diff options
| author | Pauli <paul.dale@oracle.com> | 2019-04-11 08:52:22 +1000 |
|---|---|---|
| committer | Pauli <paul.dale@oracle.com> | 2019-04-11 08:52:22 +1000 |
| commit | 6c7d80ab3b2a13074ca270a6d056c59ac431155a (patch) | |
| tree | a44ab97f1136735d7147b377b13cd69c53f65bc2 /crypto | |
| parent | 3a86f1db282569c538273cc48462a3fa5fcffa39 (diff) | |
| download | openssl-new-6c7d80ab3b2a13074ca270a6d056c59ac431155a.tar.gz | |
Reseeding without derivation function is not supported in FIPS mode.
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/8648)
Diffstat (limited to 'crypto')
| -rw-r--r-- | crypto/err/openssl.txt | 3 | ||||
| -rw-r--r-- | crypto/rand/drbg_ctr.c | 6 | ||||
| -rw-r--r-- | crypto/rand/rand_err.c | 5 |
3 files changed, 13 insertions, 1 deletions
diff --git a/crypto/err/openssl.txt b/crypto/err/openssl.txt index a3d15c9a5f..18aa16c748 100644 --- a/crypto/err/openssl.txt +++ b/crypto/err/openssl.txt @@ -1103,6 +1103,7 @@ PROP_F_PARSE_OCT:105:parse_oct PROP_F_PARSE_STRING:106:parse_string PROP_F_PARSE_UNQUOTED:107:parse_unquoted RAND_F_DRBG_BYTES:101:drbg_bytes +RAND_F_DRBG_CTR_INIT:125:drbg_ctr_init RAND_F_DRBG_GET_ENTROPY:105:drbg_get_entropy RAND_F_DRBG_SETUP:117:drbg_setup RAND_F_GET_ENTROPY:106:get_entropy @@ -2607,6 +2608,8 @@ RAND_R_ADDITIONAL_INPUT_TOO_LONG:102:additional input too long RAND_R_ALREADY_INSTANTIATED:103:already instantiated RAND_R_ARGUMENT_OUT_OF_RANGE:105:argument out of range RAND_R_CANNOT_OPEN_FILE:121:Cannot open file +RAND_R_DERIVATION_FUNCTION_MANDATORY_FOR_FIPS:137:\ + derivation function mandatory for fips RAND_R_DRBG_ALREADY_INITIALIZED:129:drbg already initialized RAND_R_DRBG_NOT_INITIALISED:104:drbg not initialised RAND_R_ENTROPY_INPUT_TOO_LONG:106:entropy input too long diff --git a/crypto/rand/drbg_ctr.c b/crypto/rand/drbg_ctr.c index 0f999254fc..4c11e65733 100644 --- a/crypto/rand/drbg_ctr.c +++ b/crypto/rand/drbg_ctr.c @@ -422,6 +422,11 @@ int drbg_ctr_init(RAND_DRBG *drbg) drbg->max_perslen = DRBG_MAX_LENGTH; drbg->max_adinlen = DRBG_MAX_LENGTH; } else { +#ifdef FIPS_MODE + RANDerr(RAND_F_DRBG_CTR_INIT, + RAND_R_DERIVATION_FUNCTION_MANDATORY_FOR_FIPS); + return 0; +#else drbg->min_entropylen = drbg->seedlen; drbg->max_entropylen = drbg->seedlen; /* Nonce not used */ @@ -429,6 +434,7 @@ int drbg_ctr_init(RAND_DRBG *drbg) drbg->max_noncelen = 0; drbg->max_perslen = drbg->seedlen; drbg->max_adinlen = drbg->seedlen; +#endif } drbg->max_request = 1 << 16; diff --git a/crypto/rand/rand_err.c b/crypto/rand/rand_err.c index c899613954..5c0dc3d8e5 100644 --- a/crypto/rand/rand_err.c +++ b/crypto/rand/rand_err.c @@ -1,6 +1,6 @@ /* * Generated by util/mkerr.pl DO NOT EDIT - * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -15,6 +15,7 @@ static const ERR_STRING_DATA RAND_str_functs[] = { {ERR_PACK(ERR_LIB_RAND, RAND_F_DRBG_BYTES, 0), "drbg_bytes"}, + {ERR_PACK(ERR_LIB_RAND, RAND_F_DRBG_CTR_INIT, 0), "drbg_ctr_init"}, {ERR_PACK(ERR_LIB_RAND, RAND_F_DRBG_GET_ENTROPY, 0), "drbg_get_entropy"}, {ERR_PACK(ERR_LIB_RAND, RAND_F_DRBG_SETUP, 0), "drbg_setup"}, {ERR_PACK(ERR_LIB_RAND, RAND_F_GET_ENTROPY, 0), "get_entropy"}, @@ -60,6 +61,8 @@ static const ERR_STRING_DATA RAND_str_reasons[] = { {ERR_PACK(ERR_LIB_RAND, 0, RAND_R_ARGUMENT_OUT_OF_RANGE), "argument out of range"}, {ERR_PACK(ERR_LIB_RAND, 0, RAND_R_CANNOT_OPEN_FILE), "Cannot open file"}, + {ERR_PACK(ERR_LIB_RAND, 0, RAND_R_DERIVATION_FUNCTION_MANDATORY_FOR_FIPS), + "derivation function mandatory for fips"}, {ERR_PACK(ERR_LIB_RAND, 0, RAND_R_DRBG_ALREADY_INITIALIZED), "drbg already initialized"}, {ERR_PACK(ERR_LIB_RAND, 0, RAND_R_DRBG_NOT_INITIALISED), |