/* Copyright (c) 2014, Google Inc. * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ #include <assert.h> #include <limits.h> #include <string.h> #if defined(BORINGSSL_FIPS) #include <unistd.h> #endif #include <openssl/chacha.h> #include <openssl/ctrdrbg.h> #include <openssl/mem.h> #include "../../bcm_support.h" #include "../bcm_interface.h" #include "../delocate.h" #include "internal.h" // It's assumed that the operating system always has an unfailing source of // entropy which is accessed via |CRYPTO_sysrand[_for_seed]|. (If the operating // system entropy source fails, it's up to |CRYPTO_sysrand| to abort the // process—we don't try to handle it.) // // In addition, the hardware may provide a low-latency RNG. Intel's rdrand // instruction is the canonical example of this. When a hardware RNG is // available we don't need to worry about an RNG failure arising from fork()ing // the process or moving a VM, so we can keep thread-local RNG state and use it // as an additional-data input to CTR-DRBG. // // (We assume that the OS entropy is safe from fork()ing and VM duplication. // This might be a bit of a leap of faith, esp on Windows, but there's nothing // that we can do about it.) // kReseedInterval is the number of generate calls made to CTR-DRBG before // reseeding. static const unsigned kReseedInterval = …; // CRNGT_BLOCK_SIZE is the number of bytes in a “block” for the purposes of the // continuous random number generator test in FIPS 140-2, section 4.9.2. #define CRNGT_BLOCK_SIZE … // rand_thread_state contains the per-thread state for the RNG. struct rand_thread_state { … }; #if defined(BORINGSSL_FIPS) // thread_states_list is the head of a linked-list of all |rand_thread_state| // objects in the process, one per thread. This is needed because FIPS requires // that they be zeroed on process exit, but thread-local destructors aren't // called when the whole process is exiting. DEFINE_BSS_GET(struct rand_thread_state *, thread_states_list); DEFINE_STATIC_MUTEX(thread_states_list_lock); static void rand_thread_state_clear_all(void) __attribute__((destructor)); static void rand_thread_state_clear_all(void) { CRYPTO_MUTEX_lock_write(thread_states_list_lock_bss_get()); for (struct rand_thread_state *cur = *thread_states_list_bss_get(); cur != NULL; cur = cur->next) { CRYPTO_MUTEX_lock_write(&cur->clear_drbg_lock); CTR_DRBG_clear(&cur->drbg); } // The locks are deliberately left locked so that any threads that are still // running will hang if they try to call |BCM_rand_bytes|. It also ensures // |rand_thread_state_free| cannot free any thread state while we've taken the // lock. } #endif // rand_thread_state_free frees a |rand_thread_state|. This is called when a // thread exits. static void rand_thread_state_free(void *state_in) { … } #if defined(OPENSSL_X86_64) && !defined(OPENSSL_NO_ASM) && \ !defined(BORINGSSL_UNSAFE_DETERMINISTIC_MODE) // rdrand should only be called if either |have_rdrand| or |have_fast_rdrand| // returned true. static int rdrand(uint8_t *buf, const size_t len) { … } #else static int rdrand(uint8_t *buf, size_t len) { return 0; } #endif bcm_status BCM_rand_bytes_hwrng(uint8_t *buf, const size_t len) { … } #if defined(BORINGSSL_FIPS) // In passive entropy mode, entropy is supplied from outside of the module via // |BCM_rand_load_entropy| and is stored in global instance of the following // structure. struct entropy_buffer { // bytes contains entropy suitable for seeding a DRBG. uint8_t bytes[CRNGT_BLOCK_SIZE + CTR_DRBG_ENTROPY_LEN * BORINGSSL_FIPS_OVERREAD]; // bytes_valid indicates the number of bytes of |bytes| that contain valid // data. size_t bytes_valid; // want_additional_input is true if any of the contents of |bytes| were // obtained via a method other than from the kernel. In these cases entropy // from the kernel is also provided via an additional input to the DRBG. int want_additional_input; }; DEFINE_BSS_GET(struct entropy_buffer, entropy_buffer); DEFINE_STATIC_MUTEX(entropy_buffer_lock); bcm_infallible BCM_rand_load_entropy(const uint8_t *entropy, size_t entropy_len, int want_additional_input) { struct entropy_buffer *const buffer = entropy_buffer_bss_get(); CRYPTO_MUTEX_lock_write(entropy_buffer_lock_bss_get()); const size_t space = sizeof(buffer->bytes) - buffer->bytes_valid; if (entropy_len > space) { entropy_len = space; } OPENSSL_memcpy(&buffer->bytes[buffer->bytes_valid], entropy, entropy_len); buffer->bytes_valid += entropy_len; buffer->want_additional_input |= want_additional_input && (entropy_len != 0); CRYPTO_MUTEX_unlock_write(entropy_buffer_lock_bss_get()); return bcm_infallible_not_approved; } // get_seed_entropy fills |out_entropy_len| bytes of |out_entropy| from the // global |entropy_buffer|. static void get_seed_entropy(uint8_t *out_entropy, size_t out_entropy_len, int *out_want_additional_input) { struct entropy_buffer *const buffer = entropy_buffer_bss_get(); if (out_entropy_len > sizeof(buffer->bytes)) { abort(); } CRYPTO_MUTEX_lock_write(entropy_buffer_lock_bss_get()); while (buffer->bytes_valid < out_entropy_len) { CRYPTO_MUTEX_unlock_write(entropy_buffer_lock_bss_get()); RAND_need_entropy(out_entropy_len - buffer->bytes_valid); CRYPTO_MUTEX_lock_write(entropy_buffer_lock_bss_get()); } *out_want_additional_input = buffer->want_additional_input; OPENSSL_memcpy(out_entropy, buffer->bytes, out_entropy_len); OPENSSL_memmove(buffer->bytes, &buffer->bytes[out_entropy_len], buffer->bytes_valid - out_entropy_len); buffer->bytes_valid -= out_entropy_len; if (buffer->bytes_valid == 0) { buffer->want_additional_input = 0; } CRYPTO_MUTEX_unlock_write(entropy_buffer_lock_bss_get()); } // rand_get_seed fills |seed| with entropy. In some cases, it will additionally // fill |additional_input| with entropy to supplement |seed|. It sets // |*out_additional_input_len| to the number of extra bytes. static void rand_get_seed(struct rand_thread_state *state, uint8_t seed[CTR_DRBG_ENTROPY_LEN], uint8_t additional_input[CTR_DRBG_ENTROPY_LEN], size_t *out_additional_input_len) { uint8_t entropy_bytes[sizeof(state->last_block) + CTR_DRBG_ENTROPY_LEN * BORINGSSL_FIPS_OVERREAD]; uint8_t *entropy = entropy_bytes; size_t entropy_len = sizeof(entropy_bytes); if (state->last_block_valid) { // No need to fill |state->last_block| with entropy from the read. entropy += sizeof(state->last_block); entropy_len -= sizeof(state->last_block); } int want_additional_input; get_seed_entropy(entropy, entropy_len, &want_additional_input); if (!state->last_block_valid) { OPENSSL_memcpy(state->last_block, entropy, sizeof(state->last_block)); entropy += sizeof(state->last_block); entropy_len -= sizeof(state->last_block); } // See FIPS 140-2, section 4.9.2. This is the “continuous random number // generator test” which causes the program to randomly abort. Hopefully the // rate of failure is small enough not to be a problem in practice. if (CRYPTO_memcmp(state->last_block, entropy, sizeof(state->last_block)) == 0) { fprintf(stderr, "CRNGT failed.\n"); BORINGSSL_FIPS_abort(); } assert(entropy_len % CRNGT_BLOCK_SIZE == 0); for (size_t i = CRNGT_BLOCK_SIZE; i < entropy_len; i += CRNGT_BLOCK_SIZE) { if (CRYPTO_memcmp(entropy + i - CRNGT_BLOCK_SIZE, entropy + i, CRNGT_BLOCK_SIZE) == 0) { fprintf(stderr, "CRNGT failed.\n"); BORINGSSL_FIPS_abort(); } } OPENSSL_memcpy(state->last_block, entropy + entropy_len - CRNGT_BLOCK_SIZE, CRNGT_BLOCK_SIZE); assert(entropy_len == BORINGSSL_FIPS_OVERREAD * CTR_DRBG_ENTROPY_LEN); OPENSSL_memcpy(seed, entropy, CTR_DRBG_ENTROPY_LEN); for (size_t i = 1; i < BORINGSSL_FIPS_OVERREAD; i++) { for (size_t j = 0; j < CTR_DRBG_ENTROPY_LEN; j++) { seed[j] ^= entropy[CTR_DRBG_ENTROPY_LEN * i + j]; } } // If we used something other than system entropy then also // opportunistically read from the system. This avoids solely relying on the // hardware once the entropy pool has been initialized. *out_additional_input_len = 0; if (want_additional_input && CRYPTO_sysrand_if_available(additional_input, CTR_DRBG_ENTROPY_LEN)) { *out_additional_input_len = CTR_DRBG_ENTROPY_LEN; } } #else // rand_get_seed fills |seed| with entropy. In some cases, it will additionally // fill |additional_input| with entropy to supplement |seed|. It sets // |*out_additional_input_len| to the number of extra bytes. static void rand_get_seed(struct rand_thread_state *state, uint8_t seed[CTR_DRBG_ENTROPY_LEN], uint8_t additional_input[CTR_DRBG_ENTROPY_LEN], size_t *out_additional_input_len) { … } #endif bcm_infallible BCM_rand_bytes_with_additional_data( uint8_t *out, size_t out_len, const uint8_t user_additional_data[32]) { … } bcm_infallible BCM_rand_bytes(uint8_t *out, size_t out_len) { … }
Codebase Browser
chromium