X-Git-Url: https://git.openssl.org/?p=openssl.git;a=blobdiff_plain;f=crypto%2Frand%2Frand_lcl.h;h=e3c0b76cde5843ace5d0579684c3f6a56fea81d5;hp=5c7087c97735ee748112c70b75b213593b317125;hb=20928ff635772182fe8696d618a19f9101a5370f;hpb=ddc6a5c8f5900959bdbdfee79e1625a3f7808acd diff --git a/crypto/rand/rand_lcl.h b/crypto/rand/rand_lcl.h index 5c7087c977..e3c0b76cde 100644 --- a/crypto/rand/rand_lcl.h +++ b/crypto/rand/rand_lcl.h @@ -1,5 +1,5 @@ /* - * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the OpenSSL license (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -17,50 +17,78 @@ # include # include "internal/rand.h" -/* - * Amount of randomness (in bytes) we want for initial seeding. - * This is based on the fact that we use AES-128 as the CRBG, and - * that we use the derivation function. If either of those changes, - * (see rand_init() in rand_lib.c), change this. - */ -# define RANDOMNESS_NEEDED 16 +/* How many times to read the TSC as a randomness source. */ +# define TSC_READ_COUNT 4 + +/* Maximum reseed intervals */ +# define MAX_RESEED_INTERVAL (1 << 24) +# define MAX_RESEED_TIME_INTERVAL (1 << 20) /* approx. 12 days */ + +/* Default reseed intervals */ +# define MASTER_RESEED_INTERVAL (1 << 8) +# define SLAVE_RESEED_INTERVAL (1 << 16) +# define MASTER_RESEED_TIME_INTERVAL (60*60) /* 1 hour */ +# define SLAVE_RESEED_TIME_INTERVAL (7*60) /* 7 minutes */ -/* Maximum amount of randomness to hold in RAND_BYTES_BUFFER. */ -# define MAX_RANDOMNESS_HELD (4 * RANDOMNESS_NEEDED) -/* Maximum count allowed in reseeding */ -# define MAX_RESEED (1 << 24) -/* How often we call RAND_poll() in drbg_entropy_from_system */ -# define RAND_POLL_RETRIES 8 +/* Max size of additional input and personalization string. */ +# define DRBG_MAX_LENGTH 4096 -/* Max size of entropy, addin, etc. Larger than any reasonable value */ -# define DRBG_MAX_LENGTH 0x7ffffff0 +/* + * The quotient between max_{entropy,nonce}len and min_{entropy,nonce}len + * + * The current factor is large enough that the RAND_POOL can store a + * random input which has a lousy entropy rate of 0.0625 bits per byte. + * This input will be sent through the derivation function which 'compresses' + * the low quality input into a high quality output. + */ +# define DRBG_MINMAX_FACTOR 128 /* DRBG status values */ typedef enum drbg_status_e { DRBG_UNINITIALISED, DRBG_READY, - DRBG_RESEED, DRBG_ERROR } DRBG_STATUS; +/* intantiate */ +typedef int (*RAND_DRBG_instantiate_fn)(RAND_DRBG *ctx, + const unsigned char *ent, + size_t entlen, + const unsigned char *nonce, + size_t noncelen, + const unsigned char *pers, + size_t perslen); +/* reseed */ +typedef int (*RAND_DRBG_reseed_fn)(RAND_DRBG *ctx, + const unsigned char *ent, + size_t entlen, + const unsigned char *adin, + size_t adinlen); +/* generat output */ +typedef int (*RAND_DRBG_generate_fn)(RAND_DRBG *ctx, + unsigned char *out, + size_t outlen, + const unsigned char *adin, + size_t adinlen); +/* uninstantiate */ +typedef int (*RAND_DRBG_uninstantiate_fn)(RAND_DRBG *ctx); + + /* - * A buffer of random bytes to be fed as "entropy" into the DRBG. RAND_add() - * adds data to the buffer, and the drbg_entropy_from_system() pulls data from - * the buffer. We have a separate data structure because of the way the - * API is defined; otherwise we'd run into deadlocks (RAND_bytes -> - * RAND_DRBG_generate* -> drbg_entropy_from_system -> RAND_poll -> RAND_add -> - * drbg_add*; the functions with an asterisk lock). + * The DRBG methods */ -typedef struct rand_bytes_buffer_st { - CRYPTO_RWLOCK *lock; - size_t size; - size_t curr; - unsigned char *buff; -} RAND_BYTES_BUFFER; + +typedef struct rand_drbg_method_st { + RAND_DRBG_instantiate_fn instantiate; + RAND_DRBG_reseed_fn reseed; + RAND_DRBG_generate_fn generate; + RAND_DRBG_uninstantiate_fn uninstantiate; +} RAND_DRBG_METHOD; + /* * The state of a DRBG AES-CTR. @@ -88,31 +116,81 @@ struct rand_drbg_st { CRYPTO_RWLOCK *lock; RAND_DRBG *parent; int nid; /* the underlying algorithm */ + int fork_count; unsigned short flags; /* various external flags */ - unsigned short filled; + + /* + * The random pool is used by RAND_add()/drbg_add() to attach random + * data to the global drbg, such that the rand_drbg_get_entropy() callback + * can pull it during instantiation and reseeding. This is necessary to + * reconcile the different philosophies of the RAND and the RAND_DRBG + * with respect to how randomness is added to the RNG during reseeding + * (see PR #4328). + */ + RAND_POOL *pool; + /* - * This is a fixed-size buffer, but we malloc to make it a little - * harder to find; a classic security/performance trade-off. + * The following parameters are setup by the per-type "init" function. + * + * Currently the only type is CTR_DRBG, its init function is drbg_ctr_init(). + * + * The parameters are closely related to the ones described in + * section '10.2.1 CTR_DRBG' of [NIST SP 800-90Ar1], with one + * crucial difference: In the NIST standard, all counts are given + * in bits, whereas in OpenSSL entropy counts are given in bits + * and buffer lengths are given in bytes. + * + * Since this difference has lead to some confusion in the past, + * (see [GitHub Issue #2443], formerly [rt.openssl.org #4055]) + * the 'len' suffix has been added to all buffer sizes for + * clarification. */ - int size; - unsigned char *randomness; - /* These parameters are setup by the per-type "init" function. */ int strength; size_t max_request; - size_t min_entropy, max_entropy; - size_t min_nonce, max_nonce; - size_t max_pers, max_adin; - unsigned int reseed_counter; + size_t min_entropylen, max_entropylen; + size_t min_noncelen, max_noncelen; + size_t max_perslen, max_adinlen; + + /* Counts the number of generate requests since the last reseed. */ + unsigned int generate_counter; + /* + * Maximum number of generate requests until a reseed is required. + * This value is ignored if it is zero. + */ unsigned int reseed_interval; + /* Stores the time when the last reseeding occurred */ + time_t reseed_time; + /* + * Specifies the maximum time interval (in seconds) between reseeds. + * This value is ignored if it is zero. + */ + time_t reseed_time_interval; + /* + * Counts the number of reseeds since instantiation. + * This value is ignored if it is zero. + * + * This counter is used only for seed propagation from the DRBG + * to its two children, the and DRBG. This feature is + * very special and its sole purpose is to ensure that any randomness which + * is added by RAND_add() or RAND_seed() will have an immediate effect on + * the output of RAND_bytes() resp. RAND_priv_bytes(). + */ + unsigned int reseed_counter; + size_t seedlen; DRBG_STATUS state; /* Application data, mainly used in the KATs. */ CRYPTO_EX_DATA ex_data; - /* Implementation specific structures; was a union, but inline for now */ - RAND_DRBG_CTR ctr; + /* Implementation specific data (currently only one implementation) */ + union { + RAND_DRBG_CTR ctr; + } data; + + /* Implementation specific methods */ + RAND_DRBG_METHOD *meth; /* Callback functions. See comments in rand_lib.c */ RAND_DRBG_get_entropy_fn get_entropy; @@ -123,35 +201,27 @@ struct rand_drbg_st { /* The global RAND method, and the global buffer and DRBG instance. */ extern RAND_METHOD rand_meth; -extern RAND_BYTES_BUFFER rand_bytes; -extern RAND_DRBG rand_drbg; -extern RAND_DRBG priv_drbg; + +/* How often we've forked (only incremented in child). */ +extern int rand_fork_count; /* Hardware-based seeding functions. */ -void rand_read_tsc(RAND_poll_fn cb, void *arg); -int rand_read_cpu(RAND_poll_fn cb, void *arg); +size_t rand_acquire_entropy_from_tsc(RAND_POOL *pool); +size_t rand_acquire_entropy_from_cpu(RAND_POOL *pool); /* DRBG entropy callbacks. */ -void drbg_release_entropy(RAND_DRBG *drbg, unsigned char *out); -size_t drbg_entropy_from_parent(RAND_DRBG *drbg, - unsigned char **pout, - int entropy, size_t min_len, size_t max_len); -size_t drbg_entropy_from_system(RAND_DRBG *drbg, - unsigned char **pout, - int entropy, size_t min_len, size_t max_len); - -/* DRBG functions implementing AES-CTR */ -int ctr_init(RAND_DRBG *drbg); -int ctr_uninstantiate(RAND_DRBG *drbg); -int ctr_instantiate(RAND_DRBG *drbg, - const unsigned char *ent, size_t entlen, - const unsigned char *nonce, size_t noncelen, - const unsigned char *pers, size_t perslen); -int ctr_reseed(RAND_DRBG *drbg, - const unsigned char *ent, size_t entlen, - const unsigned char *adin, size_t adinlen); -int ctr_generate(RAND_DRBG *drbg, - unsigned char *out, size_t outlen, - const unsigned char *adin, size_t adinlen); +size_t rand_drbg_get_entropy(RAND_DRBG *drbg, + unsigned char **pout, + int entropy, size_t min_len, size_t max_len); +void rand_drbg_cleanup_entropy(RAND_DRBG *drbg, + unsigned char *out, size_t outlen); +size_t rand_drbg_get_additional_data(unsigned char **pout, size_t max_len); + +/* DRBG helpers */ +int rand_drbg_restart(RAND_DRBG *drbg, + const unsigned char *buffer, size_t len, size_t entropy); + +/* initializes the AES-CTR DRBG implementation */ +int drbg_ctr_init(RAND_DRBG *drbg); #endif