diff options
Diffstat (limited to 'crypto/rand/rand_lcl.h')
-rw-r--r-- | crypto/rand/rand_lcl.h | 87 |
1 files changed, 36 insertions, 51 deletions
diff --git a/crypto/rand/rand_lcl.h b/crypto/rand/rand_lcl.h index 498b7e687e..10a6f00a2d 100644 --- a/crypto/rand/rand_lcl.h +++ b/crypto/rand/rand_lcl.h @@ -17,28 +17,24 @@ # include <openssl/ec.h> # include "internal/rand.h" -/* - * Amount of randomness (in bytes) we want for initial seeding. - * This is based on the fact that we use AES-128 as the CRBG, and - * that we use the derivation function. If either of those changes, - * (see rand_init() in rand_lib.c), change this. - */ -# define RANDOMNESS_NEEDED 16 - /* How many times to read the TSC as a randomness source. */ # define TSC_READ_COUNT 4 -/* Maximum amount of randomness to hold in RAND_BYTES_BUFFER. */ -# define MAX_RANDOMNESS_HELD (4 * RANDOMNESS_NEEDED) - /* Maximum count allowed in reseeding */ # define MAX_RESEED (1 << 24) -/* How often we call RAND_poll() in drbg_entropy_from_system */ -# define RAND_POLL_RETRIES 8 +/* Max size of additional input and personalization string. */ +# define DRBG_MAX_LENGTH 4096 -/* Max size of entropy, addin, etc. Larger than any reasonable value */ -# define DRBG_MAX_LENGTH 0x7ffffff0 +/* + * The quotient between max_{entropy,nonce}len and min_{entropy,nonce}len + * + * The current factor is large enough that the RAND_POOL can store a + * random input which has a lousy entropy rate of 0.0625 bits per byte. + * This input will be sent through the derivation function which 'compresses' + * the low quality input into a high quality output. + */ +# define DRBG_MINMAX_FACTOR 128 /* DRBG status values */ @@ -51,22 +47,6 @@ typedef enum drbg_status_e { /* - * A buffer of random bytes to be fed as "entropy" into the DRBG. RAND_add() - * adds data to the buffer, and the drbg_entropy_from_system() pulls data from - * the buffer. We have a separate data structure because of the way the - * API is defined; otherwise we'd run into deadlocks (RAND_bytes -> - * RAND_DRBG_generate* -> drbg_entropy_from_system -> RAND_poll -> RAND_add -> - * drbg_add*; the functions with an asterisk lock). - */ -typedef struct rand_bytes_buffer_st { - CRYPTO_RWLOCK *lock; - unsigned char *buff; - size_t size; - size_t curr; - int secure; -} RAND_BYTES_BUFFER; - -/* * The state of a DRBG AES-CTR. */ typedef struct rand_drbg_ctr_st { @@ -94,30 +74,34 @@ struct rand_drbg_st { int nid; /* the underlying algorithm */ int fork_count; unsigned short flags; /* various external flags */ - char secure; + /* - * This is a fixed-size buffer, but we malloc to make it a little - * harder to find; a classic security/performance trade-off. + * The random pool is used by RAND_add()/drbg_add() to attach random + * data to the global drbg, such that the rand_drbg_get_entropy() callback + * can pull it during instantiation and reseeding. This is necessary to + * reconcile the different philosophies of the RAND and the RAND_DRBG + * with respect to how randomness is added to the RNG during reseeding + * (see PR #4328). */ - int size; + RAND_POOL *pool; - /* + /* * The following parameters are setup by the per-type "init" function. * * Currently the only type is CTR_DRBG, its init function is ctr_init(). * - * The parameters are closely related to the ones described in + * The parameters are closely related to the ones described in * section '10.2.1 CTR_DRBG' of [NIST SP 800-90Ar1], with one * crucial difference: In the NIST standard, all counts are given - * in bits, whereas in OpenSSL entropy counts are given in bits + * in bits, whereas in OpenSSL entropy counts are given in bits * and buffer lengths are given in bytes. - * + * * Since this difference has lead to some confusion in the past, * (see [GitHub Issue #2443], formerly [rt.openssl.org #4055]) - * the 'len' suffix has been added to all buffer sizes for + * the 'len' suffix has been added to all buffer sizes for * clarification. */ - + int strength; size_t max_request; size_t min_entropylen, max_entropylen; @@ -143,23 +127,24 @@ struct rand_drbg_st { /* The global RAND method, and the global buffer and DRBG instance. */ extern RAND_METHOD rand_meth; -extern RAND_BYTES_BUFFER rand_bytes; /* How often we've forked (only incremented in child). */ extern int rand_fork_count; /* Hardware-based seeding functions. */ -void rand_read_tsc(RAND_poll_cb rand_add, void *arg); -int rand_read_cpu(RAND_poll_cb rand_add, void *arg); +size_t rand_acquire_entropy_from_tsc(RAND_POOL *pool); +size_t rand_acquire_entropy_from_cpu(RAND_POOL *pool); /* DRBG entropy callbacks. */ -void drbg_release_entropy(RAND_DRBG *drbg, unsigned char *out, size_t outlen); -size_t drbg_entropy_from_parent(RAND_DRBG *drbg, - unsigned char **pout, - int entropy, size_t min_len, size_t max_len); -size_t drbg_entropy_from_system(RAND_DRBG *drbg, - unsigned char **pout, - int entropy, size_t min_len, size_t max_len); +size_t rand_drbg_get_entropy(RAND_DRBG *drbg, + unsigned char **pout, + int entropy, size_t min_len, size_t max_len); +void rand_drbg_cleanup_entropy(RAND_DRBG *drbg, + unsigned char *out, size_t outlen); + +/* DRBG helpers */ +int rand_drbg_restart(RAND_DRBG *drbg, + const unsigned char *buffer, size_t len, size_t entropy); /* DRBG functions implementing AES-CTR */ int ctr_init(RAND_DRBG *drbg); |