diff options
Diffstat (limited to 'crypto/rand')
-rw-r--r-- | crypto/rand/build.info | 2 | ||||
-rw-r--r-- | crypto/rand/drbg_lib.c | 425 | ||||
-rw-r--r-- | crypto/rand/drbg_rand.c | 324 | ||||
-rw-r--r-- | crypto/rand/ossl_rand.c | 592 | ||||
-rw-r--r-- | crypto/rand/rand_egd.c | 13 | ||||
-rw-r--r-- | crypto/rand/rand_lcl.h | 120 | ||||
-rw-r--r-- | crypto/rand/rand_lib.c | 136 | ||||
-rw-r--r-- | crypto/rand/rand_unix.c | 92 | ||||
-rw-r--r-- | crypto/rand/rand_vms.c | 4 | ||||
-rw-r--r-- | crypto/rand/rand_win.c | 12 |
10 files changed, 637 insertions, 1083 deletions
diff --git a/crypto/rand/build.info b/crypto/rand/build.info index f011d78d88..2591c01f3b 100644 --- a/crypto/rand/build.info +++ b/crypto/rand/build.info @@ -1,4 +1,4 @@ LIBS=../../libcrypto SOURCE[../../libcrypto]=\ - ossl_rand.c randfile.c rand_lib.c rand_err.c rand_egd.c \ + randfile.c rand_lib.c rand_err.c rand_egd.c \ rand_win.c rand_unix.c rand_vms.c drbg_lib.c drbg_rand.c diff --git a/crypto/rand/drbg_lib.c b/crypto/rand/drbg_lib.c index 1588515441..e3d97d38d9 100644 --- a/crypto/rand/drbg_lib.c +++ b/crypto/rand/drbg_lib.c @@ -15,53 +15,28 @@ /* * Support framework for NIST SP 800-90A DRBG, AES-CTR mode. - */ - -/* - * Get entropy from the existing callback. This is mainly used for KATs. - */ -static size_t get_entropy(DRBG_CTX *dctx, unsigned char **pout, - int entropy, size_t min_len, size_t max_len) -{ - if (dctx->get_entropy != NULL) - return dctx->get_entropy(dctx, pout, entropy, min_len, max_len); - /* TODO: Get from parent if it exists. */ - return 0; -} - -/* - * Cleanup entropy. - */ -static void cleanup_entropy(DRBG_CTX *dctx, unsigned char *out, size_t olen) -{ - if (dctx->cleanup_entropy != NULL) - dctx->cleanup_entropy(dctx, out, olen); -} - -/* + * The RAND_DRBG is OpenSSL's pointer to an instance of the DRBG. + * * The OpenSSL model is to have new and free functions, and that new * does all initialization. That is not the NIST model, which has * instantiation and un-instantiate, and re-use within a new/free * lifecycle. (No doubt this comes from the desire to support hardware * DRBG, where allocation of resources on something like an HSM is * a much bigger deal than just re-setting an allocated resource.) - * - * The DRBG_CTX is OpenSSL's opaque pointer to an instance of the - * DRBG. */ /* - * Set/initialize |dctx| to be of type |nid|, with optional |flags|. + * Set/initialize |drbg| to be of type |nid|, with optional |flags|. * Return -2 if the type is not supported, 1 on success and -1 on * failure. */ -int RAND_DRBG_set(DRBG_CTX *dctx, int nid, unsigned int flags) +int RAND_DRBG_set(RAND_DRBG *drbg, int nid, unsigned int flags) { int ret = 1; - dctx->status = DRBG_STATUS_UNINITIALISED; - dctx->flags = flags; - dctx->nid = nid; + drbg->state = DRBG_UNINITIALISED; + drbg->flags = flags; + drbg->nid = nid; switch (nid) { default: @@ -73,7 +48,7 @@ int RAND_DRBG_set(DRBG_CTX *dctx, int nid, unsigned int flags) case NID_aes_128_ctr: case NID_aes_192_ctr: case NID_aes_256_ctr: - ret = ctr_init(dctx); + ret = ctr_init(drbg); break; } @@ -84,169 +59,176 @@ int RAND_DRBG_set(DRBG_CTX *dctx, int nid, unsigned int flags) /* * Allocate memory and initialize a new DRBG. The |parent|, if not - * NULL, will be used to auto-seed this DRBG_CTX as needed. + * NULL, will be used to auto-seed this RAND_DRBG as needed. */ -DRBG_CTX *RAND_DRBG_new(int type, unsigned int flags, DRBG_CTX *parent) +RAND_DRBG *RAND_DRBG_new(int type, unsigned int flags, RAND_DRBG *parent) { - DRBG_CTX *dctx = OPENSSL_zalloc(sizeof(*dctx)); + RAND_DRBG *drbg = OPENSSL_zalloc(sizeof(*drbg)); + unsigned char *ucp = OPENSSL_zalloc(RANDOMNESS_NEEDED); - if (dctx == NULL) { + if (drbg == NULL || ucp == NULL) { RANDerr(RAND_F_RAND_DRBG_NEW, ERR_R_MALLOC_FAILURE); - return NULL; + goto err; } - - dctx->parent = parent; - if (RAND_DRBG_set(dctx, type, flags) < 0) { - OPENSSL_free(dctx); - return NULL; + drbg->size = RANDOMNESS_NEEDED; + drbg->randomness = ucp; + + drbg->parent = parent; + if (RAND_DRBG_set(drbg, type, flags) < 0) + goto err; + + if (parent != NULL) { + if (!RAND_DRBG_set_callbacks(drbg, drbg_entropy_from_parent, + drbg_release_entropy, + NULL, NULL) + /* + * Add in our address. Note we are adding the pointer + * itself, not its contents! + */ + || !RAND_DRBG_instantiate(drbg, + (unsigned char*)&drbg, sizeof(drbg))) + goto err; } - return dctx; + + return drbg; + +err: + OPENSSL_free(ucp); + OPENSSL_free(drbg); + return NULL; } /* - * Uninstantiate |dctx| and free all memory. + * Uninstantiate |drbg| and free all memory. */ -void RAND_DRBG_free(DRBG_CTX *dctx) +void RAND_DRBG_free(RAND_DRBG *drbg) { - if (dctx == NULL) + /* The global DRBG is free'd by rand_cleanup_int() */ + if (drbg == NULL || drbg == &rand_drbg) return; - ctr_uninstantiate(dctx); - CRYPTO_free_ex_data(CRYPTO_EX_INDEX_DRBG, dctx, &dctx->ex_data); - - /* Don't free up default DRBG */ - if (dctx == RAND_DRBG_get_default()) { - memset(dctx, 0, sizeof(DRBG_CTX)); - dctx->nid = 0; - dctx->status = DRBG_STATUS_UNINITIALISED; - } else { - OPENSSL_cleanse(&dctx->ctr, sizeof(dctx->ctr)); - OPENSSL_free(dctx); - } + ctr_uninstantiate(drbg); + OPENSSL_cleanse(drbg->randomness, drbg->size); + OPENSSL_free(drbg->randomness); + CRYPTO_free_ex_data(CRYPTO_EX_INDEX_DRBG, drbg, &drbg->ex_data); + OPENSSL_clear_free(drbg, sizeof(*drbg)); } /* - * Instantiate |dctx|, after it has been initialized. Use |pers| and + * Instantiate |drbg|, after it has been initialized. Use |pers| and * |perslen| as prediction-resistance input. */ -int RAND_DRBG_instantiate(DRBG_CTX *dctx, +int RAND_DRBG_instantiate(RAND_DRBG *drbg, const unsigned char *pers, size_t perslen) { - size_t entlen = 0, noncelen = 0; unsigned char *nonce = NULL, *entropy = NULL; - int r = 0; + size_t noncelen = 0, entlen = 0; - if (perslen > dctx->max_pers) { - r = RAND_R_PERSONALISATION_STRING_TOO_LONG; + if (perslen > drbg->max_pers) { + RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, + RAND_R_PERSONALISATION_STRING_TOO_LONG); goto end; } - if (dctx->status != DRBG_STATUS_UNINITIALISED) { - r = dctx->status == DRBG_STATUS_ERROR ? RAND_R_IN_ERROR_STATE - : RAND_R_ALREADY_INSTANTIATED; + if (drbg->state != DRBG_UNINITIALISED) { + RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, + drbg->state == DRBG_ERROR ? RAND_R_IN_ERROR_STATE + : RAND_R_ALREADY_INSTANTIATED); goto end; } - dctx->status = DRBG_STATUS_ERROR; - entlen = get_entropy(dctx, &entropy, dctx->strength, - dctx->min_entropy, dctx->max_entropy); - if (entlen < dctx->min_entropy || entlen > dctx->max_entropy) { - r = RAND_R_ERROR_RETRIEVING_ENTROPY; + drbg->state = DRBG_ERROR; + if (drbg->get_entropy != NULL) + entlen = drbg->get_entropy(drbg, &entropy, drbg->strength, + drbg->min_entropy, drbg->max_entropy); + if (entlen < drbg->min_entropy || entlen > drbg->max_entropy) { + RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, RAND_R_ERROR_RETRIEVING_ENTROPY); goto end; } - if (dctx->max_nonce > 0 && dctx->get_nonce != NULL) { - noncelen = dctx->get_nonce(dctx, &nonce, - dctx->strength / 2, - dctx->min_nonce, dctx->max_nonce); - - if (noncelen < dctx->min_nonce || noncelen > dctx->max_nonce) { - r = RAND_R_ERROR_RETRIEVING_NONCE; + if (drbg->max_nonce > 0 && drbg->get_nonce != NULL) { + noncelen = drbg->get_nonce(drbg, &nonce, drbg->strength / 2, + drbg->min_nonce, drbg->max_nonce); + if (noncelen < drbg->min_nonce || noncelen > drbg->max_nonce) { + RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, RAND_R_ERROR_RETRIEVING_NONCE); goto end; } } - if (!ctr_instantiate(dctx, entropy, entlen, + if (!ctr_instantiate(drbg, entropy, entlen, nonce, noncelen, pers, perslen)) { - r = RAND_R_ERROR_INSTANTIATING_DRBG; + RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, RAND_R_ERROR_INSTANTIATING_DRBG); goto end; } - dctx->status = DRBG_STATUS_READY; - dctx->reseed_counter = 1; + drbg->state = DRBG_READY; + drbg->reseed_counter = 1; end: - if (entropy != NULL && dctx->cleanup_entropy != NULL) - dctx->cleanup_entropy(dctx, entropy, entlen); - if (nonce != NULL && dctx->cleanup_nonce!= NULL ) - dctx->cleanup_nonce(dctx, nonce, noncelen); - if (dctx->status == DRBG_STATUS_READY) + if (entropy != NULL && drbg->cleanup_entropy != NULL) + drbg->cleanup_entropy(drbg, entropy); + if (nonce != NULL && drbg->cleanup_nonce!= NULL ) + drbg->cleanup_nonce(drbg, nonce); + if (drbg->state == DRBG_READY) return 1; - - if (r) - RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, r); return 0; } /* - * Uninstantiate |dctx|. Must be instantiated before it can be used. + * Uninstantiate |drbg|. Must be instantiated before it can be used. */ -int RAND_DRBG_uninstantiate(DRBG_CTX *dctx) +int RAND_DRBG_uninstantiate(RAND_DRBG *drbg) { - int ret = ctr_uninstantiate(dctx); + int ret = ctr_uninstantiate(drbg); - OPENSSL_cleanse(&dctx->ctr, sizeof(dctx->ctr)); - dctx->status = DRBG_STATUS_UNINITIALISED; + OPENSSL_cleanse(&drbg->ctr, sizeof(drbg->ctr)); + drbg->state = DRBG_UNINITIALISED; return ret; } /* - * Mix in the specified data to reseed |dctx|. + * Mix in the specified data to reseed |drbg|. */ -int RAND_DRBG_reseed(DRBG_CTX *dctx, +int RAND_DRBG_reseed(RAND_DRBG *drbg, const unsigned char *adin, size_t adinlen) { unsigned char *entropy = NULL; size_t entlen = 0; - int r = 0; - - if (dctx->status != DRBG_STATUS_READY - && dctx->status != DRBG_STATUS_RESEED) { - if (dctx->status == DRBG_STATUS_ERROR) - r = RAND_R_IN_ERROR_STATE; - else if (dctx->status == DRBG_STATUS_UNINITIALISED) - r = RAND_R_NOT_INSTANTIATED; - goto end; + + if (drbg->state == DRBG_ERROR) { + RANDerr(RAND_F_RAND_DRBG_RESEED, RAND_R_IN_ERROR_STATE); + return 0; + } + if (drbg->state == DRBG_UNINITIALISED) { + RANDerr(RAND_F_RAND_DRBG_RESEED, RAND_R_NOT_INSTANTIATED); + return 0; } if (adin == NULL) adinlen = 0; - else if (adinlen > dctx->max_adin) { - r = RAND_R_ADDITIONAL_INPUT_TOO_LONG; - goto end; + else if (adinlen > drbg->max_adin) { + RANDerr(RAND_F_RAND_DRBG_RESEED, RAND_R_ADDITIONAL_INPUT_TOO_LONG); + return 0; } - dctx->status = DRBG_STATUS_ERROR; - entlen = get_entropy(dctx, &entropy, dctx->strength, - dctx->min_entropy, dctx->max_entropy); - - if (entlen < dctx->min_entropy || entlen > dctx->max_entropy) { - r = RAND_R_ERROR_RETRIEVING_ENTROPY; + drbg->state = DRBG_ERROR; + if (drbg->get_entropy != NULL) + entlen = drbg->get_entropy(drbg, &entropy, drbg->strength, + drbg->min_entropy, drbg->max_entropy); + if (entlen < drbg->min_entropy || entlen > drbg->max_entropy) { + RANDerr(RAND_F_RAND_DRBG_RESEED, RAND_R_ERROR_RETRIEVING_ENTROPY); goto end; } - if (!ctr_reseed(dctx, entropy, entlen, adin, adinlen)) + if (!ctr_reseed(drbg, entropy, entlen, adin, adinlen)) goto end; - dctx->status = DRBG_STATUS_READY; - dctx->reseed_counter = 1; + drbg->state = DRBG_READY; + drbg->reseed_counter = 1; end: - if (entropy != NULL && dctx->cleanup_entropy != NULL) - cleanup_entropy(dctx, entropy, entlen); - if (dctx->status == DRBG_STATUS_READY) + if (entropy != NULL && drbg->cleanup_entropy != NULL) + drbg->cleanup_entropy(drbg, entropy); + if (drbg->state == DRBG_READY) return 1; - if (r) - RANDerr(RAND_F_RAND_DRBG_RESEED, r); - return 0; } @@ -255,98 +237,183 @@ end: * to or if |prediction_resistance| is set. Additional input can be * sent in |adin| and |adinlen|. */ -int RAND_DRBG_generate(DRBG_CTX *dctx, unsigned char *out, size_t outlen, +int RAND_DRBG_generate(RAND_DRBG *drbg, unsigned char *out, size_t outlen, int prediction_resistance, const unsigned char *adin, size_t adinlen) { - int r = 0; - - if (dctx->status != DRBG_STATUS_READY - && dctx->status != DRBG_STATUS_RESEED) { - if (dctx->status == DRBG_STATUS_ERROR) - r = RAND_R_IN_ERROR_STATE; - else if(dctx->status == DRBG_STATUS_UNINITIALISED) - r = RAND_R_NOT_INSTANTIATED; - goto end; + if (drbg->state == DRBG_ERROR) { + RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_IN_ERROR_STATE); + return 0; } - - if (outlen > dctx->max_request) { - r = RAND_R_REQUEST_TOO_LARGE_FOR_DRBG; + if (drbg->state == DRBG_UNINITIALISED) { + RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_NOT_INSTANTIATED); return 0; } - if (adinlen > dctx->max_adin) { - r = RAND_R_ADDITIONAL_INPUT_TOO_LONG; - goto end; + if (outlen > drbg->max_request) { + RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_REQUEST_TOO_LARGE_FOR_DRBG); + return 0; + } + if (adinlen > drbg->max_adin) { + RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_ADDITIONAL_INPUT_TOO_LONG); + return 0; } - if (dctx->reseed_counter >= dctx->reseed_interval) - dctx->status = DRBG_STATUS_RESEED; + if (drbg->reseed_counter >= drbg->reseed_interval) + drbg->state = DRBG_RESEED; - if (dctx->status == DRBG_STATUS_RESEED || prediction_resistance) { - if (!RAND_DRBG_reseed(dctx, adin, adinlen)) { - r = RAND_R_RESEED_ERROR; - goto end; + if (drbg->state == DRBG_RESEED || prediction_resistance) { + if (!RAND_DRBG_reseed(drbg, adin, adinlen)) { + RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_RESEED_ERROR); + return 0; } adin = NULL; adinlen = 0; } - if (!ctr_generate(dctx, out, outlen, adin, adinlen)) { - r = RAND_R_GENERATE_ERROR; - dctx->status = DRBG_STATUS_ERROR; - goto end; + if (!ctr_generate(drbg, out, outlen, adin, adinlen)) { + drbg->state = DRBG_ERROR; + RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_GENERATE_ERROR); + return 0; } - if (dctx->reseed_counter >= dctx->reseed_interval) - dctx->status = DRBG_STATUS_RESEED; + + if (drbg->reseed_counter >= drbg->reseed_interval) + drbg->state = DRBG_RESEED; else - dctx->reseed_counter++; + drbg->reseed_counter++; return 1; - -end: - RANDerr(RAND_F_RAND_DRBG_GENERATE, r); - return 0; } /* - * Set the callbacks for entropy and nonce. Used mainly for the KATs + * Set the callbacks for entropy and nonce. We currently don't use + * the nonce; that's mainly for the KATs */ -int RAND_DRBG_set_callbacks(DRBG_CTX *dctx, - size_t (*cb_get_entropy)(DRBG_CTX *ctx, unsigned char **pout, - int entropy, size_t min_len, size_t max_len), - void (*cb_cleanup_entropy)(DRBG_CTX *ctx, unsigned char *out, size_t olen), - size_t (*cb_get_nonce)(DRBG_CTX *ctx, unsigned char **pout, - int entropy, size_t min_len, size_t max_len), - void (*cb_cleanup_nonce)(DRBG_CTX *ctx, unsigned char *out, size_t olen)) +int RAND_DRBG_set_callbacks(RAND_DRBG *drbg, + RAND_DRBG_get_entropy_fn cb_get_entropy, + RAND_DRBG_cleanup_entropy_fn cb_cleanup_entropy, + RAND_DRBG_get_nonce_fn cb_get_nonce, + RAND_DRBG_cleanup_nonce_fn cb_cleanup_nonce) { - if (dctx->status != DRBG_STATUS_UNINITIALISED) + if (drbg->state != DRBG_UNINITIALISED) return 0; - dctx->get_entropy = cb_get_entropy; - dctx->cleanup_entropy = cb_cleanup_entropy; - dctx->get_nonce = cb_get_nonce; - dctx->cleanup_nonce = cb_cleanup_nonce; + drbg->get_entropy = cb_get_entropy; + drbg->cleanup_entropy = cb_cleanup_entropy; + drbg->get_nonce = cb_get_nonce; + drbg->cleanup_nonce = cb_cleanup_nonce; return 1; } /* - * Set the reseed interval. Used mainly for the KATs. + * Set the reseed interval. */ -int RAND_DRBG_set_reseed_interval(DRBG_CTX *dctx, int interval) +int RAND_DRBG_set_reseed_interval(RAND_DRBG *drbg, int interval) { if (interval < 0 || interval > MAX_RESEED) return 0; - dctx->reseed_interval = interval; + drbg->reseed_interval = interval; return 1; } /* * Get and set the EXDATA */ -int RAND_DRBG_set_ex_data(DRBG_CTX *dctx, int idx, void *arg) +int RAND_DRBG_set_ex_data(RAND_DRBG *drbg, int idx, void *arg) +{ + return CRYPTO_set_ex_data(&drbg->ex_data, idx, arg); +} + +void *RAND_DRBG_get_ex_data(const RAND_DRBG *drbg, int idx) +{ + return CRYPTO_get_ex_data(&drbg->ex_data, idx); +} + + +/* + * The following functions provide a RAND_METHOD that works on the + * global DRBG. They lock. + */ + +static int drbg_bytes(unsigned char *out, int count) +{ + int ret = 0; + size_t chunk; + + CRYPTO_THREAD_write_lock(rand_drbg.lock); + if (rand_drbg.state == DRBG_UNINITIALISED + && RAND_DRBG_instantiate(&rand_drbg, NULL, 0) == 0) + goto err; + + for ( ; count > 0; count -= chunk, out += chunk) { + chunk = count; + if (chunk > rand_drbg.max_request) + chunk = rand_drbg.max_request; + ret = RAND_DRBG_generate(&rand_drbg, out, chunk, 0, NULL, 0); + if (!ret) + goto err; + } + ret = 1; + +err: + CRYPTO_THREAD_unlock(rand_drbg.lock); + return ret; +} + +static void drbg_cleanup(void) +{ + CRYPTO_THREAD_write_lock(rand_drbg.lock); + RAND_DRBG_uninstantiate(&rand_drbg); + CRYPTO_THREAD_unlock(rand_drbg.lock); +} + +static int drbg_add(const void *buf, int num, double randomness) +{ + unsigned char *in = (unsigned char *)buf; + unsigned char *out, *end; + + CRYPTO_THREAD_write_lock(rand_bytes.lock); + out = &rand_bytes.buff[rand_bytes.curr]; + end = &rand_bytes.buff[rand_bytes.size]; + + /* Copy whatever fits into the end of the buffer. */ + for ( ; --num >= 0 && out < end; rand_bytes.curr++) + *out++ = *in++; + + /* XOR any the leftover. */ + while (num > 0) { + for (out = rand_bytes.buff; --num >= 0 && out < end; ) + *out++ ^= *in++; + } + + CRYPTO_THREAD_unlock(rand_bytes.lock); + return 1; +} + +static int drbg_seed(const void *buf, int num) +{ + return drbg_add(buf, num, num); +} + +static int drbg_status(void) { - return CRYPTO_set_ex_data(&dctx->ex_data, idx, arg); + int ret; + + CRYPTO_THREAD_write_lock(rand_drbg.lock); + ret = rand_drbg.state == DRBG_READY ? 1 : 0; + CRYPTO_THREAD_unlock(rand_drbg.lock); + return ret; } -void *RAND_DRBG_get_ex_data(const DRBG_CTX *dctx, int idx) +RAND_DRBG rand_drbg; /* The default global DRBG. */ + +RAND_METHOD rand_meth = { + drbg_seed, + drbg_bytes, + drbg_cleanup, + drbg_add, + drbg_bytes, + drbg_status +}; + +RAND_METHOD *RAND_OpenSSL(void) { - return CRYPTO_get_ex_data(&dctx->ex_data, idx); + return &rand_meth; } diff --git a/crypto/rand/drbg_rand.c b/crypto/rand/drbg_rand.c index 8b30cd8a0d..06f8affeb8 100644 --- a/crypto/rand/drbg_rand.c +++ b/crypto/rand/drbg_rand.c @@ -16,37 +16,14 @@ #include "internal/thread_once.h" /* - * Mapping of NIST SP 800-90A DRBG to OpenSSL RAND_METHOD. + * Implementation of NIST SP 800-90A CTR DRBG. */ - -/* - * The default global DRBG and its auto-init/auto-cleanup. - */ -static DRBG_CTX ossl_drbg; - -static CRYPTO_ONCE ossl_drbg_init = CRYPTO_ONCE_STATIC_INIT; - -DEFINE_RUN_ONCE_STATIC(do_ossl_drbg_init) -{ - int st = 1; - - ossl_drbg.lock = CRYPTO_THREAD_lock_new(); - st &= ossl_drbg.lock != NULL; - st &= RAND_DRBG_set(&ossl_drbg, NID_aes_128_ctr, 0) == 1; - return st; -} - -void rand_drbg_cleanup(void) -{ - CRYPTO_THREAD_lock_free(ossl_drbg.lock); -} - -static void inc_128(DRBG_CTR_CTX *cctx) +static void inc_128(RAND_DRBG_CTR *ctr) { int i; unsigned char c; - unsigned char *p = &cctx->V[15]; + unsigned char *p = &ctr->V[15]; for (i = 0; i < 16; i++, p--) { c = *p; @@ -59,7 +36,7 @@ static void inc_128(DRBG_CTR_CTX *cctx) } } -static void ctr_XOR(DRBG_CTR_CTX *cctx, const unsigned char *in, size_t inlen) +static void ctr_XOR(RAND_DRBG_CTR *ctr, const unsigned char *in, size_t inlen) { size_t i, n; @@ -70,81 +47,81 @@ static void ctr_XOR(DRBG_CTR_CTX *cctx, const unsigned char *in, size_t inlen) * Any zero padding will have no effect on the result as we * are XORing. So just process however much input we have. */ - n = inlen < cctx->keylen ? inlen : cctx->keylen; + n = inlen < ctr->keylen ? inlen : ctr->keylen; for (i = 0; i < n; i++) - cctx->K[i] ^= in[i]; - if (inlen <= cctx->keylen) + ctr->K[i] ^= in[i]; + if (inlen <= ctr->keylen) return; - n = inlen - cctx->keylen; + n = inlen - ctr->keylen; if (n > 16) { /* Should never happen */ n = 16; } for (i = 0; i < n; i++) - cctx->V[i] ^= in[i + cctx->keylen]; + ctr->V[i] ^= in[i + ctr->keylen]; } /* * Process a complete block using BCC algorithm of SP 800-90A 10.3.3 */ -static void ctr_BCC_block(DRBG_CTR_CTX *cctx, unsigned char *out, +static void ctr_BCC_block(RAND_DRBG_CTR *ctr, unsigned char *out, const unsigned char *in) { int i; for (i = 0; i < 16; i++) out[i] ^= in[i]; - AES_encrypt(out, out, &cctx->df_ks); + AES_encrypt(out, out, &ctr->df_ks); } /* * Handle several BCC operations for as much data as we need for K and X */ -static void ctr_BCC_blocks(DRBG_CTR_CTX *cctx, const unsigned char *in) +static void ctr_BCC_blocks(RAND_DRBG_CTR *ctr, const unsigned char *in) { - ctr_BCC_block(cctx, cctx->KX, in); - ctr_BCC_block(cctx, cctx->KX + 16, in); - if (cctx->keylen != 16) - ctr_BCC_block(cctx, cctx->KX + 32, in); + ctr_BCC_block(ctr, ctr->KX, in); + ctr_BCC_block(ctr, ctr->KX + 16, in); + if (ctr->keylen != 16) + ctr_BCC_block(ctr, ctr->KX + 32, in); } /* * Initialise BCC blocks: these have the value 0,1,2 in leftmost positions: * see 10.3.1 stage 7. */ -static void ctr_BCC_init(DRBG_CTR_CTX *cctx) +static void ctr_BCC_init(RAND_DRBG_CTR *ctr) { - memset(cctx->KX, 0, 48); - memset(cctx->bltmp, 0, 16); - ctr_BCC_block(cctx, cctx->KX, cctx->bltmp); - cctx->bltmp[3] = 1; - ctr_BCC_block(cctx, cctx->KX + 16, cctx->bltmp); - if (cctx->keylen != 16) { - cctx->bltmp[3] = 2; - ctr_BCC_block(cctx, cctx->KX + 32, cctx->bltmp); + memset(ctr->KX, 0, 48); + memset(ctr->bltmp, 0, 16); + ctr_BCC_block(ctr, ctr->KX, ctr->bltmp); + ctr->bltmp[3] = 1; + ctr_BCC_block(ctr, ctr->KX + 16, ctr->bltmp); + if (ctr->keylen != 16) { + ctr->bltmp[3] = 2; + ctr_BCC_block(ctr, ctr->KX + 32, ctr->bltmp); } } /* * Process several blocks into BCC algorithm, some possibly partial */ -static void ctr_BCC_update(DRBG_CTR_CTX *cctx, +static void ctr_BCC_update(RAND_DRBG_CTR *ctr, const unsigned char *in, size_t inlen) { if (in == NULL || inlen == 0) return; /* If we have partial block handle it first */ - if (cctx->bltmp_pos) { - size_t left = 16 - cctx->bltmp_pos; + if (ctr->bltmp_pos) { + size_t left = 16 - ctr->bltmp_pos; /* If we now have a complete block process it */ if (inlen >= left) { - memcpy(cctx->bltmp + cctx->bltmp_pos, in, left); - ctr_BCC_blocks(cctx, cctx->bltmp); - cctx->bltmp_pos = 0; + memcpy(ctr->bltmp + ctr->bltmp_pos, in, left); + ctr_BCC_blocks(ctr, ctr->bltmp); + ctr->bltmp_pos = 0; inlen -= left; in += left; } @@ -152,34 +129,34 @@ static void ctr_BCC_update(DRBG_CTR_CTX *cctx, /* Process zero or more complete blocks */ for (; inlen >= 16; in += 16, inlen -= 16) { - ctr_BCC_blocks(cctx, in); + ctr_BCC_blocks(ctr, in); } /* Copy any remaining partial block to the temporary buffer */ if (inlen > 0) { - memcpy(cctx->bltmp + cctx->bltmp_pos, in, inlen); - cctx->bltmp_pos += inlen; + memcpy(ctr->bltmp + ctr->bltmp_pos, in, inlen); + ctr->bltmp_pos += inlen; } } -static void ctr_BCC_final(DRBG_CTR_CTX *cctx) +static void ctr_BCC_final(RAND_DRBG_CTR *ctr) { - if (cctx->bltmp_pos) { - memset(cctx->bltmp + cctx->bltmp_pos, 0, 16 - cctx->bltmp_pos); - ctr_BCC_blocks(cctx, cctx->bltmp); + if (ctr->bltmp_pos) { + memset(ctr->bltmp + ctr->bltmp_pos, 0, 16 - ctr->bltmp_pos); + ctr_BCC_blocks(ctr, ctr->bltmp); } } -static void ctr_df(DRBG_CTR_CTX *cctx, +static void ctr_df(RAND_DRBG_CTR *ctr, const unsigned char *in1, size_t in1len, const unsigned char *in2, size_t in2len, const unsigned char *in3, size_t in3len) { static unsigned char c80 = 0x80; size_t inlen; - unsigned char *p = cctx->bltmp; + unsigned char *p = ctr->bltmp; - ctr_BCC_init(cctx); + ctr_BCC_init(ctr); if (in1 == NULL) in1len = 0; if (in2 == NULL) @@ -197,100 +174,100 @@ static void ctr_df(DRBG_CTR_CTX *cctx, *p++ = 0; *p++ = 0; *p++ = 0; - *p = (unsigned char)((cctx->keylen + 16) & 0xff); - cctx->bltmp_pos = 8; - ctr_BCC_update(cctx, in1, in1len); - ctr_BCC_update(cctx, in2, in2len); - ctr_BCC_update(cctx, in3, in3len); - ctr_BCC_update(cctx, &c80, 1); - ctr_BCC_final(cctx); + *p = (unsigned char)((ctr->keylen + 16) & 0xff); + ctr->bltmp_pos = 8; + ctr_BCC_update(ctr, in1, in1len); + ctr_BCC_update(ctr, in2, in2len); + ctr_BCC_update(ctr, in3, in3len); + ctr_BCC_update(ctr, &c80, 1); + ctr_BCC_final(ctr); /* Set up key K */ - AES_set_encrypt_key(cctx->KX, cctx->keylen * 8, &cctx->df_kxks); + AES_set_encrypt_key(ctr->KX, ctr->keylen * 8, &ctr->df_kxks); /* X follows key K */ - AES_encrypt(cctx->KX + cctx->keylen, cctx->KX, &cctx->df_kxks); - AES_encrypt(cctx->KX, cctx->KX + 16, &cctx->df_kxks); - if (cctx->keylen != 16) - AES_encrypt(cctx->KX + 16, cctx->KX + 32, &cctx->df_kxks); + AES_encrypt(ctr->KX + ctr->keylen, ctr->KX, &ctr->df_kxks); + AES_encrypt(ctr->KX, ctr->KX + 16, &ctr->df_kxks); + if (ctr->keylen != 16) + AES_encrypt(ctr->KX + 16, ctr->KX + 32, &ctr->df_kxks); } /* * NB the no-df Update in SP800-90A specifies a constant input length * of seedlen, however other uses of this algorithm pad the input with * zeroes if necessary and have up to two parameters XORed together, - * handle both cases in this function instead. + * so we handle both cases in this function instead. */ -static void ctr_update(DRBG_CTX *dctx, +static void ctr_update(RAND_DRBG *drbg, const unsigned char *in1, size_t in1len, const unsigned char *in2, size_t in2len, const unsigned char *nonce, size_t noncelen) { - DRBG_CTR_CTX *cctx = &dctx->ctr; + RAND_DRBG_CTR *ctr = &drbg->ctr; /* ks is already setup for correct key */ - inc_128(cctx); - AES_encrypt(cctx->V, cctx->K, &cctx->ks); + inc_128(ctr); + AES_encrypt(ctr->V, ctr->K, &ctr->ks); /* If keylen longer than 128 bits need extra encrypt */ - if (cctx->keylen != 16) { - inc_128(cctx); - AES_encrypt(cctx->V, cctx->K + 16, &cctx->ks); + if (ctr->keylen != 16) { + inc_128(ctr); + AES_encrypt(ctr->V, ctr->K + 16, &ctr->ks); } - inc_128(cctx); - AES_encrypt(cctx->V, cctx->V, &cctx->ks); + inc_128(ctr); + AES_encrypt(ctr->V, ctr->V, &ctr->ks); /* If 192 bit key part of V is on end of K */ - if (cctx->keylen == 24) { - memcpy(cctx->V + 8, cctx->V, 8); - memcpy(cctx->V, cctx->K + 24, 8); + if (ctr->keylen == 24) { + memcpy(ctr->V + 8, ctr->V, 8); + memcpy(ctr->V, ctr->K + 24, 8); } - if (dctx->flags & RAND_DRBG_FLAG_CTR_USE_DF) { + if (drbg->flags & RAND_DRBG_FLAG_CTR_USE_DF) { /* If no input reuse existing derived value */ if (in1 != NULL || nonce != NULL || in2 != NULL) - ctr_df(cctx, in1, in1len, nonce, noncelen, in2, in2len); + ctr_df(ctr, in1, in1len, nonce, noncelen, in2, in2len); /* If this a reuse input in1len != 0 */ if (in1len) - ctr_XOR(cctx, cctx->KX, dctx->seedlen); + ctr_XOR(ctr, ctr->KX, drbg->seedlen); } else { - ctr_XOR(cctx, in1, in1len); - ctr_XOR(cctx, in2, in2len); + ctr_XOR(ctr, in1, in1len); + ctr_XOR(ctr, in2, in2len); } - AES_set_encrypt_key(cctx->K, dctx->strength, &cctx->ks); + AES_set_encrypt_key(ctr->K, drbg->strength, &ctr->ks); } -int ctr_instantiate(DRBG_CTX *dctx, +int ctr_instantiate(RAND_DRBG *drbg, const unsigned char *ent, size_t entlen, const unsigned char *nonce, size_t noncelen, const unsigned char *pers, size_t perslen) { - DRBG_CTR_CTX *cctx = &dctx->ctr; + RAND_DRBG_CTR *ctr = &drbg->ctr; - memset(cctx->K, 0, sizeof(cctx->K)); - memset(cctx->V, 0, sizeof(cctx->V)); - AES_set_encrypt_key(cctx->K, dctx->strength, &cctx->ks); - ctr_update(dctx, ent, entlen, pers, perslen, nonce, noncelen); + memset(ctr->K, 0, sizeof(ctr->K)); + memset(ctr->V, 0, sizeof(ctr->V)); + AES_set_encrypt_key(ctr->K, drbg->strength, &ctr->ks); + ctr_update(drbg, ent, entlen, pers, perslen, nonce, noncelen); return 1; } -int ctr_reseed(DRBG_CTX *dctx, +int ctr_reseed(RAND_DRBG *drbg, const unsigned char *ent, size_t entlen, const unsigned char *adin, size_t adinlen) { - ctr_update(dctx, ent, entlen, adin, adinlen, NULL, 0); + ctr_update(drbg, ent, entlen, adin, adinlen, NULL, 0); return 1; } -int ctr_generate(DRBG_CTX *dctx, +int ctr_generate(RAND_DRBG *drbg, unsigned char *out, size_t outlen, const unsigned char *adin, size_t adinlen) { - DRBG_CTR_CTX *cctx = &dctx->ctr; + RAND_DRBG_CTR *ctr = &drbg->ctr; if (adin != NULL && adinlen != 0) { - ctr_update(dctx, adin, adinlen, NULL, 0, NULL, 0); + ctr_update(drbg, adin, adinlen, NULL, 0, NULL, 0); /* This means we reuse derived value */ - if (dctx->flags & RAND_DRBG_FLAG_CTR_USE_DF) { + if (drbg->flags & RAND_DRBG_FLAG_CTR_USE_DF) { adin = NULL; adinlen = 1; } @@ -299,36 +276,36 @@ int ctr_generate(DRBG_CTX *dctx, } for ( ; ; ) { - inc_128(cctx); + inc_128(ctr); if (outlen < 16) { /* Use K as temp space as it will be updated */ - AES_encrypt(cctx->V, cctx->K, &cctx->ks); - memcpy(out, cctx->K, outlen); + AE |