From 75e2c877650444fb829547bdb58d46eb1297bc1a Mon Sep 17 00:00:00 2001 From: Rich Salz Date: Thu, 3 Aug 2017 09:23:28 -0400 Subject: Switch from ossl_rand to DRBG rand If RAND_add wraps around, XOR with existing. Add test to drbgtest that does the wrap-around. Re-order seeding and stop after first success. Add RAND_poll_ex() Use the DF and therefore lower RANDOMNESS_NEEDED. Also, for child DRBG's, mix in the address as the personalization bits. Centralize the entropy callbacks, from drbg_lib to rand_lib. (Conceptually, entropy is part of the enclosing application.) Thanks to Dr. Matthias St Pierre for the suggestion. Various code cleanups: -Make state an enum; inline RANDerr calls. -Add RAND_POLL_RETRIES (thanks Pauli for the idea) -Remove most RAND_seed calls from rest of library -Rename DRBG_CTX to RAND_DRBG, etc. -Move some code from drbg_lib to drbg_rand; drbg_lib is now only the implementation of NIST DRBG. -Remove blocklength Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/4019) --- apps/speed.c | 14 -- crypto/bn/bn_rand.c | 4 - crypto/dsa/dsa_asn1.c | 2 +- crypto/ec/ecdsa_ossl.c | 2 +- crypto/evp/evp_pkey.c | 1 - crypto/pem/pem_lib.c | 1 - crypto/rand/build.info | 2 +- crypto/rand/drbg_lib.c | 425 +++++++++++++++++-------------- crypto/rand/drbg_rand.c | 324 +++++++++--------------- crypto/rand/ossl_rand.c | 592 -------------------------------------------- crypto/rand/rand_egd.c | 13 +- crypto/rand/rand_lcl.h | 120 ++++++--- crypto/rand/rand_lib.c | 136 +++++++++- crypto/rand/rand_unix.c | 92 ++++--- crypto/rand/rand_vms.c | 4 +- crypto/rand/rand_win.c | 12 +- crypto/rsa/rsa_crpt.c | 10 - doc/man3/RAND_add.pod | 24 +- include/internal/rand.h | 64 ++--- include/openssl/ossl_typ.h | 2 +- include/openssl/rand.h | 10 + ssl/statem/statem.c | 2 - test/bntest.c | 3 - test/build.info | 6 +- test/dhtest.c | 5 - test/drbgtest.c | 206 ++++++++------- test/dsatest.c | 5 - test/ecdsatest.c | 6 - test/ectest.c | 5 - test/randtest.c | 110 -------- test/recipes/05-test_rand.t | 3 +- test/ssltest_old.c | 4 - util/libcrypto.num | 3 +- util/private.num | 1 + 34 files changed, 816 insertions(+), 1397 deletions(-) delete mode 100644 crypto/rand/ossl_rand.c delete mode 100644 test/randtest.c diff --git a/apps/speed.c b/apps/speed.c index 2d943b12e2..4a2a4a9069 100644 --- a/apps/speed.c +++ b/apps/speed.c @@ -247,11 +247,6 @@ static double ecdsa_results[EC_NUM][2]; static double ecdh_results[EC_NUM][1]; #endif -#if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_EC) -static const char rnd_seed[] = - "string to make the random number generator think it has randomness"; -#endif - #ifdef SIGALRM # if defined(__STDC__) || defined(sgi) || defined(_AIX) # define SIGRETTYPE void @@ -2397,9 +2392,6 @@ int speed_main(int argc, char **argv) RAND_bytes(loopargs[i].buf, 36); #ifndef OPENSSL_NO_DSA - if (RAND_status() != 1) { - RAND_seed(rnd_seed, sizeof rnd_seed); - } for (testnum = 0; testnum < DSA_NUM; testnum++) { int st = 0; if (!dsa_doit[testnum]) @@ -2467,9 +2459,6 @@ int speed_main(int argc, char **argv) #endif /* OPENSSL_NO_DSA */ #ifndef OPENSSL_NO_EC - if (RAND_status() != 1) { - RAND_seed(rnd_seed, sizeof rnd_seed); - } for (testnum = 0; testnum < EC_NUM; testnum++) { int st = 1; @@ -2554,9 +2543,6 @@ int speed_main(int argc, char **argv) } } - if (RAND_status() != 1) { - RAND_seed(rnd_seed, sizeof rnd_seed); - } for (testnum = 0; testnum < EC_NUM; testnum++) { int ecdh_checks = 1; diff --git a/crypto/bn/bn_rand.c b/crypto/bn/bn_rand.c index a7c7309888..0b9e43dbdd 100644 --- a/crypto/bn/bn_rand.c +++ b/crypto/bn/bn_rand.c @@ -18,7 +18,6 @@ static int bnrand(int testing, BIGNUM *rnd, int bits, int top, int bottom) { unsigned char *buf = NULL; int ret = 0, bit, bytes, mask; - time_t tim; if (bits == 0) { if (top != BN_RAND_TOP_ANY || bottom != BN_RAND_BOTTOM_ANY) @@ -40,9 +39,6 @@ static int bnrand(int testing, BIGNUM *rnd, int bits, int top, int bottom) } /* make a random number and set the top and bottom bits */ - time(&tim); - RAND_add(&tim, sizeof(tim), 0.0); - if (RAND_bytes(buf, bytes) <= 0) goto err; diff --git a/crypto/dsa/dsa_asn1.c b/crypto/dsa/dsa_asn1.c index 7de00c7440..92d6ae0ef1 100644 --- a/crypto/dsa/dsa_asn1.c +++ b/crypto/dsa/dsa_asn1.c @@ -111,7 +111,7 @@ int DSA_sign(int type, const unsigned char *dgst, int dlen, unsigned char *sig, unsigned int *siglen, DSA *dsa) { DSA_SIG *s; - RAND_seed(dgst, dlen); + s = DSA_do_sign(dgst, dlen, dsa); if (s == NULL) { *siglen = 0; diff --git a/crypto/ec/ecdsa_ossl.c b/crypto/ec/ecdsa_ossl.c index d67c48524a..c7ab0ee1a3 100644 --- a/crypto/ec/ecdsa_ossl.c +++ b/crypto/ec/ecdsa_ossl.c @@ -20,7 +20,7 @@ int ossl_ecdsa_sign(int type, const unsigned char *dgst, int dlen, const BIGNUM *kinv, const BIGNUM *r, EC_KEY *eckey) { ECDSA_SIG *s; - RAND_seed(dgst, dlen); + s = ECDSA_do_sign_ex(dgst, dlen, kinv, r, eckey); if (s == NULL) { *siglen = 0; diff --git a/crypto/evp/evp_pkey.c b/crypto/evp/evp_pkey.c index 81bffa6d91..e61a8761a9 100644 --- a/crypto/evp/evp_pkey.c +++ b/crypto/evp/evp_pkey.c @@ -80,7 +80,6 @@ PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8(EVP_PKEY *pkey) EVPerr(EVP_F_EVP_PKEY2PKCS8, EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM); goto error; } - RAND_add(p8->pkey->data, p8->pkey->length, 0.0); return p8; error: PKCS8_PRIV_KEY_INFO_free(p8); diff --git a/crypto/pem/pem_lib.c b/crypto/pem/pem_lib.c index cfe2fa6fac..76e0698558 100644 --- a/crypto/pem/pem_lib.c +++ b/crypto/pem/pem_lib.c @@ -361,7 +361,6 @@ int PEM_ASN1_write_bio(i2d_of_void *i2d, const char *name, BIO *bp, #endif kstr = (unsigned char *)buf; } - RAND_add(data, i, 0); /* put in the RSA key. */ OPENSSL_assert(EVP_CIPHER_iv_length(enc) <= (int)sizeof(iv)); if (RAND_bytes(iv, EVP_CIPHER_iv_length(enc)) <= 0) /* Generate a salt */ goto err; diff --git a/crypto/rand/build.info b/crypto/rand/build.info index f011d78d88..2591c01f3b 100644 --- a/crypto/rand/build.info +++ b/crypto/rand/build.info @@ -1,4 +1,4 @@ LIBS=../../libcrypto SOURCE[../../libcrypto]=\ - ossl_rand.c randfile.c rand_lib.c rand_err.c rand_egd.c \ + randfile.c rand_lib.c rand_err.c rand_egd.c \ rand_win.c rand_unix.c rand_vms.c drbg_lib.c drbg_rand.c diff --git a/crypto/rand/drbg_lib.c b/crypto/rand/drbg_lib.c index 1588515441..e3d97d38d9 100644 --- a/crypto/rand/drbg_lib.c +++ b/crypto/rand/drbg_lib.c @@ -15,53 +15,28 @@ /* * Support framework for NIST SP 800-90A DRBG, AES-CTR mode. - */ - -/* - * Get entropy from the existing callback. This is mainly used for KATs. - */ -static size_t get_entropy(DRBG_CTX *dctx, unsigned char **pout, - int entropy, size_t min_len, size_t max_len) -{ - if (dctx->get_entropy != NULL) - return dctx->get_entropy(dctx, pout, entropy, min_len, max_len); - /* TODO: Get from parent if it exists. */ - return 0; -} - -/* - * Cleanup entropy. - */ -static void cleanup_entropy(DRBG_CTX *dctx, unsigned char *out, size_t olen) -{ - if (dctx->cleanup_entropy != NULL) - dctx->cleanup_entropy(dctx, out, olen); -} - -/* + * The RAND_DRBG is OpenSSL's pointer to an instance of the DRBG. + * * The OpenSSL model is to have new and free functions, and that new * does all initialization. That is not the NIST model, which has * instantiation and un-instantiate, and re-use within a new/free * lifecycle. (No doubt this comes from the desire to support hardware * DRBG, where allocation of resources on something like an HSM is * a much bigger deal than just re-setting an allocated resource.) - * - * The DRBG_CTX is OpenSSL's opaque pointer to an instance of the - * DRBG. */ /* - * Set/initialize |dctx| to be of type |nid|, with optional |flags|. + * Set/initialize |drbg| to be of type |nid|, with optional |flags|. * Return -2 if the type is not supported, 1 on success and -1 on * failure. */ -int RAND_DRBG_set(DRBG_CTX *dctx, int nid, unsigned int flags) +int RAND_DRBG_set(RAND_DRBG *drbg, int nid, unsigned int flags) { int ret = 1; - dctx->status = DRBG_STATUS_UNINITIALISED; - dctx->flags = flags; - dctx->nid = nid; + drbg->state = DRBG_UNINITIALISED; + drbg->flags = flags; + drbg->nid = nid; switch (nid) { default: @@ -73,7 +48,7 @@ int RAND_DRBG_set(DRBG_CTX *dctx, int nid, unsigned int flags) case NID_aes_128_ctr: case NID_aes_192_ctr: case NID_aes_256_ctr: - ret = ctr_init(dctx); + ret = ctr_init(drbg); break; } @@ -84,169 +59,176 @@ int RAND_DRBG_set(DRBG_CTX *dctx, int nid, unsigned int flags) /* * Allocate memory and initialize a new DRBG. The |parent|, if not - * NULL, will be used to auto-seed this DRBG_CTX as needed. + * NULL, will be used to auto-seed this RAND_DRBG as needed. */ -DRBG_CTX *RAND_DRBG_new(int type, unsigned int flags, DRBG_CTX *parent) +RAND_DRBG *RAND_DRBG_new(int type, unsigned int flags, RAND_DRBG *parent) { - DRBG_CTX *dctx = OPENSSL_zalloc(sizeof(*dctx)); + RAND_DRBG *drbg = OPENSSL_zalloc(sizeof(*drbg)); + unsigned char *ucp = OPENSSL_zalloc(RANDOMNESS_NEEDED); - if (dctx == NULL) { + if (drbg == NULL || ucp == NULL) { RANDerr(RAND_F_RAND_DRBG_NEW, ERR_R_MALLOC_FAILURE); - return NULL; + goto err; } - - dctx->parent = parent; - if (RAND_DRBG_set(dctx, type, flags) < 0) { - OPENSSL_free(dctx); - return NULL; + drbg->size = RANDOMNESS_NEEDED; + drbg->randomness = ucp; + + drbg->parent = parent; + if (RAND_DRBG_set(drbg, type, flags) < 0) + goto err; + + if (parent != NULL) { + if (!RAND_DRBG_set_callbacks(drbg, drbg_entropy_from_parent, + drbg_release_entropy, + NULL, NULL) + /* + * Add in our address. Note we are adding the pointer + * itself, not its contents! + */ + || !RAND_DRBG_instantiate(drbg, + (unsigned char*)&drbg, sizeof(drbg))) + goto err; } - return dctx; + + return drbg; + +err: + OPENSSL_free(ucp); + OPENSSL_free(drbg); + return NULL; } /* - * Uninstantiate |dctx| and free all memory. + * Uninstantiate |drbg| and free all memory. */ -void RAND_DRBG_free(DRBG_CTX *dctx) +void RAND_DRBG_free(RAND_DRBG *drbg) { - if (dctx == NULL) + /* The global DRBG is free'd by rand_cleanup_int() */ + if (drbg == NULL || drbg == &rand_drbg) return; - ctr_uninstantiate(dctx); - CRYPTO_free_ex_data(CRYPTO_EX_INDEX_DRBG, dctx, &dctx->ex_data); - - /* Don't free up default DRBG */ - if (dctx == RAND_DRBG_get_default()) { - memset(dctx, 0, sizeof(DRBG_CTX)); - dctx->nid = 0; - dctx->status = DRBG_STATUS_UNINITIALISED; - } else { - OPENSSL_cleanse(&dctx->ctr, sizeof(dctx->ctr)); - OPENSSL_free(dctx); - } + ctr_uninstantiate(drbg); + OPENSSL_cleanse(drbg->randomness, drbg->size); + OPENSSL_free(drbg->randomness); + CRYPTO_free_ex_data(CRYPTO_EX_INDEX_DRBG, drbg, &drbg->ex_data); + OPENSSL_clear_free(drbg, sizeof(*drbg)); } /* - * Instantiate |dctx|, after it has been initialized. Use |pers| and + * Instantiate |drbg|, after it has been initialized. Use |pers| and * |perslen| as prediction-resistance input. */ -int RAND_DRBG_instantiate(DRBG_CTX *dctx, +int RAND_DRBG_instantiate(RAND_DRBG *drbg, const unsigned char *pers, size_t perslen) { - size_t entlen = 0, noncelen = 0; unsigned char *nonce = NULL, *entropy = NULL; - int r = 0; + size_t noncelen = 0, entlen = 0; - if (perslen > dctx->max_pers) { - r = RAND_R_PERSONALISATION_STRING_TOO_LONG; + if (perslen > drbg->max_pers) { + RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, + RAND_R_PERSONALISATION_STRING_TOO_LONG); goto end; } - if (dctx->status != DRBG_STATUS_UNINITIALISED) { - r = dctx->status == DRBG_STATUS_ERROR ? RAND_R_IN_ERROR_STATE - : RAND_R_ALREADY_INSTANTIATED; + if (drbg->state != DRBG_UNINITIALISED) { + RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, + drbg->state == DRBG_ERROR ? RAND_R_IN_ERROR_STATE + : RAND_R_ALREADY_INSTANTIATED); goto end; } - dctx->status = DRBG_STATUS_ERROR; - entlen = get_entropy(dctx, &entropy, dctx->strength, - dctx->min_entropy, dctx->max_entropy); - if (entlen < dctx->min_entropy || entlen > dctx->max_entropy) { - r = RAND_R_ERROR_RETRIEVING_ENTROPY; + drbg->state = DRBG_ERROR; + if (drbg->get_entropy != NULL) + entlen = drbg->get_entropy(drbg, &entropy, drbg->strength, + drbg->min_entropy, drbg->max_entropy); + if (entlen < drbg->min_entropy || entlen > drbg->max_entropy) { + RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, RAND_R_ERROR_RETRIEVING_ENTROPY); goto end; } - if (dctx->max_nonce > 0 && dctx->get_nonce != NULL) { - noncelen = dctx->get_nonce(dctx, &nonce, - dctx->strength / 2, - dctx->min_nonce, dctx->max_nonce); - - if (noncelen < dctx->min_nonce || noncelen > dctx->max_nonce) { - r = RAND_R_ERROR_RETRIEVING_NONCE; + if (drbg->max_nonce > 0 && drbg->get_nonce != NULL) { + noncelen = drbg->get_nonce(drbg, &nonce, drbg->strength / 2, + drbg->min_nonce, drbg->max_nonce); + if (noncelen < drbg->min_nonce || noncelen > drbg->max_nonce) { + RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, RAND_R_ERROR_RETRIEVING_NONCE); goto end; } } - if (!ctr_instantiate(dctx, entropy, entlen, + if (!ctr_instantiate(drbg, entropy, entlen, nonce, noncelen, pers, perslen)) { - r = RAND_R_ERROR_INSTANTIATING_DRBG; + RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, RAND_R_ERROR_INSTANTIATING_DRBG); goto end; } - dctx->status = DRBG_STATUS_READY; - dctx->reseed_counter = 1; + drbg->state = DRBG_READY; + drbg->reseed_counter = 1; end: - if (entropy != NULL && dctx->cleanup_entropy != NULL) - dctx->cleanup_entropy(dctx, entropy, entlen); - if (nonce != NULL && dctx->cleanup_nonce!= NULL ) - dctx->cleanup_nonce(dctx, nonce, noncelen); - if (dctx->status == DRBG_STATUS_READY) + if (entropy != NULL && drbg->cleanup_entropy != NULL) + drbg->cleanup_entropy(drbg, entropy); + if (nonce != NULL && drbg->cleanup_nonce!= NULL ) + drbg->cleanup_nonce(drbg, nonce); + if (drbg->state == DRBG_READY) return 1; - - if (r) - RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, r); return 0; } /* - * Uninstantiate |dctx|. Must be instantiated before it can be used. + * Uninstantiate |drbg|. Must be instantiated before it can be used. */ -int RAND_DRBG_uninstantiate(DRBG_CTX *dctx) +int RAND_DRBG_uninstantiate(RAND_DRBG *drbg) { - int ret = ctr_uninstantiate(dctx); + int ret = ctr_uninstantiate(drbg); - OPENSSL_cleanse(&dctx->ctr, sizeof(dctx->ctr)); - dctx->status = DRBG_STATUS_UNINITIALISED; + OPENSSL_cleanse(&drbg->ctr, sizeof(drbg->ctr)); + drbg->state = DRBG_UNINITIALISED; return ret; } /* - * Mix in the specified data to reseed |dctx|. + * Mix in the specified data to reseed |drbg|. */ -int RAND_DRBG_reseed(DRBG_CTX *dctx, +int RAND_DRBG_reseed(RAND_DRBG *drbg, const unsigned char *adin, size_t adinlen) { unsigned char *entropy = NULL; size_t entlen = 0; - int r = 0; - - if (dctx->status != DRBG_STATUS_READY - && dctx->status != DRBG_STATUS_RESEED) { - if (dctx->status == DRBG_STATUS_ERROR) - r = RAND_R_IN_ERROR_STATE; - else if (dctx->status == DRBG_STATUS_UNINITIALISED) - r = RAND_R_NOT_INSTANTIATED; - goto end; + + if (drbg->state == DRBG_ERROR) { + RANDerr(RAND_F_RAND_DRBG_RESEED, RAND_R_IN_ERROR_STATE); + return 0; + } + if (drbg->state == DRBG_UNINITIALISED) { + RANDerr(RAND_F_RAND_DRBG_RESEED, RAND_R_NOT_INSTANTIATED); + return 0; } if (adin == NULL) adinlen = 0; - else if (adinlen > dctx->max_adin) { - r = RAND_R_ADDITIONAL_INPUT_TOO_LONG; - goto end; + else if (adinlen > drbg->max_adin) { + RANDerr(RAND_F_RAND_DRBG_RESEED, RAND_R_ADDITIONAL_INPUT_TOO_LONG); + return 0; } - dctx->status = DRBG_STATUS_ERROR; - entlen = get_entropy(dctx, &entropy, dctx->strength, - dctx->min_entropy, dctx->max_entropy); - - if (entlen < dctx->min_entropy || entlen > dctx->max_entropy) { - r = RAND_R_ERROR_RETRIEVING_ENTROPY; + drbg->state = DRBG_ERROR; + if (drbg->get_entropy != NULL) + entlen = drbg->get_entropy(drbg, &entropy, drbg->strength, + drbg->min_entropy, drbg->max_entropy); + if (entlen < drbg->min_entropy || entlen > drbg->max_entropy) { + RANDerr(RAND_F_RAND_DRBG_RESEED, RAND_R_ERROR_RETRIEVING_ENTROPY); goto end; } - if (!ctr_reseed(dctx, entropy, entlen, adin, adinlen)) + if (!ctr_reseed(drbg, entropy, entlen, adin, adinlen)) goto end; - dctx->status = DRBG_STATUS_READY; - dctx->reseed_counter = 1; + drbg->state = DRBG_READY; + drbg->reseed_counter = 1; end: - if (entropy != NULL && dctx->cleanup_entropy != NULL) - cleanup_entropy(dctx, entropy, entlen); - if (dctx->status == DRBG_STATUS_READY) + if (entropy != NULL && drbg->cleanup_entropy != NULL) + drbg->cleanup_entropy(drbg, entropy); + if (drbg->state == DRBG_READY) return 1; - if (r) - RANDerr(RAND_F_RAND_DRBG_RESEED, r); - return 0; } @@ -255,98 +237,183 @@ end: * to or if |prediction_resistance| is set. Additional input can be * sent in |adin| and |adinlen|. */ -int RAND_DRBG_generate(DRBG_CTX *dctx, unsigned char *out, size_t outlen, +int RAND_DRBG_generate(RAND_DRBG *drbg, unsigned char *out, size_t outlen, int prediction_resistance, const unsigned char *adin, size_t adinlen) { - int r = 0; - - if (dctx->status != DRBG_STATUS_READY - && dctx->status != DRBG_STATUS_RESEED) { - if (dctx->status == DRBG_STATUS_ERROR) - r = RAND_R_IN_ERROR_STATE; - else if(dctx->status == DRBG_STATUS_UNINITIALISED) - r = RAND_R_NOT_INSTANTIATED; - goto end; + if (drbg->state == DRBG_ERROR) { + RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_IN_ERROR_STATE); + return 0; } - - if (outlen > dctx->max_request) { - r = RAND_R_REQUEST_TOO_LARGE_FOR_DRBG; + if (drbg->state == DRBG_UNINITIALISED) { + RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_NOT_INSTANTIATED); return 0; } - if (adinlen > dctx->max_adin) { - r = RAND_R_ADDITIONAL_INPUT_TOO_LONG; - goto end; + if (outlen > drbg->max_request) { + RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_REQUEST_TOO_LARGE_FOR_DRBG); + return 0; + } + if (adinlen > drbg->max_adin) { + RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_ADDITIONAL_INPUT_TOO_LONG); + return 0; } - if (dctx->reseed_counter >= dctx->reseed_interval) - dctx->status = DRBG_STATUS_RESEED; + if (drbg->reseed_counter >= drbg->reseed_interval) + drbg->state = DRBG_RESEED; - if (dctx->status == DRBG_STATUS_RESEED || prediction_resistance) { - if (!RAND_DRBG_reseed(dctx, adin, adinlen)) { - r = RAND_R_RESEED_ERROR; - goto end; + if (drbg->state == DRBG_RESEED || prediction_resistance) { + if (!RAND_DRBG_reseed(drbg, adin, adinlen)) { + RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_RESEED_ERROR); + return 0; } adin = NULL; adinlen = 0; } - if (!ctr_generate(dctx, out, outlen, adin, adinlen)) { - r = RAND_R_GENERATE_ERROR; - dctx->status = DRBG_STATUS_ERROR; - goto end; + if (!ctr_generate(drbg, out, outlen, adin, adinlen)) { + drbg->state = DRBG_ERROR; + RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_GENERATE_ERROR); + return 0; } - if (dctx->reseed_counter >= dctx->reseed_interval) - dctx->status = DRBG_STATUS_RESEED; + + if (drbg->reseed_counter >= drbg->reseed_interval) + drbg->state = DRBG_RESEED; else - dctx->reseed_counter++; + drbg->reseed_counter++; return 1; - -end: - RANDerr(RAND_F_RAND_DRBG_GENERATE, r); - return 0; } /* - * Set the callbacks for entropy and nonce. Used mainly for the KATs + * Set the callbacks for entropy and nonce. We currently don't use + * the nonce; that's mainly for the KATs */ -int RAND_DRBG_set_callbacks(DRBG_CTX *dctx, - size_t (*cb_get_entropy)(DRBG_CTX *ctx, unsigned char **pout, - int entropy, size_t min_len, size_t max_len), - void (*cb_cleanup_entropy)(DRBG_CTX *ctx, unsigned char *out, size_t olen), - size_t (*cb_get_nonce)(DRBG_CTX *ctx, unsigned char **pout, - int entropy, size_t min_len, size_t max_len), - void (*cb_cleanup_nonce)(DRBG_CTX *ctx, unsigned char *out, size_t olen)) +int RAND_DRBG_set_callbacks(RAND_DRBG *drbg, + RAND_DRBG_get_entropy_fn cb_get_entropy, + RAND_DRBG_cleanup_entropy_fn cb_cleanup_entropy, + RAND_DRBG_get_nonce_fn cb_get_nonce, + RAND_DRBG_cleanup_nonce_fn cb_cleanup_nonce) { - if (dctx->status != DRBG_STATUS_UNINITIALISED) + if (drbg->state != DRBG_UNINITIALISED) return 0; - dctx->get_entropy = cb_get_entropy; - dctx->cleanup_entropy = cb_cleanup_entropy; - dctx->get_nonce = cb_get_nonce; - dctx->cleanup_nonce = cb_cleanup_nonce; + drbg->get_entropy = cb_get_entropy; + drbg->cleanup_entropy = cb_cleanup_entropy; + drbg->get_nonce = cb_get_nonce; + drbg->cleanup_nonce = cb_cleanup_nonce; return 1; } /* - * Set the reseed interval. Used mainly for the KATs. + * Set the reseed interval. */ -int RAND_DRBG_set_reseed_interval(DRBG_CTX *dctx, int interval) +int RAND_DRBG_set_reseed_interval(RAND_DRBG *drbg, int interval) { if (interval < 0 || interval > MAX_RESEED) return 0; - dctx->reseed_interval = interval; + drbg->reseed_interval = interval; return 1; } /* * Get and set the EXDATA */ -int RAND_DRBG_set_ex_data(DRBG_CTX *dctx, int idx, void *arg) +int RAND_DRBG_set_ex_data(RAND_DRBG *drbg, int idx, void *arg) +{ + return CRYPTO_set_ex_data(&drbg->ex_data, idx, arg); +} + +void *RAND_DRBG_get_ex_data(const RAND_DRBG *drbg, int idx) +{ + return CRYPTO_get_ex_data(&drbg->ex_data, idx); +} + + +/* + * The following functions provide a RAND_METHOD that works on the + * global DRBG. They lock. + */ + +static int drbg_bytes(unsigned char *out, int count) +{ + int ret = 0; + size_t chunk; + + CRYPTO_THREAD_write_lock(rand_drbg.lock); + if (rand_drbg.state == DRBG_UNINITIALISED + && RAND_DRBG_instantiate(&rand_drbg, NULL, 0) == 0) + goto err; + + for ( ; count > 0; count -= chunk, out += chunk) { + chunk = count; + if (chunk > rand_drbg.max_request) + chunk = rand_drbg.max_request; + ret = RAND_DRBG_generate(&rand_drbg, out, chunk, 0, NULL, 0); + if (!ret) + goto err; + } + ret = 1; + +err: + CRYPTO_THREAD_unlock(rand_drbg.lock); + return ret; +} + +static void drbg_cleanup(void) +{ + CRYPTO_THREAD_write_lock(rand_drbg.lock); + RAND_DRBG_uninstantiate(&rand_drbg); + CRYPTO_THREAD_unlock(rand_drbg.lock); +} + +static int drbg_add(const void *buf, int num, double randomness) +{ + unsigned char *in = (unsigned char *)buf; + unsigned char *out, *end; + + CRYPTO_THREAD_write_lock(rand_bytes.lock); + out = &rand_bytes.buff[rand_bytes.curr]; + end = &rand_bytes.buff[rand_bytes.size]; + + /* Copy whatever fits into the end of the buffer. */ + for ( ; --num >= 0 && out < end; rand_bytes.curr++) + *out++ = *in++; + + /* XOR any the leftover. */ + while (num > 0) { + for (out = rand_bytes.buff; --num >= 0 && out < end; ) + *out++ ^= *in++; + } + + CRYPTO_THREAD_unlock(rand_bytes.lock); + return 1; +} + +static int drbg_seed(const void *buf, int num) +{ + return drbg_add(buf, num, num); +} + +static int drbg_status(void) { - return CRYPTO_set_ex_data(&dctx->ex_data, idx, arg); + int ret; + + CRYPTO_THREAD_write_lock(rand_drbg.lock); + ret = rand_drbg.state == DRBG_READY ? 1 : 0; + CRYPTO_THREAD_unlock(rand_drbg.lock); + return ret; } -void *RAND_DRBG_get_ex_data(const DRBG_CTX *dctx, int idx) +RAND_DRBG rand_drbg; /* The default global DRBG. */ + +RAND_METHOD rand_meth = { + drbg_seed, + drbg_bytes, + drbg_cleanup, + drbg_add, + drbg_bytes, + drbg_status +}; + +RAND_METHOD *RAND_OpenSSL(void) { - return CRYPTO_get_ex_data(&dctx->ex_data, idx); + return &rand_meth; } diff --git a/crypto/rand/drbg_rand.c b/crypto/rand/drbg_rand.c index 8b30cd8a0d..06f8affeb8 100644 --- a/crypto/rand/drbg_rand.c +++ b/crypto/rand/drbg_rand.c @@ -16,37 +16,14 @@ #include "internal/thread_once.h" /* - * Mapping of NIST SP 800-90A DRBG to OpenSSL RAND_METHOD. + * Implementation of NIST SP 800-90A CTR DRBG. */ - -/* - * The default global DRBG and its auto-init/auto-cleanup. - */ -static DRBG_CTX ossl_drbg; - -static CRYPTO_ONCE ossl_drbg_init = CRYPTO_ONCE_STATIC_INIT; - -DEFINE_RUN_ONCE_STATIC(do_ossl_drbg_init) -{ - int st = 1; - - ossl_drbg.lock = CRYPTO_THREAD_lock_new(); - st &= ossl_drbg.lock != NULL; - st &= RAND_DRBG_set(&ossl_drbg, NID_aes_128_ctr, 0) == 1; - return st; -} - -void rand_drbg_cleanup(void) -{ - CRYPTO_THREAD_lock_free(ossl_drbg.lock); -} - -static void inc_128(DRBG_CTR_CTX *cctx) +static void inc_128(RAND_DRBG_CTR *ctr) { int i; unsigned char c; - unsigned char *p = &cctx->V[15]; + unsigned char *p = &ctr->V[15]; for (i = 0; i < 16; i++, p--) { c = *p; @@ -59,7 +36,7 @@ static void inc_128(DRBG_CTR_CTX *cctx) } } -static void ctr_XOR(DRBG_CTR_CTX *cctx, const unsigned char *in, size_t inlen) +static void ctr_XOR(RAND_DRBG_CTR *ctr, const unsigned char *in, size_t inlen) { size_t i, n; @@ -70,81 +47,81 @@ static void ctr_XOR(DRBG_CTR_CTX *cctx, const unsigned char *in, size_t inlen) * Any zero padding will have no effect on the result as we * are XORing. So just process however much input we have. */ - n = inlen < cctx->keylen ? inlen : cctx->keylen; + n = inlen < ctr->keylen ? inlen : ctr->keylen; for (i = 0; i < n; i++) - cctx->K[i] ^= in[i]; - if (inlen <= cctx->keylen) + ctr->K[i] ^= in[i]; + if (inlen <= ctr->keylen) return; - n = inlen - cctx->keylen; + n = inlen - ctr->keylen; if (n > 16) { /* Should never happen */ n = 16; } for (i = 0; i < n; i++) - cctx->V[i] ^= in[i + cctx->keylen]; + ctr->V[i] ^= in[i + ctr->keylen]; } /* * Process a complete block using BCC algorithm of SP 800-90A 10.3.3 */ -static void ctr_BCC_block(DRBG_CTR_CTX *cctx, unsigned char *out, +static void ctr_BCC_block(RAND_DRBG_CTR *ctr, unsigned char *out, const unsigned char *in) { int i; for (i = 0; i < 16; i++) out[i] ^= in[i]; - AES_encrypt(out, out, &cctx->df_ks); + AES_encrypt(out, out, &ctr->df_ks); } /* * Handle several BCC operations for as much data as we need for K and X */ -static void ctr_BCC_blocks(DRBG_CTR_CTX *cctx, const unsigned char *in) +static void ctr_BCC_blocks(RAND_DRBG_CTR *ctr, const unsigned char *in) { - ctr_BCC_block(cctx, cctx->KX, in); - ctr_BCC_block(cctx, cctx->KX + 16, in); - if (cctx->keylen != 16) - ctr_BCC_block(cctx, cctx->KX + 32, in); + ctr_BCC_block(ctr, ctr->KX, in); + ctr_BCC_block(ctr, ctr->KX + 16, in); + if (ctr->keylen != 16) + ctr_BCC_block(ctr, ctr->KX + 32, in); } /* * Initialise BCC blocks: these have the value 0,1,2 in leftmost positions: * see 10.3.1 stage 7. */ -static void ctr_BCC_init(DRBG_CTR_CTX *cctx) +static void ctr_BCC_init(RAND_DRBG_CTR *ctr) { - memset(cctx->KX, 0, 48); - memset(cctx->bltmp, 0, 16); - ctr_BCC_block(cctx, cctx->KX, cctx->bltmp); - cctx->bltmp[3] = 1; - ctr_BCC_block(cctx, cctx->KX + 16, cctx->bltmp); - if (cctx->keylen != 16) { - cctx->bltmp[3] = 2; - ctr_BCC_block(cctx, cctx->KX + 32, cctx->bltmp); + memset(ctr->KX, 0, 48); + memset(ctr->bltmp, 0, 16); + ctr_BCC_block(ctr, ctr->KX, ctr->bltmp); + ctr->bltmp[3] = 1; + ctr_BCC_block(ctr, ctr->KX + 16, ctr->bltmp); + if (ctr->keylen != 16) { + ctr->bltmp[3] = 2; + ctr_BCC_block(ctr, ctr->KX + 32, ctr->bltmp); } } /* * Process several blocks into BCC algorithm, some possibly partial */ -static void ctr_BCC_update(DRBG_CTR_CTX *cctx, +static void ctr_BCC_update(RAND_DRBG_CTR *ctr, const unsigned char *in, size_t inlen) { if (in == NULL || inlen == 0) return; /* If we have partial block handle it first */ - if (cctx->bltmp_pos) { - size_t left = 16 - cctx->bltmp_pos; + if (ctr->bltmp_pos) { + size_t left = 16 - ctr->bltmp_pos; /* If we now have a complete block process it */ if (inlen >= left) { - memcpy(cctx->bltmp + cctx->bltmp_pos, in, left); - ctr_BCC_blocks(cctx, cctx->bltmp); - cctx->bltmp_pos = 0; + memcpy(ctr->bltmp + ctr->bltmp_pos, in, left); + ctr_BCC_blocks(ctr, ctr->bltmp); + ctr->bltmp_pos = 0; inlen -= left; in += left; } @@ -152,34 +129,34 @@ static void ctr_BCC_update(DRBG_CTR_CTX *cctx, /* Process zero or more complete blocks */ for (; inlen >= 16; in += 16, inlen -= 16) { - ctr_BCC_blocks(cctx, in); + ctr_BCC_blocks(ctr, in); } /* Copy any remaining partial block to the temporary buffer */ if (inlen > 0) { - memcpy(cctx->bltmp + cctx->bltmp_pos, in, inlen); - cctx->bltmp_pos += inlen; + memcpy(ctr->bltmp + ctr->bltmp_pos, in, inlen); + ctr->bltmp_pos += inlen; } } -static void ctr_BCC_final(DRBG_CTR_CTX *cctx) +static void ctr_BCC_final(RAND_DRBG_CTR *ctr) { - if (cctx->bltmp_pos) { - memset(cctx->bltmp + cctx->bltmp_pos, 0, 16 - cctx->bltmp_pos); - ctr_BCC_blocks(cctx, cctx->bltmp); + if (ctr->bltmp_pos) { + memset(ctr->bltmp + ctr->bltmp_pos, 0, 16 - ctr->bltmp_pos); + ctr_BCC_blocks(ctr, ctr->bltmp); } } -static void ctr_df(DRBG_CTR_CTX *cctx, +static void ctr_df(RAND_DRBG_CTR *ctr, const unsigned char *in1, size_t in1len, const unsigned char *in2, size_t in2len, const unsigned char *in3, size_t in3len) { static unsigned char c80 = 0x80; size_t inlen; - unsigned char *p = cctx->bltmp; + unsigned char *p = ctr->bltmp; - ctr_BCC_init(cctx); + ctr_BCC_init(ctr); if (in1 == NULL) in1len = 0; if (in2 == NULL) @@ -197,100 +174,100 @@ static void ctr_df(DRBG_CTR_CTX *cctx, *p++ = 0; *p++ = 0; *p++ = 0; - *p = (unsigned char)((cctx->keylen + 16) & 0xff); - cctx->bltmp_pos = 8; - ctr_BCC_update(cctx, in1, in1len); - ctr_BCC_update(cctx, in2, in2len); - ctr_BCC_update(cctx, in3, in3len); - ctr_BCC_update(cctx, &c80, 1); - ctr_BCC_final(cctx); + *p = (unsigned char)((ctr->keylen + 16) & 0xff); + ctr->bltmp_pos = 8; + ctr_BCC_update(ctr, in1, in1len); + ctr_BCC_update(ctr, in2, in2len); + ctr_BCC_update(ctr, in3, in3len); + ctr_BCC_update(ctr, &c80, 1); + ctr_BCC_final(ctr); /* Set up key K */ - AES_set_encrypt_key(cctx->KX, cctx->keylen * 8, &cctx->df_kxks); + AES_set_encrypt_key(ctr->KX, ctr->keylen * 8, &ctr->df_kxks); /* X follows key K */ - AES_encrypt(cctx->KX + cctx->keylen, cctx->KX, &cctx->df_kxks); - AES_encrypt(cctx->KX, cctx->KX + 16, &cctx->df_kxks); - if (cctx->keylen != 16) - AES_encrypt(cctx->KX + 16, cctx->KX + 32, &cctx->df_kxks); + AES_encrypt(ctr->KX + ctr->keylen, ctr->KX, &ctr->df_kxks); + AES_encrypt(ctr->KX, ctr->KX + 16, &ctr->df_kxks); + if (ctr->keylen != 16) + AES_encrypt(ctr->KX + 16, ctr->KX + 32, &ctr->df_kxks); } /* * NB the no-df Update in SP800-90A specifies a constant input length * of seedlen, however other uses of this algorithm pad the input with * zeroes if necessary and have up to two parameters XORed together, - * handle both cases in this function instead. + * so we handle both cases in this function instead. */ -static void ctr_update(DRBG_CTX *dctx, +static void ctr_update(RAND_DRBG *drbg, const unsigned char *in1, size_t in1len, const unsigned char *in2, size_t in2len, const unsigned char *nonce, size_t noncelen) { - DRBG_CTR_CTX *cctx = &dctx->ctr; + RAND_DRBG_CTR *ctr = &drbg->ctr; /* ks is already setup for correct key */ - inc_128(cctx); - AES_encrypt(cctx->V, cctx->K, &cctx->ks); + inc_128(ctr); + AES_encrypt(ctr->V, ctr->K, &ctr->ks); /* If keylen longer than 128 bits need extra encrypt */ - if (cctx->keylen != 16) { - inc_128(cctx); - AES_encrypt(cctx->V, cctx->K + 16, &cctx->ks); + if (ctr->keylen != 16) { + inc_128(ctr); + AES_encrypt(ctr->V, ctr->K + 16, &ctr->ks); } - inc_128(cctx); - AES_encrypt(cctx->V, cctx->V, &cctx->ks); + inc_128(ctr); + AES_encrypt(ctr->V, ctr->V, &ctr->ks); /* If 192 bit key part of V is on end of K */ - if (cctx->keylen == 24) { - memcpy(cctx->V + 8, cctx->V, 8); - memcpy(cctx->V, cctx->K + 24, 8); + if (ctr->keylen == 24) { + memcpy(ctr->V + 8, ctr->V, 8); + memcpy(ctr->V, ctr->K + 24, 8); } - if (dctx->flags & RAND_DRBG_FLAG_CTR_USE_DF) { + if (drbg->flags & RAND_DRBG_FLAG_CTR_USE_DF) { /* If no input reuse existing derived value */ if (in1 != NULL || nonce != NULL || in2 != NULL) - ctr_df(cctx, in1, in1len, nonce, noncelen, in2, in2len); + ctr_df(ctr, in1, in1len, nonce, noncelen, in2, in2len); /* If this a reuse input in1len != 0 */ if (in1len) - ctr_XOR(cctx, cctx->KX, dctx->seedlen); + ctr_XOR(ctr, ctr->KX, drbg->seedlen); } else { - ctr_XOR(cctx, in1, in1len); - ctr_XOR(cctx, in2, in2len); + ctr_XOR(ctr, in1, in1len); + ctr_XOR(ctr, in2, in2len); } - AES_set_encrypt_key(cctx->K, dctx->strength, &cctx->ks); + AES_set_encrypt_key(ctr->K, drbg->strength, &ctr->ks); } -int ctr_instantiate(DRBG_CTX *dctx, +int ctr_instantiate(RAND_DRBG *drbg, const unsigned char *ent, size_t entlen, const unsigned char *nonce, size_t noncelen, const unsigned char *pers, size_t perslen) { - DRBG_CTR_CTX *cctx = &dctx->ctr; + RAND_DRBG_CTR *ctr = &drbg->ctr; - memset(cctx->K, 0, sizeof(cctx->K)); - memset(cctx->V, 0, sizeof(cctx->V)); - AES_set_encrypt_key(cctx->K, dctx->strength, &cctx->ks); - ctr_update(dctx, ent, entlen, pers, perslen, nonce, noncelen); + memset(ctr->K, 0, sizeof(ctr->K)); + memset(ctr->V, 0, sizeof(ctr->V)); + AES_set_encrypt_key(ctr->K, drbg->strength, &ctr->ks); + ctr_update(drbg, ent, entlen, pers, perslen, nonce, noncelen); return 1; } -int ctr_reseed(DRBG_CTX *dctx, +int ctr_reseed(RAND_DRBG *drbg, const unsigned char *ent, size_t entlen, const unsigned char *adin, size_t adinlen) { - ctr_update(dctx, ent, entlen, adin, adinlen, NULL, 0); + ctr_update(drbg, ent, entlen, adin, adinlen, NULL, 0); return 1; } -int ctr_generate(DRBG_CTX *dctx, +int ctr_generate(RAND_DRBG *drbg, unsigned char *out, size_t outlen, const unsigned char *adin, size_t adinlen) { - DRBG_CTR_CTX *cctx = &dctx->ctr; + RAND_DRBG_CTR *ctr = &drbg->ctr; if (adin != NULL && adinlen != 0) { - ctr_update(dctx, adin, adinlen, NULL, 0, NULL, 0); + ctr_update(drbg, adin, adinlen, NULL, 0, NULL, 0); /* This means we reuse derived value */ - if (dctx->flags & RAND_DRBG_FLAG_CTR_USE_DF) { + if (drbg->flags & RAND_DRBG_FLAG_CTR_USE_DF) { adin = NULL; adinlen = 1; } @@ -299,36 +276,36 @@ int ctr_generate(DRBG_CTX *dctx, } for ( ; ; ) { - inc_128(cctx); + inc_128(ctr); if (outlen < 16) { /* Use K as temp space as it will be updated */ - AES_encrypt(cctx->V, cctx->K, &cctx->ks); - memcpy(out, cctx->K, outlen); + AES_encrypt(ctr->V, ctr->K, &ctr->ks); + memcpy(out, ctr->K, outlen); break; } - AES_encrypt(cctx->V, out, &cctx->ks); + AES_encrypt(ctr->V, out, &ctr->ks); out += 16; outlen -= 16; if (outlen == 0) break; } - ctr_update(dctx, adin, adinlen, NULL, 0, NULL, 0); + ctr_update(drbg, adin, adinlen, NULL, 0, NULL, 0); return 1; } -int ctr_uninstantiate(DRBG_CTX *dctx) +int ctr_uninstantiate(RAND_DRBG *drbg) { - memset(&dctx->ctr, 0, sizeof(dctx->ctr)); + memset(&drbg->ctr, 0, sizeof(drbg->ctr)); return 1; } -int ctr_init(DRBG_CTX *dctx) +int ctr_init(RAND_DRBG *drbg) { - DRBG_CTR_CTX *cctx = &dctx->ctr; + RAND_DRBG_CTR *ctr = &drbg->ctr; size_t keylen; - switch (dctx->nid) { + switch (drbg->nid) { default: /* This can't happen, but silence the compiler warning. */ return -1; @@ -343,12 +320,11 @@ int ctr_init(DRBG_CTX *dctx) break; } - cctx->keylen = keylen; - dctx->strength = keylen * 8; - dctx->blocklength = 16; - dctx->seedlen = keylen + 16; + ctr->keylen = keylen; + drbg->strength = keylen * 8; + drbg->seedlen = keylen + 16; - if (dctx->flags & RAND_DRBG_FLAG_CTR_USE_DF) { + if (drbg->flags & RAND_DRBG_FLAG_CTR_USE_DF) { /* df initialisation */ static unsigned char df_key[32] = { 0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07, @@ -357,97 +333,25 @@ int ctr_init(DRBG_CTX *dctx) 0x18,0x19,0x1a,0x1b,0x1c,0x1d,0x1e,0x1f }; /* Set key schedule for df_key */ - AES_set_encrypt_key(df_key, dctx->strength, &cctx->df_ks); - - dctx->min_entropy = cctx->keylen; - dctx->max_entropy = DRBG_MAX_LENGTH; - dctx->min_nonce = dctx->min_entropy / 2; - dctx->max_nonce = DRBG_MAX_LENGTH; - dctx->max_pers = DRBG_MAX_LENGTH; - dctx->max_adin = DRBG_MAX_LENGTH; + AES_set_encrypt_key(df_key, drbg->strength, &ctr->df_ks); + + drbg->min_entropy = ctr->keylen; + drbg->max_entropy = DRBG_MAX_LENGTH; + drbg->min_nonce = drbg->min_entropy / 2; + drbg->max_nonce = DRBG_MAX_LENGTH; + drbg->max_pers = DRBG_MAX_LENGTH; + drbg->max_adin = DRBG_MAX_LENGTH; } else { - dctx->min_entropy = dctx->seedlen; - dctx->max_entropy = dctx->seedlen; + drbg->min_entropy = drbg->seedlen; + drbg->max_entropy = drbg->seedlen; /* Nonce not used */ - dctx->min_nonce = 0; - dctx->max_nonce = 0; - dctx->max_pers = dctx->seedlen; - dctx->max_adin = dctx->seedlen; + drbg->min_nonce = 0; + drbg->max_nonce = 0; + drbg->max_pers = drbg->seedlen; + drbg->max_adin = drbg->seedlen; } - dctx->max_request = 1 << 16; - dctx->reseed_interval = MAX_RESEED; + drbg->max_request = 1 << 16; + drbg->reseed_interval = MAX_RESEED; return 1; } - - -/* - * The following function tie the DRBG code into the RAND_METHOD - */ - -DRBG_CTX *RAND_DRBG_get_default(void) -{ - if (!RUN_ONCE(&ossl_drbg_init, do_ossl_drbg_init)) - return NULL; - return &ossl_drbg; -} - -static int drbg_bytes(unsigned char *out, int count) -{ - DRBG_CTX *dctx = RAND_DRBG_get_default(); - int ret = 0; - - CRYPTO_THREAD_write_lock(dctx->lock); - do { - size_t rcnt; - - if (count > (int)dctx->max_request) - rcnt = dctx->max_request; - else - rcnt = count; - ret = RAND_DRBG_generate(dctx, out, rcnt, 0, NULL, 0); - if (!ret) - goto err; - out += rcnt; - count -= rcnt; - } while (count); - ret = 1; -err: - CRYPTO_THREAD_unlock(dctx->lock); - return ret; -} - -static int drbg_status(void) -{ - DRBG_CTX *dctx = RAND_DRBG_get_default(); - int ret; - - CRYPTO_THREAD_write_lock(dctx->lock); - ret = dctx->status == DRBG_STATUS_READY ? 1 : 0; - CRYPTO_THREAD_unlock(dctx->lock); - return ret; -} - -static void drbg_cleanup(void) -{ - DRBG_CTX *dctx = RAND_DRBG_get_default(); - - CRYPTO_THREAD_write_lock(dctx->lock); - RAND_DRBG_uninstantiate(dctx); - CRYPTO_THREAD_unlock(dctx->lock); -} - -static const RAND_METHOD rand_drbg_meth = -{ - NULL, - drbg_bytes, - drbg_cleanup, - NULL, - drbg_bytes, - drbg_status -}; - -const RAND_METHOD *RAND_drbg(void) -{ - return &rand_drbg_meth; -} diff --git a/crypto/rand/ossl_rand.c b/crypto/rand/ossl_rand.c deleted file mode 100644 index 063b55b4f1..0000000000 --- a/crypto/rand/ossl_rand.c +++ /dev/null @@ -1,592 +0,0 @@ -/* - * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the OpenSSL license (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#include -#include - -#include "e_os.h" - -#if !(defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_VXWORKS) || defined(OPENSSL_SYS_DSPBIOS)) -# include -#endif -#if defined(OPENSSL_SYS_VXWORKS) -# include -#endif - -#include -#include -#include -#include -#include -#include -#include "rand_lcl.h" - -#define STATE_SIZE 1023 - -typedef struct ossl_rand_state_st OSSL_RAND_STATE; - -struct ossl_rand_state_st { - size_t num; - size_t index; - unsigned char state[STATE_SIZE + SHA_DIGEST_LENGTH]; - unsigned char md[SHA_DIGEST_LENGTH]; - long md_count[2]; -}; - -static OSSL_RAND_STATE global_state; -static double randomness = 0; -static int initialized = 0; -static CRYPTO_RWLOCK *rand_lock = NULL; -static CRYPTO_RWLOCK *rand_tmp_lock = NULL; -static CRYPTO_ONCE ossl_rand_init = CRYPTO_ONCE_STATIC_INIT; -static CRYPTO_THREAD_LOCAL key; - -/* May be set only when a thread holds rand_lock (to prevent double locking) */ -static unsigned int crypto_lock_rand = 0; -/* - * access to locking_threadid is synchronized by rand_tmp_lock; - * valid iff crypto_lock_rand is set - */ -static CRYPTO_THREAD_ID locking_threadid; - -static int rand_hw_seed(EVP_MD_CTX *ctx); - -static void rand_thread_cleanup(void *arg) -{ - OSSL_RAND_STATE *sp = arg; - - OPENSSL_clear_free(sp, sizeof(*sp)); -} - -DEFINE_RUN_ONCE_STATIC(do_ossl_rand_init) -{ - int ret = 1; - - OPENSSL_init_crypto(0, NULL); - rand_lock = CRYPTO_THREAD_lock_new(); - ret &= rand_lock != NULL; - rand_tmp_lock = CRYPTO_THREAD_lock_new(); - ret &= rand_tmp_lock != NULL; - ret &= CRYPTO_THREAD_init_local(&key, rand_thread_cleanup) == 1; - return ret; -} - -RAND_METHOD *RAND_OpenSSL(void) -{ - return &openssl_rand_meth; -} - -static void rand_cleanup(void) -{ - OPENSSL_cleanse(&global_state, sizeof(global_state)); - randomness = 0; - initialized = 0; - CRYPTO_THREAD_lock_free(rand_lock); - CRYPTO_THREAD_lock_free(rand_tmp_lock); -} - -static int rand_add(const void *buf, int num, double add) -{ - int i, j, k, st_idx; - long md_c[2]; - unsigned char local_md[SHA_DIGEST_LENGTH]; - EVP_MD_CTX *m; - int do_not_lock; - int rv = 0; - OSSL_RAND_STATE *sp = &global_state; - - if (!num) - return 1; - - /* - * (Based on the rand(3) manpage) - * - * The input is chopped up into units of 20 bytes (or less for - * the last block). Each of these blocks is run through the hash - * function as follows: The data passed to the hash function - * is the current 'md', the same number of bytes from the 'state' - * (the location determined by in incremented looping index) as - * the current 'block', the new key data 'block', and 'count' - * (which is incremented after each use). - * The result of this is kept in 'md' and also xored into the - * 'state' at the same locations that were used as input into the - * hash function. - */ - - m = EVP_MD_CTX_new(); - if (m == NULL) - goto err; - - if (!RUN_ONCE(&ossl_rand_init, do_ossl_rand_init)) - goto err; - - /* check if we already have the lock */ - if (crypto_lock_rand) { - CRYPTO_THREAD_ID cur = CRYPTO_THREAD_get_current_id(); - CRYPTO_THREAD_read_lock(rand_tmp_lock); - do_not_lock = CRYPTO_THREAD_compare_id(locking_threadid, cur); - CRYPTO_THREAD_unlock(rand_tmp_lock); - } else - do_not_lock = 0; - - if (!do_not_lock) - CRYPTO_THREAD_write_lock(rand_lock); - st_idx = sp->index; - - /* - * use our own copies of the counters so that even if a concurrent thread - * seeds with exactly the same data and uses the same subarray there's - * _some_ difference - */ - md_c[0] = sp->md_count[0]; - md_c[1] = sp->md_count[1]; - - memcpy(local_md, sp->md, sizeof(sp->md)); - - /* sp->index <= sp->num <= STATE_SIZE */ - sp->index += num; - if (sp->index >= STATE_SIZE) { - sp->index %= STATE_SIZE; - sp->num = STATE_SIZE; - } else if (sp->num < STATE_SIZE) { - if (sp->index > sp->num) - sp->num = sp->index; - } - /* sp->index <= sp->num <= STATE_SIZE */ - - /* - * state[st_idx], ..., state[(st_idx + num - 1) % STATE_SIZE] are what we - * will use now, but other threads may use them as well - */ - - sp->md_count[1] += (num / SHA_DIGEST_LENGTH) + (num % SHA_DIGEST_LENGTH > 0); - - if (!do_not_lock) - CRYPTO_THREAD_unlock(rand_lock); - - for (i = 0; i < num; i += SHA_DIGEST_LENGTH) { - j = (num - i); - j = (j > SHA_DIGEST_LENGTH) ? SHA_DIGEST_LENGTH : j; - - if (!EVP_DigestInit_ex(m, EVP_sha1(), NULL)) - goto err; - if (!EVP_DigestUpdate(m, local_md, SHA_DIGEST_LENGTH)) - goto err; - k = (st_idx + j) - STATE_SIZE; - if (k > 0) { - if (!EVP_DigestUpdate(m, &sp->state[st_idx], j - k)) - goto err; - if (!EVP_DigestUpdate(m, &sp->state[0], k)) - goto err; - } else if (!EVP_DigestUpdate(m, &sp->state[st_idx], j)) - goto err; - - /* DO NOT REMOVE THE FOLLOWING CALL TO EVP_DigestUpdate()! */ - if (!EVP_DigestUpdate(m, buf, j)) - goto err; - /* - * We know that line may cause programs such as purify and valgrind - * to complain about use of uninitialized data. The problem is not, - * it's with the caller. Removing that line will make sure you get - * really bad randomness and thereby other problems such as very - * insecure keys. - */ - - if (!EVP_DigestUpdate(m, (unsigned char *)md_c, sizeof(md_c))) - goto err; - if (!EVP_DigestFinal_ex(m, local_md, NULL)) - goto err; - md_c[1]++; - - buf = (const char *)buf + j; - - for (k = 0; k < j; k++) { - /* - * Parallel threads may interfere with this, but always each byte - * of the new state is the XOR of some previous value of its and - * local_md (intermediate values may be lost). Alway using locking - * could hurt performance more than necessary given that - * conflicts occur only when the total seeding is longer than the - * random state. - */ - sp->state[st_idx++] ^= local_md[k]; - if (st_idx >= STATE_SIZE) - st_idx = 0; - } - } - - if (!do_not_lock) - CRYPTO_THREAD_write_lock(rand_lock); - /* - * Don't just copy back local_md into md -- this could mean that other - * thread's seeding remains without effect (except for the incremented - * counter). By XORing it we keep at least as much randomness as fits into - * md. - */ - for (k = 0; k < (int)sizeof(sp->md); k++) { - sp->md[k] ^= local_md[k]; - } - if (randomness < RANDOMNESS_NEEDED) /* stop counting when we have enough */ - randomness += add; - if (!do_not_lock) - CRYPTO_THREAD_unlock(rand_lock); - - rv = 1; - err: - EVP_MD_CTX_free(m); - return rv; -} - -static int rand_seed(const void *buf, int num) -{ - return rand_add(buf, num, (double)num); -} - -static int rand_bytes(unsigned char *buf, int num) -{ - static volatile int stirred_pool = 0; - int i, j, k; - size_t num_ceil, st_idx, st_num; - int ok; - long md_c[2]; - unsigned char local_md[SHA_DIGEST_LENGTH]; - EVP_MD_CTX *m; - OSSL_RAND_STATE *sp = &global_state; -#ifndef GETPID_IS_MEANINGLESS - pid_t curr_pid = getpid(); -#endif - time_t curr_time = time(NULL); - int do_stir_pool = 0; -/* time value for various platforms */ -#ifdef OPENSSL_SYS_WIN32 - FILETIME tv; -# ifdef _WIN32_WCE - SYSTEMTIME t; - GetSystemTime(&t); - SystemTimeToFileTime(&t, &tv); -# else - GetSystemTimeAsFileTime(&tv); -# endif -#elif defined(OPENSSL_SYS_VXWORKS) - struct timespec tv; - clock_gettime(CLOCK_REALTIME, &ts); -#elif defined(OPENSSL_SYS_DSPBIOS) - unsigned long long tv, OPENSSL_rdtsc(); - tv = OPENSSL_rdtsc(); -#else - struct timeval tv; - gettimeofday(&tv, NULL); -#endif - - if (num <= 0) - return 1; - - m = EVP_MD_CTX_new(); - if (m == NULL) - goto err_mem; - - /* round upwards to multiple of SHA_DIGEST_LENGTH/2 */ - num_ceil = - (1 + (num - 1) / (SHA_DIGEST_LENGTH / 2)) * (SHA_DIGEST_LENGTH / 2); - - /* - * (Based on the rand(3) manpage:) - * - * For each group of 10 bytes (or less), we do the following: - * - * Input into the hash function the local 'md' (which is initialized from - * the global 'md' before any bytes are generated), the bytes that are to - * be overwritten by the random bytes, and bytes from the 'state' - * (incrementing looping index). From this digest output (which is kept - * in 'md'), the top (up to) 10 bytes are returned to the caller and the - * bottom 10 bytes are xored into the 'state'. - * - * Finally, after we have finished 'num' random bytes for the - * caller, 'count' (which is incremented) and the local and global 'md' - * are fed into the hash function and the results are kept in the - * global 'md'. - */ - - if (!RUN_ONCE(&ossl_rand_init, do_ossl_rand_init)) - goto err_mem; - - CRYPTO_THREAD_write_lock(rand_lock); - /* - * We could end up in an async engine while holding this lock so ensure - * we don't pause and cause a deadlock - */ - ASYNC_block_pause(); - - /* prevent rand_bytes() from trying to obtain the lock again */ - CRYPTO_THREAD_write_lock(rand_tmp_lock); - locking_threadid = CRYPTO_THREAD_get_current_id(); - CRYPTO_THREAD_unlock(rand_tmp_lock); - crypto_lock_rand = 1; - - if (!initialized) { - RAND_poll(); - initialized = 1; - } - - if (!stirred_pool) - do_stir_pool = 1; - - ok = (randomness >= RANDOMNESS_NEEDED); - if (!ok) { - /* - * If the PRNG state is not yet unpredictable, then seeing the PRNG - * output may help attackers to determine the new state; thus we have - * to decrease the randomness estimate. Once we've had enough initial - * seeding we don't bother to adjust the randomness count, though, - * because we're not ambitious to provide *information-theoretic* - * randomness. NOTE: This approach fails if the program forks before - * we have enough randomness. Randomness should be collected in a - * separate input pool and be transferred to the output pool only - * when the randomness limit has been reached. - */ - randomness -= num; - if (randomness < 0) - randomness = 0; - } - - if (do_stir_pool) { - /* - * In the output function only half of 'md' remains secret, so we - * better make sure that the required randomness gets 'evenly - * distributed' through 'state', our randomness pool. The input - * function (rand_add) chains all of 'md', which makes it more - * suitable for this purpose. - */ - - int n = STATE_SIZE; /* so that the complete pool gets accessed */ - while (n > 0) { -#if SHA_DIGEST_LENGTH > 20 -# error "Please adjust DUMMY_SEED." -#endif -#define DUMMY_SEED "...................." /* at least SHA_DIGEST_LENGTH */ - /* - * Note that the seed does not matter, it's just that - * rand_add expects to have something to hash. - */ - rand_add(DUMMY_SEED, SHA_DIGEST_LENGTH, 0.0); - n -= SHA_DIGEST_LENGTH; - } - if (ok) - stirred_pool = 1; - } - - st_idx = sp->index; - st_num = sp->num; - md_c[0] = sp->md_count[0]; - md_c[1] = sp->md_count[1]; - memcpy(local_md, sp->md, sizeof sp->md); - - sp->index += num_ceil; - if (sp->index > sp->num) - sp->index %= sp->num; - - /* - * state[st_idx], ..., state[(st_idx + num_ceil - 1) % st_num] are now - * ours (but other threads may use them too) - */ - - sp->md_count[0] += 1; - - /* before unlocking, we must clear 'crypto_lock_rand' */ - crypto_lock_rand = 0; - ASYNC_unblock_pause(); - CRYPTO_THREAD_unlock(rand_lock); - - while (num > 0) { - /* num_ceil -= SHA_DIGEST_LENGTH / 2 */ - j = (num >= SHA_DIGEST_LENGTH / 2) ? SHA_DIGEST_LENGTH / 2 : num; - num -= j; - if (!EVP_DigestInit_ex(m, EVP_sha1(), NULL)) - goto err; -#ifndef GETPID_IS_MEANINGLESS - if (curr_pid) { /* just in the first iteration to save time */ - if (!EVP_DigestUpdate(m, (unsigned char *)&curr_pid, sizeof curr_pid)) - goto err; - curr_pid = 0; - } -#endif - if (curr_time) { /* just in the first iteration to save time */ - if (!EVP_DigestUpdate(m, (unsigned char *)&curr_time, sizeof curr_time)) - goto err; - if (!EVP_DigestUpdate(m, (unsigned char *)&tv, sizeof tv)) - goto err; - curr_time = 0; - if (!rand_hw_seed(m)) - goto err; - } - if (!EVP_DigestUpdate(m, local_md, SHA_DIGEST_LENGTH)) - goto err; - if (!EVP_DigestUpdate(m, (unsigned char *)md_c, sizeof(md_c))) - goto err; - - k = (st_idx + SHA_DIGEST_LENGTH / 2) - st_num; - if (k > 0) { - if (!EVP_DigestUpdate(m, &sp->state[st_idx], SHA_DIGEST_LENGTH / 2 - k)) - goto err; - if (!EVP_DigestUpdate(m, &sp->state[0], k)) - goto err; - } else if (!EVP_DigestUpdate(m, &sp->state[st_idx], SHA_DIGEST_LENGTH / 2)) - goto err; - if (!EVP_DigestFinal_ex(m, local_md, NULL)) - goto err; - - for (i = 0; i < SHA_DIGEST_LENGTH / 2; i++) { - /* may compete with other threads */ - sp->state[st_idx++] ^= local_md[i]; - if (st_idx >= st_num) - st_idx = 0; - if (i < j) - *(buf++) = local_md[i + SHA_DIGEST_LENGTH / 2]; - } - } - - if (!EVP_DigestInit_ex(m, EVP_sha1(), NULL) - || !EVP_DigestUpdate(m, (unsigned char *)md_c, sizeof(md_c)) - || !EVP_DigestUpdate(m, local_md, SHA_DIGEST_LENGTH)) - goto err; - CRYPTO_THREAD_write_lock(rand_lock); - /* - * Prevent deadlocks if we end up in an async engine - */ - ASYNC_block_pause(); - if (!EVP_DigestUpdate(m, sp->md, sizeof(sp->md)) - || !EVP_DigestFinal_ex(m, sp->md, NULL)) { - ASYNC_unblock_pause(); - CRYPTO_THREAD_unlock(rand_lock); - goto err; - } - ASYNC_unblock_pause(); - CRYPTO_THREAD_unlock(rand_lock); - - EVP_MD_CTX_free(m); - if (ok) - return (1); - RANDerr(RAND_F_RAND_BYTES, RAND_R_PRNG_NOT_SEEDED); - ERR_add_error_data(1, "You need to read the OpenSSL FAQ, " - "https://www.openssl.org/docs/faq.html"); - return (0); - err: - RANDerr(RAND_F_RAND_BYTES, ERR_R_EVP_LIB); - EVP_MD_CTX_free(m); - return 0; - err_mem: - RANDerr(RAND_F_RAND_BYTES, ERR_R_MALLOC_FAILURE); - EVP_MD_CTX_free(m); - return 0; - -} - -static int rand_status(void) -{ - CRYPTO_THREAD_ID cur; - int ret; - int do_not_lock; - - if (!RUN_ONCE(&ossl_rand_init, do_ossl_rand_init)) - return 0; - - cur = CRYPTO_THREAD_get_current_id(); - /* - * check if we already have the lock (could happen if a RAND_poll() - * implementation calls RAND_status()) - */ - if (crypto_lock_rand) { - CRYPTO_THREAD_read_lock(rand_tmp_lock); - do_not_lock = CRYPTO_THREAD_compare_id(locking_threadid, cur); - CRYPTO_THREAD_unlock(rand_tmp_lock); - } else - do_not_lock = 0; - - if (!do_not_lock) { - CRYPTO_THREAD_write_lock(rand_lock); - /* - * Prevent deadlocks in case we end up in an async engine - */ - ASYNC_block_pause(); - - /* - * prevent rand_bytes() from trying to obtain the lock again - */ - CRYPTO_THREAD_write_lock(rand_tmp_lock); - locking_threadid = cur; - CRYPTO_THREAD_unlock(rand_tmp_lock); - crypto_lock_rand = 1; - } - - if (!initialized) { - RAND_poll(); - initialized = 1; - } - - ret = randomness >= RANDOMNESS_NEEDED; - - if (!do_not_lock) { - /* before unlocking, we must clear 'crypto_lock_rand' */ - crypto_lock_rand = 0; - - ASYNC_unblock_pause(); - CRYPTO_THREAD_unlock(rand_lock); - } - - return ret; -} - -/* - * rand_hw_seed: get seed data from any available hardware RNG. only - * currently supports rdrand. - */ -#if (defined(__i386) || defined(__i386__) || defined(_M_IX86) || \ - defined(__x86_64) || defined(__x86_64__) || \ - defined(_M_AMD64) || defined (_M_X64)) && defined(OPENSSL_CPUID_OBJ) \ - && !defined(OPENSSL_NO_RDRAND) - -# define RDRAND_CALLS 4 - -size_t OPENSSL_ia32_rdrand(void); -extern unsigned int OPENSSL_ia32cap_P[]; - -static int rand_hw_seed(EVP_MD_CTX *ctx) -{ - int i; - if (!(OPENSSL_ia32cap_P[1] & (1 << (62 - 32)))) - return 1; - for (i = 0; i < RDRAND_CALLS; i++) { - size_t rnd; - rnd = OPENSSL_ia32_rdrand(); - if (rnd == 0) - return 1; - if (!EVP_DigestUpdate(ctx, (unsigned char *)&rnd, sizeof(size_t))) - return 0; - } - return 1; -} - -#else - -static int rand_hw_seed(EVP_MD_CTX *ctx) -{ - return 1; -} - -#endif - - -RAND_METHOD openssl_rand_meth = { - rand_seed, - rand_bytes, - rand_cleanup, - rand_add, - rand_bytes, - rand_status -}; diff --git a/crypto/rand/rand_egd.c b/crypto/rand/rand_egd.c index 657a3bc5aa..5eb3225b1f 100644 --- a/crypto/rand/rand_egd.c +++ b/crypto/rand/rand_egd.c @@ -28,12 +28,12 @@ int RAND_query_egd_bytes(const char *path, unsigned char *buf, int bytes) int RAND_egd(const char *path) { - return (-1); + return -1; } int RAND_egd_bytes(const char *path, int bytes) { - return (-1); + return -1; } # else @@ -72,12 +72,13 @@ int RAND_query_egd_bytes(const char *path, unsigned char *buf, int bytes) memset(&addr, 0, sizeof(addr)); addr.sun_family = AF_UNIX; if (strlen(path) >= sizeof(addr.sun_path)) - return (-1); + return -1; strcpy(addr.sun_path, path); i = offsetof(struct sockaddr_un, sun_path) + strlen(path); fd = socket(AF_UNIX, SOCK_STREAM, 0); if (fd == -1 || (fp = fdopen(fd, "r+")) == NULL) - return (-1); + return -1; + setbuf(fp, NULL); /* Try to connect */ for ( ; ; ) { @@ -128,7 +129,7 @@ int RAND_query_egd_bytes(const char *path, unsigned char *buf, int bytes) goto err; ret = numbytes; if (mybuffer) - RAND_seed(tempbuf, i); + RAND_add(tempbuf, i, i); err: if (fp != NULL) @@ -150,7 +151,7 @@ int RAND_egd_bytes(const char *path, int bytes) int RAND_egd(const char *path) { - return (RAND_egd_bytes(path, 255)); + return RAND_egd_bytes(path, 255); } # endif diff --git a/crypto/rand/rand_lcl.h b/crypto/rand/rand_lcl.h index b9df5d18e2..e5944f975f 100644 --- a/crypto/rand/rand_lcl.h +++ b/crypto/rand/rand_lcl.h @@ -17,25 +17,55 @@ # include # include "internal/rand.h" -/* Amount of randomness (in bytes) we want for initial seeding. */ -# define RANDOMNESS_NEEDED (128 / 8) +/* + * Amount of randomness (in bytes) we want for initial seeding. + * This is based on the fact that we use AES-128 as the CRBG, and + * that we use the derivation function. If either of those changes, + * (see rand_init() in rand_lib.c), change this. + */ +# define RANDOMNESS_NEEDED 16 + +/* Maximum amount of randomness to hold in RAND_BYTES_BUFFER. */ +# define MAX_RANDOMNESS_HELD (4 * RANDOMNESS_NEEDED) /* Maximum count allowed in reseeding */ -#define MAX_RESEED (1 << 24) +# define MAX_RESEED (1 << 24) -/* DRBG status values */ -# define DRBG_STATUS_UNINITIALISED 0 -# define DRBG_STATUS_READY 1 -# define DRBG_STATUS_RESEED 2 -# define DRBG_STATUS_ERROR 3 +/* How often we call RAND_poll() in drbg_entropy_from_system */ +# define RAND_POLL_RETRIES 8 -/* A default maximum length: larger than any reasonable value used in pratice */ +/* Max size of entropy, addin, etc. Larger than any reasonable value */ # define DRBG_MAX_LENGTH 0x7ffffff0 + +/* DRBG status values */ +typedef enum drbg_status_e { + DRBG_UNINITIALISED, + DRBG_READY, + DRBG_RESEED, + DRBG_ERROR +} DRBG_STATUS; + + /* - * The context for DRBG AES-CTR + * A buffer of random bytes to be fed as "entropy" into the DRBG. RAND_add() + * adds data to the buffer, and the drbg_entropy_from_system() pulls data from + * the buffer. We have a separate data structure because of the way the + * API is defined; otherwise we'd run into deadlocks (RAND_bytes -> + * RAND_DRBG_generate* -> drbg_entropy_from_system -> RAND_poll -> RAND_add -> + * drbg_add*; the functions with an asterisk lock). */ -typedef struct drbg_ctr_ctx_st { +typedef struct rand_bytes_buffer_st { + CRYPTO_RWLOCK *lock; + size_t size; + size_t curr; + unsigned char *buff; +} RAND_BYTES_BUFFER; + +/* + * The state of a DRBG AES-CTR. + */ +typedef struct rand_drbg_ctr_st { AES_KEY ks; size_t keylen; unsigned char K[32]; @@ -47,21 +77,28 @@ typedef struct drbg_ctr_ctx_st { unsigned char bltmp[16]; size_t bltmp_pos; unsigned char KX[48]; -} DRBG_CTR_CTX; +} RAND_DRBG_CTR; /* - * The context for all DRBG's + * The state of all types of DRBGs, even though we only have CTR mode + * right now