1 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
4 /* ====================================================================
5 * Copyright (c) 2011 The OpenSSL Project. All rights reserved.
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in
16 * the documentation and/or other materials provided with the
19 * 3. All advertising materials mentioning features or use of this
20 * software must display the following acknowledgment:
21 * "This product includes software developed by the OpenSSL Project
22 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25 * endorse or promote products derived from this software without
26 * prior written permission. For written permission, please contact
27 * licensing@OpenSSL.org.
29 * 5. Products derived from this software may not be called "OpenSSL"
30 * nor may "OpenSSL" appear in their names without prior written
31 * permission of the OpenSSL Project.
33 * 6. Redistributions of any form whatsoever must retain the following
35 * "This product includes software developed by the OpenSSL Project
36 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49 * OF THE POSSIBILITY OF SUCH DAMAGE.
50 * ====================================================================
53 #define OPENSSL_FIPSAPI
56 #include <openssl/crypto.h>
57 #include <openssl/err.h>
58 #include <openssl/fips_rand.h>
59 #include "fips_rand_lcl.h"
61 /* Support framework for SP800-90 DRBGs */
63 int FIPS_drbg_init(DRBG_CTX *dctx, int type, unsigned int flags)
66 memset(dctx, 0, sizeof(DRBG_CTX));
67 dctx->status = DRBG_STATUS_UNINITIALISED;
72 dctx->entropy_blocklen = 0;
73 dctx->health_check_cnt = 0;
74 dctx->health_check_interval = DRBG_HEALTH_INTERVAL;
76 rv = fips_drbg_hash_init(dctx);
79 rv = fips_drbg_ctr_init(dctx);
81 rv = fips_drbg_hmac_init(dctx);
83 rv = fips_drbg_ec_init(dctx);
88 FIPSerr(FIPS_F_FIPS_DRBG_INIT, FIPS_R_UNSUPPORTED_DRBG_TYPE);
90 FIPSerr(FIPS_F_FIPS_DRBG_INIT, FIPS_R_ERROR_INITIALISING_DRBG);
93 /* If not in test mode run selftests on DRBG of the same type */
95 if (!(dctx->xflags & DRBG_FLAG_TEST))
97 if (!FIPS_drbg_health_check(dctx))
99 FIPSerr(FIPS_F_FIPS_DRBG_INIT, FIPS_R_SELFTEST_FAILURE);
107 DRBG_CTX *FIPS_drbg_new(int type, unsigned int flags)
110 dctx = OPENSSL_malloc(sizeof(DRBG_CTX));
113 FIPSerr(FIPS_F_FIPS_DRBG_NEW, ERR_R_MALLOC_FAILURE);
119 memset(dctx, 0, sizeof(DRBG_CTX));
121 dctx->status = DRBG_STATUS_UNINITIALISED;
125 if (FIPS_drbg_init(dctx, type, flags) <= 0)
134 void FIPS_drbg_free(DRBG_CTX *dctx)
136 if (dctx->uninstantiate)
137 dctx->uninstantiate(dctx);
138 /* Don't free up default DRBG */
139 if (dctx == FIPS_get_default_drbg())
141 memset(dctx, 0, sizeof(DRBG_CTX));
143 dctx->status = DRBG_STATUS_UNINITIALISED;
147 OPENSSL_cleanse(&dctx->d, sizeof(dctx->d));
152 static size_t fips_get_entropy(DRBG_CTX *dctx, unsigned char **pout,
153 int entropy, size_t min_len, size_t max_len)
155 unsigned char *tout, *p;
156 size_t bl = dctx->entropy_blocklen, rv;
157 if (!dctx->get_entropy)
159 if (dctx->xflags & DRBG_FLAG_TEST || !bl)
160 return dctx->get_entropy(dctx, pout, entropy, min_len, max_len);
161 rv = dctx->get_entropy(dctx, &tout, entropy + bl,
162 min_len + bl, max_len + bl);
164 if (rv < (min_len + bl) || (rv % bl))
166 /* Compare consecutive blocks for continuous PRNG test */
167 for (p = tout; p < tout + rv - bl; p += bl)
169 if (!memcmp(p, p + bl, bl))
171 FIPSerr(FIPS_F_FIPS_GET_ENTROPY, FIPS_R_ENTROPY_SOURCE_STUCK);
181 static void fips_cleanup_entropy(DRBG_CTX *dctx,
182 unsigned char *out, size_t olen)
185 if (dctx->xflags & DRBG_FLAG_TEST)
188 bl = dctx->entropy_blocklen;
189 /* Call cleanup with original arguments */
190 dctx->cleanup_entropy(dctx, out - bl, olen + bl);
194 int FIPS_drbg_instantiate(DRBG_CTX *dctx,
195 const unsigned char *pers, size_t perslen)
197 size_t entlen = 0, noncelen = 0;
198 unsigned char *nonce = NULL, *entropy = NULL;
201 /* Put here so error script picks them up */
202 FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE,
203 FIPS_R_PERSONALISATION_STRING_TOO_LONG);
204 FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, FIPS_R_IN_ERROR_STATE);
205 FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, FIPS_R_ALREADY_INSTANTIATED);
206 FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, FIPS_R_ERROR_RETRIEVING_ENTROPY);
207 FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, FIPS_R_ERROR_RETRIEVING_NONCE);
208 FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, FIPS_R_INSTANTIATE_ERROR);
209 FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, FIPS_R_DRBG_NOT_INITIALISED);
214 if (perslen > dctx->max_pers)
216 r = FIPS_R_PERSONALISATION_STRING_TOO_LONG;
220 if (!dctx->instantiate)
222 r = FIPS_R_DRBG_NOT_INITIALISED;
226 if (dctx->status != DRBG_STATUS_UNINITIALISED)
228 if (dctx->status == DRBG_STATUS_ERROR)
229 r = FIPS_R_IN_ERROR_STATE;
231 r = FIPS_R_ALREADY_INSTANTIATED;
235 dctx->status = DRBG_STATUS_ERROR;
237 entlen = fips_get_entropy(dctx, &entropy, dctx->strength,
238 dctx->min_entropy, dctx->max_entropy);
240 if (entlen < dctx->min_entropy || entlen > dctx->max_entropy)
242 r = FIPS_R_ERROR_RETRIEVING_ENTROPY;
246 if (dctx->max_nonce > 0 && dctx->get_nonce)
248 noncelen = dctx->get_nonce(dctx, &nonce,
250 dctx->min_nonce, dctx->max_nonce);
252 if (noncelen < dctx->min_nonce || noncelen > dctx->max_nonce)
254 r = FIPS_R_ERROR_RETRIEVING_NONCE;
260 if (!dctx->instantiate(dctx,
265 r = FIPS_R_ERROR_INSTANTIATING_DRBG;
270 dctx->status = DRBG_STATUS_READY;
271 if (!(dctx->iflags & DRBG_CUSTOM_RESEED))
272 dctx->reseed_counter = 1;
276 if (entropy && dctx->cleanup_entropy)
277 fips_cleanup_entropy(dctx, entropy, entlen);
279 if (nonce && dctx->cleanup_nonce)
280 dctx->cleanup_nonce(dctx, nonce, noncelen);
282 if (dctx->status == DRBG_STATUS_READY)
285 if (r && !(dctx->iflags & DRBG_FLAG_NOERR))
286 FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, r);
292 static int drbg_reseed(DRBG_CTX *dctx,
293 const unsigned char *adin, size_t adinlen, int hcheck)
295 unsigned char *entropy = NULL;
300 FIPSerr(FIPS_F_DRBG_RESEED, FIPS_R_NOT_INSTANTIATED);
301 FIPSerr(FIPS_F_DRBG_RESEED, FIPS_R_ADDITIONAL_INPUT_TOO_LONG);
303 if (dctx->status != DRBG_STATUS_READY
304 && dctx->status != DRBG_STATUS_RESEED)
306 if (dctx->status == DRBG_STATUS_ERROR)
307 r = FIPS_R_IN_ERROR_STATE;
308 else if(dctx->status == DRBG_STATUS_UNINITIALISED)
309 r = FIPS_R_NOT_INSTANTIATED;
315 else if (adinlen > dctx->max_adin)
317 r = FIPS_R_ADDITIONAL_INPUT_TOO_LONG;
321 dctx->status = DRBG_STATUS_ERROR;
322 /* Peform health check on all reseed operations if not a prediction
323 * resistance request and not in test mode.
325 if (hcheck && !(dctx->xflags & DRBG_FLAG_TEST))
327 if (!FIPS_drbg_health_check(dctx))
329 r = FIPS_R_SELFTEST_FAILURE;
334 entlen = fips_get_entropy(dctx, &entropy, dctx->strength,
335 dctx->min_entropy, dctx->max_entropy);
337 if (entlen < dctx->min_entropy || entlen > dctx->max_entropy)
339 r = FIPS_R_ERROR_RETRIEVING_ENTROPY;
343 if (!dctx->reseed(dctx, entropy, entlen, adin, adinlen))
346 dctx->status = DRBG_STATUS_READY;
347 if (!(dctx->iflags & DRBG_CUSTOM_RESEED))
348 dctx->reseed_counter = 1;
351 if (entropy && dctx->cleanup_entropy)
352 fips_cleanup_entropy(dctx, entropy, entlen);
354 if (dctx->status == DRBG_STATUS_READY)
357 if (r && !(dctx->iflags & DRBG_FLAG_NOERR))
358 FIPSerr(FIPS_F_DRBG_RESEED, r);
363 int FIPS_drbg_reseed(DRBG_CTX *dctx,
364 const unsigned char *adin, size_t adinlen)
366 return drbg_reseed(dctx, adin, adinlen, 1);
369 static int fips_drbg_check(DRBG_CTX *dctx)
371 if (dctx->xflags & DRBG_FLAG_TEST)
373 dctx->health_check_cnt++;
374 if (dctx->health_check_cnt >= dctx->health_check_interval)
376 if (!FIPS_drbg_health_check(dctx))
378 FIPSerr(FIPS_F_FIPS_DRBG_CHECK, FIPS_R_SELFTEST_FAILURE);
385 int FIPS_drbg_generate(DRBG_CTX *dctx, unsigned char *out, size_t outlen,
386 int prediction_resistance,
387 const unsigned char *adin, size_t adinlen)
391 if (FIPS_selftest_failed())
393 FIPSerr(FIPS_F_FIPS_DRBG_GENERATE, FIPS_R_SELFTEST_FAILED);
397 if (!fips_drbg_check(dctx))
400 if (dctx->status != DRBG_STATUS_READY
401 && dctx->status != DRBG_STATUS_RESEED)
403 if (dctx->status == DRBG_STATUS_ERROR)
404 r = FIPS_R_IN_ERROR_STATE;
405 else if(dctx->status == DRBG_STATUS_UNINITIALISED)
406 r = FIPS_R_NOT_INSTANTIATED;
410 if (outlen > dctx->max_request)
412 r = FIPS_R_REQUEST_TOO_LARGE_FOR_DRBG;
416 if (adinlen > dctx->max_adin)
418 r = FIPS_R_ADDITIONAL_INPUT_TOO_LONG;
422 if (dctx->iflags & DRBG_CUSTOM_RESEED)
423 dctx->generate(dctx, NULL, outlen, NULL, 0);
424 else if (dctx->reseed_counter >= dctx->reseed_interval)
425 dctx->status = DRBG_STATUS_RESEED;
427 if (dctx->status == DRBG_STATUS_RESEED || prediction_resistance)
429 /* If prediction resistance request don't do health check */
430 int hcheck = prediction_resistance ? 0 : 1;
432 if (!drbg_reseed(dctx, adin, adinlen, hcheck))
434 r = FIPS_R_RESEED_ERROR;
441 if (!dctx->generate(dctx, out, outlen, adin, adinlen))
443 r = FIPS_R_GENERATE_ERROR;
444 dctx->status = DRBG_STATUS_ERROR;
447 if (!(dctx->iflags & DRBG_CUSTOM_RESEED))
449 if (dctx->reseed_counter >= dctx->reseed_interval)
450 dctx->status = DRBG_STATUS_RESEED;
452 dctx->reseed_counter++;
458 if (!(dctx->iflags & DRBG_FLAG_NOERR))
459 FIPSerr(FIPS_F_FIPS_DRBG_GENERATE, r);
466 int FIPS_drbg_uninstantiate(DRBG_CTX *dctx)
469 if (!dctx->uninstantiate)
472 rv = dctx->uninstantiate(dctx);
473 /* Although we'd like to cleanse here we can't because we have to
474 * test the uninstantiate really zeroes the data.
476 memset(&dctx->d, 0, sizeof(dctx->d));
477 dctx->status = DRBG_STATUS_UNINITIALISED;
478 /* If method has problems uninstantiating, return error */
482 int FIPS_drbg_set_callbacks(DRBG_CTX *dctx,
483 size_t (*get_entropy)(DRBG_CTX *ctx, unsigned char **pout,
484 int entropy, size_t min_len, size_t max_len),
485 void (*cleanup_entropy)(DRBG_CTX *ctx, unsigned char *out, size_t olen),
486 size_t entropy_blocklen,
487 size_t (*get_nonce)(DRBG_CTX *ctx, unsigned char **pout,
488 int entropy, size_t min_len, size_t max_len),
489 void (*cleanup_nonce)(DRBG_CTX *ctx, unsigned char *out, size_t olen))
491 if (dctx->status != DRBG_STATUS_UNINITIALISED)
493 dctx->entropy_blocklen = entropy_blocklen;
494 dctx->get_entropy = get_entropy;
495 dctx->cleanup_entropy = cleanup_entropy;
496 dctx->get_nonce = get_nonce;
497 dctx->cleanup_nonce = cleanup_nonce;
501 int FIPS_drbg_set_rand_callbacks(DRBG_CTX *dctx,
502 size_t (*get_adin)(DRBG_CTX *ctx, unsigned char **pout),
503 void (*cleanup_adin)(DRBG_CTX *ctx, unsigned char *out, size_t olen),
504 int (*rand_seed_cb)(DRBG_CTX *ctx, const void *buf, int num),
505 int (*rand_add_cb)(DRBG_CTX *ctx,
506 const void *buf, int num, double entropy))
508 if (dctx->status != DRBG_STATUS_UNINITIALISED)
510 dctx->get_adin = get_adin;
511 dctx->cleanup_adin = cleanup_adin;
512 dctx->rand_seed_cb = rand_seed_cb;
513 dctx->rand_add_cb = rand_add_cb;
517 void *FIPS_drbg_get_app_data(DRBG_CTX *dctx)
519 return dctx->app_data;
522 void FIPS_drbg_set_app_data(DRBG_CTX *dctx, void *app_data)
524 dctx->app_data = app_data;
527 size_t FIPS_drbg_get_blocklength(DRBG_CTX *dctx)
529 return dctx->blocklength;
532 int FIPS_drbg_get_strength(DRBG_CTX *dctx)
534 return dctx->strength;
537 void FIPS_drbg_set_check_interval(DRBG_CTX *dctx, int interval)
539 dctx->health_check_interval = interval;
542 void FIPS_drbg_set_reseed_interval(DRBG_CTX *dctx, int interval)
544 dctx->reseed_interval = interval;
547 static int drbg_stick = 0;
549 void FIPS_drbg_stick(int onoff)
554 /* Continuous DRBG utility function */
555 int fips_drbg_cprng_test(DRBG_CTX *dctx, const unsigned char *out)
557 /* No CPRNG in test mode */
558 if (dctx->xflags & DRBG_FLAG_TEST)
560 /* Check block is valid: should never happen */
561 if (dctx->lb_valid == 0)
563 FIPSerr(FIPS_F_FIPS_DRBG_CPRNG_TEST, FIPS_R_INTERNAL_ERROR);
564 fips_set_selftest_fail();
568 memcpy(dctx->lb, out, dctx->blocklength);
569 /* Check against last block: fail if match */
570 if (!memcmp(dctx->lb, out, dctx->blocklength))
572 FIPSerr(FIPS_F_FIPS_DRBG_CPRNG_TEST, FIPS_R_DRBG_STUCK);
573 fips_set_selftest_fail();
576 /* Save last block for next comparison */
577 memcpy(dctx->lb, out, dctx->blocklength);