets listed here will be ignored.
+  ignored_targets = frozenset([])
+  graph = BuildGraph(tink_path, ignored_targets)
+  fetcher = TargetFetcher(graph, targets, error_on_unknown=True)
+  targets = fetcher.FetchAll()
+  print('Found {} targets.'.format(len(targets)))
+  build_files = CreateBuildFiles(targets)
+  cmake_writer = CMakeWriter(
+      rootdir=tink_path, target_prefix='tink', build_graph=graph, max_line=80)
+  for f in build_files:
+    cmake_writer.WriteBuildFile(f)
+
+
+if __name__ == '__main__':
+  sys.exit(main(sys.argv))