]> git.ipfire.org Git - thirdparty/openssl.git/commit
fips: continuous random bit generator tests
authorPauli <ppzgs1@gmail.com>
Thu, 5 Sep 2024 00:24:07 +0000 (10:24 +1000)
committerTomas Mraz <tomas@openssl.org>
Mon, 30 Sep 2024 08:43:04 +0000 (10:43 +0200)
commitec4a2fffa5c5f6d786519fd9b1c7528b8acfa621
tree8460deeec95528c0d6d0410e71942c8e9b4db9c9
parent2ddfef283d1f0e39238705c3fcdbcd343609cb9c
fips: continuous random bit generator tests

For FIPS 140-3 the continuous tests specified in SP 800-90B need to be
included on the output of any entropy source.

They are implemented here as a replacement for the primary DRBG in the FIPS
provider.  This results in a setup that looks like this:

               +-------------+
               |             |
               | Seed Source |
               |             |
               +------+------+
                      |
                      |
                      v
               +-------------+
               |             |
               |  CRNG Test  |
               |             |
               ++----------+-+
                |          |
                |          |
                v          v
    +--------------+     +--------------+
    |              |     |              |
    | Public DRBG  |     | Private DRBG |
    |              |     |              |
    +--------------+     +--------------+

An additional benefit, that of avoiding DRBG chains, is also gained.
The current standards do not permit the output of one DRBG to be used
as the input for a second (i.e. a chain).

This also leaves open the future possibility of incorporating a seed
source inside the FIPS boundary.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25526)
crypto/context.c
crypto/rand/rand_lib.c
include/internal/cryptlib.h
providers/fips/fipsprov.c
providers/implementations/include/prov/implementations.h
providers/implementations/include/prov/names.h
providers/implementations/rands/build.info
providers/implementations/rands/crngt.c [deleted file]
providers/implementations/rands/drbg.c
providers/implementations/rands/fips_crng_test.c [new file with mode: 0644]