1 /*
2 * Entropy accumulator implementation
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
6 */
7
8 #include "common.h"
9
10 #if defined(MBEDTLS_ENTROPY_C)
11
12 #if defined(MBEDTLS_TEST_NULL_ENTROPY)
13 #warning "**** WARNING! MBEDTLS_TEST_NULL_ENTROPY defined! "
14 #warning "**** THIS BUILD HAS NO DEFINED ENTROPY SOURCES "
15 #warning "**** THIS BUILD IS *NOT* SUITABLE FOR PRODUCTION USE "
16 #endif
17
18 #include "mbedtls/entropy.h"
19 #include "mbedtls/entropy_poll.h"
20 #include "mbedtls/platform_util.h"
21 #include "mbedtls/error.h"
22 #include "mbedtls/sha256.h"
23 #include "mbedtls/sha512.h"
24
25 #include <string.h>
26
27 #if defined(MBEDTLS_FS_IO)
28 #include <stdio.h>
29 #endif
30
31 #include "mbedtls/platform.h"
32
33 #include "mbedtls/platform.h"
34
35 #if defined(MBEDTLS_HAVEGE_C)
36 #include "mbedtls/havege.h"
37 #endif
38
39 #define ENTROPY_MAX_LOOP 256 /**< Maximum amount to loop before error */
40
mbedtls_entropy_init(mbedtls_entropy_context * ctx)41 void mbedtls_entropy_init(mbedtls_entropy_context *ctx)
42 {
43 ctx->source_count = 0;
44 memset(ctx->source, 0, sizeof(ctx->source));
45
46 #if defined(MBEDTLS_THREADING_C)
47 mbedtls_mutex_init(&ctx->mutex);
48 #endif
49
50 ctx->accumulator_started = 0;
51 #if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
52 mbedtls_sha512_init(&ctx->accumulator);
53 #else
54 mbedtls_sha256_init(&ctx->accumulator);
55 #endif
56 #if defined(MBEDTLS_HAVEGE_C)
57 mbedtls_havege_init(&ctx->havege_data);
58 #endif
59
60 /* Reminder: Update ENTROPY_HAVE_STRONG in the test files
61 * when adding more strong entropy sources here. */
62
63 #if defined(MBEDTLS_TEST_NULL_ENTROPY)
64 mbedtls_entropy_add_source(ctx, mbedtls_null_entropy_poll, NULL,
65 1, MBEDTLS_ENTROPY_SOURCE_STRONG);
66 #endif
67
68 #if !defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES)
69 #if !defined(MBEDTLS_NO_PLATFORM_ENTROPY)
70 mbedtls_entropy_add_source(ctx, mbedtls_platform_entropy_poll, NULL,
71 MBEDTLS_ENTROPY_MIN_PLATFORM,
72 MBEDTLS_ENTROPY_SOURCE_STRONG);
73 #endif
74 #if defined(MBEDTLS_TIMING_C)
75 mbedtls_entropy_add_source(ctx, mbedtls_hardclock_poll, NULL,
76 MBEDTLS_ENTROPY_MIN_HARDCLOCK,
77 MBEDTLS_ENTROPY_SOURCE_WEAK);
78 #endif
79 #if defined(MBEDTLS_HAVEGE_C)
80 mbedtls_entropy_add_source(ctx, mbedtls_havege_poll, &ctx->havege_data,
81 MBEDTLS_ENTROPY_MIN_HAVEGE,
82 MBEDTLS_ENTROPY_SOURCE_STRONG);
83 #endif
84 #if defined(MBEDTLS_ENTROPY_HARDWARE_ALT)
85 mbedtls_entropy_add_source(ctx, mbedtls_hardware_poll, NULL,
86 MBEDTLS_ENTROPY_MIN_HARDWARE,
87 MBEDTLS_ENTROPY_SOURCE_STRONG);
88 #endif
89 #if defined(MBEDTLS_ENTROPY_NV_SEED)
90 mbedtls_entropy_add_source(ctx, mbedtls_nv_seed_poll, NULL,
91 MBEDTLS_ENTROPY_BLOCK_SIZE,
92 MBEDTLS_ENTROPY_SOURCE_STRONG);
93 ctx->initial_entropy_run = 0;
94 #endif
95 #endif /* MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES */
96 }
97
mbedtls_entropy_free(mbedtls_entropy_context * ctx)98 void mbedtls_entropy_free(mbedtls_entropy_context *ctx)
99 {
100 /* If the context was already free, don't call free() again.
101 * This is important for mutexes which don't allow double-free. */
102 if (ctx->accumulator_started == -1) {
103 return;
104 }
105
106 #if defined(MBEDTLS_HAVEGE_C)
107 mbedtls_havege_free(&ctx->havege_data);
108 #endif
109 #if defined(MBEDTLS_THREADING_C)
110 mbedtls_mutex_free(&ctx->mutex);
111 #endif
112 #if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
113 mbedtls_sha512_free(&ctx->accumulator);
114 #else
115 mbedtls_sha256_free(&ctx->accumulator);
116 #endif
117 #if defined(MBEDTLS_ENTROPY_NV_SEED)
118 ctx->initial_entropy_run = 0;
119 #endif
120 ctx->source_count = 0;
121 mbedtls_platform_zeroize(ctx->source, sizeof(ctx->source));
122 ctx->accumulator_started = -1;
123 }
124
mbedtls_entropy_add_source(mbedtls_entropy_context * ctx,mbedtls_entropy_f_source_ptr f_source,void * p_source,size_t threshold,int strong)125 int mbedtls_entropy_add_source(mbedtls_entropy_context *ctx,
126 mbedtls_entropy_f_source_ptr f_source, void *p_source,
127 size_t threshold, int strong)
128 {
129 int idx, ret = 0;
130
131 #if defined(MBEDTLS_THREADING_C)
132 if ((ret = mbedtls_mutex_lock(&ctx->mutex)) != 0) {
133 return ret;
134 }
135 #endif
136
137 idx = ctx->source_count;
138 if (idx >= MBEDTLS_ENTROPY_MAX_SOURCES) {
139 ret = MBEDTLS_ERR_ENTROPY_MAX_SOURCES;
140 goto exit;
141 }
142
143 ctx->source[idx].f_source = f_source;
144 ctx->source[idx].p_source = p_source;
145 ctx->source[idx].threshold = threshold;
146 ctx->source[idx].strong = strong;
147
148 ctx->source_count++;
149
150 exit:
151 #if defined(MBEDTLS_THREADING_C)
152 if (mbedtls_mutex_unlock(&ctx->mutex) != 0) {
153 return MBEDTLS_ERR_THREADING_MUTEX_ERROR;
154 }
155 #endif
156
157 return ret;
158 }
159
160 /*
161 * Entropy accumulator update
162 */
entropy_update(mbedtls_entropy_context * ctx,unsigned char source_id,const unsigned char * data,size_t len)163 static int entropy_update(mbedtls_entropy_context *ctx, unsigned char source_id,
164 const unsigned char *data, size_t len)
165 {
166 unsigned char header[2];
167 unsigned char tmp[MBEDTLS_ENTROPY_BLOCK_SIZE];
168 size_t use_len = len;
169 const unsigned char *p = data;
170 int ret = 0;
171
172 if (use_len > MBEDTLS_ENTROPY_BLOCK_SIZE) {
173 #if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
174 if ((ret = mbedtls_sha512_ret(data, len, tmp, 0)) != 0) {
175 goto cleanup;
176 }
177 #else
178 if ((ret = mbedtls_sha256_ret(data, len, tmp, 0)) != 0) {
179 goto cleanup;
180 }
181 #endif
182 p = tmp;
183 use_len = MBEDTLS_ENTROPY_BLOCK_SIZE;
184 }
185
186 header[0] = source_id;
187 header[1] = use_len & 0xFF;
188
189 /*
190 * Start the accumulator if this has not already happened. Note that
191 * it is sufficient to start the accumulator here only because all calls to
192 * gather entropy eventually execute this code.
193 */
194 #if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
195 if (ctx->accumulator_started == 0 &&
196 (ret = mbedtls_sha512_starts_ret(&ctx->accumulator, 0)) != 0) {
197 goto cleanup;
198 } else {
199 ctx->accumulator_started = 1;
200 }
201 if ((ret = mbedtls_sha512_update_ret(&ctx->accumulator, header, 2)) != 0) {
202 goto cleanup;
203 }
204 ret = mbedtls_sha512_update_ret(&ctx->accumulator, p, use_len);
205 #else
206 if (ctx->accumulator_started == 0 &&
207 (ret = mbedtls_sha256_starts_ret(&ctx->accumulator, 0)) != 0) {
208 goto cleanup;
209 } else {
210 ctx->accumulator_started = 1;
211 }
212 if ((ret = mbedtls_sha256_update_ret(&ctx->accumulator, header, 2)) != 0) {
213 goto cleanup;
214 }
215 ret = mbedtls_sha256_update_ret(&ctx->accumulator, p, use_len);
216 #endif
217
218 cleanup:
219 mbedtls_platform_zeroize(tmp, sizeof(tmp));
220
221 return ret;
222 }
223
mbedtls_entropy_update_manual(mbedtls_entropy_context * ctx,const unsigned char * data,size_t len)224 int mbedtls_entropy_update_manual(mbedtls_entropy_context *ctx,
225 const unsigned char *data, size_t len)
226 {
227 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
228
229 #if defined(MBEDTLS_THREADING_C)
230 if ((ret = mbedtls_mutex_lock(&ctx->mutex)) != 0) {
231 return ret;
232 }
233 #endif
234
235 ret = entropy_update(ctx, MBEDTLS_ENTROPY_SOURCE_MANUAL, data, len);
236
237 #if defined(MBEDTLS_THREADING_C)
238 if (mbedtls_mutex_unlock(&ctx->mutex) != 0) {
239 return MBEDTLS_ERR_THREADING_MUTEX_ERROR;
240 }
241 #endif
242
243 return ret;
244 }
245
246 /*
247 * Run through the different sources to add entropy to our accumulator
248 */
entropy_gather_internal(mbedtls_entropy_context * ctx)249 static int entropy_gather_internal(mbedtls_entropy_context *ctx)
250 {
251 int ret = MBEDTLS_ERR_ENTROPY_SOURCE_FAILED;
252 int i;
253 int have_one_strong = 0;
254 unsigned char buf[MBEDTLS_ENTROPY_MAX_GATHER];
255 size_t olen;
256
257 if (ctx->source_count == 0) {
258 return MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED;
259 }
260
261 /*
262 * Run through our entropy sources
263 */
264 for (i = 0; i < ctx->source_count; i++) {
265 if (ctx->source[i].strong == MBEDTLS_ENTROPY_SOURCE_STRONG) {
266 have_one_strong = 1;
267 }
268
269 olen = 0;
270 if ((ret = ctx->source[i].f_source(ctx->source[i].p_source,
271 buf, MBEDTLS_ENTROPY_MAX_GATHER, &olen)) != 0) {
272 goto cleanup;
273 }
274
275 /*
276 * Add if we actually gathered something
277 */
278 if (olen > 0) {
279 if ((ret = entropy_update(ctx, (unsigned char) i,
280 buf, olen)) != 0) {
281 return ret;
282 }
283 ctx->source[i].size += olen;
284 }
285 }
286
287 if (have_one_strong == 0) {
288 ret = MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE;
289 }
290
291 cleanup:
292 mbedtls_platform_zeroize(buf, sizeof(buf));
293
294 return ret;
295 }
296
297 /*
298 * Thread-safe wrapper for entropy_gather_internal()
299 */
mbedtls_entropy_gather(mbedtls_entropy_context * ctx)300 int mbedtls_entropy_gather(mbedtls_entropy_context *ctx)
301 {
302 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
303
304 #if defined(MBEDTLS_THREADING_C)
305 if ((ret = mbedtls_mutex_lock(&ctx->mutex)) != 0) {
306 return ret;
307 }
308 #endif
309
310 ret = entropy_gather_internal(ctx);
311
312 #if defined(MBEDTLS_THREADING_C)
313 if (mbedtls_mutex_unlock(&ctx->mutex) != 0) {
314 return MBEDTLS_ERR_THREADING_MUTEX_ERROR;
315 }
316 #endif
317
318 return ret;
319 }
320
mbedtls_entropy_func(void * data,unsigned char * output,size_t len)321 int mbedtls_entropy_func(void *data, unsigned char *output, size_t len)
322 {
323 int ret, count = 0, i, thresholds_reached;
324 size_t strong_size;
325 mbedtls_entropy_context *ctx = (mbedtls_entropy_context *) data;
326 unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE];
327
328 if (len > MBEDTLS_ENTROPY_BLOCK_SIZE) {
329 return MBEDTLS_ERR_ENTROPY_SOURCE_FAILED;
330 }
331
332 #if defined(MBEDTLS_ENTROPY_NV_SEED)
333 /* Update the NV entropy seed before generating any entropy for outside
334 * use.
335 */
336 if (ctx->initial_entropy_run == 0) {
337 ctx->initial_entropy_run = 1;
338 if ((ret = mbedtls_entropy_update_nv_seed(ctx)) != 0) {
339 return ret;
340 }
341 }
342 #endif
343
344 #if defined(MBEDTLS_THREADING_C)
345 if ((ret = mbedtls_mutex_lock(&ctx->mutex)) != 0) {
346 return ret;
347 }
348 #endif
349
350 /*
351 * Always gather extra entropy before a call
352 */
353 do {
354 if (count++ > ENTROPY_MAX_LOOP) {
355 ret = MBEDTLS_ERR_ENTROPY_SOURCE_FAILED;
356 goto exit;
357 }
358
359 if ((ret = entropy_gather_internal(ctx)) != 0) {
360 goto exit;
361 }
362
363 thresholds_reached = 1;
364 strong_size = 0;
365 for (i = 0; i < ctx->source_count; i++) {
366 if (ctx->source[i].size < ctx->source[i].threshold) {
367 thresholds_reached = 0;
368 }
369 if (ctx->source[i].strong == MBEDTLS_ENTROPY_SOURCE_STRONG) {
370 strong_size += ctx->source[i].size;
371 }
372 }
373 } while (!thresholds_reached || strong_size < MBEDTLS_ENTROPY_BLOCK_SIZE);
374
375 memset(buf, 0, MBEDTLS_ENTROPY_BLOCK_SIZE);
376
377 #if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
378 /*
379 * Note that at this stage it is assumed that the accumulator was started
380 * in a previous call to entropy_update(). If this is not guaranteed, the
381 * code below will fail.
382 */
383 if ((ret = mbedtls_sha512_finish_ret(&ctx->accumulator, buf)) != 0) {
384 goto exit;
385 }
386
387 /*
388 * Reset accumulator and counters and recycle existing entropy
389 */
390 mbedtls_sha512_free(&ctx->accumulator);
391 mbedtls_sha512_init(&ctx->accumulator);
392 if ((ret = mbedtls_sha512_starts_ret(&ctx->accumulator, 0)) != 0) {
393 goto exit;
394 }
395 if ((ret = mbedtls_sha512_update_ret(&ctx->accumulator, buf,
396 MBEDTLS_ENTROPY_BLOCK_SIZE)) != 0) {
397 goto exit;
398 }
399
400 /*
401 * Perform second SHA-512 on entropy
402 */
403 if ((ret = mbedtls_sha512_ret(buf, MBEDTLS_ENTROPY_BLOCK_SIZE,
404 buf, 0)) != 0) {
405 goto exit;
406 }
407 #else /* MBEDTLS_ENTROPY_SHA512_ACCUMULATOR */
408 if ((ret = mbedtls_sha256_finish_ret(&ctx->accumulator, buf)) != 0) {
409 goto exit;
410 }
411
412 /*
413 * Reset accumulator and counters and recycle existing entropy
414 */
415 mbedtls_sha256_free(&ctx->accumulator);
416 mbedtls_sha256_init(&ctx->accumulator);
417 if ((ret = mbedtls_sha256_starts_ret(&ctx->accumulator, 0)) != 0) {
418 goto exit;
419 }
420 if ((ret = mbedtls_sha256_update_ret(&ctx->accumulator, buf,
421 MBEDTLS_ENTROPY_BLOCK_SIZE)) != 0) {
422 goto exit;
423 }
424
425 /*
426 * Perform second SHA-256 on entropy
427 */
428 if ((ret = mbedtls_sha256_ret(buf, MBEDTLS_ENTROPY_BLOCK_SIZE,
429 buf, 0)) != 0) {
430 goto exit;
431 }
432 #endif /* MBEDTLS_ENTROPY_SHA512_ACCUMULATOR */
433
434 for (i = 0; i < ctx->source_count; i++) {
435 ctx->source[i].size = 0;
436 }
437
438 memcpy(output, buf, len);
439
440 ret = 0;
441
442 exit:
443 mbedtls_platform_zeroize(buf, sizeof(buf));
444
445 #if defined(MBEDTLS_THREADING_C)
446 if (mbedtls_mutex_unlock(&ctx->mutex) != 0) {
447 return MBEDTLS_ERR_THREADING_MUTEX_ERROR;
448 }
449 #endif
450
451 return ret;
452 }
453
454 #if defined(MBEDTLS_ENTROPY_NV_SEED)
mbedtls_entropy_update_nv_seed(mbedtls_entropy_context * ctx)455 int mbedtls_entropy_update_nv_seed(mbedtls_entropy_context *ctx)
456 {
457 int ret = MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
458 unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE];
459
460 /* Read new seed and write it to NV */
461 if ((ret = mbedtls_entropy_func(ctx, buf, MBEDTLS_ENTROPY_BLOCK_SIZE)) != 0) {
462 return ret;
463 }
464
465 if (mbedtls_nv_seed_write(buf, MBEDTLS_ENTROPY_BLOCK_SIZE) < 0) {
466 return MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
467 }
468
469 /* Manually update the remaining stream with a separator value to diverge */
470 memset(buf, 0, MBEDTLS_ENTROPY_BLOCK_SIZE);
471 ret = mbedtls_entropy_update_manual(ctx, buf, MBEDTLS_ENTROPY_BLOCK_SIZE);
472
473 return ret;
474 }
475 #endif /* MBEDTLS_ENTROPY_NV_SEED */
476
477 #if defined(MBEDTLS_FS_IO)
mbedtls_entropy_write_seed_file(mbedtls_entropy_context * ctx,const char * path)478 int mbedtls_entropy_write_seed_file(mbedtls_entropy_context *ctx, const char *path)
479 {
480 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
481 FILE *f = NULL;
482 unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE];
483
484 if ((ret = mbedtls_entropy_func(ctx, buf, MBEDTLS_ENTROPY_BLOCK_SIZE)) != 0) {
485 ret = MBEDTLS_ERR_ENTROPY_SOURCE_FAILED;
486 goto exit;
487 }
488
489 if ((f = fopen(path, "wb")) == NULL) {
490 ret = MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
491 goto exit;
492 }
493
494 if (fwrite(buf, 1, MBEDTLS_ENTROPY_BLOCK_SIZE, f) != MBEDTLS_ENTROPY_BLOCK_SIZE) {
495 ret = MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
496 goto exit;
497 }
498
499 ret = 0;
500
501 exit:
502 mbedtls_platform_zeroize(buf, sizeof(buf));
503
504 if (f != NULL) {
505 fclose(f);
506 }
507
508 return ret;
509 }
510
mbedtls_entropy_update_seed_file(mbedtls_entropy_context * ctx,const char * path)511 int mbedtls_entropy_update_seed_file(mbedtls_entropy_context *ctx, const char *path)
512 {
513 int ret = 0;
514 FILE *f;
515 size_t n;
516 unsigned char buf[MBEDTLS_ENTROPY_MAX_SEED_SIZE];
517
518 if ((f = fopen(path, "rb")) == NULL) {
519 return MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
520 }
521
522 fseek(f, 0, SEEK_END);
523 n = (size_t) ftell(f);
524 fseek(f, 0, SEEK_SET);
525
526 if (n > MBEDTLS_ENTROPY_MAX_SEED_SIZE) {
527 n = MBEDTLS_ENTROPY_MAX_SEED_SIZE;
528 }
529
530 if (fread(buf, 1, n, f) != n) {
531 ret = MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
532 } else {
533 ret = mbedtls_entropy_update_manual(ctx, buf, n);
534 }
535
536 fclose(f);
537
538 mbedtls_platform_zeroize(buf, sizeof(buf));
539
540 if (ret != 0) {
541 return ret;
542 }
543
544 return mbedtls_entropy_write_seed_file(ctx, path);
545 }
546 #endif /* MBEDTLS_FS_IO */
547
548 #if defined(MBEDTLS_SELF_TEST)
549 #if !defined(MBEDTLS_TEST_NULL_ENTROPY)
550 /*
551 * Dummy source function
552 */
entropy_dummy_source(void * data,unsigned char * output,size_t len,size_t * olen)553 static int entropy_dummy_source(void *data, unsigned char *output,
554 size_t len, size_t *olen)
555 {
556 ((void) data);
557
558 memset(output, 0x2a, len);
559 *olen = len;
560
561 return 0;
562 }
563 #endif /* !MBEDTLS_TEST_NULL_ENTROPY */
564
565 #if defined(MBEDTLS_ENTROPY_HARDWARE_ALT)
566
mbedtls_entropy_source_self_test_gather(unsigned char * buf,size_t buf_len)567 static int mbedtls_entropy_source_self_test_gather(unsigned char *buf, size_t buf_len)
568 {
569 int ret = 0;
570 size_t entropy_len = 0;
571 size_t olen = 0;
572 size_t attempts = buf_len;
573
574 while (attempts > 0 && entropy_len < buf_len) {
575 if ((ret = mbedtls_hardware_poll(NULL, buf + entropy_len,
576 buf_len - entropy_len, &olen)) != 0) {
577 return ret;
578 }
579
580 entropy_len += olen;
581 attempts--;
582 }
583
584 if (entropy_len < buf_len) {
585 ret = 1;
586 }
587
588 return ret;
589 }
590
591
mbedtls_entropy_source_self_test_check_bits(const unsigned char * buf,size_t buf_len)592 static int mbedtls_entropy_source_self_test_check_bits(const unsigned char *buf,
593 size_t buf_len)
594 {
595 unsigned char set = 0xFF;
596 unsigned char unset = 0x00;
597 size_t i;
598
599 for (i = 0; i < buf_len; i++) {
600 set &= buf[i];
601 unset |= buf[i];
602 }
603
604 return set == 0xFF || unset == 0x00;
605 }
606
607 /*
608 * A test to ensure that the entropy sources are functioning correctly
609 * and there is no obvious failure. The test performs the following checks:
610 * - The entropy source is not providing only 0s (all bits unset) or 1s (all
611 * bits set).
612 * - The entropy source is not providing values in a pattern. Because the
613 * hardware could be providing data in an arbitrary length, this check polls
614 * the hardware entropy source twice and compares the result to ensure they
615 * are not equal.
616 * - The error code returned by the entropy source is not an error.
617 */
mbedtls_entropy_source_self_test(int verbose)618 int mbedtls_entropy_source_self_test(int verbose)
619 {
620 int ret = 0;
621 unsigned char buf0[2 * sizeof(unsigned long long int)];
622 unsigned char buf1[2 * sizeof(unsigned long long int)];
623
624 if (verbose != 0) {
625 mbedtls_printf(" ENTROPY_BIAS test: ");
626 }
627
628 memset(buf0, 0x00, sizeof(buf0));
629 memset(buf1, 0x00, sizeof(buf1));
630
631 if ((ret = mbedtls_entropy_source_self_test_gather(buf0, sizeof(buf0))) != 0) {
632 goto cleanup;
633 }
634 if ((ret = mbedtls_entropy_source_self_test_gather(buf1, sizeof(buf1))) != 0) {
635 goto cleanup;
636 }
637
638 /* Make sure that the returned values are not all 0 or 1 */
639 if ((ret = mbedtls_entropy_source_self_test_check_bits(buf0, sizeof(buf0))) != 0) {
640 goto cleanup;
641 }
642 if ((ret = mbedtls_entropy_source_self_test_check_bits(buf1, sizeof(buf1))) != 0) {
643 goto cleanup;
644 }
645
646 /* Make sure that the entropy source is not returning values in a
647 * pattern */
648 ret = memcmp(buf0, buf1, sizeof(buf0)) == 0;
649
650 cleanup:
651 if (verbose != 0) {
652 if (ret != 0) {
653 mbedtls_printf("failed\n");
654 } else {
655 mbedtls_printf("passed\n");
656 }
657
658 mbedtls_printf("\n");
659 }
660
661 return ret != 0;
662 }
663
664 #endif /* MBEDTLS_ENTROPY_HARDWARE_ALT */
665
666 /*
667 * The actual entropy quality is hard to test, but we can at least
668 * test that the functions don't cause errors and write the correct
669 * amount of data to buffers.
670 */
mbedtls_entropy_self_test(int verbose)671 int mbedtls_entropy_self_test(int verbose)
672 {
673 int ret = 1;
674 #if !defined(MBEDTLS_TEST_NULL_ENTROPY)
675 mbedtls_entropy_context ctx;
676 unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE] = { 0 };
677 unsigned char acc[MBEDTLS_ENTROPY_BLOCK_SIZE] = { 0 };
678 size_t i, j;
679 #endif /* !MBEDTLS_TEST_NULL_ENTROPY */
680
681 if (verbose != 0) {
682 mbedtls_printf(" ENTROPY test: ");
683 }
684
685 #if !defined(MBEDTLS_TEST_NULL_ENTROPY)
686 mbedtls_entropy_init(&ctx);
687
688 /* First do a gather to make sure we have default sources */
689 if ((ret = mbedtls_entropy_gather(&ctx)) != 0) {
690 goto cleanup;
691 }
692
693 ret = mbedtls_entropy_add_source(&ctx, entropy_dummy_source, NULL, 16,
694 MBEDTLS_ENTROPY_SOURCE_WEAK);
695 if (ret != 0) {
696 goto cleanup;
697 }
698
699 if ((ret = mbedtls_entropy_update_manual(&ctx, buf, sizeof(buf))) != 0) {
700 goto cleanup;
701 }
702
703 /*
704 * To test that mbedtls_entropy_func writes correct number of bytes:
705 * - use the whole buffer and rely on ASan to detect overruns
706 * - collect entropy 8 times and OR the result in an accumulator:
707 * any byte should then be 0 with probably 2^(-64), so requiring
708 * each of the 32 or 64 bytes to be non-zero has a false failure rate
709 * of at most 2^(-58) which is acceptable.
710 */
711 for (i = 0; i < 8; i++) {
712 if ((ret = mbedtls_entropy_func(&ctx, buf, sizeof(buf))) != 0) {
713 goto cleanup;
714 }
715
716 for (j = 0; j < sizeof(buf); j++) {
717 acc[j] |= buf[j];
718 }
719 }
720
721 for (j = 0; j < sizeof(buf); j++) {
722 if (acc[j] == 0) {
723 ret = 1;
724 goto cleanup;
725 }
726 }
727
728 #if defined(MBEDTLS_ENTROPY_HARDWARE_ALT)
729 if ((ret = mbedtls_entropy_source_self_test(0)) != 0) {
730 goto cleanup;
731 }
732 #endif
733
734 cleanup:
735 mbedtls_entropy_free(&ctx);
736 #endif /* !MBEDTLS_TEST_NULL_ENTROPY */
737
738 if (verbose != 0) {
739 if (ret != 0) {
740 mbedtls_printf("failed\n");
741 } else {
742 mbedtls_printf("passed\n");
743 }
744
745 mbedtls_printf("\n");
746 }
747
748 return ret != 0;
749 }
750 #endif /* MBEDTLS_SELF_TEST */
751
752 #endif /* MBEDTLS_ENTROPY_C */
753