diff options
author | Dr. Stephen Henson <steve@openssl.org> | 2011-04-05 15:24:10 +0000 |
---|---|---|
committer | Dr. Stephen Henson <steve@openssl.org> | 2011-04-05 15:24:10 +0000 |
commit | 05e24c87dd1428809d6eaebf754b472a6cb4bb50 (patch) | |
tree | db17782a6020c7f4962f8bf9c1666f6f19356e1a /crypto/rand | |
parent | cab0595c1426b2f70d88b824028c6d1ef4a4476e (diff) | |
download | openssl-05e24c87dd1428809d6eaebf754b472a6cb4bb50.tar.gz |
Extensive reorganisation of PRNG handling in FIPS module: all calls
now use an internal RAND_METHOD. All dependencies to OpenSSL standard
PRNG are now removed: it is the applications resposibility to setup
the FIPS PRNG and initalise it.
Initial OpenSSL RAND_init_fips() function that will setup the DRBG
for the "FIPS capable OpenSSL".
Diffstat (limited to 'crypto/rand')
-rw-r--r-- | crypto/rand/rand.h | 7 | ||||
-rw-r--r-- | crypto/rand/rand_err.c | 1 | ||||
-rw-r--r-- | crypto/rand/rand_lib.c | 72 |
3 files changed, 74 insertions, 6 deletions
diff --git a/crypto/rand/rand.h b/crypto/rand/rand.h index 8db2a5f80f..d446c38daf 100644 --- a/crypto/rand/rand.h +++ b/crypto/rand/rand.h @@ -94,7 +94,7 @@ extern int rand_predictable; int RAND_set_rand_method(const RAND_METHOD *meth); const RAND_METHOD *RAND_get_rand_method(void); -#if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_FIPS) +#ifndef OPENSSL_NO_ENGINE int RAND_set_rand_engine(ENGINE *engine); #endif RAND_METHOD *RAND_SSLeay(void); @@ -119,6 +119,10 @@ int RAND_event(UINT, WPARAM, LPARAM); #endif +#ifdef OPENSSL_FIPS +int RAND_init_fips(void); +#endif + /* BEGIN ERROR CODES */ /* The following lines are auto generated by the script mkerr.pl. Any changes * made after this point may be overwritten when the script is next run. @@ -132,6 +136,7 @@ void ERR_load_RAND_strings(void); #define RAND_F_FIPS_RAND_SET_DT 103 #define RAND_F_FIPS_SET_PRNG_SEED 104 #define RAND_F_FIPS_SET_TEST_MODE 105 +#define RAND_F_FIPS_X931_SET_DT 106 #define RAND_F_RAND_GET_RAND_METHOD 101 #define RAND_F_SSLEAY_RAND_BYTES 100 diff --git a/crypto/rand/rand_err.c b/crypto/rand/rand_err.c index 1997752d14..a435b0bfa6 100644 --- a/crypto/rand/rand_err.c +++ b/crypto/rand/rand_err.c @@ -74,6 +74,7 @@ static ERR_STRING_DATA RAND_str_functs[]= {ERR_FUNC(RAND_F_FIPS_RAND_SET_DT), "FIPS_RAND_SET_DT"}, {ERR_FUNC(RAND_F_FIPS_SET_PRNG_SEED), "FIPS_SET_PRNG_SEED"}, {ERR_FUNC(RAND_F_FIPS_SET_TEST_MODE), "FIPS_SET_TEST_MODE"}, +{ERR_FUNC(RAND_F_FIPS_X931_SET_DT), "FIPS_x931_set_dt"}, {ERR_FUNC(RAND_F_RAND_GET_RAND_METHOD), "RAND_get_rand_method"}, {ERR_FUNC(RAND_F_SSLEAY_RAND_BYTES), "SSLEAY_RAND_BYTES"}, {0,NULL} diff --git a/crypto/rand/rand_lib.c b/crypto/rand/rand_lib.c index 3cf9ed5050..ef10dd507e 100644 --- a/crypto/rand/rand_lib.c +++ b/crypto/rand/rand_lib.c @@ -61,11 +61,6 @@ #include "cryptlib.h" #include <openssl/rand.h> -#ifdef OPENSSL_FIPSCANISTER -#define OPENSSL_NO_ENGINE -#include <openssl/fips.h> -#endif - #ifndef OPENSSL_NO_ENGINE #include <openssl/engine.h> #endif @@ -180,3 +175,70 @@ int RAND_status(void) return meth->status(); return 0; } + +#ifdef OPENSSL_FIPS + +#include <openssl/fips.h> +#include <openssl/fips_rand.h> + +/* FIPS DRBG initialisation code. This sets up the DRBG for use by the + * rest of OpenSSL. + */ + +/* Entropy gatherer: use standard OpenSSL PRNG to seed (this will gather + * entropy internally through RAND_poll(). + */ + +static size_t drbg_get_entropy(DRBG_CTX *ctx, unsigned char **pout, + int entropy, size_t min_len, size_t max_len) + { + *pout = OPENSSL_malloc(min_len); + if (!*pout) + return 0; + if (RAND_SSLeay()->bytes(*pout, min_len) <= 0) + { + OPENSSL_free(*pout); + *pout = NULL; + return 0; + } + return min_len; + } + +static void drbg_free_entropy(DRBG_CTX *ctx, unsigned char *out, size_t olen) + { + OPENSSL_cleanse(out, olen); + OPENSSL_free(out); + } + +/* RAND_add() and RAND_seed() pass through to OpenSSL PRNG so it is + * correctly seeded by RAND_poll(). + */ + +static int drbg_rand_add(DRBG_CTX *ctx, const void *in, int inlen, + double entropy) + { + return RAND_SSLeay()->add(in, inlen, entropy); + } + +static int drbg_rand_seed(DRBG_CTX *ctx, const void *in, int inlen) + { + return RAND_SSLeay()->seed(in, inlen); + } + +int RAND_init_fips(void) + { + DRBG_CTX *dctx; + unsigned char pers[16] = {0,0,0}; + dctx = FIPS_get_default_drbg(); + FIPS_drbg_init(dctx, NID_aes_256_ctr, DRBG_FLAG_CTR_USE_DF); + FIPS_drbg_set_callbacks(dctx, + drbg_get_entropy, drbg_free_entropy, + drbg_get_entropy, drbg_free_entropy); + FIPS_drbg_set_rand_callbacks(dctx, 0, 0, + drbg_rand_seed, drbg_rand_add); + FIPS_drbg_instantiate(dctx, pers, sizeof(pers)); + FIPS_rand_set_method(FIPS_drbg_method()); + return 1; + } + +#endif |