1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
|
// SPDX-License-Identifier: MIT
#include <stdio.h>
#if defined(_WIN32)
#include <windows.h>
#include <wincrypt.h>
#define strcasecmp _stricmp
#else
#include <unistd.h>
#include <strings.h>
#if defined(__APPLE__)
#include <TargetConditionals.h>
#if TARGET_OS_IPHONE || TARGET_IPHONE_SIMULATOR
#include <Security/SecRandom.h>
#else
#include <sys/random.h>
#endif
#else
#include <unistd.h>
#endif
#endif
#include <fcntl.h>
#include <stdlib.h>
#include <oqs/oqs.h>
void OQS_randombytes_system(uint8_t *random_array, size_t bytes_to_read);
void OQS_randombytes_nist_kat(uint8_t *random_array, size_t bytes_to_read);
#ifdef OQS_USE_OPENSSL
void OQS_randombytes_openssl(uint8_t *random_array, size_t bytes_to_read);
#endif
#ifdef OQS_USE_OPENSSL
#include <openssl/rand.h>
// Use OpenSSL's RAND_bytes as the default PRNG
static void (*oqs_randombytes_algorithm)(uint8_t *, size_t) = &OQS_randombytes_openssl;
#else
static void (*oqs_randombytes_algorithm)(uint8_t *, size_t) = &OQS_randombytes_system;
#endif
OQS_API OQS_STATUS OQS_randombytes_switch_algorithm(const char *algorithm) {
if (0 == strcasecmp(OQS_RAND_alg_system, algorithm)) {
oqs_randombytes_algorithm = &OQS_randombytes_system;
return OQS_SUCCESS;
} else if (0 == strcasecmp(OQS_RAND_alg_nist_kat, algorithm)) {
oqs_randombytes_algorithm = &OQS_randombytes_nist_kat;
return OQS_SUCCESS;
} else if (0 == strcasecmp(OQS_RAND_alg_openssl, algorithm)) {
#ifdef OQS_USE_OPENSSL
oqs_randombytes_algorithm = &OQS_randombytes_openssl;
return OQS_SUCCESS;
#else
return OQS_ERROR;
#endif
} else {
return OQS_ERROR;
}
}
OQS_API void OQS_randombytes_custom_algorithm(void (*algorithm_ptr)(uint8_t *, size_t)) {
oqs_randombytes_algorithm = algorithm_ptr;
}
OQS_API void OQS_randombytes(uint8_t *random_array, size_t bytes_to_read) {
oqs_randombytes_algorithm(random_array, bytes_to_read);
}
#if !defined(_WIN32)
#if defined(OQS_HAVE_GETENTROPY)
void OQS_randombytes_system(uint8_t *random_array, size_t bytes_to_read) {
while (bytes_to_read > 256) {
if (getentropy(random_array, 256)) {
exit(EXIT_FAILURE);
}
random_array += 256;
bytes_to_read -= 256;
}
if (getentropy(random_array, bytes_to_read)) {
exit(EXIT_FAILURE);
}
}
#else
#if defined(__APPLE__) && (TARGET_OS_IPHONE || TARGET_IPHONE_SIMULATOR)
void OQS_randombytes_system(uint8_t *random_array, size_t bytes_to_read) {
int status =
SecRandomCopyBytes(kSecRandomDefault, bytes_to_read, random_array);
if (status == errSecSuccess) {
perror("OQS_randombytes");
exit(EXIT_FAILURE);
}
}
#else
void OQS_randombytes_system(uint8_t *random_array, size_t bytes_to_read) {
FILE *handle;
size_t bytes_read;
handle = fopen("/dev/urandom", "rb");
if (!handle) {
perror("OQS_randombytes");
exit(EXIT_FAILURE);
}
bytes_read = fread(random_array, 1, bytes_to_read, handle);
if (bytes_read < bytes_to_read || ferror(handle)) {
perror("OQS_randombytes");
exit(EXIT_FAILURE);
}
fclose(handle);
}
#endif
#endif
#else
void OQS_randombytes_system(uint8_t *random_array, size_t bytes_to_read) {
HCRYPTPROV hCryptProv;
if (!CryptAcquireContext(&hCryptProv, NULL, NULL, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT) ||
!CryptGenRandom(hCryptProv, (DWORD) bytes_to_read, random_array)) {
exit(EXIT_FAILURE); // better to fail than to return bad random data
}
CryptReleaseContext(hCryptProv, 0);
}
#endif
#ifdef OQS_USE_OPENSSL
#define OQS_RAND_POLL_RETRY 3 // in case failure to get randomness is a temporary problem, allow some repeats
void OQS_randombytes_openssl(uint8_t *random_array, size_t bytes_to_read) {
int rep = OQS_RAND_POLL_RETRY;
SIZE_T_TO_INT_OR_EXIT(bytes_to_read, bytes_to_read_int)
do {
if (RAND_status() == 1) {
break;
}
RAND_poll();
} while (rep-- >= 0);
if (RAND_bytes(random_array, bytes_to_read_int) != 1) {
fprintf(stderr, "No OpenSSL randomness retrieved. DRBG available?\n");
// because of void signature we have no other way to signal the problem
// we cannot possibly return without randomness
exit(EXIT_FAILURE);
}
}
#endif
|
