2 * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
3 * Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved.
5 * Licensed under the Apache License 2.0 (the "License"). You may not use
6 * this file except in compliance with the License. You can obtain a copy
7 * in the file LICENSE in the source distribution or at
8 * https://www.openssl.org/source/license.html
12 * Implementation of the FIPS 140-2 section 4.9.2 Conditional Tests.
16 #include <openssl/evp.h>
17 #include <openssl/core_dispatch.h>
18 #include <openssl/params.h>
19 #include <openssl/self_test.h>
20 #include "prov/providercommon.h"
21 #include "prov/provider_ctx.h"
22 #include "internal/cryptlib.h"
23 #include "crypto/rand_pool.h"
24 #include "drbg_local.h"
25 #include "prov/seeding.h"
27 typedef struct crng_test_global_st {
28 unsigned char crngt_prev[EVP_MAX_MD_SIZE];
34 static int crngt_get_entropy(PROV_CTX *provctx, const EVP_MD *digest,
35 unsigned char *buf, unsigned char *md,
36 unsigned int *md_size)
42 n = ossl_prov_get_entropy(provctx, &p, 0, CRNGT_BUFSIZ, CRNGT_BUFSIZ);
43 if (n == CRNGT_BUFSIZ) {
44 r = EVP_Digest(p, CRNGT_BUFSIZ, md, md_size, digest, NULL);
46 memcpy(buf, p, CRNGT_BUFSIZ);
47 ossl_prov_cleanup_entropy(provctx, p, n);
51 ossl_prov_cleanup_entropy(provctx, p, n);
55 static void rand_crng_ossl_ctx_free(void *vcrngt_glob)
57 CRNG_TEST_GLOBAL *crngt_glob = vcrngt_glob;
59 CRYPTO_THREAD_lock_free(crngt_glob->lock);
60 EVP_MD_free(crngt_glob->md);
61 OPENSSL_free(crngt_glob);
64 static void *rand_crng_ossl_ctx_new(OSSL_LIB_CTX *ctx)
66 CRNG_TEST_GLOBAL *crngt_glob = OPENSSL_zalloc(sizeof(*crngt_glob));
68 if (crngt_glob == NULL)
71 if ((crngt_glob->md = EVP_MD_fetch(ctx, "SHA256", "")) == NULL) {
72 OPENSSL_free(crngt_glob);
76 if ((crngt_glob->lock = CRYPTO_THREAD_lock_new()) == NULL) {
77 EVP_MD_free(crngt_glob->md);
78 OPENSSL_free(crngt_glob);
85 static const OSSL_LIB_CTX_METHOD rand_crng_ossl_ctx_method = {
86 OSSL_LIB_CTX_METHOD_DEFAULT_PRIORITY,
87 rand_crng_ossl_ctx_new,
88 rand_crng_ossl_ctx_free,
91 static int prov_crngt_compare_previous(const unsigned char *prev,
92 const unsigned char *cur,
95 const int res = memcmp(prev, cur, sz) != 0;
98 ossl_set_error_state(OSSL_SELF_TEST_TYPE_CRNG);
102 size_t ossl_crngt_get_entropy(PROV_DRBG *drbg,
103 unsigned char **pout,
104 int entropy, size_t min_len, size_t max_len,
105 int prediction_resistance)
107 unsigned char md[EVP_MAX_MD_SIZE];
108 unsigned char buf[CRNGT_BUFSIZ];
109 unsigned char *ent, *entp, *entbuf;
113 int crng_test_pass = 1;
114 OSSL_LIB_CTX *libctx = ossl_prov_ctx_get0_libctx(drbg->provctx);
115 CRNG_TEST_GLOBAL *crngt_glob
116 = ossl_lib_ctx_get_data(libctx, OSSL_LIB_CTX_RAND_CRNGT_INDEX,
117 &rand_crng_ossl_ctx_method);
118 OSSL_CALLBACK *stcb = NULL;
119 void *stcbarg = NULL;
120 OSSL_SELF_TEST *st = NULL;
122 if (crngt_glob == NULL)
125 if (!CRYPTO_THREAD_write_lock(crngt_glob->lock))
128 if (!crngt_glob->preloaded) {
129 if (!crngt_get_entropy(drbg->provctx, crngt_glob->md, buf,
130 crngt_glob->crngt_prev, NULL)) {
131 OPENSSL_cleanse(buf, sizeof(buf));
134 crngt_glob->preloaded = 1;
138 * Calculate how many bytes of seed material we require, rounded up
139 * to the nearest byte. If the entropy is of less than full quality,
140 * the amount required should be scaled up appropriately here.
142 bytes_needed = (entropy + 7) / 8;
143 if (bytes_needed < min_len)
144 bytes_needed = min_len;
145 if (bytes_needed > max_len)
147 entp = ent = OPENSSL_secure_malloc(bytes_needed);
151 OSSL_SELF_TEST_get_callback(libctx, &stcb, &stcbarg);
153 st = OSSL_SELF_TEST_new(stcb, stcbarg);
156 OSSL_SELF_TEST_onbegin(st, OSSL_SELF_TEST_TYPE_CRNG,
157 OSSL_SELF_TEST_DESC_RNG);
160 for (t = bytes_needed; t > 0;) {
161 /* Care needs to be taken to avoid overrunning the buffer */
162 s = t >= CRNGT_BUFSIZ ? CRNGT_BUFSIZ : t;
163 entbuf = t >= CRNGT_BUFSIZ ? entp : buf;
164 if (!crngt_get_entropy(drbg->provctx, crngt_glob->md, entbuf, md, &sz))
166 if (t < CRNGT_BUFSIZ)
167 memcpy(entp, buf, t);
168 /* Force a failure here if the callback returns 1 */
169 if (OSSL_SELF_TEST_oncorrupt_byte(st, md))
170 memcpy(md, crngt_glob->crngt_prev, sz);
171 if (!prov_crngt_compare_previous(crngt_glob->crngt_prev, md, sz)) {
175 /* Update for next block */
176 memcpy(crngt_glob->crngt_prev, md, sz);
185 OSSL_SELF_TEST_onend(st, crng_test_pass);
186 OSSL_SELF_TEST_free(st);
187 OPENSSL_secure_clear_free(ent, bytes_needed);
190 CRYPTO_THREAD_unlock(crngt_glob->lock);
194 void ossl_crngt_cleanup_entropy(ossl_unused PROV_DRBG *drbg,
195 unsigned char *out, size_t outlen)
197 OPENSSL_secure_clear_free(out, outlen);