generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Use function name FIPS_drbg_health_check() for health check function.

Browse Source 
Add explanatory comments to health check code.
This commit is contained in:
Dr. Stephen Henson
2011-09-22 14:01:25 +00:00
parent 456d883a25
commit cb71870dfa
4 changed files with 40 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGES
View File

@@ -5,8 +5,8 @@
Changes between 1.0.1 and 1.1.0 [xx XXX xxxx] Changes between 1.0.1 and 1.1.0 [xx XXX xxxx]
*) Use separate DRBG fields for internal and external flags. New function *) Use separate DRBG fields for internal and external flags. New function
FIPS_drbg_test() to perform on demand health checking. Add generation FIPS_drbg_health_check() to perform on demand health checking. Add
tests to fips_test_suite with reduced health check interval to generation tests to fips_test_suite with reduced health check interval to
demonstrate periodic health checking. Add "nodh" option to demonstrate periodic health checking. Add "nodh" option to
fips_test_suite to skip very slow DH test. fips_test_suite to skip very slow DH test.
[Steve Henson] [Steve Henson]

11
fips/rand/fips_drbg_lib.c
View File

@@ -1,4 +1,3 @@
/* fips/rand/fips_drbg_lib.c */
/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
* project. * project.
*/ */
@@ -95,11 +94,9 @@ int FIPS_drbg_init(DRBG_CTX *dctx, int type, unsigned int flags)
if (!(dctx->xflags & DRBG_FLAG_TEST)) if (!(dctx->xflags & DRBG_FLAG_TEST))
{ {
DRBG_CTX tctx; if (!FIPS_drbg_health_check(dctx))
if (!fips_drbg_kat(&tctx, type, flags | DRBG_FLAG_TEST))
{ {
FIPSerr(FIPS_F_FIPS_DRBG_INIT, FIPS_R_SELFTEST_FAILURE); FIPSerr(FIPS_F_FIPS_DRBG_INIT, FIPS_R_SELFTEST_FAILURE);
dctx->status = DRBG_STATUS_ERROR;
return 0; return 0;
} }
} }
@@ -308,7 +305,7 @@ static int drbg_reseed(DRBG_CTX *dctx,
*/ */
if (hcheck && !(dctx->xflags & DRBG_FLAG_TEST)) if (hcheck && !(dctx->xflags & DRBG_FLAG_TEST))
{ {
if (!FIPS_drbg_test(dctx)) if (!FIPS_drbg_health_check(dctx))
{ {
r = FIPS_R_SELFTEST_FAILURE; r = FIPS_R_SELFTEST_FAILURE;
goto end; goto end;
@@ -357,13 +354,11 @@ static int fips_drbg_check(DRBG_CTX *dctx)
dctx->health_check_cnt++; dctx->health_check_cnt++;
if (dctx->health_check_cnt >= dctx->health_check_interval) if (dctx->health_check_cnt >= dctx->health_check_interval)
{ {
if (!FIPS_drbg_test(dctx)) if (!FIPS_drbg_health_check(dctx))
{ {
FIPSerr(FIPS_F_FIPS_DRBG_CHECK, FIPS_R_SELFTEST_FAILURE); FIPSerr(FIPS_F_FIPS_DRBG_CHECK, FIPS_R_SELFTEST_FAILURE);
dctx->status = DRBG_STATUS_ERROR;
return 0; return 0;
} }
dctx->health_check_cnt = 0;
} }
return 1; return 1;
} }

43
fips/rand/fips_drbg_selftest.c
View File

@@ -206,6 +206,10 @@ static int fips_drbg_single_kat(DRBG_CTX *dctx, DRBG_SELFTEST_DATA *td,
/* Initial test without PR */ /* Initial test without PR */
/* Instantiate DRBG with test entropy, nonce and personalisation
* string.
*/
if (!FIPS_drbg_init(dctx, td->nid, td->flags)) if (!FIPS_drbg_init(dctx, td->nid, td->flags))
return 0; return 0;
if (!FIPS_drbg_set_callbacks(dctx, test_entropy, 0, 0, test_nonce, 0)) if (!FIPS_drbg_set_callbacks(dctx, test_entropy, 0, 0, test_nonce, 0))
@@ -231,6 +235,8 @@ static int fips_drbg_single_kat(DRBG_CTX *dctx, DRBG_SELFTEST_DATA *td,
adinlen = td->adinlen / 2; adinlen = td->adinlen / 2;
else else
adinlen = td->adinlen; adinlen = td->adinlen;
/* Generate with no PR and verify output matches expected data */
if (!FIPS_drbg_generate(dctx, randout, td->katlen, 0, if (!FIPS_drbg_generate(dctx, randout, td->katlen, 0,
td->adin, adinlen)) td->adin, adinlen))
goto err; goto err;
@@ -240,19 +246,20 @@ static int fips_drbg_single_kat(DRBG_CTX *dctx, DRBG_SELFTEST_DATA *td,
FIPSerr(FIPS_F_FIPS_DRBG_SINGLE_KAT, FIPS_R_NOPR_TEST1_FAILURE); FIPSerr(FIPS_F_FIPS_DRBG_SINGLE_KAT, FIPS_R_NOPR_TEST1_FAILURE);
goto err2; goto err2;
} }
/* If abbreviated POST end of test */
if (quick) if (quick)
{ {
rv = 1; rv = 1;
goto err; goto err;
} }
/* Reseed DRBG with test entropy and additional input */
t.ent = td->entreseed; t.ent = td->entreseed;
t.entlen = td->entreseedlen; t.entlen = td->entreseedlen;
if (!FIPS_drbg_reseed(dctx, td->adinreseed, td->adinreseedlen)) if (!FIPS_drbg_reseed(dctx, td->adinreseed, td->adinreseedlen))
goto err; goto err;
/* Generate with no PR and verify output matches expected data */
if (!FIPS_drbg_generate(dctx, randout, td->kat2len, 0, if (!FIPS_drbg_generate(dctx, randout, td->kat2len, 0,
td->adin2, td->adin2len)) td->adin2, td->adin2len))
goto err; goto err;
@@ -266,6 +273,10 @@ static int fips_drbg_single_kat(DRBG_CTX *dctx, DRBG_SELFTEST_DATA *td,
FIPS_drbg_uninstantiate(dctx); FIPS_drbg_uninstantiate(dctx);
/* Now test with PR */ /* Now test with PR */
/* Instantiate DRBG with test entropy, nonce and personalisation
* string.
*/
if (!FIPS_drbg_init(dctx, td->nid, td->flags)) if (!FIPS_drbg_init(dctx, td->nid, td->flags))
return 0; return 0;
if (!FIPS_drbg_set_callbacks(dctx, test_entropy, 0, 0, test_nonce, 0)) if (!FIPS_drbg_set_callbacks(dctx, test_entropy, 0, 0, test_nonce, 0))
@@ -283,6 +294,10 @@ static int fips_drbg_single_kat(DRBG_CTX *dctx, DRBG_SELFTEST_DATA *td,
if (!FIPS_drbg_instantiate(dctx, td->pers_pr, td->perslen_pr)) if (!FIPS_drbg_instantiate(dctx, td->pers_pr, td->perslen_pr))
goto err; goto err;
/* Now generate with PR: we need to supply entropy as this will
* perform a reseed operation. Check output matches expected value.
*/
t.ent = td->entpr_pr; t.ent = td->entpr_pr;
t.entlen = td->entprlen_pr; t.entlen = td->entprlen_pr;
@@ -304,6 +319,10 @@ static int fips_drbg_single_kat(DRBG_CTX *dctx, DRBG_SELFTEST_DATA *td,
goto err2; goto err2;
} }
/* Now generate again with PR: supply new entropy again.
* Check output matches expected value.
*/
t.ent = td->entg_pr; t.ent = td->entg_pr;
t.entlen = td->entglen_pr; t.entlen = td->entglen_pr;
@@ -316,7 +335,7 @@ static int fips_drbg_single_kat(DRBG_CTX *dctx, DRBG_SELFTEST_DATA *td,
FIPSerr(FIPS_F_FIPS_DRBG_SINGLE_KAT, FIPS_R_PR_TEST2_FAILURE); FIPSerr(FIPS_F_FIPS_DRBG_SINGLE_KAT, FIPS_R_PR_TEST2_FAILURE);
goto err2; goto err2;
} }
/* All OK, test complete */
rv = 1; rv = 1;
err: err:
@@ -363,11 +382,13 @@ static int do_drbg_instantiate(DRBG_CTX *dctx, DRBG_SELFTEST_DATA *td,
return 1; return 1;
} }
/* This is the "health check" function required by SP800-90. Induce several /* This function performd extensive error checking as required by SP800-90.
* failure modes and check an error condition is set. * Induce several failure modes and check an error condition is set.
* This function along with fips_drbg_single_kat peforms the health checking
* operation.
*/ */
static int fips_drbg_health_check(DRBG_CTX *dctx, DRBG_SELFTEST_DATA *td) static int fips_drbg_error_check(DRBG_CTX *dctx, DRBG_SELFTEST_DATA *td)
{ {
unsigned char randout[1024]; unsigned char randout[1024];
TEST_ENT t; TEST_ENT t;
@@ -773,13 +794,13 @@ int fips_drbg_kat(DRBG_CTX *dctx, int nid, unsigned int flags)
{ {
if (!fips_drbg_single_kat(dctx, td, 0)) if (!fips_drbg_single_kat(dctx, td, 0))
return 0; return 0;
return fips_drbg_health_check(dctx, td); return fips_drbg_error_check(dctx, td);
} }
} }
return 0; return 0;
} }
int FIPS_drbg_test(DRBG_CTX *dctx) int FIPS_drbg_health_check(DRBG_CTX *dctx)
{ {
int rv; int rv;
DRBG_CTX *tctx = NULL; DRBG_CTX *tctx = NULL;
@@ -794,6 +815,10 @@ int FIPS_drbg_test(DRBG_CTX *dctx)
fips_post_success(FIPS_TEST_DRBG, dctx->type, &dctx->xflags); fips_post_success(FIPS_TEST_DRBG, dctx->type, &dctx->xflags);
else else
fips_post_failed(FIPS_TEST_DRBG, dctx->type, &dctx->xflags); fips_post_failed(FIPS_TEST_DRBG, dctx->type, &dctx->xflags);
if (!rv)
dctx->status = DRBG_STATUS_ERROR;
else
dctx->health_check_cnt = 0;
return rv; return rv;
} }
@@ -843,7 +868,7 @@ int FIPS_selftest_drbg_all(void)
rv = 0; rv = 0;
continue; continue;
} }
if (!fips_drbg_health_check(dctx, td)) if (!fips_drbg_error_check(dctx, td))
{ {
fips_post_failed(FIPS_TEST_DRBG, td->nid, &td->flags); fips_post_failed(FIPS_TEST_DRBG, td->nid, &td->flags);
rv = 0; rv = 0;

2
fips/rand/fips_rand.h
View File

@@ -115,7 +115,7 @@ int FIPS_drbg_get_strength(DRBG_CTX *dctx);
void FIPS_drbg_set_check_interval(DRBG_CTX *dctx, int interval); void FIPS_drbg_set_check_interval(DRBG_CTX *dctx, int interval);
void FIPS_drbg_set_reseed_interval(DRBG_CTX *dctx, int interval); void FIPS_drbg_set_reseed_interval(DRBG_CTX *dctx, int interval);
int FIPS_drbg_test(DRBG_CTX *dctx); int FIPS_drbg_health_check(DRBG_CTX *dctx);
DRBG_CTX *FIPS_get_default_drbg(void); DRBG_CTX *FIPS_get_default_drbg(void);
const RAND_METHOD *FIPS_drbg_method(void); const RAND_METHOD *FIPS_drbg_method(void);