From: Dr. Matthias St. Pierre Date: Thu, 27 Jun 2019 08:12:08 +0000 (+0200) Subject: man: clarify the 'random number generator must be seeded' requirement X-Git-Tag: OpenSSL_1_1_1d~122 X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=f987a4dd8929b4552f2fa19f09fd2d4115709647;p=oweals%2Fopenssl.git man: clarify the 'random number generator must be seeded' requirement The manual pages require for some API functions that the 'random number generator must be seeded' before calling the function. Initially, this was meant literally, i.e. the OpenSSL CSPRNG had to be seeded manually before calling these functions. Since version 1.1.1, the CSPRNG is seeded automatically on first use, so it's not the responsibility of the programmer anymore. Still, he needs to be aware that the seeding might fail. Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/9257) (cherry picked from commit 262c00882a2fd7cf16672bf467a86f75b4098a7c) --- diff --git a/doc/man3/BN_generate_prime.pod b/doc/man3/BN_generate_prime.pod index b6e9145106..fbccd5170b 100644 --- a/doc/man3/BN_generate_prime.pod +++ b/doc/man3/BN_generate_prime.pod @@ -51,7 +51,9 @@ Deprecated: =head1 DESCRIPTION BN_generate_prime_ex() generates a pseudo-random prime number of -at least bit length B. +at least bit length B. The returned number is probably prime +with a negligible error. + If B is not B, it will be used to store the number. If B is not B, it is used as follows: @@ -89,8 +91,9 @@ generator. If B is true, it will be a safe prime (i.e. a prime p so that (p-1)/2 is also prime). -The PRNG must be seeded prior to calling BN_generate_prime_ex(). -The prime number generation has a negligible error probability. +The random generator must be seeded prior to calling BN_generate_prime_ex(). +If the automatic seeding or reseeding of the OpenSSL CSPRNG fails due to +external circumstances (see L), the operation will fail. BN_is_prime_ex() and BN_is_prime_fasttest_ex() test if the number B

is prime. The following tests are performed until one of them shows that @@ -193,7 +196,8 @@ Instead applications should create a BN_GENCB structure using BN_GENCB_new: =head1 SEE ALSO L, L, -L, L, L +L, L, L, +L =head1 HISTORY diff --git a/doc/man3/DES_random_key.pod b/doc/man3/DES_random_key.pod index bd4bd9750c..04df6ec0df 100644 --- a/doc/man3/DES_random_key.pod +++ b/doc/man3/DES_random_key.pod @@ -104,9 +104,11 @@ consists of 8 bytes with odd parity. The least significant bit in each byte is the parity bit. The key schedule is an expanded form of the key; it is used to speed the encryption process. -DES_random_key() generates a random key. The PRNG must be seeded -prior to using this function (see L). If the PRNG -could not generate a secure key, 0 is returned. +DES_random_key() generates a random key. The random generator must be +seeded when calling this function. +If the automatic seeding or reseeding of the OpenSSL CSPRNG fails due to +external circumstances (see L), the operation will fail. +If the function fails, 0 is returned. Before a DES key can be used, it must be converted into the architecture dependent I via the diff --git a/doc/man3/DSA_generate_key.pod b/doc/man3/DSA_generate_key.pod index 9ff7553352..8701b95015 100644 --- a/doc/man3/DSA_generate_key.pod +++ b/doc/man3/DSA_generate_key.pod @@ -15,7 +15,9 @@ DSA_generate_key - generate DSA key pair DSA_generate_key() expects B to contain DSA parameters. It generates a new key pair and stores it in Bpub_key> and Bpriv_key>. -The PRNG must be seeded prior to calling DSA_generate_key(). +The random generator must be seeded prior to calling DSA_generate_key(). +If the automatic seeding or reseeding of the OpenSSL CSPRNG fails due to +external circumstances (see L), the operation will fail. =head1 RETURN VALUES diff --git a/doc/man3/DSA_sign.pod b/doc/man3/DSA_sign.pod index 889c7a1e07..82d8ce9403 100644 --- a/doc/man3/DSA_sign.pod +++ b/doc/man3/DSA_sign.pod @@ -36,8 +36,10 @@ B is the signer's public key. The B parameter is ignored. -The PRNG must be seeded before DSA_sign() (or DSA_sign_setup()) +The random generator must be seeded when DSA_sign() (or DSA_sign_setup()) is called. +If the automatic seeding or reseeding of the OpenSSL CSPRNG fails due to +external circumstances (see L), the operation will fail. =head1 RETURN VALUES @@ -54,7 +56,8 @@ Standard, DSS), ANSI X9.30 =head1 SEE ALSO L, L, L, -L +L, +L =head1 COPYRIGHT diff --git a/doc/man3/EVP_DigestSignInit.pod b/doc/man3/EVP_DigestSignInit.pod index 7b74a23cbc..4f3b03e7de 100644 --- a/doc/man3/EVP_DigestSignInit.pod +++ b/doc/man3/EVP_DigestSignInit.pod @@ -125,8 +125,9 @@ and public key algorithms. This meant that "clone" digests such as EVP_dss1() needed to be used to sign using SHA1 and DSA. This is no longer necessary and the use of clone digest is now discouraged. -For some key types and parameters the random number generator must be seeded -or the operation will fail. +For some key types and parameters the random number generator must be seeded. +If the automatic seeding or reseeding of the OpenSSL CSPRNG fails due to +external circumstances (see L), the operation will fail. The call to EVP_DigestSignFinal() internally finalizes a copy of the digest context. This means that calls to EVP_DigestSignUpdate() and @@ -147,7 +148,8 @@ L, L, L, L, L, L, L, L, -L, L +L, L, +L =head1 HISTORY diff --git a/doc/man3/EVP_DigestVerifyInit.pod b/doc/man3/EVP_DigestVerifyInit.pod index 592a7508dc..02d6632ce5 100644 --- a/doc/man3/EVP_DigestVerifyInit.pod +++ b/doc/man3/EVP_DigestVerifyInit.pod @@ -76,8 +76,9 @@ and public key algorithms. This meant that "clone" digests such as EVP_dss1() needed to be used to sign using SHA1 and DSA. This is no longer necessary and the use of clone digest is now discouraged. -For some key types and parameters the random number generator must be seeded -or the operation will fail. +For some key types and parameters the random number generator must be seeded. +If the automatic seeding or reseeding of the OpenSSL CSPRNG fails due to +external circumstances (see L), the operation will fail. The call to EVP_DigestVerifyFinal() internally finalizes a copy of the digest context. This means that EVP_VerifyUpdate() and EVP_VerifyFinal() can @@ -93,7 +94,8 @@ L, L, L, L, L, L, L, L, -L, L +L, L, +L =head1 HISTORY diff --git a/doc/man3/EVP_SealInit.pod b/doc/man3/EVP_SealInit.pod index 29d89c3052..b3333f9ddf 100644 --- a/doc/man3/EVP_SealInit.pod +++ b/doc/man3/EVP_SealInit.pod @@ -55,7 +55,9 @@ failure. =head1 NOTES Because a random secret key is generated the random number generator -must be seeded before calling EVP_SealInit(). +must be seeded when EVP_SealInit() is called. +If the automatic seeding or reseeding of the OpenSSL CSPRNG fails due to +external circumstances (see L), the operation will fail. The public key must be RSA because it is the only OpenSSL public key algorithm that supports key transport. @@ -75,7 +77,8 @@ with B set to NULL. L, L, L, -L +L, +L =head1 COPYRIGHT diff --git a/doc/man3/EVP_SignInit.pod b/doc/man3/EVP_SignInit.pod index 86fec82fb0..2eadcb2d2e 100644 --- a/doc/man3/EVP_SignInit.pod +++ b/doc/man3/EVP_SignInit.pod @@ -66,9 +66,10 @@ The B interface to digital signatures should almost always be used in preference to the low level interfaces. This is because the code then becomes transparent to the algorithm used and much more flexible. -When signing with DSA private keys the random number generator must be seeded -or the operation will fail. The random number generator does not need to be -seeded for RSA signatures. +When signing with DSA private keys the random number generator must be seeded. +If the automatic seeding or reseeding of the OpenSSL CSPRNG fails due to +external circumstances (see L), the operation will fail. +This requirement does not hold for RSA signatures. The call to EVP_SignFinal() internally finalizes a copy of the digest context. This means that calls to EVP_SignUpdate() and EVP_SignFinal() can be called diff --git a/doc/man3/RSA_blinding_on.pod b/doc/man3/RSA_blinding_on.pod index 33d49d3720..7e016adca9 100644 --- a/doc/man3/RSA_blinding_on.pod +++ b/doc/man3/RSA_blinding_on.pod @@ -20,8 +20,7 @@ must be used to protect the RSA operation from that attack. RSA_blinding_on() turns blinding on for key B and generates a random blinding factor. B is B or a pre-allocated and -initialized B. The random number generator must be seeded -prior to calling RSA_blinding_on(). +initialized B. RSA_blinding_off() turns blinding off and frees the memory used for the blinding factor. diff --git a/doc/man3/RSA_generate_key.pod b/doc/man3/RSA_generate_key.pod index 508caa10fd..fcac08e090 100644 --- a/doc/man3/RSA_generate_key.pod +++ b/doc/man3/RSA_generate_key.pod @@ -27,8 +27,10 @@ be seeded prior to calling RSA_generate_key_ex(). RSA_generate_multi_prime_key() generates a multi-prime RSA key pair and stores it in the B structure provided in B. The number of primes is given by -the B parameter. The pseudo-random number generator must be seeded prior -to calling RSA_generate_multi_prime_key(). +the B parameter. The random number generator must be seeded when +calling RSA_generate_multi_prime_key(). +If the automatic seeding or reseeding of the OpenSSL CSPRNG fails due to +external circumstances (see L), the operation will fail. The modulus size will be of length B, the number of primes to form the modulus will be B, and the public exponent will be B. Key sizes @@ -88,7 +90,8 @@ B is used with two different meanings. =head1 SEE ALSO -L, L, L +L, L, L, +L =head1 HISTORY diff --git a/doc/man3/RSA_padding_add_PKCS1_type_1.pod b/doc/man3/RSA_padding_add_PKCS1_type_1.pod index 20926003d8..407eec8c90 100644 --- a/doc/man3/RSA_padding_add_PKCS1_type_1.pod +++ b/doc/man3/RSA_padding_add_PKCS1_type_1.pod @@ -100,6 +100,8 @@ simply copy the data The random number generator must be seeded prior to calling RSA_padding_add_xxx(). +If the automatic seeding or reseeding of the OpenSSL CSPRNG fails due to +external circumstances (see L), the operation will fail. RSA_padding_check_xxx() verifies that the B bytes at B contain a valid encoding for a B byte RSA key in the respective @@ -143,7 +145,8 @@ including PKCS1_OAEP. L, L, -L, L +L, L, +L =head1 COPYRIGHT diff --git a/doc/man3/RSA_sign_ASN1_OCTET_STRING.pod b/doc/man3/RSA_sign_ASN1_OCTET_STRING.pod index f577e153d6..9f40291b31 100644 --- a/doc/man3/RSA_sign_ASN1_OCTET_STRING.pod +++ b/doc/man3/RSA_sign_ASN1_OCTET_STRING.pod @@ -26,7 +26,10 @@ memory. B is ignored. -The random number generator must be seeded prior to calling RSA_sign_ASN1_OCTET_STRING(). +The random number generator must be seeded when calling +RSA_sign_ASN1_OCTET_STRING(). +If the automatic seeding or reseeding of the OpenSSL CSPRNG fails due to +external circumstances (see L), the operation will fail. RSA_verify_ASN1_OCTET_STRING() verifies that the signature B of size B is the DER representation of a given octet string @@ -49,7 +52,8 @@ These functions serve no recognizable purpose. L, L, L, -L +L, +L =head1 COPYRIGHT diff --git a/doc/man7/RAND.pod b/doc/man7/RAND.pod index 971b3cdb16..bc6db303c2 100644 --- a/doc/man7/RAND.pod +++ b/doc/man7/RAND.pod @@ -28,6 +28,12 @@ As a normal application developer, you do not have to worry about any details, just use L to obtain random data. Having said that, there is one important rule to obey: Always check the error return value of L and do not take randomness for granted. +Although (re-)seeding is automatic, it can fail because no trusted random source +is available or the trusted source(s) temporarily fail to provide sufficient +random seed material. +In this case the CSPRNG enters an error state and ceases to provide output, +until it is able to recover from the error by reseeding itself. +For more details on reseeding and error recovery, see L. For values that should remain secret, you can use L instead.