Put quick DRBG selftest return after first generate operation.
[openssl.git] / fips / rand / fips_drbg_selftest.c
1 /* fips/rand/fips_drbg_selftest.c */
2 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3  * project.
4  */
5 /* ====================================================================
6  * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer. 
14  *
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in
17  *    the documentation and/or other materials provided with the
18  *    distribution.
19  *
20  * 3. All advertising materials mentioning features or use of this
21  *    software must display the following acknowledgment:
22  *    "This product includes software developed by the OpenSSL Project
23  *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24  *
25  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26  *    endorse or promote products derived from this software without
27  *    prior written permission. For written permission, please contact
28  *    licensing@OpenSSL.org.
29  *
30  * 5. Products derived from this software may not be called "OpenSSL"
31  *    nor may "OpenSSL" appear in their names without prior written
32  *    permission of the OpenSSL Project.
33  *
34  * 6. Redistributions of any form whatsoever must retain the following
35  *    acknowledgment:
36  *    "This product includes software developed by the OpenSSL Project
37  *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38  *
39  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
43  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50  * OF THE POSSIBILITY OF SUCH DAMAGE.
51  * ====================================================================
52  */
53
54 #define OPENSSL_FIPSAPI
55
56 #include <string.h>
57 #include <openssl/crypto.h>
58 #include <openssl/err.h>
59 #include <openssl/fips_rand.h>
60 #include "fips_rand_lcl.h"
61 #include "fips_locl.h"
62
63 #include "fips_drbg_selftest.h"
64
65 typedef struct {
66         int post;
67         int nid;
68         unsigned int flags;
69
70         /* KAT data for no PR */
71         const unsigned char *ent;
72         size_t entlen;
73         const unsigned char *nonce;
74         size_t noncelen;
75         const unsigned char *pers;
76         size_t perslen;
77         const unsigned char *adin;
78         size_t adinlen;
79         const unsigned char *entreseed;
80         size_t entreseedlen;
81         const unsigned char *adinreseed;
82         size_t adinreseedlen;
83         const unsigned char *adin2;
84         size_t adin2len;
85         const unsigned char *kat;
86         size_t katlen;
87         const unsigned char *kat2;
88         size_t kat2len;
89
90         /* KAT data for PR */
91         const unsigned char *ent_pr;
92         size_t entlen_pr;
93         const unsigned char *nonce_pr;
94         size_t noncelen_pr;
95         const unsigned char *pers_pr;
96         size_t perslen_pr;
97         const unsigned char *adin_pr;
98         size_t adinlen_pr;
99         const unsigned char *entpr_pr;
100         size_t entprlen_pr;
101         const unsigned char *ading_pr;
102         size_t adinglen_pr;
103         const unsigned char *entg_pr;
104         size_t entglen_pr;
105         const unsigned char *kat_pr;
106         size_t katlen_pr;
107         const unsigned char *kat2_pr;
108         size_t kat2len_pr;
109
110         } DRBG_SELFTEST_DATA;
111
112 #define make_drbg_test_data(nid, flag, pr, p) {p, nid, flag | DRBG_FLAG_TEST, \
113         pr##_entropyinput, sizeof(pr##_entropyinput), \
114         pr##_nonce, sizeof(pr##_nonce), \
115         pr##_personalizationstring, sizeof(pr##_personalizationstring), \
116         pr##_additionalinput, sizeof(pr##_additionalinput), \
117         pr##_entropyinputreseed, sizeof(pr##_entropyinputreseed), \
118         pr##_additionalinputreseed, sizeof(pr##_additionalinputreseed), \
119         pr##_additionalinput2, sizeof(pr##_additionalinput2), \
120         pr##_int_returnedbits, sizeof(pr##_int_returnedbits), \
121         pr##_returnedbits, sizeof(pr##_returnedbits), \
122         pr##_pr_entropyinput, sizeof(pr##_pr_entropyinput), \
123         pr##_pr_nonce, sizeof(pr##_pr_nonce), \
124         pr##_pr_personalizationstring, sizeof(pr##_pr_personalizationstring), \
125         pr##_pr_additionalinput, sizeof(pr##_pr_additionalinput), \
126         pr##_pr_entropyinputpr, sizeof(pr##_pr_entropyinputpr), \
127         pr##_pr_additionalinput2, sizeof(pr##_pr_additionalinput2), \
128         pr##_pr_entropyinputpr2, sizeof(pr##_pr_entropyinputpr2), \
129         pr##_pr_int_returnedbits, sizeof(pr##_pr_int_returnedbits), \
130         pr##_pr_returnedbits, sizeof(pr##_pr_returnedbits), \
131         }
132
133 #define make_drbg_test_data_df(nid, pr, p) \
134         make_drbg_test_data(nid, DRBG_FLAG_CTR_USE_DF, pr, p)
135
136 static DRBG_SELFTEST_DATA drbg_test[] = {
137         make_drbg_test_data_df(NID_aes_128_ctr, aes_128_use_df, 0),
138         make_drbg_test_data_df(NID_aes_192_ctr, aes_192_use_df, 0),
139         make_drbg_test_data_df(NID_aes_256_ctr, aes_256_use_df, 1),
140         make_drbg_test_data(NID_aes_128_ctr, 0, aes_128_no_df, 0),
141         make_drbg_test_data(NID_aes_192_ctr, 0, aes_192_no_df, 0),
142         make_drbg_test_data(NID_aes_256_ctr, 0, aes_256_no_df, 1),
143         make_drbg_test_data(NID_sha1, 0, sha1, 0),
144         make_drbg_test_data(NID_sha224, 0, sha224, 0),
145         make_drbg_test_data(NID_sha256, 0, sha256, 1),
146         make_drbg_test_data(NID_sha384, 0, sha384, 0),
147         make_drbg_test_data(NID_sha512, 0, sha512, 0),
148         make_drbg_test_data(NID_hmacWithSHA1, 0, hmac_sha1, 0),
149         make_drbg_test_data(NID_hmacWithSHA224, 0, hmac_sha224, 0),
150         make_drbg_test_data(NID_hmacWithSHA256, 0, hmac_sha256, 1),
151         make_drbg_test_data(NID_hmacWithSHA384, 0, hmac_sha384, 0),
152         make_drbg_test_data(NID_hmacWithSHA512, 0, hmac_sha512, 0),
153         {0,0,0}
154         };
155
156 typedef struct 
157         {
158         const unsigned char *ent;
159         size_t entlen;
160         int entcnt;
161         const unsigned char *nonce;
162         size_t noncelen;
163         int noncecnt;
164         } TEST_ENT;
165
166 static size_t test_entropy(DRBG_CTX *dctx, unsigned char **pout,
167                                 int entropy, size_t min_len, size_t max_len)
168         {
169         TEST_ENT *t = FIPS_drbg_get_app_data(dctx);
170         *pout = (unsigned char *)t->ent;
171         t->entcnt++;
172         return t->entlen;
173         }
174
175 static size_t test_nonce(DRBG_CTX *dctx, unsigned char **pout,
176                                 int entropy, size_t min_len, size_t max_len)
177         {
178         TEST_ENT *t = FIPS_drbg_get_app_data(dctx);
179         *pout = (unsigned char *)t->nonce;
180         t->noncecnt++;
181         return t->noncelen;
182         }
183
184 static int fips_drbg_single_kat(DRBG_CTX *dctx, DRBG_SELFTEST_DATA *td,
185                                                                 int quick)
186         {
187         TEST_ENT t;
188         int rv = 0;
189         size_t adinlen;
190         unsigned char randout[1024];
191
192         /* Initial test without PR */
193
194         if (!FIPS_drbg_init(dctx, td->nid, td->flags))
195                 return 0;
196         if (!FIPS_drbg_set_callbacks(dctx, test_entropy, 0, 0, test_nonce, 0))
197                 return 0;
198
199         FIPS_drbg_set_app_data(dctx, &t);
200
201         t.ent = td->ent;
202         t.entlen = td->entlen;
203         t.nonce = td->nonce;
204         t.noncelen = td->noncelen;
205         t.entcnt = 0;
206         t.noncecnt = 0;
207
208         if (!FIPS_drbg_instantiate(dctx, td->pers, td->perslen))
209                 goto err;
210
211         /* Note for CTR without DF some additional input values
212          * ignore bytes after the keylength: so reduce adinlen
213          * to half to ensure invalid data is fed in.
214          */
215         if (!fips_post_corrupt(FIPS_TEST_DRBG, dctx->type, &dctx->flags))
216                 adinlen = td->adinlen / 2;
217         else
218                 adinlen = td->adinlen;
219         if (!FIPS_drbg_generate(dctx, randout, td->katlen, 0, 0,
220                                 td->adin, adinlen))
221                 goto err;
222
223         if (memcmp(randout, td->kat, td->katlen))
224                 {
225                 FIPSerr(FIPS_F_FIPS_DRBG_SINGLE_KAT, FIPS_R_NOPR_TEST1_FAILURE);
226                 goto err2;
227                 }
228
229         if (quick)
230                 {
231                 rv = 1;
232                 goto err;
233                 }
234
235         t.ent = td->entreseed;
236         t.entlen = td->entreseedlen;
237
238         if (!FIPS_drbg_reseed(dctx, td->adinreseed, td->adinreseedlen))
239                 goto err;
240
241         if (!FIPS_drbg_generate(dctx, randout, td->kat2len, 0, 0,
242                                 td->adin2, td->adin2len))
243                 goto err;
244
245         if (memcmp(randout, td->kat2, td->kat2len))
246                 {
247                 FIPSerr(FIPS_F_FIPS_DRBG_SINGLE_KAT, FIPS_R_NOPR_TEST2_FAILURE);
248                 goto err2;
249                 }
250
251         FIPS_drbg_uninstantiate(dctx);
252
253         /* Now test with PR */
254         if (!FIPS_drbg_init(dctx, td->nid, td->flags))
255                 return 0;
256         if (!FIPS_drbg_set_callbacks(dctx, test_entropy, 0, 0, test_nonce, 0))
257                 return 0;
258
259         FIPS_drbg_set_app_data(dctx, &t);
260
261         t.ent = td->ent_pr;
262         t.entlen = td->entlen_pr;
263         t.nonce = td->nonce_pr;
264         t.noncelen = td->noncelen_pr;
265         t.entcnt = 0;
266         t.noncecnt = 0;
267
268         if (!FIPS_drbg_instantiate(dctx, td->pers_pr, td->perslen_pr))
269                 goto err;
270
271         t.ent = td->entpr_pr;
272         t.entlen = td->entprlen_pr;
273
274         /* Note for CTR without DF some additional input values
275          * ignore bytes after the keylength: so reduce adinlen
276          * to half to ensure invalid data is fed in.
277          */
278         if (!fips_post_corrupt(FIPS_TEST_DRBG, dctx->type, &dctx->flags))
279                 adinlen = td->adinlen_pr / 2;
280         else
281                 adinlen = td->adinlen_pr;
282         if (!FIPS_drbg_generate(dctx, randout, td->katlen_pr, 0, 1,
283                                 td->adin_pr, adinlen))
284                 goto err;
285
286         if (memcmp(randout, td->kat_pr, td->katlen_pr))
287                 {
288                 FIPSerr(FIPS_F_FIPS_DRBG_SINGLE_KAT, FIPS_R_PR_TEST1_FAILURE);
289                 goto err2;
290                 }
291
292         t.ent = td->entg_pr;
293         t.entlen = td->entglen_pr;
294
295         if (!FIPS_drbg_generate(dctx, randout, td->kat2len_pr, 0, 1,
296                                 td->ading_pr, td->adinglen_pr))
297                 goto err;
298
299         if (memcmp(randout, td->kat2_pr, td->kat2len_pr))
300                 {
301                 FIPSerr(FIPS_F_FIPS_DRBG_SINGLE_KAT, FIPS_R_PR_TEST2_FAILURE);
302                 goto err2;
303                 }
304
305         rv = 1;
306
307         err:
308         if (rv == 0)
309                 FIPSerr(FIPS_F_FIPS_DRBG_SINGLE_KAT, FIPS_R_SELFTEST_FAILED);
310         err2:
311         FIPS_drbg_uninstantiate(dctx);
312         
313         return rv;
314
315         }
316
317 /* This is the "health check" function required by SP800-90. Induce several
318  * failure modes and check an error condition is set.
319  */
320
321 static int fips_drbg_health_check(DRBG_CTX *dctx, DRBG_SELFTEST_DATA *td)
322         {
323         unsigned char randout[1024];
324         TEST_ENT t;
325         size_t i;
326         unsigned int reseed_counter_tmp;
327         unsigned char *p = (unsigned char *)dctx;
328
329         /* Initialise DRBG */
330
331         if (!FIPS_drbg_init(dctx, td->nid, td->flags))
332                 goto err;
333
334         if (!FIPS_drbg_set_callbacks(dctx, test_entropy, 0, 0, test_nonce, 0))
335                 goto err;
336
337         FIPS_drbg_set_app_data(dctx, &t);
338
339         t.ent = td->ent;
340         t.entlen = td->entlen;
341         t.nonce = td->nonce;
342         t.noncelen = td->noncelen;
343         t.entcnt = 0;
344         t.noncecnt = 0;
345
346         /* Don't report induced errors */
347         dctx->flags |= DRBG_FLAG_NOERR;
348
349         /* Try too large a personalisation length */
350         if (FIPS_drbg_instantiate(dctx, td->pers, dctx->max_pers + 1) > 0)
351                 {
352                 FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_PERSONALISATION_ERROR_UNDETECTED);
353                 goto err;
354                 }
355
356         /* Test entropy source failure detection */
357
358         t.entlen = 0;
359         if (FIPS_drbg_instantiate(dctx, td->pers, td->perslen) > 0)
360                 {
361                 FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_ENTROPY_ERROR_UNDETECTED);
362                 goto err;
363                 }
364
365         /* Try to generate output from uninstantiated DRBG */
366         if (FIPS_drbg_generate(dctx, randout, td->katlen, 0, 0,
367                                 td->adin, td->adinlen))
368                 {
369                 FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_GENERATE_ERROR_UNDETECTED);
370                 goto err;
371                 }
372
373         dctx->flags &= ~DRBG_FLAG_NOERR;
374         if (!FIPS_drbg_uninstantiate(dctx))
375                 {
376                 FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
377                 goto err;
378                 }
379
380         /* Instantiate with valid data. NB: errors now reported again */
381         if (!FIPS_drbg_init(dctx, td->nid, td->flags))
382                 goto err;
383         if (!FIPS_drbg_set_callbacks(dctx, test_entropy, 0, 0, test_nonce, 0))
384                 goto err;
385         FIPS_drbg_set_app_data(dctx, &t);
386
387         t.entlen = td->entlen;
388         if (!FIPS_drbg_instantiate(dctx, td->pers, td->perslen))
389                 goto err;
390
391         /* Check generation is now OK */
392         if (!FIPS_drbg_generate(dctx, randout, td->katlen, 0, 0,
393                                 td->adin, td->adinlen))
394                 goto err;
395
396         /* Try to generate with too high a strength.
397          */
398
399         dctx->flags |= DRBG_FLAG_NOERR;
400         if (dctx->strength != 256)
401                 {
402                 if (FIPS_drbg_generate(dctx, randout, td->katlen, 256, 0,
403                                         td->adin, td->adinlen))
404                         {
405                         FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_STRENGTH_ERROR_UNDETECTED);
406
407                         goto err;
408                         }
409                 }
410
411         /* Request too much data for one request */
412         if (FIPS_drbg_generate(dctx, randout, dctx->max_request + 1, 0, 0,
413                                 td->adin, td->adinlen))
414                 {
415                 FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_REQUEST_LENGTH_ERROR_UNDETECTED);
416                 goto err;
417                 }
418
419         /* Check prediction resistance request fails if entropy source
420          * failure.
421          */
422
423         t.entlen = 0;
424
425         if (FIPS_drbg_generate(dctx, randout, td->katlen, 0, 1,
426                                 td->adin, td->adinlen))
427                 {
428                 FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_ENTROPY_ERROR_UNDETECTED);
429                 goto err;
430                 }
431                 
432         dctx->flags &= ~DRBG_FLAG_NOERR;
433
434         if (!FIPS_drbg_uninstantiate(dctx))
435                 {
436                 FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
437                 goto err;
438                 }
439
440
441         /* Instantiate again with valid data */
442
443         if (!FIPS_drbg_init(dctx, td->nid, td->flags))
444                 goto err;
445         if (!FIPS_drbg_set_callbacks(dctx, test_entropy, 0, 0, test_nonce, 0))
446                 goto err;
447         FIPS_drbg_set_app_data(dctx, &t);
448
449         t.entlen = td->entlen;
450         /* Test reseed counter works */
451         if (!FIPS_drbg_instantiate(dctx, td->pers, td->perslen))
452                 goto err;
453         /* Save initial reseed counter */
454         reseed_counter_tmp = dctx->reseed_counter;
455         /* Set reseed counter to beyond interval */
456         dctx->reseed_counter = dctx->reseed_interval;
457
458         /* Generate output and check entropy has been requested for reseed */
459         t.entcnt = 0;
460         if (!FIPS_drbg_generate(dctx, randout, td->katlen, 0, 0,
461                                 td->adin, td->adinlen))
462                 goto err;
463         if (t.entcnt != 1)
464                 {
465                 FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_ENTROPY_NOT_REQUESTED_FOR_RESEED);
466                 goto err;
467                 }
468         /* Check reseed counter has been reset */
469         if (dctx->reseed_counter != reseed_counter_tmp + 1)
470                 {
471                 FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_RESEED_COUNTER_ERROR);
472                 goto err;
473                 }
474
475         FIPS_drbg_uninstantiate(dctx);
476         p = (unsigned char *)&dctx->d;
477         /* Standard says we have to check uninstantiate really zeroes
478          * the data...
479          */
480         for (i = 0; i < sizeof(dctx->d); i++)
481                 {
482                 if (*p != 0)
483                         {
484                         FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_UNINSTANTIATE_ZEROISE_ERROR);
485                         goto err;
486                         }
487                 p++;
488                 }
489
490         return 1;
491
492         err:
493         /* A real error as opposed to an induced one: underlying function will
494          * indicate the error.
495          */
496         if (!(dctx->flags & DRBG_FLAG_NOERR))
497                 FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_FUNCTION_ERROR);
498         FIPS_drbg_uninstantiate(dctx);
499         return 0;
500
501         }
502
503
504 int fips_drbg_kat(DRBG_CTX *dctx, int nid, unsigned int flags)
505         {
506         int rv;
507         DRBG_SELFTEST_DATA *td;
508         for (td = drbg_test; td->nid != 0; td++)
509                 {
510                 if (td->nid == nid && td->flags == flags)
511                         {
512                         rv = fips_drbg_single_kat(dctx, td, 0);
513                         if (rv <= 0)
514                                 return rv;
515                         return fips_drbg_health_check(dctx, td);
516                         }
517                 }
518         return 0;
519         }
520
521 int FIPS_selftest_drbg(void)
522         {
523         DRBG_CTX *dctx;
524         DRBG_SELFTEST_DATA *td;
525         int rv = 1;
526         dctx = FIPS_drbg_new(0, 0);
527         if (!dctx)
528                 return 0;
529         for (td = drbg_test; td->nid != 0; td++)
530                 {
531                 if (td->post != 1)
532                         continue;
533                 if (!fips_post_started(FIPS_TEST_DRBG, td->nid, &td->flags))
534                         return 1;
535                 if (!fips_drbg_single_kat(dctx, td, 1))
536                         {
537                         fips_post_failed(FIPS_TEST_DRBG, td->nid, &td->flags);
538                         rv = 0;
539                         continue;
540                         }
541                 if (!fips_post_success(FIPS_TEST_DRBG, td->nid, &td->flags))
542                         return 0;
543                 }
544         FIPS_drbg_free(dctx);
545         return rv;
546         }
547
548
549
550