diff options
author | Pauli <ppzgs1@gmail.com> | 2024-06-27 10:08:05 +1000 |
---|---|---|
committer | Pauli <ppzgs1@gmail.com> | 2024-06-29 14:12:32 +1000 |
commit | 7582ad23b1ee34e606a2d2699da685688c55d9ed (patch) | |
tree | 75e92c1f5bbc5a30603ac998eb846b1f7c865b1a | |
parent | 518dfe8de6f99c29f790b142750adcf2ea657cdf (diff) | |
download | openssl-7582ad23b1ee34e606a2d2699da685688c55d9ed.zip openssl-7582ad23b1ee34e606a2d2699da685688c55d9ed.tar.gz openssl-7582ad23b1ee34e606a2d2699da685688c55d9ed.tar.bz2 |
Clarify DRBG seeding.
There is a legacy code path that OpenSSL won't use anymore but applications
could. Add a comment indicating this to avoid confusion for people not
intimately conversant with the nuances in the RNG code.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24745)
(cherry picked from commit 1eb122aa0ca152dc564e61674caf3f11acd85b57)
-rw-r--r-- | providers/implementations/rands/drbg.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/providers/implementations/rands/drbg.c b/providers/implementations/rands/drbg.c index 46a056b..4d48a48 100644 --- a/providers/implementations/rands/drbg.c +++ b/providers/implementations/rands/drbg.c @@ -202,6 +202,11 @@ static size_t get_entropy(PROV_DRBG *drbg, unsigned char **pout, int entropy, return ossl_crngt_get_entropy(drbg, pout, entropy, min_len, max_len, prediction_resistance); #else + /* + * In normal use (i.e. OpenSSL's own uses), this is never called. + * Outside of the FIPS provider, OpenSSL sets its DRBGs up so that + * they always have a parent. This remains purely for legacy reasons. + */ return ossl_prov_get_entropy(drbg->provctx, pout, entropy, min_len, max_len); #endif |