diff options
author | Dr. Stephen Henson <steve@openssl.org> | 2011-09-12 13:20:57 +0000 |
---|---|---|
committer | Dr. Stephen Henson <steve@openssl.org> | 2011-09-12 13:20:57 +0000 |
commit | de2132de937217353d0a4a0aafa087d263a23ba0 (patch) | |
tree | 44e96ace4a85e94d60149f8c8f8df00613efadea /fips/rand/fips_drbg_selftest.c | |
parent | 9e56c99e1adda3717eace86f9baae423e4d58196 (diff) |
Delete strength parameter from FIPS_drbg_generate. It isn't very useful
(strength can be queried using FIPS_drbg_get_strength ) and adds a
substantial extra overhead to health check (need to check every combination
of parameters).
Diffstat (limited to 'fips/rand/fips_drbg_selftest.c')
-rw-r--r-- | fips/rand/fips_drbg_selftest.c | 28 |
1 files changed, 9 insertions, 19 deletions
diff --git a/fips/rand/fips_drbg_selftest.c b/fips/rand/fips_drbg_selftest.c index 40a3ca8162..b1a1d52bef 100644 --- a/fips/rand/fips_drbg_selftest.c +++ b/fips/rand/fips_drbg_selftest.c @@ -231,7 +231,7 @@ static int fips_drbg_single_kat(DRBG_CTX *dctx, DRBG_SELFTEST_DATA *td, adinlen = td->adinlen / 2; else adinlen = td->adinlen; - if (!FIPS_drbg_generate(dctx, randout, td->katlen, 0, 0, + if (!FIPS_drbg_generate(dctx, randout, td->katlen, 0, td->adin, adinlen)) goto err; @@ -253,7 +253,7 @@ static int fips_drbg_single_kat(DRBG_CTX *dctx, DRBG_SELFTEST_DATA *td, if (!FIPS_drbg_reseed(dctx, td->adinreseed, td->adinreseedlen)) goto err; - if (!FIPS_drbg_generate(dctx, randout, td->kat2len, 0, 0, + if (!FIPS_drbg_generate(dctx, randout, td->kat2len, 0, td->adin2, td->adin2len)) goto err; @@ -294,7 +294,7 @@ static int fips_drbg_single_kat(DRBG_CTX *dctx, DRBG_SELFTEST_DATA *td, adinlen = td->adinlen_pr / 2; else adinlen = td->adinlen_pr; - if (!FIPS_drbg_generate(dctx, randout, td->katlen_pr, 0, 1, + if (!FIPS_drbg_generate(dctx, randout, td->katlen_pr, 1, td->adin_pr, adinlen)) goto err; @@ -307,7 +307,7 @@ static int fips_drbg_single_kat(DRBG_CTX *dctx, DRBG_SELFTEST_DATA *td, t.ent = td->entg_pr; t.entlen = td->entglen_pr; - if (!FIPS_drbg_generate(dctx, randout, td->kat2len_pr, 0, 1, + if (!FIPS_drbg_generate(dctx, randout, td->kat2len_pr, 1, td->ading_pr, td->adinglen_pr)) goto err; @@ -378,7 +378,7 @@ static int fips_drbg_health_check(DRBG_CTX *dctx, DRBG_SELFTEST_DATA *td) } /* Try to generate output from uninstantiated DRBG */ - if (FIPS_drbg_generate(dctx, randout, td->katlen, 0, 0, + if (FIPS_drbg_generate(dctx, randout, td->katlen, 0, td->adin, td->adinlen)) { FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_GENERATE_ERROR_UNDETECTED); @@ -404,7 +404,7 @@ static int fips_drbg_health_check(DRBG_CTX *dctx, DRBG_SELFTEST_DATA *td) goto err; /* Check generation is now OK */ - if (!FIPS_drbg_generate(dctx, randout, td->katlen, 0, 0, + if (!FIPS_drbg_generate(dctx, randout, td->katlen, 0, td->adin, td->adinlen)) goto err; @@ -412,19 +412,9 @@ static int fips_drbg_health_check(DRBG_CTX *dctx, DRBG_SELFTEST_DATA *td) */ dctx->flags |= DRBG_FLAG_NOERR; - if (dctx->strength != 256) - { - if (FIPS_drbg_generate(dctx, randout, td->katlen, 256, 0, - td->adin, td->adinlen)) - { - FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_STRENGTH_ERROR_UNDETECTED); - - goto err; - } - } /* Request too much data for one request */ - if (FIPS_drbg_generate(dctx, randout, dctx->max_request + 1, 0, 0, + if (FIPS_drbg_generate(dctx, randout, dctx->max_request + 1, 0, td->adin, td->adinlen)) { FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_REQUEST_LENGTH_ERROR_UNDETECTED); @@ -437,7 +427,7 @@ static int fips_drbg_health_check(DRBG_CTX *dctx, DRBG_SELFTEST_DATA *td) t.entlen = 0; - if (FIPS_drbg_generate(dctx, randout, td->katlen, 0, 1, + if (FIPS_drbg_generate(dctx, randout, td->katlen, 1, td->adin, td->adinlen)) { FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_ENTROPY_ERROR_UNDETECTED); @@ -472,7 +462,7 @@ static int fips_drbg_health_check(DRBG_CTX *dctx, DRBG_SELFTEST_DATA *td) /* Generate output and check entropy has been requested for reseed */ t.entcnt = 0; - if (!FIPS_drbg_generate(dctx, randout, td->katlen, 0, 0, + if (!FIPS_drbg_generate(dctx, randout, td->katlen, 0, td->adin, td->adinlen)) goto err; if (t.entcnt != 1) |