diff options
34 files changed, 816 insertions, 1397 deletions
diff --git a/apps/speed.c b/apps/speed.c index 2d943b1..4a2a4a9 100644 --- a/apps/speed.c +++ b/apps/speed.c @@ -247,11 +247,6 @@ static double ecdsa_results[EC_NUM][2]; static double ecdh_results[EC_NUM][1]; #endif -#if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_EC) -static const char rnd_seed[] = - "string to make the random number generator think it has randomness"; -#endif - #ifdef SIGALRM # if defined(__STDC__) || defined(sgi) || defined(_AIX) # define SIGRETTYPE void @@ -2397,9 +2392,6 @@ int speed_main(int argc, char **argv) RAND_bytes(loopargs[i].buf, 36); #ifndef OPENSSL_NO_DSA - if (RAND_status() != 1) { - RAND_seed(rnd_seed, sizeof rnd_seed); - } for (testnum = 0; testnum < DSA_NUM; testnum++) { int st = 0; if (!dsa_doit[testnum]) @@ -2467,9 +2459,6 @@ int speed_main(int argc, char **argv) #endif /* OPENSSL_NO_DSA */ #ifndef OPENSSL_NO_EC - if (RAND_status() != 1) { - RAND_seed(rnd_seed, sizeof rnd_seed); - } for (testnum = 0; testnum < EC_NUM; testnum++) { int st = 1; @@ -2554,9 +2543,6 @@ int speed_main(int argc, char **argv) } } - if (RAND_status() != 1) { - RAND_seed(rnd_seed, sizeof rnd_seed); - } for (testnum = 0; testnum < EC_NUM; testnum++) { int ecdh_checks = 1; diff --git a/crypto/bn/bn_rand.c b/crypto/bn/bn_rand.c index a7c7309..0b9e43d 100644 --- a/crypto/bn/bn_rand.c +++ b/crypto/bn/bn_rand.c @@ -18,7 +18,6 @@ static int bnrand(int testing, BIGNUM *rnd, int bits, int top, int bottom) { unsigned char *buf = NULL; int ret = 0, bit, bytes, mask; - time_t tim; if (bits == 0) { if (top != BN_RAND_TOP_ANY || bottom != BN_RAND_BOTTOM_ANY) @@ -40,9 +39,6 @@ static int bnrand(int testing, BIGNUM *rnd, int bits, int top, int bottom) } /* make a random number and set the top and bottom bits */ - time(&tim); - RAND_add(&tim, sizeof(tim), 0.0); - if (RAND_bytes(buf, bytes) <= 0) goto err; diff --git a/crypto/dsa/dsa_asn1.c b/crypto/dsa/dsa_asn1.c index 7de00c7..92d6ae0 100644 --- a/crypto/dsa/dsa_asn1.c +++ b/crypto/dsa/dsa_asn1.c @@ -111,7 +111,7 @@ int DSA_sign(int type, const unsigned char *dgst, int dlen, unsigned char *sig, unsigned int *siglen, DSA *dsa) { DSA_SIG *s; - RAND_seed(dgst, dlen); + s = DSA_do_sign(dgst, dlen, dsa); if (s == NULL) { *siglen = 0; diff --git a/crypto/ec/ecdsa_ossl.c b/crypto/ec/ecdsa_ossl.c index d67c485..c7ab0ee 100644 --- a/crypto/ec/ecdsa_ossl.c +++ b/crypto/ec/ecdsa_ossl.c @@ -20,7 +20,7 @@ int ossl_ecdsa_sign(int type, const unsigned char *dgst, int dlen, const BIGNUM *kinv, const BIGNUM *r, EC_KEY *eckey) { ECDSA_SIG *s; - RAND_seed(dgst, dlen); + s = ECDSA_do_sign_ex(dgst, dlen, kinv, r, eckey); if (s == NULL) { *siglen = 0; diff --git a/crypto/evp/evp_pkey.c b/crypto/evp/evp_pkey.c index 81bffa6..e61a876 100644 --- a/crypto/evp/evp_pkey.c +++ b/crypto/evp/evp_pkey.c @@ -80,7 +80,6 @@ PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8(EVP_PKEY *pkey) EVPerr(EVP_F_EVP_PKEY2PKCS8, EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM); goto error; } - RAND_add(p8->pkey->data, p8->pkey->length, 0.0); return p8; error: PKCS8_PRIV_KEY_INFO_free(p8); diff --git a/crypto/pem/pem_lib.c b/crypto/pem/pem_lib.c index cfe2fa6..76e0698 100644 --- a/crypto/pem/pem_lib.c +++ b/crypto/pem/pem_lib.c @@ -361,7 +361,6 @@ int PEM_ASN1_write_bio(i2d_of_void *i2d, const char *name, BIO *bp, #endif kstr = (unsigned char *)buf; } - RAND_add(data, i, 0); /* put in the RSA key. */ OPENSSL_assert(EVP_CIPHER_iv_length(enc) <= (int)sizeof(iv)); if (RAND_bytes(iv, EVP_CIPHER_iv_length(enc)) <= 0) /* Generate a salt */ goto err; diff --git a/crypto/rand/build.info b/crypto/rand/build.info index f011d78..2591c01 100644 --- a/crypto/rand/build.info +++ b/crypto/rand/build.info @@ -1,4 +1,4 @@ LIBS=../../libcrypto SOURCE[../../libcrypto]=\ - ossl_rand.c randfile.c rand_lib.c rand_err.c rand_egd.c \ + randfile.c rand_lib.c rand_err.c rand_egd.c \ rand_win.c rand_unix.c rand_vms.c drbg_lib.c drbg_rand.c diff --git a/crypto/rand/drbg_lib.c b/crypto/rand/drbg_lib.c index 1588515..e3d97d3 100644 --- a/crypto/rand/drbg_lib.c +++ b/crypto/rand/drbg_lib.c @@ -15,53 +15,28 @@ /* * Support framework for NIST SP 800-90A DRBG, AES-CTR mode. - */ - -/* - * Get entropy from the existing callback. This is mainly used for KATs. - */ -static size_t get_entropy(DRBG_CTX *dctx, unsigned char **pout, - int entropy, size_t min_len, size_t max_len) -{ - if (dctx->get_entropy != NULL) - return dctx->get_entropy(dctx, pout, entropy, min_len, max_len); - /* TODO: Get from parent if it exists. */ - return 0; -} - -/* - * Cleanup entropy. - */ -static void cleanup_entropy(DRBG_CTX *dctx, unsigned char *out, size_t olen) -{ - if (dctx->cleanup_entropy != NULL) - dctx->cleanup_entropy(dctx, out, olen); -} - -/* + * The RAND_DRBG is OpenSSL's pointer to an instance of the DRBG. + * * The OpenSSL model is to have new and free functions, and that new * does all initialization. That is not the NIST model, which has * instantiation and un-instantiate, and re-use within a new/free * lifecycle. (No doubt this comes from the desire to support hardware * DRBG, where allocation of resources on something like an HSM is * a much bigger deal than just re-setting an allocated resource.) - * - * The DRBG_CTX is OpenSSL's opaque pointer to an instance of the - * DRBG. */ /* - * Set/initialize |dctx| to be of type |nid|, with optional |flags|. + * Set/initialize |drbg| to be of type |nid|, with optional |flags|. * Return -2 if the type is not supported, 1 on success and -1 on * failure. */ -int RAND_DRBG_set(DRBG_CTX *dctx, int nid, unsigned int flags) +int RAND_DRBG_set(RAND_DRBG *drbg, int nid, unsigned int flags) { int ret = 1; - dctx->status = DRBG_STATUS_UNINITIALISED; - dctx->flags = flags; - dctx->nid = nid; + drbg->state = DRBG_UNINITIALISED; + drbg->flags = flags; + drbg->nid = nid; switch (nid) { default: @@ -73,7 +48,7 @@ int RAND_DRBG_set(DRBG_CTX *dctx, int nid, unsigned int flags) case NID_aes_128_ctr: case NID_aes_192_ctr: case NID_aes_256_ctr: - ret = ctr_init(dctx); + ret = ctr_init(drbg); break; } @@ -84,169 +59,176 @@ int RAND_DRBG_set(DRBG_CTX *dctx, int nid, unsigned int flags) /* * Allocate memory and initialize a new DRBG. The |parent|, if not - * NULL, will be used to auto-seed this DRBG_CTX as needed. + * NULL, will be used to auto-seed this RAND_DRBG as needed. */ -DRBG_CTX *RAND_DRBG_new(int type, unsigned int flags, DRBG_CTX *parent) +RAND_DRBG *RAND_DRBG_new(int type, unsigned int flags, RAND_DRBG *parent) { - DRBG_CTX *dctx = OPENSSL_zalloc(sizeof(*dctx)); + RAND_DRBG *drbg = OPENSSL_zalloc(sizeof(*drbg)); + unsigned char *ucp = OPENSSL_zalloc(RANDOMNESS_NEEDED); - if (dctx == NULL) { + if (drbg == NULL || ucp == NULL) { RANDerr(RAND_F_RAND_DRBG_NEW, ERR_R_MALLOC_FAILURE); - return NULL; + goto err; } - - dctx->parent = parent; - if (RAND_DRBG_set(dctx, type, flags) < 0) { - OPENSSL_free(dctx); - return NULL; + drbg->size = RANDOMNESS_NEEDED; + drbg->randomness = ucp; + + drbg->parent = parent; + if (RAND_DRBG_set(drbg, type, flags) < 0) + goto err; + + if (parent != NULL) { + if (!RAND_DRBG_set_callbacks(drbg, drbg_entropy_from_parent, + drbg_release_entropy, + NULL, NULL) + /* + * Add in our address. Note we are adding the pointer + * itself, not its contents! + */ + || !RAND_DRBG_instantiate(drbg, + (unsigned char*)&drbg, sizeof(drbg))) + goto err; } - return dctx; + + return drbg; + +err: + OPENSSL_free(ucp); + OPENSSL_free(drbg); + return NULL; } /* - * Uninstantiate |dctx| and free all memory. + * Uninstantiate |drbg| and free all memory. */ -void RAND_DRBG_free(DRBG_CTX *dctx) +void RAND_DRBG_free(RAND_DRBG *drbg) { - if (dctx == NULL) + /* The global DRBG is free'd by rand_cleanup_int() */ + if (drbg == NULL || drbg == &rand_drbg) return; - ctr_uninstantiate(dctx); - CRYPTO_free_ex_data(CRYPTO_EX_INDEX_DRBG, dctx, &dctx->ex_data); - - /* Don't free up default DRBG */ - if (dctx == RAND_DRBG_get_default()) { - memset(dctx, 0, sizeof(DRBG_CTX)); - dctx->nid = 0; - dctx->status = DRBG_STATUS_UNINITIALISED; - } else { - OPENSSL_cleanse(&dctx->ctr, sizeof(dctx->ctr)); - OPENSSL_free(dctx); - } + ctr_uninstantiate(drbg); + OPENSSL_cleanse(drbg->randomness, drbg->size); + OPENSSL_free(drbg->randomness); + CRYPTO_free_ex_data(CRYPTO_EX_INDEX_DRBG, drbg, &drbg->ex_data); + OPENSSL_clear_free(drbg, sizeof(*drbg)); } /* - * Instantiate |dctx|, after it has been initialized. Use |pers| and + * Instantiate |drbg|, after it has been initialized. Use |pers| and * |perslen| as prediction-resistance input. */ -int RAND_DRBG_instantiate(DRBG_CTX *dctx, +int RAND_DRBG_instantiate(RAND_DRBG *drbg, const unsigned char *pers, size_t perslen) { - size_t entlen = 0, noncelen = 0; unsigned char *nonce = NULL, *entropy = NULL; - int r = 0; + size_t noncelen = 0, entlen = 0; - if (perslen > dctx->max_pers) { - r = RAND_R_PERSONALISATION_STRING_TOO_LONG; + if (perslen > drbg->max_pers) { + RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, + RAND_R_PERSONALISATION_STRING_TOO_LONG); goto end; } - if (dctx->status != DRBG_STATUS_UNINITIALISED) { - r = dctx->status == DRBG_STATUS_ERROR ? RAND_R_IN_ERROR_STATE - : RAND_R_ALREADY_INSTANTIATED; + if (drbg->state != DRBG_UNINITIALISED) { + RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, + drbg->state == DRBG_ERROR ? RAND_R_IN_ERROR_STATE + : RAND_R_ALREADY_INSTANTIATED); goto end; } - dctx->status = DRBG_STATUS_ERROR; - entlen = get_entropy(dctx, &entropy, dctx->strength, - dctx->min_entropy, dctx->max_entropy); - if (entlen < dctx->min_entropy || entlen > dctx->max_entropy) { - r = RAND_R_ERROR_RETRIEVING_ENTROPY; + drbg->state = DRBG_ERROR; + if (drbg->get_entropy != NULL) + entlen = drbg->get_entropy(drbg, &entropy, drbg->strength, + drbg->min_entropy, drbg->max_entropy); + if (entlen < drbg->min_entropy || entlen > drbg->max_entropy) { + RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, RAND_R_ERROR_RETRIEVING_ENTROPY); goto end; } - if (dctx->max_nonce > 0 && dctx->get_nonce != NULL) { - noncelen = dctx->get_nonce(dctx, &nonce, - dctx->strength / 2, - dctx->min_nonce, dctx->max_nonce); - - if (noncelen < dctx->min_nonce || noncelen > dctx->max_nonce) { - r = RAND_R_ERROR_RETRIEVING_NONCE; + if (drbg->max_nonce > 0 && drbg->get_nonce != NULL) { + noncelen = drbg->get_nonce(drbg, &nonce, drbg->strength / 2, + drbg->min_nonce, drbg->max_nonce); + if (noncelen < drbg->min_nonce || noncelen > drbg->max_nonce) { + RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, RAND_R_ERROR_RETRIEVING_NONCE); goto end; } } - if (!ctr_instantiate(dctx, entropy, entlen, + if (!ctr_instantiate(drbg, entropy, entlen, nonce, noncelen, pers, perslen)) { - r = RAND_R_ERROR_INSTANTIATING_DRBG; + RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, RAND_R_ERROR_INSTANTIATING_DRBG); goto end; } - dctx->status = DRBG_STATUS_READY; - dctx->reseed_counter = 1; + drbg->state = DRBG_READY; + drbg->reseed_counter = 1; end: - if (entropy != NULL && dctx->cleanup_entropy != NULL) - dctx->cleanup_entropy(dctx, entropy, entlen); - if (nonce != NULL && dctx->cleanup_nonce!= NULL ) - dctx->cleanup_nonce(dctx, nonce, noncelen); - if (dctx->status == DRBG_STATUS_READY) + if (entropy != NULL && drbg->cleanup_entropy != NULL) + drbg->cleanup_entropy(drbg, entropy); + if (nonce != NULL && drbg->cleanup_nonce!= NULL ) + drbg->cleanup_nonce(drbg, nonce); + if (drbg->state == DRBG_READY) return 1; - - if (r) - RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, r); return 0; } /* - * Uninstantiate |dctx|. Must be instantiated before it can be used. + * Uninstantiate |drbg|. Must be instantiated before it can be used. */ -int RAND_DRBG_uninstantiate(DRBG_CTX *dctx) +int RAND_DRBG_uninstantiate(RAND_DRBG *drbg) { - int ret = ctr_uninstantiate(dctx); + int ret = ctr_uninstantiate(drbg); - OPENSSL_cleanse(&dctx->ctr, sizeof(dctx->ctr)); - dctx->status = DRBG_STATUS_UNINITIALISED; + OPENSSL_cleanse(&drbg->ctr, sizeof(drbg->ctr)); + drbg->state = DRBG_UNINITIALISED; return ret; } /* - * Mix in the specified data to reseed |dctx|. + * Mix in the specified data to reseed |drbg|. */ -int RAND_DRBG_reseed(DRBG_CTX *dctx, +int RAND_DRBG_reseed(RAND_DRBG *drbg, const unsigned char *adin, size_t adinlen) { unsigned char *entropy = NULL; size_t entlen = 0; - int r = 0; - - if (dctx->status != DRBG_STATUS_READY - && dctx->status != DRBG_STATUS_RESEED) { - if (dctx->status == DRBG_STATUS_ERROR) - r = RAND_R_IN_ERROR_STATE; - else if (dctx->status == DRBG_STATUS_UNINITIALISED) - r = RAND_R_NOT_INSTANTIATED; - goto end; + + if (drbg->state == DRBG_ERROR) { + RANDerr(RAND_F_RAND_DRBG_RESEED, RAND_R_IN_ERROR_STATE); + return 0; + } + if (drbg->state == DRBG_UNINITIALISED) { + RANDerr(RAND_F_RAND_DRBG_RESEED, RAND_R_NOT_INSTANTIATED); + return 0; } if (adin == NULL) adinlen = 0; - else if (adinlen > dctx->max_adin) { - r = RAND_R_ADDITIONAL_INPUT_TOO_LONG; - goto end; + else if (adinlen > drbg->max_adin) { + RANDerr(RAND_F_RAND_DRBG_RESEED, RAND_R_ADDITIONAL_INPUT_TOO_LONG); + return 0; } - dctx->status = DRBG_STATUS_ERROR; - entlen = get_entropy(dctx, &entropy, dctx->strength, - dctx->min_entropy, dctx->max_entropy); - - if (entlen < dctx->min_entropy || entlen > dctx->max_entropy) { - r = RAND_R_ERROR_RETRIEVING_ENTROPY; + drbg->state = DRBG_ERROR; + if (drbg->get_entropy != NULL) + entlen = drbg->get_entropy(drbg, &entropy, drbg->strength, + drbg->min_entropy, drbg->max_entropy); + if (entlen < drbg->min_entropy || entlen > drbg->max_entropy) { + RANDerr(RAND_F_RAND_DRBG_RESEED, RAND_R_ERROR_RETRIEVING_ENTROPY); goto end; } - if (!ctr_reseed(dctx, entropy, entlen, adin, adinlen)) + if (!ctr_reseed(drbg, entropy, entlen, adin, adinlen)) goto end; - dctx->status = DRBG_STATUS_READY; - dctx->reseed_counter = 1; + drbg->state = DRBG_READY; + drbg->reseed_counter = 1; end: - if (entropy != NULL && dctx->cleanup_entropy != NULL) - cleanup_entropy(dctx, entropy, entlen); - if (dctx->status == DRBG_STATUS_READY) + if (entropy != NULL && drbg->cleanup_entropy != NULL) + drbg->cleanup_entropy(drbg, entropy); + if (drbg->state == DRBG_READY) return 1; - if (r) - RANDerr(RAND_F_RAND_DRBG_RESEED, r); - return 0; } @@ -255,98 +237,183 @@ end: * to or if |prediction_resistance| is set. Additional input can be * sent in |adin| and |adinlen|. */ -int RAND_DRBG_generate(DRBG_CTX *dctx, unsigned char *out, size_t outlen, +int RAND_DRBG_generate(RAND_DRBG *drbg, unsigned char *out, size_t outlen, int prediction_resistance, const unsigned char *adin, size_t adinlen) { - int r = 0; - - if (dctx->status != DRBG_STATUS_READY - && dctx->status != DRBG_STATUS_RESEED) { - if (dctx->status == DRBG_STATUS_ERROR) - r = RAND_R_IN_ERROR_STATE; - else if(dctx->status == DRBG_STATUS_UNINITIALISED) - r = RAND_R_NOT_INSTANTIATED; - goto end; + if (drbg->state == DRBG_ERROR) { + RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_IN_ERROR_STATE); + return 0; } - - if (outlen > dctx->max_request) { - r = RAND_R_REQUEST_TOO_LARGE_FOR_DRBG; + if (drbg->state == DRBG_UNINITIALISED) { + RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_NOT_INSTANTIATED); return 0; } - if (adinlen > dctx->max_adin) { - r = RAND_R_ADDITIONAL_INPUT_TOO_LONG; - goto end; + if (outlen > drbg->max_request) { + RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_REQUEST_TOO_LARGE_FOR_DRBG); + return 0; + } + if (adinlen > drbg->max_adin) { + RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_ADDITIONAL_INPUT_TOO_LONG); + return 0; } - if (dctx->reseed_counter >= dctx->reseed_interval) - dctx->status = DRBG_STATUS_RESEED; + if (drbg->reseed_counter >= drbg->reseed_interval) + drbg->state = DRBG_RESEED; - if (dctx->status == DRBG_STATUS_RESEED || prediction_resistance) { - if (!RAND_DRBG_reseed(dctx, adin, adinlen)) { - r = RAND_R_RESEED_ERROR; - goto end; + if (drbg->state == DRBG_RESEED || prediction_resistance) { + if (!RAND_DRBG_reseed(drbg, adin, adinlen)) { + RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_RESEED_ERROR); + return 0; } adin = NULL; adinlen = 0; } - if (!ctr_generate(dctx, out, outlen, adin, adinlen)) { - r = RAND_R_GENERATE_ERROR; - dctx->status = DRBG_STATUS_ERROR; - goto end; + if (!ctr_generate(drbg, out, outlen, adin, adinlen)) { + drbg->state = DRBG_ERROR; + RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_GENERATE_ERROR); + return 0; } - if (dctx->reseed_counter >= dctx->reseed_interval) - dctx->status = DRBG_STATUS_RESEED; + + if (drbg->reseed_counter >= drbg->reseed_interval) + drbg->state = DRBG_RESEED; else - dctx->reseed_counter++; + drbg->reseed_counter++; return 1; - -end: - RANDerr(RAND_F_RAND_DRBG_GENERATE, r); - return 0; } /* - * Set the callbacks for entropy and nonce. Used mainly for the KATs + * Set the callbacks for entropy and nonce. We currently don't use + * the nonce; that's mainly for the KATs */ -int RAND_DRBG_set_callbacks(DRBG_CTX *dctx, - size_t (*cb_get_entropy)(DRBG_CTX *ctx, unsigned char **pout, - int entropy, size_t min_len, size_t max_len), - void (*cb_cleanup_entropy)(DRBG_CTX *ctx, unsigned char *out, size_t olen), - size_t (*cb_get_nonce)(DRBG_CTX *ctx, unsigned char **pout, - int entropy, size_t min_len, size_t max_len), - void (*cb_cleanup_nonce)(DRBG_CTX *ctx, unsigned char *out, size_t olen)) +int RAND_DRBG_set_callbacks(RAND_DRBG *drbg, + RAND_DRBG_get_entropy_fn cb_get_entropy, + RAND_DRBG_cleanup_entropy_fn cb_cleanup_entropy, + RAND_DRBG_get_nonce_fn cb_get_nonce, + RAND_DRBG_cleanup_nonce_fn cb_cleanup_nonce) { - if (dctx->status != DRBG_STATUS_UNINITIALISED) + if (drbg->state != DRBG_UNINITIALISED) return 0; - dctx->get_entropy = cb_get_entropy; - dctx->cleanup_entropy = cb_cleanup_entropy; - dctx->get_nonce = cb_get_nonce; - dctx->cleanup_nonce = cb_cleanup_nonce; + drbg->get_entropy = cb_get_entropy; + drbg->cleanup_entropy = cb_cleanup_entropy; + drbg->get_nonce = cb_get_nonce; + drbg->cleanup_nonce = cb_cleanup_nonce; return 1; } /* - * Set the reseed interval. Used mainly for the KATs. + * Set the reseed interval. */ -int RAND_DRBG_set_reseed_interval(DRBG_CTX *dctx, int interval) +int RAND_DRBG_set_reseed_interval(RAND_DRBG *drbg, int interval) { if (interval < 0 || interval > MAX_RESEED) return 0; - dctx->reseed_interval = interval; + drbg->reseed_interval = interval; return 1; } /* * Get and set the EXDATA */ -int RAND_DRBG_set_ex_data(DRBG_CTX *dctx, int idx, void *arg) +int RAND_DRBG_set_ex_data(RAND_DRBG *drbg, int idx, void *arg) +{ + return CRYPTO_set_ex_data(&drbg->ex_data, idx, arg); +} + +void *RAND_DRBG_get_ex_data(const RAND_DRBG *drbg, int idx) +{ + return CRYPTO_get_ex_data(&drbg->ex_data, idx); +} + + +/* + * The following functions provide a RAND_METHOD that works on the + * global DRBG. They lock. + */ + +static int drbg_bytes(unsigned char *out, int count) +{ + int ret = 0; + size_t chunk; + + CRYPTO_THREAD_write_lock(rand_drbg.lock); + if (rand_drbg.state == DRBG_UNINITIALISED + && RAND_DRBG_instantiate(&rand_drbg, NULL, 0) == 0) + goto err; + + for ( ; count > 0; count -= chunk, out += chunk) { + chunk = count; + if (chunk > rand_drbg.max_request) + chunk = rand_drbg.max_request; + ret = RAND_DRBG_generate(&rand_drbg, out, chunk, 0, NULL, 0); + if (!ret) + goto err; + } + ret = 1; + +err: + CRYPTO_THREAD_unlock(rand_drbg.lock); + return ret; +} + +static void drbg_cleanup(void) +{ + CRYPTO_THREAD_write_lock(rand_drbg.lock); + RAND_DRBG_uninstantiate(&rand_drbg); + CRYPTO_THREAD_unlock(rand_drbg.lock); +} + +static int drbg_add(const void *buf, int num, double randomness) +{ + unsigned char *in = (unsigned char *)buf; + unsigned char *out, *end; + + CRYPTO_THREAD_write_lock(rand_bytes.lock); + out = &rand_bytes.buff[rand_bytes.curr]; + end = &rand_bytes.buff[rand_bytes.size]; + + /* Copy whatever fits into the end of the buffer. */ + for ( ; --num >= 0 && out < end; rand_bytes.curr++) + *out++ = *in++; + + /* XOR any the leftover. */ + while (num > 0) { + for (out = rand_bytes.buff; --num >= 0 && out < end; ) + *out++ ^= *in++; + } + + CRYPTO_THREAD_unlock(rand_bytes.lock); + return 1; +} + +static int drbg_seed(const void *buf, int num) +{ + return drbg_add(buf, num, num); +} + +static int drbg_status(void) { - return CRYPTO_set_ex_data(&dctx->ex_data, idx, arg); + int ret; + + CRYPTO_THREAD_write_lock(rand_drbg.lock); + ret = rand_drbg.state == DRBG_READY ? 1 : 0; + CRYPTO_THREAD_unlock(rand_drbg.lock); + return ret; } -void *RAND_DRBG_get_ex_data(const DRBG_CTX *dctx, int idx) +RAND_DRBG rand_drbg; /* The default global DRBG. */ + +RAND_METHOD rand_meth = { + drbg_seed, + drbg_bytes, + drbg_cleanup, + drbg_add, + drbg_bytes, + drbg_status +}; + +RAND_METHOD *RAND_OpenSSL(void) { - return CRYPTO_get_ex_data(&dctx->ex_data, idx); + return &rand_meth; } diff --git a/crypto/rand/drbg_rand.c b/crypto/rand/drbg_rand.c index 8b30cd8..06f8aff 100644 --- a/crypto/rand/drbg_rand.c +++ b/crypto/rand/drbg_rand.c @@ -16,37 +16,14 @@ #include "internal/thread_once.h" /* - * Mapping of NIST SP 800-90A DRBG to OpenSSL RAND_METHOD. + * Implementation of NIST SP 800-90A CTR DRBG. */ - -/* - * The default global DRBG and its auto-init/auto-cleanup. - */ -static DRBG_CTX ossl_drbg; - -static CRYPTO_ONCE ossl_drbg_init = CRYPTO_ONCE_STATIC_INIT; - -DEFINE_RUN_ONCE_STATIC(do_ossl_drbg_init) -{ - int st = 1; - - ossl_drbg.lock = CRYPTO_THREAD_lock_new(); - st &= ossl_drbg.lock != NULL; - st &= RAND_DRBG_set(&ossl_drbg, NID_aes_128_ctr, 0) == 1; - return st; -} - -void rand_drbg_cleanup(void) -{ - CRYPTO_THREAD_lock_free(ossl_drbg.lock); -} - -static void inc_128(DRBG_CTR_CTX *cctx) +static void inc_128(RAND_DRBG_CTR *ctr) { int i; unsigned char c; - unsigned char *p = &cctx->V[15]; + unsigned char *p = &ctr->V[15]; for (i = 0; i < 16; i++, p--) { c = *p; @@ -59,7 +36,7 @@ static void inc_128(DRBG_CTR_CTX *cctx) } } -static void ctr_XOR(DRBG_CTR_CTX *cctx, const unsigned char *in, size_t inlen) +static void ctr_XOR(RAND_DRBG_CTR *ctr, const unsigned char *in, size_t inlen) { size_t i, n; @@ -70,81 +47,81 @@ static void ctr_XOR(DRBG_CTR_CTX *cctx, const unsigned char *in, size_t inlen) * Any zero padding will have no effect on the result as we * are XORing. So just process however much input we have. */ - n = inlen < cctx->keylen ? inlen : cctx->keylen; + n = inlen < ctr->keylen ? inlen : ctr->keylen; for (i = 0; i < n; i++) - cctx->K[i] ^= in[i]; - if (inlen <= cctx->keylen) + ctr->K[i] ^= in[i]; + if (inlen <= ctr->keylen) return; - n = inlen - cctx->keylen; + n = inlen - ctr->keylen; if (n > 16) { /* Should never happen */ n = 16; } for (i = 0; i < n; i++) - cctx->V[i] ^= in[i + cctx->keylen]; + ctr->V[i] ^= in[i + ctr->keylen]; } /* * Process a complete block using BCC algorithm of SP 800-90A 10.3.3 */ -static void ctr_BCC_block(DRBG_CTR_CTX *cctx, unsigned char *out, +static void ctr_BCC_block(RAND_DRBG_CTR *ctr, unsigned char *out, const unsigned char *in) { int i; for (i = 0; i < 16; i++) out[i] ^= in[i]; - AES_encrypt(out, out, &cctx->df_ks); + AES_encrypt(out, out, &ctr->df_ks); } /* * Handle several BCC operations for as much data as we need for K and X */ -static void ctr_BCC_blocks(DRBG_CTR_CTX *cctx, const unsigned char *in) +static void ctr_BCC_blocks(RAND_DRBG_CTR *ctr, const unsigned char *in) { - ctr_BCC_block(cctx, cctx->KX, in); - ctr_BCC_block(cctx, cctx->KX + 16, in); - if (cctx->keylen != 16) - ctr_BCC_block(cctx, cctx->KX + 32, in); + ctr_BCC_block(ctr, ctr->KX, in); + ctr_BCC_block(ctr, ctr->KX + 16, in); + if (ctr->keylen != 16) + ctr_BCC_block(ctr, ctr->KX + 32, in); } /* * Initialise BCC blocks: these have the value 0,1,2 in leftmost positions: * see 10.3.1 stage 7. */ -static void ctr_BCC_init(DRBG_CTR_CTX *cctx) +static void ctr_BCC_init(RAND_DRBG_CTR *ctr) { - memset(cctx->KX, 0, 48); - memset(cctx->bltmp, 0, 16); - ctr_BCC_block(cctx, cctx->KX, cctx->bltmp); - cctx->bltmp[3] = 1; - ctr_BCC_block(cctx, cctx->KX + 16, cctx->bltmp); - if (cctx->keylen != 16) { - cctx->bltmp[3] = 2; - ctr_BCC_block(cctx, cctx->KX + 32, cctx->bltmp); + memset(ctr->KX, 0, 48); + memset(ctr->bltmp, 0, 16); + ctr_BCC_block(ctr, ctr->KX, ctr->bltmp); + ctr->bltmp[3] = 1; + ctr_BCC_block(ctr, ctr->KX + 16, ctr->bltmp); + if (ctr->keylen != 16) { + ctr->bltmp[3] = 2; + ctr_BCC_block(ctr, ctr->KX + 32, ctr->bltmp); } } /* * Process several blocks into BCC algorithm, some possibly partial */ -static void ctr_BCC_update(DRBG_CTR_CTX *cctx, +static void ctr_BCC_update(RAND_DRBG_CTR *ctr, const unsigned char *in, size_t inlen) { if (in == NULL || inlen == 0) return; /* If we have partial block handle it first */ - if (cctx->bltmp_pos) { - size_t left = 16 - cctx->bltmp_pos; + if (ctr->bltmp_pos) { + size_t left = 16 - ctr->bltmp_pos; /* If we now have a complete block process it */ if (inlen >= left) { - memcpy(cctx->bltmp + cctx->bltmp_pos, in, left); - ctr_BCC_blocks(cctx, cctx->bltmp); - cctx->bltmp_pos = 0; + memcpy(ctr->bltmp + ctr->bltmp_pos, in, left); + ctr_BCC_blocks(ctr, ctr->bltmp); + ctr->bltmp_pos = 0; inlen -= left; in += left; } @@ -152,34 +129,34 @@ static void ctr_BCC_update(DRBG_CTR_CTX *cctx, /* Process zero or more complete blocks */ for (; inlen >= 16; in += 16, inlen -= 16) { - ctr_BCC_blocks(cctx, in); + ctr_BCC_blocks(ctr, in); } /* Copy any remaining partial block to the temporary buffer */ if (inlen > 0) { - memcpy(cctx->bltmp + cctx->bltmp_pos, in, inlen); - cctx->bltmp_pos += inlen; + memcpy(ctr->bltmp + ctr->bltmp_pos, in, inlen); + ctr->bltmp_pos += inlen; } } -static void ctr_BCC_final(DRBG_CTR_CTX *cctx) +static void ctr_BCC_final(RAND_DRBG_CTR *ctr) { - if (cctx->bltmp_pos) { - memset(cctx->bltmp + cctx->bltmp_pos, 0, 16 - cctx->bltmp_pos); - ctr_BCC_blocks(cctx, cctx->bltmp); + if (ctr->bltmp_pos) { + memset(ctr->bltmp + ctr->bltmp_pos, 0, 16 - ctr->bltmp_pos); + ctr_BCC_blocks(ctr, ctr->bltmp); } } -static void ctr_df(DRBG_CTR_CTX *cctx, +static void ctr_df(RAND_DRBG_CTR *ctr, const unsigned char *in1, size_t in1len, const unsigned char *in2, size_t in2len, const unsigned char *in3, size_t in3len) { static unsigned char c80 = 0x80; size_t inlen; - unsigned char *p = cctx->bltmp; + unsigned char *p = ctr->bltmp; - ctr_BCC_init(cctx); + ctr_BCC_init(ctr); if (in1 == NULL) in1len = 0; if (in2 == NULL) @@ -197,100 +174,100 @@ static void ctr_df(DRBG_CTR_CTX *cctx, *p++ = 0; *p++ = 0; *p++ = 0; - *p = (unsigned char)((cctx->keylen + 16) & 0xff); - cctx->bltmp_pos = 8; - ctr_BCC_update(cctx, in1, in1len); - ctr_BCC_update(cctx, in2, in2len); - ctr_BCC_update(cctx, in3, in3len); - ctr_BCC_update(cctx, &c80, 1); - ctr_BCC_final(cctx); + *p = (unsigned char)((ctr->keylen + 16) & 0xff); + ctr->bltmp_pos = 8; + ctr_BCC_update(ctr, in1, in1len); + ctr_BCC_update(ctr, in2, in2len); + ctr_BCC_update(ctr, in3, in3len); + ctr_BCC_update(ctr, &c80, 1); + ctr_BCC_final(ctr); /* Set up key K */ - AES_set_encrypt_key(cctx->KX, cctx->keylen * 8, &cctx->df_kxks); + AES_set_encrypt_key(ctr->KX, ctr->keylen * 8, &ctr->df_kxks); /* X follows key K */ - AES_encrypt(cctx->KX + cctx->keylen, cctx->KX, &cctx->df_kxks); - AES_encrypt(cctx->KX, cctx->KX + 16, &cctx->df_kxks); - if (cctx->keylen != 16) - AES_encrypt(cctx->KX + 16, cctx->KX + 32, &cctx->df_kxks); + AES_encrypt(ctr->KX + ctr->keylen, ctr->KX, &ctr->df_kxks); + AES_encrypt(ctr->KX, ctr->KX + 16, &ctr->df_kxks); + if (ctr->keylen != 16) + AES_encrypt(ctr->KX + 16, ctr->KX + 32, &ctr->df_kxks); } /* * NB the no-df Update in SP800-90A specifies a constant input length * of seedlen, however other uses of this algorithm pad the input with * zeroes if necessary and have up to two parameters XORed together, - * handle both cases in this function instead. + * so we handle both cases in this function instead. */ -static void ctr_update(DRBG_CTX *dctx, +static void ctr_update(RAND_DRBG *drbg, const unsigned char *in1, size_t in1len, const unsigned char *in2, size_t in2len, const unsigned char *nonce, size_t noncelen) { - DRBG_CTR_CTX *cctx = &dctx->ctr; + RAND_DRBG_CTR *ctr = &drbg->ctr; /* ks is already setup for correct key */ - inc_128(cctx); - AES_encrypt(cctx->V, cctx->K, &cctx->ks); + inc_128(ctr); + AES_encrypt(ctr->V, ctr->K, &ctr->ks); /* If keylen longer than 128 bits need extra encrypt */ - if (cctx->keylen != 16) { - inc_128(cctx); - AES_encrypt(cctx->V, cctx->K + 16, &cctx->ks); + if (ctr->keylen != 16) { + inc_128(ctr); + AES_encrypt(ctr->V, ctr->K + 16, &ctr->ks); } - inc_128(cctx); - AES_encrypt(cctx->V, cctx->V, &cctx->ks); + inc_128(ctr); + AES_encrypt(ctr->V, ctr->V, &ctr->ks); /* If 192 bit key part of V is on end of K */ - if (cctx->keylen == 24) { - memcpy(cctx->V + 8, cctx->V, 8); - memcpy(cctx->V, cctx->K + 24, 8); + if (ctr->keylen == 24) { + memcpy(ctr->V + 8, ctr->V, 8); + memcpy(ctr->V, ctr->K + 24, 8); } - if (dctx->flags & RAND_DRBG_FLAG_CTR_USE_DF) { + if (drbg->flags & RAND_DRBG_FLAG_CTR_USE_DF) { /* If no input reuse existing derived value */ if (in1 != NULL || nonce != NULL || in2 != NULL) - ctr_df(cctx, in1, in1len, nonce, noncelen, in2, in2len); + ctr_df(ctr, in1, in1len, nonce, noncelen, in2, in2len); /* If this a reuse input in1len != 0 */ if (in1len) - ctr_XOR(cctx, cctx->KX, dctx->seedlen); + ctr_XOR(ctr, ctr->KX, drbg->seedlen); } else { - ctr_XOR(cctx, in1, in1len); - ctr_XOR(cctx, in2, in2len); + ctr_XOR(ctr, in1, in1len); + ctr_XOR(ctr, in2, in2len); } - AES_set_encrypt_key(cctx->K, dctx->strength, &cctx->ks); + AES_set_encrypt_key(ctr->K, drbg->strength, &ctr->ks); } -int ctr_instantiate(DRBG_CTX *dctx, +int ctr_instantiate(RAND_DRBG *drbg, const unsigned char *ent, size_t entlen, const unsigned char *nonce, size_t noncelen, const unsigned char *pers, size_t perslen) { - DRBG_CTR_CTX *cctx = &dctx->ctr; + RAND_DRBG_CTR *ctr = &drbg->ctr; - memset(cctx->K, 0, sizeof(cctx->K)); - memset(cctx->V, 0, sizeof(cctx->V)); - AES_set_encrypt_key(cctx->K, dctx->strength, &cctx->ks); - ctr_update(dctx, ent, entlen, pers, perslen, nonce, noncelen); + memset(ctr->K, 0, sizeof(ctr->K)); + memset(ctr->V, 0, sizeof(ctr->V)); + AES_set_encrypt_key(ctr->K, drbg->strength, &ctr->ks); + ctr_update(drbg, ent, entlen, pers, perslen, nonce, noncelen); return 1; } -int ctr_reseed(DRBG_CTX *dctx, +int ctr_reseed(RAND_DRBG *drbg, const unsigned char *ent, size_t entlen, const unsigned char *adin, size_t adinlen) { - ctr_update(dctx, ent, entlen, adin, adinlen, NULL, 0); + ctr_update(drbg, ent, entlen, adin, adinlen, NULL, 0); return 1; } -int ctr_generate(DRBG_CTX *dctx, +int ctr_generate(RAND_DRBG *drbg, unsigned char *out, size_t outlen, const unsigned char *adin, size_t adinlen) { - DRBG_CTR_CTX *cctx = &dctx->ctr; + RAND_DRBG_CTR *ctr = &drbg->ctr; if (adin != NULL && adinlen != 0) { - ctr_update(dctx, adin, adinlen, NULL, 0, NULL, 0); + ctr_update(drbg, adin, adinlen, NULL, 0, NULL, 0); /* This means we reuse derived value */ - if (dctx->flags & RAND_DRBG_FLAG_CTR_USE_DF) { + if (drbg->flags & RAND_DRBG_FLAG_CTR_USE_DF) { adin = NULL; adinlen = 1; } @@ -299,36 +276,36 @@ int ctr_generate(DRBG_CTX *dctx, } for ( ; ; ) { - inc_128(cctx); + inc_128(ctr); if (outlen < 16) { /* Use K as temp space as it will be updated */ - AES_encrypt(cctx->V, cctx->K, &cctx->ks); - memcpy(out, cctx->K, outlen); + AES_encrypt(ctr->V, ctr->K, &ctr->ks); + memcpy(out, ctr->K, outlen); break; } - AES_encrypt(cctx->V, out, &cctx->ks); + AES_encrypt(ctr->V, out, &ctr->ks); out += 16; outlen -= 16; if (outlen == 0) break; } - ctr_update(dctx, adin, adinlen, NULL, 0, NULL, 0); + ctr_update(drbg, adin, adinlen, NULL, 0, NULL, 0); return 1; } -int ctr_uninstantiate(DRBG_CTX *dctx) +int ctr_uninstantiate(RAND_DRBG *drbg) { - memset(&dctx->ctr, 0, sizeof(dctx->ctr)); + memset(&drbg->ctr, 0, sizeof(drbg->ctr)); return 1; } -int ctr_init(DRBG_CTX *dctx) +int ctr_init(RAND_DRBG *drbg) { - DRBG_CTR_CTX *cctx = &dctx->ctr; + RAND_DRBG_CTR *ctr = &drbg->ctr; size_t keylen; - switch (dctx->nid) { + switch (drbg->nid) { default: /* This can't happen, but silence the compiler warning. */ return -1; @@ -343,12 +320,11 @@ int ctr_init(DRBG_CTX *dctx) break; } - cctx->keylen = keylen; - dctx->strength = keylen * 8; - dctx->blocklength = 16; - dctx->seedlen = keylen + 16; + ctr->keylen = keylen; + drbg->strength = keylen * 8; + drbg->seedlen = keylen + 16; - if (dctx->flags & RAND_DRBG_FLAG_CTR_USE_DF) { + if (drbg->flags & RAND_DRBG_FLAG_CTR_USE_DF) { /* df initialisation */ static unsigned char df_key[32] = { 0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07, @@ -357,97 +333,25 @@ int ctr_init(DRBG_CTX *dctx) 0x18,0x19,0x1a,0x1b,0x1c,0x1d,0x1e,0x1f }; /* Set key schedule for df_key */ - AES_set_encrypt_key(df_key, dctx->strength, &cctx->df_ks); - - dctx->min_entropy = cctx->keylen; - dctx->max_entropy = DRBG_MAX_LENGTH; - dctx->min_nonce = dctx->min_entropy / 2; - dctx->max_nonce = DRBG_MAX_LENGTH; - dctx->max_pers = DRBG_MAX_LENGTH; - dctx->max_adin = DRBG_MAX_LENGTH; + AES_set_encrypt_key(df_key, drbg->strength, &ctr->df_ks); + + drbg->min_entropy = ctr->keylen; + drbg->max_entropy = DRBG_MAX_LENGTH; + drbg->min_nonce = drbg->min_entropy / 2; + drbg->max_nonce = DRBG_MAX_LENGTH; + drbg->max_pers = DRBG_MAX_LENGTH; + drbg->max_adin = DRBG_MAX_LENGTH; } else { - dctx->min_entropy = dctx->seedlen; - dctx->max_entropy = dctx->seedlen; + drbg->min_entropy = drbg->seedlen; + drbg->max_entropy = drbg->seedlen; /* Nonce not used */ - dctx->min_nonce = 0; - dctx->max_nonce = 0; - dctx->max_pers = dctx->seedlen; - dctx->max_adin = dctx->seedlen; + drbg->min_nonce = 0; + drbg->max_nonce = 0; + drbg->max_pers = drbg->seedlen; + drbg->max_adin = drbg->seedlen; } - dctx->max_request = 1 << 16; - dctx->reseed_interval = MAX_RESEED; + drbg->max_request = 1 << 16; + drbg->reseed_interval = MAX_RESEED; return 1; } - - -/* - * The following function tie the DRBG code into the RAND_METHOD - */ - -DRBG_CTX *RAND_DRBG_get_default(void) -{ - if (!RUN_ONCE(&ossl_drbg_init, do_ossl_drbg_init)) - return NULL; - return &ossl_drbg; -} - -static int drbg_bytes(unsigned char *out, int count) -{ - DRBG_CTX *dctx = RAND_DRBG_get_default(); - int ret = 0; - - CRYPTO_THREAD_write_lock(dctx->lock); - do { - size_t rcnt; - - if (count > (int)dctx->max_request) - rcnt = dctx->max_request; - else - rcnt = count; - ret = RAND_DRBG_generate(dctx, out, rcnt, 0, NULL, 0); - if (!ret) - goto err; - out += rcnt; - count -= rcnt; - } while (count); - ret = 1; -err: - CRYPTO_THREAD_unlock(dctx->lock); - return ret; -} - -static int drbg_status(void) -{ - DRBG_CTX *dctx = RAND_DRBG_get_default(); - int ret; - - CRYPTO_THREAD_write_lock(dctx->lock); - ret = dctx->status == DRBG_STATUS_READY ? 1 : 0; - CRYPTO_THREAD_unlock(dctx->lock); - return ret; -} - -static void drbg_cleanup(void) -{ - DRBG_CTX *dctx = RAND_DRBG_get_default(); - - CRYPTO_THREAD_write_lock(dctx->lock); - RAND_DRBG_uninstantiate(dctx); - CRYPTO_THREAD_unlock(dctx->lock); -} - -static const RAND_METHOD rand_drbg_meth = -{ - NULL, - drbg_bytes, - drbg_cleanup, - NULL, - drbg_bytes, - drbg_status -}; - -const RAND_METHOD *RAND_drbg(void) -{ - return &rand_drbg_meth; -} diff --git a/crypto/rand/ossl_rand.c b/crypto/rand/ossl_rand.c deleted file mode 100644 index 063b55b..0000000 --- a/crypto/rand/ossl_rand.c +++ /dev/null @@ -1,592 +0,0 @@ -/* - * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the OpenSSL license (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#include <stdio.h> -#include <string.h> - -#include "e_os.h" - -#if !(defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_VXWORKS) || defined(OPENSSL_SYS_DSPBIOS)) -# include <sys/time.h> -#endif -#if defined(OPENSSL_SYS_VXWORKS) -# include <time.h> -#endif - -#include <openssl/opensslconf.h> -#include <openssl/crypto.h> -#include <openssl/rand.h> -#include <openssl/async.h> -#include <openssl/err.h> -#include <internal/thread_once.h> -#include "rand_lcl.h" - -#define STATE_SIZE 1023 - -typedef struct ossl_rand_state_st OSSL_RAND_STATE; - -struct ossl_rand_state_st { - size_t num; - size_t index; - unsigned char state[STATE_SIZE + SHA_DIGEST_LENGTH]; - unsigned char md[SHA_DIGEST_LENGTH]; - long md_count[2]; -}; - -static OSSL_RAND_STATE global_state; -static double randomness = 0; -static int initialized = 0; -static CRYPTO_RWLOCK *rand_lock = NULL; -static CRYPTO_RWLOCK *rand_tmp_lock = NULL; -static CRYPTO_ONCE ossl_rand_init = CRYPTO_ONCE_STATIC_INIT; -static CRYPTO_THREAD_LOCAL key; - -/* May be set only when a thread holds rand_lock (to prevent double locking) */ -static unsigned int crypto_lock_rand = 0; -/* - * access to locking_threadid is synchronized by rand_tmp_lock; - * valid iff crypto_lock_rand is set - */ -static CRYPTO_THREAD_ID locking_threadid; - -static int rand_hw_seed(EVP_MD_CTX *ctx); - -static void rand_thread_cleanup(void *arg) -{ - OSSL_RAND_STATE *sp = arg; - - OPENSSL_clear_free(sp, sizeof(*sp)); -} - -DEFINE_RUN_ONCE_STATIC(do_ossl_rand_init) -{ - int ret = 1; - - OPENSSL_init_crypto(0, NULL); - rand_lock = CRYPTO_THREAD_lock_new(); - ret &= rand_lock != NULL; - rand_tmp_lock = CRYPTO_THREAD_lock_new(); - ret &= rand_tmp_lock != NULL; - ret &= CRYPTO_THREAD_init_local(&key, rand_thread_cleanup) == 1; - return ret; -} - -RAND_METHOD *RAND_OpenSSL(void) -{ - return &openssl_rand_meth; -} - -static void rand_cleanup(void) -{ - OPENSSL_cleanse(&global_state, sizeof(global_state)); - randomness = 0; - initialized = 0; - CRYPTO_THREAD_lock_free(rand_lock); - CRYPTO_THREAD_lock_free(rand_tmp_lock); -} - -static int rand_add(const void *buf, int num, double add) -{ - int i, j, k, st_idx; - long md_c[2]; - unsigned char local_md[SHA_DIGEST_LENGTH]; - EVP_MD_CTX *m; - int do_not_lock; - int rv = 0; - OSSL_RAND_STATE *sp = &global_state; - - if (!num) - return 1; - - /* - * (Based on the rand(3) manpage) - * - * The input is chopped up into units of 20 bytes (or less for - * the last block). Each of these blocks is run through the hash - * function as follows: The data passed to the hash function - * is the current 'md', the same number of bytes from the 'state' - * (the location determined by in incremented looping index) as - * the current 'block', the new key data 'block', and 'count' - * (which is incremented after each use). - * The result of this is kept in 'md' and also xored into the - * 'state' at the same locations that were used as input into the - * hash function. - */ - - m = EVP_MD_CTX_new(); - if (m == NULL) - goto err; - - if (!RUN_ONCE(&ossl_rand_init, do_ossl_rand_init)) - goto err; - - /* check if we already have the lock */ - if (crypto_lock_rand) { - CRYPTO_THREAD_ID cur = CRYPTO_THREAD_get_current_id(); - CRYPTO_THREAD_read_lock(rand_tmp_lock); - do_not_lock = CRYPTO_THREAD_compare_id(locking_threadid, cur); - CRYPTO_THREAD_unlock(rand_tmp_lock); - } else - do_not_lock = 0; - - if (!do_not_lock) - CRYPTO_THREAD_write_lock(rand_lock); - st_idx = sp->index; - - /* - * use our own copies of the counters so that even if a concurrent thread - * seeds with exactly the same data and uses the same subarray there's - * _some_ difference - */ - md_c[0] = sp->md_count[0]; - md_c[1] = sp->md_count[1]; - - memcpy(local_md, sp->md, sizeof(sp->md)); - - /* sp->index <= sp->num <= STATE_SIZE */ - sp->index += num; - if (sp->index >= STATE_SIZE) { - sp->index %= STATE_SIZE; - sp->num = STATE_SIZE; - } else if (sp->num < STATE_SIZE) { - if (sp->index > sp->num) - sp->num = sp->index; - } - /* sp->index <= sp->num <= STATE_SIZE */ - - /* - * state[st_idx], ..., state[(st_idx + num - 1) % STATE_SIZE] are what we - * will use now, but other threads may use them as well - */ - - sp->md_count[1] += (num / SHA_DIGEST_LENGTH) + (num % SHA_DIGEST_LENGTH > 0); - - if (!do_not_lock) - CRYPTO_THREAD_unlock(rand_lock); - - for (i = 0; i < num; i += SHA_DIGEST_LENGTH) { - j = (num - i); - j = (j > SHA_DIGEST_LENGTH) ? SHA_DIGEST_LENGTH : j; - - if (!EVP_DigestInit_ex(m, EVP_sha1(), NULL)) - goto err; - if (!EVP_DigestUpdate(m, local_md, SHA_DIGEST_LENGTH)) - goto err; - k = (st_idx + j) - STATE_SIZE; - if (k > 0) { - if (!EVP_DigestUpdate(m, &sp->state[st_idx], j - k)) - goto err; - if (!EVP_DigestUpdate(m, &sp->state[0], k)) - goto err; - } else if (!EVP_DigestUpdate(m, &sp->state[st_idx], j)) - goto err; - - /* DO NOT REMOVE THE FOLLOWING CALL TO EVP_DigestUpdate()! */ - if (!EVP_DigestUpdate(m, buf, j)) - goto err; - /* - * We know that line may cause programs such as purify and valgrind - * to complain about use of uninitialized data. The problem is not, - * it's with the caller. Removing that line will make sure you get - * really bad randomness and thereby other problems such as very - * insecure keys. - */ - - if (!EVP_DigestUpdate(m, (unsigned char *)md_c, sizeof(md_c))) - goto err; - if (!EVP_DigestFinal_ex(m, local_md, NULL)) - goto err; - md_c[1]++; - - buf = (const char *)buf + j; - - for (k = 0; k < j; k++) { - /* - * Parallel threads may interfere with this, but always each byte - * of the new state is the XOR of some previous value of its and - * local_md (intermediate values may be lost). Alway using locking - * could hurt performance more than necessary given that - * conflicts occur only when the total seeding is longer than the - * random state. - */ - sp->state[st_idx++] ^= local_md[k]; - if (st_idx >= STATE_SIZE) - st_idx = 0; - } - } - - if (!do_not_lock) - CRYPTO_THREAD_write_lock(rand_lock); - /* - * Don't just copy back local_md into md -- this could mean that other - * thread's seeding remains without effect (except for the incremented - * counter). By XORing it we keep at least as much randomness as fits into - * md. - */ - for (k = 0; k < (int)sizeof(sp->md); k++) { - sp->md[k] ^= local_md[k]; - } - if (randomness < RANDOMNESS_NEEDED) /* stop counting when we have enough */ - randomness += add; - if (!do_not_lock) - CRYPTO_THREAD_unlock(rand_lock); - - rv = 1; - err: - EVP_MD_CTX_free(m); - return rv; -} - -static int rand_seed(const void *buf, int num) -{ - return rand_add(buf, num, (double)num); -} - -static int rand_bytes(unsigned char *buf, int num) -{ - static volatile int stirred_pool = 0; - int i, j, k; - size_t num_ceil, st_idx, st_num; - int ok; - long md_c[2]; - unsigned char local_md[SHA_DIGEST_LENGTH]; - EVP_MD_CTX *m; - OSSL_RAND_STATE *sp = &global_state; -#ifndef GETPID_IS_MEANINGLESS - pid_t curr_pid = getpid(); -#endif - time_t curr_time = time(NULL); - int do_stir_pool = 0; -/* time value for various platforms */ -#ifdef OPENSSL_SYS_WIN32 - FILETIME tv; -# ifdef _WIN32_WCE - SYSTEMTIME t; - GetSystemTime(&t); - SystemTimeToFileTime(&t, &tv); -# else - GetSystemTimeAsFileTime(&tv); -# endif -#elif defined(OPENSSL_SYS_VXWORKS) - struct timespec tv; - clock_gettime(CLOCK_REALTIME, &ts); -#elif defined(OPENSSL_SYS_DSPBIOS) - unsigned long long tv, OPENSSL_rdtsc(); - tv = OPENSSL_rdtsc(); -#else - struct timeval tv; - gettimeofday(&tv, NULL); -#endif - - if (num <= 0) - return 1; - - m = EVP_MD_CTX_new(); - if (m == NULL) - goto err_mem; - - /* round upwards to multiple of SHA_DIGEST_LENGTH/2 */ - num_ceil = - (1 + (num - 1) / (SHA_DIGEST_LENGTH / 2)) * (SHA_DIGEST_LENGTH / 2); - - /* - * (Based on the rand(3) manpage:) - * - * For each group of 10 bytes (or less), we do the following: - * - * Input into the hash function the local 'md' (which is initialized from - * the global 'md' before any bytes are generated), the bytes that are to - * be overwritten by the random bytes, and bytes from the 'state' - * (incrementing looping index). From this digest output (which is kept - * in 'md'), the top (up to) 10 bytes are returned to the caller and the - * bottom 10 bytes are xored into the 'state'. - * - * Finally, after we have finished 'num' random bytes for the - * caller, 'count' (which is incremented) and the local and global 'md' - * are fed into the hash function and the results are kept in the - * global 'md'. - */ - - if (!RUN_ONCE(&ossl_rand_init, do_ossl_rand_init)) - goto err_mem; - - CRYPTO_THREAD_write_lock(rand_lock); - /* - * We could end up in an async engine while holding this lock so ensure - * we don't pause and cause a deadlock - */ - ASYNC_block_pause(); - - /* prevent rand_bytes() from trying to obtain the lock again */ - CRYPTO_THREAD_write_lock(rand_tmp_lock); - locking_threadid = CRYPTO_THREAD_get_current_id(); - CRYPTO_THREAD_unlock(rand_tmp_lock); - crypto_lock_rand = 1; - - if (!initialized) { - RAND_poll(); - initialized = 1; - } - - if (!stirred_pool) - do_stir_pool = 1; - - ok = (randomness >= RANDOMNESS_NEEDED); - if (!ok) { - /* - * If the PRNG state is not yet unpredictable, then seeing the PRNG - * output may help attackers to determine the new state; thus we have - * to decrease the randomness estimate. Once we've had enough initial - * seeding we don't bother to adjust the randomness count, though, - * because we're not ambitious to provide *information-theoretic* - * randomness. NOTE: This approach fails if the program forks before - * we have enough randomness. Randomness should be collected in a - * separate input pool and be transferred to the output pool only - * when the randomness limit has been reached. - */ - randomness -= num; - if (randomness < 0) - randomness = 0; - } - - if (do_stir_pool) { - /* - * In the output function only half of 'md' remains secret, so we - * better make sure that the required randomness gets 'evenly - * distributed' through 'state', our randomness pool. The input - * function (rand_add) chains all of 'md', which makes it more - * suitable for this purpose. - */ - - int n = STATE_SIZE; /* so that the complete pool gets accessed */ - while (n > 0) { -#if SHA_DIGEST_LENGTH > 20 -# error "Please adjust DUMMY_SEED." -#endif -#define DUMMY_SEED "...................." /* at least SHA_DIGEST_LENGTH */ - /* - * Note that the seed does not matter, it's just that - * rand_add expects to have something to hash. - */ - rand_add(DUMMY_SEED, SHA_DIGEST_LENGTH, 0.0); - n -= SHA_DIGEST_LENGTH; - } - if (ok) - stirred_pool = 1; - } - - st_idx = sp->index; - st_num = sp->num; - md_c[0] = sp->md_count[0]; - md_c[1] = sp->md_count[1]; - memcpy(local_md, sp->md, sizeof sp->md); - - sp->index += num_ceil; - if (sp->index > sp->num) - sp->index %= sp->num; - - /* - * state[st_idx], ..., state[(st_idx + num_ceil - 1) % st_num] are now - * ours (but other threads may use them too) - */ - - sp->md_count[0] += 1; - - /* before unlocking, we must clear 'crypto_lock_rand' */ - crypto_lock_rand = 0; - ASYNC_unblock_pause(); - CRYPTO_THREAD_unlock(rand_lock); - - while (num > 0) { - /* num_ceil -= SHA_DIGEST_LENGTH / 2 */ - j = (num >= SHA_DIGEST_LENGTH / 2) ? SHA_DIGEST_LENGTH / 2 : num; - num -= j; - if (!EVP_DigestInit_ex(m, EVP_sha1(), NULL)) - goto err; -#ifndef GETPID_IS_MEANINGLESS - if (curr_pid) { /* just in the first iteration to save time */ - if (!EVP_DigestUpdate(m, (unsigned char *)&curr_pid, sizeof curr_pid)) - goto err; - curr_pid = 0; - } -#endif - if (curr_time) { /* just in the first iteration to save time */ - if (!EVP_DigestUpdate(m, (unsigned char *)&curr_time, sizeof curr_time)) - goto err; - if (!EVP_DigestUpdate(m, (unsigned char *)&tv, sizeof tv)) - goto err; - curr_time = 0; - if (!rand_hw_seed(m)) - goto err; - } - if (!EVP_DigestUpdate(m, local_md, SHA_DIGEST_LENGTH)) - goto err; - if (!EVP_DigestUpdate(m, (unsigned char *)md_c, sizeof(md_c))) - goto err; - - k = (st_idx + SHA_DIGEST_LENGTH / 2) - st_num; - if (k > 0) { - if (!EVP_DigestUpdate(m, &sp->state[st_idx], SHA_DIGEST_LENGTH / 2 - k)) - goto err; - if (!EVP_DigestUpdate(m, &sp->state[0], k)) - goto err; - } else if (!EVP_DigestUpdate(m, &sp->state[st_idx], SHA_DIGEST_LENGTH / 2)) - goto err; - if (!EVP_DigestFinal_ex(m, local_md, NULL)) - goto err; - - for (i = 0; i < SHA_DIGEST_LENGTH / 2; i++) { - /* may compete with other threads */ - sp->state[st_idx++] ^= local_md[i]; - if (st_idx >= st_num) - st_idx = 0; - if (i < j) - *(buf++) = local_md[i + SHA_DIGEST_LENGTH / 2]; - } - } - - if (!EVP_DigestInit_ex(m, EVP_sha1(), NULL) - || !EVP_DigestUpdate(m, (unsigned char *)md_c, sizeof(md_c)) - || !EVP_DigestUpdate(m, local_md, SHA_DIGEST_LENGTH)) - goto err; - CRYPTO_THREAD_write_lock(rand_lock); - /* - * Prevent deadlocks if we end up in an async engine - */ - ASYNC_block_pause(); - if (!EVP_DigestUpdate(m, sp->md, sizeof(sp->md)) - || !EVP_DigestFinal_ex(m, sp->md, NULL)) { - ASYNC_unblock_pause(); - CRYPTO_THREAD_unlock(rand_lock); - goto err; - } - ASYNC_unblock_pause(); - CRYPTO_THREAD_unlock(rand_lock); - - EVP_MD_CTX_free(m); - if (ok) - return (1); - RANDerr(RAND_F_RAND_BYTES, RAND_R_PRNG_NOT_SEEDED); - ERR_add_error_data(1, "You need to read the OpenSSL FAQ, " - "https://www.openssl.org/docs/faq.html"); - return (0); - err: - RANDerr(RAND_F_RAND_BYTES, ERR_R_EVP_LIB); - EVP_MD_CTX_free(m); - return 0; - err_mem: - RANDerr(RAND_F_RAND_BYTES, ERR_R_MALLOC_FAILURE); - EVP_MD_CTX_free(m); - return 0; - -} - -static int rand_status(void) -{ - CRYPTO_THREAD_ID cur; - int ret; - int do_not_lock; - - if (!RUN_ONCE(&ossl_rand_init, do_ossl_rand_init)) - return 0; - - cur = CRYPTO_THREAD_get_current_id(); - /* - * check if we already have the lock (could happen if a RAND_poll() - * implementation calls RAND_status()) - */ - if (crypto_lock_rand) { - CRYPTO_THREAD_read_lock(rand_tmp_lock); - do_not_lock = CRYPTO_THREAD_compare_id(locking_threadid, cur); - CRYPTO_THREAD_unlock(rand_tmp_lock); - } else - do_not_lock = 0; - - if (!do_not_lock) { - CRYPTO_THREAD_write_lock(rand_lock); - /* - * Prevent deadlocks in case we end up in an async engine - */ - ASYNC_block_pause(); - - /* - * prevent rand_bytes() from trying to obtain the lock again - */ - CRYPTO_THREAD_write_lock(rand_tmp_lock); - locking_threadid = cur; - CRYPTO_THREAD_unlock(rand_tmp_lock); - crypto_lock_rand = 1; - } - - if (!initialized) { - RAND_poll(); - initialized = 1; - } - - ret = randomness >= RANDOMNESS_NEEDED; - - if (!do_not_lock) { - /* before unlocking, we must clear 'crypto_lock_rand' */ - crypto_lock_rand = 0; - - ASYNC_unblock_pause(); - CRYPTO_THREAD_unlock(rand_lock); - } - - return ret; -} - -/* - * rand_hw_seed: get seed data from any available hardware RNG. only - * currently supports rdrand. - */ -#if (defined(__i386) || defined(__i386__) || defined(_M_IX86) || \ - defined(__x86_64) || defined(__x86_64__) || \ - defined(_M_AMD64) || defined (_M_X64)) && defined(OPENSSL_CPUID_OBJ) \ - && !defined(OPENSSL_NO_RDRAND) - -# define RDRAND_CALLS 4 - -size_t OPENSSL_ia32_rdrand(void); -extern unsigned int OPENSSL_ia32cap_P[]; - -static int rand_hw_seed(EVP_MD_CTX *ctx) -{ - int i; - if (!(OPENSSL_ia32cap_P[1] & (1 << (62 - 32)))) - return 1; - for (i = 0; i < RDRAND_CALLS; i++) { - size_t rnd; - rnd = OPENSSL_ia32_rdrand(); - if (rnd == 0) - return 1; - if (!EVP_DigestUpdate(ctx, (unsigned char *)&rnd, sizeof(size_t))) - return 0; - } - return 1; -} - -#else - -static int rand_hw_seed(EVP_MD_CTX *ctx) -{ - return 1; -} - -#endif - - -RAND_METHOD openssl_rand_meth = { - rand_seed, - rand_bytes, - rand_cleanup, - rand_add, - rand_bytes, - rand_status -}; diff --git a/crypto/rand/rand_egd.c b/crypto/rand/rand_egd.c index 657a3bc..5eb3225 100644 --- a/crypto/rand/rand_egd.c +++ b/crypto/rand/rand_egd.c @@ -28,12 +28,12 @@ int RAND_query_egd_bytes(const char *path, unsigned char *buf, int bytes) int RAND_egd(const char *path) { - return (-1); + return -1; } int RAND_egd_bytes(const char *path, int bytes) { - return (-1); + return -1; } # else @@ -72,12 +72,13 @@ int RAND_query_egd_bytes(const char *path, unsigned char *buf, int bytes) memset(&addr, 0, sizeof(addr)); addr.sun_family = AF_UNIX; if (strlen(path) >= sizeof(addr.sun_path)) - return (-1); + return -1; strcpy(addr.sun_path, path); i = offsetof(struct sockaddr_un, sun_path) + strlen(path); fd = socket(AF_UNIX, SOCK_STREAM, 0); if (fd == -1 || (fp = fdopen(fd, "r+")) == NULL) - return (-1); + return -1; + setbuf(fp, NULL); /* Try to connect */ for ( ; ; ) { @@ -128,7 +129,7 @@ int RAND_query_egd_bytes(const char *path, unsigned char *buf, int bytes) goto err; ret = numbytes; if (mybuffer) - RAND_seed(tempbuf, i); + RAND_add(tempbuf, i, i); err: if (fp != NULL) @@ -150,7 +151,7 @@ int RAND_egd_bytes(const char *path, int bytes) int RAND_egd(const char *path) { - return (RAND_egd_bytes(path, 255)); + return RAND_egd_bytes(path, 255); } # endif diff --git a/crypto/rand/rand_lcl.h b/crypto/rand/rand_lcl.h index b9df5d1..e5944f9 100644 --- a/crypto/rand/rand_lcl.h +++ b/crypto/rand/rand_lcl.h @@ -17,25 +17,55 @@ # include <openssl/ec.h> # include "internal/rand.h" -/* Amount of randomness (in bytes) we want for initial seeding. */ -# define RANDOMNESS_NEEDED (128 / 8) +/* + * Amount of randomness (in bytes) we want for initial seeding. + * This is based on the fact that we use AES-128 as the CRBG, and + * that we use the derivation function. If either of those changes, + * (see rand_init() in rand_lib.c), change this. + */ +# define RANDOMNESS_NEEDED 16 + +/* Maximum amount of randomness to hold in RAND_BYTES_BUFFER. */ +# define MAX_RANDOMNESS_HELD (4 * RANDOMNESS_NEEDED) /* Maximum count allowed in reseeding */ -#define MAX_RESEED (1 << 24) +# define MAX_RESEED (1 << 24) -/* DRBG status values */ -# define DRBG_STATUS_UNINITIALISED 0 -# define DRBG_STATUS_READY 1 -# define DRBG_STATUS_RESEED 2 -# define DRBG_STATUS_ERROR 3 +/* How often we call RAND_poll() in drbg_entropy_from_system */ +# define RAND_POLL_RETRIES 8 -/* A default maximum length: larger than any reasonable value used in pratice */ +/* Max size of entropy, addin, etc. Larger than any reasonable value */ # define DRBG_MAX_LENGTH 0x7ffffff0 + +/* DRBG status values */ +typedef enum drbg_status_e { + DRBG_UNINITIALISED, + DRBG_READY, + DRBG_RESEED, + DRBG_ERROR +} DRBG_STATUS; + + /* - * The context for DRBG AES-CTR + * A buffer of random bytes to be fed as "entropy" into the DRBG. RAND_add() + * adds data to the buffer, and the drbg_entropy_from_system() pulls data from + * the buffer. We have a separate data structure because of the way the + * API is defined; otherwise we'd run into deadlocks (RAND_bytes -> + * RAND_DRBG_generate* -> drbg_entropy_from_system -> RAND_poll -> RAND_add -> + * drbg_add*; the functions with an asterisk lock). */ -typedef struct drbg_ctr_ctx_st { +typedef struct rand_bytes_buffer_st { + CRYPTO_RWLOCK *lock; + size_t size; + size_t curr; + unsigned char *buff; +} RAND_BYTES_BUFFER; + +/* + * The state of a DRBG AES-CTR. + */ +typedef struct rand_drbg_ctr_st { AES_KEY ks; size_t keylen; unsigned char K[32]; @@ -47,21 +77,28 @@ typedef struct drbg_ctr_ctx_st { unsigned char bltmp[16]; size_t bltmp_pos; unsigned char KX[48]; -} DRBG_CTR_CTX; +} RAND_DRBG_CTR; /* - * The context for all DRBG's + * The state of all types of DRBGs, even though we only have CTR mode + * right now. */ -struct drbg_ctx_st { +struct rand_drbg_st { CRYPTO_RWLOCK *lock; - DRBG_CTX *parent; - int nid; /* the NID of the underlying algorithm */ - unsigned int flags; /* various external flags */ - - /* The following parameters are setup by mechanism drbg_init() call */ + RAND_DRBG *parent; + int nid; /* the underlying algorithm */ + unsigned short flags; /* various external flags */ + unsigned short filled; + /* + * This is a fixed-size buffer, but we malloc to make it a little + * harder to find; a classic security/performance trade-off. + */ + int size; + unsigned char *randomness; + + /* These parameters are setup by the per-type "init" function. */ int strength; - size_t blocklength; size_t max_request; size_t min_entropy, max_entropy; size_t min_nonce, max_nonce; @@ -69,43 +106,50 @@ struct drbg_ctx_st { unsigned int reseed_counter; unsigned int reseed_interval; size_t seedlen; - int status; + DRBG_STATUS state; - /* Application data: typically (only?) used by test get_entropy */ + /* Application data, mainly used in the KATs. */ CRYPTO_EX_DATA ex_data; - /* Implementation specific structures */ - DRBG_CTR_CTX ctr; + /* Implementation specific structures; was a union, but inline for now */ + RAND_DRBG_CTR ctr; - /* entropy gathering function */ + /* Callback functions. See comments in rand_lib.c */ RAND_DRBG_get_entropy_fn get_entropy; - /* Indicates we have finished with entropy buffer */ RAND_DRBG_cleanup_entropy_fn cleanup_entropy; - /* nonce gathering function */ RAND_DRBG_get_nonce_fn get_nonce; - /* Indicates we have finished with nonce buffer */ RAND_DRBG_cleanup_nonce_fn cleanup_nonce; }; - -extern RAND_METHOD openssl_rand_meth; -void rand_drbg_cleanup(void); +/* The global RAND method, and the global buffer and DRBG instance. */ +extern RAND_METHOD rand_meth; +extern RAND_BYTES_BUFFER rand_bytes; +extern RAND_DRBG rand_drbg; /* Hardware-based seeding functions. */ -void rand_rdtsc(void); -int rand_rdcpu(void); +void rand_read_tsc(RAND_poll_fn cb, void *arg); +int rand_read_cpu(RAND_poll_fn cb, void *arg); + +/* DRBG entropy callbacks. */ +void drbg_release_entropy(RAND_DRBG *drbg, unsigned char *out); +size_t drbg_entropy_from_parent(RAND_DRBG *drbg, + unsigned char **pout, + int entropy, size_t min_len, size_t max_len); +size_t drbg_entropy_from_system(RAND_DRBG *drbg, + unsigned char **pout, + int entropy, size_t min_len, size_t max_len); /* DRBG functions implementing AES-CTR */ -int ctr_init(DRBG_CTX *dctx); -int ctr_uninstantiate(DRBG_CTX *dctx); -int ctr_instantiate(DRBG_CTX *dctx, +int ctr_init(RAND_DRBG *drbg); +int ctr_uninstantiate(RAND_DRBG *drbg); +int ctr_instantiate(RAND_DRBG *drbg, const unsigned char *ent, size_t entlen, const unsigned char *nonce, size_t noncelen, const unsigned char *pers, size_t perslen); -int ctr_reseed(DRBG_CTX *dctx, +int ctr_reseed(RAND_DRBG *drbg, const unsigned char *ent, size_t entlen, const unsigned char *adin, size_t adinlen); -int ctr_generate(DRBG_CTX *dctx, +int ctr_generate(RAND_DRBG *drbg, unsigned char *out, size_t outlen, const unsigned char *adin, size_t adinlen); diff --git a/crypto/rand/rand_lib.c b/crypto/rand/rand_lib.c index 05aa45c..059bd55 100644 --- a/crypto/rand/rand_lib.c +++ b/crypto/rand/rand_lib.c @@ -24,6 +24,7 @@ static CRYPTO_RWLOCK *rand_engine_lock; static CRYPTO_RWLOCK *rand_meth_lock; static const RAND_METHOD *default_RAND_meth; static CRYPTO_ONCE rand_init = CRYPTO_ONCE_STATIC_INIT; +RAND_BYTES_BUFFER rand_bytes; #ifdef OPENSSL_RAND_SEED_RDTSC /* @@ -40,14 +41,14 @@ static CRYPTO_ONCE rand_init = CRYPTO_ONCE_STATIC_INIT; * it's not sufficient to indicate whether or not the seeding was * done. */ -void rand_rdtsc(void) +void rand_read_tsc(RAND_poll_fn cb, void *arg) { unsigned char c; int i; for (i = 0; i < 10; i++) { c = (unsigned char)(OPENSSL_rdtsc() & 0xFF); - RAND_add(&c, 1, 0.5); + cb(arg, &c, 1, 0.5); } } #endif @@ -58,7 +59,7 @@ size_t OPENSSL_ia32_rdrand(void); extern unsigned int OPENSSL_ia32cap_P[]; -int rand_rdcpu(void) +int rand_read_cpu(RAND_poll_fn cb, void *arg) { size_t i, s; @@ -68,7 +69,7 @@ int rand_rdcpu(void) s = OPENSSL_ia32_rdseed(); if (s == 0) break; - RAND_add(&s, (int)sizeof(s), sizeof(s)); + cb(arg, &s, (int)sizeof(s), sizeof(s)); } if (i >= RANDOMNESS_NEEDED) return 1; @@ -80,7 +81,7 @@ int rand_rdcpu(void) s = OPENSSL_ia32_rdrand(); if (s == 0) break; - RAND_add(&s, (int)sizeof(s), sizeof(s)); + cb(arg, &s, (int)sizeof(s), sizeof(s)); } if (i >= RANDOMNESS_NEEDED) return 1; @@ -90,15 +91,117 @@ int rand_rdcpu(void) } #endif + +/* + * DRBG has two sets of callbacks; we only discuss the "entropy" one + * here. When the DRBG needs additional randomness bits (called entropy + * in the NIST document), it calls the get_entropy callback which fills in + * a pointer and returns the number of bytes. When the DRBG is finished with + * the buffer, it calls the cleanup_entropy callback, with the value of + * the buffer that the get_entropy callback filled in. + * + * Get entropy from the system, via RAND_poll if needed. The |entropy| + * is the bits of randomness required, and is expected to fit into a buffer + * of |min_len|..|max__len| size. We assume we're getting high-quality + * randomness from the system, and that |min_len| bytes will do. + */ +size_t drbg_entropy_from_system(RAND_DRBG *drbg, + unsigned char **pout, + int entropy, size_t min_len, size_t max_len) +{ + int i; + + + if (min_len > (size_t)drbg->size) { + /* Should not happen. See comment near RANDOMNESS_NEEDED. */ + min_len = drbg->size; + } + + if (rand_drbg.filled) { + /* Re-use what we have. */ + *pout = drbg->randomness; + return drbg->size; + } + + /* If we don't have enough, try to get more. */ + CRYPTO_THREAD_write_lock(rand_bytes.lock); + for (i = RAND_POLL_RETRIES; rand_bytes.curr < min_len && --i >= 0; ) { + CRYPTO_THREAD_unlock(rand_bytes.lock); + RAND_poll(); + CRYPTO_THREAD_write_lock(rand_bytes.lock); + } + + /* Get desired amount, but no more than we have. */ + if (min_len > rand_bytes.curr) + min_len = rand_bytes.curr; + if (min_len != 0) { + memcpy(drbg->randomness, rand_bytes.buff, min_len); + rand_drbg.filled = 1; + /* Update amount left and shift it down. */ + rand_bytes.curr -= min_len; + if (rand_bytes.curr != 0) + memmove(rand_bytes.buff, &rand_bytes.buff[min_len], rand_bytes.curr); + } + CRYPTO_THREAD_unlock(rand_bytes.lock); + return min_len; +} + +size_t drbg_entropy_from_parent(RAND_DRBG *drbg, + unsigned char **pout, + int entropy, size_t min_len, size_t max_len) +{ + int st; + + if (min_len > (size_t)drbg->size) { + /* Should not happen. See comment near RANDOMNESS_NEEDED. */ + min_len = drbg->size; + } + + /* Get random from parent, include our state as additional input. */ + st = RAND_DRBG_generate(drbg->parent, drbg->randomness, min_len, 0, + (unsigned char *)drbg, sizeof(*drbg)); + if (st == 0) + return 0; + drbg->filled = 1; + return min_len; +} + +void drbg_release_entropy(RAND_DRBG *drbg, unsigned char *out) +{ + drbg->filled = 0; + OPENSSL_cleanse(drbg->randomness, sizeof(drbg->randomness)); +} + DEFINE_RUN_ONCE_STATIC(do_rand_init) { int ret = 1; + #ifndef OPENSSL_NO_ENGINE rand_engine_lock = CRYPTO_THREAD_lock_new(); ret &= rand_engine_lock != NULL; #endif rand_meth_lock = CRYPTO_THREAD_lock_new(); ret &= rand_meth_lock != NULL; + + rand_bytes.lock = CRYPTO_THREAD_lock_new(); + ret &= rand_bytes.lock != NULL; + rand_bytes.curr = 0; + rand_bytes.size = MAX_RANDOMNESS_HELD; + /* TODO: Should this be secure malloc? */ + rand_bytes.buff = malloc(rand_bytes.size); + ret &= rand_bytes.buff != NULL; + + rand_drbg.lock = CRYPTO_THREAD_lock_new(); + ret &= rand_drbg.lock != NULL; + rand_drbg.size = RANDOMNESS_NEEDED; + rand_drbg.randomness = OPENSSL_malloc(rand_drbg.size); + ret &= rand_drbg.randomness != NULL; + /* If you change these parameters, see RANDOMNESS_NEEDED */ + ret &= RAND_DRBG_set(&rand_drbg, + NID_aes_128_ctr, RAND_DRBG_FLAG_CTR_USE_DF) == 1; + ret &= RAND_DRBG_set_callbacks(&rand_drbg, drbg_entropy_from_system, + drbg_release_entropy, + NULL, NULL) == 1; return ret; } @@ -113,7 +216,24 @@ void rand_cleanup_int(void) CRYPTO_THREAD_lock_free(rand_engine_lock); #endif CRYPTO_THREAD_lock_free(rand_meth_lock); - rand_drbg_cleanup(); + CRYPTO_THREAD_lock_free(rand_bytes.lock); + OPENSSL_clear_free(rand_drbg.randomness, rand_drbg.size); + CRYPTO_THREAD_lock_free(rand_drbg.lock); + RAND_DRBG_uninstantiate(&rand_drbg); +} + +/* + * RAND_poll_ex() gets a function pointer to call when it has random bytes. + * RAND_poll() sets the function pointer to be a wrapper that calls RAND_add(). + */ +static void call_rand_add(void* arg, const void *buf, int num, double r) +{ + RAND_add(buf, num, r); +} + +int RAND_poll(void) +{ + return RAND_poll_ex(call_rand_add, NULL); } int RAND_set_rand_method(const RAND_METHOD *meth) @@ -150,10 +270,10 @@ const RAND_METHOD *RAND_get_rand_method(void) default_RAND_meth = tmp_meth; } else { ENGINE_finish(e); - default_RAND_meth = &openssl_rand_meth; + default_RAND_meth = &rand_meth; } #else - default_RAND_meth = &openssl_rand_meth; + default_RAND_meth = &rand_meth; #endif } tmp_meth = default_RAND_meth; diff --git a/crypto/rand/rand_unix.c b/crypto/rand/rand_unix.c index 2cfd20d..eecd544 100644 --- a/crypto/rand/rand_unix.c +++ b/crypto/rand/rand_unix.c @@ -41,17 +41,16 @@ * uneven execution speed of the code (due to factors such as cache misses, * interrupts, bus activity, and scheduling) and upon the rather large * relative difference between the speed of the clock and the rate at which - * it can be read. + * it can be read. If it is ported to an environment where execution speed + * is more constant or where the RTC ticks at a much slower rate, or the + * clock can be read with fewer instructions, it is likely that the results + * would be far more predictable. This should only be used for legacy + * platforms. * - * If this code is ported to an environment where execution speed is more - * constant or where the RTC ticks at a much slower rate, or the clock can be - * read with fewer instructions, it is likely that the results would be far - * more predictable. - * - * As a precaution, we generate 4 times the minimum required amount of seed + * As a precaution, we generate four times the required amount of seed * data. */ -int RAND_poll(void) +int RAND_poll_ex(RAND_poll_fn cb, void *arg) { short int code; gid_t curr_gid; @@ -73,11 +72,11 @@ int RAND_poll(void) * different processes. */ curr_gid = getgid(); - RAND_add(&curr_gid, sizeof curr_gid, 0); + cb(arg, &curr_gid, sizeof curr_gid, 0); curr_pid = getpid(); - RAND_add(&curr_pid, sizeof curr_pid, 0); + cb(arg, &curr_pid, sizeof curr_pid, 0); curr_uid = getuid(); - RAND_add(&curr_uid, sizeof curr_uid, 0); + cb(arg, &curr_uid, sizeof curr_uid, 0); for (i = 0; i < (RANDOMNESS_NEEDED * 4); i++) { /* @@ -100,7 +99,7 @@ int RAND_poll(void) /* Get wall clock time, take 8 bits. */ clock_gettime(CLOCK_REALTIME, &ts); v = (unsigned char)(ts.tv_nsec & 0xFF); - RAND_add(&v, sizeof v, 1); + cb(arg, &v, sizeof v, 1); } return 1; } @@ -128,36 +127,33 @@ int RAND_poll(void) # error "librandom not (yet) supported" # endif -int RAND_poll(void) +/* + * Try the various seeding methods in turn, exit when succesful. + */ +int RAND_poll_ex(RAND_poll_fn cb, void *arg) { # ifdef OPENSSL_RAND_SEED_NONE return 0; # else - int ok = 0; + int ok = 1; char temp[RANDOMNESS_NEEDED]; # define TEMPSIZE (int)sizeof(temp) -# ifdef OPENSSL_RAND_SEED_RDTSC - rand_rdtsc(); -# endif +# ifdef OPENSSL_RAND_SEED_GETRANDOM + { + int i = getrandom(temp, TEMPSIZE, 0); -# ifdef OPENSSL_RAND_SEED_RDCPU - if (rand_rdcpu()) - ok++; + if (i >= 0) { + cb(arg, temp, i, i); + if (i == TEMPSIZE) + goto done; + } + } # endif -# ifdef OPENSSL_RAND_SEED_EGD +# if defined(OPENSSL_RAND_SEED_LIBRANDOM) { - static const char *paths[] = { DEVRANDOM_EGD, NULL }; - int i; - - for (i = 0; paths[i] != NULL; i++) { - if (RAND_query_egd_bytes(paths[i], temp, TEMPSIZE) == TEMPSIZE) { - RAND_add(temp, TEMPSIZE, TEMPSIZE); - ok++; - break; - } - } + /* Not yet implemented. */ } # endif @@ -172,29 +168,43 @@ int RAND_poll(void) continue; setbuf(fp, NULL); if (fread(temp, 1, TEMPSIZE, fp) == TEMPSIZE) { - RAND_add(temp, TEMPSIZE, TEMPSIZE); - ok++; + cb(arg, temp, TEMPSIZE, TEMPSIZE); fclose(fp); - break; + goto done; } + fclose(fp); } } # endif -# ifdef OPENSSL_RAND_SEED_GETRANDOM +# ifdef OPENSSL_RAND_SEED_RDTSC + rand_read_tsc(cb, arg); +# endif + +# ifdef OPENSSL_RAND_SEED_RDCPU + if (rand_read_cpu(cb, arg)) + goto done; +# endif + +# ifdef OPENSSL_RAND_SEED_EGD { - int i = getrandom(temp, TEMPSIZE, 0); + static const char *paths[] = { DEVRANDOM_EGD, NULL }; + int i; - if (i >= 0) { - RAND_add(temp, i, i); - if (i == TEMPSIZE) - ok++; + for (i = 0; paths[i] != NULL; i++) { + if (RAND_query_egd_bytes(paths[i], temp, TEMPSIZE) == TEMPSIZE) { + cb(arg, temp, TEMPSIZE, TEMPSIZE); + goto done; + } } } # endif + ok = 0; + +done: OPENSSL_cleanse(temp, TEMPSIZE); - return ok > 0 ? 1 : 0; + return ok; # endif } # endif diff --git a/crypto/rand/rand_vms.c b/crypto/rand/rand_vms.c index 16afae7..a6bb76d 100644 --- a/crypto/rand/rand_vms.c +++ b/crypto/rand/rand_vms.c @@ -54,7 +54,7 @@ static struct items_data_st { {0, 0} }; -int RAND_poll(void) +int RAND_poll_ex(RAND_poll_fn cb, void *arg) { /* determine the number of items in the JPI array */ struct items_data_st item_entry; @@ -113,7 +113,7 @@ int RAND_poll(void) total_length += (tmp_length - 1); /* size of seed is total_length*4 bytes (64bytes) */ - RAND_add((PTR_T)data_buffer, total_length * 4, total_length * 2); + cb(arg, (PTR_T)data_buffer, total_length * 4, total_length * 2); return 1; } diff --git a/crypto/rand/rand_win.c b/crypto/rand/rand_win.c index acc4286..5685ee8 100644 --- a/crypto/rand/rand_win.c +++ b/crypto/rand/rand_win.c @@ -39,7 +39,7 @@ # define INTEL_DEF_PROV L"Intel Hardware Cryptographic Service Provider" # endif -int RAND_poll(void) +int RAND_poll_ex(RAND_poll_fn cb, void *arg) { # ifndef USE_BCRYPTGENRANDOM HCRYPTPROV hProvider; @@ -49,10 +49,10 @@ int RAND_poll(void) int ok = 0; # ifdef OPENSSL_RAND_SEED_RDTSC - rand_rdtsc(); + rand_read_tsc(cb, arg); # endif # ifdef OPENSSL_RAND_SEED_RDCPU - if (rand_rdcpu()) + if (rand_read_cpu(cb, arg)) ok++; # endif @@ -60,14 +60,14 @@ int RAND_poll(void) if (BCryptGenRandom(NULL, buf, (ULONG)sizeof(buf), BCRYPT_USE_SYSTEM_PREFERRED_RNG) != STATUS_SUCCESS) return 0; - RAND_add(buf, sizeof(buf), sizeof(buf)); + cb(arg, buf, sizeof(buf), sizeof(buf)); return 1; # else /* poll the CryptoAPI PRNG */ if (CryptAcquireContextW(&hProvider, NULL, NULL, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT | CRYPT_SILENT) != 0) { if (CryptGenRandom(hProvider, (DWORD)sizeof(buf), buf) != 0) { - RAND_add(buf, sizeof(buf), sizeof(buf)); + cb(arg, buf, sizeof(buf), sizeof(buf)); ok++; } CryptReleaseContext(hProvider, 0); @@ -77,7 +77,7 @@ int RAND_poll(void) if (CryptAcquireContextW(&hProvider, NULL, INTEL_DEF_PROV, PROV_INTEL_SEC, CRYPT_VERIFYCONTEXT | CRYPT_SILENT) != 0) { if (CryptGenRandom(hProvider, (DWORD)sizeof(buf), buf) != 0) { - RAND_add(buf, sizeof(buf), sizeof(buf)); + cb(arg, buf, sizeof(buf), sizeof(buf)); ok++; } CryptReleaseContext(hProvider, 0); diff --git a/crypto/rsa/rsa_crpt.c b/crypto/rsa/rsa_crpt.c index 9cd733b..2b676fd 100644 --- a/crypto/rsa/rsa_crpt.c +++ b/crypto/rsa/rsa_crpt.c @@ -136,16 +136,6 @@ BN_BLINDING *RSA_setup_blinding(RSA *rsa, BN_CTX *in_ctx) } else e = rsa->e; - if ((RAND_status() == 0) && rsa->d != NULL - && bn_get_words(rsa->d) != NULL) { - /* - * if PRNG is not properly seeded, resort to secret exponent as - * unpredictable seed - */ - RAND_add(bn_get_words(rsa->d), bn_get_dmax(rsa->d) * sizeof(BN_ULONG), - 0.0); - } - { BIGNUM *n = BN_new(); diff --git a/doc/man3/RAND_add.pod b/doc/man3/RAND_add.pod index ee54390..5006bdb 100644 --- a/doc/man3/RAND_add.pod +++ b/doc/man3/RAND_add.pod @@ -2,7 +2,8 @@ =head1 NAME -RAND_add, RAND_poll, RAND_seed, RAND_status, RAND_event, RAND_screen +RAND_add, RAND_poll, RAND_poll_ex, RAND_poll_fn, +RAND_seed, RAND_status, RAND_event, RAND_screen - add randomness to the PRNG or get its status =head1 SYNOPSIS @@ -10,7 +11,11 @@ RAND_add, RAND_poll, RAND_seed, RAND_status, RAND_event, RAND_screen #include <openssl/rand.h> int RAND_status(void); - int RAND_poll() + + typedef void (*RAND_poll_fn)(void *arg, + const void *buf, int num, double randomness); + int RAND_poll_ex(RAND_poll_fn cb, void *arg); + int RAND_poll(); void RAND_add(const void *buf, int num, double randomness); void RAND_seed(const void *buf, int num); @@ -35,11 +40,16 @@ and network packet timings, can be reasonable sources of seeding material. RAND_status() indicates whether or not the CSPRNG has been sufficiently seeded. If not, functions such as RAND_bytes(3) will fail. -RAND_poll() uses the current capabilities to seed the CSPRNG. The -exact features used depends on how OpenSSL was configured, and can -be displayed with the OpenSSL L<version(1)> command. This function is -normally called automatically during OpenSSL initialization, but -can be called by the application to reseed the CSPRNG. +RAND_poll_ex() uses the system's capabilities to obtain a buffer +containing random bits which can then be used to seed a CSPRNG. The +exact features used depends on how OpenSSL was configured, and a summary +can be displayed with the OpenSSL L<version(1)> command. This function +is normally called as needed by the CSPRNG. The B<arg> parameter is an +arbitrary pointer which will be passed as an argument to the callback. +The B<cb> function is called each time there is data to add. + +RAND_poll() invokes RAND_poll_ex() with B<cb> and B<arg> set so that it +will call RAND_add(), to add the randomness to the global CSPRNG. RAND_add() mixes the B<num> bytes at B<buf> into the PRNG state. The B<randomness> argument is an estimate of how much randomness is diff --git a/include/internal/rand.h b/include/internal/rand.h index 07568ea..2f38095 100644 --- a/include/internal/rand.h +++ b/include/internal/rand.h @@ -10,49 +10,55 @@ #ifndef HEADER_DRBG_RAND_H # define HEADER_DRBG_RAND_H -/* Flag for CTR mode only: use derivation function ctr_df */ +/* In CTR mode, use derivation function ctr_df */ #define RAND_DRBG_FLAG_CTR_USE_DF 0x2 -const RAND_METHOD *RAND_drbg(void); - -int RAND_DRBG_set(DRBG_CTX *ctx, int type, unsigned int flags); -DRBG_CTX *RAND_DRBG_new(int type, unsigned int flags, DRBG_CTX *parent); -int RAND_DRBG_instantiate(DRBG_CTX *dctx, +/* + * Object lifetime functions. + */ +RAND_DRBG *RAND_DRBG_new(int type, unsigned int flags, RAND_DRBG *parent); +int RAND_DRBG_set(RAND_DRBG *drbg, int type, unsigned int flags); +int RAND_DRBG_instantiate(RAND_DRBG *drbg, const unsigned char *pers, size_t perslen); -int RAND_DRBG_uninstantiate(DRBG_CTX *dctx); -int RAND_DRBG_reseed(DRBG_CTX *dctx, const unsigned char *adin, size_t adinlen); -int RAND_DRBG_generate(DRBG_CTX *dctx, unsigned char *out, size_t outlen, +int RAND_DRBG_uninstantiate(RAND_DRBG *drbg); +void RAND_DRBG_free(RAND_DRBG *drbg); + +/* + * Object "use" functions. + */ +int RAND_DRBG_reseed(RAND_DRBG *drbg, + const unsigned char *adin, size_t adinlen); +int RAND_DRBG_generate(RAND_DRBG *drbg, unsigned char *out, size_t outlen, int prediction_resistance, const unsigned char *adin, size_t adinlen); -void RAND_DRBG_free(DRBG_CTX *dctx); +int RAND_DRBG_set_reseed_interval(RAND_DRBG *drbg, int interval); + +/* + * EXDATA + */ +#define RAND_DRBG_get_ex_new_index(l, p, newf, dupf, freef) \ + CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_DRBG, l, p, newf, dupf, freef) +int RAND_DRBG_set_ex_data(RAND_DRBG *dctx, int idx, void *arg); +void *RAND_DRBG_get_ex_data(const RAND_DRBG *dctx, int idx); -typedef size_t (*RAND_DRBG_get_entropy_fn)(DRBG_CTX *ctx, unsigned char **pout, +/* + * Callback functions. See comments in drbg_lib.c + */ +typedef size_t (*RAND_DRBG_get_entropy_fn)(RAND_DRBG *ctx, + unsigned char **pout, int entropy, size_t min_len, size_t max_len); -typedef void (*RAND_DRBG_cleanup_entropy_fn)(DRBG_CTX *ctx, unsigned char *out, - size_t olen); -typedef size_t (*RAND_DRBG_get_nonce_fn)(DRBG_CTX *ctx, unsigned char **pout, +typedef void (*RAND_DRBG_cleanup_entropy_fn)(RAND_DRBG *ctx, + unsigned char *out); +typedef size_t (*RAND_DRBG_get_nonce_fn)(RAND_DRBG *ctx, unsigned char **pout, int entropy, size_t min_len, size_t max_len); -typedef void (*RAND_DRBG_cleanup_nonce_fn)(DRBG_CTX *ctx, unsigned char *out, - size_t olen); +typedef void (*RAND_DRBG_cleanup_nonce_fn)(RAND_DRBG *ctx, unsigned char *out); -int RAND_DRBG_set_callbacks(DRBG_CTX *dctx, +int RAND_DRBG_set_callbacks(RAND_DRBG *dctx, RAND_DRBG_get_entropy_fn get_entropy, RAND_DRBG_cleanup_entropy_fn cleanup_entropy, RAND_DRBG_get_nonce_fn get_nonce, RAND_DRBG_cleanup_nonce_fn cleanup_nonce); -int RAND_DRBG_set_reseed_interval(DRBG_CTX *dctx, int interval); - -#define RAND_DRBG_get_ex_new_index(l, p, newf, dupf, freef) \ - CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_DRBG, l, p, newf, dupf, freef) -int RAND_DRBG_set_ex_data(DRBG_CTX *dctx, int idx, void *arg); -void *RAND_DRBG_get_ex_data(const DRBG_CTX *dctx, int idx); - -DRBG_CTX *RAND_DRBG_get_default(void); - - #endif - - diff --git a/include/openssl/ossl_typ.h b/include/openssl/ossl_typ.h index 49bdead..b007776 100644 --- a/include/openssl/ossl_typ.h +++ b/include/openssl/ossl_typ.h @@ -114,7 +114,7 @@ typedef struct ec_key_st EC_KEY; typedef struct ec_key_method_st EC_KEY_METHOD; typedef struct rand_meth_st RAND_METHOD; -typedef struct drbg_ctx_st DRBG_CTX; +typedef struct rand_drbg_st RAND_DRBG; typedef struct ssl_dane_st SSL_DANE; typedef struct x509_st X509; diff --git a/include/openssl/rand.h b/include/openssl/rand.h index 17bd70d..2aecbb7 100644 --- a/include/openssl/rand.h +++ b/include/openssl/rand.h @@ -33,27 +33,37 @@ const RAND_METHOD *RAND_get_rand_method(void); # ifndef OPENSSL_NO_ENGINE int RAND_set_rand_engine(ENGINE *engine); # endif + RAND_METHOD *RAND_OpenSSL(void); + # if OPENSSL_API_COMPAT < 0x10100000L # define RAND_cleanup() while(0) continue # endif int RAND_bytes(unsigned char *buf, int num); DEPRECATEDIN_1_1_0(int RAND_pseudo_bytes(unsigned char *buf, int num)) + void RAND_seed(const void *buf, int num); + # if defined(__ANDROID__) && defined(__NDK_FPABI__) __NDK_FPABI__ /* __attribute__((pcs("aapcs"))) on ARM */ # endif + void RAND_add(const void *buf, int num, double randomness); int RAND_load_file(const char *file, long max_bytes); int RAND_write_file(const char *file); const char *RAND_file_name(char *file, size_t num); int RAND_status(void); + # ifndef OPENSSL_NO_EGD int RAND_query_egd_bytes(const char *path, unsigned char *buf, int bytes); int RAND_egd(const char *path); int RAND_egd_bytes(const char *path, int bytes); # endif + +typedef void (*RAND_poll_fn)(void *arg, + const void *buf, int num, double randomness); int RAND_poll(void); +int RAND_poll_ex(RAND_poll_fn cb, void *arg); # if defined(_WIN32) && (defined(BASETYPES) || defined(_WINDEF_H)) /* application has to include <windows.h> in order to use these */ diff --git a/ssl/statem/statem.c b/ssl/statem/statem.c index e5a50c4..4f259fd 100644 --- a/ssl/statem/statem.c +++ b/ssl/statem/statem.c @@ -272,7 +272,6 @@ static info_cb get_callback(SSL *s) static int state_machine(SSL *s, int server) { BUF_MEM *buf = NULL; - unsigned long Time = (unsigned long)time(NULL); void (*cb) (const SSL *ssl, int type, int val) = NULL; OSSL_STATEM *st = &s->statem; int ret = -1; @@ -283,7 +282,6 @@ static int state_machine(SSL *s, int server) return -1; } - RAND_add(&Time, sizeof(Time), 0); ERR_clear_error(); clear_sys_error(); diff --git a/test/bntest.c b/test/bntest.c index a570d00..4dae660 100644 --- a/test/bntest.c +++ b/test/bntest.c @@ -2035,11 +2035,8 @@ static int run_file_tests(int i) int setup_tests(void) { - static const char rnd_seed[] = - "If not seeded, BN_generate_prime might fail"; int n = test_get_argument_count(); - RAND_seed(rnd_seed, sizeof(rnd_seed)); if (!TEST_ptr(ctx = BN_CTX_new())) return 0; diff --git a/test/build.info b/test/build.info index db34a5f..34d72d7 100644 --- a/test/build.info +++ b/test/build.info @@ -32,7 +32,7 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=MAIN hmactest \ rc2test rc4test rc5test \ destest mdc2test \ - randtest dhtest enginetest casttest \ + dhtest enginetest casttest \ bftest ssltest_old dsatest exptest rsa_test \ evp_test evp_extra_test igetest v3nametest v3ext \ crltest danetest bad_dtls_test lhash_test \ @@ -119,10 +119,6 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=MAIN INCLUDE[mdc2test]=../include DEPEND[mdc2test]=../libcrypto libtestutil.a - SOURCE[randtest]=randtest.c - INCLUDE[randtest]=../include - DEPEND[randtest]=../libcrypto libtestutil.a - SOURCE[dhtest]=dhtest.c INCLUDE[dhtest]=.. ../include DEPEND[dhtest]=../libcrypto libtestutil.a diff --git a/test/dhtest.c b/test/dhtest.c index 6403f77..595732c 100644 --- a/test/dhtest.c +++ b/test/dhtest.c @@ -24,9 +24,6 @@ static int cb(int p, int n, BN_GENCB *arg); -static const char rnd_seed[] = - "string to make the random number generator think it has randomness"; - static int dh_test(void) { BN_GENCB *_cb = NULL; @@ -40,8 +37,6 @@ static int dh_test(void) int i, alen, blen, aout, bout; int ret = 0; - RAND_seed(rnd_seed, sizeof rnd_seed); - if (!TEST_ptr(_cb = BN_GENCB_new())) goto err; BN_GENCB_set(_cb, &cb, NULL); diff --git a/test/drbgtest.c b/test/drbgtest.c index 90ed2ef..f28cd48 100644 --- a/test/drbgtest.c +++ b/test/drbgtest.c @@ -92,18 +92,18 @@ typedef struct drbg_selftest_data_st { make_drbg_test_data(nid, RAND_DRBG_FLAG_CTR_USE_DF, pr, p) static DRBG_SELFTEST_DATA drbg_test[] = { - make_drbg_test_data_df(NID_aes_128_ctr, aes_128_use_df, 0), - make_drbg_test_data_df(NID_aes_192_ctr, aes_192_use_df, 0), - make_drbg_test_data_df(NID_aes_256_ctr, aes_256_use_df, 1), make_drbg_test_data (NID_aes_128_ctr, 0, aes_128_no_df, 0), make_drbg_test_data (NID_aes_192_ctr, 0, aes_192_no_df, 0), make_drbg_test_data (NID_aes_256_ctr, 0, aes_256_no_df, 1), + make_drbg_test_data_df(NID_aes_128_ctr, aes_128_use_df, 0), + make_drbg_test_data_df(NID_aes_192_ctr, aes_192_use_df, 0), + make_drbg_test_data_df(NID_aes_256_ctr, aes_256_use_df, 1), }; static int app_data_index; /* - * Test context data, attached as appdata to the DRBG_CTX + * Test context data, attached as EXDATA to the RAND_DRBG */ typedef struct test_ctx_st { const unsigned char *ent; @@ -114,29 +114,29 @@ typedef struct test_ctx_st { int noncecnt; } TEST_CTX; -static size_t kat_entropy(DRBG_CTX *dctx, unsigned char **pout, +static size_t kat_entropy(RAND_DRBG *drbg, unsigned char **pout, int entropy, size_t min_len, size_t max_len) { - TEST_CTX *t = (TEST_CTX *)RAND_DRBG_get_ex_data(dctx, app_data_index); + TEST_CTX *t = (TEST_CTX *)RAND_DRBG_get_ex_data(drbg, app_data_index); t->entcnt++; *pout = (unsigned char *)t->ent; return t->entlen; } -static size_t kat_nonce(DRBG_CTX *dctx, unsigned char **pout, +static size_t kat_nonce(RAND_DRBG *drbg, unsigned char **pout, int entropy, size_t min_len, size_t max_len) { - TEST_CTX *t = (TEST_CTX *)RAND_DRBG_get_ex_data(dctx, app_data_index); + TEST_CTX *t = (TEST_CTX *)RAND_DRBG_get_ex_data(drbg, app_data_index); t->noncecnt++; *pout = (unsigned char *)t->nonce; return t->noncelen; } -static int uninstantiate(DRBG_CTX *dctx) +static int uninstantiate(RAND_DRBG *drbg) { - int ret = dctx == NULL ? 1 : RAND_DRBG_uninstantiate(dctx); + int ret = drbg == NULL ? 1 : RAND_DRBG_uninstantiate(drbg); ERR_clear_error(); return ret; @@ -147,7 +147,7 @@ static int uninstantiate(DRBG_CTX *dctx) */ static int single_kat(DRBG_SELFTEST_DATA *td) { - DRBG_CTX *dctx = NULL; + RAND_DRBG *drbg = NULL; TEST_CTX t; int failures = 0; unsigned char buff[1024]; @@ -156,9 +156,9 @@ static int single_kat(DRBG_SELFTEST_DATA *td) * Test without PR: Instantiate DRBG with test entropy, nonce and * personalisation string. */ - if (!TEST_ptr(dctx = RAND_DRBG_new(td->nid, td->flags, NULL))) + if (!TEST_ptr(drbg = RAND_DRBG_new(td->nid, td->flags, NULL))) return 0; - if (!TEST_true(RAND_DRBG_set_callbacks(dctx, kat_entropy, NULL, + if (!TEST_true(RAND_DRBG_set_callbacks(drbg, kat_entropy, NULL, kat_nonce, NULL))) { failures++; goto err; @@ -168,10 +168,10 @@ static int single_kat(DRBG_SELFTEST_DATA *td) t.entlen = td->entlen; t.nonce = td->nonce; t.noncelen = td->noncelen; - RAND_DRBG_set_ex_data(dctx, app_data_index, &t); + RAND_DRBG_set_ex_data(drbg, app_data_index, &t); - if (!TEST_true(RAND_DRBG_instantiate(dctx, td->pers, td->perslen)) - || !TEST_true(RAND_DRBG_generate(dctx, buff, td->exlen, 0, + if (!TEST_true(RAND_DRBG_instantiate(drbg, td->pers, td->perslen)) + || !TEST_true(RAND_DRBG_generate(drbg, buff, td->exlen, 0, td->adin, td->adinlen)) || !TEST_mem_eq(td->expected, td->exlen, buff, td->exlen)) failures++; @@ -179,29 +179,29 @@ static int single_kat(DRBG_SELFTEST_DATA *td) /* Reseed DRBG with test entropy and additional input */ t.ent = td->entreseed; t.entlen = td->entreseedlen; - if (!TEST_true(RAND_DRBG_reseed(dctx, td->adinreseed, td->adinreseedlen) - || !TEST_true(RAND_DRBG_generate(dctx, buff, td->kat2len, 0, + if (!TEST_true(RAND_DRBG_reseed(drbg, td->adinreseed, td->adinreseedlen) + || !TEST_true(RAND_DRBG_generate(drbg, buff, td->kat2len, 0, td->adin2, td->adin2len)) || !TEST_mem_eq(td->kat2, td->kat2len, buff, td->kat2len))) failures++; - uninstantiate(dctx); + uninstantiate(drbg); /* * Now test with PR: Instantiate DRBG with test entropy, nonce and * personalisation string. */ - if (!TEST_true(RAND_DRBG_set(dctx, td->nid, td->flags)) - || !TEST_true(RAND_DRBG_set_callbacks(dctx, kat_entropy, NULL, + if (!TEST_true(RAND_DRBG_set(drbg, td->nid, td->flags)) + || !TEST_true(RAND_DRBG_set_callbacks(drbg, kat_entropy, NULL, kat_nonce, NULL))) failures++; - RAND_DRBG_set_ex_data(dctx, app_data_index, &t); + RAND_DRBG_set_ex_data(drbg, app_data_index, &t); t.ent = td->ent_pr; t.entlen = td->entlen_pr; t.nonce = td->nonce_pr; t.noncelen = td->noncelen_pr; t.entcnt = 0; t.noncecnt = 0; - if (!TEST_true(RAND_DRBG_instantiate(dctx, td->pers_pr, td->perslen_pr))) + if (!TEST_true(RAND_DRBG_instantiate(drbg, td->pers_pr, td->perslen_pr))) failures++; /* @@ -210,7 +210,7 @@ static int single_kat(DRBG_SELFTEST_DATA *td) */ t.ent = td->entpr_pr; t.entlen = td->entprlen_pr; - if (!TEST_true(RAND_DRBG_generate(dctx, buff, td->katlen_pr, 1, + if (!TEST_true(RAND_DRBG_generate(drbg, buff, td->katlen_pr, 1, td->adin_pr, td->adinlen_pr)) || !TEST_mem_eq(td->kat_pr, td->katlen_pr, buff, td->katlen_pr)) failures++; @@ -221,28 +221,28 @@ static int single_kat(DRBG_SELFTEST_DATA *td) t.ent = td->entg_pr; t.entlen = td->entglen_pr; - if (!TEST_true(RAND_DRBG_generate(dctx, buff, td->kat2len_pr, 1, + if (!TEST_true(RAND_DRBG_generate(drbg, buff, td->kat2len_pr, 1, td->ading_pr, td->adinglen_pr)) || !TEST_mem_eq(td->kat2_pr, td->kat2len_pr, buff, td->kat2len_pr)) failures++; err: - uninstantiate(dctx); - RAND_DRBG_free(dctx); + uninstantiate(drbg); + RAND_DRBG_free(drbg); return failures == 0; } /* * Initialise a DRBG based on selftest data */ -static int init(DRBG_CTX *dctx, DRBG_SELFTEST_DATA *td, TEST_CTX *t) +static int init(RAND_DRBG *drbg, DRBG_SELFTEST_DATA *td, TEST_CTX *t) { - if (!TEST_true(RAND_DRBG_set(dctx, td->nid, td->flags)) - || !TEST_true(RAND_DRBG_set_callbacks(dctx, kat_entropy, NULL, + if (!TEST_true(RAND_DRBG_set(drbg, td->nid, td->flags)) + || !TEST_true(RAND_DRBG_set_callbacks(drbg, kat_entropy, NULL, kat_nonce, NULL))) return 0; - RAND_DRBG_set_ex_data(dctx, app_data_index, t); + RAND_DRBG_set_ex_data(drbg, app_data_index, t); t->ent = td->ent; t->entlen = td->entlen; t->nonce = td->nonce; @@ -255,11 +255,11 @@ static int init(DRBG_CTX *dctx, DRBG_SELFTEST_DATA *td, TEST_CTX *t) /* * Initialise and instantiate DRBG based on selftest data */ -static int instantiate(DRBG_CTX *dctx, DRBG_SELFTEST_DATA *td, +static int instantiate(RAND_DRBG *drbg, DRBG_SELFTEST_DATA *td, TEST_CTX *t) { - if (!TEST_true(init(dctx, td, t)) - || !TEST_true(RAND_DRBG_instantiate(dctx, td->pers, td->perslen))) + if (!TEST_true(init(drbg, td, t)) + || !TEST_true(RAND_DRBG_instantiate(drbg, td->pers, td->perslen))) return 0; return 1; } @@ -270,14 +270,14 @@ static int instantiate(DRBG_CTX *dctx, DRBG_SELFTEST_DATA *td, */ static int error_check(DRBG_SELFTEST_DATA *td) { - static char zero[sizeof(DRBG_CTX)]; - DRBG_CTX *dctx = NULL; + static char zero[sizeof(RAND_DRBG)]; + RAND_DRBG *drbg = NULL; TEST_CTX t; unsigned char buff[1024]; unsigned int reseed_counter_tmp; int ret = 0; - if (!TEST_ptr(dctx = RAND_DRBG_new(0, 0, NULL))) + if (!TEST_ptr(drbg = RAND_DRBG_new(0, 0, NULL))) goto err; /* @@ -285,8 +285,8 @@ static int error_check(DRBG_SELFTEST_DATA *td) */ /* Test detection of too large personlisation string */ - if (!init(dctx, td, &t) - || RAND_DRBG_instantiate(dctx, td->pers, dctx->max_pers + 1) > 0) + if (!init(drbg, td, &t) + || RAND_DRBG_instantiate(drbg, td->pers, drbg->max_pers + 1) > 0) goto err; /* @@ -295,27 +295,27 @@ static int error_check(DRBG_SELFTEST_DATA *td) /* Test entropy source failure detecion: i.e. returns no data */ t.entlen = 0; - if (TEST_int_le(RAND_DRBG_instantiate(dctx, td->pers, td->perslen), 0)) + if (TEST_int_le(RAND_DRBG_instantiate(drbg, td->pers, td->perslen), 0)) goto err; /* Try to generate output from uninstantiated DRBG */ - if (!TEST_false(RAND_DRBG_generate(dctx, buff, td->exlen, 0, + if (!TEST_false(RAND_DRBG_generate(drbg, buff, td->exlen, 0, td->adin, td->adinlen)) - || !uninstantiate(dctx)) + || !uninstantiate(drbg)) goto err; /* Test insufficient entropy */ - t.entlen = dctx->min_entropy - 1; - if (!init(dctx, td, &t) - || RAND_DRBG_instantiate(dctx, td->pers, td->perslen) > 0 - || !uninstantiate(dctx)) + t.entlen = drbg->min_entropy - 1; + if (!init(drbg, td, &t) + || RAND_DRBG_instantiate(drbg, td->pers, td->perslen) > 0 + || !uninstantiate(drbg)) goto err; /* Test too much entropy */ - t.entlen = dctx->max_entropy + 1; - if (!init(dctx, td, &t) - || RAND_DRBG_instantiate(dctx, td->pers, td->perslen) > 0 - || !uninstantiate(dctx)) + t.entlen = drbg->max_entropy + 1; + if (!init(drbg, td, &t) + || RAND_DRBG_instantiate(drbg, td->pers, td->perslen) > 0 + || !uninstantiate(drbg)) goto err; /* @@ -323,37 +323,37 @@ static int error_check(DRBG_SELFTEST_DATA *td) */ /* Test too small nonce */ - if (dctx->min_nonce) { - t.noncelen = dctx->min_nonce - 1; - if (!init(dctx, td, &t) - || RAND_DRBG_instantiate(dctx, td->pers, td->perslen) > 0 - || !uninstantiate(dctx)) + if (drbg->min_nonce) { + t.noncelen = drbg->min_nonce - 1; + if (!init(drbg, td, &t) + || RAND_DRBG_instantiate(drbg, td->pers, td->perslen) > 0 + || !uninstantiate(drbg)) goto err; } /* Test too large nonce */ - if (dctx->max_nonce) { - t.noncelen = dctx->max_nonce + 1; - if (!init(dctx, td, &t) - || RAND_DRBG_instantiate(dctx, td->pers, td->perslen) > 0 - || !uninstantiate(dctx)) + if (drbg->max_nonce) { + t.noncelen = drbg->max_nonce + 1; + if (!init(drbg, td, &t) + || RAND_DRBG_instantiate(drbg, td->pers, td->perslen) > 0 + || !uninstantiate(drbg)) goto err; } /* Instantiate with valid data, Check generation is now OK */ - if (!instantiate(dctx, td, &t) - || !TEST_true(RAND_DRBG_generate(dctx, buff, td->exlen, 0, + if (!instantiate(drbg, td, &t) + || !TEST_true(RAND_DRBG_generate(drbg, buff, td->exlen, 0, td->adin, td->adinlen))) goto err; /* Request too much data for one request */ - if (!TEST_false(RAND_DRBG_generate(dctx, buff, dctx->max_request + 1, 0, + if (!TEST_false(RAND_DRBG_generate(drbg, buff, drbg->max_request + 1, 0, td->adin, td->adinlen))) goto err; /* Try too large additional input */ - if (!TEST_false(RAND_DRBG_generate(dctx, buff, td->exlen, 0, - td->adin, dctx->max_adin + 1))) + if (!TEST_false(RAND_DRBG_generate(drbg, buff, td->exlen, 0, + td->adin, drbg->max_adin + 1))) goto err; /* @@ -361,24 +361,24 @@ static int error_check(DRBG_SELFTEST_DATA *td) * failure. */ t.entlen = 0; - if (TEST_false(RAND_DRBG_generate(dctx, buff, td->exlen, 1, + if (TEST_false(RAND_DRBG_generate(drbg, buff, td->exlen, 1, td->adin, td->adinlen)) - || !uninstantiate(dctx)) + || !uninstantiate(drbg)) goto err; /* Instantiate again with valid data */ - if (!instantiate(dctx, td, &t)) + if (!instantiate(drbg, td, &t)) goto err; - reseed_counter_tmp = dctx->reseed_counter; - dctx->reseed_counter = dctx->reseed_interval; + reseed_counter_tmp = drbg->reseed_counter; + drbg->reseed_counter = drbg->reseed_interval; /* Generate output and check entropy has been requested for reseed */ t.entcnt = 0; - if (!TEST_true(RAND_DRBG_generate(dctx, buff, td->exlen, 0, + if (!TEST_true(RAND_DRBG_generate(drbg, buff, td->exlen, 0, td->adin, td->adinlen)) || !TEST_int_eq(t.entcnt, 1) - || !TEST_int_eq(dctx->reseed_counter, reseed_counter_tmp + 1) - || !uninstantiate(dctx)) + || !TEST_int_eq(drbg->reseed_counter, reseed_counter_tmp + 1) + || !uninstantiate(drbg)) goto err; /* @@ -386,24 +386,24 @@ static int error_check(DRBG_SELFTEST_DATA *td) * failure. */ t.entlen = 0; - if (!TEST_false(RAND_DRBG_generate(dctx, buff, td->exlen, 1, + if (!TEST_false(RAND_DRBG_generate(drbg, buff, td->exlen, 1, td->adin, td->adinlen)) - || !uninstantiate(dctx)) + || !uninstantiate(drbg)) goto err; /* Test reseed counter works */ - if (!instantiate(dctx, td, &t)) + if (!instantiate(drbg, td, &t)) goto err; - reseed_counter_tmp = dctx->reseed_counter; - dctx->reseed_counter = dctx->reseed_interval; + reseed_counter_tmp = drbg->reseed_counter; + drbg->reseed_counter = drbg->reseed_interval; /* Generate output and check entropy has been requested for reseed */ t.entcnt = 0; - if (!TEST_true(RAND_DRBG_generate(dctx, buff, td->exlen, 0, + if (!TEST_true(RAND_DRBG_generate(drbg, buff, td->exlen, 0, td->adin, td->adinlen)) || !TEST_int_eq(t.entcnt, 1) - || !TEST_int_eq(dctx->reseed_counter, reseed_counter_tmp + 1) - || !uninstantiate(dctx)) + || !TEST_int_eq(drbg->reseed_counter, reseed_counter_tmp + 1) + || !uninstantiate(drbg)) goto err; /* @@ -411,41 +411,41 @@ static int error_check(DRBG_SELFTEST_DATA *td) */ /* Test explicit reseed with too large additional input */ - if (!init(dctx, td, &t) - || RAND_DRBG_reseed(dctx, td->adin, dctx->max_adin + 1) > 0) + if (!init(drbg, td, &t) + || RAND_DRBG_reseed(drbg, td->adin, drbg->max_adin + 1) > 0) goto err; /* Test explicit reseed with entropy source failure */ t.entlen = 0; - if (!TEST_int_le(RAND_DRBG_reseed(dctx, td->adin, td->adinlen), 0) - || !uninstantiate(dctx)) + if (!TEST_int_le(RAND_DRBG_reseed(drbg, td->adin, td->adinlen), 0) + || !uninstantiate(drbg)) goto err; /* Test explicit reseed with too much entropy */ - if (!init(dctx, td, &t)) + if (!init(drbg, td, &t)) goto err; - t.entlen = dctx->max_entropy + 1; - if (!TEST_int_le(RAND_DRBG_reseed(dctx, td->adin, td->adinlen), 0) - || !uninstantiate(dctx)) + t.entlen = drbg->max_entropy + 1; + if (!TEST_int_le(RAND_DRBG_reseed(drbg, td->adin, td->adinlen), 0) + || !uninstantiate(drbg)) goto err; /* Test explicit reseed with too little entropy */ - if (!init(dctx, td, &t)) + if (!init(drbg, td, &t)) goto err; - t.entlen = dctx->min_entropy - 1; - if (!TEST_int_le(RAND_DRBG_reseed(dctx, td->adin, td->adinlen), 0) - || !uninstantiate(dctx)) + t.entlen = drbg->min_entropy - 1; + if (!TEST_int_le(RAND_DRBG_reseed(drbg, td->adin, td->adinlen), 0) + || !uninstantiate(drbg)) goto err; /* Standard says we have to check uninstantiate really zeroes */ - if (!TEST_mem_eq(zero, sizeof(dctx->ctr), &dctx->ctr, sizeof(dctx->ctr))) + if (!TEST_mem_eq(zero, sizeof(drbg->ctr), &drbg->ctr, sizeof(drbg->ctr))) goto err; ret = 1; err: - uninstantiate(dctx); - RAND_DRBG_free(dctx); + uninstantiate(drbg); + RAND_DRBG_free(drbg); return ret; } @@ -475,6 +475,19 @@ err: return rv; } +#define RAND_ADD_SIZE 500 + +static int test_rand_add() +{ + char *p; + + if (!TEST_ptr(p = malloc(RAND_ADD_SIZE))) + return 0; + RAND_add(p, RAND_ADD_SIZE, RAND_ADD_SIZE); + free(p); + return 1; +} + int setup_tests(void) { @@ -482,5 +495,6 @@ int setup_tests(void) ADD_ALL_TESTS(test_kats, OSSL_NELEM(drbg_test)); ADD_ALL_TESTS(test_error_checks, OSSL_NELEM(drbg_test)); + ADD_TEST(test_rand_add); return 1; } diff --git a/test/dsatest.c b/test/dsatest.c index 09a49fc..7c58731 100644 --- a/test/dsatest.c +++ b/test/dsatest.c @@ -63,9 +63,6 @@ static unsigned char out_g[] = { static const unsigned char str1[] = "12345678901234567890"; -static const char rnd_seed[] = - "string to make the random number generator think it has randomness"; - static int dsa_test(void) { BN_GENCB *cb; @@ -77,8 +74,6 @@ static int dsa_test(void) unsigned int siglen; const BIGNUM *p = NULL, *q = NULL, *g = NULL; - RAND_seed(rnd_seed, sizeof rnd_seed); - if (!TEST_ptr(cb = BN_GENCB_new())) goto end; diff --git a/test/ecdsatest.c b/test/ecdsatest.c index ed29bc7..8bd9e6c 100644 --- a/test/ecdsatest.c +++ b/test/ecdsatest.c @@ -28,10 +28,6 @@ # include <openssl/err.h> # include <openssl/rand.h> -static const char rnd_seed[] = - "string to make the random number generator think it has randomness"; - - /* functions to change the RAND_METHOD */ static int fbytes(unsigned char *buf, int num); @@ -401,8 +397,6 @@ int setup_tests(void) #ifdef OPENSSL_NO_EC TEST_note("Elliptic curves are disabled."); #else - /* initialize the prng */ - RAND_seed(rnd_seed, sizeof(rnd_seed)); ADD_TEST(x9_62_tests); ADD_TEST(test_builtin); #endif diff --git a/test/ectest.c b/test/ectest.c index 85bb462..fb6027b 100644 --- a/test/ectest.c +++ b/test/ectest.c @@ -1425,9 +1425,6 @@ static int parameter_test(void) ECPARAMETERS_free(ecparameters); return r; } - -static const char rnd_seed[] = - "string to make the random number generator think it has randomness"; #endif int setup_tests(void) @@ -1438,8 +1435,6 @@ int setup_tests(void) || !TEST_true(EC_get_builtin_curves(curves, crv_len))) return 0; - RAND_seed(rnd_seed, sizeof rnd_seed); /* or BN_generate_prime may fail */ - ADD_TEST(parameter_test); ADD_TEST(prime_field_tests); # ifndef OPENSSL_NO_EC2M diff --git a/test/randtest.c b/test/randtest.c deleted file mode 100644 index 47d28f4..0000000 --- a/test/randtest.c +++ /dev/null @@ -1,110 +0,0 @@ -/* - * Copyright 1995-2017 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the OpenSSL license (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#include <openssl/rand.h> -#include "testutil.h" - -/* some FIPS 140-1 random number test */ -/* some simple tests */ - -static int fips_random_tests(void) -{ - unsigned char buf[2500]; - int i, j, k, s, sign, nsign, ret = 1; - unsigned long n1; - unsigned long n2[16]; - unsigned long runs[2][34]; - long d; - - if (!TEST_int_ge(RAND_bytes(buf, sizeof(buf)), 0)) - return 0; - - n1 = 0; - for (i = 0; i < 16; i++) - n2[i] = 0; - for (i = 0; i < 34; i++) - runs[0][i] = runs[1][i] = 0; - - /* test 1 and 2 */ - sign = 0; - nsign = 0; - for (i = 0; i < 2500; i++) { - j = buf[i]; - - n2[j & 0x0f]++; - n2[(j >> 4) & 0x0f]++; - - for (k = 0; k < 8; k++) { - s = (j & 0x01); - if (s == sign) - nsign++; - else { - if (nsign > 34) - nsign = 34; - if (nsign != 0) { - runs[sign][nsign - 1]++; - if (nsign > 6) - runs[sign][5]++; - } - sign = s; - nsign = 1; - } - - if (s) - n1++; - j >>= 1; - } - } - if (nsign > 34) - nsign = 34; - if (nsign != 0) - runs[sign][nsign - 1]++; - - /* test 1 */ - if (!TEST_true(9654 < n1 && n1 < 10346)) { - TEST_info("test 1 failed, X=%lu", n1); - ret = 0; - } - - /* test 2 */ - d = 0; - for (i = 0; i < 16; i++) - d += n2[i] * n2[i]; - d = (d * 8) / 25 - 500000; - if (!TEST_true(103 < d && d < 5740)) { - TEST_info("test 2 failed, X=%ld.%02ld", d / 100L, d % 100L); - ret = 0; - } - - /* test 3 */ - for (i = 0; i < 2; i++) { - if (!TEST_true(2267 < runs[i][0] && runs[i][0] < 2733) - || !TEST_true(1079 < runs[i][1] && runs[i][1] < 1421) - || !TEST_true(502 < runs[i][2] && runs[i][2] < 748) - || !TEST_true(223 < runs[i][3] && runs[i][3] < 402) - || !TEST_true(90 < runs[i][4] && runs[i][4] < 223) - || !TEST_true(90 < runs[i][5] && runs[i][5] < 223)) { - TEST_info("During run %d", i); - ret = 0; - } - } - - /* test 4 */ - if (!TEST_int_eq(runs[0][33], 0) - || !TEST_int_eq(runs[1][33], 0)) - ret = 0; - - return ret; -} - -int setup_tests(void) -{ - ADD_TEST(fips_random_tests); - return 1; -} diff --git a/test/recipes/05-test_rand.t b/test/recipes/05-test_rand.t index 64840db..69c92ff 100644 --- a/test/recipes/05-test_rand.t +++ b/test/recipes/05-test_rand.t @@ -10,8 +10,7 @@ use strict; use warnings; use OpenSSL::Test; -plan tests => 2; +plan tests => 1; setup("test_rand"); -ok(run(test(["randtest"]))); ok(run(test(["drbgtest"]))); diff --git a/test/ssltest_old.c b/test/ssltest_old.c index 7cfddd2..37e980d 100644 --- a/test/ssltest_old.c +++ b/test/ssltest_old.c @@ -613,8 +613,6 @@ static int custom_ext_3_srv_add_cb(SSL *s, unsigned int ext_type, static char *cipher = NULL; static int verbose = 0; static int debug = 0; -static const char rnd_seed[] = - "string to make the random number generator think it has randomness"; int doit_localhost(SSL *s_ssl, SSL *c_ssl, int family, long bytes, clock_t *s_time, clock_t *c_time); @@ -928,8 +926,6 @@ int main(int argc, char *argv[]) CRYPTO_set_mem_debug(1); CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON); - RAND_seed(rnd_seed, sizeof rnd_seed); - bio_stdout = BIO_new_fp(stdout, BIO_NOCLOSE | BIO_FP_TEXT); s_cctx = SSL_CONF_CTX_new(); diff --git a/util/libcrypto.num b/util/libcrypto.num index 1707459..023b649 100644 --- a/util/libcrypto.num +++ b/util/libcrypto.num @@ -4345,10 +4345,8 @@ OSSL_STORE_LOADER_get0_engine 4287 1_1_1 EXIST::FUNCTION: OPENSSL_fork_prepare 4288 1_1_1 EXIST:UNIX:FUNCTION: OPENSSL_fork_parent 4289 1_1_1 EXIST:UNIX:FUNCTION: OPENSSL_fork_child 4290 1_1_1 EXIST:UNIX:FUNCTION: -RAND_drbg 4291 1_1_1 EXIST::FUNCTION: RAND_DRBG_instantiate 4292 1_1_1 EXIST::FUNCTION: RAND_DRBG_uninstantiate 4293 1_1_1 EXIST::FUNCTION: -RAND_DRBG_get_default 4294 1_1_1 EXIST::FUNCTION: RAND_DRBG_set 4295 1_1_1 EXIST::FUNCTION: RAND_DRBG_set_callbacks 4296 1_1_1 EXIST::FUNCTION: RAND_DRBG_new 4297 1_1_1 EXIST::FUNCTION: @@ -4373,3 +4371,4 @@ SCRYPT_PARAMS_it 4314 1_1_1 EXIST:EXPORT_VAR_AS_FUNCTION: CRYPTO_secure_clear_free 4315 1_1_0g EXIST::FUNCTION: EVP_PKEY_meth_get0 4316 1_1_1 EXIST::FUNCTION: EVP_PKEY_meth_get_count 4317 1_1_1 EXIST::FUNCTION: +RAND_poll_ex 4318 1_1_1 EXIST::FUNCTION: diff --git a/util/private.num b/util/private.num index a586a9b..a25f47a 100644 --- a/util/private.num +++ b/util/private.num @@ -32,6 +32,7 @@ OSSL_STORE_error_fn datatype OSSL_STORE_load_fn datatype OSSL_STORE_open_fn datatype OSSL_STORE_post_process_info_fn datatype +RAND_poll_fn datatype SSL_CTX_keylog_cb_func datatype SSL_early_cb_fn datatype SSL_psk_client_cb_func datatype |