From 45c54042d02362f083143c09513e57317f983244 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Tue, 28 May 2019 11:26:17 +0100 Subject: [PATCH] Call RAND_DRBG_bytes from inside the FIPS provider Insert a dummy call to RAND_DRBG_bytes from inside the FIPS provider to demonstrate that it is possible to use the RAND code from inside the module. This is temporary and will be removed once real uses of the RAND code are available inside the module. Reviewed-by: Matthias St. Pierre (Merged from https://github.com/openssl/openssl/pull/9035) --- providers/fips/fipsprov.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/providers/fips/fipsprov.c b/providers/fips/fipsprov.c index 78e30266c5..ff13acb46b 100644 --- a/providers/fips/fipsprov.c +++ b/providers/fips/fipsprov.c @@ -15,8 +15,11 @@ #include #include #include + /* TODO(3.0): Needed for dummy_evp_call(). To be removed */ #include +#include + #include "internal/cryptlib.h" #include "internal/property.h" #include "internal/evp_int.h" @@ -85,8 +88,10 @@ static int dummy_evp_call(void *provctx) int ret = 0; BN_CTX *bnctx = NULL; BIGNUM *a = NULL, *b = NULL; + unsigned char randbuf[128]; + RAND_DRBG *drbg = OPENSSL_CTX_get0_public_drbg(libctx); - if (ctx == NULL || sha256 == NULL) + if (ctx == NULL || sha256 == NULL || drbg == NULL) goto err; if (!EVP_DigestInit_ex(ctx, sha256, NULL)) @@ -112,6 +117,9 @@ static int dummy_evp_call(void *provctx) || BN_cmp(a, b) != 0) goto err; + if (RAND_DRBG_bytes(drbg, randbuf, sizeof(randbuf)) <= 0) + goto err; + ret = 1; err: BN_CTX_end(bnctx); -- 2.25.1