Tell the ciphers which DRBG to use for generating random bytes.

Reviewed-by: Richard Levitte <levitte@openssl.org>
GH: #4672

diff --git a/crypto/evp/e_aes.c b/crypto/evp/e_aes.c
index 1d5007acf8f273d7718c5ab6ef92300b9a13a523..bed9b2743ef01dc5b32c647d091f199cfe7cfcf4 100644 (file)
--- a/crypto/evp/e_aes.c
+++ b/crypto/evp/e_aes.c
@@ -17,6 +17,7 @@
 #include "internal/evp_int.h"
 #include "modes_lcl.h"
 #include <openssl/rand.h>
+#include <internal/rand.h>
 #include "evp_locl.h"
 
 typedef struct {
@@ -1404,8 +1405,14 @@ static int s390x_aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
             memcpy(gctx->iv, ptr, arg);
 
         enc = EVP_CIPHER_CTX_encrypting(c);
-        if (enc && RAND_bytes(gctx->iv + arg, gctx->ivlen - arg) <= 0)
-            return 0;
+        if (enc) {
+            if (c->drbg != NULL) {
+                if (RAND_DRBG_bytes(c->drbg, gctx->iv + arg, gctx->ivlen - arg) == 0)
+                    return 0;
+            } else if (RAND_bytes(gctx->iv + arg, gctx->ivlen - arg) <= 0) {
+                return 0;
+            }
+        }
 
         gctx->iv_gen = 1;
         return 1;
@@ -2632,9 +2639,14 @@ static int aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
             return 0;
         if (arg)
             memcpy(gctx->iv, ptr, arg);
-        if (EVP_CIPHER_CTX_encrypting(c)
-            && RAND_bytes(gctx->iv + arg, gctx->ivlen - arg) <= 0)
-            return 0;
+        if (EVP_CIPHER_CTX_encrypting(c)) {
+            if (c->drbg != NULL) {
+                if (RAND_DRBG_bytes(c->drbg, gctx->iv + arg, gctx->ivlen - arg) == 0)
+                    return 0;
+            } else if (RAND_bytes(gctx->iv + arg, gctx->ivlen - arg) <= 0) {
+                return 0;
+            }
+        }
         gctx->iv_gen = 1;
         return 1;
 

diff --git a/crypto/evp/e_aes_cbc_hmac_sha1.c b/crypto/evp/e_aes_cbc_hmac_sha1.c
index 09d24dc3d02a02435ff5e61bd8d786c16cda5cfa..053189e6856997cdd82073da6656967a5bf64e59 100644 (file)
--- a/crypto/evp/e_aes_cbc_hmac_sha1.c
+++ b/crypto/evp/e_aes_cbc_hmac_sha1.c
@@ -17,9 +17,11 @@
 #include <openssl/aes.h>
 #include <openssl/sha.h>
 #include <openssl/rand.h>
+#include <internal/rand.h>
 #include "modes_lcl.h"
 #include "internal/evp_int.h"
 #include "internal/constant_time_locl.h"
+#include "evp_locl.h"
 
 typedef struct {
     AES_KEY ks;
@@ -154,7 +156,8 @@ void aesni_multi_cbc_encrypt(CIPH_DESC *, void *, int);
 static size_t tls1_1_multi_block_encrypt(EVP_AES_HMAC_SHA1 *key,
                                          unsigned char *out,
                                          const unsigned char *inp,
-                                         size_t inp_len, int n4x)
+                                         size_t inp_len, int n4x,
+                                         RAND_DRBG *drbg)
 {                               /* n4x is 1 or 2 */
     HASH_DESC hash_d[8], edges[8];
     CIPH_DESC ciph_d[8];
@@ -174,8 +177,13 @@ static size_t tls1_1_multi_block_encrypt(EVP_AES_HMAC_SHA1 *key,
 #  endif
 
     /* ask for IVs in bulk */
-    if (RAND_bytes((IVs = blocks[0].c), 16 * x4) <= 0)
+    IVs = blocks[0].c;
+    if (drbg != NULL) {
+        if (RAND_DRBG_bytes(drbg, IVs, 16 * x4) == 0)
+            return 0;
+    } else if (RAND_bytes(IVs, 16 * x4) <= 0) {
         return 0;
+    }
 
     ctx = (SHA1_MB_CTX *) (storage + 32 - ((size_t)storage % 32)); /* align */
 
@@ -893,7 +901,8 @@ static int aesni_cbc_hmac_sha1_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg,
 
             return (int)tls1_1_multi_block_encrypt(key, param->out,
                                                    param->inp, param->len,
-                                                   param->interleave / 4);
+                                                   param->interleave / 4,
+                                                   ctx->drbg);
         }
     case EVP_CTRL_TLS1_1_MULTIBLOCK_DECRYPT:
 # endif

diff --git a/crypto/evp/e_aes_cbc_hmac_sha256.c b/crypto/evp/e_aes_cbc_hmac_sha256.c
index caac0c9d3da23635e7936969f8719a188d6e73b8..215e02f131e25aa46f9d1fc2f1cc179e360829ba 100644 (file)
--- a/crypto/evp/e_aes_cbc_hmac_sha256.c
+++ b/crypto/evp/e_aes_cbc_hmac_sha256.c
@@ -18,9 +18,11 @@
 #include <openssl/aes.h>
 #include <openssl/sha.h>
 #include <openssl/rand.h>
+#include <internal/rand.h>
 #include "modes_lcl.h"
 #include "internal/constant_time_locl.h"
 #include "internal/evp_int.h"
+#include "evp_locl.h"
 
 typedef struct {
     AES_KEY ks;
@@ -150,7 +152,8 @@ void aesni_multi_cbc_encrypt(CIPH_DESC *, void *, int);
 static size_t tls1_1_multi_block_encrypt(EVP_AES_HMAC_SHA256 *key,
                                          unsigned char *out,
                                          const unsigned char *inp,
-                                         size_t inp_len, int n4x)
+                                         size_t inp_len, int n4x,
+                                         RAND_DRBG *drbg)
 {                               /* n4x is 1 or 2 */
     HASH_DESC hash_d[8], edges[8];
     CIPH_DESC ciph_d[8];
@@ -170,8 +173,13 @@ static size_t tls1_1_multi_block_encrypt(EVP_AES_HMAC_SHA256 *key,
 #  endif
 
     /* ask for IVs in bulk */
-    if (RAND_bytes((IVs = blocks[0].c), 16 * x4) <= 0)
+    IVs = blocks[0].c;
+    if (drbg != NULL) {
+        if (RAND_DRBG_bytes(drbg, IVs, 16 * x4) == 0)
+            return 0;
+    } else if (RAND_bytes(IVs, 16 * x4) <= 0) {
         return 0;
+    }
 
     /* align */
     ctx = (SHA256_MB_CTX *) (storage + 32 - ((size_t)storage % 32));
@@ -877,7 +885,8 @@ static int aesni_cbc_hmac_sha256_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg,
 
             return (int)tls1_1_multi_block_encrypt(key, param->out,
                                                    param->inp, param->len,
-                                                   param->interleave / 4);
+                                                   param->interleave / 4,
+                                                   ctx->drbg);
         }
     case EVP_CTRL_TLS1_1_MULTIBLOCK_DECRYPT:
 # endif

diff --git a/crypto/evp/e_aria.c b/crypto/evp/e_aria.c
index 00e008a368a6275c8039f54ca302e72d59014d6f..10525a84d9f6f30083473e43a386faf2c4595919 100644 (file)
--- a/crypto/evp/e_aria.c
+++ b/crypto/evp/e_aria.c
@@ -15,6 +15,7 @@
 # include <openssl/rand.h>
 # include "internal/aria.h"
 # include "internal/evp_int.h"
+# include "internal/rand.h"
 # include "modes_lcl.h"
 # include "evp_locl.h"
 
@@ -301,9 +302,14 @@ static int aria_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
             return 0;
         if (arg)
             memcpy(gctx->iv, ptr, arg);
-        if (EVP_CIPHER_CTX_encrypting(c)
-            && RAND_bytes(gctx->iv + arg, gctx->ivlen - arg) <= 0)
-            return 0;
+        if (EVP_CIPHER_CTX_encrypting(c)) {
+            if (c->drbg != NULL) {
+                if (RAND_DRBG_bytes(c->drbg, gctx->iv + arg, gctx->ivlen - arg) == 0)
+                    return 0;
+            } else if (RAND_bytes(gctx->iv + arg, gctx->ivlen - arg) <= 0) {
+                return 0;
+            }
+        }
         gctx->iv_gen = 1;
         return 1;
 

diff --git a/crypto/evp/e_des.c b/crypto/evp/e_des.c
index 9b2facfecfce98bf421892f0bde536bd4d5e5f2b..d8c4afa8860aa750ef3cd0bdf5a1d9a6d7250c4a 100644 (file)
--- a/crypto/evp/e_des.c
+++ b/crypto/evp/e_des.c
@@ -15,6 +15,8 @@
 # include "internal/evp_int.h"
 # include <openssl/des.h>
 # include <openssl/rand.h>
+# include <internal/rand.h>
+# include "evp_locl.h"
 
 typedef struct {
     union {
@@ -229,8 +231,12 @@ static int des_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
 
     switch (type) {
     case EVP_CTRL_RAND_KEY:
-        if (RAND_bytes(ptr, 8) <= 0)
+        if (c->drbg != NULL) {
+            if (RAND_DRBG_bytes(c->drbg, ptr, 8) == 0)
+                return 0;
+        } else if (RAND_bytes(ptr, 8) <= 0) {
             return 0;
+        }
         DES_set_odd_parity((DES_cblock *)ptr);
         return 1;
 

diff --git a/crypto/evp/e_des3.c b/crypto/evp/e_des3.c
index da77936c969cbf7b6f751023cc86f8042f803ddc..75e6ecf314c4151c400ebc1416fff9054d206985 100644 (file)
--- a/crypto/evp/e_des3.c
+++ b/crypto/evp/e_des3.c
@@ -15,6 +15,7 @@
 # include "internal/evp_int.h"
 # include <openssl/des.h>
 # include <openssl/rand.h>
+# include <internal/rand.h>
 # include "evp_locl.h"
 
 typedef struct {
@@ -283,8 +284,12 @@ static int des3_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, void *ptr)
 
     switch (type) {
     case EVP_CTRL_RAND_KEY:
-        if (RAND_bytes(ptr, EVP_CIPHER_CTX_key_length(ctx)) <= 0)
+        if (ctx->drbg != NULL) {
+            if (RAND_DRBG_bytes(ctx->drbg, ptr, EVP_CIPHER_CTX_key_length(ctx)) == 0)
+                return 0;
+        } else if (RAND_bytes(ptr, EVP_CIPHER_CTX_key_length(ctx)) <= 0) {
             return 0;
+        }
         DES_set_odd_parity(deskey);
         if (EVP_CIPHER_CTX_key_length(ctx) >= 16)
             DES_set_odd_parity(deskey + 1);
@@ -372,8 +377,12 @@ static int des_ede3_wrap(EVP_CIPHER_CTX *ctx, unsigned char *out,
     memcpy(out + inl + 8, sha1tmp, 8);
     OPENSSL_cleanse(sha1tmp, SHA_DIGEST_LENGTH);
     /* Generate random IV */
-    if (RAND_bytes(EVP_CIPHER_CTX_iv_noconst(ctx), 8) <= 0)
+    if (ctx->drbg != NULL) {
+        if (RAND_DRBG_bytes(ctx->drbg, EVP_CIPHER_CTX_iv_noconst(ctx), 8) == 0)
+            return -1;
+    } else if (RAND_bytes(EVP_CIPHER_CTX_iv_noconst(ctx), 8) <= 0) {
         return -1;
+    }
     memcpy(out, EVP_CIPHER_CTX_iv_noconst(ctx), 8);
     /* Encrypt everything after IV in place */
     des_ede_cbc_cipher(ctx, out + 8, out + 8, inl + 8);

diff --git a/crypto/evp/evp_enc.c b/crypto/evp/evp_enc.c
index 2c4a2db64ffa5de4987a2980e83e92aa0c588371..3176c615383707ed2a979bcbf32d8960674663c0 100644 (file)
--- a/crypto/evp/evp_enc.c
+++ b/crypto/evp/evp_enc.c
@@ -15,6 +15,7 @@
 #include <openssl/rand.h>
 #include <openssl/engine.h>
 #include "internal/evp_int.h"
+#include "internal/rand.h"
 #include "evp_locl.h"
 
 int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX *c)
@@ -577,6 +578,15 @@ int EVP_CIPHER_CTX_set_padding(EVP_CIPHER_CTX *ctx, int pad)
 int EVP_CIPHER_CTX_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, void *ptr)
 {
     int ret;
+
+    if (type == EVP_CTRL_GET_DRBG) {
+        *(RAND_DRBG **)ptr = ctx->drbg;
+        return 1;
+    }
+    if (type == EVP_CTRL_SET_DRBG) {
+        ctx->drbg = ptr;
+        return 1;
+    }
     if (!ctx->cipher) {
         EVPerr(EVP_F_EVP_CIPHER_CTX_CTRL, EVP_R_NO_CIPHER_SET);
         return 0;
@@ -600,8 +610,12 @@ int EVP_CIPHER_CTX_rand_key(EVP_CIPHER_CTX *ctx, unsigned char *key)
 {
     if (ctx->cipher->flags & EVP_CIPH_RAND_KEY)
         return EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_RAND_KEY, 0, key);
-    if (RAND_bytes(key, ctx->key_len) <= 0)
+    if (ctx->drbg) {
+        if (RAND_DRBG_bytes(ctx->drbg, key, ctx->key_len) == 0)
+            return 0;
+    } else if (RAND_bytes(key, ctx->key_len) <= 0) {
         return 0;
+    }
     return 1;
 }
 

diff --git a/crypto/evp/evp_locl.h b/crypto/evp/evp_locl.h
index 209577b7c2234200390ec5b44a506796ac427ca9..82b9433f75f6151f61abd5ce07af755b62752faa 100644 (file)
--- a/crypto/evp/evp_locl.h
+++ b/crypto/evp/evp_locl.h
@@ -39,6 +39,7 @@ struct evp_cipher_ctx_st {
     int final_used;
     int block_mask;
     unsigned char final[EVP_MAX_BLOCK_LENGTH]; /* possible final block */
+    RAND_DRBG *drbg;
 } /* EVP_CIPHER_CTX */ ;
 
 int PKCS5_v2_PBKDF2_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass,

diff --git a/crypto/evp/p_seal.c b/crypto/evp/p_seal.c
index 50ea60235a9c994ee8307cc456a3921fdb4f17db..3b79dab8b869ab3365c32965ea7a458765fd6954 100644 (file)
--- a/crypto/evp/p_seal.c
+++ b/crypto/evp/p_seal.c
@@ -14,6 +14,8 @@
 #include <openssl/evp.h>
 #include <openssl/objects.h>
 #include <openssl/x509.h>
+#include <internal/rand.h>
+#include "evp_locl.h"
 
 int EVP_SealInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type,
                  unsigned char **ek, int *ekl, unsigned char *iv,
@@ -31,9 +33,14 @@ int EVP_SealInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type,
         return 1;
     if (EVP_CIPHER_CTX_rand_key(ctx, key) <= 0)
         return 0;
-    if (EVP_CIPHER_CTX_iv_length(ctx)
-        && RAND_bytes(iv, EVP_CIPHER_CTX_iv_length(ctx)) <= 0)
-        return 0;
+    if (EVP_CIPHER_CTX_iv_length(ctx)) {
+        if (ctx->drbg) {
+            if (RAND_DRBG_bytes(ctx->drbg, iv, EVP_CIPHER_CTX_iv_length(ctx)) == 0)
+                return 0;
+        } else if (RAND_bytes(iv, EVP_CIPHER_CTX_iv_length(ctx)) <= 0) {
+            return 0;
+        }
+    }
 
     if (!EVP_EncryptInit_ex(ctx, NULL, NULL, key, iv))
         return 0;

diff --git a/doc/man3/EVP_EncryptInit.pod b/doc/man3/EVP_EncryptInit.pod
index 619a94eccf980a47a5e02ef3bceb1247778438fe..3022c7a05407127639f5ad85680832306abdf40c 100644 (file)
--- a/doc/man3/EVP_EncryptInit.pod
+++ b/doc/man3/EVP_EncryptInit.pod
@@ -457,6 +457,20 @@ This call is only valid when decrypting data.
 
 =back
 
+=head1 Random numbers
+
+The following can be used to select the DRBG that is used to generate the random
+numbers:
+
+EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_SET_DRBG, 0, drbg)
+
+The following can be used to get the DRBG:
+
+EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GET_DRBG, 0, &drbg)
+
+By default it's set to NULL which results in RAND_bytes() being used.
+
+
 =head1 NOTES
 
 Where possible the B<EVP> interface to symmetric ciphers should be used in

diff --git a/include/openssl/evp.h b/include/openssl/evp.h
index 268e90f3d5050a1b31bb953f4ec086936dad4024..e135de69f23b171252c9bcaf22b8edb7bd3c02ef 100644 (file)
--- a/include/openssl/evp.h
+++ b/include/openssl/evp.h
@@ -344,6 +344,8 @@ int (*EVP_CIPHER_meth_get_ctrl(const EVP_CIPHER *cipher))(EVP_CIPHER_CTX *,
 # define         EVP_CTRL_SET_PIPELINE_INPUT_BUFS        0x23
 /* Set the input buffer lengths to use for a pipelined operation */
 # define         EVP_CTRL_SET_PIPELINE_INPUT_LENS        0x24
+# define         EVP_CTRL_GET_DRBG                       0x25
+# define         EVP_CTRL_SET_DRBG                       0x26
 
 /* Padding modes */
 #define EVP_PADDING_PKCS7       1

diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c
index 4c63d4acd5aafe384423a96a1b7cc752bfc653a1..f775f26b3dc4a448754440efeed7fbcfb238da2f 100644 (file)
--- a/ssl/s3_enc.c
+++ b/ssl/s3_enc.c
@@ -167,6 +167,7 @@ int ssl3_change_cipher_state(SSL *s, int which)
              */
             EVP_CIPHER_CTX_reset(s->enc_write_ctx);
         }
+        EVP_CIPHER_CTX_ctrl(s->enc_write_ctx, EVP_CTRL_SET_DRBG, 0, s->drbg);
         dd = s->enc_write_ctx;
         if (ssl_replace_hash(&s->write_hash, m) == NULL) {
             SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_CHANGE_CIPHER_STATE,

diff --git a/ssl/statem/statem_srvr.c b/ssl/statem/statem_srvr.c
index d3358196d5f4a5173697a161730de34f58c8da16..8092684af77348525b6fe0a305f809067d034530 100644 (file)
--- a/ssl/statem/statem_srvr.c
+++ b/ssl/statem/statem_srvr.c
@@ -3753,6 +3753,7 @@ int tls_construct_new_session_ticket(SSL *s, WPACKET *pkt)
                  SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET, ERR_R_MALLOC_FAILURE);
         goto err;
     }
+    EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_SET_DRBG, 0, s->drbg);
 
     p = senc;
     if (!i2d_SSL_SESSION(s->session, &p)) {

diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c
index 465d4834072d51d394957cec106276df2018e6fe..774625a2022756f3ad34547356df2ffc5f41285b 100644 (file)
--- a/ssl/t1_enc.c
+++ b/ssl/t1_enc.c
@@ -170,6 +170,7 @@ int tls1_change_cipher_state(SSL *s, int which)
                      ERR_R_MALLOC_FAILURE);
             goto err;
         }
+        EVP_CIPHER_CTX_ctrl(s->enc_write_ctx, EVP_CTRL_SET_DRBG, 0, s->drbg);
         dd = s->enc_write_ctx;
         if (SSL_IS_DTLS(s)) {
             mac_ctx = EVP_MD_CTX_new();

diff --git a/ssl/tls13_enc.c b/ssl/tls13_enc.c
index 63328045cc6577189804da52cfe3a41c5e6088f2..5982c8e93d14e125e6de399be9b1480ffc54014f 100644 (file)
--- a/ssl/tls13_enc.c
+++ b/ssl/tls13_enc.c
@@ -406,6 +406,7 @@ int tls13_change_cipher_state(SSL *s, int which)
                          SSL_F_TLS13_CHANGE_CIPHER_STATE, ERR_R_MALLOC_FAILURE);
                 goto err;
             }
+            EVP_CIPHER_CTX_ctrl(s->enc_write_ctx, EVP_CTRL_SET_DRBG, 0, s->drbg);
         }
         ciph_ctx = s->enc_write_ctx;
         iv = s->write_iv;