2017-06-27 16:04:37 +00:00
|
|
|
/*
|
2018-01-09 04:49:01 +00:00
|
|
|
* Copyright 2011-2018 The OpenSSL Project Authors. All Rights Reserved.
|
2017-06-27 16:04:37 +00:00
|
|
|
*
|
2018-12-06 12:52:15 +00:00
|
|
|
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
2017-06-27 16:04:37 +00:00
|
|
|
* this file except in compliance with the License. You can obtain a copy
|
|
|
|
* in the file LICENSE in the source distribution or at
|
|
|
|
* https://www.openssl.org/source/license.html
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <string.h>
|
|
|
|
#include <openssl/crypto.h>
|
|
|
|
#include <openssl/err.h>
|
|
|
|
#include <openssl/rand.h>
|
|
|
|
#include "rand_lcl.h"
|
2017-08-27 15:46:33 +00:00
|
|
|
#include "internal/thread_once.h"
|
|
|
|
#include "internal/rand_int.h"
|
2018-03-07 18:25:55 +00:00
|
|
|
#include "internal/cryptlib_int.h"
|
2017-06-27 16:04:37 +00:00
|
|
|
|
|
|
|
/*
|
2018-02-27 18:02:24 +00:00
|
|
|
* Support framework for NIST SP 800-90A DRBG
|
|
|
|
*
|
|
|
|
* See manual page RAND_DRBG(7) for a general overview.
|
2017-08-03 13:23:28 +00:00
|
|
|
*
|
2017-06-27 16:04:37 +00:00
|
|
|
* The OpenSSL model is to have new and free functions, and that new
|
|
|
|
* does all initialization. That is not the NIST model, which has
|
|
|
|
* instantiation and un-instantiate, and re-use within a new/free
|
|
|
|
* lifecycle. (No doubt this comes from the desire to support hardware
|
|
|
|
* DRBG, where allocation of resources on something like an HSM is
|
|
|
|
* a much bigger deal than just re-setting an allocated resource.)
|
|
|
|
*/
|
|
|
|
|
2018-02-27 18:02:24 +00:00
|
|
|
|
2019-05-23 13:35:31 +00:00
|
|
|
typedef struct drbg_global_st {
|
|
|
|
/*
|
|
|
|
* The three shared DRBG instances
|
|
|
|
*
|
|
|
|
* There are three shared DRBG instances: <master>, <public>, and <private>.
|
|
|
|
*/
|
2017-11-24 13:59:58 +00:00
|
|
|
|
2019-05-23 13:35:31 +00:00
|
|
|
/*
|
|
|
|
* The <master> DRBG
|
|
|
|
*
|
|
|
|
* Not used directly by the application, only for reseeding the two other
|
|
|
|
* DRBGs. It reseeds itself by pulling either randomness from os entropy
|
|
|
|
* sources or by consuming randomness which was added by RAND_add().
|
|
|
|
*
|
|
|
|
* The <master> DRBG is a global instance which is accessed concurrently by
|
|
|
|
* all threads. The necessary locking is managed automatically by its child
|
|
|
|
* DRBG instances during reseeding.
|
|
|
|
*/
|
|
|
|
RAND_DRBG *master_drbg;
|
|
|
|
/*
|
|
|
|
* The <public> DRBG
|
|
|
|
*
|
|
|
|
* Used by default for generating random bytes using RAND_bytes().
|
|
|
|
*
|
|
|
|
* The <public> DRBG is thread-local, i.e., there is one instance per
|
|
|
|
* thread.
|
|
|
|
*/
|
|
|
|
CRYPTO_THREAD_LOCAL public_drbg;
|
|
|
|
/*
|
|
|
|
* The <private> DRBG
|
|
|
|
*
|
|
|
|
* Used by default for generating private keys using RAND_priv_bytes()
|
|
|
|
*
|
|
|
|
* The <private> DRBG is thread-local, i.e., there is one instance per
|
|
|
|
* thread.
|
|
|
|
*/
|
|
|
|
CRYPTO_THREAD_LOCAL private_drbg;
|
|
|
|
} DRBG_GLOBAL;
|
2017-11-24 13:59:58 +00:00
|
|
|
|
|
|
|
/* NIST SP 800-90A DRBG recommends the use of a personalization string. */
|
2019-03-29 07:50:48 +00:00
|
|
|
static const char ossl_pers_string[] = DRBG_DEFAULT_PERS_STRING;
|
2017-11-24 13:59:58 +00:00
|
|
|
|
2018-07-24 01:16:38 +00:00
|
|
|
#define RAND_DRBG_TYPE_FLAGS ( \
|
|
|
|
RAND_DRBG_FLAG_MASTER | RAND_DRBG_FLAG_PUBLIC | RAND_DRBG_FLAG_PRIVATE )
|
|
|
|
|
|
|
|
#define RAND_DRBG_TYPE_MASTER 0
|
|
|
|
#define RAND_DRBG_TYPE_PUBLIC 1
|
|
|
|
#define RAND_DRBG_TYPE_PRIVATE 2
|
|
|
|
|
|
|
|
/* Defaults */
|
|
|
|
static int rand_drbg_type[3] = {
|
|
|
|
RAND_DRBG_TYPE, /* Master */
|
|
|
|
RAND_DRBG_TYPE, /* Public */
|
|
|
|
RAND_DRBG_TYPE /* Private */
|
|
|
|
};
|
|
|
|
static unsigned int rand_drbg_flags[3] = {
|
|
|
|
RAND_DRBG_FLAGS | RAND_DRBG_FLAG_MASTER, /* Master */
|
|
|
|
RAND_DRBG_FLAGS | RAND_DRBG_FLAG_PUBLIC, /* Public */
|
|
|
|
RAND_DRBG_FLAGS | RAND_DRBG_FLAG_PRIVATE /* Private */
|
|
|
|
};
|
2018-03-15 18:48:43 +00:00
|
|
|
|
2018-03-09 17:24:23 +00:00
|
|
|
static unsigned int master_reseed_interval = MASTER_RESEED_INTERVAL;
|
|
|
|
static unsigned int slave_reseed_interval = SLAVE_RESEED_INTERVAL;
|
|
|
|
|
|
|
|
static time_t master_reseed_time_interval = MASTER_RESEED_TIME_INTERVAL;
|
|
|
|
static time_t slave_reseed_time_interval = SLAVE_RESEED_TIME_INTERVAL;
|
|
|
|
|
2018-09-11 22:37:15 +00:00
|
|
|
/* A logical OR of all used DRBG flag bits (currently there is only one) */
|
|
|
|
static const unsigned int rand_drbg_used_flags =
|
2018-07-24 01:16:38 +00:00
|
|
|
RAND_DRBG_FLAG_CTR_NO_DF | RAND_DRBG_FLAG_HMAC | RAND_DRBG_TYPE_FLAGS;
|
|
|
|
|
2018-09-11 22:37:15 +00:00
|
|
|
|
2019-05-23 13:35:31 +00:00
|
|
|
static RAND_DRBG *drbg_setup(OPENSSL_CTX *ctx, RAND_DRBG *parent, int drbg_type);
|
2018-02-08 21:46:23 +00:00
|
|
|
|
2019-05-23 13:35:31 +00:00
|
|
|
static RAND_DRBG *rand_drbg_new(OPENSSL_CTX *ctx,
|
|
|
|
int secure,
|
2018-02-08 21:46:23 +00:00
|
|
|
int type,
|
|
|
|
unsigned int flags,
|
|
|
|
RAND_DRBG *parent);
|
2017-08-27 15:46:33 +00:00
|
|
|
|
2018-07-24 01:16:38 +00:00
|
|
|
static int is_ctr(int type)
|
|
|
|
{
|
|
|
|
switch (type) {
|
|
|
|
case NID_aes_128_ctr:
|
|
|
|
case NID_aes_192_ctr:
|
|
|
|
case NID_aes_256_ctr:
|
|
|
|
return 1;
|
|
|
|
default:
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
static int is_digest(int type)
|
|
|
|
{
|
|
|
|
switch (type) {
|
|
|
|
case NID_sha1:
|
|
|
|
case NID_sha224:
|
|
|
|
case NID_sha256:
|
|
|
|
case NID_sha384:
|
|
|
|
case NID_sha512:
|
|
|
|
case NID_sha512_224:
|
|
|
|
case NID_sha512_256:
|
|
|
|
case NID_sha3_224:
|
|
|
|
case NID_sha3_256:
|
|
|
|
case NID_sha3_384:
|
|
|
|
case NID_sha3_512:
|
|
|
|
return 1;
|
|
|
|
default:
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-06-27 16:04:37 +00:00
|
|
|
/*
|
2018-03-15 18:48:43 +00:00
|
|
|
* Set/initialize |drbg| to be of type |type|, with optional |flags|.
|
|
|
|
*
|
|
|
|
* If |type| and |flags| are zero, use the defaults
|
2017-11-20 22:27:23 +00:00
|
|
|
*
|
|
|
|
* Returns 1 on success, 0 on failure.
|
2017-06-27 16:04:37 +00:00
|
|
|
*/
|
2018-03-15 18:48:43 +00:00
|
|
|
int RAND_DRBG_set(RAND_DRBG *drbg, int type, unsigned int flags)
|
2017-06-27 16:04:37 +00:00
|
|
|
{
|
|
|
|
int ret = 1;
|
|
|
|
|
2018-03-15 18:48:43 +00:00
|
|
|
if (type == 0 && flags == 0) {
|
2018-07-24 01:16:38 +00:00
|
|
|
type = rand_drbg_type[RAND_DRBG_TYPE_MASTER];
|
|
|
|
flags = rand_drbg_flags[RAND_DRBG_TYPE_MASTER];
|
|
|
|
}
|
|
|
|
|
|
|
|
/* If set is called multiple times - clear the old one */
|
2018-10-27 09:31:21 +00:00
|
|
|
if (drbg->type != 0 && (type != drbg->type || flags != drbg->flags)) {
|
2018-07-24 01:16:38 +00:00
|
|
|
drbg->meth->uninstantiate(drbg);
|
2018-10-27 09:31:21 +00:00
|
|
|
rand_pool_free(drbg->adin_pool);
|
|
|
|
drbg->adin_pool = NULL;
|
2018-03-15 18:48:43 +00:00
|
|
|
}
|
|
|
|
|
2017-08-03 13:23:28 +00:00
|
|
|
drbg->state = DRBG_UNINITIALISED;
|
|
|
|
drbg->flags = flags;
|
2018-03-15 18:48:43 +00:00
|
|
|
drbg->type = type;
|
2017-06-27 16:04:37 +00:00
|
|
|
|
2018-07-24 01:16:38 +00:00
|
|
|
if (type == 0) {
|
2017-06-27 16:04:37 +00:00
|
|
|
/* Uninitialized; that's okay. */
|
2018-10-27 09:31:21 +00:00
|
|
|
drbg->meth = NULL;
|
2017-06-27 16:04:37 +00:00
|
|
|
return 1;
|
2018-07-24 01:16:38 +00:00
|
|
|
} else if (is_ctr(type)) {
|
2017-12-28 20:42:14 +00:00
|
|
|
ret = drbg_ctr_init(drbg);
|
2018-07-24 01:16:38 +00:00
|
|
|
} else if (is_digest(type)) {
|
|
|
|
if (flags & RAND_DRBG_FLAG_HMAC)
|
|
|
|
ret = drbg_hmac_init(drbg);
|
|
|
|
else
|
|
|
|
ret = drbg_hash_init(drbg);
|
|
|
|
} else {
|
2018-10-29 12:48:53 +00:00
|
|
|
drbg->type = 0;
|
|
|
|
drbg->flags = 0;
|
|
|
|
drbg->meth = NULL;
|
2018-07-24 01:16:38 +00:00
|
|
|
RANDerr(RAND_F_RAND_DRBG_SET, RAND_R_UNSUPPORTED_DRBG_TYPE);
|
|
|
|
return 0;
|
2017-06-27 16:04:37 +00:00
|
|
|
}
|
|
|
|
|
2018-10-29 12:48:53 +00:00
|
|
|
if (ret == 0) {
|
|
|
|
drbg->state = DRBG_ERROR;
|
2017-06-27 16:04:37 +00:00
|
|
|
RANDerr(RAND_F_RAND_DRBG_SET, RAND_R_ERROR_INITIALISING_DRBG);
|
2018-10-29 12:48:53 +00:00
|
|
|
}
|
2017-06-27 16:04:37 +00:00
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
2018-03-15 18:48:43 +00:00
|
|
|
/*
|
|
|
|
* Set/initialize default |type| and |flag| for new drbg instances.
|
|
|
|
*
|
|
|
|
* Returns 1 on success, 0 on failure.
|
|
|
|
*/
|
|
|
|
int RAND_DRBG_set_defaults(int type, unsigned int flags)
|
|
|
|
{
|
2018-07-24 01:16:38 +00:00
|
|
|
int all;
|
|
|
|
if (!(is_digest(type) || is_ctr(type))) {
|
2018-03-15 18:48:43 +00:00
|
|
|
RANDerr(RAND_F_RAND_DRBG_SET_DEFAULTS, RAND_R_UNSUPPORTED_DRBG_TYPE);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2018-09-11 22:37:15 +00:00
|
|
|
if ((flags & ~rand_drbg_used_flags) != 0) {
|
2018-03-15 18:48:43 +00:00
|
|
|
RANDerr(RAND_F_RAND_DRBG_SET_DEFAULTS, RAND_R_UNSUPPORTED_DRBG_FLAGS);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2018-07-24 01:16:38 +00:00
|
|
|
all = ((flags & RAND_DRBG_TYPE_FLAGS) == 0);
|
|
|
|
if (all || (flags & RAND_DRBG_FLAG_MASTER) != 0) {
|
|
|
|
rand_drbg_type[RAND_DRBG_TYPE_MASTER] = type;
|
|
|
|
rand_drbg_flags[RAND_DRBG_TYPE_MASTER] = flags | RAND_DRBG_FLAG_MASTER;
|
|
|
|
}
|
|
|
|
if (all || (flags & RAND_DRBG_FLAG_PUBLIC) != 0) {
|
|
|
|
rand_drbg_type[RAND_DRBG_TYPE_PUBLIC] = type;
|
|
|
|
rand_drbg_flags[RAND_DRBG_TYPE_PUBLIC] = flags | RAND_DRBG_FLAG_PUBLIC;
|
|
|
|
}
|
|
|
|
if (all || (flags & RAND_DRBG_FLAG_PRIVATE) != 0) {
|
|
|
|
rand_drbg_type[RAND_DRBG_TYPE_PRIVATE] = type;
|
|
|
|
rand_drbg_flags[RAND_DRBG_TYPE_PRIVATE] = flags | RAND_DRBG_FLAG_PRIVATE;
|
|
|
|
}
|
|
|
|
return 1;
|
2018-03-15 18:48:43 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2017-06-27 16:04:37 +00:00
|
|
|
/*
|
2018-02-08 21:46:23 +00:00
|
|
|
* Allocate memory and initialize a new DRBG. The DRBG is allocated on
|
|
|
|
* the secure heap if |secure| is nonzero and the secure heap is enabled.
|
|
|
|
* The |parent|, if not NULL, will be used as random source for reseeding.
|
2017-11-24 13:59:58 +00:00
|
|
|
*
|
|
|
|
* Returns a pointer to the new DRBG instance on success, NULL on failure.
|
2017-06-27 16:04:37 +00:00
|
|
|
*/
|
2019-05-23 13:35:31 +00:00
|
|
|
static RAND_DRBG *rand_drbg_new(OPENSSL_CTX *ctx,
|
|
|
|
int secure,
|
2018-02-08 21:46:23 +00:00
|
|
|
int type,
|
|
|
|
unsigned int flags,
|
|
|
|
RAND_DRBG *parent)
|
2017-06-27 16:04:37 +00:00
|
|
|
{
|
2019-03-22 00:49:57 +00:00
|
|
|
RAND_DRBG *drbg = secure ? OPENSSL_secure_zalloc(sizeof(*drbg))
|
|
|
|
: OPENSSL_zalloc(sizeof(*drbg));
|
2017-06-27 16:04:37 +00:00
|
|
|
|
2017-08-22 22:24:23 +00:00
|
|
|
if (drbg == NULL) {
|
2017-06-27 16:04:37 +00:00
|
|
|
RANDerr(RAND_F_RAND_DRBG_NEW, ERR_R_MALLOC_FAILURE);
|
2018-03-16 14:32:25 +00:00
|
|
|
return NULL;
|
2017-06-27 16:04:37 +00:00
|
|
|
}
|
2018-02-08 21:46:23 +00:00
|
|
|
|
2019-05-23 13:35:31 +00:00
|
|
|
drbg->libctx = ctx;
|
2018-02-08 21:46:23 +00:00
|
|
|
drbg->secure = secure && CRYPTO_secure_allocated(drbg);
|
2017-08-06 22:12:28 +00:00
|
|
|
drbg->fork_count = rand_fork_count;
|
2017-08-03 13:23:28 +00:00
|
|
|
drbg->parent = parent;
|
2018-03-09 17:24:23 +00:00
|
|
|
|
|
|
|
if (parent == NULL) {
|
2019-03-29 07:50:48 +00:00
|
|
|
#ifdef FIPS_MODE
|
|
|
|
drbg->get_entropy = rand_crngt_get_entropy;
|
|
|
|
drbg->cleanup_entropy = rand_crngt_cleanup_entropy;
|
|
|
|
#else
|
2018-04-10 08:22:52 +00:00
|
|
|
drbg->get_entropy = rand_drbg_get_entropy;
|
|
|
|
drbg->cleanup_entropy = rand_drbg_cleanup_entropy;
|
2019-03-29 07:50:48 +00:00
|
|
|
#endif
|
2018-04-10 08:22:52 +00:00
|
|
|
#ifndef RAND_DRBG_GET_RANDOM_NONCE
|
|
|
|
drbg->get_nonce = rand_drbg_get_nonce;
|
|
|
|
drbg->cleanup_nonce = rand_drbg_cleanup_nonce;
|
|
|
|
#endif
|
|
|
|
|
2018-03-09 17:24:23 +00:00
|
|
|
drbg->reseed_interval = master_reseed_interval;
|
|
|
|
drbg->reseed_time_interval = master_reseed_time_interval;
|
|
|
|
} else {
|
2018-04-10 08:22:52 +00:00
|
|
|
drbg->get_entropy = rand_drbg_get_entropy;
|
|
|
|
drbg->cleanup_entropy = rand_drbg_cleanup_entropy;
|
|
|
|
/*
|
|
|
|
* Do not provide nonce callbacks, the child DRBGs will
|
|
|
|
* obtain their nonce using random bits from the parent.
|
|
|
|
*/
|
|
|
|
|
2018-03-09 17:24:23 +00:00
|
|
|
drbg->reseed_interval = slave_reseed_interval;
|
|
|
|
drbg->reseed_time_interval = slave_reseed_time_interval;
|
|
|
|
}
|
|
|
|
|
2017-11-20 22:27:23 +00:00
|
|
|
if (RAND_DRBG_set(drbg, type, flags) == 0)
|
2017-08-03 13:23:28 +00:00
|
|
|
goto err;
|
|
|
|
|
2018-03-07 18:25:55 +00:00
|
|
|
if (parent != NULL) {
|
|
|
|
rand_drbg_lock(parent);
|
|
|
|
if (drbg->strength > parent->strength) {
|
|
|
|
/*
|
|
|
|
* We currently don't support the algorithm from NIST SP 800-90C
|
|
|
|
* 10.1.2 to use a weaker DRBG as source
|
|
|
|
*/
|
|
|
|
rand_drbg_unlock(parent);
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_NEW, RAND_R_PARENT_STRENGTH_TOO_WEAK);
|
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
rand_drbg_unlock(parent);
|
2018-03-04 12:23:05 +00:00
|
|
|
}
|
|
|
|
|
2017-08-03 13:23:28 +00:00
|
|
|
return drbg;
|
|
|
|
|
2017-09-15 19:14:34 +00:00
|
|
|
err:
|
2018-10-30 19:57:53 +00:00
|
|
|
RAND_DRBG_free(drbg);
|
2018-02-08 21:46:23 +00:00
|
|
|
|
2017-08-03 13:23:28 +00:00
|
|
|
return NULL;
|
2017-06-27 16:04:37 +00:00
|
|
|
}
|
|
|
|
|
2019-05-23 13:35:31 +00:00
|
|
|
RAND_DRBG *RAND_DRBG_new_ex(OPENSSL_CTX *ctx, int type, unsigned int flags,
|
|
|
|
RAND_DRBG *parent)
|
|
|
|
{
|
|
|
|
return rand_drbg_new(ctx, 0, type, flags, parent);
|
|
|
|
}
|
|
|
|
|
2018-02-08 21:46:23 +00:00
|
|
|
RAND_DRBG *RAND_DRBG_new(int type, unsigned int flags, RAND_DRBG *parent)
|
|
|
|
{
|
2019-05-23 13:35:31 +00:00
|
|
|
return RAND_DRBG_new_ex(NULL, type, flags, parent);
|
2018-02-08 21:46:23 +00:00
|
|
|
}
|
|
|
|
|
2019-05-23 13:35:31 +00:00
|
|
|
RAND_DRBG *RAND_DRBG_secure_new_ex(OPENSSL_CTX *ctx, int type,
|
|
|
|
unsigned int flags, RAND_DRBG *parent)
|
2018-02-08 21:46:23 +00:00
|
|
|
{
|
2019-05-23 13:35:31 +00:00
|
|
|
return rand_drbg_new(ctx, 1, type, flags, parent);
|
2018-02-08 21:46:23 +00:00
|
|
|
}
|
|
|
|
|
2019-05-23 13:35:31 +00:00
|
|
|
RAND_DRBG *RAND_DRBG_secure_new(int type, unsigned int flags, RAND_DRBG *parent)
|
|
|
|
{
|
|
|
|
return RAND_DRBG_secure_new_ex(NULL, type, flags, parent);
|
|
|
|
}
|
2017-06-27 16:04:37 +00:00
|
|
|
/*
|
2017-08-03 13:23:28 +00:00
|
|
|
* Uninstantiate |drbg| and free all memory.
|
2017-06-27 16:04:37 +00:00
|
|
|
*/
|
2017-08-03 13:23:28 +00:00
|
|
|
void RAND_DRBG_free(RAND_DRBG *drbg)
|
2017-06-27 16:04:37 +00:00
|
|
|
{
|
2017-08-31 21:16:22 +00:00
|
|
|
if (drbg == NULL)
|
2017-06-27 16:04:37 +00:00
|
|
|
return;
|
|
|
|
|
2017-12-28 20:42:14 +00:00
|
|
|
if (drbg->meth != NULL)
|
|
|
|
drbg->meth->uninstantiate(drbg);
|
2018-10-27 09:31:21 +00:00
|
|
|
rand_pool_free(drbg->adin_pool);
|
2018-02-08 21:46:23 +00:00
|
|
|
CRYPTO_THREAD_lock_free(drbg->lock);
|
2017-08-03 13:23:28 +00:00
|
|
|
CRYPTO_free_ex_data(CRYPTO_EX_INDEX_DRBG, drbg, &drbg->ex_data);
|
2018-02-08 21:46:23 +00:00
|
|
|
|
|
|
|
if (drbg->secure)
|
|
|
|
OPENSSL_secure_clear_free(drbg, sizeof(*drbg));
|
|
|
|
else
|
|
|
|
OPENSSL_clear_free(drbg, sizeof(*drbg));
|
2017-06-27 16:04:37 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2017-08-03 13:23:28 +00:00
|
|
|
* Instantiate |drbg|, after it has been initialized. Use |pers| and
|
2017-06-27 16:04:37 +00:00
|
|
|
* |perslen| as prediction-resistance input.
|
2017-10-11 17:25:26 +00:00
|
|
|
*
|
|
|
|
* Requires that drbg->lock is already locked for write, if non-null.
|
2017-11-20 22:27:23 +00:00
|
|
|
*
|
|
|
|
* Returns 1 on success, 0 on failure.
|
2017-06-27 16:04:37 +00:00
|
|
|
*/
|
2017-08-03 13:23:28 +00:00
|
|
|
int RAND_DRBG_instantiate(RAND_DRBG *drbg,
|
2017-06-27 16:04:37 +00:00
|
|
|
const unsigned char *pers, size_t perslen)
|
|
|
|
{
|
|
|
|
unsigned char *nonce = NULL, *entropy = NULL;
|
DRBG: clarify difference between entropy counts and buffer lengths
Unlike the NIST DRBG standard, entropy counts are in bits and
buffer lengths are in bytes. This has lead to some confusion and
errors in the past, see my comment on PR 3789.
To clarify the destinction between entropy counts and buffer lengths,
a 'len' suffix has been added to all member names of RAND_DRBG which
represent buffer lengths:
- {min,max}_{entropy,adin,nonce,pers}
+ {min,max}_{entropy,adin,nonce,pers}len
This change makes naming also more consistent, as can be seen in the
diffs, for example:
- else if (adinlen > drbg->max_adin) {
+ else if (adinlen > drbg->max_adinlen) {
Also replaced all 'ent's by 'entropy's, following a suggestion of Paul Dale.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4266)
2017-08-20 21:02:46 +00:00
|
|
|
size_t noncelen = 0, entropylen = 0;
|
2018-03-03 22:19:03 +00:00
|
|
|
size_t min_entropy = drbg->strength;
|
|
|
|
size_t min_entropylen = drbg->min_entropylen;
|
|
|
|
size_t max_entropylen = drbg->max_entropylen;
|
2017-06-27 16:04:37 +00:00
|
|
|
|
DRBG: clarify difference between entropy counts and buffer lengths
Unlike the NIST DRBG standard, entropy counts are in bits and
buffer lengths are in bytes. This has lead to some confusion and
errors in the past, see my comment on PR 3789.
To clarify the destinction between entropy counts and buffer lengths,
a 'len' suffix has been added to all member names of RAND_DRBG which
represent buffer lengths:
- {min,max}_{entropy,adin,nonce,pers}
+ {min,max}_{entropy,adin,nonce,pers}len
This change makes naming also more consistent, as can be seen in the
diffs, for example:
- else if (adinlen > drbg->max_adin) {
+ else if (adinlen > drbg->max_adinlen) {
Also replaced all 'ent's by 'entropy's, following a suggestion of Paul Dale.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4266)
2017-08-20 21:02:46 +00:00
|
|
|
if (perslen > drbg->max_perslen) {
|
2017-08-03 13:23:28 +00:00
|
|
|
RANDerr(RAND_F_RAND_DRBG_INSTANTIATE,
|
|
|
|
RAND_R_PERSONALISATION_STRING_TOO_LONG);
|
2017-06-27 16:04:37 +00:00
|
|
|
goto end;
|
|
|
|
}
|
2017-12-28 20:42:14 +00:00
|
|
|
|
2018-04-26 08:14:14 +00:00
|
|
|
if (drbg->meth == NULL) {
|
2017-12-28 20:42:14 +00:00
|
|
|
RANDerr(RAND_F_RAND_DRBG_INSTANTIATE,
|
|
|
|
RAND_R_NO_DRBG_IMPLEMENTATION_SELECTED);
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
|
2017-08-03 13:23:28 +00:00
|
|
|
if (drbg->state != DRBG_UNINITIALISED) {
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_INSTANTIATE,
|
|
|
|
drbg->state == DRBG_ERROR ? RAND_R_IN_ERROR_STATE
|
|
|
|
: RAND_R_ALREADY_INSTANTIATED);
|
2017-06-27 16:04:37 +00:00
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
|
2017-08-03 13:23:28 +00:00
|
|
|
drbg->state = DRBG_ERROR;
|
2018-03-03 22:19:03 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* NIST SP800-90Ar1 section 9.1 says you can combine getting the entropy
|
|
|
|
* and nonce in 1 call by increasing the entropy with 50% and increasing
|
|
|
|
* the minimum length to accomadate the length of the nonce.
|
|
|
|
* We do this in case a nonce is require and get_nonce is NULL.
|
|
|
|
*/
|
|
|
|
if (drbg->min_noncelen > 0 && drbg->get_nonce == NULL) {
|
|
|
|
min_entropy += drbg->strength / 2;
|
|
|
|
min_entropylen += drbg->min_noncelen;
|
|
|
|
max_entropylen += drbg->max_noncelen;
|
|
|
|
}
|
|
|
|
|
2018-10-14 10:35:19 +00:00
|
|
|
drbg->reseed_next_counter = tsan_load(&drbg->reseed_prop_counter);
|
|
|
|
if (drbg->reseed_next_counter) {
|
|
|
|
drbg->reseed_next_counter++;
|
|
|
|
if(!drbg->reseed_next_counter)
|
|
|
|
drbg->reseed_next_counter = 1;
|
|
|
|
}
|
|
|
|
|
2017-08-03 13:23:28 +00:00
|
|
|
if (drbg->get_entropy != NULL)
|
2018-03-03 22:19:03 +00:00
|
|
|
entropylen = drbg->get_entropy(drbg, &entropy, min_entropy,
|
|
|
|
min_entropylen, max_entropylen, 0);
|
|
|
|
if (entropylen < min_entropylen
|
2017-09-15 19:14:34 +00:00
|
|
|
|| entropylen > max_entropylen) {
|
2017-08-03 13:23:28 +00:00
|
|
|
RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, RAND_R_ERROR_RETRIEVING_ENTROPY);
|
2017-06-27 16:04:37 +00:00
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
|
2018-03-03 22:19:03 +00:00
|
|
|
if (drbg->min_noncelen > 0 && drbg->get_nonce != NULL) {
|
2017-08-03 13:23:28 +00:00
|
|
|
noncelen = drbg->get_nonce(drbg, &nonce, drbg->strength / 2,
|
DRBG: clarify difference between entropy counts and buffer lengths
Unlike the NIST DRBG standard, entropy counts are in bits and
buffer lengths are in bytes. This has lead to some confusion and
errors in the past, see my comment on PR 3789.
To clarify the destinction between entropy counts and buffer lengths,
a 'len' suffix has been added to all member names of RAND_DRBG which
represent buffer lengths:
- {min,max}_{entropy,adin,nonce,pers}
+ {min,max}_{entropy,adin,nonce,pers}len
This change makes naming also more consistent, as can be seen in the
diffs, for example:
- else if (adinlen > drbg->max_adin) {
+ else if (adinlen > drbg->max_adinlen) {
Also replaced all 'ent's by 'entropy's, following a suggestion of Paul Dale.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4266)
2017-08-20 21:02:46 +00:00
|
|
|
drbg->min_noncelen, drbg->max_noncelen);
|
|
|
|
if (noncelen < drbg->min_noncelen || noncelen > drbg->max_noncelen) {
|
2018-03-03 22:19:03 +00:00
|
|
|
RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, RAND_R_ERROR_RETRIEVING_NONCE);
|
2017-06-27 16:04:37 +00:00
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-12-28 20:42:14 +00:00
|
|
|
if (!drbg->meth->instantiate(drbg, entropy, entropylen,
|
2017-06-27 16:04:37 +00:00
|
|
|
nonce, noncelen, pers, perslen)) {
|
2017-08-03 13:23:28 +00:00
|
|
|
RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, RAND_R_ERROR_INSTANTIATING_DRBG);
|
2017-06-27 16:04:37 +00:00
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
|
2017-08-03 13:23:28 +00:00
|
|
|
drbg->state = DRBG_READY;
|
2018-07-24 01:16:38 +00:00
|
|
|
drbg->reseed_gen_counter = 1;
|
2017-11-24 14:24:51 +00:00
|
|
|
drbg->reseed_time = time(NULL);
|
2018-10-14 10:35:19 +00:00
|
|
|
tsan_store(&drbg->reseed_prop_counter, drbg->reseed_next_counter);
|
2017-06-27 16:04:37 +00:00
|
|
|
|
2017-09-15 19:14:34 +00:00
|
|
|
end:
|
2017-08-03 13:23:28 +00:00
|
|
|
if (entropy != NULL && drbg->cleanup_entropy != NULL)
|
2017-08-25 21:26:53 +00:00
|
|
|
drbg->cleanup_entropy(drbg, entropy, entropylen);
|
2017-09-15 19:14:34 +00:00
|
|
|
if (nonce != NULL && drbg->cleanup_nonce != NULL)
|
2017-08-25 21:26:53 +00:00
|
|
|
drbg->cleanup_nonce(drbg, nonce, noncelen);
|
2017-08-03 13:23:28 +00:00
|
|
|
if (drbg->state == DRBG_READY)
|
2017-06-27 16:04:37 +00:00
|
|
|
return 1;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2017-08-03 13:23:28 +00:00
|
|
|
* Uninstantiate |drbg|. Must be instantiated before it can be used.
|
2017-10-11 17:25:26 +00:00
|
|
|
*
|
|
|
|
* Requires that drbg->lock is already locked for write, if non-null.
|
2017-11-20 22:27:23 +00:00
|
|
|
*
|
|
|
|
* Returns 1 on success, 0 on failure.
|
2017-06-27 16:04:37 +00:00
|
|
|
*/
|
2017-08-03 13:23:28 +00:00
|
|
|
int RAND_DRBG_uninstantiate(RAND_DRBG *drbg)
|
2017-06-27 16:04:37 +00:00
|
|
|
{
|
2018-07-24 01:16:38 +00:00
|
|
|
int index = -1, type, flags;
|
2018-04-26 08:14:14 +00:00
|
|
|
if (drbg->meth == NULL) {
|
2018-11-02 10:46:38 +00:00
|
|
|
drbg->state = DRBG_ERROR;
|
2017-12-28 20:42:14 +00:00
|
|
|
RANDerr(RAND_F_RAND_DRBG_UNINSTANTIATE,
|
|
|
|
RAND_R_NO_DRBG_IMPLEMENTATION_SELECTED);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2017-11-20 22:27:23 +00:00
|
|
|
/* Clear the entire drbg->ctr struct, then reset some important
|
|
|
|
* members of the drbg->ctr struct (e.g. keysize, df_ks) to their
|
|
|
|
* initial values.
|
|
|
|
*/
|
2017-12-28 20:42:14 +00:00
|
|
|
drbg->meth->uninstantiate(drbg);
|
2018-07-24 01:16:38 +00:00
|
|
|
|
|
|
|
/* The reset uses the default values for type and flags */
|
|
|
|
if (drbg->flags & RAND_DRBG_FLAG_MASTER)
|
|
|
|
index = RAND_DRBG_TYPE_MASTER;
|
|
|
|
else if (drbg->flags & RAND_DRBG_FLAG_PRIVATE)
|
|
|
|
index = RAND_DRBG_TYPE_PRIVATE;
|
|
|
|
else if (drbg->flags & RAND_DRBG_FLAG_PUBLIC)
|
|
|
|
index = RAND_DRBG_TYPE_PUBLIC;
|
|
|
|
|
|
|
|
if (index != -1) {
|
|
|
|
flags = rand_drbg_flags[index];
|
|
|
|
type = rand_drbg_type[index];
|
|
|
|
} else {
|
|
|
|
flags = drbg->flags;
|
|
|
|
type = drbg->type;
|
|
|
|
}
|
|
|
|
return RAND_DRBG_set(drbg, type, flags);
|
2017-06-27 16:04:37 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2017-08-31 21:16:22 +00:00
|
|
|
* Reseed |drbg|, mixing in the specified data
|
2017-10-11 17:25:26 +00:00
|
|
|
*
|
|
|
|
* Requires that drbg->lock is already locked for write, if non-null.
|
2017-11-20 22:27:23 +00:00
|
|
|
*
|
|
|
|
* Returns 1 on success, 0 on failure.
|
2017-06-27 16:04:37 +00:00
|
|
|
*/
|
2017-08-03 13:23:28 +00:00
|
|
|
int RAND_DRBG_reseed(RAND_DRBG *drbg,
|
2018-02-18 18:26:55 +00:00
|
|
|
const unsigned char *adin, size_t adinlen,
|
|
|
|
int prediction_resistance)
|
2017-06-27 16:04:37 +00:00
|
|
|
{
|
|
|
|
unsigned char *entropy = NULL;
|
DRBG: clarify difference between entropy counts and buffer lengths
Unlike the NIST DRBG standard, entropy counts are in bits and
buffer lengths are in bytes. This has lead to some confusion and
errors in the past, see my comment on PR 3789.
To clarify the destinction between entropy counts and buffer lengths,
a 'len' suffix has been added to all member names of RAND_DRBG which
represent buffer lengths:
- {min,max}_{entropy,adin,nonce,pers}
+ {min,max}_{entropy,adin,nonce,pers}len
This change makes naming also more consistent, as can be seen in the
diffs, for example:
- else if (adinlen > drbg->max_adin) {
+ else if (adinlen > drbg->max_adinlen) {
Also replaced all 'ent's by 'entropy's, following a suggestion of Paul Dale.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4266)
2017-08-20 21:02:46 +00:00
|
|
|
size_t entropylen = 0;
|
2017-08-03 13:23:28 +00:00
|
|
|
|
|
|
|
if (drbg->state == DRBG_ERROR) {
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_RESEED, RAND_R_IN_ERROR_STATE);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
if (drbg->state == DRBG_UNINITIALISED) {
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_RESEED, RAND_R_NOT_INSTANTIATED);
|
|
|
|
return 0;
|
2017-06-27 16:04:37 +00:00
|
|
|
}
|
|
|
|
|
2018-04-26 08:14:14 +00:00
|
|
|
if (adin == NULL) {
|
2017-06-27 16:04:37 +00:00
|
|
|
adinlen = 0;
|
2018-04-26 08:14:14 +00:00
|
|
|
} else if (adinlen > drbg->max_adinlen) {
|
2017-08-03 13:23:28 +00:00
|
|
|
RANDerr(RAND_F_RAND_DRBG_RESEED, RAND_R_ADDITIONAL_INPUT_TOO_LONG);
|
|
|
|
return 0;
|
2017-06-27 16:04:37 +00:00
|
|
|
}
|
|
|
|
|
2017-08-03 13:23:28 +00:00
|
|
|
drbg->state = DRBG_ERROR;
|
2018-10-14 10:35:19 +00:00
|
|
|
|
|
|
|
drbg->reseed_next_counter = tsan_load(&drbg->reseed_prop_counter);
|
|
|
|
if (drbg->reseed_next_counter) {
|
|
|
|
drbg->reseed_next_counter++;
|
|
|
|
if(!drbg->reseed_next_counter)
|
|
|
|
drbg->reseed_next_counter = 1;
|
|
|
|
}
|
|
|
|
|
2017-08-03 13:23:28 +00:00
|
|
|
if (drbg->get_entropy != NULL)
|
DRBG: clarify difference between entropy counts and buffer lengths
Unlike the NIST DRBG standard, entropy counts are in bits and
buffer lengths are in bytes. This has lead to some confusion and
errors in the past, see my comment on PR 3789.
To clarify the destinction between entropy counts and buffer lengths,
a 'len' suffix has been added to all member names of RAND_DRBG which
represent buffer lengths:
- {min,max}_{entropy,adin,nonce,pers}
+ {min,max}_{entropy,adin,nonce,pers}len
This change makes naming also more consistent, as can be seen in the
diffs, for example:
- else if (adinlen > drbg->max_adin) {
+ else if (adinlen > drbg->max_adinlen) {
Also replaced all 'ent's by 'entropy's, following a suggestion of Paul Dale.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4266)
2017-08-20 21:02:46 +00:00
|
|
|
entropylen = drbg->get_entropy(drbg, &entropy, drbg->strength,
|
2018-02-18 18:26:55 +00:00
|
|
|
drbg->min_entropylen,
|
|
|
|
drbg->max_entropylen,
|
|
|
|
prediction_resistance);
|
2017-08-31 21:16:22 +00:00
|
|
|
if (entropylen < drbg->min_entropylen
|
2017-09-15 19:14:34 +00:00
|
|
|
|| entropylen > drbg->max_entropylen) {
|
2017-08-03 13:23:28 +00:00
|
|
|
RANDerr(RAND_F_RAND_DRBG_RESEED, RAND_R_ERROR_RETRIEVING_ENTROPY);
|
2017-06-27 16:04:37 +00:00
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
|
2017-12-28 20:42:14 +00:00
|
|
|
if (!drbg->meth->reseed(drbg, entropy, entropylen, adin, adinlen))
|
2017-06-27 16:04:37 +00:00
|
|
|
goto end;
|
2017-11-24 13:59:58 +00:00
|
|
|
|
2017-08-03 13:23:28 +00:00
|
|
|
drbg->state = DRBG_READY;
|
2018-07-24 01:16:38 +00:00
|
|
|
drbg->reseed_gen_counter = 1;
|
2017-11-24 14:24:51 +00:00
|
|
|
drbg->reseed_time = time(NULL);
|
2018-10-14 10:35:19 +00:00
|
|
|
tsan_store(&drbg->reseed_prop_counter, drbg->reseed_next_counter);
|
2017-06-27 16:04:37 +00:00
|
|
|
|
2017-09-15 19:14:34 +00:00
|
|
|
end:
|
2017-08-03 13:23:28 +00:00
|
|
|
if (entropy != NULL && drbg->cleanup_entropy != NULL)
|
2017-08-25 21:26:53 +00:00
|
|
|
drbg->cleanup_entropy(drbg, entropy, entropylen);
|
2017-08-03 13:23:28 +00:00
|
|
|
if (drbg->state == DRBG_READY)
|
2017-06-27 16:04:37 +00:00
|
|
|
return 1;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2017-08-31 21:16:22 +00:00
|
|
|
/*
|
|
|
|
* Restart |drbg|, using the specified entropy or additional input
|
|
|
|
*
|
|
|
|
* Tries its best to get the drbg instantiated by all means,
|
|
|
|
* regardless of its current state.
|
|
|
|
*
|
|
|
|
* Optionally, a |buffer| of |len| random bytes can be passed,
|
|
|
|
* which is assumed to contain at least |entropy| bits of entropy.
|
|
|
|
*
|
|
|
|
* If |entropy| > 0, the buffer content is used as entropy input.
|
|
|
|
*
|
|
|
|
* If |entropy| == 0, the buffer content is used as additional input
|
|
|
|
*
|
|
|
|
* Returns 1 on success, 0 on failure.
|
|
|
|
*
|
|
|
|
* This function is used internally only.
|
|
|
|
*/
|
|
|
|
int rand_drbg_restart(RAND_DRBG *drbg,
|
|
|
|
const unsigned char *buffer, size_t len, size_t entropy)
|
|
|
|
{
|
|
|
|
int reseeded = 0;
|
|
|
|
const unsigned char *adin = NULL;
|
|
|
|
size_t adinlen = 0;
|
|
|
|
|
2018-11-05 22:13:11 +00:00
|
|
|
if (drbg->seed_pool != NULL) {
|
2017-08-31 21:16:22 +00:00
|
|
|
RANDerr(RAND_F_RAND_DRBG_RESTART, ERR_R_INTERNAL_ERROR);
|
2018-10-09 23:53:29 +00:00
|
|
|
drbg->state = DRBG_ERROR;
|
2018-11-05 22:13:11 +00:00
|
|
|
rand_pool_free(drbg->seed_pool);
|
|
|
|
drbg->seed_pool = NULL;
|
2018-10-09 23:53:29 +00:00
|
|
|
return 0;
|
2017-08-31 21:16:22 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if (buffer != NULL) {
|
|
|
|
if (entropy > 0) {
|
|
|
|
if (drbg->max_entropylen < len) {
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_RESTART,
|
|
|
|
RAND_R_ENTROPY_INPUT_TOO_LONG);
|
2018-10-09 23:53:29 +00:00
|
|
|
drbg->state = DRBG_ERROR;
|
2017-08-31 21:16:22 +00:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (entropy > 8 * len) {
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_RESTART, RAND_R_ENTROPY_OUT_OF_RANGE);
|
2018-10-09 23:53:29 +00:00
|
|
|
drbg->state = DRBG_ERROR;
|
2017-08-31 21:16:22 +00:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* will be picked up by the rand_drbg_get_entropy() callback */
|
2018-11-05 22:13:11 +00:00
|
|
|
drbg->seed_pool = rand_pool_attach(buffer, len, entropy);
|
|
|
|
if (drbg->seed_pool == NULL)
|
2017-08-31 21:16:22 +00:00
|
|
|
return 0;
|
|
|
|
} else {
|
|
|
|
if (drbg->max_adinlen < len) {
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_RESTART,
|
|
|
|
RAND_R_ADDITIONAL_INPUT_TOO_LONG);
|
2018-10-09 23:53:29 +00:00
|
|
|
drbg->state = DRBG_ERROR;
|
2017-08-31 21:16:22 +00:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
adin = buffer;
|
|
|
|
adinlen = len;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* repair error state */
|
2017-11-20 22:27:23 +00:00
|
|
|
if (drbg->state == DRBG_ERROR)
|
2017-08-31 21:16:22 +00:00
|
|
|
RAND_DRBG_uninstantiate(drbg);
|
|
|
|
|
|
|
|
/* repair uninitialized state */
|
|
|
|
if (drbg->state == DRBG_UNINITIALISED) {
|
2017-11-24 13:59:58 +00:00
|
|
|
/* reinstantiate drbg */
|
|
|
|
RAND_DRBG_instantiate(drbg,
|
|
|
|
(const unsigned char *) ossl_pers_string,
|
|
|
|
sizeof(ossl_pers_string) - 1);
|
2017-08-31 21:16:22 +00:00
|
|
|
/* already reseeded. prevent second reseeding below */
|
|
|
|
reseeded = (drbg->state == DRBG_READY);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* refresh current state if entropy or additional input has been provided */
|
|
|
|
if (drbg->state == DRBG_READY) {
|
|
|
|
if (adin != NULL) {
|
|
|
|
/*
|
|
|
|
* mix in additional input without reseeding
|
|
|
|
*
|
|
|
|
* Similar to RAND_DRBG_reseed(), but the provided additional
|
|
|
|
* data |adin| is mixed into the current state without pulling
|
|
|
|
* entropy from the trusted entropy source using get_entropy().
|
|
|
|
* This is not a reseeding in the strict sense of NIST SP 800-90A.
|
|
|
|
*/
|
2017-12-28 20:42:14 +00:00
|
|
|
drbg->meth->reseed(drbg, adin, adinlen, NULL, 0);
|
2017-08-31 21:16:22 +00:00
|
|
|
} else if (reseeded == 0) {
|
|
|
|
/* do a full reseeding if it has not been done yet above */
|
2018-02-18 18:26:55 +00:00
|
|
|
RAND_DRBG_reseed(drbg, NULL, 0, 0);
|
2017-08-31 21:16:22 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2018-11-05 22:13:11 +00:00
|
|
|
rand_pool_free(drbg->seed_pool);
|
|
|
|
drbg->seed_pool = NULL;
|
2017-08-31 21:16:22 +00:00
|
|
|
|
|
|
|
return drbg->state == DRBG_READY;
|
|
|
|
}
|
|
|
|
|
2017-06-27 16:04:37 +00:00
|
|
|
/*
|
|
|
|
* Generate |outlen| bytes into the buffer at |out|. Reseed if we need
|
|
|
|
* to or if |prediction_resistance| is set. Additional input can be
|
|
|
|
* sent in |adin| and |adinlen|.
|
2017-08-31 21:16:22 +00:00
|
|
|
*
|
2017-10-11 17:25:26 +00:00
|
|
|
* Requires that drbg->lock is already locked for write, if non-null.
|
|
|
|
*
|
2017-08-31 21:16:22 +00:00
|
|
|
* Returns 1 on success, 0 on failure.
|
|
|
|
*
|
2017-06-27 16:04:37 +00:00
|
|
|
*/
|
2017-08-03 13:23:28 +00:00
|
|
|
int RAND_DRBG_generate(RAND_DRBG *drbg, unsigned char *out, size_t outlen,
|
2017-06-27 16:04:37 +00:00
|
|
|
int prediction_resistance,
|
|
|
|
const unsigned char *adin, size_t adinlen)
|
|
|
|
{
|
2017-10-09 21:51:42 +00:00
|
|
|
int reseed_required = 0;
|
|
|
|
|
2017-08-31 21:16:22 +00:00
|
|
|
if (drbg->state != DRBG_READY) {
|
|
|
|
/* try to recover from previous errors */
|
|
|
|
rand_drbg_restart(drbg, NULL, 0, 0);
|
|
|
|
|
|
|
|
if (drbg->state == DRBG_ERROR) {
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_IN_ERROR_STATE);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
if (drbg->state == DRBG_UNINITIALISED) {
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_NOT_INSTANTIATED);
|
|
|
|
return 0;
|
|
|
|
}
|
2017-06-27 16:04:37 +00:00
|
|
|
}
|
2017-08-31 21:16:22 +00:00
|
|
|
|
2017-08-03 13:23:28 +00:00
|
|
|
if (outlen > drbg->max_request) {
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_REQUEST_TOO_LARGE_FOR_DRBG);
|
|
|
|
return 0;
|
|
|
|
}
|
DRBG: clarify difference between entropy counts and buffer lengths
Unlike the NIST DRBG standard, entropy counts are in bits and
buffer lengths are in bytes. This has lead to some confusion and
errors in the past, see my comment on PR 3789.
To clarify the destinction between entropy counts and buffer lengths,
a 'len' suffix has been added to all member names of RAND_DRBG which
represent buffer lengths:
- {min,max}_{entropy,adin,nonce,pers}
+ {min,max}_{entropy,adin,nonce,pers}len
This change makes naming also more consistent, as can be seen in the
diffs, for example:
- else if (adinlen > drbg->max_adin) {
+ else if (adinlen > drbg->max_adinlen) {
Also replaced all 'ent's by 'entropy's, following a suggestion of Paul Dale.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4266)
2017-08-20 21:02:46 +00:00
|
|
|
if (adinlen > drbg->max_adinlen) {
|
2017-08-03 13:23:28 +00:00
|
|
|
RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_ADDITIONAL_INPUT_TOO_LONG);
|
|
|
|
return 0;
|
2017-06-27 16:04:37 +00:00
|
|
|
}
|
|
|
|
|
2017-08-06 22:12:28 +00:00
|
|
|
if (drbg->fork_count != rand_fork_count) {
|
|
|
|
drbg->fork_count = rand_fork_count;
|
2017-10-09 21:51:42 +00:00
|
|
|
reseed_required = 1;
|
2017-08-06 22:12:28 +00:00
|
|
|
}
|
|
|
|
|
2017-11-24 13:59:58 +00:00
|
|
|
if (drbg->reseed_interval > 0) {
|
2018-07-24 01:16:38 +00:00
|
|
|
if (drbg->reseed_gen_counter > drbg->reseed_interval)
|
2017-11-24 13:59:58 +00:00
|
|
|
reseed_required = 1;
|
|
|
|
}
|
2017-11-24 14:24:51 +00:00
|
|
|
if (drbg->reseed_time_interval > 0) {
|
|
|
|
time_t now = time(NULL);
|
|
|
|
if (now < drbg->reseed_time
|
|
|
|
|| now - drbg->reseed_time >= drbg->reseed_time_interval)
|
|
|
|
reseed_required = 1;
|
|
|
|
}
|
2018-10-14 10:35:19 +00:00
|
|
|
if (drbg->parent != NULL) {
|
|
|
|
unsigned int reseed_counter = tsan_load(&drbg->reseed_prop_counter);
|
|
|
|
if (reseed_counter > 0
|
|
|
|
&& tsan_load(&drbg->parent->reseed_prop_counter)
|
|
|
|
!= reseed_counter)
|
2017-11-24 13:59:58 +00:00
|
|
|
reseed_required = 1;
|
|
|
|
}
|
2017-06-27 16:04:37 +00:00
|
|
|
|
2017-10-09 21:51:42 +00:00
|
|
|
if (reseed_required || prediction_resistance) {
|
2018-02-18 18:26:55 +00:00
|
|
|
if (!RAND_DRBG_reseed(drbg, adin, adinlen, prediction_resistance)) {
|
2017-08-03 13:23:28 +00:00
|
|
|
RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_RESEED_ERROR);
|
|
|
|
return 0;
|
2017-06-27 16:04:37 +00:00
|
|
|
}
|
|
|
|
adin = NULL;
|
|
|
|
adinlen = 0;
|
|
|
|
}
|
|
|
|
|
2017-12-28 20:42:14 +00:00
|
|
|
if (!drbg->meth->generate(drbg, out, outlen, adin, adinlen)) {
|
2017-08-03 13:23:28 +00:00
|
|
|
drbg->state = DRBG_ERROR;
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_GENERATE_ERROR);
|
|
|
|
return 0;
|
2017-06-27 16:04:37 +00:00
|
|
|
}
|
2017-08-03 13:23:28 +00:00
|
|
|
|
2018-07-24 01:16:38 +00:00
|
|
|
drbg->reseed_gen_counter++;
|
2017-10-09 21:51:42 +00:00
|
|
|
|
2017-06-27 16:04:37 +00:00
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2017-11-17 14:00:35 +00:00
|
|
|
/*
|
|
|
|
* Generates |outlen| random bytes and stores them in |out|. It will
|
|
|
|
* using the given |drbg| to generate the bytes.
|
|
|
|
*
|
|
|
|
* Requires that drbg->lock is already locked for write, if non-null.
|
|
|
|
*
|
|
|
|
* Returns 1 on success 0 on failure.
|
|
|
|
*/
|
|
|
|
int RAND_DRBG_bytes(RAND_DRBG *drbg, unsigned char *out, size_t outlen)
|
|
|
|
{
|
|
|
|
unsigned char *additional = NULL;
|
|
|
|
size_t additional_len;
|
2018-02-03 21:32:47 +00:00
|
|
|
size_t chunk;
|
2018-10-27 09:31:21 +00:00
|
|
|
size_t ret = 0;
|
2017-11-17 14:00:35 +00:00
|
|
|
|
2018-10-27 09:31:21 +00:00
|
|
|
if (drbg->adin_pool == NULL) {
|
|
|
|
if (drbg->type == 0)
|
|
|
|
goto err;
|
|
|
|
drbg->adin_pool = rand_pool_new(0, 0, drbg->max_adinlen);
|
|
|
|
if (drbg->adin_pool == NULL)
|
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
|
|
|
|
additional_len = rand_drbg_get_additional_data(drbg->adin_pool,
|
|
|
|
&additional);
|
2018-02-03 21:32:47 +00:00
|
|
|
|
|
|
|
for ( ; outlen > 0; outlen -= chunk, out += chunk) {
|
|
|
|
chunk = outlen;
|
|
|
|
if (chunk > drbg->max_request)
|
|
|
|
chunk = drbg->max_request;
|
|
|
|
ret = RAND_DRBG_generate(drbg, out, chunk, 0, additional, additional_len);
|
|
|
|
if (!ret)
|
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
ret = 1;
|
|
|
|
|
2018-10-27 09:31:21 +00:00
|
|
|
err:
|
|
|
|
if (additional != NULL)
|
|
|
|
rand_drbg_cleanup_additional_data(drbg->adin_pool, additional);
|
2017-11-17 14:00:35 +00:00
|
|
|
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
2017-06-27 16:04:37 +00:00
|
|
|
/*
|
2017-08-31 21:16:22 +00:00
|
|
|
* Set the RAND_DRBG callbacks for obtaining entropy and nonce.
|
|
|
|
*
|
2018-02-27 18:02:24 +00:00
|
|
|
* Setting the callbacks is allowed only if the drbg has not been
|
|
|
|
* initialized yet. Otherwise, the operation will fail.
|
2017-08-31 21:16:22 +00:00
|
|
|
*
|
2018-02-27 18:02:24 +00:00
|
|
|
* Returns 1 on success, 0 on failure.
|
2017-06-27 16:04:37 +00:00
|
|
|
*/
|
2017-08-03 13:23:28 +00:00
|
|
|
int RAND_DRBG_set_callbacks(RAND_DRBG *drbg,
|
2017-08-31 21:16:22 +00:00
|
|
|
RAND_DRBG_get_entropy_fn get_entropy,
|
|
|
|
RAND_DRBG_cleanup_entropy_fn cleanup_entropy,
|
|
|
|
RAND_DRBG_get_nonce_fn get_nonce,
|
|
|
|
RAND_DRBG_cleanup_nonce_fn cleanup_nonce)
|
2017-06-27 16:04:37 +00:00
|
|
|
{
|
2018-10-14 10:35:19 +00:00
|
|
|
if (drbg->state != DRBG_UNINITIALISED
|
|
|
|
|| drbg->parent != NULL)
|
2017-06-27 16:04:37 +00:00
|
|
|
return 0;
|
2017-08-31 21:16:22 +00:00
|
|
|
drbg->get_entropy = get_entropy;
|
|
|
|
drbg->cleanup_entropy = cleanup_entropy;
|
|
|
|
drbg->get_nonce = get_nonce;
|
|
|
|
drbg->cleanup_nonce = cleanup_nonce;
|
2017-06-27 16:04:37 +00:00
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2017-08-03 13:23:28 +00:00
|
|
|
* Set the reseed interval.
|
2017-11-24 13:59:58 +00:00
|
|
|
*
|
|
|
|
* The drbg will reseed automatically whenever the number of generate
|
|
|
|
* requests exceeds the given reseed interval. If the reseed interval
|
2017-11-24 14:24:51 +00:00
|
|
|
* is 0, then this feature is disabled.
|
2017-11-24 13:59:58 +00:00
|
|
|
*
|
|
|
|
* Returns 1 on success, 0 on failure.
|
2017-06-27 16:04:37 +00:00
|
|
|
*/
|
2017-11-24 13:59:58 +00:00
|
|
|
int RAND_DRBG_set_reseed_interval(RAND_DRBG *drbg, unsigned int interval)
|
2017-06-27 16:04:37 +00:00
|
|
|
{
|
2017-11-24 13:59:58 +00:00
|
|
|
if (interval > MAX_RESEED_INTERVAL)
|
2017-07-19 21:41:26 +00:00
|
|
|
return 0;
|
2017-08-03 13:23:28 +00:00
|
|
|
drbg->reseed_interval = interval;
|
2017-07-19 21:41:26 +00:00
|
|
|
return 1;
|
2017-06-27 16:04:37 +00:00
|
|
|
}
|
|
|
|
|
2017-11-24 14:24:51 +00:00
|
|
|
/*
|
|
|
|
* Set the reseed time interval.
|
|
|
|
*
|
|
|
|
* The drbg will reseed automatically whenever the time elapsed since
|
|
|
|
* the last reseeding exceeds the given reseed time interval. For safety,
|
|
|
|
* a reseeding will also occur if the clock has been reset to a smaller
|
|
|
|
* value.
|
|
|
|
*
|
|
|
|
* Returns 1 on success, 0 on failure.
|
|
|
|
*/
|
|
|
|
int RAND_DRBG_set_reseed_time_interval(RAND_DRBG *drbg, time_t interval)
|
|
|
|
{
|
|
|
|
if (interval > MAX_RESEED_TIME_INTERVAL)
|
|
|
|
return 0;
|
|
|
|
drbg->reseed_time_interval = interval;
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2018-03-09 17:24:23 +00:00
|
|
|
/*
|
|
|
|
* Set the default values for reseed (time) intervals of new DRBG instances
|
|
|
|
*
|
|
|
|
* The default values can be set independently for master DRBG instances
|
|
|
|
* (without a parent) and slave DRBG instances (with parent).
|
|
|
|
*
|
|
|
|
* Returns 1 on success, 0 on failure.
|
|
|
|
*/
|
|
|
|
|
|
|
|
int RAND_DRBG_set_reseed_defaults(
|
|
|
|
unsigned int _master_reseed_interval,
|
|
|
|
unsigned int _slave_reseed_interval,
|
|
|
|
time_t _master_reseed_time_interval,
|
|
|
|
time_t _slave_reseed_time_interval
|
|
|
|
)
|
|
|
|
{
|
|
|
|
if (_master_reseed_interval > MAX_RESEED_INTERVAL
|
|
|
|
|| _slave_reseed_interval > MAX_RESEED_INTERVAL)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
if (_master_reseed_time_interval > MAX_RESEED_TIME_INTERVAL
|
|
|
|
|| _slave_reseed_time_interval > MAX_RESEED_TIME_INTERVAL)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
master_reseed_interval = _master_reseed_interval;
|
|
|
|
slave_reseed_interval = _slave_reseed_interval;
|
|
|
|
|
|
|
|
master_reseed_time_interval = _master_reseed_time_interval;
|
|
|
|
slave_reseed_time_interval = _slave_reseed_time_interval;
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
2018-02-08 15:40:32 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Locks the given drbg. Locking a drbg which does not have locking
|
|
|
|
* enabled is considered a successful no-op.
|
|
|
|
*
|
|
|
|
* Returns 1 on success, 0 on failure.
|
|
|
|
*/
|
2018-02-15 09:29:56 +00:00
|
|
|
int rand_drbg_lock(RAND_DRBG *drbg)
|
2018-02-08 15:40:32 +00:00
|
|
|
{
|
|
|
|
if (drbg->lock != NULL)
|
|
|
|
return CRYPTO_THREAD_write_lock(drbg->lock);
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Unlocks the given drbg. Unlocking a drbg which does not have locking
|
|
|
|
* enabled is considered a successful no-op.
|
|
|
|
*
|
|
|
|
* Returns 1 on success, 0 on failure.
|
|
|
|
*/
|
2018-02-15 09:29:56 +00:00
|
|
|
int rand_drbg_unlock(RAND_DRBG *drbg)
|
2018-02-08 15:40:32 +00:00
|
|
|
{
|
|
|
|
if (drbg->lock != NULL)
|
|
|
|
return CRYPTO_THREAD_unlock(drbg->lock);
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Enables locking for the given drbg
|
|
|
|
*
|
|
|
|
* Locking can only be enabled if the random generator
|
|
|
|
* is in the uninitialized state.
|
|
|
|
*
|
|
|
|
* Returns 1 on success, 0 on failure.
|
|
|
|
*/
|
2018-02-15 09:29:56 +00:00
|
|
|
int rand_drbg_enable_locking(RAND_DRBG *drbg)
|
2018-02-08 15:40:32 +00:00
|
|
|
{
|
|
|
|
if (drbg->state != DRBG_UNINITIALISED) {
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_ENABLE_LOCKING,
|
|
|
|
RAND_R_DRBG_ALREADY_INITIALIZED);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (drbg->lock == NULL) {
|
2018-02-08 21:46:23 +00:00
|
|
|
if (drbg->parent != NULL && drbg->parent->lock == NULL) {
|
2018-02-08 15:40:32 +00:00
|
|
|
RANDerr(RAND_F_RAND_DRBG_ENABLE_LOCKING,
|
|
|
|
RAND_R_PARENT_LOCKING_NOT_ENABLED);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
drbg->lock = CRYPTO_THREAD_lock_new();
|
|
|
|
if (drbg->lock == NULL) {
|
|
|
|
RANDerr(RAND_F_RAND_DRBG_ENABLE_LOCKING,
|
|
|
|
RAND_R_FAILED_TO_CREATE_LOCK);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2017-06-27 16:04:37 +00:00
|
|
|
/*
|
|
|
|
* Get and set the EXDATA
|
|
|
|
*/
|
2017-08-03 13:23:28 +00:00
|
|
|
int RAND_DRBG_set_ex_data(RAND_DRBG *drbg, int idx, void *arg)
|
|
|
|
{
|
|
|
|
return CRYPTO_set_ex_data(&drbg->ex_data, idx, arg);
|
|
|
|
}
|
|
|
|
|
|
|
|
void *RAND_DRBG_get_ex_data(const RAND_DRBG *drbg, int idx)
|
|
|
|
{
|
|
|
|
return CRYPTO_get_ex_data(&drbg->ex_data, idx);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
* The following functions provide a RAND_METHOD that works on the
|
|
|
|
* global DRBG. They lock.
|
|
|
|
*/
|
|
|
|
|
2017-08-27 15:46:33 +00:00
|
|
|
/*
|
2017-11-06 01:29:15 +00:00
|
|
|
* Allocates a new global DRBG on the secure heap (if enabled) and
|
|
|
|
* initializes it with default settings.
|
2017-11-24 13:59:58 +00:00
|
|
|
*
|
|
|
|
* Returns a pointer to the new DRBG instance on success, NULL on failure.
|
2017-08-27 15:46:33 +00:00
|
|
|
*/
|
2019-05-23 13:35:31 +00:00
|
|
|
static RAND_DRBG *drbg_setup(OPENSSL_CTX *ctx, RAND_DRBG *parent, int drbg_type)
|
2017-08-27 15:46:33 +00:00
|
|
|
{
|
2017-11-06 01:29:15 +00:00
|
|
|
RAND_DRBG *drbg;
|
2017-08-27 15:46:33 +00:00
|
|
|
|
2019-05-23 13:35:31 +00:00
|
|
|
drbg = RAND_DRBG_secure_new_ex(ctx, rand_drbg_type[drbg_type],
|
|
|
|
rand_drbg_flags[drbg_type], parent);
|
2017-11-06 01:29:15 +00:00
|
|
|
if (drbg == NULL)
|
|
|
|
return NULL;
|
|
|
|
|
2018-03-07 18:25:55 +00:00
|
|
|
/* Only the master DRBG needs to have a lock */
|
|
|
|
if (parent == NULL && rand_drbg_enable_locking(drbg) == 0)
|
2017-11-06 01:29:15 +00:00
|
|
|
goto err;
|
2017-11-24 13:59:58 +00:00
|
|
|
|
|
|
|
/* enable seed propagation */
|
2018-10-14 10:35:19 +00:00
|
|
|
tsan_store(&drbg->reseed_prop_counter, 1);
|
2017-11-24 13:59:58 +00:00
|
|
|
|
2017-08-31 21:16:22 +00:00
|
|
|
/*
|
2018-04-17 06:07:11 +00:00
|
|
|
* Ignore instantiation error to support just-in-time instantiation.
|
2017-08-31 21:16:22 +00:00
|
|
|
*
|
|
|
|
* The state of the drbg will be checked in RAND_DRBG_generate() and
|
|
|
|
* an automatic recovery is attempted.
|
|
|
|
*/
|
2018-04-17 06:07:11 +00:00
|
|
|
(void)RAND_DRBG_instantiate(drbg,
|
|
|
|
(const unsigned char *) ossl_pers_string,
|
|
|
|
sizeof(ossl_pers_string) - 1);
|
2017-11-06 01:29:15 +00:00
|
|
|
return drbg;
|
|
|
|
|
|
|
|
err:
|
2018-02-08 21:46:23 +00:00
|
|
|
RAND_DRBG_free(drbg);
|
2017-11-06 01:29:15 +00:00
|
|
|
return NULL;
|
2017-08-27 15:46:33 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2019-05-23 13:35:31 +00:00
|
|
|
* Initialize the OPENSSL_CTX global DRBGs on first use.
|
|
|
|
* Returns the allocated global data on success or NULL on failure.
|
2017-08-27 15:46:33 +00:00
|
|
|
*/
|
2019-05-23 13:35:31 +00:00
|
|
|
static void *drbg_ossl_ctx_new(OPENSSL_CTX *libctx)
|
2017-08-27 15:46:33 +00:00
|
|
|
{
|
2019-05-23 13:35:31 +00:00
|
|
|
DRBG_GLOBAL *dgbl = OPENSSL_zalloc(sizeof(*dgbl));
|
2018-01-16 07:03:37 +00:00
|
|
|
|
2019-05-23 13:35:31 +00:00
|
|
|
if (dgbl == NULL)
|
|
|
|
return NULL;
|
2017-08-27 15:46:33 +00:00
|
|
|
|
2019-05-23 13:35:31 +00:00
|
|
|
if (!CRYPTO_THREAD_init_local(&dgbl->private_drbg, NULL))
|
2018-04-26 08:14:14 +00:00
|
|
|
goto err1;
|
2018-03-07 18:25:55 +00:00
|
|
|
|
2019-05-23 13:35:31 +00:00
|
|
|
if (!CRYPTO_THREAD_init_local(&dgbl->public_drbg, NULL))
|
2018-04-26 08:14:14 +00:00
|
|
|
goto err2;
|
2017-08-27 15:46:33 +00:00
|
|
|
|
2019-05-23 13:35:31 +00:00
|
|
|
dgbl->master_drbg = drbg_setup(libctx, NULL, RAND_DRBG_TYPE_MASTER);
|
|
|
|
if (dgbl->master_drbg == NULL)
|
|
|
|
goto err3;
|
2018-04-26 08:14:14 +00:00
|
|
|
|
2019-05-23 13:35:31 +00:00
|
|
|
return dgbl;
|
|
|
|
|
|
|
|
err3:
|
|
|
|
CRYPTO_THREAD_cleanup_local(&dgbl->public_drbg);
|
|
|
|
err2:
|
|
|
|
CRYPTO_THREAD_cleanup_local(&dgbl->private_drbg);
|
|
|
|
err1:
|
|
|
|
OPENSSL_free(dgbl);
|
|
|
|
return NULL;
|
2017-08-27 15:46:33 +00:00
|
|
|
}
|
|
|
|
|
2019-05-23 13:35:31 +00:00
|
|
|
static void drbg_ossl_ctx_free(void *vdgbl)
|
2017-08-27 15:46:33 +00:00
|
|
|
{
|
2019-05-23 13:35:31 +00:00
|
|
|
DRBG_GLOBAL *dgbl = vdgbl;
|
2017-11-06 01:29:15 +00:00
|
|
|
|
2019-05-23 13:35:31 +00:00
|
|
|
RAND_DRBG_free(dgbl->master_drbg);
|
|
|
|
CRYPTO_THREAD_cleanup_local(&dgbl->private_drbg);
|
|
|
|
CRYPTO_THREAD_cleanup_local(&dgbl->public_drbg);
|
|
|
|
|
|
|
|
OPENSSL_free(dgbl);
|
|
|
|
}
|
|
|
|
|
|
|
|
static const OPENSSL_CTX_METHOD drbg_ossl_ctx_method = {
|
|
|
|
drbg_ossl_ctx_new,
|
|
|
|
drbg_ossl_ctx_free,
|
|
|
|
};
|
|
|
|
|
|
|
|
static DRBG_GLOBAL *drbg_get_global(OPENSSL_CTX *libctx)
|
|
|
|
{
|
|
|
|
return openssl_ctx_get_data(libctx, OPENSSL_CTX_DRBG_INDEX,
|
|
|
|
&drbg_ossl_ctx_method);
|
2018-03-07 18:25:55 +00:00
|
|
|
}
|
|
|
|
|
2018-05-09 15:09:50 +00:00
|
|
|
void drbg_delete_thread_state(void)
|
2018-03-07 18:25:55 +00:00
|
|
|
{
|
2019-05-23 13:35:31 +00:00
|
|
|
DRBG_GLOBAL *dgbl = drbg_get_global(ctx);
|
2018-03-07 18:25:55 +00:00
|
|
|
RAND_DRBG *drbg;
|
|
|
|
|
2019-05-23 13:35:31 +00:00
|
|
|
if (dgbl == NULL)
|
|
|
|
return;
|
|
|
|
drbg = CRYPTO_THREAD_get_local(&dgbl->public_drbg);
|
|
|
|
CRYPTO_THREAD_set_local(&dgbl->public_drbg, NULL);
|
2018-03-07 18:25:55 +00:00
|
|
|
RAND_DRBG_free(drbg);
|
|
|
|
|
2019-05-23 13:35:31 +00:00
|
|
|
drbg = CRYPTO_THREAD_get_local(&dgbl->private_drbg);
|
|
|
|
CRYPTO_THREAD_set_local(&dgbl->private_drbg, NULL);
|
2018-03-07 18:25:55 +00:00
|
|
|
RAND_DRBG_free(drbg);
|
2017-08-27 15:46:33 +00:00
|
|
|
}
|
|
|
|
|
2017-08-31 21:16:22 +00:00
|
|
|
/* Implements the default OpenSSL RAND_bytes() method */
|
2017-08-03 13:23:28 +00:00
|
|
|
static int drbg_bytes(unsigned char *out, int count)
|
|
|
|
{
|
2018-02-03 21:33:19 +00:00
|
|
|
int ret;
|
2017-11-24 13:59:58 +00:00
|
|
|
RAND_DRBG *drbg = RAND_DRBG_get0_public();
|
2017-08-03 13:23:28 +00:00
|
|
|
|
2017-08-27 15:46:33 +00:00
|
|
|
if (drbg == NULL)
|
|
|
|
return 0;
|
|
|
|
|
2018-02-03 21:33:19 +00:00
|
|
|
ret = RAND_DRBG_bytes(drbg, out, count);
|
|
|
|
|
2017-08-03 13:23:28 +00:00
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
2018-10-21 13:45:34 +00:00
|
|
|
/*
|
|
|
|
* Calculates the minimum length of a full entropy buffer
|
|
|
|
* which is necessary to seed (i.e. instantiate) the DRBG
|
|
|
|
* successfully.
|
|
|
|
*/
|
2018-10-22 16:05:14 +00:00
|
|
|
size_t rand_drbg_seedlen(RAND_DRBG *drbg)
|
2018-10-21 13:45:34 +00:00
|
|
|
{
|
|
|
|
/*
|
|
|
|
* If no os entropy source is available then RAND_seed(buffer, bufsize)
|
|
|
|
* is expected to succeed if and only if the buffer length satisfies
|
|
|
|
* the following requirements, which follow from the calculations
|
|
|
|
* in RAND_DRBG_instantiate().
|
|
|
|
*/
|
|
|
|
size_t min_entropy = drbg->strength;
|
|
|
|
size_t min_entropylen = drbg->min_entropylen;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Extra entropy for the random nonce in the absence of a
|
|
|
|
* get_nonce callback, see comment in RAND_DRBG_instantiate().
|
|
|
|
*/
|
|
|
|
if (drbg->min_noncelen > 0 && drbg->get_nonce == NULL) {
|
|
|
|
min_entropy += drbg->strength / 2;
|
|
|
|
min_entropylen += drbg->min_noncelen;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Convert entropy requirement from bits to bytes
|
|
|
|
* (dividing by 8 without rounding upwards, because
|
|
|
|
* all entropy requirements are divisible by 8).
|
|
|
|
*/
|
|
|
|
min_entropy >>= 3;
|
|
|
|
|
|
|
|
/* Return a value that satisfies both requirements */
|
|
|
|
return min_entropy > min_entropylen ? min_entropy : min_entropylen;
|
|
|
|
}
|
|
|
|
|
2017-08-31 21:16:22 +00:00
|
|
|
/* Implements the default OpenSSL RAND_add() method */
|
2017-08-03 13:23:28 +00:00
|
|
|
static int drbg_add(const void *buf, int num, double randomness)
|
|
|
|
{
|
2017-08-31 21:16:22 +00:00
|
|
|
int ret = 0;
|
2017-11-24 13:59:58 +00:00
|
|
|
RAND_DRBG *drbg = RAND_DRBG_get0_master();
|
2018-10-21 13:45:34 +00:00
|
|
|
size_t buflen;
|
2018-10-28 12:46:35 +00:00
|
|
|
size_t seedlen;
|
2017-08-03 13:23:28 +00:00
|
|
|
|
2017-08-31 21:16:22 +00:00
|
|
|
if (drbg == NULL)
|
|
|
|
return 0;
|
2017-08-03 13:23:28 +00:00
|
|
|
|
2017-08-31 21:16:22 +00:00
|
|
|
if (num < 0 || randomness < 0.0)
|
|
|
|
return 0;
|
2017-08-03 13:23:28 +00:00
|
|
|
|
2018-10-29 12:48:53 +00:00
|
|
|
rand_drbg_lock(drbg);
|
2018-10-28 12:46:35 +00:00
|
|
|
seedlen = rand_drbg_seedlen(drbg);
|
|
|
|
|
2018-10-21 13:45:34 +00:00
|
|
|
buflen = (size_t)num;
|
|
|
|
|
2019-04-10 22:06:37 +00:00
|
|
|
#ifdef FIPS_MODE
|
|
|
|
/*
|
|
|
|
* NIST SP-800-90A mandates that entropy *shall not* be provided
|
|
|
|
* by the consuming application. By setting the randomness to zero,
|
|
|
|
* we ensure that the buffer contents will be added to the internal
|
|
|
|
* state of the DRBG only as additional data.
|
|
|
|
*
|
|
|
|
* (NIST SP-800-90Ar1, Sections 9.1 and 9.2)
|
|
|
|
*/
|
|
|
|
randomness = 0.0;
|
|
|
|
#endif
|
2018-10-21 13:45:34 +00:00
|
|
|
if (buflen < seedlen || randomness < (double) seedlen) {
|
|
|
|
#if defined(OPENSSL_RAND_SEED_NONE)
|
|
|
|
/*
|
|
|
|
* If no os entropy source is available, a reseeding will fail
|
|
|
|
* inevitably. So we use a trick to mix the buffer contents into
|
|
|
|
* the DRBG state without forcing a reseeding: we generate a
|
|
|
|
* dummy random byte, using the buffer content as additional data.
|
2018-10-29 12:48:53 +00:00
|
|
|
* Note: This won't work with RAND_DRBG_FLAG_CTR_NO_DF.
|
2018-10-21 13:45:34 +00:00
|
|
|
*/
|
|
|
|
unsigned char dummy[1];
|
|
|
|
|
2018-10-29 12:48:53 +00:00
|
|
|
ret = RAND_DRBG_generate(drbg, dummy, sizeof(dummy), 0, buf, buflen);
|
|
|
|
rand_drbg_unlock(drbg);
|
|
|
|
return ret;
|
2018-10-21 13:45:34 +00:00
|
|
|
#else
|
|
|
|
/*
|
2019-04-10 22:06:37 +00:00
|
|
|
* If an os entropy source is available then we declare the buffer content
|
2018-10-21 13:45:34 +00:00
|
|
|
* as additional data by setting randomness to zero and trigger a regular
|
|
|
|
* reseeding.
|
|
|
|
*/
|
|
|
|
randomness = 0.0;
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
|
|
|
if (randomness > (double)seedlen) {
|
2017-08-31 21:16:22 +00:00
|
|
|
/*
|
|
|
|
* The purpose of this check is to bound |randomness| by a
|
|
|
|
* relatively small value in order to prevent an integer
|
|
|
|
* overflow when multiplying by 8 in the rand_drbg_restart()
|
2018-10-09 23:53:29 +00:00
|
|
|
* call below. Note that randomness is measured in bytes,
|
|
|
|
* not bits, so this value corresponds to eight times the
|
|
|
|
* security strength.
|
2017-08-31 21:16:22 +00:00
|
|
|
*/
|
2018-10-21 13:45:34 +00:00
|
|
|
randomness = (double)seedlen;
|
2017-08-03 13:23:28 +00:00
|
|
|
}
|
|
|
|
|
2018-10-21 13:45:34 +00:00
|
|
|
ret = rand_drbg_restart(drbg, buf, buflen, (size_t)(8 * randomness));
|
2018-02-15 09:29:56 +00:00
|
|
|
rand_drbg_unlock(drbg);
|
2017-08-31 21:16:22 +00:00
|
|
|
|
|
|
|
return ret;
|
2017-08-03 13:23:28 +00:00
|
|
|
}
|
|
|
|
|
2017-08-31 21:16:22 +00:00
|
|
|
/* Implements the default OpenSSL RAND_seed() method */
|
2017-08-03 13:23:28 +00:00
|
|
|
static int drbg_seed(const void *buf, int num)
|
|
|
|
{
|
|
|
|
return drbg_add(buf, num, num);
|
|
|
|
}
|
|
|
|
|
2017-08-31 21:16:22 +00:00
|
|
|
/* Implements the default OpenSSL RAND_status() method */
|
2017-08-03 13:23:28 +00:00
|
|
|
static int drbg_status(void)
|
2017-06-27 16:04:37 +00:00
|
|
|
{
|
2017-08-03 13:23:28 +00:00
|
|
|
int ret;
|
2017-11-24 13:59:58 +00:00
|
|
|
RAND_DRBG *drbg = RAND_DRBG_get0_master();
|
2017-08-27 15:46:33 +00:00
|
|
|
|
|
|
|
if (drbg == NULL)
|
|
|
|
return 0;
|
2017-08-03 13:23:28 +00:00
|
|
|
|
2018-02-15 09:29:56 +00:00
|
|
|
rand_drbg_lock(drbg);
|
2017-08-27 15:46:33 +00:00
|
|
|
ret = drbg->state == DRBG_READY ? 1 : 0;
|
2018-02-15 09:29:56 +00:00
|
|
|
rand_drbg_unlock(drbg);
|
2017-08-03 13:23:28 +00:00
|
|
|
return ret;
|
2017-06-27 16:04:37 +00:00
|
|
|
}
|
|
|
|
|
2017-08-27 15:46:33 +00:00
|
|
|
/*
|
2017-11-24 13:59:58 +00:00
|
|
|
* Get the master DRBG.
|
|
|
|
* Returns pointer to the DRBG on success, NULL on failure.
|
|
|
|
*
|
|
|
|
*/
|
2019-05-23 13:35:31 +00:00
|
|
|
RAND_DRBG *OPENSSL_CTX_get0_master_drbg(OPENSSL_CTX *ctx)
|
2017-11-24 13:59:58 +00:00
|
|
|
{
|
2019-05-23 13:35:31 +00:00
|
|
|
DRBG_GLOBAL *dgbl = drbg_get_global(ctx);
|
|
|
|
|
|
|
|
if (dgbl == NULL)
|
2017-11-24 13:59:58 +00:00
|
|
|
return NULL;
|
|
|
|
|
2019-05-23 13:35:31 +00:00
|
|
|
return dgbl->master_drbg;
|
|
|
|
}
|
|
|
|
|
|
|
|
RAND_DRBG *RAND_DRBG_get0_master(void)
|
|
|
|
{
|
|
|
|
return OPENSSL_CTX_get0_master_drbg(NULL);
|
2017-11-24 13:59:58 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Get the public DRBG.
|
2017-08-27 15:46:33 +00:00
|
|
|
* Returns pointer to the DRBG on success, NULL on failure.
|
|
|
|
*/
|
2019-05-23 13:35:31 +00:00
|
|
|
RAND_DRBG *OPENSSL_CTX_get0_public_drbg(OPENSSL_CTX *ctx)
|
2017-08-27 15:46:33 +00:00
|
|
|
{
|
2019-05-23 13:35:31 +00:00
|
|
|
DRBG_GLOBAL *dgbl = drbg_get_global(ctx);
|
2018-03-07 18:25:55 +00:00
|
|
|
RAND_DRBG *drbg;
|
|
|
|
|
2019-05-23 13:35:31 +00:00
|
|
|
if (dgbl == NULL)
|
2017-08-27 15:46:33 +00:00
|
|
|
return NULL;
|
|
|
|
|
2019-05-23 13:35:31 +00:00
|
|
|
drbg = CRYPTO_THREAD_get_local(&dgbl->public_drbg);
|
2018-03-07 18:25:55 +00:00
|
|
|
if (drbg == NULL) {
|
2018-04-26 08:14:14 +00:00
|
|
|
if (!ossl_init_thread_start(OPENSSL_INIT_THREAD_RAND))
|
|
|
|
return NULL;
|
2019-05-23 13:35:31 +00:00
|
|
|
drbg = drbg_setup(ctx, dgbl->master_drbg, RAND_DRBG_TYPE_PUBLIC);
|
|
|
|
CRYPTO_THREAD_set_local(&dgbl->public_drbg, drbg);
|
2018-03-07 18:25:55 +00:00
|
|
|
}
|
|
|
|
return drbg;
|
2017-08-27 15:46:33 +00:00
|
|
|
}
|
|
|
|
|
2019-05-23 13:35:31 +00:00
|
|
|
RAND_DRBG *RAND_DRBG_get0_public(void)
|
|
|
|
{
|
|
|
|
return OPENSSL_CTX_get0_public_drbg(NULL);
|
|
|
|
}
|
|
|
|
|
2017-08-27 15:46:33 +00:00
|
|
|
/*
|
2017-11-24 13:59:58 +00:00
|
|
|
* Get the private DRBG.
|
2017-08-27 15:46:33 +00:00
|
|
|
* Returns pointer to the DRBG on success, NULL on failure.
|
|
|
|
*/
|
2019-05-23 13:35:31 +00:00
|
|
|
RAND_DRBG *OPENSSL_CTX_get0_private_drbg(OPENSSL_CTX *ctx)
|
2017-08-27 15:46:33 +00:00
|
|
|
{
|
2019-05-23 13:35:31 +00:00
|
|
|
DRBG_GLOBAL *dgbl = drbg_get_global(ctx);
|
2018-03-07 18:25:55 +00:00
|
|
|
RAND_DRBG *drbg;
|
|
|
|
|
2019-05-23 13:35:31 +00:00
|
|
|
if (dgbl == NULL)
|
2017-08-27 15:46:33 +00:00
|
|
|
return NULL;
|
|
|
|
|
2019-05-23 13:35:31 +00:00
|
|
|
drbg = CRYPTO_THREAD_get_local(&dgbl->private_drbg);
|
2018-03-07 18:25:55 +00:00
|
|
|
if (drbg == NULL) {
|
2018-04-26 08:14:14 +00:00
|
|
|
if (!ossl_init_thread_start(OPENSSL_INIT_THREAD_RAND))
|
|
|
|
return NULL;
|
2019-05-23 13:35:31 +00:00
|
|
|
drbg = drbg_setup(ctx, dgbl->master_drbg, RAND_DRBG_TYPE_PRIVATE);
|
|
|
|
CRYPTO_THREAD_set_local(&dgbl->private_drbg, drbg);
|
2018-03-07 18:25:55 +00:00
|
|
|
}
|
|
|
|
return drbg;
|
2017-08-27 15:46:33 +00:00
|
|
|
}
|
|
|
|
|
2019-05-23 13:35:31 +00:00
|
|
|
RAND_DRBG *RAND_DRBG_get0_private(void)
|
|
|
|
{
|
|
|
|
return OPENSSL_CTX_get0_private_drbg(NULL);
|
|
|
|
}
|
|
|
|
|
2017-08-03 13:23:28 +00:00
|
|
|
RAND_METHOD rand_meth = {
|
|
|
|
drbg_seed,
|
|
|
|
drbg_bytes,
|
2017-08-02 18:00:52 +00:00
|
|
|
NULL,
|
2017-08-03 13:23:28 +00:00
|
|
|
drbg_add,
|
|
|
|
drbg_bytes,
|
|
|
|
drbg_status
|
|
|
|
};
|
|
|
|
|
|
|
|
RAND_METHOD *RAND_OpenSSL(void)
|
2017-06-27 16:04:37 +00:00
|
|
|
{
|
2017-08-03 13:23:28 +00:00
|
|
|
return &rand_meth;
|
2017-06-27 16:04:37 +00:00
|
|
|
}
|