/src/openssl35/providers/implementations/rands/drbg_hmac.c
Line | Count | Source |
1 | | /* |
2 | | * Copyright 2011-2025 The OpenSSL Project Authors. All Rights Reserved. |
3 | | * |
4 | | * Licensed under the Apache License 2.0 (the "License"). You may not use |
5 | | * this file except in compliance with the License. You can obtain a copy |
6 | | * in the file LICENSE in the source distribution or at |
7 | | * https://www.openssl.org/source/license.html |
8 | | */ |
9 | | |
10 | | #include <stdlib.h> |
11 | | #include <string.h> |
12 | | #include <openssl/crypto.h> |
13 | | #include <openssl/err.h> |
14 | | #include <openssl/rand.h> |
15 | | #include <openssl/proverr.h> |
16 | | #include "internal/thread_once.h" |
17 | | #include "prov/providercommon.h" |
18 | | #include "prov/implementations.h" |
19 | | #include "prov/provider_ctx.h" |
20 | | #include "prov/hmac_drbg.h" |
21 | | #include "drbg_local.h" |
22 | | #include "crypto/evp.h" |
23 | | #include "crypto/evp/evp_local.h" |
24 | | #include "internal/provider.h" |
25 | | |
26 | | static OSSL_FUNC_rand_newctx_fn drbg_hmac_new_wrapper; |
27 | | static OSSL_FUNC_rand_freectx_fn drbg_hmac_free; |
28 | | static OSSL_FUNC_rand_instantiate_fn drbg_hmac_instantiate_wrapper; |
29 | | static OSSL_FUNC_rand_uninstantiate_fn drbg_hmac_uninstantiate_wrapper; |
30 | | static OSSL_FUNC_rand_generate_fn drbg_hmac_generate_wrapper; |
31 | | static OSSL_FUNC_rand_reseed_fn drbg_hmac_reseed_wrapper; |
32 | | static OSSL_FUNC_rand_settable_ctx_params_fn drbg_hmac_settable_ctx_params; |
33 | | static OSSL_FUNC_rand_set_ctx_params_fn drbg_hmac_set_ctx_params; |
34 | | static OSSL_FUNC_rand_gettable_ctx_params_fn drbg_hmac_gettable_ctx_params; |
35 | | static OSSL_FUNC_rand_get_ctx_params_fn drbg_hmac_get_ctx_params; |
36 | | static OSSL_FUNC_rand_verify_zeroization_fn drbg_hmac_verify_zeroization; |
37 | | |
38 | | static int drbg_hmac_set_ctx_params_locked(void *vctx, const OSSL_PARAM params[]); |
39 | | |
40 | | /* |
41 | | * Called twice by SP800-90Ar1 10.1.2.2 HMAC_DRBG_Update_Process. |
42 | | * |
43 | | * hmac is an object that holds the input/output Key and Value (K and V). |
44 | | * inbyte is 0x00 on the first call and 0x01 on the second call. |
45 | | * in1, in2, in3 are optional inputs that can be NULL. |
46 | | * in1len, in2len, in3len are the lengths of the input buffers. |
47 | | * |
48 | | * The returned K,V is: |
49 | | * hmac->K = HMAC(hmac->K, hmac->V || inbyte || [in1] || [in2] || [in3]) |
50 | | * hmac->V = HMAC(hmac->K, hmac->V) |
51 | | * |
52 | | * Returns zero if an error occurs otherwise it returns 1. |
53 | | */ |
54 | | static int do_hmac(PROV_DRBG_HMAC *hmac, unsigned char inbyte, |
55 | | const unsigned char *in1, size_t in1len, |
56 | | const unsigned char *in2, size_t in2len, |
57 | | const unsigned char *in3, size_t in3len) |
58 | 2.00k | { |
59 | 2.00k | EVP_MAC_CTX *ctx = hmac->ctx; |
60 | | |
61 | 2.00k | if (!EVP_MAC_init(ctx, hmac->K, hmac->blocklen, NULL) |
62 | | /* K = HMAC(K, V || inbyte || [in1] || [in2] || [in3]) */ |
63 | 1.98k | || !EVP_MAC_update(ctx, hmac->V, hmac->blocklen) |
64 | 1.98k | || !EVP_MAC_update(ctx, &inbyte, 1) |
65 | 1.98k | || !(in1 == NULL || in1len == 0 || EVP_MAC_update(ctx, in1, in1len)) |
66 | 1.98k | || !(in2 == NULL || in2len == 0 || EVP_MAC_update(ctx, in2, in2len)) |
67 | 1.98k | || !(in3 == NULL || in3len == 0 || EVP_MAC_update(ctx, in3, in3len)) |
68 | 1.98k | || !EVP_MAC_final(ctx, hmac->K, NULL, sizeof(hmac->K))) |
69 | 21 | return 0; |
70 | | |
71 | | /* V = HMAC(K, V) */ |
72 | 1.98k | return EVP_MAC_init(ctx, hmac->K, hmac->blocklen, NULL) |
73 | 1.98k | && EVP_MAC_update(ctx, hmac->V, hmac->blocklen) |
74 | 1.98k | && EVP_MAC_final(ctx, hmac->V, NULL, sizeof(hmac->V)); |
75 | 2.00k | } |
76 | | |
77 | | /* |
78 | | * SP800-90Ar1 10.1.2.2 HMAC_DRBG_Update_Process |
79 | | * |
80 | | * |
81 | | * Updates the drbg objects Key(K) and Value(V) using the following algorithm: |
82 | | * K,V = do_hmac(hmac, 0, in1, in2, in3) |
83 | | * if (any input is not NULL) |
84 | | * K,V = do_hmac(hmac, 1, in1, in2, in3) |
85 | | * |
86 | | * where in1, in2, in3 are optional input buffers that can be NULL. |
87 | | * in1len, in2len, in3len are the lengths of the input buffers. |
88 | | * |
89 | | * Returns zero if an error occurs otherwise it returns 1. |
90 | | */ |
91 | | static int drbg_hmac_update(PROV_DRBG_HMAC *hmac, |
92 | | const unsigned char *in1, size_t in1len, |
93 | | const unsigned char *in2, size_t in2len, |
94 | | const unsigned char *in3, size_t in3len) |
95 | 1.25k | { |
96 | | /* (Steps 1-2) K = HMAC(K, V||0x00||provided_data). V = HMAC(K,V) */ |
97 | 1.25k | if (!do_hmac(hmac, 0x00, in1, in1len, in2, in2len, in3, in3len)) |
98 | 21 | return 0; |
99 | | /* (Step 3) If provided_data == NULL then return (K,V) */ |
100 | 1.23k | if (in1len == 0 && in2len == 0 && in3len == 0) |
101 | 482 | return 1; |
102 | | /* (Steps 4-5) K = HMAC(K, V||0x01||provided_data). V = HMAC(K,V) */ |
103 | 749 | return do_hmac(hmac, 0x01, in1, in1len, in2, in2len, in3, in3len); |
104 | 1.23k | } |
105 | | |
106 | | /* |
107 | | * SP800-90Ar1 10.1.2.3 HMAC_DRBG_Instantiate_Process: |
108 | | * |
109 | | * This sets the drbg Key (K) to all zeros, and Value (V) to all 1's. |
110 | | * and then calls (K,V) = drbg_hmac_update() with input parameters: |
111 | | * ent = entropy data (Can be NULL) of length ent_len. |
112 | | * nonce = nonce data (Can be NULL) of length nonce_len. |
113 | | * pstr = personalization data (Can be NULL) of length pstr_len. |
114 | | * |
115 | | * Returns zero if an error occurs otherwise it returns 1. |
116 | | */ |
117 | | int ossl_drbg_hmac_init(PROV_DRBG_HMAC *hmac, |
118 | | const unsigned char *ent, size_t ent_len, |
119 | | const unsigned char *nonce, size_t nonce_len, |
120 | | const unsigned char *pstr, size_t pstr_len) |
121 | 528 | { |
122 | 528 | if (hmac->ctx == NULL) { |
123 | 1 | ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_MAC); |
124 | 1 | return 0; |
125 | 1 | } |
126 | | |
127 | | /* (Step 2) Key = 0x00 00...00 */ |
128 | 527 | memset(hmac->K, 0x00, hmac->blocklen); |
129 | | /* (Step 3) V = 0x01 01...01 */ |
130 | 527 | memset(hmac->V, 0x01, hmac->blocklen); |
131 | | /* (Step 4) (K,V) = HMAC_DRBG_Update(entropy||nonce||pers string, K, V) */ |
132 | 527 | return drbg_hmac_update(hmac, ent, ent_len, nonce, nonce_len, pstr, |
133 | 527 | pstr_len); |
134 | 528 | } |
135 | | static int drbg_hmac_instantiate(PROV_DRBG *drbg, |
136 | | const unsigned char *ent, size_t ent_len, |
137 | | const unsigned char *nonce, size_t nonce_len, |
138 | | const unsigned char *pstr, size_t pstr_len) |
139 | 236 | { |
140 | 236 | return ossl_drbg_hmac_init((PROV_DRBG_HMAC *)drbg->data, ent, ent_len, |
141 | 236 | nonce, nonce_len, pstr, pstr_len); |
142 | 236 | } |
143 | | |
144 | | static int drbg_hmac_instantiate_wrapper(void *vdrbg, unsigned int strength, |
145 | | int prediction_resistance, |
146 | | const unsigned char *pstr, |
147 | | size_t pstr_len, |
148 | | const OSSL_PARAM params[]) |
149 | 0 | { |
150 | 0 | PROV_DRBG *drbg = (PROV_DRBG *)vdrbg; |
151 | 0 | int ret = 0; |
152 | |
|
153 | 0 | if (drbg->lock != NULL && !CRYPTO_THREAD_write_lock(drbg->lock)) |
154 | 0 | return 0; |
155 | | |
156 | 0 | if (!ossl_prov_is_running() |
157 | 0 | || !drbg_hmac_set_ctx_params_locked(drbg, params)) |
158 | 0 | goto err; |
159 | 0 | ret = ossl_prov_drbg_instantiate(drbg, strength, prediction_resistance, |
160 | 0 | pstr, pstr_len); |
161 | 0 | err: |
162 | 0 | if (drbg->lock != NULL) |
163 | 0 | CRYPTO_THREAD_unlock(drbg->lock); |
164 | 0 | return ret; |
165 | 0 | } |
166 | | |
167 | | /* |
168 | | * SP800-90Ar1 10.1.2.4 HMAC_DRBG_Reseed_Process: |
169 | | * |
170 | | * Reseeds the drbg's Key (K) and Value (V) by calling |
171 | | * (K,V) = drbg_hmac_update() with the following input parameters: |
172 | | * ent = entropy input data (Can be NULL) of length ent_len. |
173 | | * adin = additional input data (Can be NULL) of length adin_len. |
174 | | * |
175 | | * Returns zero if an error occurs otherwise it returns 1. |
176 | | */ |
177 | | static int drbg_hmac_reseed(PROV_DRBG *drbg, |
178 | | const unsigned char *ent, size_t ent_len, |
179 | | const unsigned char *adin, size_t adin_len) |
180 | 243 | { |
181 | 243 | PROV_DRBG_HMAC *hmac = (PROV_DRBG_HMAC *)drbg->data; |
182 | | |
183 | | /* (Step 2) (K,V) = HMAC_DRBG_Update(entropy||additional_input, K, V) */ |
184 | 243 | return drbg_hmac_update(hmac, ent, ent_len, adin, adin_len, NULL, 0); |
185 | 243 | } |
186 | | |
187 | | static int drbg_hmac_reseed_wrapper(void *vdrbg, int prediction_resistance, |
188 | | const unsigned char *ent, size_t ent_len, |
189 | | const unsigned char *adin, size_t adin_len) |
190 | 190 | { |
191 | 190 | PROV_DRBG *drbg = (PROV_DRBG *)vdrbg; |
192 | | |
193 | 190 | return ossl_prov_drbg_reseed(drbg, prediction_resistance, ent, ent_len, |
194 | 190 | adin, adin_len); |
195 | 190 | } |
196 | | |
197 | | /* |
198 | | * SP800-90Ar1 10.1.2.5 HMAC_DRBG_Generate_Process: |
199 | | * |
200 | | * Generates pseudo random bytes and updates the internal K,V for the drbg. |
201 | | * out is a buffer to fill with outlen bytes of pseudo random data. |
202 | | * adin is an additional_input string of size adin_len that may be NULL. |
203 | | * |
204 | | * Returns zero if an error occurs otherwise it returns 1. |
205 | | */ |
206 | | int ossl_drbg_hmac_generate(PROV_DRBG_HMAC *hmac, |
207 | | unsigned char *out, size_t outlen, |
208 | | const unsigned char *adin, size_t adin_len) |
209 | 506 | { |
210 | 506 | EVP_MAC_CTX *ctx = hmac->ctx; |
211 | 506 | const unsigned char *temp = hmac->V; |
212 | | |
213 | | /* (Step 2) if adin != NULL then (K,V) = HMAC_DRBG_Update(adin, K, V) */ |
214 | 506 | if (adin != NULL |
215 | 0 | && adin_len > 0 |
216 | 0 | && !drbg_hmac_update(hmac, adin, adin_len, NULL, 0, NULL, 0)) |
217 | 0 | return 0; |
218 | | |
219 | | /* |
220 | | * (Steps 3-5) temp = NULL |
221 | | * while (len(temp) < outlen) { |
222 | | * V = HMAC(K, V) |
223 | | * temp = temp || V |
224 | | * } |
225 | | */ |
226 | 35.1k | for (;;) { |
227 | 35.1k | if (!EVP_MAC_init(ctx, hmac->K, hmac->blocklen, NULL) |
228 | 35.1k | || !EVP_MAC_update(ctx, temp, hmac->blocklen)) |
229 | 0 | return 0; |
230 | | |
231 | 35.1k | if (outlen > hmac->blocklen) { |
232 | 34.7k | if (!EVP_MAC_final(ctx, out, NULL, outlen)) |
233 | 24 | return 0; |
234 | 34.6k | temp = out; |
235 | 34.6k | } else { |
236 | 482 | if (!EVP_MAC_final(ctx, hmac->V, NULL, sizeof(hmac->V))) |
237 | 0 | return 0; |
238 | 482 | memcpy(out, hmac->V, outlen); |
239 | 482 | break; |
240 | 482 | } |
241 | 34.6k | out += hmac->blocklen; |
242 | 34.6k | outlen -= hmac->blocklen; |
243 | 34.6k | } |
244 | | /* (Step 6) (K,V) = HMAC_DRBG_Update(adin, K, V) */ |
245 | 482 | if (!drbg_hmac_update(hmac, adin, adin_len, NULL, 0, NULL, 0)) |
246 | 0 | return 0; |
247 | | |
248 | 482 | return 1; |
249 | 482 | } |
250 | | |
251 | | static int drbg_hmac_generate(PROV_DRBG *drbg, |
252 | | unsigned char *out, size_t outlen, |
253 | | const unsigned char *adin, size_t adin_len) |
254 | 214 | { |
255 | 214 | return ossl_drbg_hmac_generate((PROV_DRBG_HMAC *)drbg->data, out, outlen, |
256 | 214 | adin, adin_len); |
257 | 214 | } |
258 | | |
259 | | static int drbg_hmac_generate_wrapper(void *vdrbg, |
260 | | unsigned char *out, size_t outlen, unsigned int strength, |
261 | | int prediction_resistance, const unsigned char *adin, size_t adin_len) |
262 | 236 | { |
263 | 236 | PROV_DRBG *drbg = (PROV_DRBG *)vdrbg; |
264 | | |
265 | 236 | return ossl_prov_drbg_generate(drbg, out, outlen, strength, |
266 | 236 | prediction_resistance, adin, adin_len); |
267 | 236 | } |
268 | | |
269 | | static int drbg_hmac_uninstantiate(PROV_DRBG *drbg) |
270 | 0 | { |
271 | 0 | PROV_DRBG_HMAC *hmac = (PROV_DRBG_HMAC *)drbg->data; |
272 | |
|
273 | 0 | OPENSSL_cleanse(hmac->K, sizeof(hmac->K)); |
274 | 0 | OPENSSL_cleanse(hmac->V, sizeof(hmac->V)); |
275 | 0 | return ossl_prov_drbg_uninstantiate(drbg); |
276 | 0 | } |
277 | | |
278 | | static int drbg_hmac_uninstantiate_wrapper(void *vdrbg) |
279 | 0 | { |
280 | 0 | PROV_DRBG *drbg = (PROV_DRBG *)vdrbg; |
281 | 0 | int ret; |
282 | |
|
283 | 0 | if (drbg->lock != NULL && !CRYPTO_THREAD_write_lock(drbg->lock)) |
284 | 0 | return 0; |
285 | | |
286 | 0 | ret = drbg_hmac_uninstantiate(drbg); |
287 | |
|
288 | 0 | if (drbg->lock != NULL) |
289 | 0 | CRYPTO_THREAD_unlock(drbg->lock); |
290 | |
|
291 | 0 | return ret; |
292 | 0 | } |
293 | | |
294 | | static int drbg_hmac_verify_zeroization(void *vdrbg) |
295 | 0 | { |
296 | 0 | PROV_DRBG *drbg = (PROV_DRBG *)vdrbg; |
297 | 0 | PROV_DRBG_HMAC *hmac = (PROV_DRBG_HMAC *)drbg->data; |
298 | 0 | int ret = 0; |
299 | |
|
300 | 0 | if (drbg->lock != NULL && !CRYPTO_THREAD_read_lock(drbg->lock)) |
301 | 0 | return 0; |
302 | | |
303 | 0 | PROV_DRBG_VERIFY_ZEROIZATION(hmac->K); |
304 | 0 | PROV_DRBG_VERIFY_ZEROIZATION(hmac->V); |
305 | |
|
306 | 0 | ret = 1; |
307 | 0 | err: |
308 | 0 | if (drbg->lock != NULL) |
309 | 0 | CRYPTO_THREAD_unlock(drbg->lock); |
310 | 0 | return ret; |
311 | 0 | } |
312 | | |
313 | | static int drbg_hmac_new(PROV_DRBG *drbg) |
314 | 357 | { |
315 | 357 | PROV_DRBG_HMAC *hmac; |
316 | | |
317 | 357 | hmac = OPENSSL_secure_zalloc(sizeof(*hmac)); |
318 | 357 | if (hmac == NULL) |
319 | 0 | return 0; |
320 | | |
321 | 357 | OSSL_FIPS_IND_INIT(drbg) |
322 | | |
323 | 357 | drbg->data = hmac; |
324 | | /* See SP800-57 Part1 Rev4 5.6.1 Table 3 */ |
325 | 357 | drbg->max_entropylen = DRBG_MAX_LENGTH; |
326 | 357 | drbg->max_noncelen = DRBG_MAX_LENGTH; |
327 | 357 | drbg->max_perslen = DRBG_MAX_LENGTH; |
328 | 357 | drbg->max_adinlen = DRBG_MAX_LENGTH; |
329 | | |
330 | | /* Maximum number of bits per request = 2^19 = 2^16 bytes */ |
331 | 357 | drbg->max_request = 1 << 16; |
332 | 357 | return 1; |
333 | 357 | } |
334 | | |
335 | | static void *drbg_hmac_new_wrapper(void *provctx, void *parent, |
336 | | const OSSL_DISPATCH *parent_dispatch) |
337 | 357 | { |
338 | 357 | return ossl_rand_drbg_new(provctx, parent, parent_dispatch, |
339 | 357 | &drbg_hmac_new, &drbg_hmac_free, |
340 | 357 | &drbg_hmac_instantiate, &drbg_hmac_uninstantiate, |
341 | 357 | &drbg_hmac_reseed, &drbg_hmac_generate); |
342 | 357 | } |
343 | | |
344 | | static void drbg_hmac_free(void *vdrbg) |
345 | 357 | { |
346 | 357 | PROV_DRBG *drbg = (PROV_DRBG *)vdrbg; |
347 | 357 | PROV_DRBG_HMAC *hmac; |
348 | | |
349 | 357 | if (drbg != NULL && (hmac = (PROV_DRBG_HMAC *)drbg->data) != NULL) { |
350 | 357 | EVP_MAC_CTX_free(hmac->ctx); |
351 | 357 | ossl_prov_digest_reset(&hmac->digest); |
352 | 357 | OPENSSL_secure_clear_free(hmac, sizeof(*hmac)); |
353 | 357 | } |
354 | 357 | ossl_rand_drbg_free(drbg); |
355 | 357 | } |
356 | | |
357 | | static int drbg_hmac_get_ctx_params(void *vdrbg, OSSL_PARAM params[]) |
358 | 112 | { |
359 | 112 | PROV_DRBG *drbg = (PROV_DRBG *)vdrbg; |
360 | 112 | PROV_DRBG_HMAC *hmac = (PROV_DRBG_HMAC *)drbg->data; |
361 | 112 | const char *name; |
362 | 112 | const EVP_MD *md; |
363 | 112 | OSSL_PARAM *p; |
364 | 112 | int ret = 0, complete = 0; |
365 | | |
366 | 112 | if (!ossl_drbg_get_ctx_params_no_lock(drbg, params, &complete)) |
367 | 0 | return 0; |
368 | | |
369 | 112 | if (complete) |
370 | 112 | return 1; |
371 | | |
372 | 0 | if (drbg->lock != NULL && !CRYPTO_THREAD_read_lock(drbg->lock)) |
373 | 0 | return 0; |
374 | | |
375 | 0 | p = OSSL_PARAM_locate(params, OSSL_DRBG_PARAM_MAC); |
376 | 0 | if (p != NULL) { |
377 | 0 | if (hmac->ctx == NULL) |
378 | 0 | goto err; |
379 | 0 | name = EVP_MAC_get0_name(EVP_MAC_CTX_get0_mac(hmac->ctx)); |
380 | 0 | if (!OSSL_PARAM_set_utf8_string(p, name)) |
381 | 0 | goto err; |
382 | 0 | } |
383 | | |
384 | 0 | p = OSSL_PARAM_locate(params, OSSL_DRBG_PARAM_DIGEST); |
385 | 0 | if (p != NULL) { |
386 | 0 | md = ossl_prov_digest_md(&hmac->digest); |
387 | 0 | if (md == NULL || !OSSL_PARAM_set_utf8_string(p, EVP_MD_get0_name(md))) |
388 | 0 | goto err; |
389 | 0 | } |
390 | | |
391 | 0 | ret = ossl_drbg_get_ctx_params(drbg, params); |
392 | 0 | err: |
393 | 0 | if (drbg->lock != NULL) |
394 | 0 | CRYPTO_THREAD_unlock(drbg->lock); |
395 | |
|
396 | 0 | return ret; |
397 | 0 | } |
398 | | |
399 | | static const OSSL_PARAM *drbg_hmac_gettable_ctx_params(ossl_unused void *vctx, |
400 | | ossl_unused void *p_ctx) |
401 | 0 | { |
402 | 0 | static const OSSL_PARAM known_gettable_ctx_params[] = { |
403 | 0 | OSSL_PARAM_utf8_string(OSSL_DRBG_PARAM_MAC, NULL, 0), |
404 | 0 | OSSL_PARAM_utf8_string(OSSL_DRBG_PARAM_DIGEST, NULL, 0), |
405 | 0 | OSSL_PARAM_DRBG_GETTABLE_CTX_COMMON, |
406 | 0 | OSSL_FIPS_IND_GETTABLE_CTX_PARAM() |
407 | 0 | OSSL_PARAM_END |
408 | 0 | }; |
409 | 0 | return known_gettable_ctx_params; |
410 | 0 | } |
411 | | |
412 | | static int drbg_fetch_algs_from_prov(const OSSL_PARAM params[], |
413 | | OSSL_LIB_CTX *libctx, |
414 | | EVP_MAC_CTX **macctx, |
415 | | EVP_MD **digest) |
416 | 72 | { |
417 | 72 | OSSL_PROVIDER *prov = NULL; |
418 | 72 | const OSSL_PARAM *p; |
419 | 72 | EVP_MD *md = NULL; |
420 | 72 | EVP_MAC *mac = NULL; |
421 | 72 | int ret = 0; |
422 | | |
423 | 72 | if (macctx == NULL || digest == NULL) |
424 | 0 | return 0; |
425 | | |
426 | 72 | if ((p = OSSL_PARAM_locate_const(params, |
427 | 72 | OSSL_PROV_PARAM_CORE_PROV_NAME)) |
428 | 72 | == NULL) |
429 | 72 | return 0; |
430 | 0 | if (p->data_type != OSSL_PARAM_UTF8_STRING) |
431 | 0 | return 0; |
432 | 0 | if ((prov = ossl_provider_find(libctx, (const char *)p->data, 1)) == NULL) |
433 | 0 | return 0; |
434 | | |
435 | 0 | p = OSSL_PARAM_locate_const(params, OSSL_ALG_PARAM_DIGEST); |
436 | 0 | if (p) { |
437 | 0 | if (p->data_type != OSSL_PARAM_UTF8_STRING) |
438 | 0 | goto done; |
439 | | |
440 | 0 | md = evp_digest_fetch_from_prov(prov, (const char *)p->data, NULL); |
441 | 0 | if (md) { |
442 | 0 | EVP_MD_free(*digest); |
443 | 0 | *digest = md; |
444 | 0 | } else { |
445 | 0 | goto done; |
446 | 0 | } |
447 | 0 | } |
448 | | |
449 | 0 | p = OSSL_PARAM_locate_const(params, OSSL_ALG_PARAM_MAC); |
450 | 0 | if (p == NULL) { |
451 | 0 | ret = 1; |
452 | 0 | goto done; |
453 | 0 | } |
454 | | |
455 | 0 | if (p->data_type != OSSL_PARAM_UTF8_STRING) |
456 | 0 | goto done; |
457 | | |
458 | 0 | EVP_MAC_CTX_free(*macctx); |
459 | 0 | *macctx = NULL; |
460 | |
|
461 | 0 | mac = evp_mac_fetch_from_prov(prov, (const char *)p->data, NULL); |
462 | 0 | if (mac) { |
463 | 0 | *macctx = EVP_MAC_CTX_new(mac); |
464 | | /* The context holds on to the MAC */ |
465 | 0 | EVP_MAC_free(mac); |
466 | 0 | ret = 1; |
467 | 0 | } |
468 | |
|
469 | 0 | done: |
470 | 0 | ossl_provider_free(prov); |
471 | 0 | return ret; |
472 | 0 | } |
473 | | |
474 | | static int drbg_hmac_set_ctx_params_locked(void *vctx, const OSSL_PARAM params[]) |
475 | 177 | { |
476 | 177 | PROV_DRBG *ctx = (PROV_DRBG *)vctx; |
477 | 177 | PROV_DRBG_HMAC *hmac = (PROV_DRBG_HMAC *)ctx->data; |
478 | 177 | OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(ctx->provctx); |
479 | 177 | EVP_MD *prov_md = NULL; |
480 | 177 | const EVP_MD *md; |
481 | 177 | int md_size; |
482 | | |
483 | 177 | if (!OSSL_FIPS_IND_SET_CTX_PARAM(ctx, OSSL_FIPS_IND_SETTABLE0, params, |
484 | 177 | OSSL_DRBG_PARAM_FIPS_DIGEST_CHECK)) |
485 | 0 | return 0; |
486 | | |
487 | | /* try to fetch mac and digest from provider */ |
488 | 177 | (void)ERR_set_mark(); |
489 | 177 | if (!drbg_fetch_algs_from_prov(params, libctx, &hmac->ctx, &prov_md)) { |
490 | 174 | (void)ERR_pop_to_mark(); |
491 | | /* fall back to full implementation search */ |
492 | 174 | if (!ossl_prov_digest_load_from_params(&hmac->digest, params, libctx)) |
493 | 36 | return 0; |
494 | | |
495 | 138 | if (!ossl_prov_macctx_load_from_params(&hmac->ctx, params, |
496 | 138 | NULL, NULL, NULL, libctx)) |
497 | 22 | return 0; |
498 | 138 | } else { |
499 | 3 | (void)ERR_clear_last_mark(); |
500 | 3 | if (prov_md) |
501 | 3 | ossl_prov_digest_set_md(&hmac->digest, prov_md); |
502 | 3 | } |
503 | | |
504 | 119 | md = ossl_prov_digest_md(&hmac->digest); |
505 | 119 | if (md != NULL && !ossl_drbg_verify_digest(ctx, libctx, md)) |
506 | 3 | return 0; /* Error already raised for us */ |
507 | | |
508 | 116 | if (md != NULL && hmac->ctx != NULL) { |
509 | | /* These are taken from SP 800-90 10.1 Table 2 */ |
510 | 116 | md_size = EVP_MD_get_size(md); |
511 | 116 | if (md_size <= 0) |
512 | 3 | return 0; |
513 | 113 | hmac->blocklen = (size_t)md_size; |
514 | | /* See SP800-57 Part1 Rev4 5.6.1 Table 3 */ |
515 | 113 | ctx->strength = 64 * (int)(hmac->blocklen >> 3); |
516 | 113 | if (ctx->strength > 256) |
517 | 12 | ctx->strength = 256; |
518 | 113 | ctx->seedlen = hmac->blocklen; |
519 | 113 | ctx->min_entropylen = ctx->strength / 8; |
520 | 113 | ctx->min_noncelen = ctx->min_entropylen / 2; |
521 | 113 | } |
522 | | |
523 | 113 | return ossl_drbg_set_ctx_params(ctx, params); |
524 | 116 | } |
525 | | |
526 | | static int drbg_hmac_set_ctx_params(void *vctx, const OSSL_PARAM params[]) |
527 | 153 | { |
528 | 153 | PROV_DRBG *drbg = (PROV_DRBG *)vctx; |
529 | 153 | int ret; |
530 | | |
531 | 153 | if (drbg->lock != NULL && !CRYPTO_THREAD_write_lock(drbg->lock)) |
532 | 0 | return 0; |
533 | | |
534 | 153 | ret = drbg_hmac_set_ctx_params_locked(vctx, params); |
535 | | |
536 | 153 | if (drbg->lock != NULL) |
537 | 0 | CRYPTO_THREAD_unlock(drbg->lock); |
538 | | |
539 | 153 | return ret; |
540 | 153 | } |
541 | | |
542 | | static const OSSL_PARAM *drbg_hmac_settable_ctx_params(ossl_unused void *vctx, |
543 | | ossl_unused void *p_ctx) |
544 | 357 | { |
545 | 357 | static const OSSL_PARAM known_settable_ctx_params[] = { |
546 | 357 | OSSL_PARAM_utf8_string(OSSL_DRBG_PARAM_PROPERTIES, NULL, 0), |
547 | 357 | OSSL_PARAM_utf8_string(OSSL_DRBG_PARAM_DIGEST, NULL, 0), |
548 | 357 | OSSL_PARAM_utf8_string(OSSL_DRBG_PARAM_MAC, NULL, 0), |
549 | 357 | OSSL_PARAM_DRBG_SETTABLE_CTX_COMMON, |
550 | 357 | OSSL_FIPS_IND_SETTABLE_CTX_PARAM(OSSL_DRBG_PARAM_FIPS_DIGEST_CHECK) |
551 | | OSSL_PARAM_END |
552 | 357 | }; |
553 | 357 | return known_settable_ctx_params; |
554 | 357 | } |
555 | | |
556 | | const OSSL_DISPATCH ossl_drbg_ossl_hmac_functions[] = { |
557 | | { OSSL_FUNC_RAND_NEWCTX, (void (*)(void))drbg_hmac_new_wrapper }, |
558 | | { OSSL_FUNC_RAND_FREECTX, (void (*)(void))drbg_hmac_free }, |
559 | | { OSSL_FUNC_RAND_INSTANTIATE, |
560 | | (void (*)(void))drbg_hmac_instantiate_wrapper }, |
561 | | { OSSL_FUNC_RAND_UNINSTANTIATE, |
562 | | (void (*)(void))drbg_hmac_uninstantiate_wrapper }, |
563 | | { OSSL_FUNC_RAND_GENERATE, (void (*)(void))drbg_hmac_generate_wrapper }, |
564 | | { OSSL_FUNC_RAND_RESEED, (void (*)(void))drbg_hmac_reseed_wrapper }, |
565 | | { OSSL_FUNC_RAND_ENABLE_LOCKING, (void (*)(void))ossl_drbg_enable_locking }, |
566 | | { OSSL_FUNC_RAND_LOCK, (void (*)(void))ossl_drbg_lock }, |
567 | | { OSSL_FUNC_RAND_UNLOCK, (void (*)(void))ossl_drbg_unlock }, |
568 | | { OSSL_FUNC_RAND_SETTABLE_CTX_PARAMS, |
569 | | (void (*)(void))drbg_hmac_settable_ctx_params }, |
570 | | { OSSL_FUNC_RAND_SET_CTX_PARAMS, (void (*)(void))drbg_hmac_set_ctx_params }, |
571 | | { OSSL_FUNC_RAND_GETTABLE_CTX_PARAMS, |
572 | | (void (*)(void))drbg_hmac_gettable_ctx_params }, |
573 | | { OSSL_FUNC_RAND_GET_CTX_PARAMS, (void (*)(void))drbg_hmac_get_ctx_params }, |
574 | | { OSSL_FUNC_RAND_VERIFY_ZEROIZATION, |
575 | | (void (*)(void))drbg_hmac_verify_zeroization }, |
576 | | { OSSL_FUNC_RAND_GET_SEED, (void (*)(void))ossl_drbg_get_seed }, |
577 | | { OSSL_FUNC_RAND_CLEAR_SEED, (void (*)(void))ossl_drbg_clear_seed }, |
578 | | OSSL_DISPATCH_END |
579 | | }; |