generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Disable Dual EC DRBG.

Browse Source 
Return an error if an attempt is made to enable the Dual EC DRBG: it
is not used by default.
This commit is contained in:
Dr. Stephen Henson 2013-09-16 05:23:44 +01:00
parent 39aabe59c8
commit a4870de5aa
3 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
crypto/rand/rand.h
View File

@ -138,6 +138,7 @@ void ERR_load_RAND_strings(void);
#define RAND_F_SSLEAY_RAND_BYTES 100 #define RAND_F_SSLEAY_RAND_BYTES 100
/* Reason codes. */ /* Reason codes. */
#define RAND_R_DUAL_EC_DRBG_DISABLED 104
#define RAND_R_ERROR_INITIALISING_DRBG 102 #define RAND_R_ERROR_INITIALISING_DRBG 102
#define RAND_R_ERROR_INSTANTIATING_DRBG 103 #define RAND_R_ERROR_INSTANTIATING_DRBG 103
#define RAND_R_NO_FIPS_RANDOM_METHOD_SET 101 #define RAND_R_NO_FIPS_RANDOM_METHOD_SET 101

1
crypto/rand/rand_err.c
View File

@ -78,6 +78,7 @@ static ERR_STRING_DATA RAND_str_functs[]=
static ERR_STRING_DATA RAND_str_reasons[]= static ERR_STRING_DATA RAND_str_reasons[]=
{ {
{ERR_REASON(RAND_R_DUAL_EC_DRBG_DISABLED),"dual ec drbg disabled"},
{ERR_REASON(RAND_R_ERROR_INITIALISING_DRBG),"error initialising drbg"}, {ERR_REASON(RAND_R_ERROR_INITIALISING_DRBG),"error initialising drbg"},
{ERR_REASON(RAND_R_ERROR_INSTANTIATING_DRBG),"error instantiating drbg"}, {ERR_REASON(RAND_R_ERROR_INSTANTIATING_DRBG),"error instantiating drbg"},
{ERR_REASON(RAND_R_NO_FIPS_RANDOM_METHOD_SET),"no fips random method set"}, {ERR_REASON(RAND_R_NO_FIPS_RANDOM_METHOD_SET),"no fips random method set"},

8
crypto/rand/rand_lib.c
View File

@ -269,6 +269,14 @@ int RAND_init_fips(void)
DRBG_CTX *dctx; DRBG_CTX *dctx;
size_t plen; size_t plen;
unsigned char pers[32], *p; unsigned char pers[32], *p;
#ifndef OPENSSL_ALLOW_DUAL_EC_DRBG
if (fips_drbg_type >> 16)
{
RANDerr(RAND_F_RAND_INIT_FIPS, RAND_R_DUAL_EC_DRBG_DISABLED);
return 0;
}
#endif
dctx = FIPS_get_default_drbg(); dctx = FIPS_get_default_drbg();
if (FIPS_drbg_init(dctx, fips_drbg_type, fips_drbg_flags) <= 0) if (FIPS_drbg_init(dctx, fips_drbg_type, fips_drbg_flags) <= 0)
{ {