providers/implementations/rands/drbg.c

   1 /*
   2  * Copyright 2011-2020 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <string.h>
  11 #include <openssl/crypto.h>
  12 #include <openssl/err.h>
  13 #include <openssl/rand.h>
  14 #include <openssl/evp.h>
  15 #include "crypto/rand.h"
  16 #include "drbg_local.h"
  17 #include "internal/thread_once.h"
  18 #include "crypto/cryptlib.h"
  19 #include "prov/seeding.h"
  20 #include "prov/rand_pool.h"
  21 #include "prov/provider_ctx.h"
  22 #include "prov/providercommonerr.h"
  23 #include "prov/providercommon.h"
  24
  25 /*
  26  * Support framework for NIST SP 800-90A DRBG
  27  *
  28  * See manual page PROV_DRBG(7) for a general overview.
  29  *
  30  * The OpenSSL model is to have new and free functions, and that new
  31  * does all initialization.  That is not the NIST model, which has
  32  * instantiation and un-instantiate, and re-use within a new/free
  33  * lifecycle.  (No doubt this comes from the desire to support hardware
  34  * DRBG, where allocation of resources on something like an HSM is
  35  * a much bigger deal than just re-setting an allocated resource.)
  36  */
  37
  38 /* NIST SP 800-90A DRBG recommends the use of a personalization string. */
  39 static const char ossl_pers_string[] = DRBG_DEFAULT_PERS_STRING;
  40
  41 static const OSSL_DISPATCH *find_call(const OSSL_DISPATCH *dispatch,
  42                                       int function);
  43
  44 static int rand_drbg_restart(PROV_DRBG *drbg);
  45
  46 int drbg_lock(void *vctx)
  47 {
  48     PROV_DRBG *drbg = vctx;
  49
  50     if (drbg == NULL || drbg->lock == NULL)
  51         return 1;
  52     return CRYPTO_THREAD_write_lock(drbg->lock);
  53 }
  54
  55 void drbg_unlock(void *vctx)
  56 {
  57     PROV_DRBG *drbg = vctx;
  58
  59     if (drbg != NULL && drbg->lock != NULL)
  60         CRYPTO_THREAD_unlock(drbg->lock);
  61 }
  62
  63 static int drbg_lock_parent(PROV_DRBG *drbg)
  64 {
  65     void *parent = drbg->parent;
  66
  67     if (parent != NULL
  68             && drbg->parent_lock != NULL
  69             && !drbg->parent_lock(parent)) {
  70         ERR_raise(ERR_LIB_PROV, PROV_R_PARENT_LOCKING_NOT_ENABLED);
  71         return 0;
  72     }
  73     return 1;
  74 }
  75
  76 static void drbg_unlock_parent(PROV_DRBG *drbg)
  77 {
  78     void *parent = drbg->parent;
  79
  80     if (parent != NULL && drbg->parent_unlock != NULL)
  81         drbg->parent_unlock(parent);
  82 }
  83
  84 static int get_parent_strength(PROV_DRBG *drbg, unsigned int *str)
  85 {
  86     OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
  87     void *parent = drbg->parent;
  88     int res;
  89
  90     if (drbg->parent_get_ctx_params == NULL) {
  91         ERR_raise(ERR_LIB_PROV, PROV_R_UNABLE_TO_GET_PARENT_STRENGTH);
  92         return 0;
  93     }
  94
  95     *params = OSSL_PARAM_construct_uint(OSSL_RAND_PARAM_STRENGTH, str);
  96     if (!drbg_lock_parent(drbg)) {
  97         ERR_raise(ERR_LIB_PROV, PROV_R_UNABLE_TO_LOCK_PARENT);
  98         return 0;
  99     }
 100     res = drbg->parent_get_ctx_params(parent, params);
 101     drbg_unlock_parent(drbg);
 102     if (!res) {
 103         ERR_raise(ERR_LIB_PROV, PROV_R_UNABLE_TO_GET_PARENT_STRENGTH);
 104         return 0;
 105     }
 106     return 1;
 107 }
 108
 109 static unsigned int get_parent_reseed_count(PROV_DRBG *drbg)
 110 {
 111     OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
 112     void *parent = drbg->parent;
 113     unsigned int r;
 114
 115     *params = OSSL_PARAM_construct_uint(OSSL_DRBG_PARAM_RESEED_COUNTER, &r);
 116     if (!drbg_lock_parent(drbg)) {
 117         ERR_raise(ERR_LIB_PROV, PROV_R_UNABLE_TO_LOCK_PARENT);
 118         goto err;
 119     }
 120     if (!drbg->parent_get_ctx_params(parent, params)) {
 121         drbg_unlock_parent(drbg);
 122         ERR_raise(ERR_LIB_PROV, PROV_R_UNABLE_TO_GET_RESEED_PROP_CTR);
 123         goto err;
 124     }
 125     drbg_unlock_parent(drbg);
 126     return r;
 127
 128  err:
 129     r = tsan_load(&drbg->reseed_counter) - 2;
 130     if (r == 0)
 131         r = UINT_MAX;
 132     return r;
 133 }
 134
 135 /*
 136  * Implements the get_entropy() callback
 137  *
 138  * If the DRBG has a parent, then the required amount of entropy input
 139  * is fetched using the parent's ossl_prov_drbg_generate().
 140  *
 141  * Otherwise, the entropy is polled from the system entropy sources
 142  * using prov_pool_acquire_entropy().
 143  *
 144  * If a random pool has been added to the DRBG using RAND_add(), then
 145  * its entropy will be used up first.
 146  */
 147 static size_t prov_drbg_get_entropy(PROV_DRBG *drbg, unsigned char **pout,
 148                                     int entropy, size_t min_len,
 149                                     size_t max_len, int prediction_resistance)
 150 {
 151     size_t ret = 0;
 152     size_t entropy_available = 0;
 153     RAND_POOL *pool;
 154     unsigned int p_str;
 155
 156     if (drbg->parent != NULL) {
 157         if (!get_parent_strength(drbg, &p_str))
 158             return 0;
 159         if (drbg->strength > p_str) {
 160             /*
 161              * We currently don't support the algorithm from NIST SP 800-90C
 162              * 10.1.2 to use a weaker DRBG as source
 163              */
 164             RANDerr(0, PROV_R_PARENT_STRENGTH_TOO_WEAK);
 165             return 0;
 166         }
 167     }
 168
 169     if (drbg->seed_pool != NULL) {
 170         pool = drbg->seed_pool;
 171         pool->entropy_requested = entropy;
 172     } else {
 173         pool = rand_pool_new(entropy, 1, min_len, max_len);
 174         if (pool == NULL) {
 175             ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE);
 176             return 0;
 177         }
 178     }
 179
 180     if (drbg->parent != NULL) {
 181         size_t bytes_needed = rand_pool_bytes_needed(pool, 1 /*entropy_factor*/);
 182         unsigned char *buffer = rand_pool_add_begin(pool, bytes_needed);
 183
 184         if (buffer != NULL) {
 185             size_t bytes = 0;
 186
 187             if (drbg->parent_generate == NULL)
 188                 goto err;
 189             /*
 190              * Our lock is already held, but we need to lock our parent before
 191              * generating bits from it. (Note: taking the lock will be a no-op
 192              * if locking if drbg->parent->lock == NULL.)
 193              */
 194             drbg_lock_parent(drbg);
 195             /*
 196              * Get random data from parent.  Include our DRBG address as
 197              * additional input, in order to provide a distinction between
 198              * different DRBG child instances.
 199              *
 200              * Note: using the sizeof() operator on a pointer triggers
 201              *       a warning in some static code analyzers, but it's
 202              *       intentional and correct here.
 203              */
 204             if (drbg->parent_generate(drbg->parent, buffer, bytes_needed,
 205                                       drbg->strength, prediction_resistance,
 206                                       (unsigned char *)&drbg,
 207                                       sizeof(drbg)) != 0)
 208                 bytes = bytes_needed;
 209             drbg_unlock_parent(drbg);
 210             drbg->parent_reseed_counter = get_parent_reseed_count(drbg);
 211
 212             rand_pool_add_end(pool, bytes, 8 * bytes);
 213             entropy_available = rand_pool_entropy_available(pool);
 214         }
 215     } else {
 216         /* Get entropy by polling system entropy sources. */
 217         entropy_available = prov_pool_acquire_entropy(pool);
 218     }
 219
 220     if (entropy_available > 0) {
 221         ret   = rand_pool_length(pool);
 222         *pout = rand_pool_detach(pool);
 223     }
 224
 225 err:
 226     if (drbg->seed_pool == NULL)
 227         rand_pool_free(pool);
 228     return ret;
 229 }
 230
 231 /*
 232  * Implements the cleanup_entropy() callback
 233  *
 234  */
 235 static void prov_drbg_cleanup_entropy(PROV_DRBG *drbg,
 236                                       unsigned char *out, size_t outlen)
 237 {
 238     if (drbg->seed_pool == NULL) {
 239         OPENSSL_secure_clear_free(out, outlen);
 240     }
 241 }
 242
 243 static size_t get_entropy(PROV_DRBG *drbg, unsigned char **pout, int entropy,
 244                           size_t min_len, size_t max_len,
 245                           int prediction_resistance)
 246 {
 247 #ifdef FIPS_MODULE
 248     if (drbg->parent == NULL)
 249         return prov_crngt_get_entropy(drbg, pout, entropy, min_len, max_len,
 250                                       prediction_resistance);
 251 #endif
 252
 253     return prov_drbg_get_entropy(drbg, pout, entropy, min_len, max_len,
 254                                  prediction_resistance);
 255 }
 256
 257 static void cleanup_entropy(PROV_DRBG *drbg, unsigned char *out, size_t outlen)
 258 {
 259 #ifdef FIPS_MODULE
 260     if (drbg->parent == NULL)
 261         prov_crngt_cleanup_entropy(drbg, out, outlen);
 262     else
 263 #endif
 264         prov_drbg_cleanup_entropy(drbg, out, outlen);
 265 }
 266
 267 #ifndef PROV_RAND_GET_RANDOM_NONCE
 268 typedef struct prov_drbg_nonce_global_st {
 269     CRYPTO_RWLOCK *rand_nonce_lock;
 270     int rand_nonce_count;
 271 } PROV_DRBG_NONCE_GLOBAL;
 272
 273 /*
 274  * drbg_ossl_ctx_new() calls drgb_setup() which calls rand_drbg_get_nonce()
 275  * which needs to get the rand_nonce_lock out of the OSSL_LIB_CTX...but since
 276  * drbg_ossl_ctx_new() hasn't finished running yet we need the rand_nonce_lock
 277  * to be in a different global data object. Otherwise we will go into an
 278  * infinite recursion loop.
 279  */
 280 static void *prov_drbg_nonce_ossl_ctx_new(OSSL_LIB_CTX *libctx)
 281 {
 282     PROV_DRBG_NONCE_GLOBAL *dngbl = OPENSSL_zalloc(sizeof(*dngbl));
 283
 284     if (dngbl == NULL)
 285         return NULL;
 286
 287     dngbl->rand_nonce_lock = CRYPTO_THREAD_lock_new();
 288     if (dngbl->rand_nonce_lock == NULL) {
 289         OPENSSL_free(dngbl);
 290         return NULL;
 291     }
 292
 293     return dngbl;
 294 }
 295
 296 static void prov_drbg_nonce_ossl_ctx_free(void *vdngbl)
 297 {
 298     PROV_DRBG_NONCE_GLOBAL *dngbl = vdngbl;
 299
 300     if (dngbl == NULL)
 301         return;
 302
 303     CRYPTO_THREAD_lock_free(dngbl->rand_nonce_lock);
 304
 305     OPENSSL_free(dngbl);
 306 }
 307
 308 static const OSSL_LIB_CTX_METHOD drbg_nonce_ossl_ctx_method = {
 309     prov_drbg_nonce_ossl_ctx_new,
 310     prov_drbg_nonce_ossl_ctx_free,
 311 };
 312
 313 /* Get a nonce from the operating system */
 314 static size_t prov_drbg_get_nonce(PROV_DRBG *drbg,
 315                                   unsigned char **pout,
 316                                   int entropy, size_t min_len, size_t max_len)
 317 {
 318     size_t ret = 0, n;
 319     RAND_POOL *pool;
 320     unsigned char *buf = NULL;
 321     OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(drbg->provctx);
 322     PROV_DRBG_NONCE_GLOBAL *dngbl
 323         = ossl_lib_ctx_get_data(libctx, OSSL_LIB_CTX_DRBG_NONCE_INDEX,
 324                                 &drbg_nonce_ossl_ctx_method);
 325     struct {
 326         void *instance;
 327         int count;
 328     } data;
 329
 330     if (dngbl == NULL)
 331         return 0;
 332
 333     if (drbg->parent != NULL) {
 334         if (drbg->parent_nonce != NULL) {
 335             n = drbg->parent_nonce(drbg->parent, NULL, 0, drbg->min_noncelen,
 336                                    drbg->max_noncelen);
 337             if (n > 0 && (buf = OPENSSL_malloc(n)) != NULL) {
 338                 ret = drbg->parent_nonce(drbg->parent, buf, 0,
 339                                          drbg->min_noncelen,
 340                                          drbg->max_noncelen);
 341                 if (ret == n) {
 342                     *pout = buf;
 343                     return ret;
 344                 }
 345                 OPENSSL_free(buf);
 346             }
 347         }
 348     }
 349
 350     /* Use the built in nonce source */
 351     memset(&data, 0, sizeof(data));
 352     pool = rand_pool_new(0, 0, min_len, max_len);
 353     if (pool == NULL)
 354         return 0;
 355
 356     if (prov_pool_add_nonce_data(pool) == 0)
 357         goto err;
 358
 359     data.instance = drbg;
 360     CRYPTO_atomic_add(&dngbl->rand_nonce_count, 1, &data.count,
 361                       dngbl->rand_nonce_lock);
 362
 363     if (rand_pool_add(pool, (unsigned char *)&data, sizeof(data), 0) == 0)
 364         goto err;
 365
 366     ret   = rand_pool_length(pool);
 367     *pout = rand_pool_detach(pool);
 368
 369  err:
 370     rand_pool_free(pool);
 371
 372     return ret;
 373 }
 374
 375 static void prov_drbg_clear_nonce(PROV_DRBG *drbg, unsigned char *nonce,
 376                                   size_t noncelen)
 377 {
 378     OPENSSL_clear_free(nonce, noncelen);
 379 }
 380 #else
 381 # define prov_drbg_clear_nonce(drbg, nonce, len) \
 382     OPENSSL_clear_free((nonce), (len))
 383 #endif /* PROV_RAND_GET_RANDOM_NONCE */
 384
 385 /*
 386  * Instantiate |drbg|, after it has been initialized.  Use |pers| and
 387  * |perslen| as prediction-resistance input.
 388  *
 389  * Requires that drbg->lock is already locked for write, if non-null.
 390  *
 391  * Returns 1 on success, 0 on failure.
 392  */
 393 int ossl_prov_drbg_instantiate(PROV_DRBG *drbg, unsigned int strength,
 394                                int prediction_resistance,
 395                                const unsigned char *pers, size_t perslen)
 396 {
 397     unsigned char *nonce = NULL, *entropy = NULL;
 398     size_t noncelen = 0, entropylen = 0;
 399     size_t min_entropy, min_entropylen, max_entropylen;
 400
 401     if (!ossl_prov_is_running())
 402         return 0;
 403
 404     if (strength > drbg->strength) {
 405         PROVerr(0, PROV_R_INSUFFICIENT_DRBG_STRENGTH);
 406         goto end;
 407     }
 408     min_entropy = drbg->strength;
 409     min_entropylen = drbg->min_entropylen;
 410     max_entropylen = drbg->max_entropylen;
 411
 412     if (pers == NULL) {
 413         pers = (const unsigned char *)ossl_pers_string;
 414         perslen = sizeof(ossl_pers_string);
 415     }
 416     if (perslen > drbg->max_perslen) {
 417         PROVerr(0, PROV_R_PERSONALISATION_STRING_TOO_LONG);
 418         goto end;
 419     }
 420
 421     if (drbg->state != EVP_RAND_STATE_UNINITIALISED) {
 422         if (drbg->state == EVP_RAND_STATE_ERROR)
 423             PROVerr(0, PROV_R_IN_ERROR_STATE);
 424         else
 425             PROVerr(0, PROV_R_ALREADY_INSTANTIATED);
 426         goto end;
 427     }
 428
 429     drbg->state = EVP_RAND_STATE_ERROR;
 430
 431     if (drbg->min_noncelen > 0) {
 432         if (drbg->parent_nonce != NULL) {
 433             noncelen = drbg->parent_nonce(drbg->parent, NULL, drbg->strength,
 434                                           drbg->min_noncelen,
 435                                           drbg->max_noncelen);
 436             if (noncelen == 0) {
 437                 PROVerr(0, PROV_R_ERROR_RETRIEVING_NONCE);
 438                 goto end;
 439             }
 440             nonce = OPENSSL_malloc(noncelen);
 441             if (nonce == NULL) {
 442                 PROVerr(0, PROV_R_ERROR_RETRIEVING_NONCE);
 443                 goto end;
 444             }
 445             if (noncelen != drbg->parent_nonce(drbg->parent, nonce,
 446                                                drbg->strength,
 447                                                drbg->min_noncelen,
 448                                                drbg->max_noncelen)) {
 449                 PROVerr(0, PROV_R_ERROR_RETRIEVING_NONCE);
 450                 goto end;
 451             }
 452 #ifndef PROV_RAND_GET_RANDOM_NONCE
 453         } else if (drbg->parent != NULL) {
 454 #endif
 455             /*
 456              * NIST SP800-90Ar1 section 9.1 says you can combine getting
 457              * the entropy and nonce in 1 call by increasing the entropy
 458              * with 50% and increasing the minimum length to accommodate
 459              * the length of the nonce. We do this in case a nonce is
 460              * required and there is no parental nonce capability.
 461              */
 462             min_entropy += drbg->strength / 2;
 463             min_entropylen += drbg->min_noncelen;
 464             max_entropylen += drbg->max_noncelen;
 465         }
 466 #ifndef PROV_RAND_GET_RANDOM_NONCE
 467         else { /* parent == NULL */
 468             noncelen = prov_drbg_get_nonce(drbg, &nonce, drbg->strength / 2,
 469                                            drbg->min_noncelen,
 470                                            drbg->max_noncelen);
 471             if (noncelen < drbg->min_noncelen
 472                     || noncelen > drbg->max_noncelen) {
 473                 PROVerr(0, PROV_R_ERROR_RETRIEVING_NONCE);
 474                 goto end;
 475             }
 476         }
 477 #endif
 478     }
 479
 480     drbg->reseed_next_counter = tsan_load(&drbg->reseed_counter);
 481     if (drbg->reseed_next_counter) {
 482         drbg->reseed_next_counter++;
 483         if (!drbg->reseed_next_counter)
 484             drbg->reseed_next_counter = 1;
 485     }
 486
 487     entropylen = get_entropy(drbg, &entropy, min_entropy,
 488                              min_entropylen, max_entropylen,
 489                              prediction_resistance);
 490     if (entropylen < min_entropylen
 491             || entropylen > max_entropylen) {
 492         PROVerr(0, PROV_R_ERROR_RETRIEVING_ENTROPY);
 493         goto end;
 494     }
 495
 496     if (!drbg->instantiate(drbg, entropy, entropylen, nonce, noncelen,
 497                            pers, perslen)) {
 498         PROVerr(0, PROV_R_ERROR_INSTANTIATING_DRBG);
 499         goto end;
 500     }
 501
 502     drbg->state = EVP_RAND_STATE_READY;
 503     drbg->generate_counter = 1;
 504     drbg->reseed_time = time(NULL);
 505     tsan_store(&drbg->reseed_counter, drbg->reseed_next_counter);
 506
 507  end:
 508     if (entropy != NULL)
 509         cleanup_entropy(drbg, entropy, entropylen);
 510     prov_drbg_clear_nonce(drbg, nonce, noncelen);
 511     if (drbg->state == EVP_RAND_STATE_READY)
 512         return 1;
 513     return 0;
 514 }
 515
 516 /*
 517  * Uninstantiate |drbg|. Must be instantiated before it can be used.
 518  *
 519  * Requires that drbg->lock is already locked for write, if non-null.
 520  *
 521  * Returns 1 on success, 0 on failure.
 522  */
 523 int ossl_prov_drbg_uninstantiate(PROV_DRBG *drbg)
 524 {
 525     drbg->state = EVP_RAND_STATE_UNINITIALISED;
 526     return 1;
 527 }
 528
 529 /*
 530  * Reseed |drbg|, mixing in the specified data
 531  *
 532  * Requires that drbg->lock is already locked for write, if non-null.
 533  *
 534  * Returns 1 on success, 0 on failure.
 535  */
 536 int ossl_prov_drbg_reseed(PROV_DRBG *drbg, int prediction_resistance,
 537                           const unsigned char *ent, size_t ent_len,
 538                           const unsigned char *adin, size_t adinlen)
 539 {
 540     unsigned char *entropy = NULL;
 541     size_t entropylen = 0;
 542
 543     if (!ossl_prov_is_running())
 544         return 0;
 545
 546     if (drbg->state != EVP_RAND_STATE_READY) {
 547         /* try to recover from previous errors */
 548         rand_drbg_restart(drbg);
 549
 550         if (drbg->state == EVP_RAND_STATE_ERROR) {
 551             PROVerr(0, PROV_R_IN_ERROR_STATE);
 552             return 0;
 553         }
 554         if (drbg->state == EVP_RAND_STATE_UNINITIALISED) {
 555             PROVerr(0, PROV_R_NOT_INSTANTIATED);
 556             return 0;
 557         }
 558     }
 559
 560     if (ent != NULL) {
 561         if (ent_len < drbg->min_entropylen) {
 562             RANDerr(0, RAND_R_ENTROPY_OUT_OF_RANGE);
 563             drbg->state = EVP_RAND_STATE_ERROR;
 564             return 0;
 565         }
 566         if (ent_len > drbg->max_entropylen) {
 567             RANDerr(0, RAND_R_ENTROPY_INPUT_TOO_LONG);
 568             drbg->state = EVP_RAND_STATE_ERROR;
 569             return 0;
 570         }
 571     }
 572
 573     if (adin == NULL) {
 574         adinlen = 0;
 575     } else if (adinlen > drbg->max_adinlen) {
 576         PROVerr(0, PROV_R_ADDITIONAL_INPUT_TOO_LONG);
 577         return 0;
 578     }
 579
 580     drbg->state = EVP_RAND_STATE_ERROR;
 581
 582     drbg->reseed_next_counter = tsan_load(&drbg->reseed_counter);
 583     if (drbg->reseed_next_counter) {
 584         drbg->reseed_next_counter++;
 585         if (!drbg->reseed_next_counter)
 586             drbg->reseed_next_counter = 1;
 587     }
 588
 589     if (ent != NULL) {
 590 #ifdef FIPS_MODULE
 591         /*
 592          * NIST SP-800-90A mandates that entropy *shall not* be provided
 593          * by the consuming application. Instead the data is added as additional
 594          * input.
 595          *
 596          * (NIST SP-800-90Ar1, Sections 9.1 and 9.2)
 597          */
 598         if (!drbg->reseed(drbg, NULL, 0, ent, ent_len)) {
 599             ERR_raise(ERR_LIB_PROV, PROV_R_UNABLE_TO_RESEED);
 600             return 0;
 601         }
 602 #else
 603         if (!drbg->reseed(drbg, ent, ent_len, adin, adinlen)) {
 604             ERR_raise(ERR_LIB_PROV, PROV_R_UNABLE_TO_RESEED);
 605             return 0;
 606         }
 607         /* There isn't much point adding the same additional input twice */
 608         adin = NULL;
 609         adinlen = 0;
 610 #endif
 611     }
 612
 613     /* Reseed using our sources in addition */
 614     entropylen = get_entropy(drbg, &entropy, drbg->strength,
 615                              drbg->min_entropylen, drbg->max_entropylen,
 616                              prediction_resistance);
 617     if (entropylen < drbg->min_entropylen
 618             || entropylen > drbg->max_entropylen) {
 619         PROVerr(0, PROV_R_ERROR_RETRIEVING_ENTROPY);
 620         goto end;
 621     }
 622
 623     if (!drbg->reseed(drbg, entropy, entropylen, adin, adinlen))
 624         goto end;
 625
 626     drbg->state = EVP_RAND_STATE_READY;
 627     drbg->generate_counter = 1;
 628     drbg->reseed_time = time(NULL);
 629     tsan_store(&drbg->reseed_counter, drbg->reseed_next_counter);
 630     if (drbg->parent != NULL)
 631         drbg->parent_reseed_counter = get_parent_reseed_count(drbg);
 632
 633  end:
 634     cleanup_entropy(drbg, entropy, entropylen);
 635     if (drbg->state == EVP_RAND_STATE_READY)
 636         return 1;
 637     return 0;
 638 }
 639
 640 /*
 641  * Generate |outlen| bytes into the buffer at |out|.  Reseed if we need
 642  * to or if |prediction_resistance| is set.  Additional input can be
 643  * sent in |adin| and |adinlen|.
 644  *
 645  * Requires that drbg->lock is already locked for write, if non-null.
 646  *
 647  * Returns 1 on success, 0 on failure.
 648  *
 649  */
 650 int ossl_prov_drbg_generate(PROV_DRBG *drbg, unsigned char *out, size_t outlen,
 651                             unsigned int strength, int prediction_resistance,
 652                             const unsigned char *adin, size_t adinlen)
 653 {
 654     int fork_id;
 655     int reseed_required = 0;
 656
 657     if (!ossl_prov_is_running())
 658         return 0;
 659
 660     if (drbg->state != EVP_RAND_STATE_READY) {
 661         /* try to recover from previous errors */
 662         rand_drbg_restart(drbg);
 663
 664         if (drbg->state == EVP_RAND_STATE_ERROR) {
 665             PROVerr(0, PROV_R_IN_ERROR_STATE);
 666             return 0;
 667         }
 668         if (drbg->state == EVP_RAND_STATE_UNINITIALISED) {
 669             PROVerr(0, PROV_R_NOT_INSTANTIATED);
 670             return 0;
 671         }
 672     }
 673     if (strength > drbg->strength) {
 674         PROVerr(0, PROV_R_INSUFFICIENT_DRBG_STRENGTH);
 675         return 0;
 676     }
 677
 678     if (outlen > drbg->max_request) {
 679         PROVerr(0, PROV_R_REQUEST_TOO_LARGE_FOR_DRBG);
 680         return 0;
 681     }
 682     if (adinlen > drbg->max_adinlen) {
 683         PROVerr(0, PROV_R_ADDITIONAL_INPUT_TOO_LONG);
 684         return 0;
 685     }
 686
 687     fork_id = openssl_get_fork_id();
 688
 689     if (drbg->fork_id != fork_id) {
 690         drbg->fork_id = fork_id;
 691         reseed_required = 1;
 692     }
 693
 694     if (drbg->reseed_interval > 0) {
 695         if (drbg->generate_counter >= drbg->reseed_interval)
 696             reseed_required = 1;
 697     }
 698     if (drbg->reseed_time_interval > 0) {
 699         time_t now = time(NULL);
 700         if (now < drbg->reseed_time
 701             || now - drbg->reseed_time >= drbg->reseed_time_interval)
 702             reseed_required = 1;
 703     }
 704     if (drbg->parent != NULL
 705             && get_parent_reseed_count(drbg) != drbg->parent_reseed_counter)
 706         reseed_required = 1;
 707
 708     if (reseed_required || prediction_resistance) {
 709         if (!ossl_prov_drbg_reseed(drbg, prediction_resistance, NULL, 0,
 710                                    adin, adinlen)) {
 711             PROVerr(0, PROV_R_RESEED_ERROR);
 712             return 0;
 713         }
 714         adin = NULL;
 715         adinlen = 0;
 716     }
 717
 718     if (!drbg->generate(drbg, out, outlen, adin, adinlen)) {
 719         drbg->state = EVP_RAND_STATE_ERROR;
 720         PROVerr(0, PROV_R_GENERATE_ERROR);
 721         return 0;
 722     }
 723
 724     drbg->generate_counter++;
 725
 726     return 1;
 727 }
 728
 729 /*
 730  * Restart |drbg|, using the specified entropy or additional input
 731  *
 732  * Tries its best to get the drbg instantiated by all means,
 733  * regardless of its current state.
 734  *
 735  * Optionally, a |buffer| of |len| random bytes can be passed,
 736  * which is assumed to contain at least |entropy| bits of entropy.
 737  *
 738  * If |entropy| > 0, the buffer content is used as entropy input.
 739  *
 740  * If |entropy| == 0, the buffer content is used as additional input
 741  *
 742  * Returns 1 on success, 0 on failure.
 743  *
 744  * This function is used internally only.
 745  */
 746 static int rand_drbg_restart(PROV_DRBG *drbg)
 747 {
 748     if (drbg->seed_pool != NULL) {
 749         drbg->state = EVP_RAND_STATE_ERROR;
 750         rand_pool_free(drbg->seed_pool);
 751         drbg->seed_pool = NULL;
 752         RANDerr(0, ERR_R_INTERNAL_ERROR);
 753         return 0;
 754     }
 755
 756     /* repair error state */
 757     if (drbg->state == EVP_RAND_STATE_ERROR)
 758         drbg->uninstantiate(drbg);
 759
 760     /* repair uninitialized state */
 761     if (drbg->state == EVP_RAND_STATE_UNINITIALISED)
 762         /* reinstantiate drbg */
 763         ossl_prov_drbg_instantiate(drbg, drbg->strength, 0, NULL, 0);
 764
 765     rand_pool_free(drbg->seed_pool);
 766     drbg->seed_pool = NULL;
 767     return drbg->state == EVP_RAND_STATE_READY;
 768 }
 769
 770 /* Provider support from here down */
 771 static const OSSL_DISPATCH *find_call(const OSSL_DISPATCH *dispatch,
 772                                       int function)
 773 {
 774     if (dispatch != NULL)
 775         while (dispatch->function_id != 0) {
 776             if (dispatch->function_id == function)
 777                 return dispatch;
 778             dispatch++;
 779         }
 780     return NULL;
 781 }
 782
 783 int drbg_enable_locking(void *vctx)
 784 {
 785     PROV_DRBG *drbg = vctx;
 786
 787     if (drbg != NULL && drbg->lock == NULL) {
 788         if (drbg->parent_enable_locking != NULL)
 789             if (!drbg->parent_enable_locking(drbg->parent)) {
 790                 ERR_raise(ERR_LIB_PROV, PROV_R_PARENT_LOCKING_NOT_ENABLED);
 791                 return 0;
 792             }
 793         drbg->lock = CRYPTO_THREAD_lock_new();
 794         if (drbg->lock == NULL) {
 795             ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_CREATE_LOCK);
 796             return 0;
 797         }
 798     }
 799     return 1;
 800 }
 801
 802 /*
 803  * Allocate memory and initialize a new DRBG. The DRBG is allocated on
 804  * the secure heap if |secure| is nonzero and the secure heap is enabled.
 805  * The |parent|, if not NULL, will be used as random source for reseeding.
 806  * This also requires the parent's provider context and the parent's lock.
 807  *
 808  * Returns a pointer to the new DRBG instance on success, NULL on failure.
 809  */
 810 PROV_DRBG *prov_rand_drbg_new
 811     (void *provctx, void *parent, const OSSL_DISPATCH *p_dispatch,
 812      int (*dnew)(PROV_DRBG *ctx),
 813      int (*instantiate)(PROV_DRBG *drbg,
 814                         const unsigned char *entropy, size_t entropylen,
 815                         const unsigned char *nonce, size_t noncelen,
 816                         const unsigned char *pers, size_t perslen),
 817      int (*uninstantiate)(PROV_DRBG *ctx),
 818      int (*reseed)(PROV_DRBG *drbg, const unsigned char *ent, size_t ent_len,
 819                    const unsigned char *adin, size_t adin_len),
 820      int (*generate)(PROV_DRBG *, unsigned char *out, size_t outlen,
 821                      const unsigned char *adin, size_t adin_len))
 822 {
 823     PROV_DRBG *drbg;
 824     unsigned int p_str;
 825     const OSSL_DISPATCH *pfunc;
 826
 827     if (!ossl_prov_is_running())
 828         return NULL;
 829
 830     drbg = OPENSSL_zalloc(sizeof(*drbg));
 831     if (drbg == NULL) {
 832         ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE);
 833         return NULL;
 834     }
 835
 836     drbg->provctx = provctx;
 837     drbg->instantiate = instantiate;
 838     drbg->uninstantiate = uninstantiate;
 839     drbg->reseed = reseed;
 840     drbg->generate = generate;
 841     drbg->fork_id = openssl_get_fork_id();
 842
 843     /* Extract parent's functions */
 844     drbg->parent = parent;
 845     if ((pfunc = find_call(p_dispatch, OSSL_FUNC_RAND_ENABLE_LOCKING)) != NULL)
 846         drbg->parent_enable_locking = OSSL_FUNC_rand_enable_locking(pfunc);
 847     if ((pfunc = find_call(p_dispatch, OSSL_FUNC_RAND_LOCK)) != NULL)
 848         drbg->parent_lock = OSSL_FUNC_rand_lock(pfunc);
 849     if ((pfunc = find_call(p_dispatch, OSSL_FUNC_RAND_UNLOCK)) != NULL)
 850         drbg->parent_unlock = OSSL_FUNC_rand_unlock(pfunc);
 851     if ((pfunc = find_call(p_dispatch, OSSL_FUNC_RAND_GET_CTX_PARAMS)) != NULL)
 852         drbg->parent_get_ctx_params = OSSL_FUNC_rand_get_ctx_params(pfunc);
 853     if ((pfunc = find_call(p_dispatch, OSSL_FUNC_RAND_GENERATE)) != NULL)
 854         drbg->parent_generate = OSSL_FUNC_rand_generate(pfunc);
 855     if ((pfunc = find_call(p_dispatch, OSSL_FUNC_RAND_NONCE)) != NULL)
 856         drbg->parent_nonce = OSSL_FUNC_rand_nonce(pfunc);
 857
 858     /* Set some default maximums up */
 859     drbg->max_entropylen = DRBG_MAX_LENGTH;
 860     drbg->max_noncelen = DRBG_MAX_LENGTH;
 861     drbg->max_perslen = DRBG_MAX_LENGTH;
 862     drbg->max_adinlen = DRBG_MAX_LENGTH;
 863     drbg->generate_counter = 1;
 864     drbg->reseed_counter = 1;
 865     drbg->reseed_interval = RESEED_INTERVAL;
 866     drbg->reseed_time_interval = TIME_INTERVAL;
 867
 868     if (!dnew(drbg))
 869         goto err;
 870
 871     if (parent != NULL) {
 872         if (!get_parent_strength(drbg, &p_str))
 873             goto err;
 874         if (drbg->strength > p_str) {
 875             /*
 876              * We currently don't support the algorithm from NIST SP 800-90C
 877              * 10.1.2 to use a weaker DRBG as source
 878              */
 879             ERR_raise(ERR_LIB_PROV, PROV_R_PARENT_STRENGTH_TOO_WEAK);
 880             goto err;
 881         }
 882     }
 883     return drbg;
 884
 885  err:
 886     prov_rand_drbg_free(drbg);
 887     return NULL;
 888 }
 889
 890 void prov_rand_drbg_free(PROV_DRBG *drbg)
 891 {
 892     if (drbg == NULL)
 893         return;
 894
 895     rand_pool_free(drbg->adin_pool);
 896     CRYPTO_THREAD_lock_free(drbg->lock);
 897     OPENSSL_free(drbg);
 898 }
 899
 900 int drbg_get_ctx_params(PROV_DRBG *drbg, OSSL_PARAM params[])
 901 {
 902     OSSL_PARAM *p;
 903
 904     p = OSSL_PARAM_locate(params, OSSL_RAND_PARAM_STATE);
 905     if (p != NULL && !OSSL_PARAM_set_int(p, drbg->state))
 906         return 0;
 907
 908     p = OSSL_PARAM_locate(params, OSSL_RAND_PARAM_STRENGTH);
 909     if (p != NULL && !OSSL_PARAM_set_int(p, drbg->strength))
 910         return 0;
 911
 912     p = OSSL_PARAM_locate(params, OSSL_DRBG_PARAM_MAX_REQUEST);
 913     if (p != NULL && !OSSL_PARAM_set_size_t(p, drbg->max_request))
 914         return 0;
 915
 916     p = OSSL_PARAM_locate(params, OSSL_DRBG_PARAM_MIN_ENTROPYLEN);
 917     if (p != NULL && !OSSL_PARAM_set_size_t(p, drbg->min_entropylen))
 918         return 0;
 919
 920     p = OSSL_PARAM_locate(params, OSSL_DRBG_PARAM_MAX_ENTROPYLEN);
 921     if (p != NULL && !OSSL_PARAM_set_size_t(p, drbg->max_entropylen))
 922         return 0;
 923
 924     p = OSSL_PARAM_locate(params, OSSL_DRBG_PARAM_MIN_NONCELEN);
 925     if (p != NULL && !OSSL_PARAM_set_size_t(p, drbg->min_noncelen))
 926         return 0;
 927
 928     p = OSSL_PARAM_locate(params, OSSL_DRBG_PARAM_MAX_NONCELEN);
 929     if (p != NULL && !OSSL_PARAM_set_size_t(p, drbg->max_noncelen))
 930         return 0;
 931
 932     p = OSSL_PARAM_locate(params, OSSL_DRBG_PARAM_MAX_PERSLEN);
 933     if (p != NULL && !OSSL_PARAM_set_size_t(p, drbg->max_perslen))
 934         return 0;
 935
 936     p = OSSL_PARAM_locate(params, OSSL_DRBG_PARAM_MAX_ADINLEN);
 937     if (p != NULL && !OSSL_PARAM_set_size_t(p, drbg->max_adinlen))
 938         return 0;
 939
 940     p = OSSL_PARAM_locate(params, OSSL_DRBG_PARAM_RESEED_REQUESTS);
 941     if (p != NULL && !OSSL_PARAM_set_uint(p, drbg->reseed_interval))
 942         return 0;
 943
 944     p = OSSL_PARAM_locate(params, OSSL_DRBG_PARAM_RESEED_TIME);
 945     if (p != NULL && !OSSL_PARAM_set_time_t(p, drbg->reseed_time))
 946         return 0;
 947
 948     p = OSSL_PARAM_locate(params, OSSL_DRBG_PARAM_RESEED_TIME_INTERVAL);
 949     if (p != NULL && !OSSL_PARAM_set_time_t(p, drbg->reseed_time_interval))
 950         return 0;
 951
 952     p = OSSL_PARAM_locate(params, OSSL_DRBG_PARAM_RESEED_COUNTER);
 953     if (p != NULL
 954             && !OSSL_PARAM_set_uint(p, tsan_load(&drbg->reseed_counter)))
 955         return 0;
 956     return 1;
 957 }
 958
 959 int drbg_set_ctx_params(PROV_DRBG *drbg, const OSSL_PARAM params[])
 960 {
 961     const OSSL_PARAM *p;
 962
 963     p = OSSL_PARAM_locate_const(params, OSSL_DRBG_PARAM_RESEED_REQUESTS);
 964     if (p != NULL && !OSSL_PARAM_get_uint(p, &drbg->reseed_interval))
 965         return 0;
 966
 967     p = OSSL_PARAM_locate_const(params, OSSL_DRBG_PARAM_RESEED_TIME_INTERVAL);
 968     if (p != NULL && !OSSL_PARAM_get_time_t(p, &drbg->reseed_time_interval))
 969         return 0;
 970     return 1;
 971 }