1 /* fips/rand/fips_drbg_lib.c */
2 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
5 /* ====================================================================
6 * Copyright (c) 2011 The OpenSSL Project. All rights reserved.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
34 * 6. Redistributions of any form whatsoever must retain the following
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
54 #define OPENSSL_FIPSAPI
57 #include <openssl/crypto.h>
58 #include <openssl/evp.h>
59 #include <openssl/aes.h>
60 #include <openssl/err.h>
61 #include <openssl/fips_rand.h>
62 #include "fips_rand_lcl.h"
64 /* Support framework for SP800-90 DRBGs */
66 int FIPS_drbg_init(DRBG_CTX *dctx, int type, unsigned int flags)
69 memset(dctx, 0, sizeof(DRBG_CTX));
70 dctx->status = DRBG_STATUS_UNINITIALISED;
74 rv = fips_drbg_hash_init(dctx);
77 rv = fips_drbg_ctr_init(dctx);
82 FIPSerr(FIPS_F_FIPS_DRBG_INIT, FIPS_R_UNSUPPORTED_DRBG_TYPE);
84 FIPSerr(FIPS_F_FIPS_DRBG_INIT, FIPS_R_ERROR_INITIALISING_DRBG);
90 DRBG_CTX *FIPS_drbg_new(int type, unsigned int flags)
94 dctx = OPENSSL_malloc(sizeof(DRBG_CTX));
97 FIPSerr(FIPS_F_FIPS_DRBG_NEW, ERR_R_MALLOC_FAILURE);
102 rv = FIPS_drbg_init(dctx, type, flags);
104 if (FIPS_drbg_init(dctx, type, flags) <= 0)
113 void FIPS_drbg_free(DRBG_CTX *dctx)
115 if (dctx->uninstantiate)
116 dctx->uninstantiate(dctx);
117 OPENSSL_cleanse(dctx, sizeof(DRBG_CTX));
121 int FIPS_drbg_instantiate(DRBG_CTX *dctx,
122 const unsigned char *pers, size_t perslen)
124 size_t entlen = 0, noncelen = 0;
125 unsigned char *nonce = NULL, *entropy = NULL;
128 /* Put here so error script picks them up */
129 FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE,
130 FIPS_R_PERSONALISATION_STRING_TOO_LONG);
131 FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, FIPS_R_IN_ERROR_STATE);
132 FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, FIPS_R_ALREADY_INSTANTIATED);
133 FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, FIPS_R_ERROR_RETRIEVING_ENTROPY);
134 FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, FIPS_R_ERROR_RETRIEVING_NONCE);
135 FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, FIPS_R_INSTANTIATE_ERROR);
140 if (perslen > dctx->max_pers)
142 r = FIPS_R_PERSONALISATION_STRING_TOO_LONG;
146 if (dctx->status != DRBG_STATUS_UNINITIALISED)
148 if (dctx->status == DRBG_STATUS_ERROR)
149 r = FIPS_R_IN_ERROR_STATE;
151 r = FIPS_R_ALREADY_INSTANTIATED;
155 dctx->status = DRBG_STATUS_ERROR;
157 entlen = dctx->get_entropy(dctx, &entropy, dctx->strength,
158 dctx->min_entropy, dctx->max_entropy);
160 if (entlen < dctx->min_entropy || entlen > dctx->max_entropy)
162 r = FIPS_R_ERROR_RETRIEVING_ENTROPY;
166 if (dctx->max_nonce > 0)
168 noncelen = dctx->get_nonce(dctx, &nonce,
170 dctx->min_nonce, dctx->max_nonce);
172 if (noncelen < dctx->min_nonce || noncelen > dctx->max_nonce)
174 r = FIPS_R_ERROR_RETRIEVING_NONCE;
180 if (!dctx->instantiate(dctx,
185 r = FIPS_R_ERROR_INSTANTIATING_DRBG;
190 dctx->status = DRBG_STATUS_READY;
191 dctx->reseed_counter = 1;
195 if (entropy && dctx->cleanup_entropy)
196 dctx->cleanup_entropy(dctx, entropy, entlen);
198 if (nonce && dctx->cleanup_nonce)
199 dctx->cleanup_nonce(dctx, nonce, noncelen);
201 if (dctx->status == DRBG_STATUS_READY)
204 if (r && !(dctx->flags & DRBG_FLAG_NOERR))
205 FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, r);
211 int FIPS_drbg_reseed(DRBG_CTX *dctx,
212 const unsigned char *adin, size_t adinlen)
214 unsigned char *entropy = NULL;
219 FIPSerr(FIPS_F_FIPS_DRBG_RESEED, FIPS_R_NOT_INSTANTIATED);
220 FIPSerr(FIPS_F_FIPS_DRBG_RESEED, FIPS_R_ADDITIONAL_INPUT_TOO_LONG);
222 if (dctx->status != DRBG_STATUS_READY
223 && dctx->status != DRBG_STATUS_RESEED)
225 if (dctx->status == DRBG_STATUS_ERROR)
226 r = FIPS_R_IN_ERROR_STATE;
227 else if(dctx->status == DRBG_STATUS_UNINITIALISED)
228 r = FIPS_R_NOT_INSTANTIATED;
234 else if (adinlen > dctx->max_adin)
236 r = FIPS_R_ADDITIONAL_INPUT_TOO_LONG;
240 dctx->status = DRBG_STATUS_ERROR;
242 entlen = dctx->get_entropy(dctx, &entropy, dctx->strength,
243 dctx->min_entropy, dctx->max_entropy);
245 if (entlen < dctx->min_entropy || entlen > dctx->max_entropy)
247 r = FIPS_R_ERROR_RETRIEVING_ENTROPY;
251 if (!dctx->reseed(dctx, entropy, entlen, adin, adinlen))
254 dctx->status = DRBG_STATUS_READY;
255 dctx->reseed_counter = 1;
258 if (entropy && dctx->cleanup_entropy)
259 dctx->cleanup_entropy(dctx, entropy, entlen);
261 if (dctx->status == DRBG_STATUS_READY)
264 if (r && !(dctx->flags & DRBG_FLAG_NOERR))
265 FIPSerr(FIPS_F_FIPS_DRBG_RESEED, r);
271 static int fips_drbg_generate_internal(DRBG_CTX *dctx,
272 unsigned char *out, size_t outlen,
273 int strength, int prediction_resistance,
274 const unsigned char *adin, size_t adinlen)
278 if (dctx->status != DRBG_STATUS_READY
279 && dctx->status != DRBG_STATUS_RESEED)
281 if (dctx->status == DRBG_STATUS_ERROR)
282 r = FIPS_R_IN_ERROR_STATE;
283 else if(dctx->status == DRBG_STATUS_UNINITIALISED)
284 r = FIPS_R_NOT_INSTANTIATED;
288 if (outlen > dctx->max_request)
290 r = FIPS_R_REQUEST_TOO_LARGE_FOR_DRBG;
294 if (strength > dctx->strength)
296 r = FIPS_R_INSUFFICIENT_SECURITY_STRENGTH;
300 if (dctx->status == DRBG_STATUS_RESEED || prediction_resistance)
302 if (!FIPS_drbg_reseed(dctx, adin, adinlen))
304 r = FIPS_R_RESEED_ERROR;
311 if (!dctx->generate(dctx, out, outlen, adin, adinlen))
313 r = FIPS_R_GENERATE_ERROR;
314 dctx->status = DRBG_STATUS_ERROR;
317 if (dctx->reseed_counter >= dctx->reseed_interval)
318 dctx->status = DRBG_STATUS_RESEED;
320 dctx->reseed_counter++;
325 if (!(dctx->flags & DRBG_FLAG_NOERR))
326 FIPSerr(FIPS_F_FIPS_DRBG_GENERATE_INTERNAL, r);
333 /* external generate function: incorporates continuous RNG test if not
337 int FIPS_drbg_generate(DRBG_CTX *dctx,
338 unsigned char *out, size_t outlen,
339 int strength, int prediction_resistance,
340 const unsigned char *adin, size_t adinlen)
342 unsigned char tmp[16], *pout;
344 /* If test mode don't run continuous RNG test */
345 if (dctx->flags & DRBG_FLAG_TEST)
347 return fips_drbg_generate_internal(dctx, out, outlen,
349 prediction_resistance,
352 /* If this is the first call generate block and save buffer */
355 if (!fips_drbg_generate_internal(dctx, dctx->lb, 16,
356 strength, prediction_resistance,
362 /* If request less that 16 bytes request 16 in temp buffer */
376 if (!fips_drbg_generate_internal(dctx, pout, poutlen,
377 strength, prediction_resistance,
380 /* Compare to last block for continuous PRNG test */
381 if (!memcmp(pout, dctx->lb, 16))
383 FIPSerr(FIPS_F_FIPS_DRBG_GENERATE, FIPS_R_DRBG_STUCK);
386 /* Update last block */
387 memcpy(dctx->lb, pout, 16);
388 /* Copy to output buffer if needed */
390 memcpy(out, pout, outlen);
396 int FIPS_drbg_uninstantiate(DRBG_CTX *dctx)
399 if (!dctx->uninstantiate)
402 rv = dctx->uninstantiate(dctx);
403 /* Although we'd like to cleanse here we can't because we have to
404 * test the uninstantiate really zeroes the data.
406 memset(dctx, 0, sizeof(DRBG_CTX));
407 /* If method has problems uninstantiating, return error */
411 int FIPS_drbg_set_callbacks(DRBG_CTX *dctx,
412 size_t (*get_entropy)(DRBG_CTX *ctx, unsigned char **pout,
413 int entropy, size_t min_len, size_t max_len),
414 void (*cleanup_entropy)(DRBG_CTX *ctx, unsigned char *out, size_t olen),
415 size_t (*get_nonce)(DRBG_CTX *ctx, unsigned char **pout,
416 int entropy, size_t min_len, size_t max_len),
417 void (*cleanup_nonce)(DRBG_CTX *ctx, unsigned char *out, size_t olen))
419 if (dctx->status != DRBG_STATUS_UNINITIALISED)
421 dctx->get_entropy = get_entropy;
422 dctx->cleanup_entropy = cleanup_entropy;
423 dctx->get_nonce = get_nonce;
424 dctx->cleanup_nonce = cleanup_nonce;
428 void *FIPS_drbg_get_app_data(DRBG_CTX *dctx)
430 return dctx->app_data;
433 void FIPS_drbg_set_app_data(DRBG_CTX *dctx, void *app_data)
435 dctx->app_data = app_data;
438 size_t FIPS_drbg_get_blocklength(DRBG_CTX *dctx)
440 return dctx->blocklength;
443 int FIPS_drbg_get_strength(DRBG_CTX *dctx)
445 return dctx->strength;