1 /* fips/rand/fips_drbg_lib.c */
2 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
5 /* ====================================================================
6 * Copyright (c) 2011 The OpenSSL Project. All rights reserved.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
34 * 6. Redistributions of any form whatsoever must retain the following
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
54 #define OPENSSL_FIPSAPI
57 #include <openssl/crypto.h>
58 #include <openssl/err.h>
59 #include <openssl/fips_rand.h>
60 #include "fips_rand_lcl.h"
62 /* Support framework for SP800-90 DRBGs */
64 int FIPS_drbg_init(DRBG_CTX *dctx, int type, unsigned int flags)
67 memset(dctx, 0, sizeof(DRBG_CTX));
68 dctx->status = DRBG_STATUS_UNINITIALISED;
73 dctx->entropy_blocklen = 0;
74 dctx->health_check_cnt = 0;
75 dctx->health_check_interval = DRBG_HEALTH_INTERVAL;
77 rv = fips_drbg_hash_init(dctx);
80 rv = fips_drbg_ctr_init(dctx);
82 rv = fips_drbg_hmac_init(dctx);
84 rv = fips_drbg_ec_init(dctx);
89 FIPSerr(FIPS_F_FIPS_DRBG_INIT, FIPS_R_UNSUPPORTED_DRBG_TYPE);
91 FIPSerr(FIPS_F_FIPS_DRBG_INIT, FIPS_R_ERROR_INITIALISING_DRBG);
94 /* If not in test mode run selftests on DRBG of the same type */
96 if (!(dctx->xflags & DRBG_FLAG_TEST))
99 if (!fips_drbg_kat(&tctx, type, flags | DRBG_FLAG_TEST))
101 FIPSerr(FIPS_F_FIPS_DRBG_INIT, FIPS_R_SELFTEST_FAILURE);
102 dctx->status = DRBG_STATUS_ERROR;
110 DRBG_CTX *FIPS_drbg_new(int type, unsigned int flags)
113 dctx = OPENSSL_malloc(sizeof(DRBG_CTX));
116 FIPSerr(FIPS_F_FIPS_DRBG_NEW, ERR_R_MALLOC_FAILURE);
122 memset(dctx, 0, sizeof(DRBG_CTX));
124 dctx->status = DRBG_STATUS_UNINITIALISED;
128 if (FIPS_drbg_init(dctx, type, flags) <= 0)
137 void FIPS_drbg_free(DRBG_CTX *dctx)
139 if (dctx->uninstantiate)
140 dctx->uninstantiate(dctx);
141 OPENSSL_cleanse(&dctx->d, sizeof(dctx->d));
145 static size_t fips_get_entropy(DRBG_CTX *dctx, unsigned char **pout,
146 int entropy, size_t min_len, size_t max_len)
148 unsigned char *tout, *p;
149 size_t bl = dctx->entropy_blocklen, rv;
150 if (dctx->xflags & DRBG_FLAG_TEST || !bl)
151 return dctx->get_entropy(dctx, pout, entropy, min_len, max_len);
152 rv = dctx->get_entropy(dctx, &tout, entropy + bl,
153 min_len + bl, max_len + bl);
155 if (rv < (min_len + bl) || (rv % bl))
157 /* Compare consecutive blocks for continuous PRNG test */
158 for (p = tout; p < tout + rv - bl; p += bl)
160 if (!memcmp(p, p + bl, bl))
162 FIPSerr(FIPS_F_FIPS_GET_ENTROPY, FIPS_R_ENTROPY_SOURCE_STUCK);
172 static void fips_cleanup_entropy(DRBG_CTX *dctx,
173 unsigned char *out, size_t olen)
176 if (dctx->xflags & DRBG_FLAG_TEST)
179 bl = dctx->entropy_blocklen;
180 /* Call cleanup with original arguments */
181 dctx->cleanup_entropy(dctx, out - bl, olen + bl);
185 int FIPS_drbg_instantiate(DRBG_CTX *dctx,
186 const unsigned char *pers, size_t perslen)
188 size_t entlen = 0, noncelen = 0;
189 unsigned char *nonce = NULL, *entropy = NULL;
192 /* Put here so error script picks them up */
193 FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE,
194 FIPS_R_PERSONALISATION_STRING_TOO_LONG);
195 FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, FIPS_R_IN_ERROR_STATE);
196 FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, FIPS_R_ALREADY_INSTANTIATED);
197 FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, FIPS_R_ERROR_RETRIEVING_ENTROPY);
198 FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, FIPS_R_ERROR_RETRIEVING_NONCE);
199 FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, FIPS_R_INSTANTIATE_ERROR);
204 if (perslen > dctx->max_pers)
206 r = FIPS_R_PERSONALISATION_STRING_TOO_LONG;
210 if (dctx->status != DRBG_STATUS_UNINITIALISED)
212 if (dctx->status == DRBG_STATUS_ERROR)
213 r = FIPS_R_IN_ERROR_STATE;
215 r = FIPS_R_ALREADY_INSTANTIATED;
219 dctx->status = DRBG_STATUS_ERROR;
221 entlen = fips_get_entropy(dctx, &entropy, dctx->strength,
222 dctx->min_entropy, dctx->max_entropy);
224 if (entlen < dctx->min_entropy || entlen > dctx->max_entropy)
226 r = FIPS_R_ERROR_RETRIEVING_ENTROPY;
230 if (dctx->max_nonce > 0)
232 noncelen = dctx->get_nonce(dctx, &nonce,
234 dctx->min_nonce, dctx->max_nonce);
236 if (noncelen < dctx->min_nonce || noncelen > dctx->max_nonce)
238 r = FIPS_R_ERROR_RETRIEVING_NONCE;
244 if (!dctx->instantiate(dctx,
249 r = FIPS_R_ERROR_INSTANTIATING_DRBG;
254 dctx->status = DRBG_STATUS_READY;
255 if (!(dctx->iflags & DRBG_CUSTOM_RESEED))
256 dctx->reseed_counter = 1;
260 if (entropy && dctx->cleanup_entropy)
261 fips_cleanup_entropy(dctx, entropy, entlen);
263 if (nonce && dctx->cleanup_nonce)
264 dctx->cleanup_nonce(dctx, nonce, noncelen);
266 if (dctx->status == DRBG_STATUS_READY)
269 if (r && !(dctx->iflags & DRBG_FLAG_NOERR))
270 FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, r);
276 int FIPS_drbg_reseed(DRBG_CTX *dctx,
277 const unsigned char *adin, size_t adinlen)
279 unsigned char *entropy = NULL;
284 FIPSerr(FIPS_F_FIPS_DRBG_RESEED, FIPS_R_NOT_INSTANTIATED);
285 FIPSerr(FIPS_F_FIPS_DRBG_RESEED, FIPS_R_ADDITIONAL_INPUT_TOO_LONG);
287 if (dctx->status != DRBG_STATUS_READY
288 && dctx->status != DRBG_STATUS_RESEED)
290 if (dctx->status == DRBG_STATUS_ERROR)
291 r = FIPS_R_IN_ERROR_STATE;
292 else if(dctx->status == DRBG_STATUS_UNINITIALISED)
293 r = FIPS_R_NOT_INSTANTIATED;
299 else if (adinlen > dctx->max_adin)
301 r = FIPS_R_ADDITIONAL_INPUT_TOO_LONG;
305 dctx->status = DRBG_STATUS_ERROR;
307 entlen = fips_get_entropy(dctx, &entropy, dctx->strength,
308 dctx->min_entropy, dctx->max_entropy);
310 if (entlen < dctx->min_entropy || entlen > dctx->max_entropy)
312 r = FIPS_R_ERROR_RETRIEVING_ENTROPY;
316 if (!dctx->reseed(dctx, entropy, entlen, adin, adinlen))
319 dctx->status = DRBG_STATUS_READY;
320 if (!(dctx->iflags & DRBG_CUSTOM_RESEED))
321 dctx->reseed_counter = 1;
324 if (entropy && dctx->cleanup_entropy)
325 fips_cleanup_entropy(dctx, entropy, entlen);
327 if (dctx->status == DRBG_STATUS_READY)
330 if (r && !(dctx->iflags & DRBG_FLAG_NOERR))
331 FIPSerr(FIPS_F_FIPS_DRBG_RESEED, r);
336 static int fips_drbg_check(DRBG_CTX *dctx)
338 if (dctx->xflags & DRBG_FLAG_TEST)
340 dctx->health_check_cnt++;
341 if (dctx->health_check_cnt >= dctx->health_check_interval)
343 if (FIPS_drbg_test(dctx) <= 0)
345 FIPSerr(FIPS_F_FIPS_DRBG_CHECK, FIPS_R_SELFTEST_FAILURE);
346 dctx->status = DRBG_STATUS_ERROR;
349 dctx->health_check_cnt = 0;
354 int FIPS_drbg_generate(DRBG_CTX *dctx, unsigned char *out, size_t outlen,
355 int prediction_resistance,
356 const unsigned char *adin, size_t adinlen)
360 if (!fips_drbg_check(dctx))
363 if (dctx->status != DRBG_STATUS_READY
364 && dctx->status != DRBG_STATUS_RESEED)
366 if (dctx->status == DRBG_STATUS_ERROR)
367 r = FIPS_R_IN_ERROR_STATE;
368 else if(dctx->status == DRBG_STATUS_UNINITIALISED)
369 r = FIPS_R_NOT_INSTANTIATED;
373 if (outlen > dctx->max_request)
375 r = FIPS_R_REQUEST_TOO_LARGE_FOR_DRBG;
379 if (adinlen > dctx->max_adin)
381 r = FIPS_R_ADDITIONAL_INPUT_TOO_LONG;
385 if (dctx->iflags & DRBG_CUSTOM_RESEED)
386 dctx->generate(dctx, NULL, outlen, NULL, 0);
387 else if (dctx->reseed_counter >= dctx->reseed_interval)
388 dctx->status = DRBG_STATUS_RESEED;
390 if (dctx->status == DRBG_STATUS_RESEED || prediction_resistance)
392 if (!FIPS_drbg_reseed(dctx, adin, adinlen))
394 r = FIPS_R_RESEED_ERROR;
401 if (!dctx->generate(dctx, out, outlen, adin, adinlen))
403 r = FIPS_R_GENERATE_ERROR;
404 dctx->status = DRBG_STATUS_ERROR;
407 if (!(dctx->iflags & DRBG_CUSTOM_RESEED))
409 if (dctx->reseed_counter >= dctx->reseed_interval)
410 dctx->status = DRBG_STATUS_RESEED;
412 dctx->reseed_counter++;
418 if (!(dctx->iflags & DRBG_FLAG_NOERR))
419 FIPSerr(FIPS_F_FIPS_DRBG_GENERATE, r);
426 int FIPS_drbg_uninstantiate(DRBG_CTX *dctx)
429 if (!dctx->uninstantiate)
432 rv = dctx->uninstantiate(dctx);
433 /* Although we'd like to cleanse here we can't because we have to
434 * test the uninstantiate really zeroes the data.
436 memset(&dctx->d, 0, sizeof(dctx->d));
437 dctx->status = DRBG_STATUS_UNINITIALISED;
438 /* If method has problems uninstantiating, return error */
442 int FIPS_drbg_set_callbacks(DRBG_CTX *dctx,
443 size_t (*get_entropy)(DRBG_CTX *ctx, unsigned char **pout,
444 int entropy, size_t min_len, size_t max_len),
445 void (*cleanup_entropy)(DRBG_CTX *ctx, unsigned char *out, size_t olen),
446 size_t entropy_blocklen,
447 size_t (*get_nonce)(DRBG_CTX *ctx, unsigned char **pout,
448 int entropy, size_t min_len, size_t max_len),
449 void (*cleanup_nonce)(DRBG_CTX *ctx, unsigned char *out, size_t olen))
451 if (dctx->status != DRBG_STATUS_UNINITIALISED)
453 dctx->entropy_blocklen = entropy_blocklen;
454 dctx->get_entropy = get_entropy;
455 dctx->cleanup_entropy = cleanup_entropy;
456 dctx->get_nonce = get_nonce;
457 dctx->cleanup_nonce = cleanup_nonce;
461 int FIPS_drbg_set_rand_callbacks(DRBG_CTX *dctx,
462 size_t (*get_adin)(DRBG_CTX *ctx, unsigned char **pout),
463 void (*cleanup_adin)(DRBG_CTX *ctx, unsigned char *out, size_t olen),
464 int (*rand_seed_cb)(DRBG_CTX *ctx, const void *buf, int num),
465 int (*rand_add_cb)(DRBG_CTX *ctx,
466 const void *buf, int num, double entropy))
468 if (dctx->status != DRBG_STATUS_UNINITIALISED)
470 dctx->get_adin = get_adin;
471 dctx->cleanup_adin = cleanup_adin;
472 dctx->rand_seed_cb = rand_seed_cb;
473 dctx->rand_add_cb = rand_add_cb;
477 void *FIPS_drbg_get_app_data(DRBG_CTX *dctx)
479 return dctx->app_data;
482 void FIPS_drbg_set_app_data(DRBG_CTX *dctx, void *app_data)
484 dctx->app_data = app_data;
487 size_t FIPS_drbg_get_blocklength(DRBG_CTX *dctx)
489 return dctx->blocklength;
492 int FIPS_drbg_get_strength(DRBG_CTX *dctx)
494 return dctx->strength;
497 void FIPS_drbg_set_check_interval(DRBG_CTX *dctx, int interval)
499 dctx->health_check_interval = interval;
502 void FIPS_drbg_set_reseed_interval(DRBG_CTX *dctx, int interval)
504 dctx->reseed_interval = interval;
507 static int drbg_stick = 0;
509 void FIPS_drbg_stick(void)
514 /* Continuous DRBG utility function */
515 int fips_drbg_cprng_test(DRBG_CTX *dctx, const unsigned char *out)
517 /* No CPRNG in test mode */
518 if (dctx->xflags & DRBG_FLAG_TEST)
520 /* Check block is valid: should never happen */
521 if (dctx->lb_valid == 0)
523 FIPSerr(FIPS_F_FIPS_DRBG_CPRNG_TEST, FIPS_R_INTERNAL_ERROR);
524 fips_set_selftest_fail();
528 memcpy(dctx->lb, out, dctx->blocklength);
529 /* Check against last block: fail if match */
530 if (!memcmp(dctx->lb, out, dctx->blocklength))
532 FIPSerr(FIPS_F_FIPS_DRBG_CPRNG_TEST, FIPS_R_DRBG_STUCK);
533 fips_set_selftest_fail();
536 /* Save last block for next comparison */
537 memcpy(dctx->lb, out, dctx->blocklength);