/src/boringssl/crypto/fipsmodule/rand/rand.c.inc
Line | Count | Source (jump to first uncovered line) |
1 | | /* Copyright (c) 2014, Google Inc. |
2 | | * |
3 | | * Permission to use, copy, modify, and/or distribute this software for any |
4 | | * purpose with or without fee is hereby granted, provided that the above |
5 | | * copyright notice and this permission notice appear in all copies. |
6 | | * |
7 | | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
8 | | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
9 | | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY |
10 | | * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
11 | | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION |
12 | | * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN |
13 | | * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ |
14 | | |
15 | | #include <assert.h> |
16 | | #include <limits.h> |
17 | | #include <string.h> |
18 | | |
19 | | #if defined(BORINGSSL_FIPS) |
20 | | #include <unistd.h> |
21 | | #endif |
22 | | |
23 | | #include <openssl/chacha.h> |
24 | | #include <openssl/ctrdrbg.h> |
25 | | #include <openssl/mem.h> |
26 | | |
27 | | #include "../../bcm_support.h" |
28 | | #include "../bcm_interface.h" |
29 | | #include "../delocate.h" |
30 | | #include "internal.h" |
31 | | |
32 | | |
33 | | // It's assumed that the operating system always has an unfailing source of |
34 | | // entropy which is accessed via |CRYPTO_sysrand[_for_seed]|. (If the operating |
35 | | // system entropy source fails, it's up to |CRYPTO_sysrand| to abort the |
36 | | // process—we don't try to handle it.) |
37 | | // |
38 | | // In addition, the hardware may provide a low-latency RNG. Intel's rdrand |
39 | | // instruction is the canonical example of this. When a hardware RNG is |
40 | | // available we don't need to worry about an RNG failure arising from fork()ing |
41 | | // the process or moving a VM, so we can keep thread-local RNG state and use it |
42 | | // as an additional-data input to CTR-DRBG. |
43 | | // |
44 | | // (We assume that the OS entropy is safe from fork()ing and VM duplication. |
45 | | // This might be a bit of a leap of faith, esp on Windows, but there's nothing |
46 | | // that we can do about it.) |
47 | | |
48 | | // kReseedInterval is the number of generate calls made to CTR-DRBG before |
49 | | // reseeding. |
50 | | static const unsigned kReseedInterval = 4096; |
51 | | |
52 | | // CRNGT_BLOCK_SIZE is the number of bytes in a “block” for the purposes of the |
53 | | // continuous random number generator test in FIPS 140-2, section 4.9.2. |
54 | | #define CRNGT_BLOCK_SIZE 16 |
55 | | |
56 | | // rand_thread_state contains the per-thread state for the RNG. |
57 | | struct rand_thread_state { |
58 | | CTR_DRBG_STATE drbg; |
59 | | uint64_t fork_generation; |
60 | | // calls is the number of generate calls made on |drbg| since it was last |
61 | | // (re)seeded. This is bound by |kReseedInterval|. |
62 | | unsigned calls; |
63 | | // last_block_valid is non-zero iff |last_block| contains data from |
64 | | // |get_seed_entropy|. |
65 | | int last_block_valid; |
66 | | // fork_unsafe_buffering is non-zero iff, when |drbg| was last (re)seeded, |
67 | | // fork-unsafe buffering was enabled. |
68 | | int fork_unsafe_buffering; |
69 | | |
70 | | #if defined(BORINGSSL_FIPS) |
71 | | // last_block contains the previous block from |get_seed_entropy|. |
72 | | uint8_t last_block[CRNGT_BLOCK_SIZE]; |
73 | | // next and prev form a NULL-terminated, double-linked list of all states in |
74 | | // a process. |
75 | | struct rand_thread_state *next, *prev; |
76 | | // clear_drbg_lock synchronizes between uses of |drbg| and |
77 | | // |rand_thread_state_clear_all| clearing it. This lock should be uncontended |
78 | | // in the common case, except on shutdown. |
79 | | CRYPTO_MUTEX clear_drbg_lock; |
80 | | #endif |
81 | | }; |
82 | | |
83 | | #if defined(BORINGSSL_FIPS) |
84 | | // thread_states_list is the head of a linked-list of all |rand_thread_state| |
85 | | // objects in the process, one per thread. This is needed because FIPS requires |
86 | | // that they be zeroed on process exit, but thread-local destructors aren't |
87 | | // called when the whole process is exiting. |
88 | | DEFINE_BSS_GET(struct rand_thread_state *, thread_states_list) |
89 | | DEFINE_STATIC_MUTEX(thread_states_list_lock) |
90 | | |
91 | | static void rand_thread_state_clear_all(void) __attribute__((destructor)); |
92 | | static void rand_thread_state_clear_all(void) { |
93 | | CRYPTO_MUTEX_lock_write(thread_states_list_lock_bss_get()); |
94 | | for (struct rand_thread_state *cur = *thread_states_list_bss_get(); |
95 | | cur != NULL; cur = cur->next) { |
96 | | CRYPTO_MUTEX_lock_write(&cur->clear_drbg_lock); |
97 | | CTR_DRBG_clear(&cur->drbg); |
98 | | } |
99 | | // The locks are deliberately left locked so that any threads that are still |
100 | | // running will hang if they try to call |BCM_rand_bytes|. It also ensures |
101 | | // |rand_thread_state_free| cannot free any thread state while we've taken the |
102 | | // lock. |
103 | | } |
104 | | #endif |
105 | | |
106 | | // rand_thread_state_free frees a |rand_thread_state|. This is called when a |
107 | | // thread exits. |
108 | 0 | static void rand_thread_state_free(void *state_in) { |
109 | 0 | struct rand_thread_state *state = state_in; |
110 | |
|
111 | 0 | if (state_in == NULL) { |
112 | 0 | return; |
113 | 0 | } |
114 | | |
115 | | #if defined(BORINGSSL_FIPS) |
116 | | CRYPTO_MUTEX_lock_write(thread_states_list_lock_bss_get()); |
117 | | |
118 | | if (state->prev != NULL) { |
119 | | state->prev->next = state->next; |
120 | | } else if (*thread_states_list_bss_get() == state) { |
121 | | // |state->prev| may be NULL either if it is the head of the list, |
122 | | // or if |state| is freed before it was added to the list at all. |
123 | | // Compare against the head of the list to distinguish these cases. |
124 | | *thread_states_list_bss_get() = state->next; |
125 | | } |
126 | | |
127 | | if (state->next != NULL) { |
128 | | state->next->prev = state->prev; |
129 | | } |
130 | | |
131 | | CRYPTO_MUTEX_unlock_write(thread_states_list_lock_bss_get()); |
132 | | |
133 | | CTR_DRBG_clear(&state->drbg); |
134 | | #endif |
135 | | |
136 | 0 | OPENSSL_free(state); |
137 | 0 | } |
138 | | |
139 | | #if defined(OPENSSL_X86_64) && !defined(OPENSSL_NO_ASM) && \ |
140 | | !defined(BORINGSSL_UNSAFE_DETERMINISTIC_MODE) |
141 | | // rdrand should only be called if either |have_rdrand| or |have_fast_rdrand| |
142 | | // returned true. |
143 | | static int rdrand(uint8_t *buf, const size_t len) { |
144 | | const size_t len_multiple8 = len & ~7; |
145 | | if (!CRYPTO_rdrand_multiple8_buf(buf, len_multiple8)) { |
146 | | return 0; |
147 | | } |
148 | | const size_t remainder = len - len_multiple8; |
149 | | |
150 | | if (remainder != 0) { |
151 | | assert(remainder < 8); |
152 | | |
153 | | uint8_t rand_buf[8]; |
154 | | if (!CRYPTO_rdrand(rand_buf)) { |
155 | | return 0; |
156 | | } |
157 | | OPENSSL_memcpy(buf + len_multiple8, rand_buf, remainder); |
158 | | } |
159 | | |
160 | | return 1; |
161 | | } |
162 | | |
163 | | #else |
164 | | |
165 | 0 | static int rdrand(uint8_t *buf, size_t len) { return 0; } |
166 | | |
167 | | #endif |
168 | | |
169 | 0 | bcm_status BCM_rand_bytes_hwrng(uint8_t *buf, const size_t len) { |
170 | 0 | if (!have_rdrand()) { |
171 | 0 | return bcm_status_failure; |
172 | 0 | } |
173 | 0 | if (rdrand(buf, len)) { |
174 | 0 | return bcm_status_not_approved; |
175 | 0 | } |
176 | 0 | return bcm_status_failure; |
177 | 0 | } |
178 | | |
179 | | #if defined(BORINGSSL_FIPS) |
180 | | |
181 | | // In passive entropy mode, entropy is supplied from outside of the module via |
182 | | // |BCM_rand_load_entropy| and is stored in global instance of the following |
183 | | // structure. |
184 | | |
185 | | struct entropy_buffer { |
186 | | // bytes contains entropy suitable for seeding a DRBG. |
187 | | uint8_t |
188 | | bytes[CRNGT_BLOCK_SIZE + CTR_DRBG_ENTROPY_LEN * BORINGSSL_FIPS_OVERREAD]; |
189 | | // bytes_valid indicates the number of bytes of |bytes| that contain valid |
190 | | // data. |
191 | | size_t bytes_valid; |
192 | | // want_additional_input is true if any of the contents of |bytes| were |
193 | | // obtained via a method other than from the kernel. In these cases entropy |
194 | | // from the kernel is also provided via an additional input to the DRBG. |
195 | | int want_additional_input; |
196 | | }; |
197 | | |
198 | | DEFINE_BSS_GET(struct entropy_buffer, entropy_buffer) |
199 | | DEFINE_STATIC_MUTEX(entropy_buffer_lock) |
200 | | |
201 | | bcm_infallible BCM_rand_load_entropy(const uint8_t *entropy, size_t entropy_len, |
202 | | int want_additional_input) { |
203 | | struct entropy_buffer *const buffer = entropy_buffer_bss_get(); |
204 | | |
205 | | CRYPTO_MUTEX_lock_write(entropy_buffer_lock_bss_get()); |
206 | | const size_t space = sizeof(buffer->bytes) - buffer->bytes_valid; |
207 | | if (entropy_len > space) { |
208 | | entropy_len = space; |
209 | | } |
210 | | |
211 | | OPENSSL_memcpy(&buffer->bytes[buffer->bytes_valid], entropy, entropy_len); |
212 | | buffer->bytes_valid += entropy_len; |
213 | | buffer->want_additional_input |= want_additional_input && (entropy_len != 0); |
214 | | CRYPTO_MUTEX_unlock_write(entropy_buffer_lock_bss_get()); |
215 | | return bcm_infallible_not_approved; |
216 | | } |
217 | | |
218 | | // get_seed_entropy fills |out_entropy_len| bytes of |out_entropy| from the |
219 | | // global |entropy_buffer|. |
220 | | static void get_seed_entropy(uint8_t *out_entropy, size_t out_entropy_len, |
221 | | int *out_want_additional_input) { |
222 | | struct entropy_buffer *const buffer = entropy_buffer_bss_get(); |
223 | | if (out_entropy_len > sizeof(buffer->bytes)) { |
224 | | abort(); |
225 | | } |
226 | | |
227 | | CRYPTO_MUTEX_lock_write(entropy_buffer_lock_bss_get()); |
228 | | while (buffer->bytes_valid < out_entropy_len) { |
229 | | CRYPTO_MUTEX_unlock_write(entropy_buffer_lock_bss_get()); |
230 | | RAND_need_entropy(out_entropy_len - buffer->bytes_valid); |
231 | | CRYPTO_MUTEX_lock_write(entropy_buffer_lock_bss_get()); |
232 | | } |
233 | | |
234 | | *out_want_additional_input = buffer->want_additional_input; |
235 | | OPENSSL_memcpy(out_entropy, buffer->bytes, out_entropy_len); |
236 | | OPENSSL_memmove(buffer->bytes, &buffer->bytes[out_entropy_len], |
237 | | buffer->bytes_valid - out_entropy_len); |
238 | | buffer->bytes_valid -= out_entropy_len; |
239 | | if (buffer->bytes_valid == 0) { |
240 | | buffer->want_additional_input = 0; |
241 | | } |
242 | | |
243 | | CRYPTO_MUTEX_unlock_write(entropy_buffer_lock_bss_get()); |
244 | | } |
245 | | |
246 | | // rand_get_seed fills |seed| with entropy. In some cases, it will additionally |
247 | | // fill |additional_input| with entropy to supplement |seed|. It sets |
248 | | // |*out_additional_input_len| to the number of extra bytes. |
249 | | static void rand_get_seed(struct rand_thread_state *state, |
250 | | uint8_t seed[CTR_DRBG_ENTROPY_LEN], |
251 | | uint8_t additional_input[CTR_DRBG_ENTROPY_LEN], |
252 | | size_t *out_additional_input_len) { |
253 | | uint8_t entropy_bytes[sizeof(state->last_block) + |
254 | | CTR_DRBG_ENTROPY_LEN * BORINGSSL_FIPS_OVERREAD]; |
255 | | uint8_t *entropy = entropy_bytes; |
256 | | size_t entropy_len = sizeof(entropy_bytes); |
257 | | |
258 | | if (state->last_block_valid) { |
259 | | // No need to fill |state->last_block| with entropy from the read. |
260 | | entropy += sizeof(state->last_block); |
261 | | entropy_len -= sizeof(state->last_block); |
262 | | } |
263 | | |
264 | | int want_additional_input; |
265 | | get_seed_entropy(entropy, entropy_len, &want_additional_input); |
266 | | |
267 | | if (!state->last_block_valid) { |
268 | | OPENSSL_memcpy(state->last_block, entropy, sizeof(state->last_block)); |
269 | | entropy += sizeof(state->last_block); |
270 | | entropy_len -= sizeof(state->last_block); |
271 | | } |
272 | | |
273 | | // See FIPS 140-2, section 4.9.2. This is the “continuous random number |
274 | | // generator test” which causes the program to randomly abort. Hopefully the |
275 | | // rate of failure is small enough not to be a problem in practice. |
276 | | if (CRYPTO_memcmp(state->last_block, entropy, sizeof(state->last_block)) == |
277 | | 0) { |
278 | | fprintf(CRYPTO_get_stderr(), "CRNGT failed.\n"); |
279 | | BORINGSSL_FIPS_abort(); |
280 | | } |
281 | | |
282 | | assert(entropy_len % CRNGT_BLOCK_SIZE == 0); |
283 | | for (size_t i = CRNGT_BLOCK_SIZE; i < entropy_len; i += CRNGT_BLOCK_SIZE) { |
284 | | if (CRYPTO_memcmp(entropy + i - CRNGT_BLOCK_SIZE, entropy + i, |
285 | | CRNGT_BLOCK_SIZE) == 0) { |
286 | | fprintf(CRYPTO_get_stderr(), "CRNGT failed.\n"); |
287 | | BORINGSSL_FIPS_abort(); |
288 | | } |
289 | | } |
290 | | OPENSSL_memcpy(state->last_block, entropy + entropy_len - CRNGT_BLOCK_SIZE, |
291 | | CRNGT_BLOCK_SIZE); |
292 | | |
293 | | assert(entropy_len == BORINGSSL_FIPS_OVERREAD * CTR_DRBG_ENTROPY_LEN); |
294 | | OPENSSL_memcpy(seed, entropy, CTR_DRBG_ENTROPY_LEN); |
295 | | |
296 | | for (size_t i = 1; i < BORINGSSL_FIPS_OVERREAD; i++) { |
297 | | for (size_t j = 0; j < CTR_DRBG_ENTROPY_LEN; j++) { |
298 | | seed[j] ^= entropy[CTR_DRBG_ENTROPY_LEN * i + j]; |
299 | | } |
300 | | } |
301 | | |
302 | | // If we used something other than system entropy then also |
303 | | // opportunistically read from the system. This avoids solely relying on the |
304 | | // hardware once the entropy pool has been initialized. |
305 | | *out_additional_input_len = 0; |
306 | | if (want_additional_input && |
307 | | CRYPTO_sysrand_if_available(additional_input, CTR_DRBG_ENTROPY_LEN)) { |
308 | | *out_additional_input_len = CTR_DRBG_ENTROPY_LEN; |
309 | | } |
310 | | } |
311 | | |
312 | | #else |
313 | | |
314 | | // rand_get_seed fills |seed| with entropy. In some cases, it will additionally |
315 | | // fill |additional_input| with entropy to supplement |seed|. It sets |
316 | | // |*out_additional_input_len| to the number of extra bytes. |
317 | | static void rand_get_seed(struct rand_thread_state *state, |
318 | | uint8_t seed[CTR_DRBG_ENTROPY_LEN], |
319 | | uint8_t additional_input[CTR_DRBG_ENTROPY_LEN], |
320 | 2 | size_t *out_additional_input_len) { |
321 | | // If not in FIPS mode, we don't overread from the system entropy source and |
322 | | // we don't depend only on the hardware RDRAND. |
323 | 2 | CRYPTO_sysrand_for_seed(seed, CTR_DRBG_ENTROPY_LEN); |
324 | 2 | *out_additional_input_len = 0; |
325 | 2 | } |
326 | | |
327 | | #endif |
328 | | |
329 | | bcm_infallible BCM_rand_bytes_with_additional_data( |
330 | 4.28k | uint8_t *out, size_t out_len, const uint8_t user_additional_data[32]) { |
331 | 4.28k | if (out_len == 0) { |
332 | 0 | return bcm_infallible_approved; |
333 | 0 | } |
334 | | |
335 | 4.28k | const uint64_t fork_generation = CRYPTO_get_fork_generation(); |
336 | 4.28k | const int fork_unsafe_buffering = rand_fork_unsafe_buffering_enabled(); |
337 | | |
338 | | // Additional data is mixed into every CTR-DRBG call to protect, as best we |
339 | | // can, against forks & VM clones. We do not over-read this information and |
340 | | // don't reseed with it so, from the point of view of FIPS, this doesn't |
341 | | // provide “prediction resistance”. But, in practice, it does. |
342 | 4.28k | uint8_t additional_data[32]; |
343 | | // Intel chips have fast RDRAND instructions while, in other cases, RDRAND can |
344 | | // be _slower_ than a system call. |
345 | 4.28k | if (!have_fast_rdrand() || |
346 | 4.28k | !rdrand(additional_data, sizeof(additional_data))) { |
347 | | // Without a hardware RNG to save us from address-space duplication, the OS |
348 | | // entropy is used. This can be expensive (one read per |RAND_bytes| call) |
349 | | // and so is disabled when we have fork detection, or if the application has |
350 | | // promised not to fork. |
351 | 4.28k | if (fork_generation != 0 || fork_unsafe_buffering) { |
352 | 4.28k | OPENSSL_memset(additional_data, 0, sizeof(additional_data)); |
353 | 4.28k | } else if (!have_rdrand()) { |
354 | | // No alternative so block for OS entropy. |
355 | 0 | CRYPTO_sysrand(additional_data, sizeof(additional_data)); |
356 | 0 | } else if (!CRYPTO_sysrand_if_available(additional_data, |
357 | 0 | sizeof(additional_data)) && |
358 | 0 | !rdrand(additional_data, sizeof(additional_data))) { |
359 | | // RDRAND failed: block for OS entropy. |
360 | 0 | CRYPTO_sysrand(additional_data, sizeof(additional_data)); |
361 | 0 | } |
362 | 4.28k | } |
363 | | |
364 | 141k | for (size_t i = 0; i < sizeof(additional_data); i++) { |
365 | 137k | additional_data[i] ^= user_additional_data[i]; |
366 | 137k | } |
367 | | |
368 | 4.28k | struct rand_thread_state stack_state; |
369 | 4.28k | struct rand_thread_state *state = |
370 | 4.28k | CRYPTO_get_thread_local(OPENSSL_THREAD_LOCAL_RAND); |
371 | | |
372 | 4.28k | if (state == NULL) { |
373 | 2 | state = OPENSSL_zalloc(sizeof(struct rand_thread_state)); |
374 | 2 | if (state == NULL || |
375 | 2 | !CRYPTO_set_thread_local(OPENSSL_THREAD_LOCAL_RAND, state, |
376 | 2 | rand_thread_state_free)) { |
377 | | // If the system is out of memory, use an ephemeral state on the |
378 | | // stack. |
379 | 0 | state = &stack_state; |
380 | 0 | } |
381 | | |
382 | 2 | state->last_block_valid = 0; |
383 | 2 | uint8_t seed[CTR_DRBG_ENTROPY_LEN]; |
384 | 2 | uint8_t personalization[CTR_DRBG_ENTROPY_LEN] = {0}; |
385 | 2 | size_t personalization_len = 0; |
386 | 2 | rand_get_seed(state, seed, personalization, &personalization_len); |
387 | | |
388 | 2 | if (!CTR_DRBG_init(&state->drbg, seed, personalization, |
389 | 2 | personalization_len)) { |
390 | 0 | abort(); |
391 | 0 | } |
392 | 2 | state->calls = 0; |
393 | 2 | state->fork_generation = fork_generation; |
394 | 2 | state->fork_unsafe_buffering = fork_unsafe_buffering; |
395 | | |
396 | | #if defined(BORINGSSL_FIPS) |
397 | | CRYPTO_MUTEX_init(&state->clear_drbg_lock); |
398 | | if (state != &stack_state) { |
399 | | CRYPTO_MUTEX_lock_write(thread_states_list_lock_bss_get()); |
400 | | struct rand_thread_state **states_list = thread_states_list_bss_get(); |
401 | | state->next = *states_list; |
402 | | if (state->next != NULL) { |
403 | | state->next->prev = state; |
404 | | } |
405 | | state->prev = NULL; |
406 | | *states_list = state; |
407 | | CRYPTO_MUTEX_unlock_write(thread_states_list_lock_bss_get()); |
408 | | } |
409 | | #endif |
410 | 2 | } |
411 | | |
412 | 4.28k | if (state->calls >= kReseedInterval || |
413 | | // If we've forked since |state| was last seeded, reseed. |
414 | 4.28k | state->fork_generation != fork_generation || |
415 | | // If |state| was seeded from a state with different fork-safety |
416 | | // preferences, reseed. Suppose |state| was fork-safe, then forked into |
417 | | // two children, but each of the children never fork and disable fork |
418 | | // safety. The children must reseed to avoid working from the same PRNG |
419 | | // state. |
420 | 4.28k | state->fork_unsafe_buffering != fork_unsafe_buffering) { |
421 | 0 | uint8_t seed[CTR_DRBG_ENTROPY_LEN]; |
422 | 0 | uint8_t reseed_additional_data[CTR_DRBG_ENTROPY_LEN] = {0}; |
423 | 0 | size_t reseed_additional_data_len = 0; |
424 | 0 | rand_get_seed(state, seed, reseed_additional_data, |
425 | 0 | &reseed_additional_data_len); |
426 | | #if defined(BORINGSSL_FIPS) |
427 | | // Take a read lock around accesses to |state->drbg|. This is needed to |
428 | | // avoid returning bad entropy if we race with |
429 | | // |rand_thread_state_clear_all|. |
430 | | CRYPTO_MUTEX_lock_read(&state->clear_drbg_lock); |
431 | | #endif |
432 | 0 | if (!CTR_DRBG_reseed(&state->drbg, seed, reseed_additional_data, |
433 | 0 | reseed_additional_data_len)) { |
434 | 0 | abort(); |
435 | 0 | } |
436 | 0 | state->calls = 0; |
437 | 0 | state->fork_generation = fork_generation; |
438 | 0 | state->fork_unsafe_buffering = fork_unsafe_buffering; |
439 | 4.28k | } else { |
440 | | #if defined(BORINGSSL_FIPS) |
441 | | CRYPTO_MUTEX_lock_read(&state->clear_drbg_lock); |
442 | | #endif |
443 | 4.28k | } |
444 | | |
445 | 4.28k | int first_call = 1; |
446 | 8.57k | while (out_len > 0) { |
447 | 4.28k | size_t todo = out_len; |
448 | 4.28k | if (todo > CTR_DRBG_MAX_GENERATE_LENGTH) { |
449 | 0 | todo = CTR_DRBG_MAX_GENERATE_LENGTH; |
450 | 0 | } |
451 | | |
452 | 4.28k | if (!CTR_DRBG_generate(&state->drbg, out, todo, additional_data, |
453 | 4.28k | first_call ? sizeof(additional_data) : 0)) { |
454 | 0 | abort(); |
455 | 0 | } |
456 | | |
457 | 4.28k | out += todo; |
458 | 4.28k | out_len -= todo; |
459 | | // Though we only check before entering the loop, this cannot add enough to |
460 | | // overflow a |size_t|. |
461 | 4.28k | state->calls++; |
462 | 4.28k | first_call = 0; |
463 | 4.28k | } |
464 | | |
465 | 4.28k | if (state == &stack_state) { |
466 | 0 | CTR_DRBG_clear(&state->drbg); |
467 | 0 | } |
468 | | |
469 | | #if defined(BORINGSSL_FIPS) |
470 | | CRYPTO_MUTEX_unlock_read(&state->clear_drbg_lock); |
471 | | #endif |
472 | 4.28k | return bcm_infallible_approved; |
473 | 4.28k | } |
474 | | |
475 | 4.20k | bcm_infallible BCM_rand_bytes(uint8_t *out, size_t out_len) { |
476 | 4.20k | static const uint8_t kZeroAdditionalData[32] = {0}; |
477 | 4.20k | BCM_rand_bytes_with_additional_data(out, out_len, kZeroAdditionalData); |
478 | 4.20k | return bcm_infallible_approved; |
479 | 4.20k | } |