generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Extensive reorganisation of PRNG handling in FIPS module: all calls

Browse Source 
now use an internal RAND_METHOD. All dependencies to OpenSSL standard
PRNG are now removed: it is the applications resposibility to setup
the FIPS PRNG and initalise it.

Initial OpenSSL RAND_init_fips() function that will setup the DRBG
for the "FIPS capable OpenSSL".
This commit is contained in:
Dr. Stephen Henson
2011-04-05 15:24:10 +00:00
parent cab0595c14
commit 05e24c87dd
17 changed files with 257 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files

72
crypto/rand/rand_lib.c
View File

@@ -61,11 +61,6 @@
#include "cryptlib.h"
#include <openssl/rand.h>
#ifdef OPENSSL_FIPSCANISTER
#define OPENSSL_NO_ENGINE
#include <openssl/fips.h>
#endif
#ifndef OPENSSL_NO_ENGINE
#include <openssl/engine.h>
#endif
@@ -180,3 +175,70 @@ int RAND_status(void)
return meth->status();
return 0;
}
#ifdef OPENSSL_FIPS
#include <openssl/fips.h>
#include <openssl/fips_rand.h>
/* FIPS DRBG initialisation code. This sets up the DRBG for use by the
* rest of OpenSSL.
*/
/* Entropy gatherer: use standard OpenSSL PRNG to seed (this will gather
* entropy internally through RAND_poll().
*/
static size_t drbg_get_entropy(DRBG_CTX *ctx, unsigned char **pout,
int entropy, size_t min_len, size_t max_len)
{
*pout = OPENSSL_malloc(min_len);
if (!*pout)
return 0;
if (RAND_SSLeay()->bytes(*pout, min_len) <= 0)
{
OPENSSL_free(*pout);
*pout = NULL;
return 0;
}
return min_len;
}
static void drbg_free_entropy(DRBG_CTX *ctx, unsigned char *out, size_t olen)
{
OPENSSL_cleanse(out, olen);
OPENSSL_free(out);
}
/* RAND_add() and RAND_seed() pass through to OpenSSL PRNG so it is
* correctly seeded by RAND_poll().
*/
static int drbg_rand_add(DRBG_CTX *ctx, const void *in, int inlen,
double entropy)
{
return RAND_SSLeay()->add(in, inlen, entropy);
}
static int drbg_rand_seed(DRBG_CTX *ctx, const void *in, int inlen)
{
return RAND_SSLeay()->seed(in, inlen);
}
int RAND_init_fips(void)
{
DRBG_CTX *dctx;
unsigned char pers[16] = {0,0,0};
dctx = FIPS_get_default_drbg();
FIPS_drbg_init(dctx, NID_aes_256_ctr, DRBG_FLAG_CTR_USE_DF);
FIPS_drbg_set_callbacks(dctx,
drbg_get_entropy, drbg_free_entropy,
drbg_get_entropy, drbg_free_entropy);
FIPS_drbg_set_rand_callbacks(dctx, 0, 0,
drbg_rand_seed, drbg_rand_add);
FIPS_drbg_instantiate(dctx, pers, sizeof(pers));
FIPS_rand_set_method(FIPS_drbg_method());
return 1;
}
#endif