2 * Copyright 2011-2020 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
11 #include <openssl/crypto.h>
12 #include <openssl/err.h>
13 #include <openssl/rand.h>
14 #include <openssl/evp.h>
15 #include "crypto/rand.h"
16 #include "drbg_local.h"
17 #include "internal/thread_once.h"
18 #include "crypto/cryptlib.h"
19 #include "prov/seeding.h"
20 #include "prov/rand_pool.h"
21 #include "prov/provider_ctx.h"
22 #include "prov/providercommonerr.h"
23 #include "prov/providercommon.h"
26 * Support framework for NIST SP 800-90A DRBG
28 * See manual page PROV_DRBG(7) for a general overview.
30 * The OpenSSL model is to have new and free functions, and that new
31 * does all initialization. That is not the NIST model, which has
32 * instantiation and un-instantiate, and re-use within a new/free
33 * lifecycle. (No doubt this comes from the desire to support hardware
34 * DRBG, where allocation of resources on something like an HSM is
35 * a much bigger deal than just re-setting an allocated resource.)
38 /* NIST SP 800-90A DRBG recommends the use of a personalization string. */
39 static const char ossl_pers_string[] = DRBG_DEFAULT_PERS_STRING;
41 static const OSSL_DISPATCH *find_call(const OSSL_DISPATCH *dispatch,
44 static int rand_drbg_restart(PROV_DRBG *drbg);
46 int drbg_lock(void *vctx)
48 PROV_DRBG *drbg = vctx;
50 if (drbg == NULL || drbg->lock == NULL)
52 return CRYPTO_THREAD_write_lock(drbg->lock);
55 void drbg_unlock(void *vctx)
57 PROV_DRBG *drbg = vctx;
59 if (drbg != NULL && drbg->lock != NULL)
60 CRYPTO_THREAD_unlock(drbg->lock);
63 static int drbg_lock_parent(PROV_DRBG *drbg)
65 void *parent = drbg->parent;
68 && drbg->parent_lock != NULL
69 && !drbg->parent_lock(parent)) {
70 ERR_raise(ERR_LIB_PROV, PROV_R_PARENT_LOCKING_NOT_ENABLED);
76 static void drbg_unlock_parent(PROV_DRBG *drbg)
78 void *parent = drbg->parent;
80 if (parent != NULL && drbg->parent_unlock != NULL)
81 drbg->parent_unlock(parent);
84 static int get_parent_strength(PROV_DRBG *drbg, unsigned int *str)
86 OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
87 void *parent = drbg->parent;
90 if (drbg->parent_get_ctx_params == NULL) {
91 ERR_raise(ERR_LIB_PROV, PROV_R_UNABLE_TO_GET_PARENT_STRENGTH);
95 *params = OSSL_PARAM_construct_uint(OSSL_RAND_PARAM_STRENGTH, str);
96 if (!drbg_lock_parent(drbg)) {
97 ERR_raise(ERR_LIB_PROV, PROV_R_UNABLE_TO_LOCK_PARENT);
100 res = drbg->parent_get_ctx_params(parent, params);
101 drbg_unlock_parent(drbg);
103 ERR_raise(ERR_LIB_PROV, PROV_R_UNABLE_TO_GET_PARENT_STRENGTH);
109 static unsigned int get_parent_reseed_count(PROV_DRBG *drbg)
111 OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
112 void *parent = drbg->parent;
115 *params = OSSL_PARAM_construct_uint(OSSL_DRBG_PARAM_RESEED_COUNTER, &r);
116 if (!drbg_lock_parent(drbg)) {
117 ERR_raise(ERR_LIB_PROV, PROV_R_UNABLE_TO_LOCK_PARENT);
120 if (!drbg->parent_get_ctx_params(parent, params)) {
121 drbg_unlock_parent(drbg);
122 ERR_raise(ERR_LIB_PROV, PROV_R_UNABLE_TO_GET_RESEED_PROP_CTR);
125 drbg_unlock_parent(drbg);
129 r = tsan_load(&drbg->reseed_counter) - 2;
136 * Implements the get_entropy() callback
138 * If the DRBG has a parent, then the required amount of entropy input
139 * is fetched using the parent's ossl_prov_drbg_generate().
141 * Otherwise, the entropy is polled from the system entropy sources
142 * using prov_pool_acquire_entropy().
144 * If a random pool has been added to the DRBG using RAND_add(), then
145 * its entropy will be used up first.
147 static size_t prov_drbg_get_entropy(PROV_DRBG *drbg, unsigned char **pout,
148 int entropy, size_t min_len,
149 size_t max_len, int prediction_resistance)
152 size_t entropy_available = 0;
156 if (drbg->parent != NULL) {
157 if (!get_parent_strength(drbg, &p_str))
159 if (drbg->strength > p_str) {
161 * We currently don't support the algorithm from NIST SP 800-90C
162 * 10.1.2 to use a weaker DRBG as source
164 ERR_raise(ERR_LIB_RAND, PROV_R_PARENT_STRENGTH_TOO_WEAK);
169 if (drbg->seed_pool != NULL) {
170 pool = drbg->seed_pool;
171 pool->entropy_requested = entropy;
173 pool = rand_pool_new(entropy, 1, min_len, max_len);
175 ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE);
180 if (drbg->parent != NULL) {
181 size_t bytes_needed = rand_pool_bytes_needed(pool, 1 /*entropy_factor*/);
182 unsigned char *buffer = rand_pool_add_begin(pool, bytes_needed);
184 if (buffer != NULL) {
187 if (drbg->parent_generate == NULL)
190 * Our lock is already held, but we need to lock our parent before
191 * generating bits from it. (Note: taking the lock will be a no-op
192 * if locking if drbg->parent->lock == NULL.)
194 drbg_lock_parent(drbg);
196 * Get random data from parent. Include our DRBG address as
197 * additional input, in order to provide a distinction between
198 * different DRBG child instances.
200 * Note: using the sizeof() operator on a pointer triggers
201 * a warning in some static code analyzers, but it's
202 * intentional and correct here.
204 if (drbg->parent_generate(drbg->parent, buffer, bytes_needed,
205 drbg->strength, prediction_resistance,
206 (unsigned char *)&drbg,
208 bytes = bytes_needed;
209 drbg_unlock_parent(drbg);
210 drbg->parent_reseed_counter = get_parent_reseed_count(drbg);
212 rand_pool_add_end(pool, bytes, 8 * bytes);
213 entropy_available = rand_pool_entropy_available(pool);
216 /* Get entropy by polling system entropy sources. */
217 entropy_available = prov_pool_acquire_entropy(pool);
220 if (entropy_available > 0) {
221 ret = rand_pool_length(pool);
222 *pout = rand_pool_detach(pool);
226 if (drbg->seed_pool == NULL)
227 rand_pool_free(pool);
232 * Implements the cleanup_entropy() callback
235 static void prov_drbg_cleanup_entropy(PROV_DRBG *drbg,
236 unsigned char *out, size_t outlen)
238 if (drbg->seed_pool == NULL) {
239 OPENSSL_secure_clear_free(out, outlen);
243 static size_t get_entropy(PROV_DRBG *drbg, unsigned char **pout, int entropy,
244 size_t min_len, size_t max_len,
245 int prediction_resistance)
248 if (drbg->parent == NULL)
249 return prov_crngt_get_entropy(drbg, pout, entropy, min_len, max_len,
250 prediction_resistance);
253 return prov_drbg_get_entropy(drbg, pout, entropy, min_len, max_len,
254 prediction_resistance);
257 static void cleanup_entropy(PROV_DRBG *drbg, unsigned char *out, size_t outlen)
260 if (drbg->parent == NULL)
261 prov_crngt_cleanup_entropy(drbg, out, outlen);
264 prov_drbg_cleanup_entropy(drbg, out, outlen);
267 #ifndef PROV_RAND_GET_RANDOM_NONCE
268 typedef struct prov_drbg_nonce_global_st {
269 CRYPTO_RWLOCK *rand_nonce_lock;
270 int rand_nonce_count;
271 } PROV_DRBG_NONCE_GLOBAL;
274 * drbg_ossl_ctx_new() calls drgb_setup() which calls rand_drbg_get_nonce()
275 * which needs to get the rand_nonce_lock out of the OSSL_LIB_CTX...but since
276 * drbg_ossl_ctx_new() hasn't finished running yet we need the rand_nonce_lock
277 * to be in a different global data object. Otherwise we will go into an
278 * infinite recursion loop.
280 static void *prov_drbg_nonce_ossl_ctx_new(OSSL_LIB_CTX *libctx)
282 PROV_DRBG_NONCE_GLOBAL *dngbl = OPENSSL_zalloc(sizeof(*dngbl));
287 dngbl->rand_nonce_lock = CRYPTO_THREAD_lock_new();
288 if (dngbl->rand_nonce_lock == NULL) {
296 static void prov_drbg_nonce_ossl_ctx_free(void *vdngbl)
298 PROV_DRBG_NONCE_GLOBAL *dngbl = vdngbl;
303 CRYPTO_THREAD_lock_free(dngbl->rand_nonce_lock);
308 static const OSSL_LIB_CTX_METHOD drbg_nonce_ossl_ctx_method = {
309 prov_drbg_nonce_ossl_ctx_new,
310 prov_drbg_nonce_ossl_ctx_free,
313 /* Get a nonce from the operating system */
314 static size_t prov_drbg_get_nonce(PROV_DRBG *drbg,
315 unsigned char **pout,
316 int entropy, size_t min_len, size_t max_len)
320 unsigned char *buf = NULL;
321 OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(drbg->provctx);
322 PROV_DRBG_NONCE_GLOBAL *dngbl
323 = ossl_lib_ctx_get_data(libctx, OSSL_LIB_CTX_DRBG_NONCE_INDEX,
324 &drbg_nonce_ossl_ctx_method);
333 if (drbg->parent != NULL) {
334 if (drbg->parent_nonce != NULL) {
335 n = drbg->parent_nonce(drbg->parent, NULL, 0, drbg->min_noncelen,
337 if (n > 0 && (buf = OPENSSL_malloc(n)) != NULL) {
338 ret = drbg->parent_nonce(drbg->parent, buf, 0,
350 /* Use the built in nonce source */
351 memset(&data, 0, sizeof(data));
352 pool = rand_pool_new(0, 0, min_len, max_len);
356 if (prov_pool_add_nonce_data(pool) == 0)
359 data.instance = drbg;
360 CRYPTO_atomic_add(&dngbl->rand_nonce_count, 1, &data.count,
361 dngbl->rand_nonce_lock);
363 if (rand_pool_add(pool, (unsigned char *)&data, sizeof(data), 0) == 0)
366 ret = rand_pool_length(pool);
367 *pout = rand_pool_detach(pool);
370 rand_pool_free(pool);
375 static void prov_drbg_clear_nonce(PROV_DRBG *drbg, unsigned char *nonce,
378 OPENSSL_clear_free(nonce, noncelen);
381 # define prov_drbg_clear_nonce(drbg, nonce, len) \
382 OPENSSL_clear_free((nonce), (len))
383 #endif /* PROV_RAND_GET_RANDOM_NONCE */
386 * Instantiate |drbg|, after it has been initialized. Use |pers| and
387 * |perslen| as prediction-resistance input.
389 * Requires that drbg->lock is already locked for write, if non-null.
391 * Returns 1 on success, 0 on failure.
393 int ossl_prov_drbg_instantiate(PROV_DRBG *drbg, unsigned int strength,
394 int prediction_resistance,
395 const unsigned char *pers, size_t perslen)
397 unsigned char *nonce = NULL, *entropy = NULL;
398 size_t noncelen = 0, entropylen = 0;
399 size_t min_entropy, min_entropylen, max_entropylen;
401 if (!ossl_prov_is_running())
404 if (strength > drbg->strength) {
405 ERR_raise(ERR_LIB_PROV, PROV_R_INSUFFICIENT_DRBG_STRENGTH);
408 min_entropy = drbg->strength;
409 min_entropylen = drbg->min_entropylen;
410 max_entropylen = drbg->max_entropylen;
413 pers = (const unsigned char *)ossl_pers_string;
414 perslen = sizeof(ossl_pers_string);
416 if (perslen > drbg->max_perslen) {
417 ERR_raise(ERR_LIB_PROV, PROV_R_PERSONALISATION_STRING_TOO_LONG);
421 if (drbg->state != EVP_RAND_STATE_UNINITIALISED) {
422 if (drbg->state == EVP_RAND_STATE_ERROR)
423 ERR_raise(ERR_LIB_PROV, PROV_R_IN_ERROR_STATE);
425 ERR_raise(ERR_LIB_PROV, PROV_R_ALREADY_INSTANTIATED);
429 drbg->state = EVP_RAND_STATE_ERROR;
431 if (drbg->min_noncelen > 0) {
432 if (drbg->parent_nonce != NULL) {
433 noncelen = drbg->parent_nonce(drbg->parent, NULL, drbg->strength,
437 ERR_raise(ERR_LIB_PROV, PROV_R_ERROR_RETRIEVING_NONCE);
440 nonce = OPENSSL_malloc(noncelen);
442 ERR_raise(ERR_LIB_PROV, PROV_R_ERROR_RETRIEVING_NONCE);
445 if (noncelen != drbg->parent_nonce(drbg->parent, nonce,
448 drbg->max_noncelen)) {
449 ERR_raise(ERR_LIB_PROV, PROV_R_ERROR_RETRIEVING_NONCE);
452 #ifndef PROV_RAND_GET_RANDOM_NONCE
453 } else if (drbg->parent != NULL) {
456 * NIST SP800-90Ar1 section 9.1 says you can combine getting
457 * the entropy and nonce in 1 call by increasing the entropy
458 * with 50% and increasing the minimum length to accommodate
459 * the length of the nonce. We do this in case a nonce is
460 * required and there is no parental nonce capability.
462 min_entropy += drbg->strength / 2;
463 min_entropylen += drbg->min_noncelen;
464 max_entropylen += drbg->max_noncelen;
466 #ifndef PROV_RAND_GET_RANDOM_NONCE
467 else { /* parent == NULL */
468 noncelen = prov_drbg_get_nonce(drbg, &nonce, drbg->strength / 2,
471 if (noncelen < drbg->min_noncelen
472 || noncelen > drbg->max_noncelen) {
473 ERR_raise(ERR_LIB_PROV, PROV_R_ERROR_RETRIEVING_NONCE);
480 drbg->reseed_next_counter = tsan_load(&drbg->reseed_counter);
481 if (drbg->reseed_next_counter) {
482 drbg->reseed_next_counter++;
483 if (!drbg->reseed_next_counter)
484 drbg->reseed_next_counter = 1;
487 entropylen = get_entropy(drbg, &entropy, min_entropy,
488 min_entropylen, max_entropylen,
489 prediction_resistance);
490 if (entropylen < min_entropylen
491 || entropylen > max_entropylen) {
492 ERR_raise(ERR_LIB_PROV, PROV_R_ERROR_RETRIEVING_ENTROPY);
496 if (!drbg->instantiate(drbg, entropy, entropylen, nonce, noncelen,
498 ERR_raise(ERR_LIB_PROV, PROV_R_ERROR_INSTANTIATING_DRBG);
502 drbg->state = EVP_RAND_STATE_READY;
503 drbg->generate_counter = 1;
504 drbg->reseed_time = time(NULL);
505 tsan_store(&drbg->reseed_counter, drbg->reseed_next_counter);
509 cleanup_entropy(drbg, entropy, entropylen);
510 prov_drbg_clear_nonce(drbg, nonce, noncelen);
511 if (drbg->state == EVP_RAND_STATE_READY)
517 * Uninstantiate |drbg|. Must be instantiated before it can be used.
519 * Requires that drbg->lock is already locked for write, if non-null.
521 * Returns 1 on success, 0 on failure.
523 int ossl_prov_drbg_uninstantiate(PROV_DRBG *drbg)
525 drbg->state = EVP_RAND_STATE_UNINITIALISED;
530 * Reseed |drbg|, mixing in the specified data
532 * Requires that drbg->lock is already locked for write, if non-null.
534 * Returns 1 on success, 0 on failure.
536 int ossl_prov_drbg_reseed(PROV_DRBG *drbg, int prediction_resistance,
537 const unsigned char *ent, size_t ent_len,
538 const unsigned char *adin, size_t adinlen)
540 unsigned char *entropy = NULL;
541 size_t entropylen = 0;
543 if (!ossl_prov_is_running())
546 if (drbg->state != EVP_RAND_STATE_READY) {
547 /* try to recover from previous errors */
548 rand_drbg_restart(drbg);
550 if (drbg->state == EVP_RAND_STATE_ERROR) {
551 ERR_raise(ERR_LIB_PROV, PROV_R_IN_ERROR_STATE);
554 if (drbg->state == EVP_RAND_STATE_UNINITIALISED) {
555 ERR_raise(ERR_LIB_PROV, PROV_R_NOT_INSTANTIATED);
561 if (ent_len < drbg->min_entropylen) {
562 ERR_raise(ERR_LIB_RAND, RAND_R_ENTROPY_OUT_OF_RANGE);
563 drbg->state = EVP_RAND_STATE_ERROR;
566 if (ent_len > drbg->max_entropylen) {
567 ERR_raise(ERR_LIB_RAND, RAND_R_ENTROPY_INPUT_TOO_LONG);
568 drbg->state = EVP_RAND_STATE_ERROR;
575 } else if (adinlen > drbg->max_adinlen) {
576 ERR_raise(ERR_LIB_PROV, PROV_R_ADDITIONAL_INPUT_TOO_LONG);
580 drbg->state = EVP_RAND_STATE_ERROR;
582 drbg->reseed_next_counter = tsan_load(&drbg->reseed_counter);
583 if (drbg->reseed_next_counter) {
584 drbg->reseed_next_counter++;
585 if (!drbg->reseed_next_counter)
586 drbg->reseed_next_counter = 1;
592 * NIST SP-800-90A mandates that entropy *shall not* be provided
593 * by the consuming application. Instead the data is added as additional
596 * (NIST SP-800-90Ar1, Sections 9.1 and 9.2)
598 if (!drbg->reseed(drbg, NULL, 0, ent, ent_len)) {
599 ERR_raise(ERR_LIB_PROV, PROV_R_UNABLE_TO_RESEED);
603 if (!drbg->reseed(drbg, ent, ent_len, adin, adinlen)) {
604 ERR_raise(ERR_LIB_PROV, PROV_R_UNABLE_TO_RESEED);
607 /* There isn't much point adding the same additional input twice */
613 /* Reseed using our sources in addition */
614 entropylen = get_entropy(drbg, &entropy, drbg->strength,
615 drbg->min_entropylen, drbg->max_entropylen,
616 prediction_resistance);
617 if (entropylen < drbg->min_entropylen
618 || entropylen > drbg->max_entropylen) {
619 ERR_raise(ERR_LIB_PROV, PROV_R_ERROR_RETRIEVING_ENTROPY);
623 if (!drbg->reseed(drbg, entropy, entropylen, adin, adinlen))
626 drbg->state = EVP_RAND_STATE_READY;
627 drbg->generate_counter = 1;
628 drbg->reseed_time = time(NULL);
629 tsan_store(&drbg->reseed_counter, drbg->reseed_next_counter);
630 if (drbg->parent != NULL)
631 drbg->parent_reseed_counter = get_parent_reseed_count(drbg);
634 cleanup_entropy(drbg, entropy, entropylen);
635 if (drbg->state == EVP_RAND_STATE_READY)
641 * Generate |outlen| bytes into the buffer at |out|. Reseed if we need
642 * to or if |prediction_resistance| is set. Additional input can be
643 * sent in |adin| and |adinlen|.
645 * Requires that drbg->lock is already locked for write, if non-null.
647 * Returns 1 on success, 0 on failure.
650 int ossl_prov_drbg_generate(PROV_DRBG *drbg, unsigned char *out, size_t outlen,
651 unsigned int strength, int prediction_resistance,
652 const unsigned char *adin, size_t adinlen)
655 int reseed_required = 0;
657 if (!ossl_prov_is_running())
660 if (drbg->state != EVP_RAND_STATE_READY) {
661 /* try to recover from previous errors */
662 rand_drbg_restart(drbg);
664 if (drbg->state == EVP_RAND_STATE_ERROR) {
665 ERR_raise(ERR_LIB_PROV, PROV_R_IN_ERROR_STATE);
668 if (drbg->state == EVP_RAND_STATE_UNINITIALISED) {
669 ERR_raise(ERR_LIB_PROV, PROV_R_NOT_INSTANTIATED);
673 if (strength > drbg->strength) {
674 ERR_raise(ERR_LIB_PROV, PROV_R_INSUFFICIENT_DRBG_STRENGTH);
678 if (outlen > drbg->max_request) {
679 ERR_raise(ERR_LIB_PROV, PROV_R_REQUEST_TOO_LARGE_FOR_DRBG);
682 if (adinlen > drbg->max_adinlen) {
683 ERR_raise(ERR_LIB_PROV, PROV_R_ADDITIONAL_INPUT_TOO_LONG);
687 fork_id = openssl_get_fork_id();
689 if (drbg->fork_id != fork_id) {
690 drbg->fork_id = fork_id;
694 if (drbg->reseed_interval > 0) {
695 if (drbg->generate_counter >= drbg->reseed_interval)
698 if (drbg->reseed_time_interval > 0) {
699 time_t now = time(NULL);
700 if (now < drbg->reseed_time
701 || now - drbg->reseed_time >= drbg->reseed_time_interval)
704 if (drbg->parent != NULL
705 && get_parent_reseed_count(drbg) != drbg->parent_reseed_counter)
708 if (reseed_required || prediction_resistance) {
709 if (!ossl_prov_drbg_reseed(drbg, prediction_resistance, NULL, 0,
711 ERR_raise(ERR_LIB_PROV, PROV_R_RESEED_ERROR);
718 if (!drbg->generate(drbg, out, outlen, adin, adinlen)) {
719 drbg->state = EVP_RAND_STATE_ERROR;
720 ERR_raise(ERR_LIB_PROV, PROV_R_GENERATE_ERROR);
724 drbg->generate_counter++;
730 * Restart |drbg|, using the specified entropy or additional input
732 * Tries its best to get the drbg instantiated by all means,
733 * regardless of its current state.
735 * Optionally, a |buffer| of |len| random bytes can be passed,
736 * which is assumed to contain at least |entropy| bits of entropy.
738 * If |entropy| > 0, the buffer content is used as entropy input.
740 * If |entropy| == 0, the buffer content is used as additional input
742 * Returns 1 on success, 0 on failure.
744 * This function is used internally only.
746 static int rand_drbg_restart(PROV_DRBG *drbg)
748 if (drbg->seed_pool != NULL) {
749 drbg->state = EVP_RAND_STATE_ERROR;
750 rand_pool_free(drbg->seed_pool);
751 drbg->seed_pool = NULL;
752 ERR_raise(ERR_LIB_RAND, ERR_R_INTERNAL_ERROR);
756 /* repair error state */
757 if (drbg->state == EVP_RAND_STATE_ERROR)
758 drbg->uninstantiate(drbg);
760 /* repair uninitialized state */
761 if (drbg->state == EVP_RAND_STATE_UNINITIALISED)
762 /* reinstantiate drbg */
763 ossl_prov_drbg_instantiate(drbg, drbg->strength, 0, NULL, 0);
765 rand_pool_free(drbg->seed_pool);
766 drbg->seed_pool = NULL;
767 return drbg->state == EVP_RAND_STATE_READY;
770 /* Provider support from here down */
771 static const OSSL_DISPATCH *find_call(const OSSL_DISPATCH *dispatch,
774 if (dispatch != NULL)
775 while (dispatch->function_id != 0) {
776 if (dispatch->function_id == function)
783 int drbg_enable_locking(void *vctx)
785 PROV_DRBG *drbg = vctx;
787 if (drbg != NULL && drbg->lock == NULL) {
788 if (drbg->parent_enable_locking != NULL)
789 if (!drbg->parent_enable_locking(drbg->parent)) {
790 ERR_raise(ERR_LIB_PROV, PROV_R_PARENT_LOCKING_NOT_ENABLED);
793 drbg->lock = CRYPTO_THREAD_lock_new();
794 if (drbg->lock == NULL) {
795 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_CREATE_LOCK);
803 * Allocate memory and initialize a new DRBG. The DRBG is allocated on
804 * the secure heap if |secure| is nonzero and the secure heap is enabled.
805 * The |parent|, if not NULL, will be used as random source for reseeding.
806 * This also requires the parent's provider context and the parent's lock.
808 * Returns a pointer to the new DRBG instance on success, NULL on failure.
810 PROV_DRBG *prov_rand_drbg_new
811 (void *provctx, void *parent, const OSSL_DISPATCH *p_dispatch,
812 int (*dnew)(PROV_DRBG *ctx),
813 int (*instantiate)(PROV_DRBG *drbg,
814 const unsigned char *entropy, size_t entropylen,
815 const unsigned char *nonce, size_t noncelen,
816 const unsigned char *pers, size_t perslen),
817 int (*uninstantiate)(PROV_DRBG *ctx),
818 int (*reseed)(PROV_DRBG *drbg, const unsigned char *ent, size_t ent_len,
819 const unsigned char *adin, size_t adin_len),
820 int (*generate)(PROV_DRBG *, unsigned char *out, size_t outlen,
821 const unsigned char *adin, size_t adin_len))
825 const OSSL_DISPATCH *pfunc;
827 if (!ossl_prov_is_running())
830 drbg = OPENSSL_zalloc(sizeof(*drbg));
832 ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE);
836 drbg->provctx = provctx;
837 drbg->instantiate = instantiate;
838 drbg->uninstantiate = uninstantiate;
839 drbg->reseed = reseed;
840 drbg->generate = generate;
841 drbg->fork_id = openssl_get_fork_id();
843 /* Extract parent's functions */
844 drbg->parent = parent;
845 if ((pfunc = find_call(p_dispatch, OSSL_FUNC_RAND_ENABLE_LOCKING)) != NULL)
846 drbg->parent_enable_locking = OSSL_FUNC_rand_enable_locking(pfunc);
847 if ((pfunc = find_call(p_dispatch, OSSL_FUNC_RAND_LOCK)) != NULL)
848 drbg->parent_lock = OSSL_FUNC_rand_lock(pfunc);
849 if ((pfunc = find_call(p_dispatch, OSSL_FUNC_RAND_UNLOCK)) != NULL)
850 drbg->parent_unlock = OSSL_FUNC_rand_unlock(pfunc);
851 if ((pfunc = find_call(p_dispatch, OSSL_FUNC_RAND_GET_CTX_PARAMS)) != NULL)
852 drbg->parent_get_ctx_params = OSSL_FUNC_rand_get_ctx_params(pfunc);
853 if ((pfunc = find_call(p_dispatch, OSSL_FUNC_RAND_GENERATE)) != NULL)
854 drbg->parent_generate = OSSL_FUNC_rand_generate(pfunc);
855 if ((pfunc = find_call(p_dispatch, OSSL_FUNC_RAND_NONCE)) != NULL)
856 drbg->parent_nonce = OSSL_FUNC_rand_nonce(pfunc);
858 /* Set some default maximums up */
859 drbg->max_entropylen = DRBG_MAX_LENGTH;
860 drbg->max_noncelen = DRBG_MAX_LENGTH;
861 drbg->max_perslen = DRBG_MAX_LENGTH;
862 drbg->max_adinlen = DRBG_MAX_LENGTH;
863 drbg->generate_counter = 1;
864 drbg->reseed_counter = 1;
865 drbg->reseed_interval = RESEED_INTERVAL;
866 drbg->reseed_time_interval = TIME_INTERVAL;
871 if (parent != NULL) {
872 if (!get_parent_strength(drbg, &p_str))
874 if (drbg->strength > p_str) {
876 * We currently don't support the algorithm from NIST SP 800-90C
877 * 10.1.2 to use a weaker DRBG as source
879 ERR_raise(ERR_LIB_PROV, PROV_R_PARENT_STRENGTH_TOO_WEAK);
886 prov_rand_drbg_free(drbg);
890 void prov_rand_drbg_free(PROV_DRBG *drbg)
895 rand_pool_free(drbg->adin_pool);
896 CRYPTO_THREAD_lock_free(drbg->lock);
900 int drbg_get_ctx_params(PROV_DRBG *drbg, OSSL_PARAM params[])
904 p = OSSL_PARAM_locate(params, OSSL_RAND_PARAM_STATE);
905 if (p != NULL && !OSSL_PARAM_set_int(p, drbg->state))
908 p = OSSL_PARAM_locate(params, OSSL_RAND_PARAM_STRENGTH);
909 if (p != NULL && !OSSL_PARAM_set_int(p, drbg->strength))
912 p = OSSL_PARAM_locate(params, OSSL_DRBG_PARAM_MAX_REQUEST);
913 if (p != NULL && !OSSL_PARAM_set_size_t(p, drbg->max_request))
916 p = OSSL_PARAM_locate(params, OSSL_DRBG_PARAM_MIN_ENTROPYLEN);
917 if (p != NULL && !OSSL_PARAM_set_size_t(p, drbg->min_entropylen))
920 p = OSSL_PARAM_locate(params, OSSL_DRBG_PARAM_MAX_ENTROPYLEN);
921 if (p != NULL && !OSSL_PARAM_set_size_t(p, drbg->max_entropylen))
924 p = OSSL_PARAM_locate(params, OSSL_DRBG_PARAM_MIN_NONCELEN);
925 if (p != NULL && !OSSL_PARAM_set_size_t(p, drbg->min_noncelen))
928 p = OSSL_PARAM_locate(params, OSSL_DRBG_PARAM_MAX_NONCELEN);
929 if (p != NULL && !OSSL_PARAM_set_size_t(p, drbg->max_noncelen))
932 p = OSSL_PARAM_locate(params, OSSL_DRBG_PARAM_MAX_PERSLEN);
933 if (p != NULL && !OSSL_PARAM_set_size_t(p, drbg->max_perslen))
936 p = OSSL_PARAM_locate(params, OSSL_DRBG_PARAM_MAX_ADINLEN);
937 if (p != NULL && !OSSL_PARAM_set_size_t(p, drbg->max_adinlen))
940 p = OSSL_PARAM_locate(params, OSSL_DRBG_PARAM_RESEED_REQUESTS);
941 if (p != NULL && !OSSL_PARAM_set_uint(p, drbg->reseed_interval))
944 p = OSSL_PARAM_locate(params, OSSL_DRBG_PARAM_RESEED_TIME);
945 if (p != NULL && !OSSL_PARAM_set_time_t(p, drbg->reseed_time))
948 p = OSSL_PARAM_locate(params, OSSL_DRBG_PARAM_RESEED_TIME_INTERVAL);
949 if (p != NULL && !OSSL_PARAM_set_time_t(p, drbg->reseed_time_interval))
952 p = OSSL_PARAM_locate(params, OSSL_DRBG_PARAM_RESEED_COUNTER);
954 && !OSSL_PARAM_set_uint(p, tsan_load(&drbg->reseed_counter)))
959 int drbg_set_ctx_params(PROV_DRBG *drbg, const OSSL_PARAM params[])
963 p = OSSL_PARAM_locate_const(params, OSSL_DRBG_PARAM_RESEED_REQUESTS);
964 if (p != NULL && !OSSL_PARAM_get_uint(p, &drbg->reseed_interval))
967 p = OSSL_PARAM_locate_const(params, OSSL_DRBG_PARAM_RESEED_TIME_INTERVAL);
968 if (p != NULL && !OSSL_PARAM_get_time_t(p, &drbg->reseed_time_interval))