Before initalising a live DRBG (i.e. not in test mode) run a complete health
authorDr. Stephen Henson <steve@openssl.org>
Sat, 9 Apr 2011 17:27:07 +0000 (17:27 +0000)
committerDr. Stephen Henson <steve@openssl.org>
Sat, 9 Apr 2011 17:27:07 +0000 (17:27 +0000)
check on a DRBG of the same type.

fips/rand/fips_drbg_lib.c

index 7a0a107..9248876 100644 (file)
@@ -84,6 +84,18 @@ int FIPS_drbg_init(DRBG_CTX *dctx, int type, unsigned int flags)
                        FIPSerr(FIPS_F_FIPS_DRBG_INIT, FIPS_R_ERROR_INITIALISING_DRBG);
                }
 
+       /* If not in test mode run selftests on DRBG of the same type */
+
+       if (!(dctx->flags & DRBG_FLAG_TEST))
+               {
+               DRBG_CTX tctx;
+               if (!fips_drbg_kat(&tctx, type, flags | DRBG_FLAG_TEST))
+                       {
+                       /*FIPSerr(FIPS_F_FIPS_DRBG_INIT, FIPS_R_SELFTEST_FAILURE);*/
+                       return 0;
+                       }
+               }
+
        return rv;
        }