diff options
| author | Rich Salz <rsalz@openssl.org> | 2017-08-02 14:00:52 -0400 |
|---|---|---|
| committer | Rich Salz <rsalz@openssl.org> | 2017-08-03 10:45:17 -0400 |
| commit | ddc6a5c8f5900959bdbdfee79e1625a3f7808acd (patch) | |
| tree | 3121037aca10793706bbc4b8800b40ba305a1c06 /doc | |
| parent | ae3947de09522206d61c0206a733517b10a910f8 (diff) | |
Add RAND_priv_bytes() for private keys
Add a new global DRBG for private keys used by RAND_priv_bytes.
Add BN_priv_rand() and BN_priv_rand_range() which use RAND_priv_bytes().
Change callers to use the appropriate BN_priv... function.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/4076)
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/man3/RAND_bytes.pod | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/doc/man3/RAND_bytes.pod b/doc/man3/RAND_bytes.pod index 80f75aefe1..c3e6aef310 100644 --- a/doc/man3/RAND_bytes.pod +++ b/doc/man3/RAND_bytes.pod @@ -2,13 +2,14 @@ =head1 NAME -RAND_bytes, RAND_pseudo_bytes - generate random data +RAND_bytes, RAND_priv_bytes, RAND_pseudo_bytes - generate random data =head1 SYNOPSIS #include <openssl/rand.h> int RAND_bytes(unsigned char *buf, int num); + int RAND_priv_bytes(unsigned char *buf, int num); Deprecated: @@ -22,9 +23,15 @@ RAND_bytes() puts B<num> cryptographically strong pseudo-random bytes into B<buf>. An error occurs if the PRNG has not been seeded with enough randomness to ensure an unpredictable byte sequence. +RAND_priv_bytes() has the same semantics as RAND_bytes(). It is intended to +be used for generating long-term private keys. If using the default +RAND_METHOD, this function uses a separate instance of the PRNG so that +a compromise of the global generator will not affect such key generation. + =head1 RETURN VALUES -RAND_bytes() returns 1 on success, -1 if not supported by the current +RAND_bytes() nad RAND_priv_bytes() +return 1 on success, -1 if not supported by the current RAND method, or 0 on other failure. The error code can be obtained by L<ERR_get_error(3)>. |