mirror of
https://github.com/reactos/reactos.git
synced 2025-04-05 13:11:22 +00:00
[MBEDTLS] Update to version 2.7.13. CORE-16686
This commit is contained in:
parent
2903022199
commit
d152519a4a
12 changed files with 572 additions and 212 deletions
24
dll/3rdparty/mbedtls/aes.c
vendored
24
dll/3rdparty/mbedtls/aes.c
vendored
|
@ -763,6 +763,18 @@ int mbedtls_internal_aes_encrypt( mbedtls_aes_context *ctx,
|
|||
PUT_UINT32_LE( X2, output, 8 );
|
||||
PUT_UINT32_LE( X3, output, 12 );
|
||||
|
||||
mbedtls_zeroize( &X0, sizeof( X0 ) );
|
||||
mbedtls_zeroize( &X1, sizeof( X1 ) );
|
||||
mbedtls_zeroize( &X2, sizeof( X2 ) );
|
||||
mbedtls_zeroize( &X3, sizeof( X3 ) );
|
||||
|
||||
mbedtls_zeroize( &Y0, sizeof( Y0 ) );
|
||||
mbedtls_zeroize( &Y1, sizeof( Y1 ) );
|
||||
mbedtls_zeroize( &Y2, sizeof( Y2 ) );
|
||||
mbedtls_zeroize( &Y3, sizeof( Y3 ) );
|
||||
|
||||
mbedtls_zeroize( &RK, sizeof( RK ) );
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
#endif /* !MBEDTLS_AES_ENCRYPT_ALT */
|
||||
|
@ -831,6 +843,18 @@ int mbedtls_internal_aes_decrypt( mbedtls_aes_context *ctx,
|
|||
PUT_UINT32_LE( X2, output, 8 );
|
||||
PUT_UINT32_LE( X3, output, 12 );
|
||||
|
||||
mbedtls_zeroize( &X0, sizeof( X0 ) );
|
||||
mbedtls_zeroize( &X1, sizeof( X1 ) );
|
||||
mbedtls_zeroize( &X2, sizeof( X2 ) );
|
||||
mbedtls_zeroize( &X3, sizeof( X3 ) );
|
||||
|
||||
mbedtls_zeroize( &Y0, sizeof( Y0 ) );
|
||||
mbedtls_zeroize( &Y1, sizeof( Y1 ) );
|
||||
mbedtls_zeroize( &Y2, sizeof( Y2 ) );
|
||||
mbedtls_zeroize( &Y3, sizeof( Y3 ) );
|
||||
|
||||
mbedtls_zeroize( &RK, sizeof( RK ) );
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
#endif /* !MBEDTLS_AES_DECRYPT_ALT */
|
||||
|
|
97
dll/3rdparty/mbedtls/bignum.c
vendored
97
dll/3rdparty/mbedtls/bignum.c
vendored
|
@ -921,6 +921,103 @@ int mbedtls_mpi_cmp_mpi( const mbedtls_mpi *X, const mbedtls_mpi *Y )
|
|||
return( 0 );
|
||||
}
|
||||
|
||||
/** Decide if an integer is less than the other, without branches.
|
||||
*
|
||||
* \param x First integer.
|
||||
* \param y Second integer.
|
||||
*
|
||||
* \return 1 if \p x is less than \p y, 0 otherwise
|
||||
*/
|
||||
static unsigned ct_lt_mpi_uint( const mbedtls_mpi_uint x,
|
||||
const mbedtls_mpi_uint y )
|
||||
{
|
||||
mbedtls_mpi_uint ret;
|
||||
mbedtls_mpi_uint cond;
|
||||
|
||||
/*
|
||||
* Check if the most significant bits (MSB) of the operands are different.
|
||||
*/
|
||||
cond = ( x ^ y );
|
||||
/*
|
||||
* If the MSB are the same then the difference x-y will be negative (and
|
||||
* have its MSB set to 1 during conversion to unsigned) if and only if x<y.
|
||||
*/
|
||||
ret = ( x - y ) & ~cond;
|
||||
/*
|
||||
* If the MSB are different, then the operand with the MSB of 1 is the
|
||||
* bigger. (That is if y has MSB of 1, then x<y is true and it is false if
|
||||
* the MSB of y is 0.)
|
||||
*/
|
||||
ret |= y & cond;
|
||||
|
||||
|
||||
ret = ret >> ( biL - 1 );
|
||||
|
||||
return (unsigned) ret;
|
||||
}
|
||||
|
||||
/*
|
||||
* Compare signed values in constant time
|
||||
*/
|
||||
int mbedtls_mpi_lt_mpi_ct( const mbedtls_mpi *X, const mbedtls_mpi *Y,
|
||||
unsigned *ret )
|
||||
{
|
||||
size_t i;
|
||||
/* The value of any of these variables is either 0 or 1 at all times. */
|
||||
unsigned cond, done, X_is_negative, Y_is_negative;
|
||||
|
||||
if( X->n != Y->n )
|
||||
return MBEDTLS_ERR_MPI_BAD_INPUT_DATA;
|
||||
|
||||
/*
|
||||
* Set sign_N to 1 if N >= 0, 0 if N < 0.
|
||||
* We know that N->s == 1 if N >= 0 and N->s == -1 if N < 0.
|
||||
*/
|
||||
X_is_negative = ( X->s & 2 ) >> 1;
|
||||
Y_is_negative = ( Y->s & 2 ) >> 1;
|
||||
|
||||
/*
|
||||
* If the signs are different, then the positive operand is the bigger.
|
||||
* That is if X is negative (X_is_negative == 1), then X < Y is true and it
|
||||
* is false if X is positive (X_is_negative == 0).
|
||||
*/
|
||||
cond = ( X_is_negative ^ Y_is_negative );
|
||||
*ret = cond & X_is_negative;
|
||||
|
||||
/*
|
||||
* This is a constant-time function. We might have the result, but we still
|
||||
* need to go through the loop. Record if we have the result already.
|
||||
*/
|
||||
done = cond;
|
||||
|
||||
for( i = X->n; i > 0; i-- )
|
||||
{
|
||||
/*
|
||||
* If Y->p[i - 1] < X->p[i - 1] then X < Y is true if and only if both
|
||||
* X and Y are negative.
|
||||
*
|
||||
* Again even if we can make a decision, we just mark the result and
|
||||
* the fact that we are done and continue looping.
|
||||
*/
|
||||
cond = ct_lt_mpi_uint( Y->p[i - 1], X->p[i - 1] );
|
||||
*ret |= cond & ( 1 - done ) & X_is_negative;
|
||||
done |= cond;
|
||||
|
||||
/*
|
||||
* If X->p[i - 1] < Y->p[i - 1] then X < Y is true if and only if both
|
||||
* X and Y are positive.
|
||||
*
|
||||
* Again even if we can make a decision, we just mark the result and
|
||||
* the fact that we are done and continue looping.
|
||||
*/
|
||||
cond = ct_lt_mpi_uint( X->p[i - 1], Y->p[i - 1] );
|
||||
*ret |= cond & ( 1 - done ) & ( 1 - X_is_negative );
|
||||
done |= cond;
|
||||
}
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
|
||||
/*
|
||||
* Compare signed values
|
||||
*/
|
||||
|
|
112
dll/3rdparty/mbedtls/ctr_drbg.c
vendored
112
dll/3rdparty/mbedtls/ctr_drbg.c
vendored
|
@ -68,56 +68,6 @@ void mbedtls_ctr_drbg_init( mbedtls_ctr_drbg_context *ctx )
|
|||
#endif
|
||||
}
|
||||
|
||||
/*
|
||||
* Non-public function wrapped by mbedtls_ctr_drbg_seed(). Necessary to allow
|
||||
* NIST tests to succeed (which require known length fixed entropy)
|
||||
*/
|
||||
int mbedtls_ctr_drbg_seed_entropy_len(
|
||||
mbedtls_ctr_drbg_context *ctx,
|
||||
int (*f_entropy)(void *, unsigned char *, size_t),
|
||||
void *p_entropy,
|
||||
const unsigned char *custom,
|
||||
size_t len,
|
||||
size_t entropy_len )
|
||||
{
|
||||
int ret;
|
||||
unsigned char key[MBEDTLS_CTR_DRBG_KEYSIZE];
|
||||
|
||||
memset( key, 0, MBEDTLS_CTR_DRBG_KEYSIZE );
|
||||
|
||||
mbedtls_aes_init( &ctx->aes_ctx );
|
||||
|
||||
ctx->f_entropy = f_entropy;
|
||||
ctx->p_entropy = p_entropy;
|
||||
|
||||
ctx->entropy_len = entropy_len;
|
||||
ctx->reseed_interval = MBEDTLS_CTR_DRBG_RESEED_INTERVAL;
|
||||
|
||||
/*
|
||||
* Initialize with an empty key
|
||||
*/
|
||||
if( ( ret = mbedtls_aes_setkey_enc( &ctx->aes_ctx, key, MBEDTLS_CTR_DRBG_KEYBITS ) ) != 0 )
|
||||
{
|
||||
return( ret );
|
||||
}
|
||||
|
||||
if( ( ret = mbedtls_ctr_drbg_reseed( ctx, custom, len ) ) != 0 )
|
||||
{
|
||||
return( ret );
|
||||
}
|
||||
return( 0 );
|
||||
}
|
||||
|
||||
int mbedtls_ctr_drbg_seed( mbedtls_ctr_drbg_context *ctx,
|
||||
int (*f_entropy)(void *, unsigned char *, size_t),
|
||||
void *p_entropy,
|
||||
const unsigned char *custom,
|
||||
size_t len )
|
||||
{
|
||||
return( mbedtls_ctr_drbg_seed_entropy_len( ctx, f_entropy, p_entropy, custom, len,
|
||||
MBEDTLS_CTR_DRBG_ENTROPY_LEN ) );
|
||||
}
|
||||
|
||||
void mbedtls_ctr_drbg_free( mbedtls_ctr_drbg_context *ctx )
|
||||
{
|
||||
if( ctx == NULL )
|
||||
|
@ -388,6 +338,52 @@ exit:
|
|||
return( ret );
|
||||
}
|
||||
|
||||
int mbedtls_ctr_drbg_seed( mbedtls_ctr_drbg_context *ctx,
|
||||
int (*f_entropy)(void *, unsigned char *, size_t),
|
||||
void *p_entropy,
|
||||
const unsigned char *custom,
|
||||
size_t len )
|
||||
{
|
||||
int ret;
|
||||
unsigned char key[MBEDTLS_CTR_DRBG_KEYSIZE];
|
||||
|
||||
memset( key, 0, MBEDTLS_CTR_DRBG_KEYSIZE );
|
||||
|
||||
mbedtls_aes_init( &ctx->aes_ctx );
|
||||
|
||||
ctx->f_entropy = f_entropy;
|
||||
ctx->p_entropy = p_entropy;
|
||||
|
||||
if( ctx->entropy_len == 0 )
|
||||
ctx->entropy_len = MBEDTLS_CTR_DRBG_ENTROPY_LEN;
|
||||
ctx->reseed_interval = MBEDTLS_CTR_DRBG_RESEED_INTERVAL;
|
||||
|
||||
/*
|
||||
* Initialize with an empty key
|
||||
*/
|
||||
if( ( ret = mbedtls_aes_setkey_enc( &ctx->aes_ctx, key, MBEDTLS_CTR_DRBG_KEYBITS ) ) != 0 )
|
||||
{
|
||||
return( ret );
|
||||
}
|
||||
|
||||
if( ( ret = mbedtls_ctr_drbg_reseed( ctx, custom, len ) ) != 0 )
|
||||
{
|
||||
return( ret );
|
||||
}
|
||||
return( 0 );
|
||||
}
|
||||
|
||||
/* Backward compatibility wrapper */
|
||||
int mbedtls_ctr_drbg_seed_entropy_len(
|
||||
mbedtls_ctr_drbg_context *ctx,
|
||||
int (*f_entropy)(void *, unsigned char *, size_t), void *p_entropy,
|
||||
const unsigned char *custom, size_t len,
|
||||
size_t entropy_len )
|
||||
{
|
||||
mbedtls_ctr_drbg_set_entropy_len( ctx, entropy_len );
|
||||
return( mbedtls_ctr_drbg_seed( ctx, f_entropy, p_entropy, custom, len ) );
|
||||
}
|
||||
|
||||
int mbedtls_ctr_drbg_random_with_add( void *p_rng,
|
||||
unsigned char *output, size_t output_len,
|
||||
const unsigned char *additional, size_t add_len )
|
||||
|
@ -459,7 +455,7 @@ int mbedtls_ctr_drbg_random_with_add( void *p_rng,
|
|||
exit:
|
||||
mbedtls_zeroize( add_input, sizeof( add_input ) );
|
||||
mbedtls_zeroize( tmp, sizeof( tmp ) );
|
||||
return( 0 );
|
||||
return( ret );
|
||||
}
|
||||
|
||||
int mbedtls_ctr_drbg_random( void *p_rng, unsigned char *output, size_t output_len )
|
||||
|
@ -619,8 +615,11 @@ int mbedtls_ctr_drbg_self_test( int verbose )
|
|||
mbedtls_printf( " CTR_DRBG (PR = TRUE) : " );
|
||||
|
||||
test_offset = 0;
|
||||
CHK( mbedtls_ctr_drbg_seed_entropy_len( &ctx, ctr_drbg_self_test_entropy,
|
||||
(void *) entropy_source_pr, nonce_pers_pr, 16, 32 ) );
|
||||
mbedtls_ctr_drbg_set_entropy_len( &ctx, 32 );
|
||||
CHK( mbedtls_ctr_drbg_seed( &ctx,
|
||||
ctr_drbg_self_test_entropy,
|
||||
(void *) entropy_source_pr,
|
||||
nonce_pers_pr, 16 ) );
|
||||
mbedtls_ctr_drbg_set_prediction_resistance( &ctx, MBEDTLS_CTR_DRBG_PR_ON );
|
||||
CHK( mbedtls_ctr_drbg_random( &ctx, buf, MBEDTLS_CTR_DRBG_BLOCKSIZE ) );
|
||||
CHK( mbedtls_ctr_drbg_random( &ctx, buf, MBEDTLS_CTR_DRBG_BLOCKSIZE ) );
|
||||
|
@ -640,8 +639,11 @@ int mbedtls_ctr_drbg_self_test( int verbose )
|
|||
mbedtls_ctr_drbg_init( &ctx );
|
||||
|
||||
test_offset = 0;
|
||||
CHK( mbedtls_ctr_drbg_seed_entropy_len( &ctx, ctr_drbg_self_test_entropy,
|
||||
(void *) entropy_source_nopr, nonce_pers_nopr, 16, 32 ) );
|
||||
mbedtls_ctr_drbg_set_entropy_len( &ctx, 32 );
|
||||
CHK( mbedtls_ctr_drbg_seed( &ctx,
|
||||
ctr_drbg_self_test_entropy,
|
||||
(void *) entropy_source_nopr,
|
||||
nonce_pers_nopr, 16 ) );
|
||||
CHK( mbedtls_ctr_drbg_random( &ctx, buf, 16 ) );
|
||||
CHK( mbedtls_ctr_drbg_reseed( &ctx, NULL, 0 ) );
|
||||
CHK( mbedtls_ctr_drbg_random( &ctx, buf, 16 ) );
|
||||
|
|
1
dll/3rdparty/mbedtls/ecdsa.c
vendored
1
dll/3rdparty/mbedtls/ecdsa.c
vendored
|
@ -155,6 +155,7 @@ static int ecdsa_sign_internal( mbedtls_ecp_group *grp, mbedtls_mpi *r,
|
|||
MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &e, &e, s ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &e, &e, &t ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &k, &k, &t ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &k, &k, &grp->N ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( s, &k, &grp->N ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( s, s, &e ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( s, s, &grp->N ) );
|
||||
|
|
10
dll/3rdparty/mbedtls/ecp.c
vendored
10
dll/3rdparty/mbedtls/ecp.c
vendored
|
@ -1959,6 +1959,7 @@ int mbedtls_ecp_gen_privkey( const mbedtls_ecp_group *grp,
|
|||
{
|
||||
/* SEC1 3.2.1: Generate d such that 1 <= n < N */
|
||||
int count = 0;
|
||||
unsigned cmp = 0;
|
||||
|
||||
/*
|
||||
* Match the procedure given in RFC 6979 (deterministic ECDSA):
|
||||
|
@ -1983,9 +1984,14 @@ int mbedtls_ecp_gen_privkey( const mbedtls_ecp_group *grp,
|
|||
*/
|
||||
if( ++count > 30 )
|
||||
return( MBEDTLS_ERR_ECP_RANDOM_FAILED );
|
||||
|
||||
ret = mbedtls_mpi_lt_mpi_ct( d, &grp->N, &cmp );
|
||||
if( ret != 0 )
|
||||
{
|
||||
goto cleanup;
|
||||
}
|
||||
}
|
||||
while( mbedtls_mpi_cmp_int( d, 1 ) < 0 ||
|
||||
mbedtls_mpi_cmp_mpi( d, &grp->N ) >= 0 );
|
||||
while( mbedtls_mpi_cmp_int( d, 1 ) < 0 || cmp != 1 );
|
||||
}
|
||||
#endif /* ECP_SHORTWEIERSTRASS */
|
||||
|
||||
|
|
25
dll/3rdparty/mbedtls/hmac_drbg.c
vendored
25
dll/3rdparty/mbedtls/hmac_drbg.c
vendored
|
@ -277,16 +277,19 @@ int mbedtls_hmac_drbg_seed( mbedtls_hmac_drbg_context *ctx,
|
|||
|
||||
ctx->reseed_interval = MBEDTLS_HMAC_DRBG_RESEED_INTERVAL;
|
||||
|
||||
/*
|
||||
* See SP800-57 5.6.1 (p. 65-66) for the security strength provided by
|
||||
* each hash function, then according to SP800-90A rev1 10.1 table 2,
|
||||
* min_entropy_len (in bits) is security_strength.
|
||||
*
|
||||
* (This also matches the sizes used in the NIST test vectors.)
|
||||
*/
|
||||
ctx->entropy_len = md_size <= 20 ? 16 : /* 160-bits hash -> 128 bits */
|
||||
md_size <= 28 ? 24 : /* 224-bits hash -> 192 bits */
|
||||
32; /* better (256+) -> 256 bits */
|
||||
if( ctx->entropy_len == 0 )
|
||||
{
|
||||
/*
|
||||
* See SP800-57 5.6.1 (p. 65-66) for the security strength provided by
|
||||
* each hash function, then according to SP800-90A rev1 10.1 table 2,
|
||||
* min_entropy_len (in bits) is security_strength.
|
||||
*
|
||||
* (This also matches the sizes used in the NIST test vectors.)
|
||||
*/
|
||||
ctx->entropy_len = md_size <= 20 ? 16 : /* 160-bits hash -> 128 bits */
|
||||
md_size <= 28 ? 24 : /* 224-bits hash -> 192 bits */
|
||||
32; /* better (256+) -> 256 bits */
|
||||
}
|
||||
|
||||
if( ( ret = hmac_drbg_reseed_core( ctx, custom, len,
|
||||
1 /* add nonce */ ) ) != 0 )
|
||||
|
@ -307,7 +310,7 @@ void mbedtls_hmac_drbg_set_prediction_resistance( mbedtls_hmac_drbg_context *ctx
|
|||
}
|
||||
|
||||
/*
|
||||
* Set entropy length grabbed for reseeds
|
||||
* Set entropy length grabbed for seeding
|
||||
*/
|
||||
void mbedtls_hmac_drbg_set_entropy_len( mbedtls_hmac_drbg_context *ctx, size_t len )
|
||||
{
|
||||
|
|
|
@ -83,7 +83,7 @@ Used Version: 4.1.0
|
|||
Website: http://www.simplesystems.org/libtiff/
|
||||
|
||||
Title: mbed TLS
|
||||
Used Version: 2.7.12
|
||||
Used Version: 2.7.13
|
||||
Website: https://tls.mbed.org/
|
||||
|
||||
Title: libpng
|
||||
|
|
|
@ -181,7 +181,7 @@ extern "C" {
|
|||
*/
|
||||
typedef struct
|
||||
{
|
||||
int s; /*!< integer sign */
|
||||
int s; /*!< Sign: -1 if the mpi is negative, 1 otherwise */
|
||||
size_t n; /*!< total # of limbs */
|
||||
mbedtls_mpi_uint *p; /*!< pointer to limbs */
|
||||
}
|
||||
|
@ -486,6 +486,24 @@ int mbedtls_mpi_cmp_abs( const mbedtls_mpi *X, const mbedtls_mpi *Y );
|
|||
*/
|
||||
int mbedtls_mpi_cmp_mpi( const mbedtls_mpi *X, const mbedtls_mpi *Y );
|
||||
|
||||
/**
|
||||
* \brief Check if an MPI is less than the other in constant time.
|
||||
*
|
||||
* \param X The left-hand MPI. This must point to an initialized MPI
|
||||
* with the same allocated length as Y.
|
||||
* \param Y The right-hand MPI. This must point to an initialized MPI
|
||||
* with the same allocated length as X.
|
||||
* \param ret The result of the comparison:
|
||||
* \c 1 if \p X is less than \p Y.
|
||||
* \c 0 if \p X is greater than or equal to \p Y.
|
||||
*
|
||||
* \return 0 on success.
|
||||
* \return MBEDTLS_ERR_MPI_BAD_INPUT_DATA if the allocated length of
|
||||
* the two input MPIs is not the same.
|
||||
*/
|
||||
int mbedtls_mpi_lt_mpi_ct( const mbedtls_mpi *X, const mbedtls_mpi *Y,
|
||||
unsigned *ret );
|
||||
|
||||
/**
|
||||
* \brief Compare signed values
|
||||
*
|
||||
|
|
|
@ -262,6 +262,14 @@
|
|||
#error "MBEDTLS_MEMORY_BUFFER_ALLOC_C defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_MEMORY_BACKTRACE) && !defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C)
|
||||
#error "MBEDTLS_MEMORY_BACKTRACE defined, but not all prerequesites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_MEMORY_DEBUG) && !defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C)
|
||||
#error "MBEDTLS_MEMORY_DEBUG defined, but not all prerequesites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_PADLOCK_C) && !defined(MBEDTLS_HAVE_ASM)
|
||||
#error "MBEDTLS_PADLOCK_C defined, but not all prerequisites"
|
||||
#endif
|
||||
|
|
|
@ -1886,6 +1886,10 @@
|
|||
*
|
||||
* Enable the CTR_DRBG AES-256-based random generator.
|
||||
*
|
||||
* \note This module only achieves a 256-bit security strength if
|
||||
* the generator is seeded with sufficient entropy.
|
||||
* See ctr_drbg.h for more details.
|
||||
*
|
||||
* Module: library/ctr_drbg.c
|
||||
* Caller:
|
||||
*
|
||||
|
|
|
@ -1,13 +1,38 @@
|
|||
/**
|
||||
* \file ctr_drbg.h
|
||||
*
|
||||
* \brief CTR_DRBG is based on AES-256, as defined in <em>NIST SP 800-90A:
|
||||
* Recommendation for Random Number Generation Using Deterministic
|
||||
* Random Bit Generators</em>.
|
||||
* \brief The CTR_DRBG pseudorandom generator.
|
||||
*
|
||||
* CTR_DRBG is a standardized way of building a PRNG from a block-cipher
|
||||
* in counter mode operation, as defined in <em>NIST SP 800-90A:
|
||||
* Recommendation for Random Number Generation Using Deterministic Random
|
||||
* Bit Generators</em>.
|
||||
*
|
||||
* The Mbed TLS implementation of CTR_DRBG uses AES-256
|
||||
* as the underlying block cipher, with a derivation function.
|
||||
* The initial seeding grabs #MBEDTLS_CTR_DRBG_ENTROPY_LEN bytes of entropy.
|
||||
* See the documentation of mbedtls_ctr_drbg_seed() for more details.
|
||||
*
|
||||
* Based on NIST SP 800-90A §10.2.1 table 3 and NIST SP 800-57 part 1 table 2,
|
||||
* here are the security strengths achieved in typical configuration:
|
||||
* - 256 bits under the default configuration of the library,
|
||||
* with #MBEDTLS_CTR_DRBG_ENTROPY_LEN set to 48 or more.
|
||||
* - 256 bits if #MBEDTLS_CTR_DRBG_ENTROPY_LEN is set
|
||||
* to 32 or more and the DRBG is initialized with an explicit
|
||||
* nonce in the \c custom parameter to mbedtls_ctr_drbg_seed().
|
||||
* - 128 bits if #MBEDTLS_CTR_DRBG_ENTROPY_LEN is
|
||||
* between 24 and 47 and the DRBG is not initialized with an explicit
|
||||
* nonce (see mbedtls_ctr_drbg_seed()).
|
||||
*
|
||||
* Note that the value of #MBEDTLS_CTR_DRBG_ENTROPY_LEN defaults to:
|
||||
* - \c 48 if the module \c MBEDTLS_SHA512_C is enabled and the symbol
|
||||
* \c MBEDTLS_ENTROPY_FORCE_SHA256 is not enabled at compile time.
|
||||
* This is the default configuration of the library.
|
||||
* - \c 32 if the module \c MBEDTLS_SHA512_C is disabled at compile time.
|
||||
* - \c 32 if \c MBEDTLS_ENTROPY_FORCE_SHA256 is enabled at compile time.
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved
|
||||
* Copyright (C) 2006-2019, Arm Limited (or its affiliates), All Rights Reserved
|
||||
* SPDX-License-Identifier: GPL-2.0
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify
|
||||
|
@ -61,21 +86,29 @@
|
|||
* \{
|
||||
*/
|
||||
|
||||
/** \def MBEDTLS_CTR_DRBG_ENTROPY_LEN
|
||||
*
|
||||
* \brief The amount of entropy used per seed by default, in bytes.
|
||||
*/
|
||||
#if !defined(MBEDTLS_CTR_DRBG_ENTROPY_LEN)
|
||||
#if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_ENTROPY_FORCE_SHA256)
|
||||
/** This is 48 bytes because the entropy module uses SHA-512
|
||||
* (\c MBEDTLS_ENTROPY_FORCE_SHA256 is not set).
|
||||
*/
|
||||
#define MBEDTLS_CTR_DRBG_ENTROPY_LEN 48
|
||||
/**< The amount of entropy used per seed by default:
|
||||
* <ul><li>48 with SHA-512.</li>
|
||||
* <li>32 with SHA-256.</li></ul>
|
||||
|
||||
#else /* defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_ENTROPY_FORCE_SHA256) */
|
||||
|
||||
/** This is 32 bytes because the entropy module uses SHA-256
|
||||
* (the SHA512 module is disabled or
|
||||
* \c MBEDTLS_ENTROPY_FORCE_SHA256 is enabled).
|
||||
*
|
||||
* \warning To achieve a 256-bit security strength, you must pass a nonce
|
||||
* to mbedtls_ctr_drbg_seed().
|
||||
*/
|
||||
#else
|
||||
#define MBEDTLS_CTR_DRBG_ENTROPY_LEN 32
|
||||
/**< Amount of entropy used per seed by default:
|
||||
* <ul><li>48 with SHA-512.</li>
|
||||
* <li>32 with SHA-256.</li></ul>
|
||||
*/
|
||||
#endif
|
||||
#endif
|
||||
#endif /* defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_ENTROPY_FORCE_SHA256) */
|
||||
#endif /* !defined(MBEDTLS_CTR_DRBG_ENTROPY_LEN) */
|
||||
|
||||
#if !defined(MBEDTLS_CTR_DRBG_RESEED_INTERVAL)
|
||||
#define MBEDTLS_CTR_DRBG_RESEED_INTERVAL 10000
|
||||
|
@ -94,7 +127,7 @@
|
|||
|
||||
#if !defined(MBEDTLS_CTR_DRBG_MAX_SEED_INPUT)
|
||||
#define MBEDTLS_CTR_DRBG_MAX_SEED_INPUT 384
|
||||
/**< The maximum size of seed or reseed buffer. */
|
||||
/**< The maximum size of seed or reseed buffer in bytes. */
|
||||
#endif
|
||||
|
||||
/* \} name SECTION: Module settings */
|
||||
|
@ -152,17 +185,67 @@ void mbedtls_ctr_drbg_init( mbedtls_ctr_drbg_context *ctx );
|
|||
* \brief This function seeds and sets up the CTR_DRBG
|
||||
* entropy source for future reseeds.
|
||||
*
|
||||
* \note Personalization data can be provided in addition to the more generic
|
||||
* entropy source, to make this instantiation as unique as possible.
|
||||
* A typical choice for the \p f_entropy and \p p_entropy parameters is
|
||||
* to use the entropy module:
|
||||
* - \p f_entropy is mbedtls_entropy_func();
|
||||
* - \p p_entropy is an instance of ::mbedtls_entropy_context initialized
|
||||
* with mbedtls_entropy_init() (which registers the platform's default
|
||||
* entropy sources).
|
||||
*
|
||||
* The entropy length is #MBEDTLS_CTR_DRBG_ENTROPY_LEN by default.
|
||||
* You can override it by calling mbedtls_ctr_drbg_set_entropy_len().
|
||||
*
|
||||
* You can provide a personalization string in addition to the
|
||||
* entropy source, to make this instantiation as unique as possible.
|
||||
*
|
||||
* \note The _seed_material_ value passed to the derivation
|
||||
* function in the CTR_DRBG Instantiate Process
|
||||
* described in NIST SP 800-90A §10.2.1.3.2
|
||||
* is the concatenation of the string obtained from
|
||||
* calling \p f_entropy and the \p custom string.
|
||||
* The origin of the nonce depends on the value of
|
||||
* the entropy length relative to the security strength.
|
||||
* - If the entropy length is at least 1.5 times the
|
||||
* security strength then the nonce is taken from the
|
||||
* string obtained with \p f_entropy.
|
||||
* - If the entropy length is less than the security
|
||||
* strength, then the nonce is taken from \p custom.
|
||||
* In this case, for compliance with SP 800-90A,
|
||||
* you must pass a unique value of \p custom at
|
||||
* each invocation. See SP 800-90A §8.6.7 for more
|
||||
* details.
|
||||
*/
|
||||
#if MBEDTLS_CTR_DRBG_ENTROPY_LEN < MBEDTLS_CTR_DRBG_KEYSIZE * 3 / 2
|
||||
/** \warning When #MBEDTLS_CTR_DRBG_ENTROPY_LEN is less than
|
||||
* 48, to achieve a 256-bit security strength,
|
||||
* you must pass a value of \p custom that is a nonce:
|
||||
* this value must never be repeated in subsequent
|
||||
* runs of the same application or on a different
|
||||
* device.
|
||||
*/
|
||||
#endif
|
||||
/**
|
||||
* \param ctx The CTR_DRBG context to seed.
|
||||
* It must have been initialized with
|
||||
* mbedtls_ctr_drbg_init().
|
||||
* After a successful call to mbedtls_ctr_drbg_seed(),
|
||||
* you may not call mbedtls_ctr_drbg_seed() again on
|
||||
* the same context unless you call
|
||||
* mbedtls_ctr_drbg_free() and mbedtls_ctr_drbg_init()
|
||||
* again first.
|
||||
* \param f_entropy The entropy callback, taking as arguments the
|
||||
* \p p_entropy context, the buffer to fill, and the
|
||||
length of the buffer.
|
||||
* \param p_entropy The entropy context.
|
||||
* \param custom Personalization data, that is device-specific
|
||||
identifiers. Can be NULL.
|
||||
* \param len The length of the personalization data.
|
||||
* length of the buffer.
|
||||
* \p f_entropy is always called with a buffer size
|
||||
* equal to the entropy length.
|
||||
* \param p_entropy The entropy context to pass to \p f_entropy.
|
||||
* \param custom The personalization string.
|
||||
* This can be \c NULL, in which case the personalization
|
||||
* string is empty regardless of the value of \p len.
|
||||
* \param len The length of the personalization string.
|
||||
* This must be at most
|
||||
* #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT
|
||||
* - #MBEDTLS_CTR_DRBG_ENTROPY_LEN.
|
||||
*
|
||||
* \return \c 0 on success, or
|
||||
* #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure.
|
||||
|
@ -185,7 +268,8 @@ void mbedtls_ctr_drbg_free( mbedtls_ctr_drbg_context *ctx );
|
|||
* The default value is off.
|
||||
*
|
||||
* \note If enabled, entropy is gathered at the beginning of
|
||||
* every call to mbedtls_ctr_drbg_random_with_add().
|
||||
* every call to mbedtls_ctr_drbg_random_with_add()
|
||||
* or mbedtls_ctr_drbg_random().
|
||||
* Only use this if your entropy source has sufficient
|
||||
* throughput.
|
||||
*
|
||||
|
@ -197,18 +281,29 @@ void mbedtls_ctr_drbg_set_prediction_resistance( mbedtls_ctr_drbg_context *ctx,
|
|||
|
||||
/**
|
||||
* \brief This function sets the amount of entropy grabbed on each
|
||||
* seed or reseed. The default value is
|
||||
* #MBEDTLS_CTR_DRBG_ENTROPY_LEN.
|
||||
* seed or reseed.
|
||||
*
|
||||
* The default value is #MBEDTLS_CTR_DRBG_ENTROPY_LEN.
|
||||
*
|
||||
* \note The security strength of CTR_DRBG is bounded by the
|
||||
* entropy length. Thus \p len must be at least
|
||||
* 32 (in bytes) to achieve a 256-bit strength.
|
||||
*
|
||||
* \param ctx The CTR_DRBG context.
|
||||
* \param len The amount of entropy to grab.
|
||||
* \param len The amount of entropy to grab, in bytes.
|
||||
* This must be at most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT.
|
||||
*/
|
||||
void mbedtls_ctr_drbg_set_entropy_len( mbedtls_ctr_drbg_context *ctx,
|
||||
size_t len );
|
||||
|
||||
/**
|
||||
* \brief This function sets the reseed interval.
|
||||
* The default value is #MBEDTLS_CTR_DRBG_RESEED_INTERVAL.
|
||||
*
|
||||
* The reseed interval is the number of calls to mbedtls_ctr_drbg_random()
|
||||
* or mbedtls_ctr_drbg_random_with_add() after which the entropy function
|
||||
* is called again.
|
||||
*
|
||||
* The default value is #MBEDTLS_CTR_DRBG_RESEED_INTERVAL.
|
||||
*
|
||||
* \param ctx The CTR_DRBG context.
|
||||
* \param interval The reseed interval.
|
||||
|
@ -221,8 +316,12 @@ void mbedtls_ctr_drbg_set_reseed_interval( mbedtls_ctr_drbg_context *ctx,
|
|||
* extracts data from the entropy source.
|
||||
*
|
||||
* \param ctx The CTR_DRBG context.
|
||||
* \param additional Additional data to add to the state. Can be NULL.
|
||||
* \param additional Additional data to add to the state. Can be \c NULL.
|
||||
* \param len The length of the additional data.
|
||||
* This must be less than
|
||||
* #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len
|
||||
* where \c entropy_len is the entropy length
|
||||
* configured for the context.
|
||||
*
|
||||
* \return \c 0 on success, or
|
||||
* #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure.
|
||||
|
@ -234,7 +333,8 @@ int mbedtls_ctr_drbg_reseed( mbedtls_ctr_drbg_context *ctx,
|
|||
* \brief This function updates the state of the CTR_DRBG context.
|
||||
*
|
||||
* \param ctx The CTR_DRBG context.
|
||||
* \param additional The data to update the state with.
|
||||
* \param additional The data to update the state with. This must not be
|
||||
* \c NULL unless \p add_len is \c 0.
|
||||
* \param add_len Length of \p additional in bytes. This must be at
|
||||
* most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT.
|
||||
*
|
||||
|
@ -260,8 +360,10 @@ int mbedtls_ctr_drbg_update_ret( mbedtls_ctr_drbg_context *ctx,
|
|||
* The remaining Bytes are silently discarded.
|
||||
*
|
||||
* \param ctx The CTR_DRBG context.
|
||||
* \param additional The data to update the state with.
|
||||
* \param add_len Length of \p additional data.
|
||||
* \param additional The data to update the state with. This must not be
|
||||
* \c NULL unless \p add_len is \c 0.
|
||||
* \param add_len Length of \p additional data. This must be at
|
||||
* most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT.
|
||||
*/
|
||||
void mbedtls_ctr_drbg_update( mbedtls_ctr_drbg_context *ctx,
|
||||
const unsigned char *additional,
|
||||
|
@ -271,17 +373,26 @@ void mbedtls_ctr_drbg_update( mbedtls_ctr_drbg_context *ctx,
|
|||
* \brief This function updates a CTR_DRBG instance with additional
|
||||
* data and uses it to generate random data.
|
||||
*
|
||||
* \note The function automatically reseeds if the reseed counter is exceeded.
|
||||
* This function automatically reseeds if the reseed counter is exceeded
|
||||
* or prediction resistance is enabled.
|
||||
*
|
||||
* \param p_rng The CTR_DRBG context. This must be a pointer to a
|
||||
* #mbedtls_ctr_drbg_context structure.
|
||||
* \param output The buffer to fill.
|
||||
* \param output_len The length of the buffer.
|
||||
* \param additional Additional data to update. Can be NULL.
|
||||
* \param add_len The length of the additional data.
|
||||
* \param output_len The length of the buffer in bytes.
|
||||
* \param additional Additional data to update. Can be \c NULL, in which
|
||||
* case the additional data is empty regardless of
|
||||
* the value of \p add_len.
|
||||
* \param add_len The length of the additional data
|
||||
* if \p additional is not \c NULL.
|
||||
* This must be less than #MBEDTLS_CTR_DRBG_MAX_INPUT
|
||||
* and less than
|
||||
* #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len
|
||||
* where \c entropy_len is the entropy length
|
||||
* configured for the context.
|
||||
*
|
||||
* \return \c 0 on success, or
|
||||
* #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or
|
||||
* #MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG on failure.
|
||||
*/
|
||||
int mbedtls_ctr_drbg_random_with_add( void *p_rng,
|
||||
|
@ -291,15 +402,17 @@ int mbedtls_ctr_drbg_random_with_add( void *p_rng,
|
|||
/**
|
||||
* \brief This function uses CTR_DRBG to generate random data.
|
||||
*
|
||||
* \note The function automatically reseeds if the reseed counter is exceeded.
|
||||
* This function automatically reseeds if the reseed counter is exceeded
|
||||
* or prediction resistance is enabled.
|
||||
*
|
||||
*
|
||||
* \param p_rng The CTR_DRBG context. This must be a pointer to a
|
||||
* #mbedtls_ctr_drbg_context structure.
|
||||
* \param output The buffer to fill.
|
||||
* \param output_len The length of the buffer.
|
||||
* \param output_len The length of the buffer in bytes.
|
||||
*
|
||||
* \return \c 0 on success, or
|
||||
* #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or
|
||||
* #MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG on failure.
|
||||
*/
|
||||
int mbedtls_ctr_drbg_random( void *p_rng,
|
||||
|
@ -312,9 +425,9 @@ int mbedtls_ctr_drbg_random( void *p_rng,
|
|||
* \param ctx The CTR_DRBG context.
|
||||
* \param path The name of the file.
|
||||
*
|
||||
* \return \c 0 on success,
|
||||
* #MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR on file error, or
|
||||
* #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR on file error.
|
||||
* \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on reseed
|
||||
* failure.
|
||||
*/
|
||||
int mbedtls_ctr_drbg_write_seed_file( mbedtls_ctr_drbg_context *ctx, const char *path );
|
||||
|
@ -326,10 +439,12 @@ int mbedtls_ctr_drbg_write_seed_file( mbedtls_ctr_drbg_context *ctx, const char
|
|||
* \param ctx The CTR_DRBG context.
|
||||
* \param path The name of the file.
|
||||
*
|
||||
* \return \c 0 on success,
|
||||
* #MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR on file error,
|
||||
* #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or
|
||||
* #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG on failure.
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR on file error.
|
||||
* \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on
|
||||
* reseed failure.
|
||||
* \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if the existing
|
||||
* seed file is too large.
|
||||
*/
|
||||
int mbedtls_ctr_drbg_update_seed_file( mbedtls_ctr_drbg_context *ctx, const char *path );
|
||||
#endif /* MBEDTLS_FS_IO */
|
||||
|
|
|
@ -1,10 +1,14 @@
|
|||
/**
|
||||
* \file hmac_drbg.h
|
||||
*
|
||||
* \brief HMAC_DRBG (NIST SP 800-90A)
|
||||
* \brief The HMAC_DRBG pseudorandom generator.
|
||||
*
|
||||
* This module implements the HMAC_DRBG pseudorandom generator described
|
||||
* in <em>NIST SP 800-90A: Recommendation for Random Number Generation Using
|
||||
* Deterministic Random Bit Generators</em>.
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
||||
* Copyright (C) 2006-2019, ARM Limited, All Rights Reserved
|
||||
* SPDX-License-Identifier: GPL-2.0
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify
|
||||
|
@ -106,38 +110,72 @@ typedef struct
|
|||
} mbedtls_hmac_drbg_context;
|
||||
|
||||
/**
|
||||
* \brief HMAC_DRBG context initialization
|
||||
* Makes the context ready for mbedtls_hmac_drbg_seed(),
|
||||
* mbedtls_hmac_drbg_seed_buf() or
|
||||
* mbedtls_hmac_drbg_free().
|
||||
* \brief HMAC_DRBG context initialization.
|
||||
*
|
||||
* \param ctx HMAC_DRBG context to be initialized
|
||||
* This function makes the context ready for mbedtls_hmac_drbg_seed(),
|
||||
* mbedtls_hmac_drbg_seed_buf() or mbedtls_hmac_drbg_free().
|
||||
*
|
||||
* \param ctx HMAC_DRBG context to be initialized.
|
||||
*/
|
||||
void mbedtls_hmac_drbg_init( mbedtls_hmac_drbg_context *ctx );
|
||||
|
||||
/**
|
||||
* \brief HMAC_DRBG initial seeding
|
||||
* Seed and setup entropy source for future reseeds.
|
||||
* \brief HMAC_DRBG initial seeding.
|
||||
*
|
||||
* \param ctx HMAC_DRBG context to be seeded
|
||||
* \param md_info MD algorithm to use for HMAC_DRBG
|
||||
* \param f_entropy Entropy callback (p_entropy, buffer to fill, buffer
|
||||
* length)
|
||||
* \param p_entropy Entropy context
|
||||
* \param custom Personalization data (Device specific identifiers)
|
||||
* (Can be NULL)
|
||||
* \param len Length of personalization data
|
||||
* Set the initial seed and set up the entropy source for future reseeds.
|
||||
*
|
||||
* \note The "security strength" as defined by NIST is set to:
|
||||
* 128 bits if md_alg is SHA-1,
|
||||
* 192 bits if md_alg is SHA-224,
|
||||
* 256 bits if md_alg is SHA-256 or higher.
|
||||
* A typical choice for the \p f_entropy and \p p_entropy parameters is
|
||||
* to use the entropy module:
|
||||
* - \p f_entropy is mbedtls_entropy_func();
|
||||
* - \p p_entropy is an instance of ::mbedtls_entropy_context initialized
|
||||
* with mbedtls_entropy_init() (which registers the platform's default
|
||||
* entropy sources).
|
||||
*
|
||||
* You can provide a personalization string in addition to the
|
||||
* entropy source, to make this instantiation as unique as possible.
|
||||
*
|
||||
* \note By default, the security strength as defined by NIST is:
|
||||
* - 128 bits if \p md_info is SHA-1;
|
||||
* - 192 bits if \p md_info is SHA-224;
|
||||
* - 256 bits if \p md_info is SHA-256, SHA-384 or SHA-512.
|
||||
* Note that SHA-256 is just as efficient as SHA-224.
|
||||
* The security strength can be reduced if a smaller
|
||||
* entropy length is set with
|
||||
* mbedtls_hmac_drbg_set_entropy_len().
|
||||
*
|
||||
* \return 0 if successful, or
|
||||
* MBEDTLS_ERR_MD_BAD_INPUT_DATA, or
|
||||
* MBEDTLS_ERR_MD_ALLOC_FAILED, or
|
||||
* MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED.
|
||||
* \note The default entropy length is the security strength
|
||||
* (converted from bits to bytes). You can override
|
||||
* it by calling mbedtls_hmac_drbg_set_entropy_len().
|
||||
*
|
||||
* \note During the initial seeding, this function calls
|
||||
* the entropy source to obtain a nonce
|
||||
* whose length is half the entropy length.
|
||||
*
|
||||
* \param ctx HMAC_DRBG context to be seeded.
|
||||
* \param md_info MD algorithm to use for HMAC_DRBG.
|
||||
* \param f_entropy The entropy callback, taking as arguments the
|
||||
* \p p_entropy context, the buffer to fill, and the
|
||||
* length of the buffer.
|
||||
* \p f_entropy is always called with a length that is
|
||||
* less than or equal to the entropy length.
|
||||
* \param p_entropy The entropy context to pass to \p f_entropy.
|
||||
* \param custom The personalization string.
|
||||
* This can be \c NULL, in which case the personalization
|
||||
* string is empty regardless of the value of \p len.
|
||||
* \param len The length of the personalization string.
|
||||
* This must be at most #MBEDTLS_HMAC_DRBG_MAX_INPUT
|
||||
* and also at most
|
||||
* #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \p entropy_len * 3 / 2
|
||||
* where \p entropy_len is the entropy length
|
||||
* described above.
|
||||
*
|
||||
* \return \c 0 if successful.
|
||||
* \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA if \p md_info is
|
||||
* invalid.
|
||||
* \return #MBEDTLS_ERR_MD_ALLOC_FAILED if there was not enough
|
||||
* memory to allocate context data.
|
||||
* \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED
|
||||
* if the call to \p f_entropy failed.
|
||||
*/
|
||||
int mbedtls_hmac_drbg_seed( mbedtls_hmac_drbg_context *ctx,
|
||||
const mbedtls_md_info_t * md_info,
|
||||
|
@ -148,66 +186,80 @@ int mbedtls_hmac_drbg_seed( mbedtls_hmac_drbg_context *ctx,
|
|||
|
||||
/**
|
||||
* \brief Initilisation of simpified HMAC_DRBG (never reseeds).
|
||||
* (For use with deterministic ECDSA.)
|
||||
*
|
||||
* \param ctx HMAC_DRBG context to be initialised
|
||||
* \param md_info MD algorithm to use for HMAC_DRBG
|
||||
* \param data Concatenation of entropy string and additional data
|
||||
* \param data_len Length of data in bytes
|
||||
* This function is meant for use in algorithms that need a pseudorandom
|
||||
* input such as deterministic ECDSA.
|
||||
*
|
||||
* \return 0 if successful, or
|
||||
* MBEDTLS_ERR_MD_BAD_INPUT_DATA, or
|
||||
* MBEDTLS_ERR_MD_ALLOC_FAILED.
|
||||
* \param ctx HMAC_DRBG context to be initialised.
|
||||
* \param md_info MD algorithm to use for HMAC_DRBG.
|
||||
* \param data Concatenation of the initial entropy string and
|
||||
* the additional data.
|
||||
* \param data_len Length of \p data in bytes.
|
||||
*
|
||||
* \return \c 0 if successful. or
|
||||
* \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA if \p md_info is
|
||||
* invalid.
|
||||
* \return #MBEDTLS_ERR_MD_ALLOC_FAILED if there was not enough
|
||||
* memory to allocate context data.
|
||||
*/
|
||||
int mbedtls_hmac_drbg_seed_buf( mbedtls_hmac_drbg_context *ctx,
|
||||
const mbedtls_md_info_t * md_info,
|
||||
const unsigned char *data, size_t data_len );
|
||||
|
||||
/**
|
||||
* \brief Enable / disable prediction resistance (Default: Off)
|
||||
* \brief This function turns prediction resistance on or off.
|
||||
* The default value is off.
|
||||
*
|
||||
* Note: If enabled, entropy is used for ctx->entropy_len before each call!
|
||||
* Only use this if you have ample supply of good entropy!
|
||||
* \note If enabled, entropy is gathered at the beginning of
|
||||
* every call to mbedtls_hmac_drbg_random_with_add()
|
||||
* or mbedtls_hmac_drbg_random().
|
||||
* Only use this if your entropy source has sufficient
|
||||
* throughput.
|
||||
*
|
||||
* \param ctx HMAC_DRBG context
|
||||
* \param resistance MBEDTLS_HMAC_DRBG_PR_ON or MBEDTLS_HMAC_DRBG_PR_OFF
|
||||
* \param ctx The HMAC_DRBG context.
|
||||
* \param resistance #MBEDTLS_HMAC_DRBG_PR_ON or #MBEDTLS_HMAC_DRBG_PR_OFF.
|
||||
*/
|
||||
void mbedtls_hmac_drbg_set_prediction_resistance( mbedtls_hmac_drbg_context *ctx,
|
||||
int resistance );
|
||||
|
||||
/**
|
||||
* \brief Set the amount of entropy grabbed on each reseed
|
||||
* (Default: given by the security strength, which
|
||||
* depends on the hash used, see \c mbedtls_hmac_drbg_init() )
|
||||
* \brief This function sets the amount of entropy grabbed on each
|
||||
* seed or reseed.
|
||||
*
|
||||
* \param ctx HMAC_DRBG context
|
||||
* \param len Amount of entropy to grab, in bytes
|
||||
* See the documentation of mbedtls_hmac_drbg_seed() for the default value.
|
||||
*
|
||||
* \param ctx The HMAC_DRBG context.
|
||||
* \param len The amount of entropy to grab, in bytes.
|
||||
*/
|
||||
void mbedtls_hmac_drbg_set_entropy_len( mbedtls_hmac_drbg_context *ctx,
|
||||
size_t len );
|
||||
|
||||
/**
|
||||
* \brief Set the reseed interval
|
||||
* (Default: MBEDTLS_HMAC_DRBG_RESEED_INTERVAL)
|
||||
* \brief Set the reseed interval.
|
||||
*
|
||||
* \param ctx HMAC_DRBG context
|
||||
* \param interval Reseed interval
|
||||
* The reseed interval is the number of calls to mbedtls_hmac_drbg_random()
|
||||
* or mbedtls_hmac_drbg_random_with_add() after which the entropy function
|
||||
* is called again.
|
||||
*
|
||||
* The default value is #MBEDTLS_HMAC_DRBG_RESEED_INTERVAL.
|
||||
*
|
||||
* \param ctx The HMAC_DRBG context.
|
||||
* \param interval The reseed interval.
|
||||
*/
|
||||
void mbedtls_hmac_drbg_set_reseed_interval( mbedtls_hmac_drbg_context *ctx,
|
||||
int interval );
|
||||
|
||||
/**
|
||||
* \brief HMAC_DRBG update state
|
||||
* \brief This function updates the state of the HMAC_DRBG context.
|
||||
*
|
||||
* \param ctx HMAC_DRBG context
|
||||
* \param additional Additional data to update state with, or NULL
|
||||
* \param add_len Length of additional data, or 0
|
||||
* \param ctx The HMAC_DRBG context.
|
||||
* \param additional The data to update the state with.
|
||||
* If this is \c NULL, there is no additional data.
|
||||
* \param add_len Length of \p additional in bytes.
|
||||
* Unused if \p additional is \c NULL.
|
||||
*
|
||||
* \return \c 0 on success, or an error from the underlying
|
||||
* hash calculation.
|
||||
*
|
||||
* \note Additional data is optional, pass NULL and 0 as second
|
||||
* third argument if no additional data is being used.
|
||||
*/
|
||||
int mbedtls_hmac_drbg_update_ret( mbedtls_hmac_drbg_context *ctx,
|
||||
const unsigned char *additional, size_t add_len );
|
||||
|
@ -230,33 +282,52 @@ void mbedtls_hmac_drbg_update( mbedtls_hmac_drbg_context *ctx,
|
|||
size_t add_len );
|
||||
|
||||
/**
|
||||
* \brief HMAC_DRBG reseeding (extracts data from entropy source)
|
||||
* \brief This function reseeds the HMAC_DRBG context, that is
|
||||
* extracts data from the entropy source.
|
||||
*
|
||||
* \param ctx HMAC_DRBG context
|
||||
* \param additional Additional data to add to state (Can be NULL)
|
||||
* \param len Length of additional data
|
||||
* \param ctx The HMAC_DRBG context.
|
||||
* \param additional Additional data to add to the state.
|
||||
* If this is \c NULL, there is no additional data
|
||||
* and \p len should be \c 0.
|
||||
* \param len The length of the additional data.
|
||||
* This must be at most #MBEDTLS_HMAC_DRBG_MAX_INPUT
|
||||
* and also at most
|
||||
* #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \p entropy_len
|
||||
* where \p entropy_len is the entropy length
|
||||
* (see mbedtls_hmac_drbg_set_entropy_len()).
|
||||
*
|
||||
* \return 0 if successful, or
|
||||
* MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED
|
||||
* \return \c 0 if successful.
|
||||
* \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED
|
||||
* if a call to the entropy function failed.
|
||||
*/
|
||||
int mbedtls_hmac_drbg_reseed( mbedtls_hmac_drbg_context *ctx,
|
||||
const unsigned char *additional, size_t len );
|
||||
|
||||
/**
|
||||
* \brief HMAC_DRBG generate random with additional update input
|
||||
* \brief This function updates an HMAC_DRBG instance with additional
|
||||
* data and uses it to generate random data.
|
||||
*
|
||||
* Note: Automatically reseeds if reseed_counter is reached or PR is enabled.
|
||||
* This function automatically reseeds if the reseed counter is exceeded
|
||||
* or prediction resistance is enabled.
|
||||
*
|
||||
* \param p_rng HMAC_DRBG context
|
||||
* \param output Buffer to fill
|
||||
* \param output_len Length of the buffer
|
||||
* \param additional Additional data to update with (can be NULL)
|
||||
* \param add_len Length of additional data (can be 0)
|
||||
* \param p_rng The HMAC_DRBG context. This must be a pointer to a
|
||||
* #mbedtls_hmac_drbg_context structure.
|
||||
* \param output The buffer to fill.
|
||||
* \param output_len The length of the buffer in bytes.
|
||||
* This must be at most #MBEDTLS_HMAC_DRBG_MAX_REQUEST.
|
||||
* \param additional Additional data to update with.
|
||||
* If this is \c NULL, there is no additional data
|
||||
* and \p add_len should be \c 0.
|
||||
* \param add_len The length of the additional data.
|
||||
* This must be at most #MBEDTLS_HMAC_DRBG_MAX_INPUT.
|
||||
*
|
||||
* \return 0 if successful, or
|
||||
* MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED, or
|
||||
* MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG, or
|
||||
* MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG.
|
||||
* \return \c 0 if successful.
|
||||
* \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED
|
||||
* if a call to the entropy source failed.
|
||||
* \return #MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG if
|
||||
* \p output_len > #MBEDTLS_HMAC_DRBG_MAX_REQUEST.
|
||||
* \return #MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG if
|
||||
* \p add_len > #MBEDTLS_HMAC_DRBG_MAX_INPUT.
|
||||
*/
|
||||
int mbedtls_hmac_drbg_random_with_add( void *p_rng,
|
||||
unsigned char *output, size_t output_len,
|
||||
|
@ -264,49 +335,59 @@ int mbedtls_hmac_drbg_random_with_add( void *p_rng,
|
|||
size_t add_len );
|
||||
|
||||
/**
|
||||
* \brief HMAC_DRBG generate random
|
||||
* \brief This function uses HMAC_DRBG to generate random data.
|
||||
*
|
||||
* Note: Automatically reseeds if reseed_counter is reached or PR is enabled.
|
||||
* This function automatically reseeds if the reseed counter is exceeded
|
||||
* or prediction resistance is enabled.
|
||||
*
|
||||
* \param p_rng HMAC_DRBG context
|
||||
* \param output Buffer to fill
|
||||
* \param out_len Length of the buffer
|
||||
* \param p_rng The HMAC_DRBG context. This must be a pointer to a
|
||||
* #mbedtls_hmac_drbg_context structure.
|
||||
* \param output The buffer to fill.
|
||||
* \param out_len The length of the buffer in bytes.
|
||||
* This must be at most #MBEDTLS_HMAC_DRBG_MAX_REQUEST.
|
||||
*
|
||||
* \return 0 if successful, or
|
||||
* MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED, or
|
||||
* MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG
|
||||
* \return \c 0 if successful.
|
||||
* \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED
|
||||
* if a call to the entropy source failed.
|
||||
* \return #MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG if
|
||||
* \p out_len > #MBEDTLS_HMAC_DRBG_MAX_REQUEST.
|
||||
*/
|
||||
int mbedtls_hmac_drbg_random( void *p_rng, unsigned char *output, size_t out_len );
|
||||
|
||||
/**
|
||||
* \brief Free an HMAC_DRBG context
|
||||
*
|
||||
* \param ctx HMAC_DRBG context to free.
|
||||
* \param ctx The HMAC_DRBG context to free.
|
||||
*/
|
||||
void mbedtls_hmac_drbg_free( mbedtls_hmac_drbg_context *ctx );
|
||||
|
||||
#if defined(MBEDTLS_FS_IO)
|
||||
/**
|
||||
* \brief Write a seed file
|
||||
* \brief This function writes a seed file.
|
||||
*
|
||||
* \param ctx HMAC_DRBG context
|
||||
* \param path Name of the file
|
||||
* \param ctx The HMAC_DRBG context.
|
||||
* \param path The name of the file.
|
||||
*
|
||||
* \return 0 if successful, 1 on file error, or
|
||||
* MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR on file error.
|
||||
* \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED on reseed
|
||||
* failure.
|
||||
*/
|
||||
int mbedtls_hmac_drbg_write_seed_file( mbedtls_hmac_drbg_context *ctx, const char *path );
|
||||
|
||||
/**
|
||||
* \brief Read and update a seed file. Seed is added to this
|
||||
* instance
|
||||
* \brief This function reads and updates a seed file. The seed
|
||||
* is added to this instance.
|
||||
*
|
||||
* \param ctx HMAC_DRBG context
|
||||
* \param path Name of the file
|
||||
* \param ctx The HMAC_DRBG context.
|
||||
* \param path The name of the file.
|
||||
*
|
||||
* \return 0 if successful, 1 on file error,
|
||||
* MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED or
|
||||
* MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR on file error.
|
||||
* \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED on
|
||||
* reseed failure.
|
||||
* \return #MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG if the existing
|
||||
* seed file is too large.
|
||||
*/
|
||||
int mbedtls_hmac_drbg_update_seed_file( mbedtls_hmac_drbg_context *ctx, const char *path );
|
||||
#endif /* MBEDTLS_FS_IO */
|
||||
|
@ -314,9 +395,10 @@ int mbedtls_hmac_drbg_update_seed_file( mbedtls_hmac_drbg_context *ctx, const ch
|
|||
|
||||
#if defined(MBEDTLS_SELF_TEST)
|
||||
/**
|
||||
* \brief Checkup routine
|
||||
* \brief The HMAC_DRBG Checkup routine.
|
||||
*
|
||||
* \return 0 if successful, or 1 if the test failed
|
||||
* \return \c 0 if successful.
|
||||
* \return \c 1 if the test failed.
|
||||
*/
|
||||
int mbedtls_hmac_drbg_self_test( int verbose );
|
||||
#endif
|
||||
|
|
Loading…
Reference in a new issue