2017-06-27 16:04:37 +00:00
|
|
|
/*
|
2018-01-09 04:49:01 +00:00
|
|
|
* Copyright 2011-2018 The OpenSSL Project Authors. All Rights Reserved.
|
2017-06-27 16:04:37 +00:00
|
|
|
*
|
|
|
|
* Licensed under the OpenSSL license (the "License"). You may not use
|
|
|
|
* this file except in compliance with the License. You can obtain a copy
|
|
|
|
* in the file LICENSE in the source distribution or at
|
|
|
|
* https://www.openssl.org/source/license.html
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <string.h>
|
|
|
|
#include <openssl/crypto.h>
|
|
|
|
#include <openssl/err.h>
|
|
|
|
#include <openssl/rand.h>
|
|
|
|
#include "rand_lcl.h"
|
2017-08-27 15:46:33 +00:00
|
|
|
#include "internal/thread_once.h"
|
|
|
|
#include "internal/rand_int.h"
|
2017-06-27 16:04:37 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Support framework for NIST SP 800-90A DRBG, AES-CTR mode.
|
2017-08-03 13:23:28 +00:00
|
|
|
* The RAND_DRBG is OpenSSL's pointer to an instance of the DRBG.
|
|
|
|
*
|
2017-06-27 16:04:37 +00:00
|
|
|
* The OpenSSL model is to have new and free functions, and that new
|
|
|
|
* does all initialization. That is not the NIST model, which has
|
|
|
|
* instantiation and un-instantiate, and re-use within a new/free
|
|
|
|
* lifecycle. (No doubt this comes from the desire to support hardware
|
|
|
|
* DRBG, where allocation of resources on something like an HSM is
|
|
|
|
* a much bigger deal than just re-setting an allocated resource.)
|
|
|
|
*/
|
|
|
|
|
2017-11-24 13:59:58 +00:00
|
|
|
/*
|
|
|
|
* THE THREE SHARED DRBGs
|
|
|
|
*
|
|
|
|
* There are three shared DRBGs (master, public and private), which are
|
|
|
|
* accessed concurrently by all threads.
|
|
|
|
*
|
|
|
|
* THE MASTER DRBG
|
|
|
|
*
|
|
|
|
* Not used directly by the application, only for reseeding the two other
|
|
|
|
* DRBGs. It reseeds itself by pulling either randomness from os entropy
|
|
|
|
* sources or by consuming randomnes which was added by RAND_add()
|
|
|
|
*/
|
2017-11-06 01:29:15 +00:00
|
|
|
static RAND_DRBG *drbg_master;
|
2017-11-24 13:59:58 +00:00
|
|
|
/*
|
|
|
|
* THE PUBLIC DRBG
|
|
|
|
*
|
|
|
|
* Used by default for generating random bytes using RAND_bytes().
|
|
|
|
*/
|
2017-11-06 01:29:15 +00:00
|
|
|
static RAND_DRBG *drbg_public;
|
2017-11-24 13:59:58 +00:00
|
|
|
/*
|
|
|
|
* THE PRIVATE DRBG
|
|
|
|
*
|
|
|
|
* Used by default for generating private keys using RAND_priv_bytes()
|
|
|
|
*/
|
2017-11-06 01:29:15 +00:00
|
|
|
static RAND_DRBG *drbg_private;
|
2017-11-24 13:59:58 +00:00
|
|
|
/*+
|
|
|
|
* DRBG HIERARCHY
|
|
|
|
*
|
|
|
|
* In addition there are DRBGs, which are not shared, but used only by a
|
|
|
|
* single thread at every time, for example the DRBGs which are owned by
|
|
|
|
* an SSL context. All DRBGs are organized in a hierarchical fashion
|
|
|
|
* with the <master> DRBG as root.
|
|
|
|
*
|
|
|
|
* This gives the following overall picture:
|
|
|
|
*
|
|
|
|
* <os entropy sources>
|
|
|
|
* |
|
|
|
|
* RAND_add() ==> <master> \
|
|
|
|
* / \ | shared DRBGs (with locking)
|
|
|
|
* <public> <private> /
|
|
|
|
* |
|
|
|
|
* <ssl> owned by an SSL context
|
|
|
|
*
|
|
|
|
* AUTOMATIC RESEEDING
|
|
|
|
*
|
2017-11-24 14:24:51 +00:00
|
|
|
* Before satisfying a generate request, a DRBG reseeds itself automatically,
|
|
|
|
* if one of the following two conditions holds:
|
|
|
|
*
|
|
|
|
* - the number of generate requests since the last reseeding exceeds a
|
|
|
|
* certain threshold, the so called |reseed_interval|. This behaviour
|
|
|
|
* can be disabled by setting the |reseed_interval| to 0.
|
|
|
|
*
|
|
|
|
* - the time elapsed since the last reseeding exceeds a certain time
|
|
|
|
* interval, the so called |reseed_time_interval|. This behaviour
|
|
|
|
* can be disabled by setting the |reseed_time_interval| to 0.
|
2017-11-24 13:59:58 +00:00
|
|
|
*
|
|
|
|
* MANUAL RESEEDING
|
|
|
|
*
|
2017-11-24 14:24:51 +00:00
|
|
|
* For the three shared DRBGs (and only for these) there is another way to
|
|
|
|
* reseed them manually by calling RAND_seed() (or RAND_add() with a positive
|
2017-11-24 13:59:58 +00:00
|
|
|
* |randomness| argument). This will immediately reseed the <master> DRBG.
|
2017-11-24 14:24:51 +00:00
|
|
|
* The <public> and <private> DRBG will detect this on their next generate
|
|
|
|
* call and reseed, pulling randomness from <master>.
|
2018-02-08 15:40:32 +00:00
|
|
|
*
|
|
|
|
* LOCKING
|
|
|
|
*
|
|
|
|
* The three shared DRBGs are intended to be used concurrently, so they
|
2018-02-15 09:29:56 +00:00
|
|
|
* support locking. The RAND methods take the locks automatically, so using
|
|
|
|
* the RAND api (in particular RAND_bytes() and RAND_priv_bytes()) is
|
|
|
|
* thread-safe. Note however that accessing the shared DRBGs directly via
|
|
|
|
* the RAND_DRBG interface is *not* thread-safe.
|
|
|
|
*
|
|
|
|
* All other DRBG instances don't support locking, because they are
|
|
|
|
* intendended to be used by a single thread. Instead of accessing a single
|
|
|
|
* DRBG instance concurrently from different threads, it is recommended to
|
|
|
|
* instantiate a separate DRBG instance per thread. Using the same shared
|
|
|
|
* DRBG (preferrably the public DRBG) as parent of DRBG instances on
|
|
|
|
* different threads is safe.
|
2017-11-24 13:59:58 +00:00
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
|
|
/* NIST SP 800-90A DRBG recommends the use of a personalization string. */
|
|
|
|
static const char ossl_pers_string[] = "OpenSSL NIST SP 800-90A DRBG";
|
|
|
|
|
2017-08-31 21:16:22 +00:00
|
|
|
static CRYPTO_ONCE rand_drbg_init = CRYPTO_ONCE_STATIC_INIT;
|
|
|
|
|
Revert the crypto "global lock" implementation
Conceptually, this is a squashed version of:
Revert "Address feedback"
This reverts commit 75551e07bd2339dfea06ef1d31d69929e13a4495.
and
Revert "Add CRYPTO_thread_glock_new"
This reverts commit ed6b2c7938ec6f07b15745d4183afc276e74c6dd.
But there were some intervening commits that made neither revert apply
cleanly, so instead do it all as one shot.
The crypto global locks were an attempt to cope with the awkward
POSIX semantics for pthread_atfork(); its documentation (the "RATIONALE"
section) indicates that the expected usage is to have the prefork handler
lock all "global" locks, and the parent and child handlers release those
locks, to ensure that forking happens with a consistent (lock) state.
However, the set of functions available in the child process is limited
to async-signal-safe functions, and pthread_mutex_unlock() is not on
the list of async-signal-safe functions! The only synchronization
primitives that are async-signal-safe are the semaphore primitives,
which are not really appropriate for general-purpose usage.
However, the state consistency problem that the global locks were
attempting to solve is not actually a serious problem, particularly for
OpenSSL. That is, we can consider four cases of forking application
that might use OpenSSL:
(1) Single-threaded, does not call into OpenSSL in the child (e.g.,
the child calls exec() immediately)
For this class of process, no locking is needed at all, since there is
only ever a single thread of execution and the only reentrancy is due to
signal handlers (which are themselves limited to async-signal-safe
operation and should not be doing much work at all).
(2) Single-threaded, calls into OpenSSL after fork()
The application must ensure that it does not fork() with an unexpected
lock held (that is, one that would get unlocked in the parent but
accidentally remain locked in the child and cause deadlock). Since
OpenSSL does not expose any of its internal locks to the application
and the application is single-threaded, the OpenSSL internal locks
will be unlocked for the fork(), and the state will be consistent.
(OpenSSL will need to reseed its PRNG in the child, but that is
an orthogonal issue.) If the application makes use of locks from
libcrypto, proper handling for those locks is the responsibility of
the application, as for any other locking primitive that is available
for application programming.
(3) Multi-threaded, does not call into OpenSSL after fork()
As for (1), the OpenSSL state is only relevant in the parent, so
no particular fork()-related handling is needed. The internal locks
are relevant, but there is no interaction with the child to consider.
(4) Multi-threaded, calls into OpenSSL after fork()
This is the case where the pthread_atfork() hooks to ensure that all
global locks are in a known state across fork() would come into play,
per the above discussion. However, these "calls into OpenSSL after
fork()" are still subject to the restriction to async-signal-safe
functions. Since OpenSSL uses all sorts of locking and libc functions
that are not on the list of safe functions (e.g., malloc()), this
case is not currently usable and is unlikely to ever be usable,
independently of the locking situation. So, there is no need to
go through contortions to attempt to support this case in the one small
area of locking interaction with fork().
In light of the above analysis (thanks @davidben and @achernya), go
back to the simpler implementation that does not need to distinguish
"library-global" locks or to have complicated atfork handling for locks.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/5089)
2018-01-16 15:49:54 +00:00
|
|
|
static RAND_DRBG *drbg_setup(RAND_DRBG *parent);
|
2018-02-08 21:46:23 +00:00
|
|
|
|
|
|
|
static RAND_DRBG *rand_drbg_new(int secure,
|
|
|
|
int type,
|
|
|
|
unsigned int flags,
|
|
|
|
RAND_DRBG *parent);
|
2017-08-27 15:46:33 +00:00
|
|
|
|
2017-06-27 16:04:37 +00:00
|
|
|
/*
|
2017-08-03 13:23:28 +00:00
|
|
|
* Set/initialize |drbg| to be of type |nid|, with optional |flags|.
|
2017-11-20 22:27:23 +00:00
|
|
|
*
|
|
|
|
* Returns 1 on success, 0 on failure.
|
2017-06-27 16:04:37 +00:00
|
|
|
*/
|
2017-08-03 13:23:28 +00:00
|
|
|
int RAND_DRBG_set(RAND_DRBG *drbg, int nid, unsigned int flags)
|
2017-06-27 16:04:37 +00:00
|
|
|
{
|
|
|
|
int ret = 1;
|
|
|
|
|
2017-08-03 13:23:28 +00:00
|
|
|
drbg->state = DRBG_UNINITIALISED;
|
|
|
|
drbg->flags = flags;
|
|
|
|
drbg->nid = nid;
|
2017-06-27 16:04:37 +00:00
|
|
|
|
|
|
|
switch (nid) {
|
|
|
|
default:
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_SET, RAND_R_UNSUPPORTED_DRBG_TYPE);
|
2017-11-20 22:27:23 +00:00
|
|
|
return 0;
|
2017-06-27 16:04:37 +00:00
|
|
|
case 0:
|
|
|
|
/* Uninitialized; that's okay. */
|
|
|
|
return 1;
|
|
|
|
case NID_aes_128_ctr:
|
|
|
|
case NID_aes_192_ctr:
|
|
|
|
case NID_aes_256_ctr:
|
2017-12-28 20:42:14 +00:00
|
|
|
ret = drbg_ctr_init(drbg);
|
2017-06-27 16:04:37 +00:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2017-11-20 22:27:23 +00:00
|
|
|
if (ret == 0)
|
2017-06-27 16:04:37 +00:00
|
|
|
RANDerr(RAND_F_RAND_DRBG_SET, RAND_R_ERROR_INITIALISING_DRBG);
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2018-02-08 21:46:23 +00:00
|
|
|
* Allocate memory and initialize a new DRBG. The DRBG is allocated on
|
|
|
|
* the secure heap if |secure| is nonzero and the secure heap is enabled.
|
|
|
|
* The |parent|, if not NULL, will be used as random source for reseeding.
|
2017-11-24 13:59:58 +00:00
|
|
|
*
|
|
|
|
* Returns a pointer to the new DRBG instance on success, NULL on failure.
|
2017-06-27 16:04:37 +00:00
|
|
|
*/
|
2018-02-08 21:46:23 +00:00
|
|
|
static RAND_DRBG *rand_drbg_new(int secure,
|
|
|
|
int type,
|
|
|
|
unsigned int flags,
|
|
|
|
RAND_DRBG *parent)
|
2017-06-27 16:04:37 +00:00
|
|
|
{
|
2018-02-08 21:46:23 +00:00
|
|
|
RAND_DRBG *drbg = secure ?
|
|
|
|
OPENSSL_secure_zalloc(sizeof(*drbg)) : OPENSSL_zalloc(sizeof(*drbg));
|
2017-06-27 16:04:37 +00:00
|
|
|
|
2017-08-22 22:24:23 +00:00
|
|
|
if (drbg == NULL) {
|
2017-06-27 16:04:37 +00:00
|
|
|
RANDerr(RAND_F_RAND_DRBG_NEW, ERR_R_MALLOC_FAILURE);
|
2017-08-03 13:23:28 +00:00
|
|
|
goto err;
|
2017-06-27 16:04:37 +00:00
|
|
|
}
|
2018-02-08 21:46:23 +00:00
|
|
|
|
|
|
|
drbg->secure = secure && CRYPTO_secure_allocated(drbg);
|
2017-08-06 22:12:28 +00:00
|
|
|
drbg->fork_count = rand_fork_count;
|
2017-08-03 13:23:28 +00:00
|
|
|
drbg->parent = parent;
|
2017-11-20 22:27:23 +00:00
|
|
|
if (RAND_DRBG_set(drbg, type, flags) == 0)
|
2017-08-03 13:23:28 +00:00
|
|
|
goto err;
|
|
|
|
|
2017-11-24 13:59:58 +00:00
|
|
|
if (!RAND_DRBG_set_callbacks(drbg, rand_drbg_get_entropy,
|
|
|
|
rand_drbg_cleanup_entropy,
|
|
|
|
NULL, NULL))
|
|
|
|
goto err;
|
2017-08-03 13:23:28 +00:00
|
|
|
|
|
|
|
return drbg;
|
|
|
|
|
|
|
|
err:
|
2018-02-08 21:46:23 +00:00
|
|
|
if (drbg->secure)
|
|
|
|
OPENSSL_secure_free(drbg);
|
|
|
|
else
|
|
|
|
OPENSSL_free(drbg);
|
|
|
|
|
2017-08-03 13:23:28 +00:00
|
|
|
return NULL;
|
2017-06-27 16:04:37 +00:00
|
|
|
}
|
|
|
|
|
2018-02-08 21:46:23 +00:00
|
|
|
RAND_DRBG *RAND_DRBG_new(int type, unsigned int flags, RAND_DRBG *parent)
|
|
|
|
{
|
|
|
|
return rand_drbg_new(0, type, flags, parent);
|
|
|
|
}
|
|
|
|
|
|
|
|
RAND_DRBG *RAND_DRBG_secure_new(int type, unsigned int flags, RAND_DRBG *parent)
|
|
|
|
{
|
|
|
|
return rand_drbg_new(1, type, flags, parent);
|
|
|
|
}
|
|
|
|
|
2017-06-27 16:04:37 +00:00
|
|
|
/*
|
2017-08-03 13:23:28 +00:00
|
|
|
* Uninstantiate |drbg| and free all memory.
|
2017-06-27 16:04:37 +00:00
|
|
|
*/
|
2017-08-03 13:23:28 +00:00
|
|
|
void RAND_DRBG_free(RAND_DRBG *drbg)
|
2017-06-27 16:04:37 +00:00
|
|
|
{
|
2017-08-31 21:16:22 +00:00
|
|
|
if (drbg == NULL)
|
2017-06-27 16:04:37 +00:00
|
|
|
return;
|
|
|
|
|
2017-12-28 20:42:14 +00:00
|
|
|
if (drbg->meth != NULL)
|
|
|
|
drbg->meth->uninstantiate(drbg);
|
2018-02-08 21:46:23 +00:00
|
|
|
CRYPTO_THREAD_lock_free(drbg->lock);
|
2017-08-03 13:23:28 +00:00
|
|
|
CRYPTO_free_ex_data(CRYPTO_EX_INDEX_DRBG, drbg, &drbg->ex_data);
|
2018-02-08 21:46:23 +00:00
|
|
|
|
|
|
|
if (drbg->secure)
|
|
|
|
OPENSSL_secure_clear_free(drbg, sizeof(*drbg));
|
|
|
|
else
|
|
|
|
OPENSSL_clear_free(drbg, sizeof(*drbg));
|
2017-06-27 16:04:37 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2017-08-03 13:23:28 +00:00
|
|
|
* Instantiate |drbg|, after it has been initialized. Use |pers| and
|
2017-06-27 16:04:37 +00:00
|
|
|
* |perslen| as prediction-resistance input.
|
2017-10-11 17:25:26 +00:00
|
|
|
*
|
|
|
|
* Requires that drbg->lock is already locked for write, if non-null.
|
2017-11-20 22:27:23 +00:00
|
|
|
*
|
|
|
|
* Returns 1 on success, 0 on failure.
|
2017-06-27 16:04:37 +00:00
|
|
|
*/
|
2017-08-03 13:23:28 +00:00
|
|
|
int RAND_DRBG_instantiate(RAND_DRBG *drbg,
|
2017-06-27 16:04:37 +00:00
|
|
|
const unsigned char *pers, size_t perslen)
|
|
|
|
{
|
|
|
|
unsigned char *nonce = NULL, *entropy = NULL;
|
DRBG: clarify difference between entropy counts and buffer lengths
Unlike the NIST DRBG standard, entropy counts are in bits and
buffer lengths are in bytes. This has lead to some confusion and
errors in the past, see my comment on PR 3789.
To clarify the destinction between entropy counts and buffer lengths,
a 'len' suffix has been added to all member names of RAND_DRBG which
represent buffer lengths:
- {min,max}_{entropy,adin,nonce,pers}
+ {min,max}_{entropy,adin,nonce,pers}len
This change makes naming also more consistent, as can be seen in the
diffs, for example:
- else if (adinlen > drbg->max_adin) {
+ else if (adinlen > drbg->max_adinlen) {
Also replaced all 'ent's by 'entropy's, following a suggestion of Paul Dale.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4266)
2017-08-20 21:02:46 +00:00
|
|
|
size_t noncelen = 0, entropylen = 0;
|
2017-06-27 16:04:37 +00:00
|
|
|
|
DRBG: clarify difference between entropy counts and buffer lengths
Unlike the NIST DRBG standard, entropy counts are in bits and
buffer lengths are in bytes. This has lead to some confusion and
errors in the past, see my comment on PR 3789.
To clarify the destinction between entropy counts and buffer lengths,
a 'len' suffix has been added to all member names of RAND_DRBG which
represent buffer lengths:
- {min,max}_{entropy,adin,nonce,pers}
+ {min,max}_{entropy,adin,nonce,pers}len
This change makes naming also more consistent, as can be seen in the
diffs, for example:
- else if (adinlen > drbg->max_adin) {
+ else if (adinlen > drbg->max_adinlen) {
Also replaced all 'ent's by 'entropy's, following a suggestion of Paul Dale.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4266)
2017-08-20 21:02:46 +00:00
|
|
|
if (perslen > drbg->max_perslen) {
|
2017-08-03 13:23:28 +00:00
|
|
|
RANDerr(RAND_F_RAND_DRBG_INSTANTIATE,
|
|
|
|
RAND_R_PERSONALISATION_STRING_TOO_LONG);
|
2017-06-27 16:04:37 +00:00
|
|
|
goto end;
|
|
|
|
}
|
2017-12-28 20:42:14 +00:00
|
|
|
|
|
|
|
if (drbg->meth == NULL)
|
|
|
|
{
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_INSTANTIATE,
|
|
|
|
RAND_R_NO_DRBG_IMPLEMENTATION_SELECTED);
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
|
2017-08-03 13:23:28 +00:00
|
|
|
if (drbg->state != DRBG_UNINITIALISED) {
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_INSTANTIATE,
|
|
|
|
drbg->state == DRBG_ERROR ? RAND_R_IN_ERROR_STATE
|
|
|
|
: RAND_R_ALREADY_INSTANTIATED);
|
2017-06-27 16:04:37 +00:00
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
|
2017-08-03 13:23:28 +00:00
|
|
|
drbg->state = DRBG_ERROR;
|
|
|
|
if (drbg->get_entropy != NULL)
|
DRBG: clarify difference between entropy counts and buffer lengths
Unlike the NIST DRBG standard, entropy counts are in bits and
buffer lengths are in bytes. This has lead to some confusion and
errors in the past, see my comment on PR 3789.
To clarify the destinction between entropy counts and buffer lengths,
a 'len' suffix has been added to all member names of RAND_DRBG which
represent buffer lengths:
- {min,max}_{entropy,adin,nonce,pers}
+ {min,max}_{entropy,adin,nonce,pers}len
This change makes naming also more consistent, as can be seen in the
diffs, for example:
- else if (adinlen > drbg->max_adin) {
+ else if (adinlen > drbg->max_adinlen) {
Also replaced all 'ent's by 'entropy's, following a suggestion of Paul Dale.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4266)
2017-08-20 21:02:46 +00:00
|
|
|
entropylen = drbg->get_entropy(drbg, &entropy, drbg->strength,
|
|
|
|
drbg->min_entropylen, drbg->max_entropylen);
|
2017-08-31 21:16:22 +00:00
|
|
|
if (entropylen < drbg->min_entropylen
|
|
|
|
|| entropylen > drbg->max_entropylen) {
|
2017-08-03 13:23:28 +00:00
|
|
|
RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, RAND_R_ERROR_RETRIEVING_ENTROPY);
|
2017-06-27 16:04:37 +00:00
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
|
DRBG: clarify difference between entropy counts and buffer lengths
Unlike the NIST DRBG standard, entropy counts are in bits and
buffer lengths are in bytes. This has lead to some confusion and
errors in the past, see my comment on PR 3789.
To clarify the destinction between entropy counts and buffer lengths,
a 'len' suffix has been added to all member names of RAND_DRBG which
represent buffer lengths:
- {min,max}_{entropy,adin,nonce,pers}
+ {min,max}_{entropy,adin,nonce,pers}len
This change makes naming also more consistent, as can be seen in the
diffs, for example:
- else if (adinlen > drbg->max_adin) {
+ else if (adinlen > drbg->max_adinlen) {
Also replaced all 'ent's by 'entropy's, following a suggestion of Paul Dale.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4266)
2017-08-20 21:02:46 +00:00
|
|
|
if (drbg->max_noncelen > 0 && drbg->get_nonce != NULL) {
|
2017-08-03 13:23:28 +00:00
|
|
|
noncelen = drbg->get_nonce(drbg, &nonce, drbg->strength / 2,
|
DRBG: clarify difference between entropy counts and buffer lengths
Unlike the NIST DRBG standard, entropy counts are in bits and
buffer lengths are in bytes. This has lead to some confusion and
errors in the past, see my comment on PR 3789.
To clarify the destinction between entropy counts and buffer lengths,
a 'len' suffix has been added to all member names of RAND_DRBG which
represent buffer lengths:
- {min,max}_{entropy,adin,nonce,pers}
+ {min,max}_{entropy,adin,nonce,pers}len
This change makes naming also more consistent, as can be seen in the
diffs, for example:
- else if (adinlen > drbg->max_adin) {
+ else if (adinlen > drbg->max_adinlen) {
Also replaced all 'ent's by 'entropy's, following a suggestion of Paul Dale.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4266)
2017-08-20 21:02:46 +00:00
|
|
|
drbg->min_noncelen, drbg->max_noncelen);
|
|
|
|
if (noncelen < drbg->min_noncelen || noncelen > drbg->max_noncelen) {
|
2017-08-31 21:16:22 +00:00
|
|
|
RANDerr(RAND_F_RAND_DRBG_INSTANTIATE,
|
|
|
|
RAND_R_ERROR_RETRIEVING_NONCE);
|
2017-06-27 16:04:37 +00:00
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-12-28 20:42:14 +00:00
|
|
|
if (!drbg->meth->instantiate(drbg, entropy, entropylen,
|
2017-06-27 16:04:37 +00:00
|
|
|
nonce, noncelen, pers, perslen)) {
|
2017-08-03 13:23:28 +00:00
|
|
|
RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, RAND_R_ERROR_INSTANTIATING_DRBG);
|
2017-06-27 16:04:37 +00:00
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
|
2017-08-03 13:23:28 +00:00
|
|
|
drbg->state = DRBG_READY;
|
2017-11-24 13:59:58 +00:00
|
|
|
drbg->generate_counter = 0;
|
2017-11-24 14:24:51 +00:00
|
|
|
drbg->reseed_time = time(NULL);
|
2017-11-24 13:59:58 +00:00
|
|
|
if (drbg->reseed_counter > 0) {
|
|
|
|
if (drbg->parent == NULL)
|
|
|
|
drbg->reseed_counter++;
|
|
|
|
else
|
|
|
|
drbg->reseed_counter = drbg->parent->reseed_counter;
|
|
|
|
}
|
2017-06-27 16:04:37 +00:00
|
|
|
|
|
|
|
end:
|
2017-08-03 13:23:28 +00:00
|
|
|
if (entropy != NULL && drbg->cleanup_entropy != NULL)
|
2017-08-25 21:26:53 +00:00
|
|
|
drbg->cleanup_entropy(drbg, entropy, entropylen);
|
2017-08-03 13:23:28 +00:00
|
|
|
if (nonce != NULL && drbg->cleanup_nonce!= NULL )
|
2017-08-25 21:26:53 +00:00
|
|
|
drbg->cleanup_nonce(drbg, nonce, noncelen);
|
2017-08-31 21:16:22 +00:00
|
|
|
if (drbg->pool != NULL) {
|
|
|
|
if (drbg->state == DRBG_READY) {
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_INSTANTIATE,
|
|
|
|
RAND_R_ERROR_ENTROPY_POOL_WAS_IGNORED);
|
|
|
|
drbg->state = DRBG_ERROR;
|
|
|
|
}
|
|
|
|
RAND_POOL_free(drbg->pool);
|
|
|
|
drbg->pool = NULL;
|
|
|
|
}
|
2017-08-03 13:23:28 +00:00
|
|
|
if (drbg->state == DRBG_READY)
|
2017-06-27 16:04:37 +00:00
|
|
|
return 1;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2017-08-03 13:23:28 +00:00
|
|
|
* Uninstantiate |drbg|. Must be instantiated before it can be used.
|
2017-10-11 17:25:26 +00:00
|
|
|
*
|
|
|
|
* Requires that drbg->lock is already locked for write, if non-null.
|
2017-11-20 22:27:23 +00:00
|
|
|
*
|
|
|
|
* Returns 1 on success, 0 on failure.
|
2017-06-27 16:04:37 +00:00
|
|
|
*/
|
2017-08-03 13:23:28 +00:00
|
|
|
int RAND_DRBG_uninstantiate(RAND_DRBG *drbg)
|
2017-06-27 16:04:37 +00:00
|
|
|
{
|
2017-12-28 20:42:14 +00:00
|
|
|
if (drbg->meth == NULL)
|
|
|
|
{
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_UNINSTANTIATE,
|
|
|
|
RAND_R_NO_DRBG_IMPLEMENTATION_SELECTED);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2017-11-20 22:27:23 +00:00
|
|
|
/* Clear the entire drbg->ctr struct, then reset some important
|
|
|
|
* members of the drbg->ctr struct (e.g. keysize, df_ks) to their
|
|
|
|
* initial values.
|
|
|
|
*/
|
2017-12-28 20:42:14 +00:00
|
|
|
drbg->meth->uninstantiate(drbg);
|
2017-11-20 22:27:23 +00:00
|
|
|
return RAND_DRBG_set(drbg, drbg->nid, drbg->flags);
|
2017-06-27 16:04:37 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2017-08-31 21:16:22 +00:00
|
|
|
* Reseed |drbg|, mixing in the specified data
|
2017-10-11 17:25:26 +00:00
|
|
|
*
|
|
|
|
* Requires that drbg->lock is already locked for write, if non-null.
|
2017-11-20 22:27:23 +00:00
|
|
|
*
|
|
|
|
* Returns 1 on success, 0 on failure.
|
2017-06-27 16:04:37 +00:00
|
|
|
*/
|
2017-08-03 13:23:28 +00:00
|
|
|
int RAND_DRBG_reseed(RAND_DRBG *drbg,
|
2017-06-27 16:04:37 +00:00
|
|
|
const unsigned char *adin, size_t adinlen)
|
|
|
|
{
|
|
|
|
unsigned char *entropy = NULL;
|
DRBG: clarify difference between entropy counts and buffer lengths
Unlike the NIST DRBG standard, entropy counts are in bits and
buffer lengths are in bytes. This has lead to some confusion and
errors in the past, see my comment on PR 3789.
To clarify the destinction between entropy counts and buffer lengths,
a 'len' suffix has been added to all member names of RAND_DRBG which
represent buffer lengths:
- {min,max}_{entropy,adin,nonce,pers}
+ {min,max}_{entropy,adin,nonce,pers}len
This change makes naming also more consistent, as can be seen in the
diffs, for example:
- else if (adinlen > drbg->max_adin) {
+ else if (adinlen > drbg->max_adinlen) {
Also replaced all 'ent's by 'entropy's, following a suggestion of Paul Dale.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4266)
2017-08-20 21:02:46 +00:00
|
|
|
size_t entropylen = 0;
|
2017-08-03 13:23:28 +00:00
|
|
|
|
|
|
|
if (drbg->state == DRBG_ERROR) {
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_RESEED, RAND_R_IN_ERROR_STATE);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
if (drbg->state == DRBG_UNINITIALISED) {
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_RESEED, RAND_R_NOT_INSTANTIATED);
|
|
|
|
return 0;
|
2017-06-27 16:04:37 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if (adin == NULL)
|
|
|
|
adinlen = 0;
|
DRBG: clarify difference between entropy counts and buffer lengths
Unlike the NIST DRBG standard, entropy counts are in bits and
buffer lengths are in bytes. This has lead to some confusion and
errors in the past, see my comment on PR 3789.
To clarify the destinction between entropy counts and buffer lengths,
a 'len' suffix has been added to all member names of RAND_DRBG which
represent buffer lengths:
- {min,max}_{entropy,adin,nonce,pers}
+ {min,max}_{entropy,adin,nonce,pers}len
This change makes naming also more consistent, as can be seen in the
diffs, for example:
- else if (adinlen > drbg->max_adin) {
+ else if (adinlen > drbg->max_adinlen) {
Also replaced all 'ent's by 'entropy's, following a suggestion of Paul Dale.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4266)
2017-08-20 21:02:46 +00:00
|
|
|
else if (adinlen > drbg->max_adinlen) {
|
2017-08-03 13:23:28 +00:00
|
|
|
RANDerr(RAND_F_RAND_DRBG_RESEED, RAND_R_ADDITIONAL_INPUT_TOO_LONG);
|
|
|
|
return 0;
|
2017-06-27 16:04:37 +00:00
|
|
|
}
|
|
|
|
|
2017-08-03 13:23:28 +00:00
|
|
|
drbg->state = DRBG_ERROR;
|
|
|
|
if (drbg->get_entropy != NULL)
|
DRBG: clarify difference between entropy counts and buffer lengths
Unlike the NIST DRBG standard, entropy counts are in bits and
buffer lengths are in bytes. This has lead to some confusion and
errors in the past, see my comment on PR 3789.
To clarify the destinction between entropy counts and buffer lengths,
a 'len' suffix has been added to all member names of RAND_DRBG which
represent buffer lengths:
- {min,max}_{entropy,adin,nonce,pers}
+ {min,max}_{entropy,adin,nonce,pers}len
This change makes naming also more consistent, as can be seen in the
diffs, for example:
- else if (adinlen > drbg->max_adin) {
+ else if (adinlen > drbg->max_adinlen) {
Also replaced all 'ent's by 'entropy's, following a suggestion of Paul Dale.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4266)
2017-08-20 21:02:46 +00:00
|
|
|
entropylen = drbg->get_entropy(drbg, &entropy, drbg->strength,
|
|
|
|
drbg->min_entropylen, drbg->max_entropylen);
|
2017-08-31 21:16:22 +00:00
|
|
|
if (entropylen < drbg->min_entropylen
|
|
|
|
|| entropylen > drbg->max_entropylen) {
|
2017-08-03 13:23:28 +00:00
|
|
|
RANDerr(RAND_F_RAND_DRBG_RESEED, RAND_R_ERROR_RETRIEVING_ENTROPY);
|
2017-06-27 16:04:37 +00:00
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
|
2017-12-28 20:42:14 +00:00
|
|
|
if (!drbg->meth->reseed(drbg, entropy, entropylen, adin, adinlen))
|
2017-06-27 16:04:37 +00:00
|
|
|
goto end;
|
2017-11-24 13:59:58 +00:00
|
|
|
|
2017-08-03 13:23:28 +00:00
|
|
|
drbg->state = DRBG_READY;
|
2017-11-24 13:59:58 +00:00
|
|
|
drbg->generate_counter = 0;
|
2017-11-24 14:24:51 +00:00
|
|
|
drbg->reseed_time = time(NULL);
|
2017-11-24 13:59:58 +00:00
|
|
|
if (drbg->reseed_counter > 0) {
|
|
|
|
if (drbg->parent == NULL)
|
|
|
|
drbg->reseed_counter++;
|
|
|
|
else
|
|
|
|
drbg->reseed_counter = drbg->parent->reseed_counter;
|
|
|
|
}
|
2017-06-27 16:04:37 +00:00
|
|
|
|
|
|
|
end:
|
2017-08-03 13:23:28 +00:00
|
|
|
if (entropy != NULL && drbg->cleanup_entropy != NULL)
|
2017-08-25 21:26:53 +00:00
|
|
|
drbg->cleanup_entropy(drbg, entropy, entropylen);
|
2017-08-03 13:23:28 +00:00
|
|
|
if (drbg->state == DRBG_READY)
|
2017-06-27 16:04:37 +00:00
|
|
|
return 1;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2017-08-31 21:16:22 +00:00
|
|
|
/*
|
|
|
|
* Restart |drbg|, using the specified entropy or additional input
|
|
|
|
*
|
|
|
|
* Tries its best to get the drbg instantiated by all means,
|
|
|
|
* regardless of its current state.
|
|
|
|
*
|
|
|
|
* Optionally, a |buffer| of |len| random bytes can be passed,
|
|
|
|
* which is assumed to contain at least |entropy| bits of entropy.
|
|
|
|
*
|
|
|
|
* If |entropy| > 0, the buffer content is used as entropy input.
|
|
|
|
*
|
|
|
|
* If |entropy| == 0, the buffer content is used as additional input
|
|
|
|
*
|
|
|
|
* Returns 1 on success, 0 on failure.
|
|
|
|
*
|
|
|
|
* This function is used internally only.
|
|
|
|
*/
|
|
|
|
int rand_drbg_restart(RAND_DRBG *drbg,
|
|
|
|
const unsigned char *buffer, size_t len, size_t entropy)
|
|
|
|
{
|
|
|
|
int reseeded = 0;
|
|
|
|
const unsigned char *adin = NULL;
|
|
|
|
size_t adinlen = 0;
|
|
|
|
|
|
|
|
if (drbg->pool != NULL) {
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_RESTART, ERR_R_INTERNAL_ERROR);
|
|
|
|
RAND_POOL_free(drbg->pool);
|
|
|
|
drbg->pool = NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (buffer != NULL) {
|
|
|
|
if (entropy > 0) {
|
|
|
|
if (drbg->max_entropylen < len) {
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_RESTART,
|
|
|
|
RAND_R_ENTROPY_INPUT_TOO_LONG);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (entropy > 8 * len) {
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_RESTART, RAND_R_ENTROPY_OUT_OF_RANGE);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* will be picked up by the rand_drbg_get_entropy() callback */
|
|
|
|
drbg->pool = RAND_POOL_new(entropy, len, len);
|
|
|
|
if (drbg->pool == NULL)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
RAND_POOL_add(drbg->pool, buffer, len, entropy);
|
|
|
|
} else {
|
|
|
|
if (drbg->max_adinlen < len) {
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_RESTART,
|
|
|
|
RAND_R_ADDITIONAL_INPUT_TOO_LONG);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
adin = buffer;
|
|
|
|
adinlen = len;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* repair error state */
|
2017-11-20 22:27:23 +00:00
|
|
|
if (drbg->state == DRBG_ERROR)
|
2017-08-31 21:16:22 +00:00
|
|
|
RAND_DRBG_uninstantiate(drbg);
|
|
|
|
|
|
|
|
/* repair uninitialized state */
|
|
|
|
if (drbg->state == DRBG_UNINITIALISED) {
|
2017-11-24 13:59:58 +00:00
|
|
|
/* reinstantiate drbg */
|
|
|
|
RAND_DRBG_instantiate(drbg,
|
|
|
|
(const unsigned char *) ossl_pers_string,
|
|
|
|
sizeof(ossl_pers_string) - 1);
|
2017-08-31 21:16:22 +00:00
|
|
|
/* already reseeded. prevent second reseeding below */
|
|
|
|
reseeded = (drbg->state == DRBG_READY);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* refresh current state if entropy or additional input has been provided */
|
|
|
|
if (drbg->state == DRBG_READY) {
|
|
|
|
if (adin != NULL) {
|
|
|
|
/*
|
|
|
|
* mix in additional input without reseeding
|
|
|
|
*
|
|
|
|
* Similar to RAND_DRBG_reseed(), but the provided additional
|
|
|
|
* data |adin| is mixed into the current state without pulling
|
|
|
|
* entropy from the trusted entropy source using get_entropy().
|
|
|
|
* This is not a reseeding in the strict sense of NIST SP 800-90A.
|
|
|
|
*/
|
2017-12-28 20:42:14 +00:00
|
|
|
drbg->meth->reseed(drbg, adin, adinlen, NULL, 0);
|
2017-08-31 21:16:22 +00:00
|
|
|
} else if (reseeded == 0) {
|
|
|
|
/* do a full reseeding if it has not been done yet above */
|
|
|
|
RAND_DRBG_reseed(drbg, NULL, 0);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* check whether a given entropy pool was cleared properly during reseed */
|
|
|
|
if (drbg->pool != NULL) {
|
|
|
|
drbg->state = DRBG_ERROR;
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_RESTART, ERR_R_INTERNAL_ERROR);
|
|
|
|
RAND_POOL_free(drbg->pool);
|
|
|
|
drbg->pool = NULL;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
return drbg->state == DRBG_READY;
|
|
|
|
}
|
|
|
|
|
2017-06-27 16:04:37 +00:00
|
|
|
/*
|
|
|
|
* Generate |outlen| bytes into the buffer at |out|. Reseed if we need
|
|
|
|
* to or if |prediction_resistance| is set. Additional input can be
|
|
|
|
* sent in |adin| and |adinlen|.
|
2017-08-31 21:16:22 +00:00
|
|
|
*
|
2017-10-11 17:25:26 +00:00
|
|
|
* Requires that drbg->lock is already locked for write, if non-null.
|
|
|
|
*
|
2017-08-31 21:16:22 +00:00
|
|
|
* Returns 1 on success, 0 on failure.
|
|
|
|
*
|
2017-06-27 16:04:37 +00:00
|
|
|
*/
|
2017-08-03 13:23:28 +00:00
|
|
|
int RAND_DRBG_generate(RAND_DRBG *drbg, unsigned char *out, size_t outlen,
|
2017-06-27 16:04:37 +00:00
|
|
|
int prediction_resistance,
|
|
|
|
const unsigned char *adin, size_t adinlen)
|
|
|
|
{
|
2017-10-09 21:51:42 +00:00
|
|
|
int reseed_required = 0;
|
|
|
|
|
2017-08-31 21:16:22 +00:00
|
|
|
if (drbg->state != DRBG_READY) {
|
|
|
|
/* try to recover from previous errors */
|
|
|
|
rand_drbg_restart(drbg, NULL, 0, 0);
|
|
|
|
|
|
|
|
if (drbg->state == DRBG_ERROR) {
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_IN_ERROR_STATE);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
if (drbg->state == DRBG_UNINITIALISED) {
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_NOT_INSTANTIATED);
|
|
|
|
return 0;
|
|
|
|
}
|
2017-06-27 16:04:37 +00:00
|
|
|
}
|
2017-08-31 21:16:22 +00:00
|
|
|
|
2017-08-03 13:23:28 +00:00
|
|
|
if (outlen > drbg->max_request) {
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_REQUEST_TOO_LARGE_FOR_DRBG);
|
|
|
|
return 0;
|
|
|
|
}
|
DRBG: clarify difference between entropy counts and buffer lengths
Unlike the NIST DRBG standard, entropy counts are in bits and
buffer lengths are in bytes. This has lead to some confusion and
errors in the past, see my comment on PR 3789.
To clarify the destinction between entropy counts and buffer lengths,
a 'len' suffix has been added to all member names of RAND_DRBG which
represent buffer lengths:
- {min,max}_{entropy,adin,nonce,pers}
+ {min,max}_{entropy,adin,nonce,pers}len
This change makes naming also more consistent, as can be seen in the
diffs, for example:
- else if (adinlen > drbg->max_adin) {
+ else if (adinlen > drbg->max_adinlen) {
Also replaced all 'ent's by 'entropy's, following a suggestion of Paul Dale.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4266)
2017-08-20 21:02:46 +00:00
|
|
|
if (adinlen > drbg->max_adinlen) {
|
2017-08-03 13:23:28 +00:00
|
|
|
RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_ADDITIONAL_INPUT_TOO_LONG);
|
|
|
|
return 0;
|
2017-06-27 16:04:37 +00:00
|
|
|
}
|
|
|
|
|
2017-08-06 22:12:28 +00:00
|
|
|
if (drbg->fork_count != rand_fork_count) {
|
|
|
|
drbg->fork_count = rand_fork_count;
|
2017-10-09 21:51:42 +00:00
|
|
|
reseed_required = 1;
|
2017-08-06 22:12:28 +00:00
|
|
|
}
|
|
|
|
|
2017-11-24 13:59:58 +00:00
|
|
|
if (drbg->reseed_interval > 0) {
|
|
|
|
if (drbg->generate_counter >= drbg->reseed_interval)
|
|
|
|
reseed_required = 1;
|
|
|
|
}
|
2017-11-24 14:24:51 +00:00
|
|
|
if (drbg->reseed_time_interval > 0) {
|
|
|
|
time_t now = time(NULL);
|
|
|
|
if (now < drbg->reseed_time
|
|
|
|
|| now - drbg->reseed_time >= drbg->reseed_time_interval)
|
|
|
|
reseed_required = 1;
|
|
|
|
}
|
2017-11-24 13:59:58 +00:00
|
|
|
if (drbg->reseed_counter > 0 && drbg->parent != NULL) {
|
|
|
|
if (drbg->reseed_counter != drbg->parent->reseed_counter)
|
|
|
|
reseed_required = 1;
|
|
|
|
}
|
2017-06-27 16:04:37 +00:00
|
|
|
|
2017-10-09 21:51:42 +00:00
|
|
|
if (reseed_required || prediction_resistance) {
|
2017-08-03 13:23:28 +00:00
|
|
|
if (!RAND_DRBG_reseed(drbg, adin, adinlen)) {
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_RESEED_ERROR);
|
|
|
|
return 0;
|
2017-06-27 16:04:37 +00:00
|
|
|
}
|
|
|
|
adin = NULL;
|
|
|
|
adinlen = 0;
|
|
|
|
}
|
|
|
|
|
2017-12-28 20:42:14 +00:00
|
|
|
if (!drbg->meth->generate(drbg, out, outlen, adin, adinlen)) {
|
2017-08-03 13:23:28 +00:00
|
|
|
drbg->state = DRBG_ERROR;
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_GENERATE_ERROR);
|
|
|
|
return 0;
|
2017-06-27 16:04:37 +00:00
|
|
|
}
|
2017-08-03 13:23:28 +00:00
|
|
|
|
2017-11-24 13:59:58 +00:00
|
|
|
drbg->generate_counter++;
|
2017-10-09 21:51:42 +00:00
|
|
|
|
2017-06-27 16:04:37 +00:00
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2017-11-17 14:00:35 +00:00
|
|
|
/*
|
|
|
|
* Generates |outlen| random bytes and stores them in |out|. It will
|
|
|
|
* using the given |drbg| to generate the bytes.
|
|
|
|
*
|
|
|
|
* Requires that drbg->lock is already locked for write, if non-null.
|
|
|
|
*
|
|
|
|
* Returns 1 on success 0 on failure.
|
|
|
|
*/
|
|
|
|
int RAND_DRBG_bytes(RAND_DRBG *drbg, unsigned char *out, size_t outlen)
|
|
|
|
{
|
|
|
|
unsigned char *additional = NULL;
|
|
|
|
size_t additional_len;
|
2018-02-03 21:32:47 +00:00
|
|
|
size_t chunk;
|
2017-11-17 14:00:35 +00:00
|
|
|
size_t ret;
|
|
|
|
|
|
|
|
additional_len = rand_drbg_get_additional_data(&additional, drbg->max_adinlen);
|
2018-02-03 21:32:47 +00:00
|
|
|
|
|
|
|
for ( ; outlen > 0; outlen -= chunk, out += chunk) {
|
|
|
|
chunk = outlen;
|
|
|
|
if (chunk > drbg->max_request)
|
|
|
|
chunk = drbg->max_request;
|
|
|
|
ret = RAND_DRBG_generate(drbg, out, chunk, 0, additional, additional_len);
|
|
|
|
if (!ret)
|
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
ret = 1;
|
|
|
|
|
|
|
|
err:
|
2017-11-17 14:00:35 +00:00
|
|
|
if (additional_len != 0)
|
|
|
|
OPENSSL_secure_clear_free(additional, additional_len);
|
|
|
|
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
2017-06-27 16:04:37 +00:00
|
|
|
/*
|
2017-08-31 21:16:22 +00:00
|
|
|
* Set the RAND_DRBG callbacks for obtaining entropy and nonce.
|
|
|
|
*
|
|
|
|
* In the following, the signature and the semantics of the
|
|
|
|
* get_entropy() and cleanup_entropy() callbacks are explained.
|
|
|
|
*
|
|
|
|
* GET_ENTROPY
|
|
|
|
*
|
|
|
|
* size_t get_entropy(RAND_DRBG *ctx,
|
|
|
|
* unsigned char **pout,
|
|
|
|
* int entropy,
|
|
|
|
* size_t min_len, size_t max_len);
|
|
|
|
*
|
|
|
|
* This is a request to allocate and fill a buffer of size
|
|
|
|
* |min_len| <= size <= |max_len| (in bytes) which contains
|
|
|
|
* at least |entropy| bits of randomness. The buffer's address is
|
|
|
|
* to be returned in |*pout| and the number of collected
|
|
|
|
* randomness bytes (which may be less than the allocated size
|
|
|
|
* of the buffer) as return value.
|
|
|
|
*
|
|
|
|
* If the callback fails to acquire at least |entropy| bits of
|
|
|
|
* randomness, it shall return a buffer length of 0.
|
|
|
|
*
|
|
|
|
* CLEANUP_ENTROPY
|
|
|
|
*
|
|
|
|
* void cleanup_entropy(RAND_DRBG *ctx,
|
|
|
|
* unsigned char *out, size_t outlen);
|
|
|
|
*
|
|
|
|
* A request to clear and free the buffer allocated by get_entropy().
|
|
|
|
* The values |out| and |outlen| are expected to be the random buffer's
|
|
|
|
* address and length, as returned by the get_entropy() callback.
|
|
|
|
*
|
|
|
|
* GET_NONCE, CLEANUP_NONCE
|
|
|
|
*
|
|
|
|
* Signature and semantics of the get_nonce() and cleanup_nonce()
|
|
|
|
* callbacks are analogous to get_entropy() and cleanup_entropy().
|
|
|
|
* Currently, the nonce is used only for the known answer tests.
|
2017-06-27 16:04:37 +00:00
|
|
|
*/
|
2017-08-03 13:23:28 +00:00
|
|
|
int RAND_DRBG_set_callbacks(RAND_DRBG *drbg,
|
2017-08-31 21:16:22 +00:00
|
|
|
RAND_DRBG_get_entropy_fn get_entropy,
|
|
|
|
RAND_DRBG_cleanup_entropy_fn cleanup_entropy,
|
|
|
|
RAND_DRBG_get_nonce_fn get_nonce,
|
|
|
|
RAND_DRBG_cleanup_nonce_fn cleanup_nonce)
|
2017-06-27 16:04:37 +00:00
|
|
|
{
|
2017-08-03 13:23:28 +00:00
|
|
|
if (drbg->state != DRBG_UNINITIALISED)
|
2017-06-27 16:04:37 +00:00
|
|
|
return 0;
|
2017-08-31 21:16:22 +00:00
|
|
|
drbg->get_entropy = get_entropy;
|
|
|
|
drbg->cleanup_entropy = cleanup_entropy;
|
|
|
|
drbg->get_nonce = get_nonce;
|
|
|
|
drbg->cleanup_nonce = cleanup_nonce;
|
2017-06-27 16:04:37 +00:00
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2017-08-03 13:23:28 +00:00
|
|
|
* Set the reseed interval.
|
2017-11-24 13:59:58 +00:00
|
|
|
*
|
|
|
|
* The drbg will reseed automatically whenever the number of generate
|
|
|
|
* requests exceeds the given reseed interval. If the reseed interval
|
2017-11-24 14:24:51 +00:00
|
|
|
* is 0, then this feature is disabled.
|
2017-11-24 13:59:58 +00:00
|
|
|
*
|
|
|
|
* Returns 1 on success, 0 on failure.
|
2017-06-27 16:04:37 +00:00
|
|
|
*/
|
2017-11-24 13:59:58 +00:00
|
|
|
int RAND_DRBG_set_reseed_interval(RAND_DRBG *drbg, unsigned int interval)
|
2017-06-27 16:04:37 +00:00
|
|
|
{
|
2017-11-24 13:59:58 +00:00
|
|
|
if (interval > MAX_RESEED_INTERVAL)
|
2017-07-19 21:41:26 +00:00
|
|
|
return 0;
|
2017-08-03 13:23:28 +00:00
|
|
|
drbg->reseed_interval = interval;
|
2017-07-19 21:41:26 +00:00
|
|
|
return 1;
|
2017-06-27 16:04:37 +00:00
|
|
|
}
|
|
|
|
|
2017-11-24 14:24:51 +00:00
|
|
|
/*
|
|
|
|
* Set the reseed time interval.
|
|
|
|
*
|
|
|
|
* The drbg will reseed automatically whenever the time elapsed since
|
|
|
|
* the last reseeding exceeds the given reseed time interval. For safety,
|
|
|
|
* a reseeding will also occur if the clock has been reset to a smaller
|
|
|
|
* value.
|
|
|
|
*
|
|
|
|
* Returns 1 on success, 0 on failure.
|
|
|
|
*/
|
|
|
|
int RAND_DRBG_set_reseed_time_interval(RAND_DRBG *drbg, time_t interval)
|
|
|
|
{
|
|
|
|
if (interval > MAX_RESEED_TIME_INTERVAL)
|
|
|
|
return 0;
|
|
|
|
drbg->reseed_time_interval = interval;
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2018-02-08 15:40:32 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Locks the given drbg. Locking a drbg which does not have locking
|
|
|
|
* enabled is considered a successful no-op.
|
|
|
|
*
|
|
|
|
* Returns 1 on success, 0 on failure.
|
|
|
|
*/
|
2018-02-15 09:29:56 +00:00
|
|
|
int rand_drbg_lock(RAND_DRBG *drbg)
|
2018-02-08 15:40:32 +00:00
|
|
|
{
|
|
|
|
if (drbg->lock != NULL)
|
|
|
|
return CRYPTO_THREAD_write_lock(drbg->lock);
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Unlocks the given drbg. Unlocking a drbg which does not have locking
|
|
|
|
* enabled is considered a successful no-op.
|
|
|
|
*
|
|
|
|
* Returns 1 on success, 0 on failure.
|
|
|
|
*/
|
2018-02-15 09:29:56 +00:00
|
|
|
int rand_drbg_unlock(RAND_DRBG *drbg)
|
2018-02-08 15:40:32 +00:00
|
|
|
{
|
|
|
|
if (drbg->lock != NULL)
|
|
|
|
return CRYPTO_THREAD_unlock(drbg->lock);
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Enables locking for the given drbg
|
|
|
|
*
|
|
|
|
* Locking can only be enabled if the random generator
|
|
|
|
* is in the uninitialized state.
|
|
|
|
*
|
|
|
|
* Returns 1 on success, 0 on failure.
|
|
|
|
*/
|
2018-02-15 09:29:56 +00:00
|
|
|
int rand_drbg_enable_locking(RAND_DRBG *drbg)
|
2018-02-08 15:40:32 +00:00
|
|
|
{
|
|
|
|
if (drbg->state != DRBG_UNINITIALISED) {
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_ENABLE_LOCKING,
|
|
|
|
RAND_R_DRBG_ALREADY_INITIALIZED);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (drbg->lock == NULL) {
|
2018-02-08 21:46:23 +00:00
|
|
|
if (drbg->parent != NULL && drbg->parent->lock == NULL) {
|
2018-02-08 15:40:32 +00:00
|
|
|
RANDerr(RAND_F_RAND_DRBG_ENABLE_LOCKING,
|
|
|
|
RAND_R_PARENT_LOCKING_NOT_ENABLED);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
drbg->lock = CRYPTO_THREAD_lock_new();
|
|
|
|
if (drbg->lock == NULL) {
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_ENABLE_LOCKING,
|
|
|
|
RAND_R_FAILED_TO_CREATE_LOCK);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2017-06-27 16:04:37 +00:00
|
|
|
/*
|
|
|
|
* Get and set the EXDATA
|
|
|
|
*/
|
2017-08-03 13:23:28 +00:00
|
|
|
int RAND_DRBG_set_ex_data(RAND_DRBG *drbg, int idx, void *arg)
|
|
|
|
{
|
|
|
|
return CRYPTO_set_ex_data(&drbg->ex_data, idx, arg);
|
|
|
|
}
|
|
|
|
|
|
|
|
void *RAND_DRBG_get_ex_data(const RAND_DRBG *drbg, int idx)
|
|
|
|
{
|
|
|
|
return CRYPTO_get_ex_data(&drbg->ex_data, idx);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
* The following functions provide a RAND_METHOD that works on the
|
|
|
|
* global DRBG. They lock.
|
|
|
|
*/
|
|
|
|
|
2017-08-27 15:46:33 +00:00
|
|
|
/*
|
2017-11-06 01:29:15 +00:00
|
|
|
* Allocates a new global DRBG on the secure heap (if enabled) and
|
|
|
|
* initializes it with default settings.
|
2017-11-24 13:59:58 +00:00
|
|
|
*
|
|
|
|
* Returns a pointer to the new DRBG instance on success, NULL on failure.
|
2017-08-27 15:46:33 +00:00
|
|
|
*/
|
Revert the crypto "global lock" implementation
Conceptually, this is a squashed version of:
Revert "Address feedback"
This reverts commit 75551e07bd2339dfea06ef1d31d69929e13a4495.
and
Revert "Add CRYPTO_thread_glock_new"
This reverts commit ed6b2c7938ec6f07b15745d4183afc276e74c6dd.
But there were some intervening commits that made neither revert apply
cleanly, so instead do it all as one shot.
The crypto global locks were an attempt to cope with the awkward
POSIX semantics for pthread_atfork(); its documentation (the "RATIONALE"
section) indicates that the expected usage is to have the prefork handler
lock all "global" locks, and the parent and child handlers release those
locks, to ensure that forking happens with a consistent (lock) state.
However, the set of functions available in the child process is limited
to async-signal-safe functions, and pthread_mutex_unlock() is not on
the list of async-signal-safe functions! The only synchronization
primitives that are async-signal-safe are the semaphore primitives,
which are not really appropriate for general-purpose usage.
However, the state consistency problem that the global locks were
attempting to solve is not actually a serious problem, particularly for
OpenSSL. That is, we can consider four cases of forking application
that might use OpenSSL:
(1) Single-threaded, does not call into OpenSSL in the child (e.g.,
the child calls exec() immediately)
For this class of process, no locking is needed at all, since there is
only ever a single thread of execution and the only reentrancy is due to
signal handlers (which are themselves limited to async-signal-safe
operation and should not be doing much work at all).
(2) Single-threaded, calls into OpenSSL after fork()
The application must ensure that it does not fork() with an unexpected
lock held (that is, one that would get unlocked in the parent but
accidentally remain locked in the child and cause deadlock). Since
OpenSSL does not expose any of its internal locks to the application
and the application is single-threaded, the OpenSSL internal locks
will be unlocked for the fork(), and the state will be consistent.
(OpenSSL will need to reseed its PRNG in the child, but that is
an orthogonal issue.) If the application makes use of locks from
libcrypto, proper handling for those locks is the responsibility of
the application, as for any other locking primitive that is available
for application programming.
(3) Multi-threaded, does not call into OpenSSL after fork()
As for (1), the OpenSSL state is only relevant in the parent, so
no particular fork()-related handling is needed. The internal locks
are relevant, but there is no interaction with the child to consider.
(4) Multi-threaded, calls into OpenSSL after fork()
This is the case where the pthread_atfork() hooks to ensure that all
global locks are in a known state across fork() would come into play,
per the above discussion. However, these "calls into OpenSSL after
fork()" are still subject to the restriction to async-signal-safe
functions. Since OpenSSL uses all sorts of locking and libc functions
that are not on the list of safe functions (e.g., malloc()), this
case is not currently usable and is unlikely to ever be usable,
independently of the locking situation. So, there is no need to
go through contortions to attempt to support this case in the one small
area of locking interaction with fork().
In light of the above analysis (thanks @davidben and @achernya), go
back to the simpler implementation that does not need to distinguish
"library-global" locks or to have complicated atfork handling for locks.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/5089)
2018-01-16 15:49:54 +00:00
|
|
|
static RAND_DRBG *drbg_setup(RAND_DRBG *parent)
|
2017-08-27 15:46:33 +00:00
|
|
|
{
|
2017-11-06 01:29:15 +00:00
|
|
|
RAND_DRBG *drbg;
|
2017-08-27 15:46:33 +00:00
|
|
|
|
2018-02-08 22:04:16 +00:00
|
|
|
drbg = RAND_DRBG_secure_new(RAND_DRBG_NID, 0, parent);
|
2017-11-06 01:29:15 +00:00
|
|
|
if (drbg == NULL)
|
|
|
|
return NULL;
|
|
|
|
|
2018-02-15 09:29:56 +00:00
|
|
|
if (rand_drbg_enable_locking(drbg) == 0)
|
2017-11-06 01:29:15 +00:00
|
|
|
goto err;
|
2017-11-24 13:59:58 +00:00
|
|
|
|
2017-11-24 14:24:51 +00:00
|
|
|
if (parent == NULL) {
|
2017-11-24 13:59:58 +00:00
|
|
|
drbg->reseed_interval = MASTER_RESEED_INTERVAL;
|
2017-11-24 14:24:51 +00:00
|
|
|
drbg->reseed_time_interval = MASTER_RESEED_TIME_INTERVAL;
|
|
|
|
} else {
|
2017-11-24 13:59:58 +00:00
|
|
|
drbg->reseed_interval = SLAVE_RESEED_INTERVAL;
|
2017-11-24 14:24:51 +00:00
|
|
|
drbg->reseed_time_interval = SLAVE_RESEED_TIME_INTERVAL;
|
2017-11-24 13:59:58 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* enable seed propagation */
|
|
|
|
drbg->reseed_counter = 1;
|
|
|
|
|
2017-08-31 21:16:22 +00:00
|
|
|
/*
|
|
|
|
* Ignore instantiation error so support just-in-time instantiation.
|
|
|
|
*
|
|
|
|
* The state of the drbg will be checked in RAND_DRBG_generate() and
|
|
|
|
* an automatic recovery is attempted.
|
|
|
|
*/
|
|
|
|
RAND_DRBG_instantiate(drbg,
|
|
|
|
(const unsigned char *) ossl_pers_string,
|
|
|
|
sizeof(ossl_pers_string) - 1);
|
2017-11-06 01:29:15 +00:00
|
|
|
return drbg;
|
|
|
|
|
|
|
|
err:
|
2018-02-08 21:46:23 +00:00
|
|
|
RAND_DRBG_free(drbg);
|
2017-11-06 01:29:15 +00:00
|
|
|
return NULL;
|
2017-08-27 15:46:33 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Initialize the global DRBGs on first use.
|
|
|
|
* Returns 1 on success, 0 on failure.
|
|
|
|
*/
|
2017-08-31 21:16:22 +00:00
|
|
|
DEFINE_RUN_ONCE_STATIC(do_rand_drbg_init)
|
2017-08-27 15:46:33 +00:00
|
|
|
{
|
2018-01-16 07:03:37 +00:00
|
|
|
/*
|
|
|
|
* ensure that libcrypto is initialized, otherwise the
|
|
|
|
* DRBG locks are not cleaned up properly
|
|
|
|
*/
|
|
|
|
if (!OPENSSL_init_crypto(0, NULL))
|
|
|
|
return 0;
|
|
|
|
|
Revert the crypto "global lock" implementation
Conceptually, this is a squashed version of:
Revert "Address feedback"
This reverts commit 75551e07bd2339dfea06ef1d31d69929e13a4495.
and
Revert "Add CRYPTO_thread_glock_new"
This reverts commit ed6b2c7938ec6f07b15745d4183afc276e74c6dd.
But there were some intervening commits that made neither revert apply
cleanly, so instead do it all as one shot.
The crypto global locks were an attempt to cope with the awkward
POSIX semantics for pthread_atfork(); its documentation (the "RATIONALE"
section) indicates that the expected usage is to have the prefork handler
lock all "global" locks, and the parent and child handlers release those
locks, to ensure that forking happens with a consistent (lock) state.
However, the set of functions available in the child process is limited
to async-signal-safe functions, and pthread_mutex_unlock() is not on
the list of async-signal-safe functions! The only synchronization
primitives that are async-signal-safe are the semaphore primitives,
which are not really appropriate for general-purpose usage.
However, the state consistency problem that the global locks were
attempting to solve is not actually a serious problem, particularly for
OpenSSL. That is, we can consider four cases of forking application
that might use OpenSSL:
(1) Single-threaded, does not call into OpenSSL in the child (e.g.,
the child calls exec() immediately)
For this class of process, no locking is needed at all, since there is
only ever a single thread of execution and the only reentrancy is due to
signal handlers (which are themselves limited to async-signal-safe
operation and should not be doing much work at all).
(2) Single-threaded, calls into OpenSSL after fork()
The application must ensure that it does not fork() with an unexpected
lock held (that is, one that would get unlocked in the parent but
accidentally remain locked in the child and cause deadlock). Since
OpenSSL does not expose any of its internal locks to the application
and the application is single-threaded, the OpenSSL internal locks
will be unlocked for the fork(), and the state will be consistent.
(OpenSSL will need to reseed its PRNG in the child, but that is
an orthogonal issue.) If the application makes use of locks from
libcrypto, proper handling for those locks is the responsibility of
the application, as for any other locking primitive that is available
for application programming.
(3) Multi-threaded, does not call into OpenSSL after fork()
As for (1), the OpenSSL state is only relevant in the parent, so
no particular fork()-related handling is needed. The internal locks
are relevant, but there is no interaction with the child to consider.
(4) Multi-threaded, calls into OpenSSL after fork()
This is the case where the pthread_atfork() hooks to ensure that all
global locks are in a known state across fork() would come into play,
per the above discussion. However, these "calls into OpenSSL after
fork()" are still subject to the restriction to async-signal-safe
functions. Since OpenSSL uses all sorts of locking and libc functions
that are not on the list of safe functions (e.g., malloc()), this
case is not currently usable and is unlikely to ever be usable,
independently of the locking situation. So, there is no need to
go through contortions to attempt to support this case in the one small
area of locking interaction with fork().
In light of the above analysis (thanks @davidben and @achernya), go
back to the simpler implementation that does not need to distinguish
"library-global" locks or to have complicated atfork handling for locks.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/5089)
2018-01-16 15:49:54 +00:00
|
|
|
drbg_master = drbg_setup(NULL);
|
|
|
|
drbg_public = drbg_setup(drbg_master);
|
|
|
|
drbg_private = drbg_setup(drbg_master);
|
2017-08-27 15:46:33 +00:00
|
|
|
|
2017-11-06 01:29:15 +00:00
|
|
|
if (drbg_master == NULL || drbg_public == NULL || drbg_private == NULL)
|
|
|
|
return 0;
|
2017-08-27 15:46:33 +00:00
|
|
|
|
2017-11-06 01:29:15 +00:00
|
|
|
return 1;
|
2017-08-27 15:46:33 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Clean up the global DRBGs before exit */
|
2017-08-31 21:16:22 +00:00
|
|
|
void rand_drbg_cleanup_int(void)
|
2017-08-27 15:46:33 +00:00
|
|
|
{
|
2018-02-08 21:46:23 +00:00
|
|
|
RAND_DRBG_free(drbg_private);
|
|
|
|
RAND_DRBG_free(drbg_public);
|
|
|
|
RAND_DRBG_free(drbg_master);
|
2017-11-06 01:29:15 +00:00
|
|
|
|
|
|
|
drbg_private = drbg_public = drbg_master = NULL;
|
2017-08-27 15:46:33 +00:00
|
|
|
}
|
|
|
|
|
2017-08-31 21:16:22 +00:00
|
|
|
/* Implements the default OpenSSL RAND_bytes() method */
|
2017-08-03 13:23:28 +00:00
|
|
|
static int drbg_bytes(unsigned char *out, int count)
|
|
|
|
{
|
2018-02-03 21:33:19 +00:00
|
|
|
int ret;
|
2017-11-24 13:59:58 +00:00
|
|
|
RAND_DRBG *drbg = RAND_DRBG_get0_public();
|
2017-08-03 13:23:28 +00:00
|
|
|
|
2017-08-27 15:46:33 +00:00
|
|
|
if (drbg == NULL)
|
|
|
|
return 0;
|
|
|
|
|
2018-02-15 09:29:56 +00:00
|
|
|
rand_drbg_lock(drbg);
|
2018-02-03 21:33:19 +00:00
|
|
|
ret = RAND_DRBG_bytes(drbg, out, count);
|
2018-02-15 09:29:56 +00:00
|
|
|
rand_drbg_unlock(drbg);
|
2018-02-03 21:33:19 +00:00
|
|
|
|
2017-08-03 13:23:28 +00:00
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
2017-08-31 21:16:22 +00:00
|
|
|
/* Implements the default OpenSSL RAND_add() method */
|
2017-08-03 13:23:28 +00:00
|
|
|
static int drbg_add(const void *buf, int num, double randomness)
|
|
|
|
{
|
2017-08-31 21:16:22 +00:00
|
|
|
int ret = 0;
|
2017-11-24 13:59:58 +00:00
|
|
|
RAND_DRBG *drbg = RAND_DRBG_get0_master();
|
2017-08-03 13:23:28 +00:00
|
|
|
|
2017-08-31 21:16:22 +00:00
|
|
|
if (drbg == NULL)
|
|
|
|
return 0;
|
2017-08-03 13:23:28 +00:00
|
|
|
|
2017-08-31 21:16:22 +00:00
|
|
|
if (num < 0 || randomness < 0.0)
|
|
|
|
return 0;
|
2017-08-03 13:23:28 +00:00
|
|
|
|
2017-08-31 21:16:22 +00:00
|
|
|
if (randomness > (double)drbg->max_entropylen) {
|
|
|
|
/*
|
|
|
|
* The purpose of this check is to bound |randomness| by a
|
|
|
|
* relatively small value in order to prevent an integer
|
|
|
|
* overflow when multiplying by 8 in the rand_drbg_restart()
|
|
|
|
* call below.
|
|
|
|
*/
|
|
|
|
return 0;
|
2017-08-03 13:23:28 +00:00
|
|
|
}
|
|
|
|
|
2018-02-15 09:29:56 +00:00
|
|
|
rand_drbg_lock(drbg);
|
2017-08-31 21:16:22 +00:00
|
|
|
ret = rand_drbg_restart(drbg, buf,
|
|
|
|
(size_t)(unsigned int)num,
|
|
|
|
(size_t)(8*randomness));
|
2018-02-15 09:29:56 +00:00
|
|
|
rand_drbg_unlock(drbg);
|
2017-08-31 21:16:22 +00:00
|
|
|
|
|
|
|
return ret;
|
2017-08-03 13:23:28 +00:00
|
|
|
}
|
|
|
|
|
2017-08-31 21:16:22 +00:00
|
|
|
/* Implements the default OpenSSL RAND_seed() method */
|
2017-08-03 13:23:28 +00:00
|
|
|
static int drbg_seed(const void *buf, int num)
|
|
|
|
{
|
|
|
|
return drbg_add(buf, num, num);
|
|
|
|
}
|
|
|
|
|
2017-08-31 21:16:22 +00:00
|
|
|
/* Implements the default OpenSSL RAND_status() method */
|
2017-08-03 13:23:28 +00:00
|
|
|
static int drbg_status(void)
|
2017-06-27 16:04:37 +00:00
|
|
|
{
|
2017-08-03 13:23:28 +00:00
|
|
|
int ret;
|
2017-11-24 13:59:58 +00:00
|
|
|
RAND_DRBG *drbg = RAND_DRBG_get0_master();
|
2017-08-27 15:46:33 +00:00
|
|
|
|
|
|
|
if (drbg == NULL)
|
|
|
|
return 0;
|
2017-08-03 13:23:28 +00:00
|
|
|
|
2018-02-15 09:29:56 +00:00
|
|
|
rand_drbg_lock(drbg);
|
2017-08-27 15:46:33 +00:00
|
|
|
ret = drbg->state == DRBG_READY ? 1 : 0;
|
2018-02-15 09:29:56 +00:00
|
|
|
rand_drbg_unlock(drbg);
|
2017-08-03 13:23:28 +00:00
|
|
|
return ret;
|
2017-06-27 16:04:37 +00:00
|
|
|
}
|
|
|
|
|
2017-08-27 15:46:33 +00:00
|
|
|
/*
|
2017-11-24 13:59:58 +00:00
|
|
|
* Get the master DRBG.
|
|
|
|
* Returns pointer to the DRBG on success, NULL on failure.
|
|
|
|
*
|
|
|
|
*/
|
|
|
|
RAND_DRBG *RAND_DRBG_get0_master(void)
|
|
|
|
{
|
|
|
|
if (!RUN_ONCE(&rand_drbg_init, do_rand_drbg_init))
|
|
|
|
return NULL;
|
|
|
|
|
2017-11-06 01:29:15 +00:00
|
|
|
return drbg_master;
|
2017-11-24 13:59:58 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Get the public DRBG.
|
2017-08-27 15:46:33 +00:00
|
|
|
* Returns pointer to the DRBG on success, NULL on failure.
|
|
|
|
*/
|
2017-11-24 13:59:58 +00:00
|
|
|
RAND_DRBG *RAND_DRBG_get0_public(void)
|
2017-08-27 15:46:33 +00:00
|
|
|
{
|
2017-08-31 21:16:22 +00:00
|
|
|
if (!RUN_ONCE(&rand_drbg_init, do_rand_drbg_init))
|
2017-08-27 15:46:33 +00:00
|
|
|
return NULL;
|
|
|
|
|
2017-11-06 01:29:15 +00:00
|
|
|
return drbg_public;
|
2017-08-27 15:46:33 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2017-11-24 13:59:58 +00:00
|
|
|
* Get the private DRBG.
|
2017-08-27 15:46:33 +00:00
|
|
|
* Returns pointer to the DRBG on success, NULL on failure.
|
|
|
|
*/
|
2017-11-24 13:59:58 +00:00
|
|
|
RAND_DRBG *RAND_DRBG_get0_private(void)
|
2017-08-27 15:46:33 +00:00
|
|
|
{
|
2017-08-31 21:16:22 +00:00
|
|
|
if (!RUN_ONCE(&rand_drbg_init, do_rand_drbg_init))
|
2017-08-27 15:46:33 +00:00
|
|
|
return NULL;
|
|
|
|
|
2017-11-06 01:29:15 +00:00
|
|
|
return drbg_private;
|
2017-08-27 15:46:33 +00:00
|
|
|
}
|
|
|
|
|
2017-08-03 13:23:28 +00:00
|
|
|
RAND_METHOD rand_meth = {
|
|
|
|
drbg_seed,
|
|
|
|
drbg_bytes,
|
2017-08-02 18:00:52 +00:00
|
|
|
NULL,
|
2017-08-03 13:23:28 +00:00
|
|
|
drbg_add,
|
|
|
|
drbg_bytes,
|
|
|
|
drbg_status
|
|
|
|
};
|
|
|
|
|
|
|
|
RAND_METHOD *RAND_OpenSSL(void)
|
2017-06-27 16:04:37 +00:00
|
|
|
{
|
2017-08-03 13:23:28 +00:00
|
|
|
return &rand_meth;
|
2017-06-27 16:04:37 +00:00
|
|
|
}
|