fips/rand/fips_drbg_selftest.c

   1 /* fips/rand/fips_drbg_selftest.c */
   2 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
   3  * project.
   4  */
   5 /* ====================================================================
   6  * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in
  17  *    the documentation and/or other materials provided with the
  18  *    distribution.
  19  *
  20  * 3. All advertising materials mentioning features or use of this
  21  *    software must display the following acknowledgment:
  22  *    "This product includes software developed by the OpenSSL Project
  23  *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  24  *
  25  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  26  *    endorse or promote products derived from this software without
  27  *    prior written permission. For written permission, please contact
  28  *    licensing@OpenSSL.org.
  29  *
  30  * 5. Products derived from this software may not be called "OpenSSL"
  31  *    nor may "OpenSSL" appear in their names without prior written
  32  *    permission of the OpenSSL Project.
  33  *
  34  * 6. Redistributions of any form whatsoever must retain the following
  35  *    acknowledgment:
  36  *    "This product includes software developed by the OpenSSL Project
  37  *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  38  *
  39  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  40  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  41  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  42  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  43  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  44  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  45  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  46  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  47  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  48  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  49  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  50  * OF THE POSSIBILITY OF SUCH DAMAGE.
  51  * ====================================================================
  52  */
  53
  54 #define OPENSSL_FIPSAPI
  55
  56 #include <string.h>
  57 #include <openssl/crypto.h>
  58 #include <openssl/err.h>
  59 #include <openssl/fips_rand.h>
  60 #include "fips_rand_lcl.h"
  61 #include "fips_locl.h"
  62
  63 #include "fips_drbg_selftest.h"
  64
  65 typedef struct {
  66         int post;
  67         int nid;
  68         unsigned int flags;
  69
  70         /* KAT data for no PR */
  71         const unsigned char *ent;
  72         size_t entlen;
  73         const unsigned char *nonce;
  74         size_t noncelen;
  75         const unsigned char *pers;
  76         size_t perslen;
  77         const unsigned char *adin;
  78         size_t adinlen;
  79         const unsigned char *entreseed;
  80         size_t entreseedlen;
  81         const unsigned char *adinreseed;
  82         size_t adinreseedlen;
  83         const unsigned char *adin2;
  84         size_t adin2len;
  85         const unsigned char *kat;
  86         size_t katlen;
  87         const unsigned char *kat2;
  88         size_t kat2len;
  89
  90         /* KAT data for PR */
  91         const unsigned char *ent_pr;
  92         size_t entlen_pr;
  93         const unsigned char *nonce_pr;
  94         size_t noncelen_pr;
  95         const unsigned char *pers_pr;
  96         size_t perslen_pr;
  97         const unsigned char *adin_pr;
  98         size_t adinlen_pr;
  99         const unsigned char *entpr_pr;
 100         size_t entprlen_pr;
 101         const unsigned char *ading_pr;
 102         size_t adinglen_pr;
 103         const unsigned char *entg_pr;
 104         size_t entglen_pr;
 105         const unsigned char *kat_pr;
 106         size_t katlen_pr;
 107         const unsigned char *kat2_pr;
 108         size_t kat2len_pr;
 109
 110         } DRBG_SELFTEST_DATA;
 111
 112 #define make_drbg_test_data(nid, flag, pr, p) {p, nid, flag | DRBG_FLAG_TEST, \
 113         pr##_entropyinput, sizeof(pr##_entropyinput), \
 114         pr##_nonce, sizeof(pr##_nonce), \
 115         pr##_personalizationstring, sizeof(pr##_personalizationstring), \
 116         pr##_additionalinput, sizeof(pr##_additionalinput), \
 117         pr##_entropyinputreseed, sizeof(pr##_entropyinputreseed), \
 118         pr##_additionalinputreseed, sizeof(pr##_additionalinputreseed), \
 119         pr##_additionalinput2, sizeof(pr##_additionalinput2), \
 120         pr##_int_returnedbits, sizeof(pr##_int_returnedbits), \
 121         pr##_returnedbits, sizeof(pr##_returnedbits), \
 122         pr##_pr_entropyinput, sizeof(pr##_pr_entropyinput), \
 123         pr##_pr_nonce, sizeof(pr##_pr_nonce), \
 124         pr##_pr_personalizationstring, sizeof(pr##_pr_personalizationstring), \
 125         pr##_pr_additionalinput, sizeof(pr##_pr_additionalinput), \
 126         pr##_pr_entropyinputpr, sizeof(pr##_pr_entropyinputpr), \
 127         pr##_pr_additionalinput2, sizeof(pr##_pr_additionalinput2), \
 128         pr##_pr_entropyinputpr2, sizeof(pr##_pr_entropyinputpr2), \
 129         pr##_pr_int_returnedbits, sizeof(pr##_pr_int_returnedbits), \
 130         pr##_pr_returnedbits, sizeof(pr##_pr_returnedbits), \
 131         }
 132
 133 #define make_drbg_test_data_df(nid, pr, p) \
 134         make_drbg_test_data(nid, DRBG_FLAG_CTR_USE_DF, pr, p)
 135
 136 static DRBG_SELFTEST_DATA drbg_test[] = {
 137         make_drbg_test_data_df(NID_aes_128_ctr, aes_128_use_df, 0),
 138         make_drbg_test_data_df(NID_aes_192_ctr, aes_192_use_df, 0),
 139         make_drbg_test_data_df(NID_aes_256_ctr, aes_256_use_df, 1),
 140         make_drbg_test_data(NID_aes_128_ctr, 0, aes_128_no_df, 0),
 141         make_drbg_test_data(NID_aes_192_ctr, 0, aes_192_no_df, 0),
 142         make_drbg_test_data(NID_aes_256_ctr, 0, aes_256_no_df, 1),
 143         make_drbg_test_data(NID_sha1, 0, sha1, 0),
 144         make_drbg_test_data(NID_sha224, 0, sha224, 0),
 145         make_drbg_test_data(NID_sha256, 0, sha256, 1),
 146         make_drbg_test_data(NID_sha384, 0, sha384, 0),
 147         make_drbg_test_data(NID_sha512, 0, sha512, 0),
 148         make_drbg_test_data(NID_hmacWithSHA1, 0, hmac_sha1, 0),
 149         make_drbg_test_data(NID_hmacWithSHA224, 0, hmac_sha224, 0),
 150         make_drbg_test_data(NID_hmacWithSHA256, 0, hmac_sha256, 1),
 151         make_drbg_test_data(NID_hmacWithSHA384, 0, hmac_sha384, 0),
 152         make_drbg_test_data(NID_hmacWithSHA512, 0, hmac_sha512, 0),
 153         {0,0,0}
 154         };
 155
 156 typedef struct
 157         {
 158         const unsigned char *ent;
 159         size_t entlen;
 160         int entcnt;
 161         const unsigned char *nonce;
 162         size_t noncelen;
 163         int noncecnt;
 164         } TEST_ENT;
 165
 166 static size_t test_entropy(DRBG_CTX *dctx, unsigned char **pout,
 167                                 int entropy, size_t min_len, size_t max_len)
 168         {
 169         TEST_ENT *t = FIPS_drbg_get_app_data(dctx);
 170         *pout = (unsigned char *)t->ent;
 171         t->entcnt++;
 172         return t->entlen;
 173         }
 174
 175 static size_t test_nonce(DRBG_CTX *dctx, unsigned char **pout,
 176                                 int entropy, size_t min_len, size_t max_len)
 177         {
 178         TEST_ENT *t = FIPS_drbg_get_app_data(dctx);
 179         *pout = (unsigned char *)t->nonce;
 180         t->noncecnt++;
 181         return t->noncelen;
 182         }
 183
 184 static int fips_drbg_single_kat(DRBG_CTX *dctx, DRBG_SELFTEST_DATA *td,
 185                                                                 int quick)
 186         {
 187         TEST_ENT t;
 188         int rv = 0;
 189         size_t adinlen;
 190         unsigned char randout[1024];
 191
 192         /* Initial test without PR */
 193
 194         if (!FIPS_drbg_init(dctx, td->nid, td->flags))
 195                 return 0;
 196         if (!FIPS_drbg_set_callbacks(dctx, test_entropy, 0, 0, test_nonce, 0))
 197                 return 0;
 198
 199         FIPS_drbg_set_app_data(dctx, &t);
 200
 201         t.ent = td->ent;
 202         t.entlen = td->entlen;
 203         t.nonce = td->nonce;
 204         t.noncelen = td->noncelen;
 205         t.entcnt = 0;
 206         t.noncecnt = 0;
 207
 208         if (!FIPS_drbg_instantiate(dctx, td->pers, td->perslen))
 209                 goto err;
 210
 211         /* Note for CTR without DF some additional input values
 212          * ignore bytes after the keylength: so reduce adinlen
 213          * to half to ensure invalid data is fed in.
 214          */
 215         if (!fips_post_corrupt(FIPS_TEST_DRBG, dctx->type, &dctx->flags))
 216                 adinlen = td->adinlen / 2;
 217         else
 218                 adinlen = td->adinlen;
 219         if (!FIPS_drbg_generate(dctx, randout, td->katlen, 0, 0,
 220                                 td->adin, adinlen))
 221                 goto err;
 222
 223         if (memcmp(randout, td->kat, td->katlen))
 224                 {
 225                 FIPSerr(FIPS_F_FIPS_DRBG_SINGLE_KAT, FIPS_R_NOPR_TEST1_FAILURE);
 226                 goto err2;
 227                 }
 228
 229         t.ent = td->entreseed;
 230         t.entlen = td->entreseedlen;
 231
 232         if (!FIPS_drbg_reseed(dctx, td->adinreseed, td->adinreseedlen))
 233                 goto err;
 234
 235         if (!FIPS_drbg_generate(dctx, randout, td->kat2len, 0, 0,
 236                                 td->adin2, td->adin2len))
 237                 goto err;
 238
 239         if (memcmp(randout, td->kat2, td->kat2len))
 240                 {
 241                 FIPSerr(FIPS_F_FIPS_DRBG_SINGLE_KAT, FIPS_R_NOPR_TEST2_FAILURE);
 242                 goto err2;
 243                 }
 244
 245         FIPS_drbg_uninstantiate(dctx);
 246
 247         /* Now test with PR */
 248         if (!FIPS_drbg_init(dctx, td->nid, td->flags))
 249                 return 0;
 250         if (!FIPS_drbg_set_callbacks(dctx, test_entropy, 0, 0, test_nonce, 0))
 251                 return 0;
 252
 253         FIPS_drbg_set_app_data(dctx, &t);
 254
 255         t.ent = td->ent_pr;
 256         t.entlen = td->entlen_pr;
 257         t.nonce = td->nonce_pr;
 258         t.noncelen = td->noncelen_pr;
 259         t.entcnt = 0;
 260         t.noncecnt = 0;
 261
 262         if (!FIPS_drbg_instantiate(dctx, td->pers_pr, td->perslen_pr))
 263                 goto err;
 264
 265         t.ent = td->entpr_pr;
 266         t.entlen = td->entprlen_pr;
 267
 268         /* Note for CTR without DF some additional input values
 269          * ignore bytes after the keylength: so reduce adinlen
 270          * to half to ensure invalid data is fed in.
 271          */
 272         if (!fips_post_corrupt(FIPS_TEST_DRBG, dctx->type, &dctx->flags))
 273                 adinlen = td->adinlen_pr / 2;
 274         else
 275                 adinlen = td->adinlen_pr;
 276         if (!FIPS_drbg_generate(dctx, randout, td->katlen_pr, 0, 1,
 277                                 td->adin_pr, adinlen))
 278                 goto err;
 279
 280         if (memcmp(randout, td->kat_pr, td->katlen_pr))
 281                 {
 282                 FIPSerr(FIPS_F_FIPS_DRBG_SINGLE_KAT, FIPS_R_PR_TEST1_FAILURE);
 283                 goto err2;
 284                 }
 285
 286         if (quick)
 287                 {
 288                 rv = 1;
 289                 goto err;
 290                 }
 291
 292         t.ent = td->entg_pr;
 293         t.entlen = td->entglen_pr;
 294
 295         if (!FIPS_drbg_generate(dctx, randout, td->kat2len_pr, 0, 1,
 296                                 td->ading_pr, td->adinglen_pr))
 297                 goto err;
 298
 299         if (memcmp(randout, td->kat2_pr, td->kat2len_pr))
 300                 {
 301                 FIPSerr(FIPS_F_FIPS_DRBG_SINGLE_KAT, FIPS_R_PR_TEST2_FAILURE);
 302                 goto err2;
 303                 }
 304
 305         rv = 1;
 306
 307         err:
 308         if (rv == 0)
 309                 FIPSerr(FIPS_F_FIPS_DRBG_SINGLE_KAT, FIPS_R_SELFTEST_FAILED);
 310         err2:
 311         FIPS_drbg_uninstantiate(dctx);
 312
 313         return rv;
 314
 315         }
 316
 317 /* This is the "health check" function required by SP800-90. Induce several
 318  * failure modes and check an error condition is set.
 319  */
 320
 321 static int fips_drbg_health_check(DRBG_CTX *dctx, DRBG_SELFTEST_DATA *td)
 322         {
 323         unsigned char randout[1024];
 324         TEST_ENT t;
 325         size_t i;
 326         unsigned int reseed_counter_tmp;
 327         unsigned char *p = (unsigned char *)dctx;
 328
 329         /* Initialise DRBG */
 330
 331         if (!FIPS_drbg_init(dctx, td->nid, td->flags))
 332                 goto err;
 333
 334         if (!FIPS_drbg_set_callbacks(dctx, test_entropy, 0, 0, test_nonce, 0))
 335                 goto err;
 336
 337         FIPS_drbg_set_app_data(dctx, &t);
 338
 339         t.ent = td->ent;
 340         t.entlen = td->entlen;
 341         t.nonce = td->nonce;
 342         t.noncelen = td->noncelen;
 343         t.entcnt = 0;
 344         t.noncecnt = 0;
 345
 346         /* Don't report induced errors */
 347         dctx->flags |= DRBG_FLAG_NOERR;
 348
 349         /* Try too large a personalisation length */
 350         if (FIPS_drbg_instantiate(dctx, td->pers, dctx->max_pers + 1) > 0)
 351                 {
 352                 FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_PERSONALISATION_ERROR_UNDETECTED);
 353                 goto err;
 354                 }
 355
 356         /* Test entropy source failure detection */
 357
 358         t.entlen = 0;
 359         if (FIPS_drbg_instantiate(dctx, td->pers, td->perslen) > 0)
 360                 {
 361                 FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_ENTROPY_ERROR_UNDETECTED);
 362                 goto err;
 363                 }
 364
 365         /* Try to generate output from uninstantiated DRBG */
 366         if (FIPS_drbg_generate(dctx, randout, td->katlen, 0, 0,
 367                                 td->adin, td->adinlen))
 368                 {
 369                 FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_GENERATE_ERROR_UNDETECTED);
 370                 goto err;
 371                 }
 372
 373         dctx->flags &= ~DRBG_FLAG_NOERR;
 374         if (!FIPS_drbg_uninstantiate(dctx))
 375                 {
 376                 FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
 377                 goto err;
 378                 }
 379
 380         /* Instantiate with valid data. NB: errors now reported again */
 381         if (!FIPS_drbg_init(dctx, td->nid, td->flags))
 382                 goto err;
 383         if (!FIPS_drbg_set_callbacks(dctx, test_entropy, 0, 0, test_nonce, 0))
 384                 goto err;
 385         FIPS_drbg_set_app_data(dctx, &t);
 386
 387         t.entlen = td->entlen;
 388         if (!FIPS_drbg_instantiate(dctx, td->pers, td->perslen))
 389                 goto err;
 390
 391         /* Check generation is now OK */
 392         if (!FIPS_drbg_generate(dctx, randout, td->katlen, 0, 0,
 393                                 td->adin, td->adinlen))
 394                 goto err;
 395
 396         /* Try to generate with too high a strength.
 397          */
 398
 399         dctx->flags |= DRBG_FLAG_NOERR;
 400         if (dctx->strength != 256)
 401                 {
 402                 if (FIPS_drbg_generate(dctx, randout, td->katlen, 256, 0,
 403                                         td->adin, td->adinlen))
 404                         {
 405                         FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_STRENGTH_ERROR_UNDETECTED);
 406
 407                         goto err;
 408                         }
 409                 }
 410
 411         /* Request too much data for one request */
 412         if (FIPS_drbg_generate(dctx, randout, dctx->max_request + 1, 0, 0,
 413                                 td->adin, td->adinlen))
 414                 {
 415                 FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_REQUEST_LENGTH_ERROR_UNDETECTED);
 416                 goto err;
 417                 }
 418
 419         /* Check prediction resistance request fails if entropy source
 420          * failure.
 421          */
 422
 423         t.entlen = 0;
 424
 425         if (FIPS_drbg_generate(dctx, randout, td->katlen, 0, 1,
 426                                 td->adin, td->adinlen))
 427                 {
 428                 FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_ENTROPY_ERROR_UNDETECTED);
 429                 goto err;
 430                 }
 431
 432         dctx->flags &= ~DRBG_FLAG_NOERR;
 433
 434         if (!FIPS_drbg_uninstantiate(dctx))
 435                 {
 436                 FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
 437                 goto err;
 438                 }
 439
 440
 441         /* Instantiate again with valid data */
 442
 443         if (!FIPS_drbg_init(dctx, td->nid, td->flags))
 444                 goto err;
 445         if (!FIPS_drbg_set_callbacks(dctx, test_entropy, 0, 0, test_nonce, 0))
 446                 goto err;
 447         FIPS_drbg_set_app_data(dctx, &t);
 448
 449         t.entlen = td->entlen;
 450         /* Test reseed counter works */
 451         if (!FIPS_drbg_instantiate(dctx, td->pers, td->perslen))
 452                 goto err;
 453         /* Save initial reseed counter */
 454         reseed_counter_tmp = dctx->reseed_counter;
 455         /* Set reseed counter to beyond interval */
 456         dctx->reseed_counter = dctx->reseed_interval;
 457
 458         /* Generate output and check entropy has been requested for reseed */
 459         t.entcnt = 0;
 460         if (!FIPS_drbg_generate(dctx, randout, td->katlen, 0, 0,
 461                                 td->adin, td->adinlen))
 462                 goto err;
 463         if (t.entcnt != 1)
 464                 {
 465                 FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_ENTROPY_NOT_REQUESTED_FOR_RESEED);
 466                 goto err;
 467                 }
 468         /* Check reseed counter has been reset */
 469         if (dctx->reseed_counter != reseed_counter_tmp + 1)
 470                 {
 471                 FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_RESEED_COUNTER_ERROR);
 472                 goto err;
 473                 }
 474
 475         FIPS_drbg_uninstantiate(dctx);
 476         p = (unsigned char *)&dctx->d;
 477         /* Standard says we have to check uninstantiate really zeroes
 478          * the data...
 479          */
 480         for (i = 0; i < sizeof(dctx->d); i++)
 481                 {
 482                 if (*p != 0)
 483                         {
 484                         FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_UNINSTANTIATE_ZEROISE_ERROR);
 485                         goto err;
 486                         }
 487                 p++;
 488                 }
 489
 490         return 1;
 491
 492         err:
 493         /* A real error as opposed to an induced one: underlying function will
 494          * indicate the error.
 495          */
 496         if (!(dctx->flags & DRBG_FLAG_NOERR))
 497                 FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_FUNCTION_ERROR);
 498         FIPS_drbg_uninstantiate(dctx);
 499         return 0;
 500
 501         }
 502
 503
 504 int fips_drbg_kat(DRBG_CTX *dctx, int nid, unsigned int flags)
 505         {
 506         int rv;
 507         DRBG_SELFTEST_DATA *td;
 508         for (td = drbg_test; td->nid != 0; td++)
 509                 {
 510                 if (td->nid == nid && td->flags == flags)
 511                         {
 512                         rv = fips_drbg_single_kat(dctx, td, 0);
 513                         if (rv <= 0)
 514                                 return rv;
 515                         return fips_drbg_health_check(dctx, td);
 516                         }
 517                 }
 518         return 0;
 519         }
 520
 521 int FIPS_selftest_drbg(void)
 522         {
 523         DRBG_CTX *dctx;
 524         DRBG_SELFTEST_DATA *td;
 525         int rv = 1;
 526         dctx = FIPS_drbg_new(0, 0);
 527         if (!dctx)
 528                 return 0;
 529         for (td = drbg_test; td->nid != 0; td++)
 530                 {
 531                 if (td->post != 1)
 532                         continue;
 533                 if (!fips_post_started(FIPS_TEST_DRBG, td->nid, &td->flags))
 534                         return 1;
 535                 if (!fips_drbg_single_kat(dctx, td, 1))
 536                         {
 537                         fips_post_failed(FIPS_TEST_DRBG, td->nid, &td->flags);
 538                         rv = 0;
 539                         continue;
 540                         }
 541                 if (!fips_post_success(FIPS_TEST_DRBG, td->nid, &td->flags))
 542                         return 0;
 543                 }
 544         FIPS_drbg_free(dctx);
 545         return rv;
 546         }
 547
 548
 549
 550