crypto/rand/drbg_lib.c

   1 /*
   2  * Copyright 2011-2018 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the OpenSSL license (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <string.h>
  11 #include <openssl/crypto.h>
  12 #include <openssl/err.h>
  13 #include <openssl/rand.h>
  14 #include "rand_lcl.h"
  15 #include "internal/thread_once.h"
  16 #include "internal/rand_int.h"
  17
  18 /*
  19  * Support framework for NIST SP 800-90A DRBG, AES-CTR mode.
  20  * The RAND_DRBG is OpenSSL's pointer to an instance of the DRBG.
  21  *
  22  * The OpenSSL model is to have new and free functions, and that new
  23  * does all initialization.  That is not the NIST model, which has
  24  * instantiation and un-instantiate, and re-use within a new/free
  25  * lifecycle.  (No doubt this comes from the desire to support hardware
  26  * DRBG, where allocation of resources on something like an HSM is
  27  * a much bigger deal than just re-setting an allocated resource.)
  28  */
  29
  30 /*
  31  * THE THREE SHARED DRBGs
  32  *
  33  * There are three shared DRBGs (master, public and private), which are
  34  * accessed concurrently by all threads.
  35  *
  36  * THE MASTER DRBG
  37  *
  38  * Not used directly by the application, only for reseeding the two other
  39  * DRBGs. It reseeds itself by pulling either randomness from os entropy
  40  * sources or by consuming randomnes which was added by RAND_add()
  41  */
  42 static RAND_DRBG *drbg_master;
  43 /*
  44  * THE PUBLIC DRBG
  45  *
  46  * Used by default for generating random bytes using RAND_bytes().
  47  */
  48 static RAND_DRBG *drbg_public;
  49 /*
  50  * THE PRIVATE DRBG
  51  *
  52  * Used by default for generating private keys using RAND_priv_bytes()
  53  */
  54 static RAND_DRBG *drbg_private;
  55 /*+
  56  * DRBG HIERARCHY
  57  *
  58  * In addition there are DRBGs, which are not shared, but used only by a
  59  * single thread at every time, for example the DRBGs which are owned by
  60  * an SSL context. All DRBGs are organized in a hierarchical fashion
  61  * with the <master> DRBG as root.
  62  *
  63  * This gives the following overall picture:
  64  *
  65  *                  <os entropy sources>
  66  *                         |
  67  *    RAND_add() ==>    <master>          \
  68  *                       /   \            | shared DRBGs (with locking)
  69  *                 <public>  <private>    /
  70  *                     |
  71  *                   <ssl>  owned by an SSL context
  72  *
  73  * AUTOMATIC RESEEDING
  74  *
  75  * Before satisfying a generate request, a DRBG reseeds itself automatically,
  76  * if one of the following two conditions holds:
  77  *
  78  * - the number of generate requests since the last reseeding exceeds a
  79  *   certain threshold, the so called |reseed_interval|. This behaviour
  80  *   can be disabled by setting the |reseed_interval| to 0.
  81  *
  82  * - the time elapsed since the last reseeding exceeds a certain time
  83  *   interval, the so called |reseed_time_interval|. This behaviour
  84  *   can be disabled by setting the |reseed_time_interval| to 0.
  85  *
  86  * MANUAL RESEEDING
  87  *
  88  * For the three shared DRBGs (and only for these) there is another way to
  89  * reseed them manually by calling RAND_seed() (or RAND_add() with a positive
  90  * |randomness| argument). This will immediately reseed the <master> DRBG.
  91  * The <public> and <private> DRBG will detect this on their next generate
  92  * call and reseed, pulling randomness from <master>.
  93  *
  94  * LOCKING
  95  *
  96  * The three shared DRBGs are intended to be used concurrently, so they
  97  * support locking by default. It is the callers responsibility to wrap
  98  * calls to functions like RAND_DRBG_generate() which modify the DRBGs
  99  * internal state with calls to RAND_DRBG_lock() and RAND_DRBG_unlock().
 100  * The functions RAND_bytes() and RAND_priv_bytes() take the locks
 101  * automatically, so using the RAND api is thread safe as before.
 102  *
 103  * All other DRBG instances don't have locking enabled by default, because
 104  * they are intendended to be used by a single thread. If it is desired,
 105  * locking can be enabled using RAND_DRBG_enable_locking(). However, instead
 106  * of accessing a single DRBG instance concurrently from different threads,
 107  * it is recommended to instantiate a separate DRBG instance per thread.
 108  */
 109
 110
 111 /* NIST SP 800-90A DRBG recommends the use of a personalization string. */
 112 static const char ossl_pers_string[] = "OpenSSL NIST SP 800-90A DRBG";
 113
 114 static CRYPTO_ONCE rand_drbg_init = CRYPTO_ONCE_STATIC_INIT;
 115
 116 static RAND_DRBG *drbg_setup(RAND_DRBG *parent);
 117 static void drbg_cleanup(RAND_DRBG *drbg);
 118
 119 /*
 120  * Set/initialize |drbg| to be of type |nid|, with optional |flags|.
 121  *
 122  * Returns 1 on success, 0 on failure.
 123  */
 124 int RAND_DRBG_set(RAND_DRBG *drbg, int nid, unsigned int flags)
 125 {
 126     int ret = 1;
 127
 128     drbg->state = DRBG_UNINITIALISED;
 129     drbg->flags = flags;
 130     drbg->nid = nid;
 131
 132     switch (nid) {
 133     default:
 134         RANDerr(RAND_F_RAND_DRBG_SET, RAND_R_UNSUPPORTED_DRBG_TYPE);
 135         return 0;
 136     case 0:
 137         /* Uninitialized; that's okay. */
 138         return 1;
 139     case NID_aes_128_ctr:
 140     case NID_aes_192_ctr:
 141     case NID_aes_256_ctr:
 142         ret = drbg_ctr_init(drbg);
 143         break;
 144     }
 145
 146     if (ret == 0)
 147         RANDerr(RAND_F_RAND_DRBG_SET, RAND_R_ERROR_INITIALISING_DRBG);
 148     return ret;
 149 }
 150
 151 /*
 152  * Allocate memory and initialize a new DRBG.  The |parent|, if not
 153  * NULL, will be used to auto-seed this RAND_DRBG as needed.
 154  *
 155  * Returns a pointer to the new DRBG instance on success, NULL on failure.
 156  */
 157 RAND_DRBG *RAND_DRBG_new(int type, unsigned int flags, RAND_DRBG *parent)
 158 {
 159     RAND_DRBG *drbg = OPENSSL_zalloc(sizeof(*drbg));
 160
 161     if (drbg == NULL) {
 162         RANDerr(RAND_F_RAND_DRBG_NEW, ERR_R_MALLOC_FAILURE);
 163         goto err;
 164     }
 165     drbg->fork_count = rand_fork_count;
 166     drbg->parent = parent;
 167     if (RAND_DRBG_set(drbg, type, flags) == 0)
 168         goto err;
 169
 170     if (!RAND_DRBG_set_callbacks(drbg, rand_drbg_get_entropy,
 171                                  rand_drbg_cleanup_entropy,
 172                                  NULL, NULL))
 173         goto err;
 174
 175     return drbg;
 176
 177 err:
 178     OPENSSL_free(drbg);
 179     return NULL;
 180 }
 181
 182 /*
 183  * Uninstantiate |drbg| and free all memory.
 184  */
 185 void RAND_DRBG_free(RAND_DRBG *drbg)
 186 {
 187     if (drbg == NULL)
 188         return;
 189
 190     if (drbg->meth != NULL)
 191         drbg->meth->uninstantiate(drbg);
 192     CRYPTO_free_ex_data(CRYPTO_EX_INDEX_DRBG, drbg, &drbg->ex_data);
 193     OPENSSL_clear_free(drbg, sizeof(*drbg));
 194 }
 195
 196 /*
 197  * Instantiate |drbg|, after it has been initialized.  Use |pers| and
 198  * |perslen| as prediction-resistance input.
 199  *
 200  * Requires that drbg->lock is already locked for write, if non-null.
 201  *
 202  * Returns 1 on success, 0 on failure.
 203  */
 204 int RAND_DRBG_instantiate(RAND_DRBG *drbg,
 205                           const unsigned char *pers, size_t perslen)
 206 {
 207     unsigned char *nonce = NULL, *entropy = NULL;
 208     size_t noncelen = 0, entropylen = 0;
 209
 210     if (perslen > drbg->max_perslen) {
 211         RANDerr(RAND_F_RAND_DRBG_INSTANTIATE,
 212                 RAND_R_PERSONALISATION_STRING_TOO_LONG);
 213         goto end;
 214     }
 215
 216     if (drbg->meth == NULL)
 217     {
 218         RANDerr(RAND_F_RAND_DRBG_INSTANTIATE,
 219                 RAND_R_NO_DRBG_IMPLEMENTATION_SELECTED);
 220         goto end;
 221     }
 222
 223     if (drbg->state != DRBG_UNINITIALISED) {
 224         RANDerr(RAND_F_RAND_DRBG_INSTANTIATE,
 225                 drbg->state == DRBG_ERROR ? RAND_R_IN_ERROR_STATE
 226                                           : RAND_R_ALREADY_INSTANTIATED);
 227         goto end;
 228     }
 229
 230     drbg->state = DRBG_ERROR;
 231     if (drbg->get_entropy != NULL)
 232         entropylen = drbg->get_entropy(drbg, &entropy, drbg->strength,
 233                                    drbg->min_entropylen, drbg->max_entropylen);
 234     if (entropylen < drbg->min_entropylen
 235         || entropylen > drbg->max_entropylen) {
 236         RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, RAND_R_ERROR_RETRIEVING_ENTROPY);
 237         goto end;
 238     }
 239
 240     if (drbg->max_noncelen > 0 && drbg->get_nonce != NULL) {
 241         noncelen = drbg->get_nonce(drbg, &nonce, drbg->strength / 2,
 242                                    drbg->min_noncelen, drbg->max_noncelen);
 243         if (noncelen < drbg->min_noncelen || noncelen > drbg->max_noncelen) {
 244             RANDerr(RAND_F_RAND_DRBG_INSTANTIATE,
 245                     RAND_R_ERROR_RETRIEVING_NONCE);
 246             goto end;
 247         }
 248     }
 249
 250     if (!drbg->meth->instantiate(drbg, entropy, entropylen,
 251                          nonce, noncelen, pers, perslen)) {
 252         RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, RAND_R_ERROR_INSTANTIATING_DRBG);
 253         goto end;
 254     }
 255
 256     drbg->state = DRBG_READY;
 257     drbg->generate_counter = 0;
 258     drbg->reseed_time = time(NULL);
 259     if (drbg->reseed_counter > 0) {
 260         if (drbg->parent == NULL)
 261             drbg->reseed_counter++;
 262         else
 263             drbg->reseed_counter = drbg->parent->reseed_counter;
 264     }
 265
 266 end:
 267     if (entropy != NULL && drbg->cleanup_entropy != NULL)
 268         drbg->cleanup_entropy(drbg, entropy, entropylen);
 269     if (nonce != NULL && drbg->cleanup_nonce!= NULL )
 270         drbg->cleanup_nonce(drbg, nonce, noncelen);
 271     if (drbg->pool != NULL) {
 272         if (drbg->state == DRBG_READY) {
 273             RANDerr(RAND_F_RAND_DRBG_INSTANTIATE,
 274                     RAND_R_ERROR_ENTROPY_POOL_WAS_IGNORED);
 275             drbg->state = DRBG_ERROR;
 276         }
 277         RAND_POOL_free(drbg->pool);
 278         drbg->pool = NULL;
 279     }
 280     if (drbg->state == DRBG_READY)
 281         return 1;
 282     return 0;
 283 }
 284
 285 /*
 286  * Uninstantiate |drbg|. Must be instantiated before it can be used.
 287  *
 288  * Requires that drbg->lock is already locked for write, if non-null.
 289  *
 290  * Returns 1 on success, 0 on failure.
 291  */
 292 int RAND_DRBG_uninstantiate(RAND_DRBG *drbg)
 293 {
 294     if (drbg->meth == NULL)
 295     {
 296         RANDerr(RAND_F_RAND_DRBG_UNINSTANTIATE,
 297                 RAND_R_NO_DRBG_IMPLEMENTATION_SELECTED);
 298         return 0;
 299     }
 300
 301     /* Clear the entire drbg->ctr struct, then reset some important
 302      * members of the drbg->ctr struct (e.g. keysize, df_ks) to their
 303      * initial values.
 304      */
 305     drbg->meth->uninstantiate(drbg);
 306     return RAND_DRBG_set(drbg, drbg->nid, drbg->flags);
 307 }
 308
 309 /*
 310  * Reseed |drbg|, mixing in the specified data
 311  *
 312  * Requires that drbg->lock is already locked for write, if non-null.
 313  *
 314  * Returns 1 on success, 0 on failure.
 315  */
 316 int RAND_DRBG_reseed(RAND_DRBG *drbg,
 317                      const unsigned char *adin, size_t adinlen)
 318 {
 319     unsigned char *entropy = NULL;
 320     size_t entropylen = 0;
 321
 322     if (drbg->state == DRBG_ERROR) {
 323         RANDerr(RAND_F_RAND_DRBG_RESEED, RAND_R_IN_ERROR_STATE);
 324         return 0;
 325     }
 326     if (drbg->state == DRBG_UNINITIALISED) {
 327         RANDerr(RAND_F_RAND_DRBG_RESEED, RAND_R_NOT_INSTANTIATED);
 328         return 0;
 329     }
 330
 331     if (adin == NULL)
 332         adinlen = 0;
 333     else if (adinlen > drbg->max_adinlen) {
 334         RANDerr(RAND_F_RAND_DRBG_RESEED, RAND_R_ADDITIONAL_INPUT_TOO_LONG);
 335         return 0;
 336     }
 337
 338     drbg->state = DRBG_ERROR;
 339     if (drbg->get_entropy != NULL)
 340         entropylen = drbg->get_entropy(drbg, &entropy, drbg->strength,
 341                                    drbg->min_entropylen, drbg->max_entropylen);
 342     if (entropylen < drbg->min_entropylen
 343         || entropylen > drbg->max_entropylen) {
 344         RANDerr(RAND_F_RAND_DRBG_RESEED, RAND_R_ERROR_RETRIEVING_ENTROPY);
 345         goto end;
 346     }
 347
 348     if (!drbg->meth->reseed(drbg, entropy, entropylen, adin, adinlen))
 349         goto end;
 350
 351     drbg->state = DRBG_READY;
 352     drbg->generate_counter = 0;
 353     drbg->reseed_time = time(NULL);
 354     if (drbg->reseed_counter > 0) {
 355         if (drbg->parent == NULL)
 356             drbg->reseed_counter++;
 357         else
 358             drbg->reseed_counter = drbg->parent->reseed_counter;
 359     }
 360
 361 end:
 362     if (entropy != NULL && drbg->cleanup_entropy != NULL)
 363         drbg->cleanup_entropy(drbg, entropy, entropylen);
 364     if (drbg->state == DRBG_READY)
 365         return 1;
 366     return 0;
 367 }
 368
 369 /*
 370  * Restart |drbg|, using the specified entropy or additional input
 371  *
 372  * Tries its best to get the drbg instantiated by all means,
 373  * regardless of its current state.
 374  *
 375  * Optionally, a |buffer| of |len| random bytes can be passed,
 376  * which is assumed to contain at least |entropy| bits of entropy.
 377  *
 378  * If |entropy| > 0, the buffer content is used as entropy input.
 379  *
 380  * If |entropy| == 0, the buffer content is used as additional input
 381  *
 382  * Returns 1 on success, 0 on failure.
 383  *
 384  * This function is used internally only.
 385  */
 386 int rand_drbg_restart(RAND_DRBG *drbg,
 387                       const unsigned char *buffer, size_t len, size_t entropy)
 388 {
 389     int reseeded = 0;
 390     const unsigned char *adin = NULL;
 391     size_t adinlen = 0;
 392
 393     if (drbg->pool != NULL) {
 394         RANDerr(RAND_F_RAND_DRBG_RESTART, ERR_R_INTERNAL_ERROR);
 395         RAND_POOL_free(drbg->pool);
 396         drbg->pool = NULL;
 397     }
 398
 399     if (buffer != NULL) {
 400         if (entropy > 0) {
 401             if (drbg->max_entropylen < len) {
 402                 RANDerr(RAND_F_RAND_DRBG_RESTART,
 403                     RAND_R_ENTROPY_INPUT_TOO_LONG);
 404                 return 0;
 405             }
 406
 407             if (entropy > 8 * len) {
 408                 RANDerr(RAND_F_RAND_DRBG_RESTART, RAND_R_ENTROPY_OUT_OF_RANGE);
 409                 return 0;
 410             }
 411
 412             /* will be picked up by the rand_drbg_get_entropy() callback */
 413             drbg->pool = RAND_POOL_new(entropy, len, len);
 414             if (drbg->pool == NULL)
 415                 return 0;
 416
 417             RAND_POOL_add(drbg->pool, buffer, len, entropy);
 418         } else {
 419             if (drbg->max_adinlen < len) {
 420                 RANDerr(RAND_F_RAND_DRBG_RESTART,
 421                         RAND_R_ADDITIONAL_INPUT_TOO_LONG);
 422                 return 0;
 423             }
 424             adin = buffer;
 425             adinlen = len;
 426         }
 427     }
 428
 429     /* repair error state */
 430     if (drbg->state == DRBG_ERROR)
 431         RAND_DRBG_uninstantiate(drbg);
 432
 433     /* repair uninitialized state */
 434     if (drbg->state == DRBG_UNINITIALISED) {
 435         /* reinstantiate drbg */
 436         RAND_DRBG_instantiate(drbg,
 437                               (const unsigned char *) ossl_pers_string,
 438                               sizeof(ossl_pers_string) - 1);
 439         /* already reseeded. prevent second reseeding below */
 440         reseeded = (drbg->state == DRBG_READY);
 441     }
 442
 443     /* refresh current state if entropy or additional input has been provided */
 444     if (drbg->state == DRBG_READY) {
 445         if (adin != NULL) {
 446             /*
 447              * mix in additional input without reseeding
 448              *
 449              * Similar to RAND_DRBG_reseed(), but the provided additional
 450              * data |adin| is mixed into the current state without pulling
 451              * entropy from the trusted entropy source using get_entropy().
 452              * This is not a reseeding in the strict sense of NIST SP 800-90A.
 453              */
 454             drbg->meth->reseed(drbg, adin, adinlen, NULL, 0);
 455         } else if (reseeded == 0) {
 456             /* do a full reseeding if it has not been done yet above */
 457             RAND_DRBG_reseed(drbg, NULL, 0);
 458         }
 459     }
 460
 461     /* check whether a given entropy pool was cleared properly during reseed */
 462     if (drbg->pool != NULL) {
 463         drbg->state = DRBG_ERROR;
 464         RANDerr(RAND_F_RAND_DRBG_RESTART, ERR_R_INTERNAL_ERROR);
 465         RAND_POOL_free(drbg->pool);
 466         drbg->pool = NULL;
 467         return 0;
 468     }
 469
 470     return drbg->state == DRBG_READY;
 471 }
 472
 473 /*
 474  * Generate |outlen| bytes into the buffer at |out|.  Reseed if we need
 475  * to or if |prediction_resistance| is set.  Additional input can be
 476  * sent in |adin| and |adinlen|.
 477  *
 478  * Requires that drbg->lock is already locked for write, if non-null.
 479  *
 480  * Returns 1 on success, 0 on failure.
 481  *
 482  */
 483 int RAND_DRBG_generate(RAND_DRBG *drbg, unsigned char *out, size_t outlen,
 484                        int prediction_resistance,
 485                        const unsigned char *adin, size_t adinlen)
 486 {
 487     int reseed_required = 0;
 488
 489     if (drbg->state != DRBG_READY) {
 490         /* try to recover from previous errors */
 491         rand_drbg_restart(drbg, NULL, 0, 0);
 492
 493         if (drbg->state == DRBG_ERROR) {
 494             RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_IN_ERROR_STATE);
 495             return 0;
 496         }
 497         if (drbg->state == DRBG_UNINITIALISED) {
 498             RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_NOT_INSTANTIATED);
 499             return 0;
 500         }
 501     }
 502
 503     if (outlen > drbg->max_request) {
 504         RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_REQUEST_TOO_LARGE_FOR_DRBG);
 505         return 0;
 506     }
 507     if (adinlen > drbg->max_adinlen) {
 508         RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_ADDITIONAL_INPUT_TOO_LONG);
 509         return 0;
 510     }
 511
 512     if (drbg->fork_count != rand_fork_count) {
 513         drbg->fork_count = rand_fork_count;
 514         reseed_required = 1;
 515     }
 516
 517     if (drbg->reseed_interval > 0) {
 518         if (drbg->generate_counter >= drbg->reseed_interval)
 519             reseed_required = 1;
 520     }
 521     if (drbg->reseed_time_interval > 0) {
 522         time_t now = time(NULL);
 523         if (now < drbg->reseed_time
 524             || now - drbg->reseed_time >= drbg->reseed_time_interval)
 525             reseed_required = 1;
 526     }
 527     if (drbg->reseed_counter > 0 && drbg->parent != NULL) {
 528         if (drbg->reseed_counter != drbg->parent->reseed_counter)
 529             reseed_required = 1;
 530     }
 531
 532     if (reseed_required || prediction_resistance) {
 533         if (!RAND_DRBG_reseed(drbg, adin, adinlen)) {
 534             RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_RESEED_ERROR);
 535             return 0;
 536         }
 537         adin = NULL;
 538         adinlen = 0;
 539     }
 540
 541     if (!drbg->meth->generate(drbg, out, outlen, adin, adinlen)) {
 542         drbg->state = DRBG_ERROR;
 543         RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_GENERATE_ERROR);
 544         return 0;
 545     }
 546
 547     drbg->generate_counter++;
 548
 549     return 1;
 550 }
 551
 552 /*
 553  * Generates |outlen| random bytes and stores them in |out|. It will
 554  * using the given |drbg| to generate the bytes.
 555  *
 556  * Requires that drbg->lock is already locked for write, if non-null.
 557  *
 558  * Returns 1 on success 0 on failure.
 559  */
 560 int RAND_DRBG_bytes(RAND_DRBG *drbg, unsigned char *out, size_t outlen)
 561 {
 562     unsigned char *additional = NULL;
 563     size_t additional_len;
 564     size_t chunk;
 565     size_t ret;
 566
 567     additional_len = rand_drbg_get_additional_data(&additional, drbg->max_adinlen);
 568
 569     for ( ; outlen > 0; outlen -= chunk, out += chunk) {
 570         chunk = outlen;
 571         if (chunk > drbg->max_request)
 572             chunk = drbg->max_request;
 573         ret = RAND_DRBG_generate(drbg, out, chunk, 0, additional, additional_len);
 574         if (!ret)
 575             goto err;
 576     }
 577     ret = 1;
 578
 579 err:
 580     if (additional_len != 0)
 581         OPENSSL_secure_clear_free(additional, additional_len);
 582
 583     return ret;
 584 }
 585
 586 /*
 587  * Set the RAND_DRBG callbacks for obtaining entropy and nonce.
 588  *
 589  * In the following, the signature and the semantics of the
 590  * get_entropy() and cleanup_entropy() callbacks are explained.
 591  *
 592  * GET_ENTROPY
 593  *
 594  *     size_t get_entropy(RAND_DRBG *ctx,
 595  *                        unsigned char **pout,
 596  *                        int entropy,
 597  *                        size_t min_len, size_t max_len);
 598  *
 599  * This is a request to allocate and fill a buffer of size
 600  * |min_len| <= size <= |max_len| (in bytes) which contains
 601  * at least |entropy| bits of randomness. The buffer's address is
 602  * to be returned in |*pout| and the number of collected
 603  * randomness bytes (which may be less than the allocated size
 604  * of the buffer) as return value.
 605  *
 606  * If the callback fails to acquire at least |entropy| bits of
 607  * randomness, it shall return a buffer length of 0.
 608  *
 609  * CLEANUP_ENTROPY
 610  *
 611  *     void cleanup_entropy(RAND_DRBG *ctx,
 612  *                          unsigned char *out, size_t outlen);
 613  *
 614  * A request to clear and free the buffer allocated by get_entropy().
 615  * The values |out| and |outlen| are expected to be the random buffer's
 616  * address and length, as returned by the get_entropy() callback.
 617  *
 618  * GET_NONCE, CLEANUP_NONCE
 619  *
 620  * Signature and semantics of the get_nonce() and cleanup_nonce()
 621  * callbacks are analogous to get_entropy() and cleanup_entropy().
 622  * Currently, the nonce is used only for the known answer tests.
 623  */
 624 int RAND_DRBG_set_callbacks(RAND_DRBG *drbg,
 625                             RAND_DRBG_get_entropy_fn get_entropy,
 626                             RAND_DRBG_cleanup_entropy_fn cleanup_entropy,
 627                             RAND_DRBG_get_nonce_fn get_nonce,
 628                             RAND_DRBG_cleanup_nonce_fn cleanup_nonce)
 629 {
 630     if (drbg->state != DRBG_UNINITIALISED)
 631         return 0;
 632     drbg->get_entropy = get_entropy;
 633     drbg->cleanup_entropy = cleanup_entropy;
 634     drbg->get_nonce = get_nonce;
 635     drbg->cleanup_nonce = cleanup_nonce;
 636     return 1;
 637 }
 638
 639 /*
 640  * Set the reseed interval.
 641  *
 642  * The drbg will reseed automatically whenever the number of generate
 643  * requests exceeds the given reseed interval. If the reseed interval
 644  * is 0, then this feature is disabled.
 645  *
 646  * Returns 1 on success, 0 on failure.
 647  */
 648 int RAND_DRBG_set_reseed_interval(RAND_DRBG *drbg, unsigned int interval)
 649 {
 650     if (interval > MAX_RESEED_INTERVAL)
 651         return 0;
 652     drbg->reseed_interval = interval;
 653     return 1;
 654 }
 655
 656 /*
 657  * Set the reseed time interval.
 658  *
 659  * The drbg will reseed automatically whenever the time elapsed since
 660  * the last reseeding exceeds the given reseed time interval. For safety,
 661  * a reseeding will also occur if the clock has been reset to a smaller
 662  * value.
 663  *
 664  * Returns 1 on success, 0 on failure.
 665  */
 666 int RAND_DRBG_set_reseed_time_interval(RAND_DRBG *drbg, time_t interval)
 667 {
 668     if (interval > MAX_RESEED_TIME_INTERVAL)
 669         return 0;
 670     drbg->reseed_time_interval = interval;
 671     return 1;
 672 }
 673
 674
 675 /*
 676  * Locks the given drbg. Locking a drbg which does not have locking
 677  * enabled is considered a successful no-op.
 678  *
 679  * Returns 1 on success, 0 on failure.
 680  */
 681 int RAND_DRBG_lock(RAND_DRBG *drbg)
 682 {
 683     if (drbg->lock != NULL)
 684         return CRYPTO_THREAD_write_lock(drbg->lock);
 685
 686     return 1;
 687 }
 688
 689 /*
 690  * Unlocks the given drbg. Unlocking a drbg which does not have locking
 691  * enabled is considered a successful no-op.
 692  *
 693  * Returns 1 on success, 0 on failure.
 694  */
 695 int RAND_DRBG_unlock(RAND_DRBG *drbg)
 696 {
 697     if (drbg->lock != NULL)
 698         return CRYPTO_THREAD_unlock(drbg->lock);
 699
 700     return 1;
 701 }
 702
 703 /*
 704  * Enables locking for the given drbg
 705  *
 706  * Locking can only be enabled if the random generator
 707  * is in the uninitialized state.
 708  *
 709  * Returns 1 on success, 0 on failure.
 710  */
 711 int RAND_DRBG_enable_locking(RAND_DRBG *drbg)
 712 {
 713     if (drbg->state != DRBG_UNINITIALISED) {
 714         RANDerr(RAND_F_RAND_DRBG_ENABLE_LOCKING,
 715                 RAND_R_DRBG_ALREADY_INITIALIZED);
 716         return 0;
 717     }
 718
 719     if (drbg->lock == NULL) {
 720         if (drbg->parent != NULL && drbg->lock == NULL) {
 721             RANDerr(RAND_F_RAND_DRBG_ENABLE_LOCKING,
 722                     RAND_R_PARENT_LOCKING_NOT_ENABLED);
 723             return 0;
 724         }
 725
 726         drbg->lock = CRYPTO_THREAD_lock_new();
 727         if (drbg->lock == NULL) {
 728             RANDerr(RAND_F_RAND_DRBG_ENABLE_LOCKING,
 729                     RAND_R_FAILED_TO_CREATE_LOCK);
 730             return 0;
 731         }
 732     }
 733
 734     return 1;
 735 }
 736
 737 /*
 738  * Get and set the EXDATA
 739  */
 740 int RAND_DRBG_set_ex_data(RAND_DRBG *drbg, int idx, void *arg)
 741 {
 742     return CRYPTO_set_ex_data(&drbg->ex_data, idx, arg);
 743 }
 744
 745 void *RAND_DRBG_get_ex_data(const RAND_DRBG *drbg, int idx)
 746 {
 747     return CRYPTO_get_ex_data(&drbg->ex_data, idx);
 748 }
 749
 750
 751 /*
 752  * The following functions provide a RAND_METHOD that works on the
 753  * global DRBG.  They lock.
 754  */
 755
 756 /*
 757  * Allocates a new global DRBG on the secure heap (if enabled) and
 758  * initializes it with default settings.
 759  *
 760  * Returns a pointer to the new DRBG instance on success, NULL on failure.
 761  */
 762 static RAND_DRBG *drbg_setup(RAND_DRBG *parent)
 763 {
 764     RAND_DRBG *drbg;
 765
 766     drbg = OPENSSL_secure_zalloc(sizeof(RAND_DRBG));
 767     if (drbg == NULL)
 768         return NULL;
 769
 770     drbg->lock = CRYPTO_THREAD_lock_new();
 771     if (drbg->lock == NULL) {
 772         RANDerr(RAND_F_DRBG_SETUP, RAND_R_FAILED_TO_CREATE_LOCK);
 773         goto err;
 774     }
 775
 776     if (RAND_DRBG_set(drbg,
 777                       RAND_DRBG_NID, RAND_DRBG_FLAG_CTR_USE_DF) != 1)
 778         goto err;
 779     if (RAND_DRBG_set_callbacks(drbg, rand_drbg_get_entropy,
 780                                 rand_drbg_cleanup_entropy, NULL, NULL) != 1)
 781         goto err;
 782
 783     if (parent == NULL) {
 784         drbg->reseed_interval = MASTER_RESEED_INTERVAL;
 785         drbg->reseed_time_interval = MASTER_RESEED_TIME_INTERVAL;
 786     } else {
 787         drbg->parent = parent;
 788         drbg->reseed_interval = SLAVE_RESEED_INTERVAL;
 789         drbg->reseed_time_interval = SLAVE_RESEED_TIME_INTERVAL;
 790     }
 791
 792     /* enable seed propagation */
 793     drbg->reseed_counter = 1;
 794
 795     /*
 796      * Ignore instantiation error so support just-in-time instantiation.
 797      *
 798      * The state of the drbg will be checked in RAND_DRBG_generate() and
 799      * an automatic recovery is attempted.
 800      */
 801     RAND_DRBG_instantiate(drbg,
 802                           (const unsigned char *) ossl_pers_string,
 803                           sizeof(ossl_pers_string) - 1);
 804     return drbg;
 805
 806 err:
 807     drbg_cleanup(drbg);
 808     return NULL;
 809 }
 810
 811 /*
 812  * Initialize the global DRBGs on first use.
 813  * Returns 1 on success, 0 on failure.
 814  */
 815 DEFINE_RUN_ONCE_STATIC(do_rand_drbg_init)
 816 {
 817     /*
 818      * ensure that libcrypto is initialized, otherwise the
 819      * DRBG locks are not cleaned up properly
 820      */
 821     if (!OPENSSL_init_crypto(0, NULL))
 822         return 0;
 823
 824     drbg_master = drbg_setup(NULL);
 825     drbg_public = drbg_setup(drbg_master);
 826     drbg_private = drbg_setup(drbg_master);
 827
 828     if (drbg_master == NULL || drbg_public == NULL || drbg_private == NULL)
 829         return 0;
 830
 831     return 1;
 832 }
 833
 834 /* Cleans up the given global DRBG  */
 835 static void drbg_cleanup(RAND_DRBG *drbg)
 836 {
 837     if (drbg != NULL) {
 838         RAND_DRBG_uninstantiate(drbg);
 839         CRYPTO_THREAD_lock_free(drbg->lock);
 840         OPENSSL_secure_clear_free(drbg, sizeof(RAND_DRBG));
 841     }
 842 }
 843
 844 /* Clean up the global DRBGs before exit */
 845 void rand_drbg_cleanup_int(void)
 846 {
 847     drbg_cleanup(drbg_private);
 848     drbg_cleanup(drbg_public);
 849     drbg_cleanup(drbg_master);
 850
 851     drbg_private = drbg_public = drbg_master = NULL;
 852 }
 853
 854 /* Implements the default OpenSSL RAND_bytes() method */
 855 static int drbg_bytes(unsigned char *out, int count)
 856 {
 857     int ret;
 858     RAND_DRBG *drbg = RAND_DRBG_get0_public();
 859
 860     if (drbg == NULL)
 861         return 0;
 862
 863     RAND_DRBG_lock(drbg);
 864     ret = RAND_DRBG_bytes(drbg, out, count);
 865     RAND_DRBG_unlock(drbg);
 866
 867     return ret;
 868 }
 869
 870 /* Implements the default OpenSSL RAND_add() method */
 871 static int drbg_add(const void *buf, int num, double randomness)
 872 {
 873     int ret = 0;
 874     RAND_DRBG *drbg = RAND_DRBG_get0_master();
 875
 876     if (drbg == NULL)
 877         return 0;
 878
 879     if (num < 0 || randomness < 0.0)
 880         return 0;
 881
 882     if (randomness > (double)drbg->max_entropylen) {
 883         /*
 884          * The purpose of this check is to bound |randomness| by a
 885          * relatively small value in order to prevent an integer
 886          * overflow when multiplying by 8 in the rand_drbg_restart()
 887          * call below.
 888          */
 889         return 0;
 890     }
 891
 892     RAND_DRBG_lock(drbg);
 893     ret = rand_drbg_restart(drbg, buf,
 894                             (size_t)(unsigned int)num,
 895                             (size_t)(8*randomness));
 896     RAND_DRBG_unlock(drbg);
 897
 898     return ret;
 899 }
 900
 901 /* Implements the default OpenSSL RAND_seed() method */
 902 static int drbg_seed(const void *buf, int num)
 903 {
 904     return drbg_add(buf, num, num);
 905 }
 906
 907 /* Implements the default OpenSSL RAND_status() method */
 908 static int drbg_status(void)
 909 {
 910     int ret;
 911     RAND_DRBG *drbg = RAND_DRBG_get0_master();
 912
 913     if (drbg == NULL)
 914         return 0;
 915
 916     RAND_DRBG_lock(drbg);
 917     ret = drbg->state == DRBG_READY ? 1 : 0;
 918     RAND_DRBG_unlock(drbg);
 919     return ret;
 920 }
 921
 922 /*
 923  * Get the master DRBG.
 924  * Returns pointer to the DRBG on success, NULL on failure.
 925  *
 926  */
 927 RAND_DRBG *RAND_DRBG_get0_master(void)
 928 {
 929     if (!RUN_ONCE(&rand_drbg_init, do_rand_drbg_init))
 930         return NULL;
 931
 932     return drbg_master;
 933 }
 934
 935 /*
 936  * Get the public DRBG.
 937  * Returns pointer to the DRBG on success, NULL on failure.
 938  */
 939 RAND_DRBG *RAND_DRBG_get0_public(void)
 940 {
 941     if (!RUN_ONCE(&rand_drbg_init, do_rand_drbg_init))
 942         return NULL;
 943
 944     return drbg_public;
 945 }
 946
 947 /*
 948  * Get the private DRBG.
 949  * Returns pointer to the DRBG on success, NULL on failure.
 950  */
 951 RAND_DRBG *RAND_DRBG_get0_private(void)
 952 {
 953     if (!RUN_ONCE(&rand_drbg_init, do_rand_drbg_init))
 954         return NULL;
 955
 956     return drbg_private;
 957 }
 958
 959 RAND_METHOD rand_meth = {
 960     drbg_seed,
 961     drbg_bytes,
 962     NULL,
 963     drbg_add,
 964     drbg_bytes,
 965     drbg_status
 966 };
 967
 968 RAND_METHOD *RAND_OpenSSL(void)
 969 {
 970     return &rand_meth;
 971 }