Allow MinGW-w64 builds to use BCryptGenRandom

MinGW-w64 has provided bcrypt headers and import libraries since
version 2.0, but OpenSSL only enabled the BCryptGenRandom seeding
path for supported MSVC builds. Enable the existing direct
BCryptGenRandom flow for MinGW-w64 when targeting Windows Vista or
newer, and link MinGW builds with bcrypt alongside the other Windows
import libraries.

Use __MINGW64_VERSION_MAJOR to detect MinGW-w64 because it is defined
by both the 32-bit and 64-bit MinGW-w64 toolchains.

Builds targeting older Windows versions keep the CryptoAPI fallback
because USE_BCRYPTGENRANDOM remains disabled when _WIN32_WINNT is
below 0x0600.

Fixes #13878

Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Jul 10 12:05:09 2026
(Merged from https://github.com/openssl/openssl/pull/13882)

diff --git a/Configurations/10-main.conf b/Configurations/10-main.conf
index 4dd4250d1b55d9c4109a241e51cdc80dcba7b97a..390aac5011075e60ebcaceb34693d3966aa0d1c6 100644 (file)
--- a/Configurations/10-main.conf
+++ b/Configurations/10-main.conf
@@ -1591,7 +1591,7 @@ my %targets = (
         cppflags         => combine("-DUNICODE -D_UNICODE -DWIN32_LEAN_AND_MEAN",
                                     threads("-D_MT")),
         lib_cppflags     => "-DL_ENDIAN",
-        ex_libs          => add("-lws2_32 -lgdi32 -lcrypt32"),
+        ex_libs          => add("-lws2_32 -lgdi32 -lcrypt32 -lbcrypt"),
         thread_scheme    => "winthreads",
         dso_scheme       => "win32",
         shared_target    => "mingw-shared",

diff --git a/providers/implementations/rands/seeding/rand_win.c b/providers/implementations/rands/seeding/rand_win.c
index acc35936f0af89cf54fe18dbe9ccf13d8d9425a3..e1350f7d806fbd306378b8886b3c8fe645977c9e 100644 (file)
--- a/providers/implementations/rands/seeding/rand_win.c
+++ b/providers/implementations/rands/seeding/rand_win.c
@@ -21,8 +21,9 @@
 #endif
 
 /* On Windows Vista or higher use BCrypt instead of the legacy CryptoAPI */
-#if defined(_MSC_VER) && _MSC_VER > 1500 /* 1500 = Visual Studio 2008 */ \
-    && defined(_WIN32_WINNT) && _WIN32_WINNT >= 0x0600
+#if defined(_WIN32_WINNT) && _WIN32_WINNT >= 0x0600 \
+    && ((defined(_MSC_VER) && _MSC_VER > 1500)      \
+        || (defined(__MINGW64_VERSION_MAJOR) && __MINGW64_VERSION_MAJOR >= 2))
 #define USE_BCRYPTGENRANDOM
 #endif