2 * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 /* We need to use some engine deprecated APIs */
11 #define OPENSSL_SUPPRESS_DEPRECATED
16 #include <openssl/trace.h>
17 #include <openssl/err.h>
18 #include <openssl/conf.h>
19 #include "internal/cryptlib.h"
20 #include <openssl/opensslconf.h>
21 #include "crypto/rand.h"
22 #include "crypto/cryptlib.h"
23 #include <openssl/engine.h>
24 #include <openssl/core_names.h>
25 #include "internal/thread_once.h"
26 #include "rand_local.h"
30 # include "prov/rand_pool.h"
31 # include "prov/seeding.h"
33 # ifndef OPENSSL_NO_ENGINE
34 /* non-NULL if default_RAND_meth is ENGINE-provided */
35 static ENGINE
*funct_ref
;
36 static CRYPTO_RWLOCK
*rand_engine_lock
;
38 static CRYPTO_RWLOCK
*rand_meth_lock
;
39 static const RAND_METHOD
*default_RAND_meth
;
40 static CRYPTO_ONCE rand_init
= CRYPTO_ONCE_STATIC_INIT
;
42 static int rand_inited
= 0;
44 DEFINE_RUN_ONCE_STATIC(do_rand_init
)
46 # ifndef OPENSSL_NO_ENGINE
47 rand_engine_lock
= CRYPTO_THREAD_lock_new();
48 if (rand_engine_lock
== NULL
)
52 rand_meth_lock
= CRYPTO_THREAD_lock_new();
53 if (rand_meth_lock
== NULL
)
56 if (!rand_pool_init())
63 CRYPTO_THREAD_lock_free(rand_meth_lock
);
64 rand_meth_lock
= NULL
;
65 # ifndef OPENSSL_NO_ENGINE
66 CRYPTO_THREAD_lock_free(rand_engine_lock
);
67 rand_engine_lock
= NULL
;
72 void rand_cleanup_int(void)
74 const RAND_METHOD
*meth
= default_RAND_meth
;
79 if (meth
!= NULL
&& meth
->cleanup
!= NULL
)
81 RAND_set_rand_method(NULL
);
83 # ifndef OPENSSL_NO_ENGINE
84 CRYPTO_THREAD_lock_free(rand_engine_lock
);
85 rand_engine_lock
= NULL
;
87 CRYPTO_THREAD_lock_free(rand_meth_lock
);
88 rand_meth_lock
= NULL
;
93 * RAND_close_seed_files() ensures that any seed file descriptors are
94 * closed after use. This only applies to libcrypto/default provider,
95 * it does not apply to other providers.
97 void RAND_keep_random_devices_open(int keep
)
99 if (RUN_ONCE(&rand_init
, do_rand_init
))
100 rand_pool_keep_random_devices_open(keep
);
104 * RAND_poll() reseeds the default RNG using random input
106 * The random input is obtained from polling various entropy
107 * sources which depend on the operating system and are
108 * configurable via the --with-rand-seed configure option.
112 const RAND_METHOD
*meth
= RAND_get_rand_method();
113 int ret
= meth
== RAND_OpenSSL();
118 #ifndef OPENSSL_NO_DEPRECATED_3_0
120 /* fill random pool and seed the current legacy RNG */
121 RAND_POOL
*pool
= rand_pool_new(RAND_DRBG_STRENGTH
, 1,
122 (RAND_DRBG_STRENGTH
+ 7) / 8,
123 RAND_POOL_MAX_LENGTH
);
128 if (prov_pool_acquire_entropy(pool
) == 0)
131 if (meth
->add
== NULL
132 || meth
->add(rand_pool_buffer(pool
),
133 rand_pool_length(pool
),
134 (rand_pool_entropy(pool
) / 8.0)) == 0)
139 rand_pool_free(pool
);
145 int RAND_set_rand_method(const RAND_METHOD
*meth
)
147 if (!RUN_ONCE(&rand_init
, do_rand_init
))
150 CRYPTO_THREAD_write_lock(rand_meth_lock
);
151 # ifndef OPENSSL_NO_ENGINE
152 ENGINE_finish(funct_ref
);
155 default_RAND_meth
= meth
;
156 CRYPTO_THREAD_unlock(rand_meth_lock
);
160 const RAND_METHOD
*RAND_get_rand_method(void)
162 const RAND_METHOD
*tmp_meth
= NULL
;
164 if (!RUN_ONCE(&rand_init
, do_rand_init
))
167 CRYPTO_THREAD_write_lock(rand_meth_lock
);
168 if (default_RAND_meth
== NULL
) {
169 # ifndef OPENSSL_NO_ENGINE
172 /* If we have an engine that can do RAND, use it. */
173 if ((e
= ENGINE_get_default_RAND()) != NULL
174 && (tmp_meth
= ENGINE_get_RAND(e
)) != NULL
) {
176 default_RAND_meth
= tmp_meth
;
179 default_RAND_meth
= &rand_meth
;
182 default_RAND_meth
= &rand_meth
;
185 tmp_meth
= default_RAND_meth
;
186 CRYPTO_THREAD_unlock(rand_meth_lock
);
190 # if !defined(OPENSSL_NO_ENGINE)
191 int RAND_set_rand_engine(ENGINE
*engine
)
193 const RAND_METHOD
*tmp_meth
= NULL
;
195 if (!RUN_ONCE(&rand_init
, do_rand_init
))
198 if (engine
!= NULL
) {
199 if (!ENGINE_init(engine
))
201 tmp_meth
= ENGINE_get_RAND(engine
);
202 if (tmp_meth
== NULL
) {
203 ENGINE_finish(engine
);
207 CRYPTO_THREAD_write_lock(rand_engine_lock
);
208 /* This function releases any prior ENGINE so call it first */
209 RAND_set_rand_method(tmp_meth
);
211 CRYPTO_THREAD_unlock(rand_engine_lock
);
216 void RAND_seed(const void *buf
, int num
)
218 const RAND_METHOD
*meth
= RAND_get_rand_method();
220 if (meth
!= NULL
&& meth
->seed
!= NULL
)
221 meth
->seed(buf
, num
);
224 void RAND_add(const void *buf
, int num
, double randomness
)
226 const RAND_METHOD
*meth
= RAND_get_rand_method();
228 if (meth
!= NULL
&& meth
->add
!= NULL
)
229 meth
->add(buf
, num
, randomness
);
232 # if !defined(OPENSSL_NO_DEPRECATED_1_1_0)
233 int RAND_pseudo_bytes(unsigned char *buf
, int num
)
235 const RAND_METHOD
*meth
= RAND_get_rand_method();
237 if (meth
!= NULL
&& meth
->pseudorand
!= NULL
)
238 return meth
->pseudorand(buf
, num
);
239 RANDerr(RAND_F_RAND_PSEUDO_BYTES
, RAND_R_FUNC_NOT_IMPLEMENTED
);
244 int RAND_status(void)
247 const RAND_METHOD
*meth
= RAND_get_rand_method();
249 if (meth
!= NULL
&& meth
!= RAND_OpenSSL())
250 return meth
->status
!= NULL
? meth
->status() : 0;
252 if ((rand
= RAND_get0_primary(NULL
)) == NULL
)
254 return EVP_RAND_state(rand
) == EVP_RAND_STATE_READY
;
256 #else /* !FIPS_MODULE */
258 const RAND_METHOD
*RAND_get_rand_method(void)
262 #endif /* !FIPS_MODULE */
265 * This function is not part of RAND_METHOD, so if we're not using
266 * the default method, then just call RAND_bytes(). Otherwise make
267 * sure we're instantiated and use the private DRBG.
269 int RAND_priv_bytes_ex(OSSL_LIB_CTX
*ctx
, unsigned char *buf
, int num
)
272 const RAND_METHOD
*meth
= RAND_get_rand_method();
274 if (meth
!= NULL
&& meth
!= RAND_OpenSSL()) {
275 if (meth
->bytes
!= NULL
)
276 return meth
->bytes(buf
, num
);
277 RANDerr(RAND_F_RAND_PRIV_BYTES_EX
, RAND_R_FUNC_NOT_IMPLEMENTED
);
281 rand
= RAND_get0_private(ctx
);
283 return EVP_RAND_generate(rand
, buf
, num
, 0, 0, NULL
, 0);
288 int RAND_priv_bytes(unsigned char *buf
, int num
)
290 return RAND_priv_bytes_ex(NULL
, buf
, num
);
293 int RAND_bytes_ex(OSSL_LIB_CTX
*ctx
, unsigned char *buf
, int num
)
296 const RAND_METHOD
*meth
= RAND_get_rand_method();
298 if (meth
!= NULL
&& meth
!= RAND_OpenSSL()) {
299 if (meth
->bytes
!= NULL
)
300 return meth
->bytes(buf
, num
);
301 RANDerr(RAND_F_RAND_BYTES_EX
, RAND_R_FUNC_NOT_IMPLEMENTED
);
305 rand
= RAND_get0_public(ctx
);
307 return EVP_RAND_generate(rand
, buf
, num
, 0, 0, NULL
, 0);
312 int RAND_bytes(unsigned char *buf
, int num
)
314 return RAND_bytes_ex(NULL
, buf
, num
);
317 typedef struct rand_global_st
{
319 * The three shared DRBG instances
321 * There are three shared DRBG instances: <primary>, <public>, and
322 * <private>. The <public> and <private> DRBGs are secondary ones.
323 * These are used for non-secret (e.g. nonces) and secret
324 * (e.g. private keys) data respectively.
331 * Not used directly by the application, only for reseeding the two other
332 * DRBGs. It reseeds itself by pulling either randomness from os entropy
333 * sources or by consuming randomness which was added by RAND_add().
335 * The <primary> DRBG is a global instance which is accessed concurrently by
336 * all threads. The necessary locking is managed automatically by its child
337 * DRBG instances during reseeding.
339 EVP_RAND_CTX
*primary
;
344 * Used by default for generating random bytes using RAND_bytes().
346 * The <public> secondary DRBG is thread-local, i.e., there is one instance
349 CRYPTO_THREAD_LOCAL
public;
354 * Used by default for generating private keys using RAND_priv_bytes()
356 * The <private> secondary DRBG is thread-local, i.e., there is one
357 * instance per thread.
359 CRYPTO_THREAD_LOCAL
private;
361 /* Which RNG is being used by default and it's configuration settings */
369 * Initialize the OSSL_LIB_CTX global DRBGs on first use.
370 * Returns the allocated global data on success or NULL on failure.
372 static void *rand_ossl_ctx_new(OSSL_LIB_CTX
*libctx
)
374 RAND_GLOBAL
*dgbl
= OPENSSL_zalloc(sizeof(*dgbl
));
381 * We need to ensure that base libcrypto thread handling has been
384 OPENSSL_init_crypto(0, NULL
);
387 dgbl
->lock
= CRYPTO_THREAD_lock_new();
388 if (dgbl
->lock
== NULL
)
391 if (!CRYPTO_THREAD_init_local(&dgbl
->private, NULL
))
394 if (!CRYPTO_THREAD_init_local(&dgbl
->public, NULL
))
400 CRYPTO_THREAD_cleanup_local(&dgbl
->private);
402 CRYPTO_THREAD_lock_free(dgbl
->lock
);
407 static void rand_ossl_ctx_free(void *vdgbl
)
409 RAND_GLOBAL
*dgbl
= vdgbl
;
414 CRYPTO_THREAD_lock_free(dgbl
->lock
);
415 EVP_RAND_CTX_free(dgbl
->primary
);
416 CRYPTO_THREAD_cleanup_local(&dgbl
->private);
417 CRYPTO_THREAD_cleanup_local(&dgbl
->public);
418 OPENSSL_free(dgbl
->rng_name
);
419 OPENSSL_free(dgbl
->rng_cipher
);
420 OPENSSL_free(dgbl
->rng_digest
);
421 OPENSSL_free(dgbl
->rng_propq
);
426 static const OSSL_LIB_CTX_METHOD rand_drbg_ossl_ctx_method
= {
431 static RAND_GLOBAL
*rand_get_global(OSSL_LIB_CTX
*libctx
)
433 return ossl_lib_ctx_get_data(libctx
, OSSL_LIB_CTX_DRBG_INDEX
,
434 &rand_drbg_ossl_ctx_method
);
437 static void rand_delete_thread_state(void *arg
)
439 OSSL_LIB_CTX
*ctx
= arg
;
440 RAND_GLOBAL
*dgbl
= rand_get_global(ctx
);
446 rand
= CRYPTO_THREAD_get_local(&dgbl
->public);
447 CRYPTO_THREAD_set_local(&dgbl
->public, NULL
);
448 EVP_RAND_CTX_free(rand
);
450 rand
= CRYPTO_THREAD_get_local(&dgbl
->private);
451 CRYPTO_THREAD_set_local(&dgbl
->private, NULL
);
452 EVP_RAND_CTX_free(rand
);
455 static EVP_RAND_CTX
*rand_new_drbg(OSSL_LIB_CTX
*libctx
, EVP_RAND_CTX
*parent
,
456 unsigned int reseed_interval
,
457 time_t reseed_time_interval
)
460 RAND_GLOBAL
*dgbl
= rand_get_global(libctx
);
462 OSSL_PARAM params
[7], *p
= params
;
465 name
= dgbl
->rng_name
!= NULL
? dgbl
->rng_name
: "CTR-DRBG";
466 rand
= EVP_RAND_fetch(libctx
, name
, dgbl
->rng_propq
);
468 RANDerr(0, RAND_R_UNABLE_TO_FETCH_DRBG
);
471 ctx
= EVP_RAND_CTX_new(rand
, parent
);
474 RANDerr(0, RAND_R_UNABLE_TO_CREATE_DRBG
);
479 * Rather than trying to decode the DRBG settings, just pass them through
480 * and rely on the other end to ignore those it doesn't care about.
482 cipher
= dgbl
->rng_cipher
!= NULL
? dgbl
->rng_cipher
: "AES-256-CTR";
483 *p
++ = OSSL_PARAM_construct_utf8_string(OSSL_DRBG_PARAM_CIPHER
,
485 if (dgbl
->rng_digest
!= NULL
)
486 *p
++ = OSSL_PARAM_construct_utf8_string(OSSL_DRBG_PARAM_DIGEST
,
487 dgbl
->rng_digest
, 0);
488 if (dgbl
->rng_propq
!= NULL
)
489 *p
++ = OSSL_PARAM_construct_utf8_string(OSSL_DRBG_PARAM_PROPERTIES
,
491 *p
++ = OSSL_PARAM_construct_utf8_string(OSSL_ALG_PARAM_MAC
, "HMAC", 0);
492 *p
++ = OSSL_PARAM_construct_uint(OSSL_DRBG_PARAM_RESEED_REQUESTS
,
494 *p
++ = OSSL_PARAM_construct_time_t(OSSL_DRBG_PARAM_RESEED_TIME_INTERVAL
,
495 &reseed_time_interval
);
496 *p
= OSSL_PARAM_construct_end();
497 if (!EVP_RAND_set_ctx_params(ctx
, params
)) {
498 RANDerr(0, RAND_R_ERROR_INITIALISING_DRBG
);
499 EVP_RAND_CTX_free(ctx
);
502 if (!EVP_RAND_instantiate(ctx
, 0, 0, NULL
, 0)) {
503 RANDerr(0, RAND_R_ERROR_INSTANTIATING_DRBG
);
504 EVP_RAND_CTX_free(ctx
);
511 * Get the primary random generator.
512 * Returns pointer to its EVP_RAND_CTX on success, NULL on failure.
515 EVP_RAND_CTX
*RAND_get0_primary(OSSL_LIB_CTX
*ctx
)
517 RAND_GLOBAL
*dgbl
= rand_get_global(ctx
);
522 if (dgbl
->primary
== NULL
) {
523 if (!CRYPTO_THREAD_write_lock(dgbl
->lock
))
525 if (dgbl
->primary
== NULL
)
526 dgbl
->primary
= rand_new_drbg(ctx
, NULL
, PRIMARY_RESEED_INTERVAL
,
527 PRIMARY_RESEED_TIME_INTERVAL
);
528 CRYPTO_THREAD_unlock(dgbl
->lock
);
530 return dgbl
->primary
;
534 * Get the public random generator.
535 * Returns pointer to its EVP_RAND_CTX on success, NULL on failure.
537 EVP_RAND_CTX
*RAND_get0_public(OSSL_LIB_CTX
*ctx
)
539 RAND_GLOBAL
*dgbl
= rand_get_global(ctx
);
540 EVP_RAND_CTX
*rand
, *primary
;
545 rand
= CRYPTO_THREAD_get_local(&dgbl
->public);
547 primary
= RAND_get0_primary(ctx
);
551 ctx
= ossl_lib_ctx_get_concrete(ctx
);
553 * If the private is also NULL then this is the first time we've
556 if (CRYPTO_THREAD_get_local(&dgbl
->private) == NULL
557 && !ossl_init_thread_start(NULL
, ctx
, rand_delete_thread_state
))
559 rand
= rand_new_drbg(ctx
, primary
, SECONDARY_RESEED_INTERVAL
,
560 SECONDARY_RESEED_TIME_INTERVAL
);
561 CRYPTO_THREAD_set_local(&dgbl
->public, rand
);
567 * Get the private random generator.
568 * Returns pointer to its EVP_RAND_CTX on success, NULL on failure.
570 EVP_RAND_CTX
*RAND_get0_private(OSSL_LIB_CTX
*ctx
)
572 RAND_GLOBAL
*dgbl
= rand_get_global(ctx
);
573 EVP_RAND_CTX
*rand
, *primary
;
578 rand
= CRYPTO_THREAD_get_local(&dgbl
->private);
580 primary
= RAND_get0_primary(ctx
);
584 ctx
= ossl_lib_ctx_get_concrete(ctx
);
586 * If the public is also NULL then this is the first time we've
589 if (CRYPTO_THREAD_get_local(&dgbl
->public) == NULL
590 && !ossl_init_thread_start(NULL
, ctx
, rand_delete_thread_state
))
592 rand
= rand_new_drbg(ctx
, primary
, SECONDARY_RESEED_INTERVAL
,
593 SECONDARY_RESEED_TIME_INTERVAL
);
594 CRYPTO_THREAD_set_local(&dgbl
->private, rand
);
600 static int random_set_string(char **p
, const char *s
)
602 char *d
= OPENSSL_strdup(s
);
605 CRYPTOerr(0, ERR_R_MALLOC_FAILURE
);
614 * Load the DRBG definitions from a configuration file.
616 static int random_conf_init(CONF_IMODULE
*md
, const CONF
*cnf
)
618 STACK_OF(CONF_VALUE
) *elist
;
620 RAND_GLOBAL
*dgbl
= rand_get_global(cnf
->libctx
);
623 OSSL_TRACE1(CONF
, "Loading random module: section %s\n",
624 CONF_imodule_get_value(md
));
626 /* Value is a section containing RANDOM configuration */
627 elist
= NCONF_get_section(cnf
, CONF_imodule_get_value(md
));
629 CRYPTOerr(0, CRYPTO_R_RANDOM_SECTION_ERROR
);
633 for (i
= 0; i
< sk_CONF_VALUE_num(elist
); i
++) {
634 cval
= sk_CONF_VALUE_value(elist
, i
);
635 if (strcasecmp(cval
->name
, "random") == 0) {
636 if (!random_set_string(&dgbl
->rng_name
, cval
->value
))
638 } else if (strcasecmp(cval
->name
, "cipher") == 0) {
639 if (!random_set_string(&dgbl
->rng_cipher
, cval
->value
))
641 } else if (strcasecmp(cval
->name
, "digest") == 0) {
642 if (!random_set_string(&dgbl
->rng_digest
, cval
->value
))
644 } else if (strcasecmp(cval
->name
, "properties") == 0) {
645 if (!random_set_string(&dgbl
->rng_propq
, cval
->value
))
648 CRYPTOerr(0, CRYPTO_R_UNKNOWN_NAME_IN_RANDOM_SECTION
);
649 ERR_add_error_data(4, "name=", cval
->name
, ", value=", cval
->value
);
657 static void random_conf_deinit(CONF_IMODULE
*md
)
659 OSSL_TRACE(CONF
, "Cleaned up random\n");
662 void ossl_random_add_conf_module(void)
664 OSSL_TRACE(CONF
, "Adding config module 'random'\n");
665 CONF_module_add("random", random_conf_init
, random_conf_deinit
);