drbgtest.c 44 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355
  1. /*
  2. * Copyright 2011-2018 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <string.h>
  10. #include "internal/nelem.h"
  11. #include <openssl/crypto.h>
  12. #include <openssl/err.h>
  13. #include <openssl/rand.h>
  14. #include <openssl/obj_mac.h>
  15. #include <openssl/evp.h>
  16. #include <openssl/aes.h>
  17. #include "../crypto/rand/rand_lcl.h"
  18. #include "../crypto/include/internal/rand_int.h"
  19. #if defined(_WIN32)
  20. # include <windows.h>
  21. #endif
  22. #include "testutil.h"
  23. #include "drbgtest.h"
  24. typedef struct drbg_selftest_data_st {
  25. int post;
  26. int nid;
  27. unsigned int flags;
  28. /* KAT data for no PR */
  29. const unsigned char *entropy;
  30. size_t entropylen;
  31. const unsigned char *nonce;
  32. size_t noncelen;
  33. const unsigned char *pers;
  34. size_t perslen;
  35. const unsigned char *adin;
  36. size_t adinlen;
  37. const unsigned char *entropyreseed;
  38. size_t entropyreseedlen;
  39. const unsigned char *adinreseed;
  40. size_t adinreseedlen;
  41. const unsigned char *adin2;
  42. size_t adin2len;
  43. const unsigned char *expected;
  44. size_t exlen;
  45. const unsigned char *kat2;
  46. size_t kat2len;
  47. /* KAT data for PR */
  48. const unsigned char *entropy_pr;
  49. size_t entropylen_pr;
  50. const unsigned char *nonce_pr;
  51. size_t noncelen_pr;
  52. const unsigned char *pers_pr;
  53. size_t perslen_pr;
  54. const unsigned char *adin_pr;
  55. size_t adinlen_pr;
  56. const unsigned char *entropypr_pr;
  57. size_t entropyprlen_pr;
  58. const unsigned char *ading_pr;
  59. size_t adinglen_pr;
  60. const unsigned char *entropyg_pr;
  61. size_t entropyglen_pr;
  62. const unsigned char *kat_pr;
  63. size_t katlen_pr;
  64. const unsigned char *kat2_pr;
  65. size_t kat2len_pr;
  66. } DRBG_SELFTEST_DATA;
  67. #define make_drbg_test_data(nid, flag, pr, post) {\
  68. post, nid, flag, \
  69. pr##_entropyinput, sizeof(pr##_entropyinput), \
  70. pr##_nonce, sizeof(pr##_nonce), \
  71. pr##_personalizationstring, sizeof(pr##_personalizationstring), \
  72. pr##_additionalinput, sizeof(pr##_additionalinput), \
  73. pr##_entropyinputreseed, sizeof(pr##_entropyinputreseed), \
  74. pr##_additionalinputreseed, sizeof(pr##_additionalinputreseed), \
  75. pr##_additionalinput2, sizeof(pr##_additionalinput2), \
  76. pr##_int_returnedbits, sizeof(pr##_int_returnedbits), \
  77. pr##_returnedbits, sizeof(pr##_returnedbits), \
  78. pr##_pr_entropyinput, sizeof(pr##_pr_entropyinput), \
  79. pr##_pr_nonce, sizeof(pr##_pr_nonce), \
  80. pr##_pr_personalizationstring, sizeof(pr##_pr_personalizationstring), \
  81. pr##_pr_additionalinput, sizeof(pr##_pr_additionalinput), \
  82. pr##_pr_entropyinputpr, sizeof(pr##_pr_entropyinputpr), \
  83. pr##_pr_additionalinput2, sizeof(pr##_pr_additionalinput2), \
  84. pr##_pr_entropyinputpr2, sizeof(pr##_pr_entropyinputpr2), \
  85. pr##_pr_int_returnedbits, sizeof(pr##_pr_int_returnedbits), \
  86. pr##_pr_returnedbits, sizeof(pr##_pr_returnedbits) \
  87. }
  88. #define make_drbg_test_data_use_df(nid, pr, p) \
  89. make_drbg_test_data(nid, 0, pr, p)
  90. #define make_drbg_test_data_no_df(nid, pr, p) \
  91. make_drbg_test_data(nid, RAND_DRBG_FLAG_CTR_NO_DF, pr, p)
  92. #define make_drbg_test_data_hash(nid, pr, p) \
  93. make_drbg_test_data(nid, RAND_DRBG_FLAG_HMAC, hmac_##pr, p), \
  94. make_drbg_test_data(nid, 0, pr, p)
  95. static DRBG_SELFTEST_DATA drbg_test[] = {
  96. #ifndef FIPS_MODE
  97. /* FIPS mode doesn't support CTR DRBG without a derivation function */
  98. make_drbg_test_data_no_df (NID_aes_128_ctr, aes_128_no_df, 0),
  99. make_drbg_test_data_no_df (NID_aes_192_ctr, aes_192_no_df, 0),
  100. make_drbg_test_data_no_df (NID_aes_256_ctr, aes_256_no_df, 1),
  101. #endif
  102. make_drbg_test_data_use_df(NID_aes_128_ctr, aes_128_use_df, 0),
  103. make_drbg_test_data_use_df(NID_aes_192_ctr, aes_192_use_df, 0),
  104. make_drbg_test_data_use_df(NID_aes_256_ctr, aes_256_use_df, 1),
  105. make_drbg_test_data_hash(NID_sha1, sha1, 0),
  106. make_drbg_test_data_hash(NID_sha224, sha224, 0),
  107. make_drbg_test_data_hash(NID_sha256, sha256, 1),
  108. make_drbg_test_data_hash(NID_sha384, sha384, 0),
  109. make_drbg_test_data_hash(NID_sha512, sha512, 0),
  110. };
  111. static int app_data_index;
  112. /*
  113. * Test context data, attached as EXDATA to the RAND_DRBG
  114. */
  115. typedef struct test_ctx_st {
  116. const unsigned char *entropy;
  117. size_t entropylen;
  118. int entropycnt;
  119. const unsigned char *nonce;
  120. size_t noncelen;
  121. int noncecnt;
  122. } TEST_CTX;
  123. static size_t kat_entropy(RAND_DRBG *drbg, unsigned char **pout,
  124. int entropy, size_t min_len, size_t max_len,
  125. int prediction_resistance)
  126. {
  127. TEST_CTX *t = (TEST_CTX *)RAND_DRBG_get_ex_data(drbg, app_data_index);
  128. t->entropycnt++;
  129. *pout = (unsigned char *)t->entropy;
  130. return t->entropylen;
  131. }
  132. static size_t kat_nonce(RAND_DRBG *drbg, unsigned char **pout,
  133. int entropy, size_t min_len, size_t max_len)
  134. {
  135. TEST_CTX *t = (TEST_CTX *)RAND_DRBG_get_ex_data(drbg, app_data_index);
  136. t->noncecnt++;
  137. *pout = (unsigned char *)t->nonce;
  138. return t->noncelen;
  139. }
  140. /*
  141. * Disable CRNG testing if it is enabled.
  142. * If the DRBG is ready or in an error state, this means an instantiate cycle
  143. * for which the default personalisation string is used.
  144. */
  145. static int disable_crngt(RAND_DRBG *drbg)
  146. {
  147. static const char pers[] = DRBG_DEFAULT_PERS_STRING;
  148. const int instantiate = drbg->state != DRBG_UNINITIALISED;
  149. if (drbg->get_entropy != rand_crngt_get_entropy)
  150. return 1;
  151. if ((instantiate && !RAND_DRBG_uninstantiate(drbg))
  152. || !TEST_true(RAND_DRBG_set_callbacks(drbg, &rand_drbg_get_entropy,
  153. &rand_drbg_cleanup_entropy,
  154. &rand_drbg_get_nonce,
  155. &rand_drbg_cleanup_nonce))
  156. || (instantiate
  157. && !RAND_DRBG_instantiate(drbg, (const unsigned char *)pers,
  158. sizeof(pers) - 1)))
  159. return 0;
  160. return 1;
  161. }
  162. static int uninstantiate(RAND_DRBG *drbg)
  163. {
  164. int ret = drbg == NULL ? 1 : RAND_DRBG_uninstantiate(drbg);
  165. ERR_clear_error();
  166. return ret;
  167. }
  168. /*
  169. * Do a single KAT test. Return 0 on failure.
  170. */
  171. static int single_kat(DRBG_SELFTEST_DATA *td)
  172. {
  173. RAND_DRBG *drbg = NULL;
  174. TEST_CTX t;
  175. int failures = 0;
  176. unsigned char buff[1024];
  177. /*
  178. * Test without PR: Instantiate DRBG with test entropy, nonce and
  179. * personalisation string.
  180. */
  181. if (!TEST_ptr(drbg = RAND_DRBG_new(td->nid, td->flags, NULL)))
  182. return 0;
  183. if (!TEST_true(RAND_DRBG_set_callbacks(drbg, kat_entropy, NULL,
  184. kat_nonce, NULL))
  185. || !TEST_true(disable_crngt(drbg))) {
  186. failures++;
  187. goto err;
  188. }
  189. memset(&t, 0, sizeof(t));
  190. t.entropy = td->entropy;
  191. t.entropylen = td->entropylen;
  192. t.nonce = td->nonce;
  193. t.noncelen = td->noncelen;
  194. RAND_DRBG_set_ex_data(drbg, app_data_index, &t);
  195. if (!TEST_true(RAND_DRBG_instantiate(drbg, td->pers, td->perslen))
  196. || !TEST_true(RAND_DRBG_generate(drbg, buff, td->exlen, 0,
  197. td->adin, td->adinlen))
  198. || !TEST_mem_eq(td->expected, td->exlen, buff, td->exlen))
  199. failures++;
  200. /* Reseed DRBG with test entropy and additional input */
  201. t.entropy = td->entropyreseed;
  202. t.entropylen = td->entropyreseedlen;
  203. if (!TEST_true(RAND_DRBG_reseed(drbg, td->adinreseed, td->adinreseedlen, 0)
  204. || !TEST_true(RAND_DRBG_generate(drbg, buff, td->kat2len, 0,
  205. td->adin2, td->adin2len))
  206. || !TEST_mem_eq(td->kat2, td->kat2len, buff, td->kat2len)))
  207. failures++;
  208. uninstantiate(drbg);
  209. /*
  210. * Now test with PR: Instantiate DRBG with test entropy, nonce and
  211. * personalisation string.
  212. */
  213. if (!TEST_true(RAND_DRBG_set(drbg, td->nid, td->flags))
  214. || !TEST_true(RAND_DRBG_set_callbacks(drbg, kat_entropy, NULL,
  215. kat_nonce, NULL)))
  216. failures++;
  217. RAND_DRBG_set_ex_data(drbg, app_data_index, &t);
  218. t.entropy = td->entropy_pr;
  219. t.entropylen = td->entropylen_pr;
  220. t.nonce = td->nonce_pr;
  221. t.noncelen = td->noncelen_pr;
  222. t.entropycnt = 0;
  223. t.noncecnt = 0;
  224. if (!TEST_true(RAND_DRBG_instantiate(drbg, td->pers_pr, td->perslen_pr)))
  225. failures++;
  226. /*
  227. * Now generate with PR: we need to supply entropy as this will
  228. * perform a reseed operation.
  229. */
  230. t.entropy = td->entropypr_pr;
  231. t.entropylen = td->entropyprlen_pr;
  232. if (!TEST_true(RAND_DRBG_generate(drbg, buff, td->katlen_pr, 1,
  233. td->adin_pr, td->adinlen_pr))
  234. || !TEST_mem_eq(td->kat_pr, td->katlen_pr, buff, td->katlen_pr))
  235. failures++;
  236. /*
  237. * Now generate again with PR: supply new entropy again.
  238. */
  239. t.entropy = td->entropyg_pr;
  240. t.entropylen = td->entropyglen_pr;
  241. if (!TEST_true(RAND_DRBG_generate(drbg, buff, td->kat2len_pr, 1,
  242. td->ading_pr, td->adinglen_pr))
  243. || !TEST_mem_eq(td->kat2_pr, td->kat2len_pr,
  244. buff, td->kat2len_pr))
  245. failures++;
  246. err:
  247. uninstantiate(drbg);
  248. RAND_DRBG_free(drbg);
  249. return failures == 0;
  250. }
  251. /*
  252. * Initialise a DRBG based on selftest data
  253. */
  254. static int init(RAND_DRBG *drbg, DRBG_SELFTEST_DATA *td, TEST_CTX *t)
  255. {
  256. if (!TEST_true(RAND_DRBG_set(drbg, td->nid, td->flags))
  257. || !TEST_true(RAND_DRBG_set_callbacks(drbg, kat_entropy, NULL,
  258. kat_nonce, NULL)))
  259. return 0;
  260. RAND_DRBG_set_ex_data(drbg, app_data_index, t);
  261. t->entropy = td->entropy;
  262. t->entropylen = td->entropylen;
  263. t->nonce = td->nonce;
  264. t->noncelen = td->noncelen;
  265. t->entropycnt = 0;
  266. t->noncecnt = 0;
  267. return 1;
  268. }
  269. /*
  270. * Initialise and instantiate DRBG based on selftest data
  271. */
  272. static int instantiate(RAND_DRBG *drbg, DRBG_SELFTEST_DATA *td,
  273. TEST_CTX *t)
  274. {
  275. if (!TEST_true(init(drbg, td, t))
  276. || !TEST_true(RAND_DRBG_instantiate(drbg, td->pers, td->perslen)))
  277. return 0;
  278. return 1;
  279. }
  280. /*
  281. * Perform extensive error checking as required by SP800-90.
  282. * Induce several failure modes and check an error condition is set.
  283. */
  284. static int error_check(DRBG_SELFTEST_DATA *td)
  285. {
  286. static char zero[sizeof(RAND_DRBG)];
  287. RAND_DRBG *drbg = NULL;
  288. TEST_CTX t;
  289. unsigned char buff[1024];
  290. unsigned int reseed_counter_tmp;
  291. int ret = 0;
  292. if (!TEST_ptr(drbg = RAND_DRBG_new(td->nid, td->flags, NULL))
  293. || !TEST_true(disable_crngt(drbg)))
  294. goto err;
  295. /*
  296. * Personalisation string tests
  297. */
  298. /* Test detection of too large personalisation string */
  299. if (!init(drbg, td, &t)
  300. || RAND_DRBG_instantiate(drbg, td->pers, drbg->max_perslen + 1) > 0)
  301. goto err;
  302. /*
  303. * Entropy source tests
  304. */
  305. /* Test entropy source failure detection: i.e. returns no data */
  306. t.entropylen = 0;
  307. if (TEST_int_le(RAND_DRBG_instantiate(drbg, td->pers, td->perslen), 0))
  308. goto err;
  309. /* Try to generate output from uninstantiated DRBG */
  310. if (!TEST_false(RAND_DRBG_generate(drbg, buff, td->exlen, 0,
  311. td->adin, td->adinlen))
  312. || !uninstantiate(drbg))
  313. goto err;
  314. /* Test insufficient entropy */
  315. t.entropylen = drbg->min_entropylen - 1;
  316. if (!init(drbg, td, &t)
  317. || RAND_DRBG_instantiate(drbg, td->pers, td->perslen) > 0
  318. || !uninstantiate(drbg))
  319. goto err;
  320. /* Test too much entropy */
  321. t.entropylen = drbg->max_entropylen + 1;
  322. if (!init(drbg, td, &t)
  323. || RAND_DRBG_instantiate(drbg, td->pers, td->perslen) > 0
  324. || !uninstantiate(drbg))
  325. goto err;
  326. /*
  327. * Nonce tests
  328. */
  329. /* Test too small nonce */
  330. if (drbg->min_noncelen) {
  331. t.noncelen = drbg->min_noncelen - 1;
  332. if (!init(drbg, td, &t)
  333. || RAND_DRBG_instantiate(drbg, td->pers, td->perslen) > 0
  334. || !uninstantiate(drbg))
  335. goto err;
  336. }
  337. /* Test too large nonce */
  338. if (drbg->max_noncelen) {
  339. t.noncelen = drbg->max_noncelen + 1;
  340. if (!init(drbg, td, &t)
  341. || RAND_DRBG_instantiate(drbg, td->pers, td->perslen) > 0
  342. || !uninstantiate(drbg))
  343. goto err;
  344. }
  345. /* Instantiate with valid data, Check generation is now OK */
  346. if (!instantiate(drbg, td, &t)
  347. || !TEST_true(RAND_DRBG_generate(drbg, buff, td->exlen, 0,
  348. td->adin, td->adinlen)))
  349. goto err;
  350. /* Request too much data for one request */
  351. if (!TEST_false(RAND_DRBG_generate(drbg, buff, drbg->max_request + 1, 0,
  352. td->adin, td->adinlen)))
  353. goto err;
  354. /* Try too large additional input */
  355. if (!TEST_false(RAND_DRBG_generate(drbg, buff, td->exlen, 0,
  356. td->adin, drbg->max_adinlen + 1)))
  357. goto err;
  358. /*
  359. * Check prediction resistance request fails if entropy source
  360. * failure.
  361. */
  362. t.entropylen = 0;
  363. if (TEST_false(RAND_DRBG_generate(drbg, buff, td->exlen, 1,
  364. td->adin, td->adinlen))
  365. || !uninstantiate(drbg))
  366. goto err;
  367. /* Instantiate again with valid data */
  368. if (!instantiate(drbg, td, &t))
  369. goto err;
  370. reseed_counter_tmp = drbg->reseed_gen_counter;
  371. drbg->reseed_gen_counter = drbg->reseed_interval;
  372. /* Generate output and check entropy has been requested for reseed */
  373. t.entropycnt = 0;
  374. if (!TEST_true(RAND_DRBG_generate(drbg, buff, td->exlen, 0,
  375. td->adin, td->adinlen))
  376. || !TEST_int_eq(t.entropycnt, 1)
  377. || !TEST_int_eq(drbg->reseed_gen_counter, reseed_counter_tmp + 1)
  378. || !uninstantiate(drbg))
  379. goto err;
  380. /*
  381. * Check prediction resistance request fails if entropy source
  382. * failure.
  383. */
  384. t.entropylen = 0;
  385. if (!TEST_false(RAND_DRBG_generate(drbg, buff, td->exlen, 1,
  386. td->adin, td->adinlen))
  387. || !uninstantiate(drbg))
  388. goto err;
  389. /* Test reseed counter works */
  390. if (!instantiate(drbg, td, &t))
  391. goto err;
  392. reseed_counter_tmp = drbg->reseed_gen_counter;
  393. drbg->reseed_gen_counter = drbg->reseed_interval;
  394. /* Generate output and check entropy has been requested for reseed */
  395. t.entropycnt = 0;
  396. if (!TEST_true(RAND_DRBG_generate(drbg, buff, td->exlen, 0,
  397. td->adin, td->adinlen))
  398. || !TEST_int_eq(t.entropycnt, 1)
  399. || !TEST_int_eq(drbg->reseed_gen_counter, reseed_counter_tmp + 1)
  400. || !uninstantiate(drbg))
  401. goto err;
  402. /*
  403. * Explicit reseed tests
  404. */
  405. /* Test explicit reseed with too large additional input */
  406. if (!instantiate(drbg, td, &t)
  407. || RAND_DRBG_reseed(drbg, td->adin, drbg->max_adinlen + 1, 0) > 0)
  408. goto err;
  409. /* Test explicit reseed with entropy source failure */
  410. t.entropylen = 0;
  411. if (!TEST_int_le(RAND_DRBG_reseed(drbg, td->adin, td->adinlen, 0), 0)
  412. || !uninstantiate(drbg))
  413. goto err;
  414. /* Test explicit reseed with too much entropy */
  415. if (!instantiate(drbg, td, &t))
  416. goto err;
  417. t.entropylen = drbg->max_entropylen + 1;
  418. if (!TEST_int_le(RAND_DRBG_reseed(drbg, td->adin, td->adinlen, 0), 0)
  419. || !uninstantiate(drbg))
  420. goto err;
  421. /* Test explicit reseed with too little entropy */
  422. if (!instantiate(drbg, td, &t))
  423. goto err;
  424. t.entropylen = drbg->min_entropylen - 1;
  425. if (!TEST_int_le(RAND_DRBG_reseed(drbg, td->adin, td->adinlen, 0), 0)
  426. || !uninstantiate(drbg))
  427. goto err;
  428. /* Standard says we have to check uninstantiate really zeroes */
  429. if (!TEST_mem_eq(zero, sizeof(drbg->data), &drbg->data, sizeof(drbg->data)))
  430. goto err;
  431. ret = 1;
  432. err:
  433. uninstantiate(drbg);
  434. RAND_DRBG_free(drbg);
  435. return ret;
  436. }
  437. static int test_kats(int i)
  438. {
  439. DRBG_SELFTEST_DATA *td = &drbg_test[i];
  440. int rv = 0;
  441. if (!single_kat(td))
  442. goto err;
  443. rv = 1;
  444. err:
  445. return rv;
  446. }
  447. static int test_error_checks(int i)
  448. {
  449. DRBG_SELFTEST_DATA *td = &drbg_test[i];
  450. int rv = 0;
  451. if (error_check(td))
  452. goto err;
  453. rv = 1;
  454. err:
  455. return rv;
  456. }
  457. /*
  458. * Hook context data, attached as EXDATA to the RAND_DRBG
  459. */
  460. typedef struct hook_ctx_st {
  461. RAND_DRBG *drbg;
  462. /*
  463. * Currently, all DRBGs use the same get_entropy() callback.
  464. * The tests however, don't assume this and store
  465. * the original callback for every DRBG separately.
  466. */
  467. RAND_DRBG_get_entropy_fn get_entropy;
  468. /* forces a failure of the get_entropy() call if nonzero */
  469. int fail;
  470. /* counts successful reseeds */
  471. int reseed_count;
  472. } HOOK_CTX;
  473. static HOOK_CTX master_ctx, public_ctx, private_ctx;
  474. static HOOK_CTX *get_hook_ctx(RAND_DRBG *drbg)
  475. {
  476. return (HOOK_CTX *)RAND_DRBG_get_ex_data(drbg, app_data_index);
  477. }
  478. /* Intercepts and counts calls to the get_entropy() callback */
  479. static size_t get_entropy_hook(RAND_DRBG *drbg, unsigned char **pout,
  480. int entropy, size_t min_len, size_t max_len,
  481. int prediction_resistance)
  482. {
  483. size_t ret;
  484. HOOK_CTX *ctx = get_hook_ctx(drbg);
  485. if (ctx->fail != 0)
  486. return 0;
  487. ret = ctx->get_entropy(drbg, pout, entropy, min_len, max_len,
  488. prediction_resistance);
  489. if (ret != 0)
  490. ctx->reseed_count++;
  491. return ret;
  492. }
  493. /* Installs a hook for the get_entropy() callback of the given drbg */
  494. static void hook_drbg(RAND_DRBG *drbg, HOOK_CTX *ctx)
  495. {
  496. memset(ctx, 0, sizeof(*ctx));
  497. ctx->drbg = drbg;
  498. ctx->get_entropy = drbg->get_entropy;
  499. drbg->get_entropy = get_entropy_hook;
  500. RAND_DRBG_set_ex_data(drbg, app_data_index, ctx);
  501. }
  502. /* Installs the hook for the get_entropy() callback of the given drbg */
  503. static void unhook_drbg(RAND_DRBG *drbg)
  504. {
  505. HOOK_CTX *ctx = get_hook_ctx(drbg);
  506. drbg->get_entropy = ctx->get_entropy;
  507. CRYPTO_free_ex_data(CRYPTO_EX_INDEX_DRBG, drbg, &drbg->ex_data);
  508. }
  509. /* Resets the given hook context */
  510. static void reset_hook_ctx(HOOK_CTX *ctx)
  511. {
  512. ctx->fail = 0;
  513. ctx->reseed_count = 0;
  514. }
  515. /* Resets all drbg hook contexts */
  516. static void reset_drbg_hook_ctx(void)
  517. {
  518. reset_hook_ctx(&master_ctx);
  519. reset_hook_ctx(&public_ctx);
  520. reset_hook_ctx(&private_ctx);
  521. }
  522. /*
  523. * Generates random output using RAND_bytes() and RAND_priv_bytes()
  524. * and checks whether the three shared DRBGs were reseeded as
  525. * expected.
  526. *
  527. * |expect_success|: expected outcome (as reported by RAND_status())
  528. * |master|, |public|, |private|: pointers to the three shared DRBGs
  529. * |expect_xxx_reseed| =
  530. * 1: it is expected that the specified DRBG is reseeded
  531. * 0: it is expected that the specified DRBG is not reseeded
  532. * -1: don't check whether the specified DRBG was reseeded or not
  533. * |reseed_time|: if nonzero, used instead of time(NULL) to set the
  534. * |before_reseed| time.
  535. */
  536. static int test_drbg_reseed(int expect_success,
  537. RAND_DRBG *master,
  538. RAND_DRBG *public,
  539. RAND_DRBG *private,
  540. int expect_master_reseed,
  541. int expect_public_reseed,
  542. int expect_private_reseed,
  543. time_t reseed_time
  544. )
  545. {
  546. unsigned char buf[32];
  547. time_t before_reseed, after_reseed;
  548. int expected_state = (expect_success ? DRBG_READY : DRBG_ERROR);
  549. /*
  550. * step 1: check preconditions
  551. */
  552. /* Test whether seed propagation is enabled */
  553. if (!TEST_int_ne(master->reseed_prop_counter, 0)
  554. || !TEST_int_ne(public->reseed_prop_counter, 0)
  555. || !TEST_int_ne(private->reseed_prop_counter, 0))
  556. return 0;
  557. /* Check whether the master DRBG's reseed counter is the largest one */
  558. if (!TEST_int_le(public->reseed_prop_counter, master->reseed_prop_counter)
  559. || !TEST_int_le(private->reseed_prop_counter, master->reseed_prop_counter))
  560. return 0;
  561. /*
  562. * step 2: generate random output
  563. */
  564. if (reseed_time == 0)
  565. reseed_time = time(NULL);
  566. /* Generate random output from the public and private DRBG */
  567. before_reseed = expect_master_reseed == 1 ? reseed_time : 0;
  568. if (!TEST_int_eq(RAND_bytes(buf, sizeof(buf)), expect_success)
  569. || !TEST_int_eq(RAND_priv_bytes(buf, sizeof(buf)), expect_success))
  570. return 0;
  571. after_reseed = time(NULL);
  572. /*
  573. * step 3: check postconditions
  574. */
  575. /* Test whether reseeding succeeded as expected */
  576. if (!TEST_int_eq(master->state, expected_state)
  577. || !TEST_int_eq(public->state, expected_state)
  578. || !TEST_int_eq(private->state, expected_state))
  579. return 0;
  580. if (expect_master_reseed >= 0) {
  581. /* Test whether master DRBG was reseeded as expected */
  582. if (!TEST_int_eq(master_ctx.reseed_count, expect_master_reseed))
  583. return 0;
  584. }
  585. if (expect_public_reseed >= 0) {
  586. /* Test whether public DRBG was reseeded as expected */
  587. if (!TEST_int_eq(public_ctx.reseed_count, expect_public_reseed))
  588. return 0;
  589. }
  590. if (expect_private_reseed >= 0) {
  591. /* Test whether public DRBG was reseeded as expected */
  592. if (!TEST_int_eq(private_ctx.reseed_count, expect_private_reseed))
  593. return 0;
  594. }
  595. if (expect_success == 1) {
  596. /* Test whether all three reseed counters are synchronized */
  597. if (!TEST_int_eq(public->reseed_prop_counter, master->reseed_prop_counter)
  598. || !TEST_int_eq(private->reseed_prop_counter, master->reseed_prop_counter))
  599. return 0;
  600. /* Test whether reseed time of master DRBG is set correctly */
  601. if (!TEST_time_t_le(before_reseed, master->reseed_time)
  602. || !TEST_time_t_le(master->reseed_time, after_reseed))
  603. return 0;
  604. /* Test whether reseed times of child DRBGs are synchronized with master */
  605. if (!TEST_time_t_ge(public->reseed_time, master->reseed_time)
  606. || !TEST_time_t_ge(private->reseed_time, master->reseed_time))
  607. return 0;
  608. } else {
  609. ERR_clear_error();
  610. }
  611. return 1;
  612. }
  613. /*
  614. * Test whether the default rand_method (RAND_OpenSSL()) is
  615. * setup correctly, in particular whether reseeding works
  616. * as designed.
  617. */
  618. static int test_rand_drbg_reseed(void)
  619. {
  620. RAND_DRBG *master, *public, *private;
  621. unsigned char rand_add_buf[256];
  622. int rv=0;
  623. time_t before_reseed;
  624. /* Check whether RAND_OpenSSL() is the default method */
  625. if (!TEST_ptr_eq(RAND_get_rand_method(), RAND_OpenSSL()))
  626. return 0;
  627. /* All three DRBGs should be non-null */
  628. if (!TEST_ptr(master = RAND_DRBG_get0_master())
  629. || !TEST_ptr(public = RAND_DRBG_get0_public())
  630. || !TEST_ptr(private = RAND_DRBG_get0_private()))
  631. return 0;
  632. /* There should be three distinct DRBGs, two of them chained to master */
  633. if (!TEST_ptr_ne(public, private)
  634. || !TEST_ptr_ne(public, master)
  635. || !TEST_ptr_ne(private, master)
  636. || !TEST_ptr_eq(public->parent, master)
  637. || !TEST_ptr_eq(private->parent, master))
  638. return 0;
  639. /* Disable CRNG testing for the master DRBG */
  640. if (!TEST_true(disable_crngt(master)))
  641. return 0;
  642. /* uninstantiate the three global DRBGs */
  643. RAND_DRBG_uninstantiate(private);
  644. RAND_DRBG_uninstantiate(public);
  645. RAND_DRBG_uninstantiate(master);
  646. /* Install hooks for the following tests */
  647. hook_drbg(master, &master_ctx);
  648. hook_drbg(public, &public_ctx);
  649. hook_drbg(private, &private_ctx);
  650. /*
  651. * Test initial seeding of shared DRBGs
  652. */
  653. if (!TEST_true(test_drbg_reseed(1, master, public, private, 1, 1, 1, 0)))
  654. goto error;
  655. reset_drbg_hook_ctx();
  656. /*
  657. * Test initial state of shared DRBGs
  658. */
  659. if (!TEST_true(test_drbg_reseed(1, master, public, private, 0, 0, 0, 0)))
  660. goto error;
  661. reset_drbg_hook_ctx();
  662. /*
  663. * Test whether the public and private DRBG are both reseeded when their
  664. * reseed counters differ from the master's reseed counter.
  665. */
  666. master->reseed_prop_counter++;
  667. if (!TEST_true(test_drbg_reseed(1, master, public, private, 0, 1, 1, 0)))
  668. goto error;
  669. reset_drbg_hook_ctx();
  670. /*
  671. * Test whether the public DRBG is reseeded when its reseed counter differs
  672. * from the master's reseed counter.
  673. */
  674. master->reseed_prop_counter++;
  675. private->reseed_prop_counter++;
  676. if (!TEST_true(test_drbg_reseed(1, master, public, private, 0, 1, 0, 0)))
  677. goto error;
  678. reset_drbg_hook_ctx();
  679. /*
  680. * Test whether the private DRBG is reseeded when its reseed counter differs
  681. * from the master's reseed counter.
  682. */
  683. master->reseed_prop_counter++;
  684. public->reseed_prop_counter++;
  685. if (!TEST_true(test_drbg_reseed(1, master, public, private, 0, 0, 1, 0)))
  686. goto error;
  687. reset_drbg_hook_ctx();
  688. /* fill 'randomness' buffer with some arbitrary data */
  689. memset(rand_add_buf, 'r', sizeof(rand_add_buf));
  690. #ifndef FIPS_MODE
  691. /*
  692. * Test whether all three DRBGs are reseeded by RAND_add().
  693. * The before_reseed time has to be measured here and passed into the
  694. * test_drbg_reseed() test, because the master DRBG gets already reseeded
  695. * in RAND_add(), whence the check for the condition
  696. * before_reseed <= master->reseed_time will fail if the time value happens
  697. * to increase between the RAND_add() and the test_drbg_reseed() call.
  698. */
  699. before_reseed = time(NULL);
  700. RAND_add(rand_add_buf, sizeof(rand_add_buf), sizeof(rand_add_buf));
  701. if (!TEST_true(test_drbg_reseed(1, master, public, private, 1, 1, 1,
  702. before_reseed)))
  703. goto error;
  704. reset_drbg_hook_ctx();
  705. /*
  706. * Test whether none of the DRBGs is reseed if the master fails to reseed
  707. */
  708. master_ctx.fail = 1;
  709. master->reseed_prop_counter++;
  710. RAND_add(rand_add_buf, sizeof(rand_add_buf), sizeof(rand_add_buf));
  711. if (!TEST_true(test_drbg_reseed(0, master, public, private, 0, 0, 0, 0)))
  712. goto error;
  713. reset_drbg_hook_ctx();
  714. #else /* FIPS_MODE */
  715. /*
  716. * In FIPS mode, random data provided by the application via RAND_add()
  717. * is not considered a trusted entropy source. It is only treated as
  718. * additional_data and no reseeding is forced. This test assures that
  719. * no reseeding occurs.
  720. */
  721. before_reseed = time(NULL);
  722. RAND_add(rand_add_buf, sizeof(rand_add_buf), sizeof(rand_add_buf));
  723. if (!TEST_true(test_drbg_reseed(1, master, public, private, 0, 0, 0,
  724. before_reseed)))
  725. goto error;
  726. reset_drbg_hook_ctx();
  727. #endif
  728. rv = 1;
  729. error:
  730. /* Remove hooks */
  731. unhook_drbg(master);
  732. unhook_drbg(public);
  733. unhook_drbg(private);
  734. return rv;
  735. }
  736. #if defined(OPENSSL_THREADS)
  737. static int multi_thread_rand_bytes_succeeded = 1;
  738. static int multi_thread_rand_priv_bytes_succeeded = 1;
  739. static void run_multi_thread_test(void)
  740. {
  741. unsigned char buf[256];
  742. time_t start = time(NULL);
  743. RAND_DRBG *public = NULL, *private = NULL;
  744. if (!TEST_ptr(public = RAND_DRBG_get0_public())
  745. || !TEST_ptr(private = RAND_DRBG_get0_private())) {
  746. multi_thread_rand_bytes_succeeded = 0;
  747. return;
  748. }
  749. RAND_DRBG_set_reseed_time_interval(private, 1);
  750. RAND_DRBG_set_reseed_time_interval(public, 1);
  751. do {
  752. if (RAND_bytes(buf, sizeof(buf)) <= 0)
  753. multi_thread_rand_bytes_succeeded = 0;
  754. if (RAND_priv_bytes(buf, sizeof(buf)) <= 0)
  755. multi_thread_rand_priv_bytes_succeeded = 0;
  756. }
  757. while(time(NULL) - start < 5);
  758. }
  759. # if defined(OPENSSL_SYS_WINDOWS)
  760. typedef HANDLE thread_t;
  761. static DWORD WINAPI thread_run(LPVOID arg)
  762. {
  763. run_multi_thread_test();
  764. /*
  765. * Because we're linking with a static library, we must stop each
  766. * thread explicitly, or so says OPENSSL_thread_stop(3)
  767. */
  768. OPENSSL_thread_stop();
  769. return 0;
  770. }
  771. static int run_thread(thread_t *t)
  772. {
  773. *t = CreateThread(NULL, 0, thread_run, NULL, 0, NULL);
  774. return *t != NULL;
  775. }
  776. static int wait_for_thread(thread_t thread)
  777. {
  778. return WaitForSingleObject(thread, INFINITE) == 0;
  779. }
  780. # else
  781. typedef pthread_t thread_t;
  782. static void *thread_run(void *arg)
  783. {
  784. run_multi_thread_test();
  785. /*
  786. * Because we're linking with a static library, we must stop each
  787. * thread explicitly, or so says OPENSSL_thread_stop(3)
  788. */
  789. OPENSSL_thread_stop();
  790. return NULL;
  791. }
  792. static int run_thread(thread_t *t)
  793. {
  794. return pthread_create(t, NULL, thread_run, NULL) == 0;
  795. }
  796. static int wait_for_thread(thread_t thread)
  797. {
  798. return pthread_join(thread, NULL) == 0;
  799. }
  800. # endif
  801. /*
  802. * The main thread will also run the test, so we'll have THREADS+1 parallel
  803. * tests running
  804. */
  805. # define THREADS 3
  806. static int test_multi_thread(void)
  807. {
  808. thread_t t[THREADS];
  809. int i;
  810. for (i = 0; i < THREADS; i++)
  811. run_thread(&t[i]);
  812. run_multi_thread_test();
  813. for (i = 0; i < THREADS; i++)
  814. wait_for_thread(t[i]);
  815. if (!TEST_true(multi_thread_rand_bytes_succeeded))
  816. return 0;
  817. if (!TEST_true(multi_thread_rand_priv_bytes_succeeded))
  818. return 0;
  819. return 1;
  820. }
  821. #endif
  822. /*
  823. * Test that instantiation with RAND_seed() works as expected
  824. *
  825. * If no os entropy source is available then RAND_seed(buffer, bufsize)
  826. * is expected to succeed if and only if the buffer length is at least
  827. * rand_drbg_seedlen(master) bytes.
  828. *
  829. * If an os entropy source is available then RAND_seed(buffer, bufsize)
  830. * is expected to succeed always.
  831. */
  832. static int test_rand_seed(void)
  833. {
  834. RAND_DRBG *master = NULL;
  835. unsigned char rand_buf[256];
  836. size_t rand_buflen;
  837. size_t required_seed_buflen = 0;
  838. if (!TEST_ptr(master = RAND_DRBG_get0_master())
  839. || !TEST_true(disable_crngt(master)))
  840. return 0;
  841. #ifdef OPENSSL_RAND_SEED_NONE
  842. required_seed_buflen = rand_drbg_seedlen(master);
  843. #endif
  844. memset(rand_buf, 0xCD, sizeof(rand_buf));
  845. for ( rand_buflen = 256 ; rand_buflen > 0 ; --rand_buflen ) {
  846. RAND_DRBG_uninstantiate(master);
  847. RAND_seed(rand_buf, rand_buflen);
  848. if (!TEST_int_eq(RAND_status(),
  849. (rand_buflen >= required_seed_buflen)))
  850. return 0;
  851. }
  852. return 1;
  853. }
  854. /*
  855. * Test that adding additional data with RAND_add() works as expected
  856. * when the master DRBG is instantiated (and below its reseed limit).
  857. *
  858. * This should succeed regardless of whether an os entropy source is
  859. * available or not.
  860. */
  861. static int test_rand_add(void)
  862. {
  863. unsigned char rand_buf[256];
  864. size_t rand_buflen;
  865. memset(rand_buf, 0xCD, sizeof(rand_buf));
  866. /* make sure it's instantiated */
  867. RAND_seed(rand_buf, sizeof(rand_buf));
  868. if (!TEST_true(RAND_status()))
  869. return 0;
  870. for ( rand_buflen = 256 ; rand_buflen > 0 ; --rand_buflen ) {
  871. RAND_add(rand_buf, rand_buflen, 0.0);
  872. if (!TEST_true(RAND_status()))
  873. return 0;
  874. }
  875. return 1;
  876. }
  877. static int test_rand_drbg_prediction_resistance(void)
  878. {
  879. RAND_DRBG *m = NULL, *i = NULL, *s = NULL;
  880. unsigned char buf1[51], buf2[sizeof(buf1)];
  881. int ret = 0, mreseed, ireseed, sreseed;
  882. /* Initialise a three long DRBG chain */
  883. if (!TEST_ptr(m = RAND_DRBG_new(0, 0, NULL))
  884. || !TEST_true(disable_crngt(m))
  885. || !TEST_true(RAND_DRBG_instantiate(m, NULL, 0))
  886. || !TEST_ptr(i = RAND_DRBG_new(0, 0, m))
  887. || !TEST_true(RAND_DRBG_instantiate(i, NULL, 0))
  888. || !TEST_ptr(s = RAND_DRBG_new(0, 0, i))
  889. || !TEST_true(RAND_DRBG_instantiate(s, NULL, 0)))
  890. goto err;
  891. /* During a normal reseed, only the slave DRBG should be reseed */
  892. mreseed = ++m->reseed_prop_counter;
  893. ireseed = ++i->reseed_prop_counter;
  894. sreseed = s->reseed_prop_counter;
  895. if (!TEST_true(RAND_DRBG_reseed(s, NULL, 0, 0))
  896. || !TEST_int_eq(m->reseed_prop_counter, mreseed)
  897. || !TEST_int_eq(i->reseed_prop_counter, ireseed)
  898. || !TEST_int_gt(s->reseed_prop_counter, sreseed))
  899. goto err;
  900. /*
  901. * When prediction resistance is requested, the request should be
  902. * propagated to the master, so that the entire DRBG chain reseeds.
  903. */
  904. sreseed = s->reseed_prop_counter;
  905. if (!TEST_true(RAND_DRBG_reseed(s, NULL, 0, 1))
  906. || !TEST_int_gt(m->reseed_prop_counter, mreseed)
  907. || !TEST_int_gt(i->reseed_prop_counter, ireseed)
  908. || !TEST_int_gt(s->reseed_prop_counter, sreseed))
  909. goto err;
  910. /* During a normal generate, only the slave DRBG should be reseed */
  911. mreseed = ++m->reseed_prop_counter;
  912. ireseed = ++i->reseed_prop_counter;
  913. sreseed = s->reseed_prop_counter;
  914. if (!TEST_true(RAND_DRBG_generate(s, buf1, sizeof(buf1), 0, NULL, 0))
  915. || !TEST_int_eq(m->reseed_prop_counter, mreseed)
  916. || !TEST_int_eq(i->reseed_prop_counter, ireseed)
  917. || !TEST_int_gt(s->reseed_prop_counter, sreseed))
  918. goto err;
  919. /*
  920. * When a prediction resistant generate is requested, the request
  921. * should be propagated to the master, reseeding the entire DRBG chain.
  922. */
  923. sreseed = s->reseed_prop_counter;
  924. if (!TEST_true(RAND_DRBG_generate(s, buf2, sizeof(buf2), 1, NULL, 0))
  925. || !TEST_int_gt(m->reseed_prop_counter, mreseed)
  926. || !TEST_int_gt(i->reseed_prop_counter, ireseed)
  927. || !TEST_int_gt(s->reseed_prop_counter, sreseed)
  928. || !TEST_mem_ne(buf1, sizeof(buf1), buf2, sizeof(buf2)))
  929. goto err;
  930. /* Verify that a normal reseed still only reseeds the slave DRBG */
  931. mreseed = ++m->reseed_prop_counter;
  932. ireseed = ++i->reseed_prop_counter;
  933. sreseed = s->reseed_prop_counter;
  934. if (!TEST_true(RAND_DRBG_reseed(s, NULL, 0, 0))
  935. || !TEST_int_eq(m->reseed_prop_counter, mreseed)
  936. || !TEST_int_eq(i->reseed_prop_counter, ireseed)
  937. || !TEST_int_gt(s->reseed_prop_counter, sreseed))
  938. goto err;
  939. ret = 1;
  940. err:
  941. RAND_DRBG_free(s);
  942. RAND_DRBG_free(i);
  943. RAND_DRBG_free(m);
  944. return ret;
  945. }
  946. static int test_multi_set(void)
  947. {
  948. int rv = 0;
  949. RAND_DRBG *drbg = NULL;
  950. /* init drbg with default CTR initializer */
  951. if (!TEST_ptr(drbg = RAND_DRBG_new(0, 0, NULL))
  952. || !TEST_true(disable_crngt(drbg)))
  953. goto err;
  954. /* change it to use hmac */
  955. if (!TEST_true(RAND_DRBG_set(drbg, NID_sha1, RAND_DRBG_FLAG_HMAC)))
  956. goto err;
  957. /* use same type */
  958. if (!TEST_true(RAND_DRBG_set(drbg, NID_sha1, RAND_DRBG_FLAG_HMAC)))
  959. goto err;
  960. /* change it to use hash */
  961. if (!TEST_true(RAND_DRBG_set(drbg, NID_sha256, 0)))
  962. goto err;
  963. /* use same type */
  964. if (!TEST_true(RAND_DRBG_set(drbg, NID_sha256, 0)))
  965. goto err;
  966. /* change it to use ctr */
  967. if (!TEST_true(RAND_DRBG_set(drbg, NID_aes_192_ctr, 0)))
  968. goto err;
  969. /* use same type */
  970. if (!TEST_true(RAND_DRBG_set(drbg, NID_aes_192_ctr, 0)))
  971. goto err;
  972. if (!TEST_int_gt(RAND_DRBG_instantiate(drbg, NULL, 0), 0))
  973. goto err;
  974. rv = 1;
  975. err:
  976. uninstantiate(drbg);
  977. RAND_DRBG_free(drbg);
  978. return rv;
  979. }
  980. static int test_set_defaults(void)
  981. {
  982. RAND_DRBG *master = NULL, *public = NULL, *private = NULL;
  983. /* Check the default type and flags for master, public and private */
  984. return TEST_ptr(master = RAND_DRBG_get0_master())
  985. && TEST_ptr(public = RAND_DRBG_get0_public())
  986. && TEST_ptr(private = RAND_DRBG_get0_private())
  987. && TEST_int_eq(master->type, RAND_DRBG_TYPE)
  988. && TEST_int_eq(master->flags,
  989. RAND_DRBG_FLAGS | RAND_DRBG_FLAG_MASTER)
  990. && TEST_int_eq(public->type, RAND_DRBG_TYPE)
  991. && TEST_int_eq(public->flags,
  992. RAND_DRBG_FLAGS | RAND_DRBG_FLAG_PUBLIC)
  993. && TEST_int_eq(private->type, RAND_DRBG_TYPE)
  994. && TEST_int_eq(private->flags,
  995. RAND_DRBG_FLAGS | RAND_DRBG_FLAG_PRIVATE)
  996. /* change master DRBG and check again */
  997. && TEST_true(RAND_DRBG_set_defaults(NID_sha256,
  998. RAND_DRBG_FLAG_MASTER))
  999. && TEST_true(RAND_DRBG_uninstantiate(master))
  1000. && TEST_int_eq(master->type, NID_sha256)
  1001. && TEST_int_eq(master->flags, RAND_DRBG_FLAG_MASTER)
  1002. && TEST_int_eq(public->type, RAND_DRBG_TYPE)
  1003. && TEST_int_eq(public->flags,
  1004. RAND_DRBG_FLAGS | RAND_DRBG_FLAG_PUBLIC)
  1005. && TEST_int_eq(private->type, RAND_DRBG_TYPE)
  1006. && TEST_int_eq(private->flags,
  1007. RAND_DRBG_FLAGS | RAND_DRBG_FLAG_PRIVATE)
  1008. /* change private DRBG and check again */
  1009. && TEST_true(RAND_DRBG_set_defaults(NID_sha256,
  1010. RAND_DRBG_FLAG_PRIVATE|RAND_DRBG_FLAG_HMAC))
  1011. && TEST_true(RAND_DRBG_uninstantiate(private))
  1012. && TEST_int_eq(master->type, NID_sha256)
  1013. && TEST_int_eq(master->flags, RAND_DRBG_FLAG_MASTER)
  1014. && TEST_int_eq(public->type, RAND_DRBG_TYPE)
  1015. && TEST_int_eq(public->flags,
  1016. RAND_DRBG_FLAGS | RAND_DRBG_FLAG_PUBLIC)
  1017. && TEST_int_eq(private->type, NID_sha256)
  1018. && TEST_int_eq(private->flags,
  1019. RAND_DRBG_FLAG_PRIVATE | RAND_DRBG_FLAG_HMAC)
  1020. /* change public DRBG and check again */
  1021. && TEST_true(RAND_DRBG_set_defaults(NID_sha1,
  1022. RAND_DRBG_FLAG_PUBLIC
  1023. | RAND_DRBG_FLAG_HMAC))
  1024. && TEST_true(RAND_DRBG_uninstantiate(public))
  1025. && TEST_int_eq(master->type, NID_sha256)
  1026. && TEST_int_eq(master->flags, RAND_DRBG_FLAG_MASTER)
  1027. && TEST_int_eq(public->type, NID_sha1)
  1028. && TEST_int_eq(public->flags,
  1029. RAND_DRBG_FLAG_PUBLIC | RAND_DRBG_FLAG_HMAC)
  1030. && TEST_int_eq(private->type, NID_sha256)
  1031. && TEST_int_eq(private->flags,
  1032. RAND_DRBG_FLAG_PRIVATE | RAND_DRBG_FLAG_HMAC)
  1033. /* Change DRBG defaults and change public and check again */
  1034. && TEST_true(RAND_DRBG_set_defaults(NID_sha256, 0))
  1035. && TEST_true(RAND_DRBG_uninstantiate(public))
  1036. && TEST_int_eq(public->type, NID_sha256)
  1037. && TEST_int_eq(public->flags, RAND_DRBG_FLAG_PUBLIC)
  1038. /* FIPS mode doesn't support CTR DRBG without a derivation function */
  1039. #ifndef FIPS_MODE
  1040. /* Change DRBG defaults and change master and check again */
  1041. && TEST_true(RAND_DRBG_set_defaults(NID_aes_256_ctr,
  1042. RAND_DRBG_FLAG_CTR_NO_DF))
  1043. && TEST_true(RAND_DRBG_uninstantiate(master))
  1044. && TEST_int_eq(master->type, NID_aes_256_ctr)
  1045. && TEST_int_eq(master->flags,
  1046. RAND_DRBG_FLAG_MASTER|RAND_DRBG_FLAG_CTR_NO_DF)
  1047. #endif
  1048. /* Reset back to the standard defaults */
  1049. && TEST_true(RAND_DRBG_set_defaults(RAND_DRBG_TYPE,
  1050. RAND_DRBG_FLAGS
  1051. | RAND_DRBG_FLAG_MASTER
  1052. | RAND_DRBG_FLAG_PUBLIC
  1053. | RAND_DRBG_FLAG_PRIVATE))
  1054. && TEST_true(RAND_DRBG_uninstantiate(master))
  1055. && TEST_true(RAND_DRBG_uninstantiate(public))
  1056. && TEST_true(RAND_DRBG_uninstantiate(private));
  1057. }
  1058. /*
  1059. * A list of the FIPS DRGB types.
  1060. * Because of the way HMAC DRGBs are implemented, both the NID and flags
  1061. * are required.
  1062. */
  1063. static const struct s_drgb_types {
  1064. int nid;
  1065. int flags;
  1066. } drgb_types[] = {
  1067. { NID_aes_128_ctr, 0 },
  1068. { NID_aes_192_ctr, 0 },
  1069. { NID_aes_256_ctr, 0 },
  1070. { NID_sha1, 0 },
  1071. { NID_sha224, 0 },
  1072. { NID_sha256, 0 },
  1073. { NID_sha384, 0 },
  1074. { NID_sha512, 0 },
  1075. { NID_sha512_224, 0 },
  1076. { NID_sha512_256, 0 },
  1077. { NID_sha3_224, 0 },
  1078. { NID_sha3_256, 0 },
  1079. { NID_sha3_384, 0 },
  1080. { NID_sha3_512, 0 },
  1081. { NID_sha1, RAND_DRBG_FLAG_HMAC },
  1082. { NID_sha224, RAND_DRBG_FLAG_HMAC },
  1083. { NID_sha256, RAND_DRBG_FLAG_HMAC },
  1084. { NID_sha384, RAND_DRBG_FLAG_HMAC },
  1085. { NID_sha512, RAND_DRBG_FLAG_HMAC },
  1086. { NID_sha512_224, RAND_DRBG_FLAG_HMAC },
  1087. { NID_sha512_256, RAND_DRBG_FLAG_HMAC },
  1088. { NID_sha3_224, RAND_DRBG_FLAG_HMAC },
  1089. { NID_sha3_256, RAND_DRBG_FLAG_HMAC },
  1090. { NID_sha3_384, RAND_DRBG_FLAG_HMAC },
  1091. { NID_sha3_512, RAND_DRBG_FLAG_HMAC },
  1092. };
  1093. /* Six cases for each covers seed sizes up to 32 bytes */
  1094. static const size_t crngt_num_cases = 6;
  1095. static size_t crngt_case, crngt_idx;
  1096. static int crngt_entropy_cb(OPENSSL_CTX *ctx, RAND_POOL *pool,
  1097. unsigned char *buf, unsigned char *md,
  1098. unsigned int *md_size)
  1099. {
  1100. size_t i, z;
  1101. if (!TEST_int_lt(crngt_idx, crngt_num_cases))
  1102. return 0;
  1103. /* Generate a block of unique data unless this is the duplication point */
  1104. z = crngt_idx++;
  1105. if (z > 0 && crngt_case == z)
  1106. z--;
  1107. for (i = 0; i < CRNGT_BUFSIZ; i++)
  1108. buf[i] = (unsigned char)(i + 'A' + z);
  1109. return EVP_Digest(buf, CRNGT_BUFSIZ, md, md_size, EVP_sha256(), NULL);
  1110. }
  1111. static int test_crngt(int n)
  1112. {
  1113. const struct s_drgb_types *dt = drgb_types + n / crngt_num_cases;
  1114. RAND_DRBG *drbg = NULL;
  1115. unsigned char buff[100];
  1116. size_t ent;
  1117. int res = 0;
  1118. int expect;
  1119. OPENSSL_CTX *ctx = OPENSSL_CTX_new();
  1120. if (!TEST_ptr(ctx))
  1121. return 0;
  1122. if (!TEST_ptr(drbg = RAND_DRBG_new_ex(ctx, dt->nid, dt->flags, NULL)))
  1123. goto err;
  1124. ent = (drbg->min_entropylen + CRNGT_BUFSIZ - 1) / CRNGT_BUFSIZ;
  1125. crngt_case = n % crngt_num_cases;
  1126. crngt_idx = 0;
  1127. crngt_get_entropy = &crngt_entropy_cb;
  1128. #ifndef FIPS_MODE
  1129. if (!TEST_true(RAND_DRBG_set_callbacks(drbg, &rand_crngt_get_entropy,
  1130. &rand_crngt_cleanup_entropy,
  1131. &rand_drbg_get_nonce,
  1132. &rand_drbg_cleanup_nonce)))
  1133. goto err;
  1134. #endif
  1135. expect = crngt_case == 0 || crngt_case > ent;
  1136. if (!TEST_int_eq(RAND_DRBG_instantiate(drbg, NULL, 0), expect))
  1137. goto err;
  1138. if (!expect)
  1139. goto fin;
  1140. if (!TEST_true(RAND_DRBG_generate(drbg, buff, sizeof(buff), 0, NULL, 0)))
  1141. goto err;
  1142. expect = crngt_case == 0 || crngt_case > 2 * ent;
  1143. if (!TEST_int_eq(RAND_DRBG_reseed(drbg, NULL, 0, 0), expect))
  1144. goto err;
  1145. if (!expect)
  1146. goto fin;
  1147. if (!TEST_true(RAND_DRBG_generate(drbg, buff, sizeof(buff), 0, NULL, 0)))
  1148. goto err;
  1149. fin:
  1150. res = 1;
  1151. err:
  1152. if (!res)
  1153. TEST_note("DRBG %zd case %zd block %zd", n / crngt_num_cases,
  1154. crngt_case, crngt_idx);
  1155. uninstantiate(drbg);
  1156. RAND_DRBG_free(drbg);
  1157. crngt_get_entropy = &rand_crngt_get_entropy_cb;
  1158. OPENSSL_CTX_free(ctx);
  1159. return res;
  1160. }
  1161. int setup_tests(void)
  1162. {
  1163. app_data_index = RAND_DRBG_get_ex_new_index(0L, NULL, NULL, NULL, NULL);
  1164. ADD_ALL_TESTS(test_kats, OSSL_NELEM(drbg_test));
  1165. ADD_ALL_TESTS(test_error_checks, OSSL_NELEM(drbg_test));
  1166. ADD_TEST(test_rand_drbg_reseed);
  1167. ADD_TEST(test_rand_seed);
  1168. ADD_TEST(test_rand_add);
  1169. ADD_TEST(test_rand_drbg_prediction_resistance);
  1170. ADD_TEST(test_multi_set);
  1171. ADD_TEST(test_set_defaults);
  1172. #if defined(OPENSSL_THREADS)
  1173. ADD_TEST(test_multi_thread);
  1174. #endif
  1175. ADD_ALL_TESTS(test_crngt, crngt_num_cases * OSSL_NELEM(drgb_types));
  1176. return 1;
  1177. }