2 * Copyright 2011-2018 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
11 #include <openssl/crypto.h>
12 #include <openssl/err.h>
13 #include <openssl/rand.h>
15 #include "internal/thread_once.h"
16 #include "crypto/rand.h"
17 #include "crypto/cryptlib.h"
20 * Support framework for NIST SP 800-90A DRBG
22 * See manual page RAND_DRBG(7) for a general overview.
24 * The OpenSSL model is to have new and free functions, and that new
25 * does all initialization. That is not the NIST model, which has
26 * instantiation and un-instantiate, and re-use within a new/free
27 * lifecycle. (No doubt this comes from the desire to support hardware
28 * DRBG, where allocation of resources on something like an HSM is
29 * a much bigger deal than just re-setting an allocated resource.)
33 typedef struct drbg_global_st
{
35 * The three shared DRBG instances
37 * There are three shared DRBG instances: <master>, <public>, and <private>.
43 * Not used directly by the application, only for reseeding the two other
44 * DRBGs. It reseeds itself by pulling either randomness from os entropy
45 * sources or by consuming randomness which was added by RAND_add().
47 * The <master> DRBG is a global instance which is accessed concurrently by
48 * all threads. The necessary locking is managed automatically by its child
49 * DRBG instances during reseeding.
51 RAND_DRBG
*master_drbg
;
55 * Used by default for generating random bytes using RAND_bytes().
57 * The <public> DRBG is thread-local, i.e., there is one instance per
60 CRYPTO_THREAD_LOCAL public_drbg
;
64 * Used by default for generating private keys using RAND_priv_bytes()
66 * The <private> DRBG is thread-local, i.e., there is one instance per
69 CRYPTO_THREAD_LOCAL private_drbg
;
72 typedef struct drbg_nonce_global_st
{
73 CRYPTO_RWLOCK
*rand_nonce_lock
;
77 /* NIST SP 800-90A DRBG recommends the use of a personalization string. */
78 static const char ossl_pers_string
[] = DRBG_DEFAULT_PERS_STRING
;
80 #define RAND_DRBG_TYPE_FLAGS ( \
81 RAND_DRBG_FLAG_MASTER | RAND_DRBG_FLAG_PUBLIC | RAND_DRBG_FLAG_PRIVATE )
83 #define RAND_DRBG_TYPE_MASTER 0
84 #define RAND_DRBG_TYPE_PUBLIC 1
85 #define RAND_DRBG_TYPE_PRIVATE 2
88 static int rand_drbg_type
[3] = {
89 RAND_DRBG_TYPE
, /* Master */
90 RAND_DRBG_TYPE
, /* Public */
91 RAND_DRBG_TYPE
/* Private */
93 static unsigned int rand_drbg_flags
[3] = {
94 RAND_DRBG_FLAGS
| RAND_DRBG_FLAG_MASTER
, /* Master */
95 RAND_DRBG_FLAGS
| RAND_DRBG_FLAG_PUBLIC
, /* Public */
96 RAND_DRBG_FLAGS
| RAND_DRBG_FLAG_PRIVATE
/* Private */
99 static unsigned int master_reseed_interval
= MASTER_RESEED_INTERVAL
;
100 static unsigned int slave_reseed_interval
= SLAVE_RESEED_INTERVAL
;
102 static time_t master_reseed_time_interval
= MASTER_RESEED_TIME_INTERVAL
;
103 static time_t slave_reseed_time_interval
= SLAVE_RESEED_TIME_INTERVAL
;
105 /* A logical OR of all used DRBG flag bits (currently there is only one) */
106 static const unsigned int rand_drbg_used_flags
=
107 RAND_DRBG_FLAG_CTR_NO_DF
| RAND_DRBG_FLAG_HMAC
| RAND_DRBG_TYPE_FLAGS
;
110 static RAND_DRBG
*drbg_setup(OPENSSL_CTX
*ctx
, RAND_DRBG
*parent
, int drbg_type
);
112 static RAND_DRBG
*rand_drbg_new(OPENSSL_CTX
*ctx
,
118 static int is_ctr(int type
)
121 case NID_aes_128_ctr
:
122 case NID_aes_192_ctr
:
123 case NID_aes_256_ctr
:
130 static int is_digest(int type
)
151 * Initialize the OPENSSL_CTX global DRBGs on first use.
152 * Returns the allocated global data on success or NULL on failure.
154 static void *drbg_ossl_ctx_new(OPENSSL_CTX
*libctx
)
156 DRBG_GLOBAL
*dgbl
= OPENSSL_zalloc(sizeof(*dgbl
));
163 * We need to ensure that base libcrypto thread handling has been
166 OPENSSL_init_crypto(0, NULL
);
169 if (!CRYPTO_THREAD_init_local(&dgbl
->private_drbg
, NULL
))
172 if (!CRYPTO_THREAD_init_local(&dgbl
->public_drbg
, NULL
))
175 dgbl
->master_drbg
= drbg_setup(libctx
, NULL
, RAND_DRBG_TYPE_MASTER
);
176 if (dgbl
->master_drbg
== NULL
)
182 CRYPTO_THREAD_cleanup_local(&dgbl
->public_drbg
);
184 CRYPTO_THREAD_cleanup_local(&dgbl
->private_drbg
);
190 static void drbg_ossl_ctx_free(void *vdgbl
)
192 DRBG_GLOBAL
*dgbl
= vdgbl
;
197 RAND_DRBG_free(dgbl
->master_drbg
);
198 CRYPTO_THREAD_cleanup_local(&dgbl
->private_drbg
);
199 CRYPTO_THREAD_cleanup_local(&dgbl
->public_drbg
);
204 static const OPENSSL_CTX_METHOD drbg_ossl_ctx_method
= {
210 * drbg_ossl_ctx_new() calls drgb_setup() which calls rand_drbg_get_nonce()
211 * which needs to get the rand_nonce_lock out of the OPENSSL_CTX...but since
212 * drbg_ossl_ctx_new() hasn't finished running yet we need the rand_nonce_lock
213 * to be in a different global data object. Otherwise we will go into an
214 * infinite recursion loop.
216 static void *drbg_nonce_ossl_ctx_new(OPENSSL_CTX
*libctx
)
218 DRBG_NONCE_GLOBAL
*dngbl
= OPENSSL_zalloc(sizeof(*dngbl
));
223 dngbl
->rand_nonce_lock
= CRYPTO_THREAD_lock_new();
224 if (dngbl
->rand_nonce_lock
== NULL
) {
232 static void drbg_nonce_ossl_ctx_free(void *vdngbl
)
234 DRBG_NONCE_GLOBAL
*dngbl
= vdngbl
;
239 CRYPTO_THREAD_lock_free(dngbl
->rand_nonce_lock
);
244 static const OPENSSL_CTX_METHOD drbg_nonce_ossl_ctx_method
= {
245 drbg_nonce_ossl_ctx_new
,
246 drbg_nonce_ossl_ctx_free
,
249 static DRBG_GLOBAL
*drbg_get_global(OPENSSL_CTX
*libctx
)
251 return openssl_ctx_get_data(libctx
, OPENSSL_CTX_DRBG_INDEX
,
252 &drbg_ossl_ctx_method
);
255 /* Implements the get_nonce() callback (see RAND_DRBG_set_callbacks()) */
256 size_t rand_drbg_get_nonce(RAND_DRBG
*drbg
,
257 unsigned char **pout
,
258 int entropy
, size_t min_len
, size_t max_len
)
262 DRBG_NONCE_GLOBAL
*dngbl
263 = openssl_ctx_get_data(drbg
->libctx
, OPENSSL_CTX_DRBG_NONCE_INDEX
,
264 &drbg_nonce_ossl_ctx_method
);
273 memset(&data
, 0, sizeof(data
));
274 pool
= rand_pool_new(0, 0, min_len
, max_len
);
278 if (rand_pool_add_nonce_data(pool
) == 0)
281 data
.instance
= drbg
;
282 CRYPTO_atomic_add(&dngbl
->rand_nonce_count
, 1, &data
.count
,
283 dngbl
->rand_nonce_lock
);
285 if (rand_pool_add(pool
, (unsigned char *)&data
, sizeof(data
), 0) == 0)
288 ret
= rand_pool_length(pool
);
289 *pout
= rand_pool_detach(pool
);
292 rand_pool_free(pool
);
298 * Implements the cleanup_nonce() callback (see RAND_DRBG_set_callbacks())
301 void rand_drbg_cleanup_nonce(RAND_DRBG
*drbg
,
302 unsigned char *out
, size_t outlen
)
304 OPENSSL_clear_free(out
, outlen
);
308 * Set/initialize |drbg| to be of type |type|, with optional |flags|.
310 * If |type| and |flags| are zero, use the defaults
312 * Returns 1 on success, 0 on failure.
314 int RAND_DRBG_set(RAND_DRBG
*drbg
, int type
, unsigned int flags
)
318 if (type
== 0 && flags
== 0) {
319 type
= rand_drbg_type
[RAND_DRBG_TYPE_MASTER
];
320 flags
= rand_drbg_flags
[RAND_DRBG_TYPE_MASTER
];
323 /* If set is called multiple times - clear the old one */
324 if (drbg
->type
!= 0 && (type
!= drbg
->type
|| flags
!= drbg
->flags
)) {
325 drbg
->meth
->uninstantiate(drbg
);
326 rand_pool_free(drbg
->adin_pool
);
327 drbg
->adin_pool
= NULL
;
330 drbg
->state
= DRBG_UNINITIALISED
;
335 /* Uninitialized; that's okay. */
338 } else if (is_ctr(type
)) {
339 ret
= drbg_ctr_init(drbg
);
340 } else if (is_digest(type
)) {
341 if (flags
& RAND_DRBG_FLAG_HMAC
)
342 ret
= drbg_hmac_init(drbg
);
344 ret
= drbg_hash_init(drbg
);
349 RANDerr(RAND_F_RAND_DRBG_SET
, RAND_R_UNSUPPORTED_DRBG_TYPE
);
354 drbg
->state
= DRBG_ERROR
;
355 RANDerr(RAND_F_RAND_DRBG_SET
, RAND_R_ERROR_INITIALISING_DRBG
);
361 * Set/initialize default |type| and |flag| for new drbg instances.
363 * Returns 1 on success, 0 on failure.
365 int RAND_DRBG_set_defaults(int type
, unsigned int flags
)
368 if (!(is_digest(type
) || is_ctr(type
))) {
369 RANDerr(RAND_F_RAND_DRBG_SET_DEFAULTS
, RAND_R_UNSUPPORTED_DRBG_TYPE
);
373 if ((flags
& ~rand_drbg_used_flags
) != 0) {
374 RANDerr(RAND_F_RAND_DRBG_SET_DEFAULTS
, RAND_R_UNSUPPORTED_DRBG_FLAGS
);
378 all
= ((flags
& RAND_DRBG_TYPE_FLAGS
) == 0);
379 if (all
|| (flags
& RAND_DRBG_FLAG_MASTER
) != 0) {
380 rand_drbg_type
[RAND_DRBG_TYPE_MASTER
] = type
;
381 rand_drbg_flags
[RAND_DRBG_TYPE_MASTER
] = flags
| RAND_DRBG_FLAG_MASTER
;
383 if (all
|| (flags
& RAND_DRBG_FLAG_PUBLIC
) != 0) {
384 rand_drbg_type
[RAND_DRBG_TYPE_PUBLIC
] = type
;
385 rand_drbg_flags
[RAND_DRBG_TYPE_PUBLIC
] = flags
| RAND_DRBG_FLAG_PUBLIC
;
387 if (all
|| (flags
& RAND_DRBG_FLAG_PRIVATE
) != 0) {
388 rand_drbg_type
[RAND_DRBG_TYPE_PRIVATE
] = type
;
389 rand_drbg_flags
[RAND_DRBG_TYPE_PRIVATE
] = flags
| RAND_DRBG_FLAG_PRIVATE
;
396 * Allocate memory and initialize a new DRBG. The DRBG is allocated on
397 * the secure heap if |secure| is nonzero and the secure heap is enabled.
398 * The |parent|, if not NULL, will be used as random source for reseeding.
400 * Returns a pointer to the new DRBG instance on success, NULL on failure.
402 static RAND_DRBG
*rand_drbg_new(OPENSSL_CTX
*ctx
,
408 RAND_DRBG
*drbg
= secure
? OPENSSL_secure_zalloc(sizeof(*drbg
))
409 : OPENSSL_zalloc(sizeof(*drbg
));
412 RANDerr(RAND_F_RAND_DRBG_NEW
, ERR_R_MALLOC_FAILURE
);
417 drbg
->secure
= secure
&& CRYPTO_secure_allocated(drbg
);
418 drbg
->fork_id
= openssl_get_fork_id();
419 drbg
->parent
= parent
;
421 if (parent
== NULL
) {
423 drbg
->get_entropy
= rand_crngt_get_entropy
;
424 drbg
->cleanup_entropy
= rand_crngt_cleanup_entropy
;
426 drbg
->get_entropy
= rand_drbg_get_entropy
;
427 drbg
->cleanup_entropy
= rand_drbg_cleanup_entropy
;
429 #ifndef RAND_DRBG_GET_RANDOM_NONCE
430 drbg
->get_nonce
= rand_drbg_get_nonce
;
431 drbg
->cleanup_nonce
= rand_drbg_cleanup_nonce
;
434 drbg
->reseed_interval
= master_reseed_interval
;
435 drbg
->reseed_time_interval
= master_reseed_time_interval
;
437 drbg
->get_entropy
= rand_drbg_get_entropy
;
438 drbg
->cleanup_entropy
= rand_drbg_cleanup_entropy
;
440 * Do not provide nonce callbacks, the child DRBGs will
441 * obtain their nonce using random bits from the parent.
444 drbg
->reseed_interval
= slave_reseed_interval
;
445 drbg
->reseed_time_interval
= slave_reseed_time_interval
;
448 if (RAND_DRBG_set(drbg
, type
, flags
) == 0)
451 if (parent
!= NULL
) {
452 rand_drbg_lock(parent
);
453 if (drbg
->strength
> parent
->strength
) {
455 * We currently don't support the algorithm from NIST SP 800-90C
456 * 10.1.2 to use a weaker DRBG as source
458 rand_drbg_unlock(parent
);
459 RANDerr(RAND_F_RAND_DRBG_NEW
, RAND_R_PARENT_STRENGTH_TOO_WEAK
);
462 rand_drbg_unlock(parent
);
468 RAND_DRBG_free(drbg
);
473 RAND_DRBG
*RAND_DRBG_new_ex(OPENSSL_CTX
*ctx
, int type
, unsigned int flags
,
476 return rand_drbg_new(ctx
, 0, type
, flags
, parent
);
479 RAND_DRBG
*RAND_DRBG_new(int type
, unsigned int flags
, RAND_DRBG
*parent
)
481 return RAND_DRBG_new_ex(NULL
, type
, flags
, parent
);
484 RAND_DRBG
*RAND_DRBG_secure_new_ex(OPENSSL_CTX
*ctx
, int type
,
485 unsigned int flags
, RAND_DRBG
*parent
)
487 return rand_drbg_new(ctx
, 1, type
, flags
, parent
);
490 RAND_DRBG
*RAND_DRBG_secure_new(int type
, unsigned int flags
, RAND_DRBG
*parent
)
492 return RAND_DRBG_secure_new_ex(NULL
, type
, flags
, parent
);
495 * Uninstantiate |drbg| and free all memory.
497 void RAND_DRBG_free(RAND_DRBG
*drbg
)
502 if (drbg
->meth
!= NULL
)
503 drbg
->meth
->uninstantiate(drbg
);
504 rand_pool_free(drbg
->adin_pool
);
505 CRYPTO_THREAD_lock_free(drbg
->lock
);
506 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_DRBG
, drbg
, &drbg
->ex_data
);
509 OPENSSL_secure_clear_free(drbg
, sizeof(*drbg
));
511 OPENSSL_clear_free(drbg
, sizeof(*drbg
));
515 * Instantiate |drbg|, after it has been initialized. Use |pers| and
516 * |perslen| as prediction-resistance input.
518 * Requires that drbg->lock is already locked for write, if non-null.
520 * Returns 1 on success, 0 on failure.
522 int RAND_DRBG_instantiate(RAND_DRBG
*drbg
,
523 const unsigned char *pers
, size_t perslen
)
525 unsigned char *nonce
= NULL
, *entropy
= NULL
;
526 size_t noncelen
= 0, entropylen
= 0;
527 size_t min_entropy
= drbg
->strength
;
528 size_t min_entropylen
= drbg
->min_entropylen
;
529 size_t max_entropylen
= drbg
->max_entropylen
;
531 if (perslen
> drbg
->max_perslen
) {
532 RANDerr(RAND_F_RAND_DRBG_INSTANTIATE
,
533 RAND_R_PERSONALISATION_STRING_TOO_LONG
);
537 if (drbg
->meth
== NULL
) {
538 RANDerr(RAND_F_RAND_DRBG_INSTANTIATE
,
539 RAND_R_NO_DRBG_IMPLEMENTATION_SELECTED
);
543 if (drbg
->state
!= DRBG_UNINITIALISED
) {
544 if (drbg
->state
== DRBG_ERROR
)
545 RANDerr(RAND_F_RAND_DRBG_INSTANTIATE
, RAND_R_IN_ERROR_STATE
);
547 RANDerr(RAND_F_RAND_DRBG_INSTANTIATE
, RAND_R_ALREADY_INSTANTIATED
);
551 drbg
->state
= DRBG_ERROR
;
554 * NIST SP800-90Ar1 section 9.1 says you can combine getting the entropy
555 * and nonce in 1 call by increasing the entropy with 50% and increasing
556 * the minimum length to accommodate the length of the nonce.
557 * We do this in case a nonce is require and get_nonce is NULL.
559 if (drbg
->min_noncelen
> 0 && drbg
->get_nonce
== NULL
) {
560 min_entropy
+= drbg
->strength
/ 2;
561 min_entropylen
+= drbg
->min_noncelen
;
562 max_entropylen
+= drbg
->max_noncelen
;
565 drbg
->reseed_next_counter
= tsan_load(&drbg
->reseed_prop_counter
);
566 if (drbg
->reseed_next_counter
) {
567 drbg
->reseed_next_counter
++;
568 if(!drbg
->reseed_next_counter
)
569 drbg
->reseed_next_counter
= 1;
572 if (drbg
->get_entropy
!= NULL
)
573 entropylen
= drbg
->get_entropy(drbg
, &entropy
, min_entropy
,
574 min_entropylen
, max_entropylen
, 0);
575 if (entropylen
< min_entropylen
576 || entropylen
> max_entropylen
) {
577 RANDerr(RAND_F_RAND_DRBG_INSTANTIATE
, RAND_R_ERROR_RETRIEVING_ENTROPY
);
581 if (drbg
->min_noncelen
> 0 && drbg
->get_nonce
!= NULL
) {
582 noncelen
= drbg
->get_nonce(drbg
, &nonce
, drbg
->strength
/ 2,
583 drbg
->min_noncelen
, drbg
->max_noncelen
);
584 if (noncelen
< drbg
->min_noncelen
|| noncelen
> drbg
->max_noncelen
) {
585 RANDerr(RAND_F_RAND_DRBG_INSTANTIATE
, RAND_R_ERROR_RETRIEVING_NONCE
);
590 if (!drbg
->meth
->instantiate(drbg
, entropy
, entropylen
,
591 nonce
, noncelen
, pers
, perslen
)) {
592 RANDerr(RAND_F_RAND_DRBG_INSTANTIATE
, RAND_R_ERROR_INSTANTIATING_DRBG
);
596 drbg
->state
= DRBG_READY
;
597 drbg
->reseed_gen_counter
= 1;
598 drbg
->reseed_time
= time(NULL
);
599 tsan_store(&drbg
->reseed_prop_counter
, drbg
->reseed_next_counter
);
602 if (entropy
!= NULL
&& drbg
->cleanup_entropy
!= NULL
)
603 drbg
->cleanup_entropy(drbg
, entropy
, entropylen
);
604 if (nonce
!= NULL
&& drbg
->cleanup_nonce
!= NULL
)
605 drbg
->cleanup_nonce(drbg
, nonce
, noncelen
);
606 if (drbg
->state
== DRBG_READY
)
612 * Uninstantiate |drbg|. Must be instantiated before it can be used.
614 * Requires that drbg->lock is already locked for write, if non-null.
616 * Returns 1 on success, 0 on failure.
618 int RAND_DRBG_uninstantiate(RAND_DRBG
*drbg
)
620 int index
= -1, type
, flags
;
621 if (drbg
->meth
== NULL
) {
622 drbg
->state
= DRBG_ERROR
;
623 RANDerr(RAND_F_RAND_DRBG_UNINSTANTIATE
,
624 RAND_R_NO_DRBG_IMPLEMENTATION_SELECTED
);
628 /* Clear the entire drbg->ctr struct, then reset some important
629 * members of the drbg->ctr struct (e.g. keysize, df_ks) to their
632 drbg
->meth
->uninstantiate(drbg
);
634 /* The reset uses the default values for type and flags */
635 if (drbg
->flags
& RAND_DRBG_FLAG_MASTER
)
636 index
= RAND_DRBG_TYPE_MASTER
;
637 else if (drbg
->flags
& RAND_DRBG_FLAG_PRIVATE
)
638 index
= RAND_DRBG_TYPE_PRIVATE
;
639 else if (drbg
->flags
& RAND_DRBG_FLAG_PUBLIC
)
640 index
= RAND_DRBG_TYPE_PUBLIC
;
643 flags
= rand_drbg_flags
[index
];
644 type
= rand_drbg_type
[index
];
649 return RAND_DRBG_set(drbg
, type
, flags
);
653 * Reseed |drbg|, mixing in the specified data
655 * Requires that drbg->lock is already locked for write, if non-null.
657 * Returns 1 on success, 0 on failure.
659 int RAND_DRBG_reseed(RAND_DRBG
*drbg
,
660 const unsigned char *adin
, size_t adinlen
,
661 int prediction_resistance
)
663 unsigned char *entropy
= NULL
;
664 size_t entropylen
= 0;
666 if (drbg
->state
== DRBG_ERROR
) {
667 RANDerr(RAND_F_RAND_DRBG_RESEED
, RAND_R_IN_ERROR_STATE
);
670 if (drbg
->state
== DRBG_UNINITIALISED
) {
671 RANDerr(RAND_F_RAND_DRBG_RESEED
, RAND_R_NOT_INSTANTIATED
);
677 } else if (adinlen
> drbg
->max_adinlen
) {
678 RANDerr(RAND_F_RAND_DRBG_RESEED
, RAND_R_ADDITIONAL_INPUT_TOO_LONG
);
682 drbg
->state
= DRBG_ERROR
;
684 drbg
->reseed_next_counter
= tsan_load(&drbg
->reseed_prop_counter
);
685 if (drbg
->reseed_next_counter
) {
686 drbg
->reseed_next_counter
++;
687 if(!drbg
->reseed_next_counter
)
688 drbg
->reseed_next_counter
= 1;
691 if (drbg
->get_entropy
!= NULL
)
692 entropylen
= drbg
->get_entropy(drbg
, &entropy
, drbg
->strength
,
693 drbg
->min_entropylen
,
694 drbg
->max_entropylen
,
695 prediction_resistance
);
696 if (entropylen
< drbg
->min_entropylen
697 || entropylen
> drbg
->max_entropylen
) {
698 RANDerr(RAND_F_RAND_DRBG_RESEED
, RAND_R_ERROR_RETRIEVING_ENTROPY
);
702 if (!drbg
->meth
->reseed(drbg
, entropy
, entropylen
, adin
, adinlen
))
705 drbg
->state
= DRBG_READY
;
706 drbg
->reseed_gen_counter
= 1;
707 drbg
->reseed_time
= time(NULL
);
708 tsan_store(&drbg
->reseed_prop_counter
, drbg
->reseed_next_counter
);
711 if (entropy
!= NULL
&& drbg
->cleanup_entropy
!= NULL
)
712 drbg
->cleanup_entropy(drbg
, entropy
, entropylen
);
713 if (drbg
->state
== DRBG_READY
)
719 * Restart |drbg|, using the specified entropy or additional input
721 * Tries its best to get the drbg instantiated by all means,
722 * regardless of its current state.
724 * Optionally, a |buffer| of |len| random bytes can be passed,
725 * which is assumed to contain at least |entropy| bits of entropy.
727 * If |entropy| > 0, the buffer content is used as entropy input.
729 * If |entropy| == 0, the buffer content is used as additional input
731 * Returns 1 on success, 0 on failure.
733 * This function is used internally only.
735 int rand_drbg_restart(RAND_DRBG
*drbg
,
736 const unsigned char *buffer
, size_t len
, size_t entropy
)
739 const unsigned char *adin
= NULL
;
742 if (drbg
->seed_pool
!= NULL
) {
743 RANDerr(RAND_F_RAND_DRBG_RESTART
, ERR_R_INTERNAL_ERROR
);
744 drbg
->state
= DRBG_ERROR
;
745 rand_pool_free(drbg
->seed_pool
);
746 drbg
->seed_pool
= NULL
;
750 if (buffer
!= NULL
) {
752 if (drbg
->max_entropylen
< len
) {
753 RANDerr(RAND_F_RAND_DRBG_RESTART
,
754 RAND_R_ENTROPY_INPUT_TOO_LONG
);
755 drbg
->state
= DRBG_ERROR
;
759 if (entropy
> 8 * len
) {
760 RANDerr(RAND_F_RAND_DRBG_RESTART
, RAND_R_ENTROPY_OUT_OF_RANGE
);
761 drbg
->state
= DRBG_ERROR
;
765 /* will be picked up by the rand_drbg_get_entropy() callback */
766 drbg
->seed_pool
= rand_pool_attach(buffer
, len
, entropy
);
767 if (drbg
->seed_pool
== NULL
)
770 if (drbg
->max_adinlen
< len
) {
771 RANDerr(RAND_F_RAND_DRBG_RESTART
,
772 RAND_R_ADDITIONAL_INPUT_TOO_LONG
);
773 drbg
->state
= DRBG_ERROR
;
781 /* repair error state */
782 if (drbg
->state
== DRBG_ERROR
)
783 RAND_DRBG_uninstantiate(drbg
);
785 /* repair uninitialized state */
786 if (drbg
->state
== DRBG_UNINITIALISED
) {
787 /* reinstantiate drbg */
788 RAND_DRBG_instantiate(drbg
,
789 (const unsigned char *) ossl_pers_string
,
790 sizeof(ossl_pers_string
) - 1);
791 /* already reseeded. prevent second reseeding below */
792 reseeded
= (drbg
->state
== DRBG_READY
);
795 /* refresh current state if entropy or additional input has been provided */
796 if (drbg
->state
== DRBG_READY
) {
799 * mix in additional input without reseeding
801 * Similar to RAND_DRBG_reseed(), but the provided additional
802 * data |adin| is mixed into the current state without pulling
803 * entropy from the trusted entropy source using get_entropy().
804 * This is not a reseeding in the strict sense of NIST SP 800-90A.
806 drbg
->meth
->reseed(drbg
, adin
, adinlen
, NULL
, 0);
807 } else if (reseeded
== 0) {
808 /* do a full reseeding if it has not been done yet above */
809 RAND_DRBG_reseed(drbg
, NULL
, 0, 0);
813 rand_pool_free(drbg
->seed_pool
);
814 drbg
->seed_pool
= NULL
;
816 return drbg
->state
== DRBG_READY
;
820 * Generate |outlen| bytes into the buffer at |out|. Reseed if we need
821 * to or if |prediction_resistance| is set. Additional input can be
822 * sent in |adin| and |adinlen|.
824 * Requires that drbg->lock is already locked for write, if non-null.
826 * Returns 1 on success, 0 on failure.
829 int RAND_DRBG_generate(RAND_DRBG
*drbg
, unsigned char *out
, size_t outlen
,
830 int prediction_resistance
,
831 const unsigned char *adin
, size_t adinlen
)
834 int reseed_required
= 0;
836 if (drbg
->state
!= DRBG_READY
) {
837 /* try to recover from previous errors */
838 rand_drbg_restart(drbg
, NULL
, 0, 0);
840 if (drbg
->state
== DRBG_ERROR
) {
841 RANDerr(RAND_F_RAND_DRBG_GENERATE
, RAND_R_IN_ERROR_STATE
);
844 if (drbg
->state
== DRBG_UNINITIALISED
) {
845 RANDerr(RAND_F_RAND_DRBG_GENERATE
, RAND_R_NOT_INSTANTIATED
);
850 if (outlen
> drbg
->max_request
) {
851 RANDerr(RAND_F_RAND_DRBG_GENERATE
, RAND_R_REQUEST_TOO_LARGE_FOR_DRBG
);
854 if (adinlen
> drbg
->max_adinlen
) {
855 RANDerr(RAND_F_RAND_DRBG_GENERATE
, RAND_R_ADDITIONAL_INPUT_TOO_LONG
);
859 fork_id
= openssl_get_fork_id();
861 if (drbg
->fork_id
!= fork_id
) {
862 drbg
->fork_id
= fork_id
;
866 if (drbg
->reseed_interval
> 0) {
867 if (drbg
->reseed_gen_counter
> drbg
->reseed_interval
)
870 if (drbg
->reseed_time_interval
> 0) {
871 time_t now
= time(NULL
);
872 if (now
< drbg
->reseed_time
873 || now
- drbg
->reseed_time
>= drbg
->reseed_time_interval
)
876 if (drbg
->parent
!= NULL
) {
877 unsigned int reseed_counter
= tsan_load(&drbg
->reseed_prop_counter
);
878 if (reseed_counter
> 0
879 && tsan_load(&drbg
->parent
->reseed_prop_counter
)
884 if (reseed_required
|| prediction_resistance
) {
885 if (!RAND_DRBG_reseed(drbg
, adin
, adinlen
, prediction_resistance
)) {
886 RANDerr(RAND_F_RAND_DRBG_GENERATE
, RAND_R_RESEED_ERROR
);
893 if (!drbg
->meth
->generate(drbg
, out
, outlen
, adin
, adinlen
)) {
894 drbg
->state
= DRBG_ERROR
;
895 RANDerr(RAND_F_RAND_DRBG_GENERATE
, RAND_R_GENERATE_ERROR
);
899 drbg
->reseed_gen_counter
++;
905 * Generates |outlen| random bytes and stores them in |out|. It will
906 * using the given |drbg| to generate the bytes.
908 * Requires that drbg->lock is already locked for write, if non-null.
910 * Returns 1 on success 0 on failure.
912 int RAND_DRBG_bytes(RAND_DRBG
*drbg
, unsigned char *out
, size_t outlen
)
914 unsigned char *additional
= NULL
;
915 size_t additional_len
;
919 if (drbg
->adin_pool
== NULL
) {
922 drbg
->adin_pool
= rand_pool_new(0, 0, 0, drbg
->max_adinlen
);
923 if (drbg
->adin_pool
== NULL
)
927 additional_len
= rand_drbg_get_additional_data(drbg
->adin_pool
,
930 for ( ; outlen
> 0; outlen
-= chunk
, out
+= chunk
) {
932 if (chunk
> drbg
->max_request
)
933 chunk
= drbg
->max_request
;
934 ret
= RAND_DRBG_generate(drbg
, out
, chunk
, 0, additional
, additional_len
);
941 if (additional
!= NULL
)
942 rand_drbg_cleanup_additional_data(drbg
->adin_pool
, additional
);
948 * Set the RAND_DRBG callbacks for obtaining entropy and nonce.
950 * Setting the callbacks is allowed only if the drbg has not been
951 * initialized yet. Otherwise, the operation will fail.
953 * Returns 1 on success, 0 on failure.
955 int RAND_DRBG_set_callbacks(RAND_DRBG
*drbg
,
956 RAND_DRBG_get_entropy_fn get_entropy
,
957 RAND_DRBG_cleanup_entropy_fn cleanup_entropy
,
958 RAND_DRBG_get_nonce_fn get_nonce
,
959 RAND_DRBG_cleanup_nonce_fn cleanup_nonce
)
961 if (drbg
->state
!= DRBG_UNINITIALISED
962 || drbg
->parent
!= NULL
)
964 drbg
->get_entropy
= get_entropy
;
965 drbg
->cleanup_entropy
= cleanup_entropy
;
966 drbg
->get_nonce
= get_nonce
;
967 drbg
->cleanup_nonce
= cleanup_nonce
;
972 * Set the reseed interval.
974 * The drbg will reseed automatically whenever the number of generate
975 * requests exceeds the given reseed interval. If the reseed interval
976 * is 0, then this feature is disabled.
978 * Returns 1 on success, 0 on failure.
980 int RAND_DRBG_set_reseed_interval(RAND_DRBG
*drbg
, unsigned int interval
)
982 if (interval
> MAX_RESEED_INTERVAL
)
984 drbg
->reseed_interval
= interval
;
989 * Set the reseed time interval.
991 * The drbg will reseed automatically whenever the time elapsed since
992 * the last reseeding exceeds the given reseed time interval. For safety,
993 * a reseeding will also occur if the clock has been reset to a smaller
996 * Returns 1 on success, 0 on failure.
998 int RAND_DRBG_set_reseed_time_interval(RAND_DRBG
*drbg
, time_t interval
)
1000 if (interval
> MAX_RESEED_TIME_INTERVAL
)
1002 drbg
->reseed_time_interval
= interval
;
1007 * Set the default values for reseed (time) intervals of new DRBG instances
1009 * The default values can be set independently for master DRBG instances
1010 * (without a parent) and slave DRBG instances (with parent).
1012 * Returns 1 on success, 0 on failure.
1015 int RAND_DRBG_set_reseed_defaults(
1016 unsigned int _master_reseed_interval
,
1017 unsigned int _slave_reseed_interval
,
1018 time_t _master_reseed_time_interval
,
1019 time_t _slave_reseed_time_interval
1022 if (_master_reseed_interval
> MAX_RESEED_INTERVAL
1023 || _slave_reseed_interval
> MAX_RESEED_INTERVAL
)
1026 if (_master_reseed_time_interval
> MAX_RESEED_TIME_INTERVAL
1027 || _slave_reseed_time_interval
> MAX_RESEED_TIME_INTERVAL
)
1030 master_reseed_interval
= _master_reseed_interval
;
1031 slave_reseed_interval
= _slave_reseed_interval
;
1033 master_reseed_time_interval
= _master_reseed_time_interval
;
1034 slave_reseed_time_interval
= _slave_reseed_time_interval
;
1040 * Locks the given drbg. Locking a drbg which does not have locking
1041 * enabled is considered a successful no-op.
1043 * Returns 1 on success, 0 on failure.
1045 int rand_drbg_lock(RAND_DRBG
*drbg
)
1047 if (drbg
->lock
!= NULL
)
1048 return CRYPTO_THREAD_write_lock(drbg
->lock
);
1054 * Unlocks the given drbg. Unlocking a drbg which does not have locking
1055 * enabled is considered a successful no-op.
1057 * Returns 1 on success, 0 on failure.
1059 int rand_drbg_unlock(RAND_DRBG
*drbg
)
1061 if (drbg
->lock
!= NULL
)
1062 return CRYPTO_THREAD_unlock(drbg
->lock
);
1068 * Enables locking for the given drbg
1070 * Locking can only be enabled if the random generator
1071 * is in the uninitialized state.
1073 * Returns 1 on success, 0 on failure.
1075 int rand_drbg_enable_locking(RAND_DRBG
*drbg
)
1077 if (drbg
->state
!= DRBG_UNINITIALISED
) {
1078 RANDerr(RAND_F_RAND_DRBG_ENABLE_LOCKING
,
1079 RAND_R_DRBG_ALREADY_INITIALIZED
);
1083 if (drbg
->lock
== NULL
) {
1084 if (drbg
->parent
!= NULL
&& drbg
->parent
->lock
== NULL
) {
1085 RANDerr(RAND_F_RAND_DRBG_ENABLE_LOCKING
,
1086 RAND_R_PARENT_LOCKING_NOT_ENABLED
);
1090 drbg
->lock
= CRYPTO_THREAD_lock_new();
1091 if (drbg
->lock
== NULL
) {
1092 RANDerr(RAND_F_RAND_DRBG_ENABLE_LOCKING
,
1093 RAND_R_FAILED_TO_CREATE_LOCK
);
1102 * Get and set the EXDATA
1104 int RAND_DRBG_set_ex_data(RAND_DRBG
*drbg
, int idx
, void *arg
)
1106 return CRYPTO_set_ex_data(&drbg
->ex_data
, idx
, arg
);
1109 void *RAND_DRBG_get_ex_data(const RAND_DRBG
*drbg
, int idx
)
1111 return CRYPTO_get_ex_data(&drbg
->ex_data
, idx
);
1116 * The following functions provide a RAND_METHOD that works on the
1117 * global DRBG. They lock.
1121 * Allocates a new global DRBG on the secure heap (if enabled) and
1122 * initializes it with default settings.
1124 * Returns a pointer to the new DRBG instance on success, NULL on failure.
1126 static RAND_DRBG
*drbg_setup(OPENSSL_CTX
*ctx
, RAND_DRBG
*parent
, int drbg_type
)
1130 drbg
= RAND_DRBG_secure_new_ex(ctx
, rand_drbg_type
[drbg_type
],
1131 rand_drbg_flags
[drbg_type
], parent
);
1135 /* Only the master DRBG needs to have a lock */
1136 if (parent
== NULL
&& rand_drbg_enable_locking(drbg
) == 0)
1139 /* enable seed propagation */
1140 tsan_store(&drbg
->reseed_prop_counter
, 1);
1143 * Ignore instantiation error to support just-in-time instantiation.
1145 * The state of the drbg will be checked in RAND_DRBG_generate() and
1146 * an automatic recovery is attempted.
1148 (void)RAND_DRBG_instantiate(drbg
,
1149 (const unsigned char *) ossl_pers_string
,
1150 sizeof(ossl_pers_string
) - 1);
1154 RAND_DRBG_free(drbg
);
1158 static void drbg_delete_thread_state(void *arg
)
1160 OPENSSL_CTX
*ctx
= arg
;
1161 DRBG_GLOBAL
*dgbl
= drbg_get_global(ctx
);
1166 drbg
= CRYPTO_THREAD_get_local(&dgbl
->public_drbg
);
1167 CRYPTO_THREAD_set_local(&dgbl
->public_drbg
, NULL
);
1168 RAND_DRBG_free(drbg
);
1170 drbg
= CRYPTO_THREAD_get_local(&dgbl
->private_drbg
);
1171 CRYPTO_THREAD_set_local(&dgbl
->private_drbg
, NULL
);
1172 RAND_DRBG_free(drbg
);
1175 /* Implements the default OpenSSL RAND_bytes() method */
1176 static int drbg_bytes(unsigned char *out
, int count
)
1179 RAND_DRBG
*drbg
= RAND_DRBG_get0_public();
1184 ret
= RAND_DRBG_bytes(drbg
, out
, count
);
1190 * Calculates the minimum length of a full entropy buffer
1191 * which is necessary to seed (i.e. instantiate) the DRBG
1194 size_t rand_drbg_seedlen(RAND_DRBG
*drbg
)
1197 * If no os entropy source is available then RAND_seed(buffer, bufsize)
1198 * is expected to succeed if and only if the buffer length satisfies
1199 * the following requirements, which follow from the calculations
1200 * in RAND_DRBG_instantiate().
1202 size_t min_entropy
= drbg
->strength
;
1203 size_t min_entropylen
= drbg
->min_entropylen
;
1206 * Extra entropy for the random nonce in the absence of a
1207 * get_nonce callback, see comment in RAND_DRBG_instantiate().
1209 if (drbg
->min_noncelen
> 0 && drbg
->get_nonce
== NULL
) {
1210 min_entropy
+= drbg
->strength
/ 2;
1211 min_entropylen
+= drbg
->min_noncelen
;
1215 * Convert entropy requirement from bits to bytes
1216 * (dividing by 8 without rounding upwards, because
1217 * all entropy requirements are divisible by 8).
1221 /* Return a value that satisfies both requirements */
1222 return min_entropy
> min_entropylen
? min_entropy
: min_entropylen
;
1225 /* Implements the default OpenSSL RAND_add() method */
1226 static int drbg_add(const void *buf
, int num
, double randomness
)
1229 RAND_DRBG
*drbg
= RAND_DRBG_get0_master();
1236 if (num
< 0 || randomness
< 0.0)
1239 rand_drbg_lock(drbg
);
1240 seedlen
= rand_drbg_seedlen(drbg
);
1242 buflen
= (size_t)num
;
1246 * NIST SP-800-90A mandates that entropy *shall not* be provided
1247 * by the consuming application. By setting the randomness to zero,
1248 * we ensure that the buffer contents will be added to the internal
1249 * state of the DRBG only as additional data.
1251 * (NIST SP-800-90Ar1, Sections 9.1 and 9.2)
1255 if (buflen
< seedlen
|| randomness
< (double) seedlen
) {
1256 #if defined(OPENSSL_RAND_SEED_NONE)
1258 * If no os entropy source is available, a reseeding will fail
1259 * inevitably. So we use a trick to mix the buffer contents into
1260 * the DRBG state without forcing a reseeding: we generate a
1261 * dummy random byte, using the buffer content as additional data.
1262 * Note: This won't work with RAND_DRBG_FLAG_CTR_NO_DF.
1264 unsigned char dummy
[1];
1266 ret
= RAND_DRBG_generate(drbg
, dummy
, sizeof(dummy
), 0, buf
, buflen
);
1267 rand_drbg_unlock(drbg
);
1271 * If an os entropy source is available then we declare the buffer content
1272 * as additional data by setting randomness to zero and trigger a regular
1279 if (randomness
> (double)seedlen
) {
1281 * The purpose of this check is to bound |randomness| by a
1282 * relatively small value in order to prevent an integer
1283 * overflow when multiplying by 8 in the rand_drbg_restart()
1284 * call below. Note that randomness is measured in bytes,
1285 * not bits, so this value corresponds to eight times the
1286 * security strength.
1288 randomness
= (double)seedlen
;
1291 ret
= rand_drbg_restart(drbg
, buf
, buflen
, (size_t)(8 * randomness
));
1292 rand_drbg_unlock(drbg
);
1297 /* Implements the default OpenSSL RAND_seed() method */
1298 static int drbg_seed(const void *buf
, int num
)
1300 return drbg_add(buf
, num
, num
);
1303 /* Implements the default OpenSSL RAND_status() method */
1304 static int drbg_status(void)
1307 RAND_DRBG
*drbg
= RAND_DRBG_get0_master();
1312 rand_drbg_lock(drbg
);
1313 ret
= drbg
->state
== DRBG_READY
? 1 : 0;
1314 rand_drbg_unlock(drbg
);
1319 * Get the master DRBG.
1320 * Returns pointer to the DRBG on success, NULL on failure.
1323 RAND_DRBG
*OPENSSL_CTX_get0_master_drbg(OPENSSL_CTX
*ctx
)
1325 DRBG_GLOBAL
*dgbl
= drbg_get_global(ctx
);
1330 return dgbl
->master_drbg
;
1333 RAND_DRBG
*RAND_DRBG_get0_master(void)
1335 return OPENSSL_CTX_get0_master_drbg(NULL
);
1339 * Get the public DRBG.
1340 * Returns pointer to the DRBG on success, NULL on failure.
1342 RAND_DRBG
*OPENSSL_CTX_get0_public_drbg(OPENSSL_CTX
*ctx
)
1344 DRBG_GLOBAL
*dgbl
= drbg_get_global(ctx
);
1350 drbg
= CRYPTO_THREAD_get_local(&dgbl
->public_drbg
);
1352 ctx
= openssl_ctx_get_concrete(ctx
);
1353 if (!ossl_init_thread_start(NULL
, ctx
, drbg_delete_thread_state
))
1355 drbg
= drbg_setup(ctx
, dgbl
->master_drbg
, RAND_DRBG_TYPE_PUBLIC
);
1356 CRYPTO_THREAD_set_local(&dgbl
->public_drbg
, drbg
);
1361 RAND_DRBG
*RAND_DRBG_get0_public(void)
1363 return OPENSSL_CTX_get0_public_drbg(NULL
);
1367 * Get the private DRBG.
1368 * Returns pointer to the DRBG on success, NULL on failure.
1370 RAND_DRBG
*OPENSSL_CTX_get0_private_drbg(OPENSSL_CTX
*ctx
)
1372 DRBG_GLOBAL
*dgbl
= drbg_get_global(ctx
);
1378 drbg
= CRYPTO_THREAD_get_local(&dgbl
->private_drbg
);
1380 ctx
= openssl_ctx_get_concrete(ctx
);
1381 if (!ossl_init_thread_start(NULL
, ctx
, drbg_delete_thread_state
))
1383 drbg
= drbg_setup(ctx
, dgbl
->master_drbg
, RAND_DRBG_TYPE_PRIVATE
);
1384 CRYPTO_THREAD_set_local(&dgbl
->private_drbg
, drbg
);
1389 RAND_DRBG
*RAND_DRBG_get0_private(void)
1391 return OPENSSL_CTX_get0_private_drbg(NULL
);
1394 RAND_METHOD rand_meth
= {
1403 RAND_METHOD
*RAND_OpenSSL(void)