1 /* Copyright (c) 2015, Google Inc.
2 *
3 * Permission to use, copy, modify, and/or distribute this software for any
4 * purpose with or without fee is hereby granted, provided that the above
5 * copyright notice and this permission notice appear in all copies.
6 *
7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14
15 #ifndef OPENSSL_HEADER_CRYPTO_RAND_INTERNAL_H
16 #define OPENSSL_HEADER_CRYPTO_RAND_INTERNAL_H
17
18 #include <openssl/aes.h>
19 #include <openssl/ctrdrbg.h>
20
21 #include "../../internal.h"
22 #include "../modes/internal.h"
23
24 #if defined(__cplusplus)
25 extern "C" {
26 #endif
27
28
29 #if !defined(OPENSSL_WINDOWS) && !defined(OPENSSL_FUCHSIA) && \
30 !defined(BORINGSSL_UNSAFE_DETERMINISTIC_MODE) && !defined(OPENSSL_TRUSTY)
31 #define OPENSSL_URANDOM
32 #endif
33
34 // RAND_bytes_with_additional_data samples from the RNG after mixing 32 bytes
35 // from |user_additional_data| in.
36 void RAND_bytes_with_additional_data(uint8_t *out, size_t out_len,
37 const uint8_t user_additional_data[32]);
38
39 #if defined(BORINGSSL_FIPS)
40
41 // We overread from /dev/urandom or RDRAND by a factor of 10 and XOR to whiten.
42 #define BORINGSSL_FIPS_OVERREAD 10
43
44 // CRYPTO_get_seed_entropy writes |out_entropy_len| bytes of entropy, suitable
45 // for seeding a DRBG, to |out_entropy|. It sets |*out_used_cpu| to one if the
46 // entropy came directly from the CPU and zero if it came from the OS. It
47 // actively obtains entropy from the CPU/OS and so should not be called from
48 // within the FIPS module.
49 void CRYPTO_get_seed_entropy(uint8_t *out_entropy, size_t out_entropy_len,
50 int *out_used_cpu);
51
52 // RAND_load_entropy supplies |entropy_len| bytes of entropy to the module. The
53 // |want_additional_input| parameter is true iff the entropy was obtained from
54 // a source other than the system, e.g. directly from the CPU.
55 void RAND_load_entropy(const uint8_t *entropy, size_t entropy_len,
56 int want_additional_input);
57
58 // RAND_need_entropy is implemented outside of the FIPS module and is called
59 // when the module has stopped because it has run out of entropy.
60 void RAND_need_entropy(size_t bytes_needed);
61
62 #endif // BORINGSSL_FIPS
63
64 // CRYPTO_sysrand fills |len| bytes at |buf| with entropy from the operating
65 // system.
66 void CRYPTO_sysrand(uint8_t *buf, size_t len);
67
68 // CRYPTO_sysrand_for_seed fills |len| bytes at |buf| with entropy from the
69 // operating system. It may draw from the |GRND_RANDOM| pool on Android,
70 // depending on the vendor's configuration.
71 void CRYPTO_sysrand_for_seed(uint8_t *buf, size_t len);
72
73 #if defined(OPENSSL_URANDOM)
74 // CRYPTO_init_sysrand initializes long-lived resources needed to draw entropy
75 // from the operating system.
76 void CRYPTO_init_sysrand(void);
77
78 // CRYPTO_sysrand_if_available fills |len| bytes at |buf| with entropy from the
79 // operating system, or early /dev/urandom data, and returns 1, _if_ the entropy
80 // pool is initialized or if getrandom() is not available and not in FIPS mode.
81 // Otherwise it will not block and will instead fill |buf| with all zeros and
82 // return 0.
83 int CRYPTO_sysrand_if_available(uint8_t *buf, size_t len);
84 #else
CRYPTO_init_sysrand(void)85 OPENSSL_INLINE void CRYPTO_init_sysrand(void) {}
86
CRYPTO_sysrand_if_available(uint8_t * buf,size_t len)87 OPENSSL_INLINE int CRYPTO_sysrand_if_available(uint8_t *buf, size_t len) {
88 CRYPTO_sysrand(buf, len);
89 return 1;
90 }
91 #endif
92
93 // rand_fork_unsafe_buffering_enabled returns whether fork-unsafe buffering has
94 // been enabled via |RAND_enable_fork_unsafe_buffering|.
95 int rand_fork_unsafe_buffering_enabled(void);
96
97 // CTR_DRBG_STATE contains the state of a CTR_DRBG based on AES-256. See SP
98 // 800-90Ar1.
99 struct ctr_drbg_state_st {
100 AES_KEY ks;
101 block128_f block;
102 ctr128_f ctr;
103 union {
104 uint8_t bytes[16];
105 uint32_t words[4];
106 } counter;
107 uint64_t reseed_counter;
108 };
109
110 // CTR_DRBG_init initialises |*drbg| given |CTR_DRBG_ENTROPY_LEN| bytes of
111 // entropy in |entropy| and, optionally, a personalization string up to
112 // |CTR_DRBG_ENTROPY_LEN| bytes in length. It returns one on success and zero
113 // on error.
114 OPENSSL_EXPORT int CTR_DRBG_init(CTR_DRBG_STATE *drbg,
115 const uint8_t entropy[CTR_DRBG_ENTROPY_LEN],
116 const uint8_t *personalization,
117 size_t personalization_len);
118
119 #if defined(OPENSSL_X86_64) && !defined(OPENSSL_NO_ASM)
120
have_rdrand(void)121 OPENSSL_INLINE int have_rdrand(void) {
122 return CRYPTO_is_RDRAND_capable();
123 }
124
125 // have_fast_rdrand returns true if RDRAND is supported and it's reasonably
126 // fast. Concretely the latter is defined by whether the chip is Intel (fast) or
127 // not (assumed slow).
have_fast_rdrand(void)128 OPENSSL_INLINE int have_fast_rdrand(void) {
129 return CRYPTO_is_RDRAND_capable() && CRYPTO_is_intel_cpu();
130 }
131
132 // CRYPTO_rdrand writes eight bytes of random data from the hardware RNG to
133 // |out|. It returns one on success or zero on hardware failure.
134 int CRYPTO_rdrand(uint8_t out[8]);
135
136 // CRYPTO_rdrand_multiple8_buf fills |len| bytes at |buf| with random data from
137 // the hardware RNG. The |len| argument must be a multiple of eight. It returns
138 // one on success and zero on hardware failure.
139 int CRYPTO_rdrand_multiple8_buf(uint8_t *buf, size_t len);
140
141 #else // OPENSSL_X86_64 && !OPENSSL_NO_ASM
142
have_rdrand(void)143 OPENSSL_INLINE int have_rdrand(void) {
144 return 0;
145 }
146
have_fast_rdrand(void)147 OPENSSL_INLINE int have_fast_rdrand(void) {
148 return 0;
149 }
150
151 #endif // OPENSSL_X86_64 && !OPENSSL_NO_ASM
152
153
154 #if defined(__cplusplus)
155 } // extern C
156 #endif
157
158 #endif // OPENSSL_HEADER_CRYPTO_RAND_INTERNAL_H
159