1/*
2 * Copyright 2011-2018 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10#include <string.h>
11#include <openssl/crypto.h>
12#include <openssl/err.h>
13#include <openssl/rand.h>
14#include "rand_local.h"
15#include "internal/thread_once.h"
16#include "crypto/rand.h"
17#include "crypto/cryptlib.h"
18
19/*
20 * Support framework for NIST SP 800-90A DRBG
21 *
22 * See manual page RAND_DRBG(7) for a general overview.
23 *
24 * The OpenSSL model is to have new and free functions, and that new
25 * does all initialization. That is not the NIST model, which has
26 * instantiation and un-instantiate, and re-use within a new/free
27 * lifecycle. (No doubt this comes from the desire to support hardware
28 * DRBG, where allocation of resources on something like an HSM is
29 * a much bigger deal than just re-setting an allocated resource.)
30 */
31
32
33typedef struct drbg_global_st {
34 /*
35 * The three shared DRBG instances
36 *
37 * There are three shared DRBG instances: <master>, <public>, and <private>.
38 */
39
40 /*
41 * The <master> DRBG
42 *
43 * Not used directly by the application, only for reseeding the two other
44 * DRBGs. It reseeds itself by pulling either randomness from os entropy
45 * sources or by consuming randomness which was added by RAND_add().
46 *
47 * The <master> DRBG is a global instance which is accessed concurrently by
48 * all threads. The necessary locking is managed automatically by its child
49 * DRBG instances during reseeding.
50 */
51 RAND_DRBG *master_drbg;
52 /*
53 * The <public> DRBG
54 *
55 * Used by default for generating random bytes using RAND_bytes().
56 *
57 * The <public> DRBG is thread-local, i.e., there is one instance per
58 * thread.
59 */
60 CRYPTO_THREAD_LOCAL public_drbg;
61 /*
62 * The <private> DRBG
63 *
64 * Used by default for generating private keys using RAND_priv_bytes()
65 *
66 * The <private> DRBG is thread-local, i.e., there is one instance per
67 * thread.
68 */
69 CRYPTO_THREAD_LOCAL private_drbg;
70} DRBG_GLOBAL;
71
72typedef struct drbg_nonce_global_st {
73 CRYPTO_RWLOCK *rand_nonce_lock;
74 int rand_nonce_count;
75} DRBG_NONCE_GLOBAL;
76
77/* NIST SP 800-90A DRBG recommends the use of a personalization string. */
78static const char ossl_pers_string[] = DRBG_DEFAULT_PERS_STRING;
79
80#define RAND_DRBG_TYPE_FLAGS ( \
81 RAND_DRBG_FLAG_MASTER | RAND_DRBG_FLAG_PUBLIC | RAND_DRBG_FLAG_PRIVATE )
82
83#define RAND_DRBG_TYPE_MASTER 0
84#define RAND_DRBG_TYPE_PUBLIC 1
85#define RAND_DRBG_TYPE_PRIVATE 2
86
87/* Defaults */
88static int rand_drbg_type[3] = {
89 RAND_DRBG_TYPE, /* Master */
90 RAND_DRBG_TYPE, /* Public */
91 RAND_DRBG_TYPE /* Private */
92};
93static unsigned int rand_drbg_flags[3] = {
94 RAND_DRBG_FLAGS | RAND_DRBG_FLAG_MASTER, /* Master */
95 RAND_DRBG_FLAGS | RAND_DRBG_FLAG_PUBLIC, /* Public */
96 RAND_DRBG_FLAGS | RAND_DRBG_FLAG_PRIVATE /* Private */
97};
98
99static unsigned int master_reseed_interval = MASTER_RESEED_INTERVAL;
100static unsigned int slave_reseed_interval = SLAVE_RESEED_INTERVAL;
101
102static time_t master_reseed_time_interval = MASTER_RESEED_TIME_INTERVAL;
103static time_t slave_reseed_time_interval = SLAVE_RESEED_TIME_INTERVAL;
104
105/* A logical OR of all used DRBG flag bits (currently there is only one) */
106static const unsigned int rand_drbg_used_flags =
107 RAND_DRBG_FLAG_CTR_NO_DF | RAND_DRBG_FLAG_HMAC | RAND_DRBG_TYPE_FLAGS;
108
109
110static RAND_DRBG *drbg_setup(OPENSSL_CTX *ctx, RAND_DRBG *parent, int drbg_type);
111
112static RAND_DRBG *rand_drbg_new(OPENSSL_CTX *ctx,
113 int secure,
114 int type,
115 unsigned int flags,
116 RAND_DRBG *parent);
117
118static int is_ctr(int type)
119{
120 switch (type) {
121 case NID_aes_128_ctr:
122 case NID_aes_192_ctr:
123 case NID_aes_256_ctr:
124 return 1;
125 default:
126 return 0;
127 }
128}
129
130static int is_digest(int type)
131{
132 switch (type) {
133 case NID_sha1:
134 case NID_sha224:
135 case NID_sha256:
136 case NID_sha384:
137 case NID_sha512:
138 case NID_sha512_224:
139 case NID_sha512_256:
140 case NID_sha3_224:
141 case NID_sha3_256:
142 case NID_sha3_384:
143 case NID_sha3_512:
144 return 1;
145 default:
146 return 0;
147 }
148}
149
150/*
151 * Initialize the OPENSSL_CTX global DRBGs on first use.
152 * Returns the allocated global data on success or NULL on failure.
153 */
154static void *drbg_ossl_ctx_new(OPENSSL_CTX *libctx)
155{
156 DRBG_GLOBAL *dgbl = OPENSSL_zalloc(sizeof(*dgbl));
157
158 if (dgbl == NULL)
159 return NULL;
160
161#ifndef FIPS_MODE
162 /*
163 * We need to ensure that base libcrypto thread handling has been
164 * initialised.
165 */
166 OPENSSL_init_crypto(0, NULL);
167#endif
168
169 if (!CRYPTO_THREAD_init_local(&dgbl->private_drbg, NULL))
170 goto err1;
171
172 if (!CRYPTO_THREAD_init_local(&dgbl->public_drbg, NULL))
173 goto err2;
174
175 dgbl->master_drbg = drbg_setup(libctx, NULL, RAND_DRBG_TYPE_MASTER);
176 if (dgbl->master_drbg == NULL)
177 goto err3;
178
179 return dgbl;
180
181 err3:
182 CRYPTO_THREAD_cleanup_local(&dgbl->public_drbg);
183 err2:
184 CRYPTO_THREAD_cleanup_local(&dgbl->private_drbg);
185 err1:
186 OPENSSL_free(dgbl);
187 return NULL;
188}
189
190static void drbg_ossl_ctx_free(void *vdgbl)
191{
192 DRBG_GLOBAL *dgbl = vdgbl;
193
194 if (dgbl == NULL)
195 return;
196
197 RAND_DRBG_free(dgbl->master_drbg);
198 CRYPTO_THREAD_cleanup_local(&dgbl->private_drbg);
199 CRYPTO_THREAD_cleanup_local(&dgbl->public_drbg);
200
201 OPENSSL_free(dgbl);
202}
203
204static const OPENSSL_CTX_METHOD drbg_ossl_ctx_method = {
205 drbg_ossl_ctx_new,
206 drbg_ossl_ctx_free,
207};
208
209/*
210 * drbg_ossl_ctx_new() calls drgb_setup() which calls rand_drbg_get_nonce()
211 * which needs to get the rand_nonce_lock out of the OPENSSL_CTX...but since
212 * drbg_ossl_ctx_new() hasn't finished running yet we need the rand_nonce_lock
213 * to be in a different global data object. Otherwise we will go into an
214 * infinite recursion loop.
215 */
216static void *drbg_nonce_ossl_ctx_new(OPENSSL_CTX *libctx)
217{
218 DRBG_NONCE_GLOBAL *dngbl = OPENSSL_zalloc(sizeof(*dngbl));
219
220 if (dngbl == NULL)
221 return NULL;
222
223 dngbl->rand_nonce_lock = CRYPTO_THREAD_lock_new();
224 if (dngbl->rand_nonce_lock == NULL) {
225 OPENSSL_free(dngbl);
226 return NULL;
227 }
228
229 return dngbl;
230}
231
232static void drbg_nonce_ossl_ctx_free(void *vdngbl)
233{
234 DRBG_NONCE_GLOBAL *dngbl = vdngbl;
235
236 if (dngbl == NULL)
237 return;
238
239 CRYPTO_THREAD_lock_free(dngbl->rand_nonce_lock);
240
241 OPENSSL_free(dngbl);
242}
243
244static const OPENSSL_CTX_METHOD drbg_nonce_ossl_ctx_method = {
245 drbg_nonce_ossl_ctx_new,
246 drbg_nonce_ossl_ctx_free,
247};
248
249static DRBG_GLOBAL *drbg_get_global(OPENSSL_CTX *libctx)
250{
251 return openssl_ctx_get_data(libctx, OPENSSL_CTX_DRBG_INDEX,
252 &drbg_ossl_ctx_method);
253}
254
255/* Implements the get_nonce() callback (see RAND_DRBG_set_callbacks()) */
256size_t rand_drbg_get_nonce(RAND_DRBG *drbg,
257 unsigned char **pout,
258 int entropy, size_t min_len, size_t max_len)
259{
260 size_t ret = 0;
261 RAND_POOL *pool;
262 DRBG_NONCE_GLOBAL *dngbl
263 = openssl_ctx_get_data(drbg->libctx, OPENSSL_CTX_DRBG_NONCE_INDEX,
264 &drbg_nonce_ossl_ctx_method);
265 struct {
266 void *instance;
267 int count;
268 } data;
269
270 if (dngbl == NULL)
271 return 0;
272
273 memset(&data, 0, sizeof(data));
274 pool = rand_pool_new(0, 0, min_len, max_len);
275 if (pool == NULL)
276 return 0;
277
278 if (rand_pool_add_nonce_data(pool) == 0)
279 goto err;
280
281 data.instance = drbg;
282 CRYPTO_atomic_add(&dngbl->rand_nonce_count, 1, &data.count,
283 dngbl->rand_nonce_lock);
284
285 if (rand_pool_add(pool, (unsigned char *)&data, sizeof(data), 0) == 0)
286 goto err;
287
288 ret = rand_pool_length(pool);
289 *pout = rand_pool_detach(pool);
290
291 err:
292 rand_pool_free(pool);
293
294 return ret;
295}
296
297/*
298 * Implements the cleanup_nonce() callback (see RAND_DRBG_set_callbacks())
299 *
300 */
301void rand_drbg_cleanup_nonce(RAND_DRBG *drbg,
302 unsigned char *out, size_t outlen)
303{
304 OPENSSL_clear_free(out, outlen);
305}
306
307/*
308 * Set/initialize |drbg| to be of type |type|, with optional |flags|.
309 *
310 * If |type| and |flags| are zero, use the defaults
311 *
312 * Returns 1 on success, 0 on failure.
313 */
314int RAND_DRBG_set(RAND_DRBG *drbg, int type, unsigned int flags)
315{
316 int ret = 1;
317
318 if (type == 0 && flags == 0) {
319 type = rand_drbg_type[RAND_DRBG_TYPE_MASTER];
320 flags = rand_drbg_flags[RAND_DRBG_TYPE_MASTER];
321 }
322
323 /* If set is called multiple times - clear the old one */
324 if (drbg->type != 0 && (type != drbg->type || flags != drbg->flags)) {
325 drbg->meth->uninstantiate(drbg);
326 rand_pool_free(drbg->adin_pool);
327 drbg->adin_pool = NULL;
328 }
329
330 drbg->state = DRBG_UNINITIALISED;
331 drbg->flags = flags;
332 drbg->type = type;
333
334 if (type == 0) {
335 /* Uninitialized; that's okay. */
336 drbg->meth = NULL;
337 return 1;
338 } else if (is_ctr(type)) {
339 ret = drbg_ctr_init(drbg);
340 } else if (is_digest(type)) {
341 if (flags & RAND_DRBG_FLAG_HMAC)
342 ret = drbg_hmac_init(drbg);
343 else
344 ret = drbg_hash_init(drbg);
345 } else {
346 drbg->type = 0;
347 drbg->flags = 0;
348 drbg->meth = NULL;
349 RANDerr(RAND_F_RAND_DRBG_SET, RAND_R_UNSUPPORTED_DRBG_TYPE);
350 return 0;
351 }
352
353 if (ret == 0) {
354 drbg->state = DRBG_ERROR;
355 RANDerr(RAND_F_RAND_DRBG_SET, RAND_R_ERROR_INITIALISING_DRBG);
356 }
357 return ret;
358}
359
360/*
361 * Set/initialize default |type| and |flag| for new drbg instances.
362 *
363 * Returns 1 on success, 0 on failure.
364 */
365int RAND_DRBG_set_defaults(int type, unsigned int flags)
366{
367 int all;
368 if (!(is_digest(type) || is_ctr(type))) {
369 RANDerr(RAND_F_RAND_DRBG_SET_DEFAULTS, RAND_R_UNSUPPORTED_DRBG_TYPE);
370 return 0;
371 }
372
373 if ((flags & ~rand_drbg_used_flags) != 0) {
374 RANDerr(RAND_F_RAND_DRBG_SET_DEFAULTS, RAND_R_UNSUPPORTED_DRBG_FLAGS);
375 return 0;
376 }
377
378 all = ((flags & RAND_DRBG_TYPE_FLAGS) == 0);
379 if (all || (flags & RAND_DRBG_FLAG_MASTER) != 0) {
380 rand_drbg_type[RAND_DRBG_TYPE_MASTER] = type;
381 rand_drbg_flags[RAND_DRBG_TYPE_MASTER] = flags | RAND_DRBG_FLAG_MASTER;
382 }
383 if (all || (flags & RAND_DRBG_FLAG_PUBLIC) != 0) {
384 rand_drbg_type[RAND_DRBG_TYPE_PUBLIC] = type;
385 rand_drbg_flags[RAND_DRBG_TYPE_PUBLIC] = flags | RAND_DRBG_FLAG_PUBLIC;
386 }
387 if (all || (flags & RAND_DRBG_FLAG_PRIVATE) != 0) {
388 rand_drbg_type[RAND_DRBG_TYPE_PRIVATE] = type;
389 rand_drbg_flags[RAND_DRBG_TYPE_PRIVATE] = flags | RAND_DRBG_FLAG_PRIVATE;
390 }
391 return 1;
392}
393
394
395/*
396 * Allocate memory and initialize a new DRBG. The DRBG is allocated on
397 * the secure heap if |secure| is nonzero and the secure heap is enabled.
398 * The |parent|, if not NULL, will be used as random source for reseeding.
399 *
400 * Returns a pointer to the new DRBG instance on success, NULL on failure.
401 */
402static RAND_DRBG *rand_drbg_new(OPENSSL_CTX *ctx,
403 int secure,
404 int type,
405 unsigned int flags,
406 RAND_DRBG *parent)
407{
408 RAND_DRBG *drbg = secure ? OPENSSL_secure_zalloc(sizeof(*drbg))
409 : OPENSSL_zalloc(sizeof(*drbg));
410
411 if (drbg == NULL) {
412 RANDerr(RAND_F_RAND_DRBG_NEW, ERR_R_MALLOC_FAILURE);
413 return NULL;
414 }
415
416 drbg->libctx = ctx;
417 drbg->secure = secure && CRYPTO_secure_allocated(drbg);
418 drbg->fork_id = openssl_get_fork_id();
419 drbg->parent = parent;
420
421 if (parent == NULL) {
422#ifdef FIPS_MODE
423 drbg->get_entropy = rand_crngt_get_entropy;
424 drbg->cleanup_entropy = rand_crngt_cleanup_entropy;
425#else
426 drbg->get_entropy = rand_drbg_get_entropy;
427 drbg->cleanup_entropy = rand_drbg_cleanup_entropy;
428#endif
429#ifndef RAND_DRBG_GET_RANDOM_NONCE
430 drbg->get_nonce = rand_drbg_get_nonce;
431 drbg->cleanup_nonce = rand_drbg_cleanup_nonce;
432#endif
433
434 drbg->reseed_interval = master_reseed_interval;
435 drbg->reseed_time_interval = master_reseed_time_interval;
436 } else {
437 drbg->get_entropy = rand_drbg_get_entropy;
438 drbg->cleanup_entropy = rand_drbg_cleanup_entropy;
439 /*
440 * Do not provide nonce callbacks, the child DRBGs will
441 * obtain their nonce using random bits from the parent.
442 */
443
444 drbg->reseed_interval = slave_reseed_interval;
445 drbg->reseed_time_interval = slave_reseed_time_interval;
446 }
447
448 if (RAND_DRBG_set(drbg, type, flags) == 0)
449 goto err;
450
451 if (parent != NULL) {
452 rand_drbg_lock(parent);
453 if (drbg->strength > parent->strength) {
454 /*
455 * We currently don't support the algorithm from NIST SP 800-90C
456 * 10.1.2 to use a weaker DRBG as source
457 */
458 rand_drbg_unlock(parent);
459 RANDerr(RAND_F_RAND_DRBG_NEW, RAND_R_PARENT_STRENGTH_TOO_WEAK);
460 goto err;
461 }
462 rand_drbg_unlock(parent);
463 }
464
465 return drbg;
466
467 err:
468 RAND_DRBG_free(drbg);
469
470 return NULL;
471}
472
473RAND_DRBG *RAND_DRBG_new_ex(OPENSSL_CTX *ctx, int type, unsigned int flags,
474 RAND_DRBG *parent)
475{
476 return rand_drbg_new(ctx, 0, type, flags, parent);
477}
478
479RAND_DRBG *RAND_DRBG_new(int type, unsigned int flags, RAND_DRBG *parent)
480{
481 return RAND_DRBG_new_ex(NULL, type, flags, parent);
482}
483
484RAND_DRBG *RAND_DRBG_secure_new_ex(OPENSSL_CTX *ctx, int type,
485 unsigned int flags, RAND_DRBG *parent)
486{
487 return rand_drbg_new(ctx, 1, type, flags, parent);
488}
489
490RAND_DRBG *RAND_DRBG_secure_new(int type, unsigned int flags, RAND_DRBG *parent)
491{
492 return RAND_DRBG_secure_new_ex(NULL, type, flags, parent);
493}
494/*
495 * Uninstantiate |drbg| and free all memory.
496 */
497void RAND_DRBG_free(RAND_DRBG *drbg)
498{
499 if (drbg == NULL)
500 return;
501
502 if (drbg->meth != NULL)
503 drbg->meth->uninstantiate(drbg);
504 rand_pool_free(drbg->adin_pool);
505 CRYPTO_THREAD_lock_free(drbg->lock);
506 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_RAND_DRBG, drbg, &drbg->ex_data);
507
508 if (drbg->secure)
509 OPENSSL_secure_clear_free(drbg, sizeof(*drbg));
510 else
511 OPENSSL_clear_free(drbg, sizeof(*drbg));
512}
513
514/*
515 * Instantiate |drbg|, after it has been initialized. Use |pers| and
516 * |perslen| as prediction-resistance input.
517 *
518 * Requires that drbg->lock is already locked for write, if non-null.
519 *
520 * Returns 1 on success, 0 on failure.
521 */
522int RAND_DRBG_instantiate(RAND_DRBG *drbg,
523 const unsigned char *pers, size_t perslen)
524{
525 unsigned char *nonce = NULL, *entropy = NULL;
526 size_t noncelen = 0, entropylen = 0;
527 size_t min_entropy = drbg->strength;
528 size_t min_entropylen = drbg->min_entropylen;
529 size_t max_entropylen = drbg->max_entropylen;
530
531 if (perslen > drbg->max_perslen) {
532 RANDerr(RAND_F_RAND_DRBG_INSTANTIATE,
533 RAND_R_PERSONALISATION_STRING_TOO_LONG);
534 goto end;
535 }
536
537 if (drbg->meth == NULL) {
538 RANDerr(RAND_F_RAND_DRBG_INSTANTIATE,
539 RAND_R_NO_DRBG_IMPLEMENTATION_SELECTED);
540 goto end;
541 }
542
543 if (drbg->state != DRBG_UNINITIALISED) {
544 if (drbg->state == DRBG_ERROR)
545 RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, RAND_R_IN_ERROR_STATE);
546 else
547 RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, RAND_R_ALREADY_INSTANTIATED);
548 goto end;
549 }
550
551 drbg->state = DRBG_ERROR;
552
553 /*
554 * NIST SP800-90Ar1 section 9.1 says you can combine getting the entropy
555 * and nonce in 1 call by increasing the entropy with 50% and increasing
556 * the minimum length to accommodate the length of the nonce.
557 * We do this in case a nonce is require and get_nonce is NULL.
558 */
559 if (drbg->min_noncelen > 0 && drbg->get_nonce == NULL) {
560 min_entropy += drbg->strength / 2;
561 min_entropylen += drbg->min_noncelen;
562 max_entropylen += drbg->max_noncelen;
563 }
564
565 drbg->reseed_next_counter = tsan_load(&drbg->reseed_prop_counter);
566 if (drbg->reseed_next_counter) {
567 drbg->reseed_next_counter++;
568 if(!drbg->reseed_next_counter)
569 drbg->reseed_next_counter = 1;
570 }
571
572 if (drbg->get_entropy != NULL)
573 entropylen = drbg->get_entropy(drbg, &entropy, min_entropy,
574 min_entropylen, max_entropylen, 0);
575 if (entropylen < min_entropylen
576 || entropylen > max_entropylen) {
577 RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, RAND_R_ERROR_RETRIEVING_ENTROPY);
578 goto end;
579 }
580
581 if (drbg->min_noncelen > 0 && drbg->get_nonce != NULL) {
582 noncelen = drbg->get_nonce(drbg, &nonce, drbg->strength / 2,
583 drbg->min_noncelen, drbg->max_noncelen);
584 if (noncelen < drbg->min_noncelen || noncelen > drbg->max_noncelen) {
585 RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, RAND_R_ERROR_RETRIEVING_NONCE);
586 goto end;
587 }
588 }
589
590 if (!drbg->meth->instantiate(drbg, entropy, entropylen,
591 nonce, noncelen, pers, perslen)) {
592 RANDerr(RAND_F_RAND_DRBG_INSTANTIATE, RAND_R_ERROR_INSTANTIATING_DRBG);
593 goto end;
594 }
595
596 drbg->state = DRBG_READY;
597 drbg->reseed_gen_counter = 1;
598 drbg->reseed_time = time(NULL);
599 tsan_store(&drbg->reseed_prop_counter, drbg->reseed_next_counter);
600
601 end:
602 if (entropy != NULL && drbg->cleanup_entropy != NULL)
603 drbg->cleanup_entropy(drbg, entropy, entropylen);
604 if (nonce != NULL && drbg->cleanup_nonce != NULL)
605 drbg->cleanup_nonce(drbg, nonce, noncelen);
606 if (drbg->state == DRBG_READY)
607 return 1;
608 return 0;
609}
610
611/*
612 * Uninstantiate |drbg|. Must be instantiated before it can be used.
613 *
614 * Requires that drbg->lock is already locked for write, if non-null.
615 *
616 * Returns 1 on success, 0 on failure.
617 */
618int RAND_DRBG_uninstantiate(RAND_DRBG *drbg)
619{
620 int index = -1, type, flags;
621 if (drbg->meth == NULL) {
622 drbg->state = DRBG_ERROR;
623 RANDerr(RAND_F_RAND_DRBG_UNINSTANTIATE,
624 RAND_R_NO_DRBG_IMPLEMENTATION_SELECTED);
625 return 0;
626 }
627
628 /* Clear the entire drbg->ctr struct, then reset some important
629 * members of the drbg->ctr struct (e.g. keysize, df_ks) to their
630 * initial values.
631 */
632 drbg->meth->uninstantiate(drbg);
633
634 /* The reset uses the default values for type and flags */
635 if (drbg->flags & RAND_DRBG_FLAG_MASTER)
636 index = RAND_DRBG_TYPE_MASTER;
637 else if (drbg->flags & RAND_DRBG_FLAG_PRIVATE)
638 index = RAND_DRBG_TYPE_PRIVATE;
639 else if (drbg->flags & RAND_DRBG_FLAG_PUBLIC)
640 index = RAND_DRBG_TYPE_PUBLIC;
641
642 if (index != -1) {
643 flags = rand_drbg_flags[index];
644 type = rand_drbg_type[index];
645 } else {
646 flags = drbg->flags;
647 type = drbg->type;
648 }
649 return RAND_DRBG_set(drbg, type, flags);
650}
651
652/*
653 * Reseed |drbg|, mixing in the specified data
654 *
655 * Requires that drbg->lock is already locked for write, if non-null.
656 *
657 * Returns 1 on success, 0 on failure.
658 */
659int RAND_DRBG_reseed(RAND_DRBG *drbg,
660 const unsigned char *adin, size_t adinlen,
661 int prediction_resistance)
662{
663 unsigned char *entropy = NULL;
664 size_t entropylen = 0;
665
666 if (drbg->state == DRBG_ERROR) {
667 RANDerr(RAND_F_RAND_DRBG_RESEED, RAND_R_IN_ERROR_STATE);
668 return 0;
669 }
670 if (drbg->state == DRBG_UNINITIALISED) {
671 RANDerr(RAND_F_RAND_DRBG_RESEED, RAND_R_NOT_INSTANTIATED);
672 return 0;
673 }
674
675 if (adin == NULL) {
676 adinlen = 0;
677 } else if (adinlen > drbg->max_adinlen) {
678 RANDerr(RAND_F_RAND_DRBG_RESEED, RAND_R_ADDITIONAL_INPUT_TOO_LONG);
679 return 0;
680 }
681
682 drbg->state = DRBG_ERROR;
683
684 drbg->reseed_next_counter = tsan_load(&drbg->reseed_prop_counter);
685 if (drbg->reseed_next_counter) {
686 drbg->reseed_next_counter++;
687 if(!drbg->reseed_next_counter)
688 drbg->reseed_next_counter = 1;
689 }
690
691 if (drbg->get_entropy != NULL)
692 entropylen = drbg->get_entropy(drbg, &entropy, drbg->strength,
693 drbg->min_entropylen,
694 drbg->max_entropylen,
695 prediction_resistance);
696 if (entropylen < drbg->min_entropylen
697 || entropylen > drbg->max_entropylen) {
698 RANDerr(RAND_F_RAND_DRBG_RESEED, RAND_R_ERROR_RETRIEVING_ENTROPY);
699 goto end;
700 }
701
702 if (!drbg->meth->reseed(drbg, entropy, entropylen, adin, adinlen))
703 goto end;
704
705 drbg->state = DRBG_READY;
706 drbg->reseed_gen_counter = 1;
707 drbg->reseed_time = time(NULL);
708 tsan_store(&drbg->reseed_prop_counter, drbg->reseed_next_counter);
709
710 end:
711 if (entropy != NULL && drbg->cleanup_entropy != NULL)
712 drbg->cleanup_entropy(drbg, entropy, entropylen);
713 if (drbg->state == DRBG_READY)
714 return 1;
715 return 0;
716}
717
718/*
719 * Restart |drbg|, using the specified entropy or additional input
720 *
721 * Tries its best to get the drbg instantiated by all means,
722 * regardless of its current state.
723 *
724 * Optionally, a |buffer| of |len| random bytes can be passed,
725 * which is assumed to contain at least |entropy| bits of entropy.
726 *
727 * If |entropy| > 0, the buffer content is used as entropy input.
728 *
729 * If |entropy| == 0, the buffer content is used as additional input
730 *
731 * Returns 1 on success, 0 on failure.
732 *
733 * This function is used internally only.
734 */
735int rand_drbg_restart(RAND_DRBG *drbg,
736 const unsigned char *buffer, size_t len, size_t entropy)
737{
738 int reseeded = 0;
739 const unsigned char *adin = NULL;
740 size_t adinlen = 0;
741
742 if (drbg->seed_pool != NULL) {
743 RANDerr(RAND_F_RAND_DRBG_RESTART, ERR_R_INTERNAL_ERROR);
744 drbg->state = DRBG_ERROR;
745 rand_pool_free(drbg->seed_pool);
746 drbg->seed_pool = NULL;
747 return 0;
748 }
749
750 if (buffer != NULL) {
751 if (entropy > 0) {
752 if (drbg->max_entropylen < len) {
753 RANDerr(RAND_F_RAND_DRBG_RESTART,
754 RAND_R_ENTROPY_INPUT_TOO_LONG);
755 drbg->state = DRBG_ERROR;
756 return 0;
757 }
758
759 if (entropy > 8 * len) {
760 RANDerr(RAND_F_RAND_DRBG_RESTART, RAND_R_ENTROPY_OUT_OF_RANGE);
761 drbg->state = DRBG_ERROR;
762 return 0;
763 }
764
765 /* will be picked up by the rand_drbg_get_entropy() callback */
766 drbg->seed_pool = rand_pool_attach(buffer, len, entropy);
767 if (drbg->seed_pool == NULL)
768 return 0;
769 } else {
770 if (drbg->max_adinlen < len) {
771 RANDerr(RAND_F_RAND_DRBG_RESTART,
772 RAND_R_ADDITIONAL_INPUT_TOO_LONG);
773 drbg->state = DRBG_ERROR;
774 return 0;
775 }
776 adin = buffer;
777 adinlen = len;
778 }
779 }
780
781 /* repair error state */
782 if (drbg->state == DRBG_ERROR)
783 RAND_DRBG_uninstantiate(drbg);
784
785 /* repair uninitialized state */
786 if (drbg->state == DRBG_UNINITIALISED) {
787 /* reinstantiate drbg */
788 RAND_DRBG_instantiate(drbg,
789 (const unsigned char *) ossl_pers_string,
790 sizeof(ossl_pers_string) - 1);
791 /* already reseeded. prevent second reseeding below */
792 reseeded = (drbg->state == DRBG_READY);
793 }
794
795 /* refresh current state if entropy or additional input has been provided */
796 if (drbg->state == DRBG_READY) {
797 if (adin != NULL) {
798 /*
799 * mix in additional input without reseeding
800 *
801 * Similar to RAND_DRBG_reseed(), but the provided additional
802 * data |adin| is mixed into the current state without pulling
803 * entropy from the trusted entropy source using get_entropy().
804 * This is not a reseeding in the strict sense of NIST SP 800-90A.
805 */
806 drbg->meth->reseed(drbg, adin, adinlen, NULL, 0);
807 } else if (reseeded == 0) {
808 /* do a full reseeding if it has not been done yet above */
809 RAND_DRBG_reseed(drbg, NULL, 0, 0);
810 }
811 }
812
813 rand_pool_free(drbg->seed_pool);
814 drbg->seed_pool = NULL;
815
816 return drbg->state == DRBG_READY;
817}
818
819/*
820 * Generate |outlen| bytes into the buffer at |out|. Reseed if we need
821 * to or if |prediction_resistance| is set. Additional input can be
822 * sent in |adin| and |adinlen|.
823 *
824 * Requires that drbg->lock is already locked for write, if non-null.
825 *
826 * Returns 1 on success, 0 on failure.
827 *
828 */
829int RAND_DRBG_generate(RAND_DRBG *drbg, unsigned char *out, size_t outlen,
830 int prediction_resistance,
831 const unsigned char *adin, size_t adinlen)
832{
833 int fork_id;
834 int reseed_required = 0;
835
836 if (drbg->state != DRBG_READY) {
837 /* try to recover from previous errors */
838 rand_drbg_restart(drbg, NULL, 0, 0);
839
840 if (drbg->state == DRBG_ERROR) {
841 RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_IN_ERROR_STATE);
842 return 0;
843 }
844 if (drbg->state == DRBG_UNINITIALISED) {
845 RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_NOT_INSTANTIATED);
846 return 0;
847 }
848 }
849
850 if (outlen > drbg->max_request) {
851 RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_REQUEST_TOO_LARGE_FOR_DRBG);
852 return 0;
853 }
854 if (adinlen > drbg->max_adinlen) {
855 RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_ADDITIONAL_INPUT_TOO_LONG);
856 return 0;
857 }
858
859 fork_id = openssl_get_fork_id();
860
861 if (drbg->fork_id != fork_id) {
862 drbg->fork_id = fork_id;
863 reseed_required = 1;
864 }
865
866 if (drbg->reseed_interval > 0) {
867 if (drbg->reseed_gen_counter > drbg->reseed_interval)
868 reseed_required = 1;
869 }
870 if (drbg->reseed_time_interval > 0) {
871 time_t now = time(NULL);
872 if (now < drbg->reseed_time
873 || now - drbg->reseed_time >= drbg->reseed_time_interval)
874 reseed_required = 1;
875 }
876 if (drbg->parent != NULL) {
877 unsigned int reseed_counter = tsan_load(&drbg->reseed_prop_counter);
878 if (reseed_counter > 0
879 && tsan_load(&drbg->parent->reseed_prop_counter)
880 != reseed_counter)
881 reseed_required = 1;
882 }
883
884 if (reseed_required || prediction_resistance) {
885 if (!RAND_DRBG_reseed(drbg, adin, adinlen, prediction_resistance)) {
886 RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_RESEED_ERROR);
887 return 0;
888 }
889 adin = NULL;
890 adinlen = 0;
891 }
892
893 if (!drbg->meth->generate(drbg, out, outlen, adin, adinlen)) {
894 drbg->state = DRBG_ERROR;
895 RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_GENERATE_ERROR);
896 return 0;
897 }
898
899 drbg->reseed_gen_counter++;
900
901 return 1;
902}
903
904/*
905 * Generates |outlen| random bytes and stores them in |out|. It will
906 * using the given |drbg| to generate the bytes.
907 *
908 * Requires that drbg->lock is already locked for write, if non-null.
909 *
910 * Returns 1 on success 0 on failure.
911 */
912int RAND_DRBG_bytes(RAND_DRBG *drbg, unsigned char *out, size_t outlen)
913{
914 unsigned char *additional = NULL;
915 size_t additional_len;
916 size_t chunk;
917 size_t ret = 0;
918
919 if (drbg->adin_pool == NULL) {
920 if (drbg->type == 0)
921 goto err;
922 drbg->adin_pool = rand_pool_new(0, 0, 0, drbg->max_adinlen);
923 if (drbg->adin_pool == NULL)
924 goto err;
925 }
926
927 additional_len = rand_drbg_get_additional_data(drbg->adin_pool,
928 &additional);
929
930 for ( ; outlen > 0; outlen -= chunk, out += chunk) {
931 chunk = outlen;
932 if (chunk > drbg->max_request)
933 chunk = drbg->max_request;
934 ret = RAND_DRBG_generate(drbg, out, chunk, 0, additional, additional_len);
935 if (!ret)
936 goto err;
937 }
938 ret = 1;
939
940 err:
941 if (additional != NULL)
942 rand_drbg_cleanup_additional_data(drbg->adin_pool, additional);
943
944 return ret;
945}
946
947/*
948 * Set the RAND_DRBG callbacks for obtaining entropy and nonce.
949 *
950 * Setting the callbacks is allowed only if the drbg has not been
951 * initialized yet. Otherwise, the operation will fail.
952 *
953 * Returns 1 on success, 0 on failure.
954 */
955int RAND_DRBG_set_callbacks(RAND_DRBG *drbg,
956 RAND_DRBG_get_entropy_fn get_entropy,
957 RAND_DRBG_cleanup_entropy_fn cleanup_entropy,
958 RAND_DRBG_get_nonce_fn get_nonce,
959 RAND_DRBG_cleanup_nonce_fn cleanup_nonce)
960{
961 if (drbg->state != DRBG_UNINITIALISED
962 || drbg->parent != NULL)
963 return 0;
964 drbg->get_entropy = get_entropy;
965 drbg->cleanup_entropy = cleanup_entropy;
966 drbg->get_nonce = get_nonce;
967 drbg->cleanup_nonce = cleanup_nonce;
968 return 1;
969}
970
971/*
972 * Set the reseed interval.
973 *
974 * The drbg will reseed automatically whenever the number of generate
975 * requests exceeds the given reseed interval. If the reseed interval
976 * is 0, then this feature is disabled.
977 *
978 * Returns 1 on success, 0 on failure.
979 */
980int RAND_DRBG_set_reseed_interval(RAND_DRBG *drbg, unsigned int interval)
981{
982 if (interval > MAX_RESEED_INTERVAL)
983 return 0;
984 drbg->reseed_interval = interval;
985 return 1;
986}
987
988/*
989 * Set the reseed time interval.
990 *
991 * The drbg will reseed automatically whenever the time elapsed since
992 * the last reseeding exceeds the given reseed time interval. For safety,
993 * a reseeding will also occur if the clock has been reset to a smaller
994 * value.
995 *
996 * Returns 1 on success, 0 on failure.
997 */
998int RAND_DRBG_set_reseed_time_interval(RAND_DRBG *drbg, time_t interval)
999{
1000 if (interval > MAX_RESEED_TIME_INTERVAL)
1001 return 0;
1002 drbg->reseed_time_interval = interval;
1003 return 1;
1004}
1005
1006/*
1007 * Set the default values for reseed (time) intervals of new DRBG instances
1008 *
1009 * The default values can be set independently for master DRBG instances
1010 * (without a parent) and slave DRBG instances (with parent).
1011 *
1012 * Returns 1 on success, 0 on failure.
1013 */
1014
1015int RAND_DRBG_set_reseed_defaults(
1016 unsigned int _master_reseed_interval,
1017 unsigned int _slave_reseed_interval,
1018 time_t _master_reseed_time_interval,
1019 time_t _slave_reseed_time_interval
1020 )
1021{
1022 if (_master_reseed_interval > MAX_RESEED_INTERVAL
1023 || _slave_reseed_interval > MAX_RESEED_INTERVAL)
1024 return 0;
1025
1026 if (_master_reseed_time_interval > MAX_RESEED_TIME_INTERVAL
1027 || _slave_reseed_time_interval > MAX_RESEED_TIME_INTERVAL)
1028 return 0;
1029
1030 master_reseed_interval = _master_reseed_interval;
1031 slave_reseed_interval = _slave_reseed_interval;
1032
1033 master_reseed_time_interval = _master_reseed_time_interval;
1034 slave_reseed_time_interval = _slave_reseed_time_interval;
1035
1036 return 1;
1037}
1038
1039/*
1040 * Locks the given drbg. Locking a drbg which does not have locking
1041 * enabled is considered a successful no-op.
1042 *
1043 * Returns 1 on success, 0 on failure.
1044 */
1045int rand_drbg_lock(RAND_DRBG *drbg)
1046{
1047 if (drbg->lock != NULL)
1048 return CRYPTO_THREAD_write_lock(drbg->lock);
1049
1050 return 1;
1051}
1052
1053/*
1054 * Unlocks the given drbg. Unlocking a drbg which does not have locking
1055 * enabled is considered a successful no-op.
1056 *
1057 * Returns 1 on success, 0 on failure.
1058 */
1059int rand_drbg_unlock(RAND_DRBG *drbg)
1060{
1061 if (drbg->lock != NULL)
1062 return CRYPTO_THREAD_unlock(drbg->lock);
1063
1064 return 1;
1065}
1066
1067/*
1068 * Enables locking for the given drbg
1069 *
1070 * Locking can only be enabled if the random generator
1071 * is in the uninitialized state.
1072 *
1073 * Returns 1 on success, 0 on failure.
1074 */
1075int rand_drbg_enable_locking(RAND_DRBG *drbg)
1076{
1077 if (drbg->state != DRBG_UNINITIALISED) {
1078 RANDerr(RAND_F_RAND_DRBG_ENABLE_LOCKING,
1079 RAND_R_DRBG_ALREADY_INITIALIZED);
1080 return 0;
1081 }
1082
1083 if (drbg->lock == NULL) {
1084 if (drbg->parent != NULL && drbg->parent->lock == NULL) {
1085 RANDerr(RAND_F_RAND_DRBG_ENABLE_LOCKING,
1086 RAND_R_PARENT_LOCKING_NOT_ENABLED);
1087 return 0;
1088 }
1089
1090 drbg->lock = CRYPTO_THREAD_lock_new();
1091 if (drbg->lock == NULL) {
1092 RANDerr(RAND_F_RAND_DRBG_ENABLE_LOCKING,
1093 RAND_R_FAILED_TO_CREATE_LOCK);
1094 return 0;
1095 }
1096 }
1097
1098 return 1;
1099}
1100
1101/*
1102 * Get and set the EXDATA
1103 */
1104int RAND_DRBG_set_ex_data(RAND_DRBG *drbg, int idx, void *arg)
1105{
1106 return CRYPTO_set_ex_data(&drbg->ex_data, idx, arg);
1107}
1108
1109void *RAND_DRBG_get_ex_data(const RAND_DRBG *drbg, int idx)
1110{
1111 return CRYPTO_get_ex_data(&drbg->ex_data, idx);
1112}
1113
1114
1115/*
1116 * The following functions provide a RAND_METHOD that works on the
1117 * global DRBG. They lock.
1118 */
1119
1120/*
1121 * Allocates a new global DRBG on the secure heap (if enabled) and
1122 * initializes it with default settings.
1123 *
1124 * Returns a pointer to the new DRBG instance on success, NULL on failure.
1125 */
1126static RAND_DRBG *drbg_setup(OPENSSL_CTX *ctx, RAND_DRBG *parent, int drbg_type)
1127{
1128 RAND_DRBG *drbg;
1129
1130 drbg = RAND_DRBG_secure_new_ex(ctx, rand_drbg_type[drbg_type],
1131 rand_drbg_flags[drbg_type], parent);
1132 if (drbg == NULL)
1133 return NULL;
1134
1135 /* Only the master DRBG needs to have a lock */
1136 if (parent == NULL && rand_drbg_enable_locking(drbg) == 0)
1137 goto err;
1138
1139 /* enable seed propagation */
1140 tsan_store(&drbg->reseed_prop_counter, 1);
1141
1142 /*
1143 * Ignore instantiation error to support just-in-time instantiation.
1144 *
1145 * The state of the drbg will be checked in RAND_DRBG_generate() and
1146 * an automatic recovery is attempted.
1147 */
1148 (void)RAND_DRBG_instantiate(drbg,
1149 (const unsigned char *) ossl_pers_string,
1150 sizeof(ossl_pers_string) - 1);
1151 return drbg;
1152
1153err:
1154 RAND_DRBG_free(drbg);
1155 return NULL;
1156}
1157
1158static void drbg_delete_thread_state(void *arg)
1159{
1160 OPENSSL_CTX *ctx = arg;
1161 DRBG_GLOBAL *dgbl = drbg_get_global(ctx);
1162 RAND_DRBG *drbg;
1163
1164 if (dgbl == NULL)
1165 return;
1166 drbg = CRYPTO_THREAD_get_local(&dgbl->public_drbg);
1167 CRYPTO_THREAD_set_local(&dgbl->public_drbg, NULL);
1168 RAND_DRBG_free(drbg);
1169
1170 drbg = CRYPTO_THREAD_get_local(&dgbl->private_drbg);
1171 CRYPTO_THREAD_set_local(&dgbl->private_drbg, NULL);
1172 RAND_DRBG_free(drbg);
1173}
1174
1175/* Implements the default OpenSSL RAND_bytes() method */
1176static int drbg_bytes(unsigned char *out, int count)
1177{
1178 int ret;
1179 RAND_DRBG *drbg = RAND_DRBG_get0_public();
1180
1181 if (drbg == NULL)
1182 return 0;
1183
1184 ret = RAND_DRBG_bytes(drbg, out, count);
1185
1186 return ret;
1187}
1188
1189/*
1190 * Calculates the minimum length of a full entropy buffer
1191 * which is necessary to seed (i.e. instantiate) the DRBG
1192 * successfully.
1193 */
1194size_t rand_drbg_seedlen(RAND_DRBG *drbg)
1195{
1196 /*
1197 * If no os entropy source is available then RAND_seed(buffer, bufsize)
1198 * is expected to succeed if and only if the buffer length satisfies
1199 * the following requirements, which follow from the calculations
1200 * in RAND_DRBG_instantiate().
1201 */
1202 size_t min_entropy = drbg->strength;
1203 size_t min_entropylen = drbg->min_entropylen;
1204
1205 /*
1206 * Extra entropy for the random nonce in the absence of a
1207 * get_nonce callback, see comment in RAND_DRBG_instantiate().
1208 */
1209 if (drbg->min_noncelen > 0 && drbg->get_nonce == NULL) {
1210 min_entropy += drbg->strength / 2;
1211 min_entropylen += drbg->min_noncelen;
1212 }
1213
1214 /*
1215 * Convert entropy requirement from bits to bytes
1216 * (dividing by 8 without rounding upwards, because
1217 * all entropy requirements are divisible by 8).
1218 */
1219 min_entropy >>= 3;
1220
1221 /* Return a value that satisfies both requirements */
1222 return min_entropy > min_entropylen ? min_entropy : min_entropylen;
1223}
1224
1225/* Implements the default OpenSSL RAND_add() method */
1226static int drbg_add(const void *buf, int num, double randomness)
1227{
1228 int ret = 0;
1229 RAND_DRBG *drbg = RAND_DRBG_get0_master();
1230 size_t buflen;
1231 size_t seedlen;
1232
1233 if (drbg == NULL)
1234 return 0;
1235
1236 if (num < 0 || randomness < 0.0)
1237 return 0;
1238
1239 rand_drbg_lock(drbg);
1240 seedlen = rand_drbg_seedlen(drbg);
1241
1242 buflen = (size_t)num;
1243
1244#ifdef FIPS_MODE
1245 /*
1246 * NIST SP-800-90A mandates that entropy *shall not* be provided
1247 * by the consuming application. By setting the randomness to zero,
1248 * we ensure that the buffer contents will be added to the internal
1249 * state of the DRBG only as additional data.
1250 *
1251 * (NIST SP-800-90Ar1, Sections 9.1 and 9.2)
1252 */
1253 randomness = 0.0;
1254#endif
1255 if (buflen < seedlen || randomness < (double) seedlen) {
1256#if defined(OPENSSL_RAND_SEED_NONE)
1257 /*
1258 * If no os entropy source is available, a reseeding will fail
1259 * inevitably. So we use a trick to mix the buffer contents into
1260 * the DRBG state without forcing a reseeding: we generate a
1261 * dummy random byte, using the buffer content as additional data.
1262 * Note: This won't work with RAND_DRBG_FLAG_CTR_NO_DF.
1263 */
1264 unsigned char dummy[1];
1265
1266 ret = RAND_DRBG_generate(drbg, dummy, sizeof(dummy), 0, buf, buflen);
1267 rand_drbg_unlock(drbg);
1268 return ret;
1269#else
1270 /*
1271 * If an os entropy source is available then we declare the buffer content
1272 * as additional data by setting randomness to zero and trigger a regular
1273 * reseeding.
1274 */
1275 randomness = 0.0;
1276#endif
1277 }
1278
1279 if (randomness > (double)seedlen) {
1280 /*
1281 * The purpose of this check is to bound |randomness| by a
1282 * relatively small value in order to prevent an integer
1283 * overflow when multiplying by 8 in the rand_drbg_restart()
1284 * call below. Note that randomness is measured in bytes,
1285 * not bits, so this value corresponds to eight times the
1286 * security strength.
1287 */
1288 randomness = (double)seedlen;
1289 }
1290
1291 ret = rand_drbg_restart(drbg, buf, buflen, (size_t)(8 * randomness));
1292 rand_drbg_unlock(drbg);
1293
1294 return ret;
1295}
1296
1297/* Implements the default OpenSSL RAND_seed() method */
1298static int drbg_seed(const void *buf, int num)
1299{
1300 return drbg_add(buf, num, num);
1301}
1302
1303/* Implements the default OpenSSL RAND_status() method */
1304static int drbg_status(void)
1305{
1306 int ret;
1307 RAND_DRBG *drbg = RAND_DRBG_get0_master();
1308
1309 if (drbg == NULL)
1310 return 0;
1311
1312 rand_drbg_lock(drbg);
1313 ret = drbg->state == DRBG_READY ? 1 : 0;
1314 rand_drbg_unlock(drbg);
1315 return ret;
1316}
1317
1318/*
1319 * Get the master DRBG.
1320 * Returns pointer to the DRBG on success, NULL on failure.
1321 *
1322 */
1323RAND_DRBG *OPENSSL_CTX_get0_master_drbg(OPENSSL_CTX *ctx)
1324{
1325 DRBG_GLOBAL *dgbl = drbg_get_global(ctx);
1326
1327 if (dgbl == NULL)
1328 return NULL;
1329
1330 return dgbl->master_drbg;
1331}
1332
1333RAND_DRBG *RAND_DRBG_get0_master(void)
1334{
1335 return OPENSSL_CTX_get0_master_drbg(NULL);
1336}
1337
1338/*
1339 * Get the public DRBG.
1340 * Returns pointer to the DRBG on success, NULL on failure.
1341 */
1342RAND_DRBG *OPENSSL_CTX_get0_public_drbg(OPENSSL_CTX *ctx)
1343{
1344 DRBG_GLOBAL *dgbl = drbg_get_global(ctx);
1345 RAND_DRBG *drbg;
1346
1347 if (dgbl == NULL)
1348 return NULL;
1349
1350 drbg = CRYPTO_THREAD_get_local(&dgbl->public_drbg);
1351 if (drbg == NULL) {
1352 ctx = openssl_ctx_get_concrete(ctx);
1353 if (!ossl_init_thread_start(NULL, ctx, drbg_delete_thread_state))
1354 return NULL;
1355 drbg = drbg_setup(ctx, dgbl->master_drbg, RAND_DRBG_TYPE_PUBLIC);
1356 CRYPTO_THREAD_set_local(&dgbl->public_drbg, drbg);
1357 }
1358 return drbg;
1359}
1360
1361RAND_DRBG *RAND_DRBG_get0_public(void)
1362{
1363 return OPENSSL_CTX_get0_public_drbg(NULL);
1364}
1365
1366/*
1367 * Get the private DRBG.
1368 * Returns pointer to the DRBG on success, NULL on failure.
1369 */
1370RAND_DRBG *OPENSSL_CTX_get0_private_drbg(OPENSSL_CTX *ctx)
1371{
1372 DRBG_GLOBAL *dgbl = drbg_get_global(ctx);
1373 RAND_DRBG *drbg;
1374
1375 if (dgbl == NULL)
1376 return NULL;
1377
1378 drbg = CRYPTO_THREAD_get_local(&dgbl->private_drbg);
1379 if (drbg == NULL) {
1380 ctx = openssl_ctx_get_concrete(ctx);
1381 if (!ossl_init_thread_start(NULL, ctx, drbg_delete_thread_state))
1382 return NULL;
1383 drbg = drbg_setup(ctx, dgbl->master_drbg, RAND_DRBG_TYPE_PRIVATE);
1384 CRYPTO_THREAD_set_local(&dgbl->private_drbg, drbg);
1385 }
1386 return drbg;
1387}
1388
1389RAND_DRBG *RAND_DRBG_get0_private(void)
1390{
1391 return OPENSSL_CTX_get0_private_drbg(NULL);
1392}
1393
1394RAND_METHOD rand_meth = {
1395 drbg_seed,
1396 drbg_bytes,
1397 NULL,
1398 drbg_add,
1399 drbg_bytes,
1400 drbg_status
1401};
1402
1403RAND_METHOD *RAND_OpenSSL(void)
1404{
1405#ifndef FIPS_MODE
1406 return &rand_meth;
1407#else
1408 return NULL;
1409#endif
1410}
1411