rand_drbg: remove RAND_DRBG.

The RAND_DRBG API did not fit well into the new provider concept as
implemented by EVP_RAND and EVP_RAND_CTX. The main reason is that the
RAND_DRBG API is a mixture of 'front end' and 'back end' API calls
and some of its API calls are rather low-level. This holds in particular
for the callback mechanism (RAND_DRBG_set_callbacks()) and the RAND_DRBG
type changing mechanism (RAND_DRBG_set()).

Adding a compatibility layer to continue supporting the RAND_DRBG API as
a legacy API for a regular deprecation period turned out to come at the
price of complicating the new provider API unnecessarily. Since the
RAND_DRBG API exists only since version 1.1.1, it was decided by the OMC
to drop it entirely.

Other related changes:

Use RNG instead of DRBG in EVP_RAND documentation.  The documentation was
using DRBG in places where it should have been RNG or CSRNG.

Move the RAND_DRBG(7) documentation to EVP_RAND(7).

Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/12509)

1 files changed, 108 insertions, 742 deletions

diff --git a/test/drbgtest.c b/test/drbgtest.c
index 3107ccaaf4..2d72055cc7 100644
--- a/test/drbgtest.c
+++ b/test/drbgtest.c
@@ -40,220 +40,89 @@
 #include "testutil.h"
 #include "drbgtest.h"
 
-typedef struct drbg_selftest_data_st {
-    int post;
-    int nid;
-    unsigned int flags;
-
-    /* KAT data for no PR */
-    const unsigned char *entropy;
-    size_t entropylen;
-    const unsigned char *nonce;
-    size_t noncelen;
-    const unsigned char *pers;
-    size_t perslen;
-    const unsigned char *adin;
-    size_t adinlen;
-    const unsigned char *entropyreseed;
-    size_t entropyreseedlen;
-    const unsigned char *adinreseed;
-    size_t adinreseedlen;
-    const unsigned char *adin2;
-    size_t adin2len;
-    const unsigned char *expected;
-    size_t exlen;
-    const unsigned char *kat2;
-    size_t kat2len;
-
-    /* KAT data for PR */
-    const unsigned char *entropy_pr;
-    size_t entropylen_pr;
-    const unsigned char *nonce_pr;
-    size_t noncelen_pr;
-    const unsigned char *pers_pr;
-    size_t perslen_pr;
-    const unsigned char *adin_pr;
-    size_t adinlen_pr;
-    const unsigned char *entropypr_pr;
-    size_t entropyprlen_pr;
-    const unsigned char *ading_pr;
-    size_t adinglen_pr;
-    const unsigned char *entropyg_pr;
-    size_t entropyglen_pr;
-    const unsigned char *kat_pr;
-    size_t katlen_pr;
-    const unsigned char *kat2_pr;
-    size_t kat2len_pr;
-} DRBG_SELFTEST_DATA;
-
-#define make_drbg_test_data(nid, flag, pr, post) {\
-    post, nid, flag, \
-    pr##_entropyinput, sizeof(pr##_entropyinput), \
-    pr##_nonce, sizeof(pr##_nonce), \
-    pr##_personalizationstring, sizeof(pr##_personalizationstring), \
-    pr##_additionalinput, sizeof(pr##_additionalinput), \
-    pr##_entropyinputreseed, sizeof(pr##_entropyinputreseed), \
-    pr##_additionalinputreseed, sizeof(pr##_additionalinputreseed), \
-    pr##_additionalinput2, sizeof(pr##_additionalinput2), \
-    pr##_int_returnedbits, sizeof(pr##_int_returnedbits), \
-    pr##_returnedbits, sizeof(pr##_returnedbits), \
-    pr##_pr_entropyinput, sizeof(pr##_pr_entropyinput), \
-    pr##_pr_nonce, sizeof(pr##_pr_nonce), \
-    pr##_pr_personalizationstring, sizeof(pr##_pr_personalizationstring), \
-    pr##_pr_additionalinput, sizeof(pr##_pr_additionalinput), \
-    pr##_pr_entropyinputpr, sizeof(pr##_pr_entropyinputpr), \
-    pr##_pr_additionalinput2, sizeof(pr##_pr_additionalinput2), \
-    pr##_pr_entropyinputpr2, sizeof(pr##_pr_entropyinputpr2), \
-    pr##_pr_int_returnedbits, sizeof(pr##_pr_int_returnedbits), \
-    pr##_pr_returnedbits, sizeof(pr##_pr_returnedbits) \
-    }
+/*
+ * DRBG generate wrappers
+ */
+static int gen_bytes(EVP_RAND_CTX *drbg, unsigned char *buf, int num)
+{
+    const RAND_METHOD *meth = RAND_get_rand_method();
 
-#define make_drbg_test_data_use_df(nid, pr, p) \
-    make_drbg_test_data(nid, 0, pr, p)
+    if (meth != NULL && meth != RAND_OpenSSL()) {
+        if (meth->bytes != NULL)
+            return meth->bytes(buf, num);
+        return -1;
+    }
 
-#define make_drbg_test_data_no_df(nid, pr, p)                      \
-    make_drbg_test_data(nid, RAND_DRBG_FLAG_CTR_NO_DF, pr, p)
+    if (drbg != NULL)
+        return EVP_RAND_generate(drbg, buf, num, 0, 0, NULL, 0);
+    return 0;
+}
 
-#define make_drbg_test_data_hash(nid, pr, p) \
-    make_drbg_test_data(nid, RAND_DRBG_FLAG_HMAC, hmac_##pr, p), \
-    make_drbg_test_data(nid, 0, pr, p)
+static int rand_bytes(unsigned char *buf, int num)
+{
+    return gen_bytes(RAND_get0_public(NULL), buf, num);
+}
 
-static DRBG_SELFTEST_DATA drbg_test[] = {
-#ifndef FIPS_MODULE
-    /* FIPS mode doesn't support CTR DRBG without a derivation function */
-    make_drbg_test_data_no_df (NID_aes_128_ctr, aes_128_no_df,  0),
-    make_drbg_test_data_no_df (NID_aes_192_ctr, aes_192_no_df,  0),
-    make_drbg_test_data_no_df (NID_aes_256_ctr, aes_256_no_df,  1),
-#endif
-    make_drbg_test_data_use_df(NID_aes_128_ctr, aes_128_use_df, 0),
-    make_drbg_test_data_use_df(NID_aes_192_ctr, aes_192_use_df, 0),
-    make_drbg_test_data_use_df(NID_aes_256_ctr, aes_256_use_df, 1),
-    make_drbg_test_data_hash(NID_sha1, sha1, 0),
-    make_drbg_test_data_hash(NID_sha224, sha224, 0),
-    make_drbg_test_data_hash(NID_sha256, sha256, 1),
-    make_drbg_test_data_hash(NID_sha384, sha384, 0),
-    make_drbg_test_data_hash(NID_sha512, sha512, 0),
-};
+static int rand_priv_bytes(unsigned char *buf, int num)
+{
+    return gen_bytes(RAND_get0_private(NULL), buf, num);
+}
 
 /*
  * DRBG query functions
  */
-static int state(RAND_DRBG *drbg)
+static int state(EVP_RAND_CTX *drbg)
 {
-    return EVP_RAND_state(drbg->rand);
+    return EVP_RAND_state(drbg);
 }
 
-static size_t query_rand_size_t(RAND_DRBG *drbg, const char *name)
-{
-    OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
-    size_t n;
-
-    *params = OSSL_PARAM_construct_size_t(name, &n);
-    if (EVP_RAND_get_ctx_params(drbg->rand, params))
-        return n;
-    return 0;
-}
-
-static unsigned int query_rand_uint(RAND_DRBG *drbg, const char *name)
+static unsigned int query_rand_uint(EVP_RAND_CTX *drbg, const char *name)
 {
     OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
     unsigned int n;
 
     *params = OSSL_PARAM_construct_uint(name, &n);
-    if (EVP_RAND_get_ctx_params(drbg->rand, params))
+    if (EVP_RAND_get_ctx_params(drbg, params))
         return n;
     return 0;
 }
 
-#define DRBG_SIZE_T(name)                               \
-    static size_t name(RAND_DRBG *drbg)                 \
-    {                                                   \
-        return query_rand_size_t(drbg, #name);          \
-    }
-DRBG_SIZE_T(min_entropylen)
-DRBG_SIZE_T(max_entropylen)
-DRBG_SIZE_T(min_noncelen)
-DRBG_SIZE_T(max_noncelen)
-DRBG_SIZE_T(max_perslen)
-DRBG_SIZE_T(max_adinlen)
-
 #define DRBG_UINT(name)                                 \
-    static unsigned int name(RAND_DRBG *drbg)           \
+    static unsigned int name(EVP_RAND_CTX *drbg)        \
     {                                                   \
         return query_rand_uint(drbg, #name);            \
     }
-DRBG_UINT(reseed_requests)
 DRBG_UINT(reseed_counter)
 
-static PROV_DRBG *prov_rand(RAND_DRBG *drbg)
-{
-    return (PROV_DRBG *)drbg->rand->data;
-}
-
-static void set_generate_counter(RAND_DRBG *drbg, unsigned int n)
+static PROV_DRBG *prov_rand(EVP_RAND_CTX *drbg)
 {
-    PROV_DRBG *p = prov_rand(drbg);
-
-    p->reseed_gen_counter = n;
+    return (PROV_DRBG *)drbg->data;
 }
 
-static void set_reseed_counter(RAND_DRBG *drbg, unsigned int n)
+static void set_reseed_counter(EVP_RAND_CTX *drbg, unsigned int n)
 {
     PROV_DRBG *p = prov_rand(drbg);
 
     p->reseed_counter = n;
 }
 
-static void inc_reseed_counter(RAND_DRBG *drbg)
+static void inc_reseed_counter(EVP_RAND_CTX *drbg)
 {
     set_reseed_counter(drbg, reseed_counter(drbg) + 1);
 }
 
-static time_t reseed_time(RAND_DRBG *drbg)
+static time_t reseed_time(EVP_RAND_CTX *drbg)
 {
     OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
     time_t t;
 
     *params = OSSL_PARAM_construct_time_t(OSSL_DRBG_PARAM_RESEED_TIME, &t);
-    if (EVP_RAND_get_ctx_params(drbg->rand, params))
+    if (EVP_RAND_get_ctx_params(drbg, params))
         return t;
     return 0;
 }
 
 /*
- * Test context data, attached as EXDATA to the RAND_DRBG
- */
-typedef struct test_ctx_st {
-    const unsigned char *entropy;
-    size_t entropylen;
-    int entropycnt;
-    const unsigned char *nonce;
-    size_t noncelen;
-    int noncecnt;
-} TEST_CTX;
-
-static size_t kat_entropy(RAND_DRBG *drbg, unsigned char **pout,
-                          int entropy, size_t min_len, size_t max_len,
-                          int prediction_resistance)
-{
-    TEST_CTX *t = (TEST_CTX *)RAND_DRBG_get_callback_data(drbg);
-
-    t->entropycnt++;
-    *pout = (unsigned char *)t->entropy;
-    return t->entropylen;
-}
-
-static size_t kat_nonce(RAND_DRBG *drbg, unsigned char **pout,
-                        int entropy, size_t min_len, size_t max_len)
-{
-    TEST_CTX *t = (TEST_CTX *)RAND_DRBG_get_callback_data(drbg);
-
-    t->noncecnt++;
-    *pout = (unsigned char *)t->nonce;
-    return t->noncelen;
-}
-
-/*
  * When building the FIPS module, it isn't possible to disable the continuous
  * RNG tests.  Tests that require this are skipped.
  */
@@ -272,360 +141,13 @@ static int crngt_skip(void)
  * Once the RNG infrastructure is able to disable these tests, it should be
  * reconstituted.
  */
-static int disable_crngt(RAND_DRBG *drbg)
-{
-    return 1;
-}
-
-static int uninstantiate(RAND_DRBG *drbg)
-{
-    int ret = drbg == NULL ? 1 : RAND_DRBG_uninstantiate(drbg);
-
-    ERR_clear_error();
-    return ret;
-}
-
-/*
- * Do a single KAT test.  Return 0 on failure.
- */
-static int single_kat(DRBG_SELFTEST_DATA *td)
-{
-    RAND_DRBG *drbg = NULL;
-    TEST_CTX t;
-    int failures = 0;
-    unsigned char buff[1024];
-
-    if (crngt_skip())
-        return TEST_skip("CRNGT cannot be disabled");
-
-    /*
-     * Test without PR: Instantiate DRBG with test entropy, nonce and
-     * personalisation string.
-     */
-    if (!TEST_ptr(drbg = RAND_DRBG_new(td->nid, td->flags, NULL)))
-        return 0;
-    if (!TEST_true(RAND_DRBG_set_callbacks(drbg, kat_entropy, NULL,
-                                           kat_nonce, NULL))
-        || !TEST_true(RAND_DRBG_set_callback_data(drbg, &t))
-        || !TEST_true(disable_crngt(drbg))) {
-        failures++;
-        goto err;
-    }
-    memset(&t, 0, sizeof(t));
-    t.entropy = td->entropy;
-    t.entropylen = td->entropylen;
-    t.nonce = td->nonce;
-    t.noncelen = td->noncelen;
-
-    if (!TEST_true(RAND_DRBG_instantiate(drbg, td->pers, td->perslen))
-            || !TEST_true(RAND_DRBG_generate(drbg, buff, td->exlen, 0,
-                                             td->adin, td->adinlen))
-            || !TEST_mem_eq(td->expected, td->exlen, buff, td->exlen))
-        failures++;
-
-    /* Reseed DRBG with test entropy and additional input */
-    t.entropy = td->entropyreseed;
-    t.entropylen = td->entropyreseedlen;
-    if (!TEST_true(RAND_DRBG_reseed(drbg, td->adinreseed, td->adinreseedlen, 0)
-            || !TEST_true(RAND_DRBG_generate(drbg, buff, td->kat2len, 0,
-                                             td->adin2, td->adin2len))
-            || !TEST_mem_eq(td->kat2, td->kat2len, buff, td->kat2len)))
-        failures++;
-    uninstantiate(drbg);
-
-    /*
-     * Now test with PR: Instantiate DRBG with test entropy, nonce and
-     * personalisation string.
-     */
-    if (!TEST_true(RAND_DRBG_set(drbg, td->nid, td->flags))
-            || !TEST_true(RAND_DRBG_set_callbacks(drbg, kat_entropy, NULL,
-                                                  kat_nonce, NULL))
-            || !TEST_true(RAND_DRBG_set_callback_data(drbg, &t)))
-        failures++;
-    t.entropy = td->entropy_pr;
-    t.entropylen = td->entropylen_pr;
-    t.nonce = td->nonce_pr;
-    t.noncelen = td->noncelen_pr;
-    t.entropycnt = 0;
-    t.noncecnt = 0;
-    if (!TEST_true(RAND_DRBG_instantiate(drbg, td->pers_pr, td->perslen_pr)))
-        failures++;
-
-    /*
-     * Now generate with PR: we need to supply entropy as this will
-     * perform a reseed operation.
-     */
-    t.entropy = td->entropypr_pr;
-    t.entropylen = td->entropyprlen_pr;
-    if (!TEST_true(RAND_DRBG_generate(drbg, buff, td->katlen_pr, 1,
-                                      td->adin_pr, td->adinlen_pr))
-            || !TEST_mem_eq(td->kat_pr, td->katlen_pr, buff, td->katlen_pr))
-        failures++;
-
-    /*
-     * Now generate again with PR: supply new entropy again.
-     */
-    t.entropy = td->entropyg_pr;
-    t.entropylen = td->entropyglen_pr;
-
-    if (!TEST_true(RAND_DRBG_generate(drbg, buff, td->kat2len_pr, 1,
-                                      td->ading_pr, td->adinglen_pr))
-                || !TEST_mem_eq(td->kat2_pr, td->kat2len_pr,
-                                buff, td->kat2len_pr))
-        failures++;
-
-err:
-    uninstantiate(drbg);
-    RAND_DRBG_free(drbg);
-    return failures == 0;
-}
-
-/*
- * Initialise a DRBG based on selftest data
- */
-static int init(RAND_DRBG *drbg, DRBG_SELFTEST_DATA *td, TEST_CTX *t)
-{
-    if (!TEST_true(RAND_DRBG_set(drbg, td->nid, td->flags))
-            || !TEST_true(RAND_DRBG_set_callbacks(drbg, kat_entropy, NULL,
-                                                  kat_nonce, NULL)))
-        return 0;
-    RAND_DRBG_set_callback_data(drbg, t);
-    t->entropy = td->entropy;
-    t->entropylen = td->entropylen;
-    t->nonce = td->nonce;
-    t->noncelen = td->noncelen;
-    t->entropycnt = 0;
-    t->noncecnt = 0;
-    return 1;
-}
-
-/*
- * Initialise and instantiate DRBG based on selftest data
- */
-static int instantiate(RAND_DRBG *drbg, DRBG_SELFTEST_DATA *td,
-                       TEST_CTX *t)
+static int disable_crngt(EVP_RAND_CTX *drbg)
 {
-    if (!TEST_true(init(drbg, td, t))
-            || !TEST_true(RAND_DRBG_instantiate(drbg, td->pers, td->perslen)))
-        return 0;
     return 1;
 }
 
 /*
- * Perform extensive error checking as required by SP800-90.
- * Induce several failure modes and check an error condition is set.
- */
-static int error_check(DRBG_SELFTEST_DATA *td)
-{
-    RAND_DRBG *drbg = NULL;
-    TEST_CTX t;
-    unsigned char buff[1024];
-    unsigned int reseed_counter_tmp;
-    int ret = 0;
-
-    if (!TEST_ptr(drbg = RAND_DRBG_new(td->nid, td->flags, NULL))
-        || !TEST_true(disable_crngt(drbg)))
-        goto err;
-
-    /*
-     * Personalisation string tests
-     */
-
-    /* Test detection of too large personalisation string */
-    if (!init(drbg, td, &t)
-            || !TEST_false(RAND_DRBG_instantiate(drbg, td->pers, max_perslen(drbg) + 1)))
-        goto err;
-
-    /*
-     * Entropy source tests
-     */
-
-    /* Test entropy source failure detection: i.e. returns no data */
-    t.entropylen = 0;
-    if (!TEST_false(RAND_DRBG_instantiate(drbg, td->pers, td->perslen)))
-        goto err;
-
-    /* Try to generate output from uninstantiated DRBG */
-    if (!TEST_false(RAND_DRBG_generate(drbg, buff, td->exlen, 0,
-                                       td->adin, td->adinlen))
-            || !uninstantiate(drbg))
-        goto err;
-
-    /* Test insufficient entropy */
-    if (!init(drbg, td, &t))
-        goto err;
-    t.entropylen = min_entropylen(drbg) - 1;
-    if (!TEST_false(RAND_DRBG_instantiate(drbg, td->pers, td->perslen))
-            || !uninstantiate(drbg))
-        goto err;
-
-    /* Test too much entropy */
-    if (!init(drbg, td, &t))
-        goto err;
-    t.entropylen = max_entropylen(drbg) + 1;
-    if (!TEST_false(RAND_DRBG_instantiate(drbg, td->pers, td->perslen))
-            || !uninstantiate(drbg))
-        goto err;
-
-    /*
-     * Nonce tests
-     */
-
-    /* Test too small nonce */
-    if (min_noncelen(drbg) != 0) {
-        if (!init(drbg, td, &t))
-            goto err;
-        t.noncelen = min_noncelen(drbg) - 1;
-        if (!TEST_false(RAND_DRBG_instantiate(drbg, td->pers, td->perslen))
-                || !uninstantiate(drbg))
-            goto err;
-    }
-
-    /* Test too large nonce */
-    if (max_noncelen(drbg) != 0) {
-        if (!init(drbg, td, &t))
-            goto err;
-        t.noncelen = max_noncelen(drbg) + 1;
-        if (!TEST_false(RAND_DRBG_instantiate(drbg, td->pers, td->perslen))
-                || !uninstantiate(drbg))
-            goto err;
-    }
-
-    /* Instantiate with valid data, Check generation is now OK */
-    if (!instantiate(drbg, td, &t)
-            || !TEST_true(RAND_DRBG_generate(drbg, buff, td->exlen, 0,
-                                             td->adin, td->adinlen)))
-        goto err;
-
-    /* Try too large additional input */
-    if (!TEST_false(RAND_DRBG_generate(drbg, buff, td->exlen, 0,
-                                       td->adin, max_adinlen(drbg) + 1)))
-        goto err;
-
-    /*
-     * Check prediction resistance request fails if entropy source
-     * failure.
-     */
-    t.entropylen = 0;
-    if (!TEST_false(RAND_DRBG_generate(drbg, buff, td->exlen, 1,
-                                      td->adin, td->adinlen))
-            || !uninstantiate(drbg))
-        goto err;
-
-    /* Instantiate again with valid data */
-    if (!instantiate(drbg, td, &t))
-        goto err;
-    reseed_counter_tmp = reseed_counter(drbg);
-    set_generate_counter(drbg, reseed_requests(drbg));
-
-    /* Generate output and check entropy has been requested for reseed */
-    t.entropycnt = 0;
-    if (!TEST_true(RAND_DRBG_generate(drbg, buff, td->exlen, 0,
-                                      td->adin, td->adinlen))
-            || !TEST_int_eq(t.entropycnt, 1)
-            || !TEST_int_eq(reseed_counter(drbg), reseed_counter_tmp + 1)
-            || !uninstantiate(drbg))
-        goto err;
-
-    /*
-     * Check prediction resistance request fails if entropy source
-     * failure.
-     */
-    t.entropylen = 0;
-    if (!TEST_false(RAND_DRBG_generate(drbg, buff, td->exlen, 1,
-                                       td->adin, td->adinlen))
-            || !uninstantiate(drbg))
-        goto err;
-
-    /* Test reseed counter works */
-    if (!instantiate(drbg, td, &t))
-        goto err;
-    reseed_counter_tmp = reseed_counter(drbg);
-    set_generate_counter(drbg, reseed_requests(drbg));
-
-    /* Generate output and check entropy has been requested for reseed */
-    t.entropycnt = 0;
-    if (!TEST_true(RAND_DRBG_generate(drbg, buff, td->exlen, 0,
-                                      td->adin, td->adinlen))
-            || !TEST_int_eq(t.entropycnt, 1)
-            || !TEST_int_eq(reseed_counter(drbg), reseed_counter_tmp + 1)
-            || !uninstantiate(drbg))
-        goto err;
-
-    /*
-     * Explicit reseed tests
-     */
-
-    /* Test explicit reseed with too large additional input */
-    if (!instantiate(drbg, td, &t)
-            || !TEST_false(RAND_DRBG_reseed(drbg, td->adin, max_adinlen(drbg) + 1, 0)))
-        goto err;
-
-    /* Test explicit reseed with entropy source failure */
-    t.entropylen = 0;
-    if (!TEST_false(RAND_DRBG_reseed(drbg, td->adin, td->adinlen, 0))
-            || !uninstantiate(drbg))
-        goto err;
-
-    /* Test explicit reseed with too much entropy */
-    if (!instantiate(drbg, td, &t))
-        goto err;
-    t.entropylen = max_entropylen(drbg) + 1;
-    if (!TEST_false(RAND_DRBG_reseed(drbg, td->adin, td->adinlen, 0))
-            || !uninstantiate(drbg))
-        goto err;
-
-    /* Test explicit reseed with too little entropy */
-    if (!instantiate(drbg, td, &t))
-        goto err;
-    t.entropylen = min_entropylen(drbg) - 1;
-    if (!TEST_false(RAND_DRBG_reseed(drbg, td->adin, td->adinlen, 0))
-            || !uninstantiate(drbg))
-        goto err;
-
-    /* Standard says we have to check uninstantiate really zeroes */
-    if (!TEST_true(EVP_RAND_verify_zeroization(drbg->rand)))
-        goto err;
-
-    ret = 1;
-
-err:
-    uninstantiate(drbg);
-    RAND_DRBG_free(drbg);
-    return ret;
-}
-
-static int test_kats(int i)
-{
-    DRBG_SELFTEST_DATA *td = &drbg_test[i];
-    int rv = 0;
-
-    if (!single_kat(td))
-        goto err;
-    rv = 1;
-
-err:
-    return rv;
-}
-
-static int test_error_checks(int i)
-{
-    DRBG_SELFTEST_DATA *td = &drbg_test[i];
-    int rv = 0;
-
-    if (crngt_skip())
-        return TEST_skip("CRNGT cannot be disabled");
-
-    if (!error_check(td))
-        goto err;
-    rv = 1;
-
-err:
-    return rv;
-}
-
-/*
- * Generates random output using RAND_bytes() and RAND_priv_bytes()
+ * Generates random output using rand_bytes() and rand_priv_bytes()
  * and checks whether the three shared DRBGs were reseeded as
  * expected.
  *
@@ -639,9 +161,9 @@ err:
  *                |before_reseed| time.
  */
 static int test_drbg_reseed(int expect_success,
-                            RAND_DRBG *primary,
-                            RAND_DRBG *public,
-                            RAND_DRBG *private,
+                            EVP_RAND_CTX *primary,
+                            EVP_RAND_CTX *public,
+                            EVP_RAND_CTX *private,
                             int expect_primary_reseed,
                             int expect_public_reseed,
                             int expect_private_reseed,
@@ -672,8 +194,8 @@ static int test_drbg_reseed(int expect_success,
 
     /* Generate random output from the public and private DRBG */
     before_reseed = expect_primary_reseed == 1 ? reseed_when : 0;
-    if (!TEST_int_eq(RAND_bytes(buf, sizeof(buf)), expect_success)
-        || !TEST_int_eq(RAND_priv_bytes(buf, sizeof(buf)), expect_success))
+    if (!TEST_int_eq(rand_bytes(buf, sizeof(buf)), expect_success)
+        || !TEST_int_eq(rand_priv_bytes(buf, sizeof(buf)), expect_success))
         return 0;
     after_reseed = time(NULL);
 
@@ -683,8 +205,8 @@ static int test_drbg_reseed(int expect_success,
      */
 
     /* Test whether reseeding succeeded as expected */
-    if (/*!TEST_int_eq(state(primary), expected_state)
-        || */!TEST_int_eq(state(public), expected_state)
+    if (!TEST_int_eq(state(primary), expected_state)
+        || !TEST_int_eq(state(public), expected_state)
         || !TEST_int_eq(state(private), expected_state))
         return 0;
 
@@ -733,9 +255,9 @@ static int test_drbg_reseed(int expect_success,
  * Test whether primary, public and private DRBG are reseeded after
  * forking the process.
  */
-static int test_drbg_reseed_after_fork(RAND_DRBG *primary,
-                                       RAND_DRBG *public,
-                                       RAND_DRBG *private)
+static int test_drbg_reseed_after_fork(EVP_RAND_CTX *primary,
+                                       EVP_RAND_CTX *public,
+                                       EVP_RAND_CTX *private)
 {
     pid_t pid;
     int status=0;
@@ -763,7 +285,7 @@ static int test_drbg_reseed_after_fork(RAND_DRBG *primary,
  */
 static int test_rand_drbg_reseed(void)
 {
-    RAND_DRBG *primary, *public, *private;
+    EVP_RAND_CTX *primary, *public, *private;
     unsigned char rand_add_buf[256];
     int rv = 0;
     time_t before_reseed;
@@ -776,17 +298,17 @@ static int test_rand_drbg_reseed(void)
         return 0;
 
     /* All three DRBGs should be non-null */
-    if (!TEST_ptr(primary = RAND_DRBG_get0_master())
-        || !TEST_ptr(public = RAND_DRBG_get0_public())
-        || !TEST_ptr(private = RAND_DRBG_get0_private()))
+    if (!TEST_ptr(primary = RAND_get0_primary(NULL))
+        || !TEST_ptr(public = RAND_get0_public(NULL))
+        || !TEST_ptr(private = RAND_get0_private(NULL)))
         return 0;
 
     /* There should be three distinct DRBGs, two of them chained to primary */
     if (!TEST_ptr_ne(public, private)
         || !TEST_ptr_ne(public, primary)
         || !TEST_ptr_ne(private, primary)
-        || !TEST_ptr_eq(public->parent, primary)
-        || !TEST_ptr_eq(private->parent, primary))
+        || !TEST_ptr_eq(prov_rand(public)->parent, prov_rand(primary))
+        || !TEST_ptr_eq(prov_rand(private)->parent, prov_rand(primary)))
         return 0;
 
     /* Disable CRNG testing for the primary DRBG */
@@ -794,9 +316,9 @@ static int test_rand_drbg_reseed(void)
         return 0;
 
     /* uninstantiate the three global DRBGs */
-    RAND_DRBG_uninstantiate(primary);
-    RAND_DRBG_uninstantiate(private);
-    RAND_DRBG_uninstantiate(public);
+    EVP_RAND_uninstantiate(primary);
+    EVP_RAND_uninstantiate(private);
+    EVP_RAND_uninstantiate(public);
 
 
     /*
@@ -884,27 +406,37 @@ error:
 static int multi_thread_rand_bytes_succeeded = 1;
 static int multi_thread_rand_priv_bytes_succeeded = 1;
 
+static int set_reseed_time_interval(EVP_RAND_CTX *drbg, int t)
+{
+    OSSL_PARAM params[2];
+
+    params[0] = OSSL_PARAM_construct_int(OSSL_DRBG_PARAM_RESEED_TIME_INTERVAL,
+                                         &t);
+    params[1] = OSSL_PARAM_construct_end();
+    return EVP_RAND_set_ctx_params(drbg, params);
+}
+
 static void run_multi_thread_test(void)
 {
     unsigned char buf[256];
     time_t start = time(NULL);
-    RAND_DRBG *public = NULL, *private = NULL;
+    EVP_RAND_CTX *public = NULL, *private = NULL;
 
-    if (!TEST_ptr(public = RAND_DRBG_get0_public())
-            || !TEST_ptr(private = RAND_DRBG_get0_private())) {
+    if (!TEST_ptr(public = RAND_get0_public(NULL))
+            || !TEST_ptr(private = RAND_get0_private(NULL))
+            || !TEST_true(set_reseed_time_interval(private, 1))
+            || !TEST_true(set_reseed_time_interval(public, 1))) {
         multi_thread_rand_bytes_succeeded = 0;
         return;
     }
-    RAND_DRBG_set_reseed_time_interval(private, 1);
-    RAND_DRBG_set_reseed_time_interval(public, 1);
 
     do {
-        if (RAND_bytes(buf, sizeof(buf)) <= 0)
+        if (rand_bytes(buf, sizeof(buf)) <= 0)
             multi_thread_rand_bytes_succeeded = 0;
-        if (RAND_priv_bytes(buf, sizeof(buf)) <= 0)
+        if (rand_priv_bytes(buf, sizeof(buf)) <= 0)
             multi_thread_rand_priv_bytes_succeeded = 0;
     }
-    while(time(NULL) - start < 5);
+    while (time(NULL) - start < 5);
 }
 
 # if defined(OPENSSL_SYS_WINDOWS)
@@ -986,9 +518,29 @@ static int test_multi_thread(void)
 }
 #endif
 
+static EVP_RAND_CTX *new_drbg(EVP_RAND_CTX *parent)
+{
+    OSSL_PARAM params[2];
+    EVP_RAND *rand = NULL;
+    EVP_RAND_CTX *drbg = NULL;
+
+    params[0] = OSSL_PARAM_construct_utf8_string(OSSL_DRBG_PARAM_CIPHER,
+                                                 "AES-256-CTR", 0);
+    params[1] = OSSL_PARAM_construct_end();
+
+    if (!TEST_ptr(rand = EVP_RAND_fetch(NULL, "CTR-DRBG", NULL))
+            || !TEST_ptr(drbg = EVP_RAND_CTX_new(rand, parent))
+            || !TEST_true(EVP_RAND_set_ctx_params(drbg, params))) {
+        EVP_RAND_CTX_rand(drbg);
+        EVP_RAND_free(rand);
+        drbg = NULL;
+    }
+    return drbg;
+}
+
 static int test_rand_drbg_prediction_resistance(void)
 {
-    RAND_DRBG *x = NULL, *y = NULL, *z = NULL;
+    EVP_RAND_CTX *x = NULL, *y = NULL, *z = NULL;
     unsigned char buf1[51], buf2[sizeof(buf1)];
     int ret = 0, xreseed, yreseed, zreseed;
 
@@ -996,13 +548,13 @@ static int test_rand_drbg_prediction_resistance(void)
         return TEST_skip("CRNGT cannot be disabled");
 
     /* Initialise a three long DRBG chain */
-    if (!TEST_ptr(x = RAND_DRBG_new(0, 0, NULL))
+    if (!TEST_ptr(x = new_drbg(NULL))
         || !TEST_true(disable_crngt(x))
-        || !TEST_true(RAND_DRBG_instantiate(x, NULL, 0))
-        || !TEST_ptr(y = RAND_DRBG_new(0, 0, x))
-        || !TEST_true(RAND_DRBG_instantiate(y, NULL, 0))
-        || !TEST_ptr(z = RAND_DRBG_new(0, 0, y))
-        || !TEST_true(RAND_DRBG_instantiate(z, NULL, 0)))
+        || !TEST_true(EVP_RAND_instantiate(x, 0, 0, NULL, 0))
+        || !TEST_ptr(y = new_drbg(x))
+        || !TEST_true(EVP_RAND_instantiate(y, 0, 0, NULL, 0))
+        || !TEST_ptr(z = new_drbg(y))
+        || !TEST_true(EVP_RAND_instantiate(z, 0, 0, NULL, 0)))
         goto err;
 
     /*
@@ -1013,7 +565,7 @@ static int test_rand_drbg_prediction_resistance(void)
     xreseed = reseed_counter(x);
     yreseed = reseed_counter(y);
     zreseed = reseed_counter(z);
-    if (!TEST_true(RAND_DRBG_reseed(z, NULL, 0, 0))
+    if (!TEST_true(EVP_RAND_reseed(z, 0, NULL, 0, NULL, 0))
         || !TEST_int_eq(reseed_counter(x), xreseed)
         || !TEST_int_eq(reseed_counter(y), yreseed)
         || !TEST_int_gt(reseed_counter(z), zreseed))
@@ -1024,7 +576,7 @@ static int test_rand_drbg_prediction_resistance(void)
      * propagated to the primary, so that the entire DRBG chain reseeds.
      */
     zreseed = reseed_counter(z);
-    if (!TEST_true(RAND_DRBG_reseed(z, NULL, 0, 1))
+    if (!TEST_true(EVP_RAND_reseed(z, 1, NULL, 0, NULL, 0))
         || !TEST_int_gt(reseed_counter(x), xreseed)
         || !TEST_int_gt(reseed_counter(y), yreseed)
         || !TEST_int_gt(reseed_counter(z), zreseed))
@@ -1036,7 +588,7 @@ static int test_rand_drbg_prediction_resistance(void)
     xreseed = reseed_counter(x);
     yreseed = reseed_counter(y);
     zreseed = reseed_counter(z);
-    if (!TEST_true(RAND_DRBG_generate(z, buf1, sizeof(buf1), 0, NULL, 0))
+    if (!TEST_true(EVP_RAND_generate(z, buf1, sizeof(buf1), 0, 0, NULL, 0))
         || !TEST_int_eq(reseed_counter(x), xreseed)
         || !TEST_int_eq(reseed_counter(y), yreseed)
         || !TEST_int_gt(reseed_counter(z), zreseed))
@@ -1047,7 +599,7 @@ static int test_rand_drbg_prediction_resistance(void)
      * should be propagated to the primary, reseeding the entire DRBG chain.
      */
     zreseed = reseed_counter(z);
-    if (!TEST_true(RAND_DRBG_generate(z, buf2, sizeof(buf2), 1, NULL, 0))
+    if (!TEST_true(EVP_RAND_generate(z, buf2, sizeof(buf2), 0, 1, NULL, 0))
         || !TEST_int_gt(reseed_counter(x), xreseed)
         || !TEST_int_gt(reseed_counter(y), yreseed)
         || !TEST_int_gt(reseed_counter(z), zreseed)
@@ -1059,7 +611,7 @@ static int test_rand_drbg_prediction_resistance(void)
     xreseed = reseed_counter(x);
     yreseed = reseed_counter(y);
     zreseed = reseed_counter(z);
-    if (!TEST_true(RAND_DRBG_reseed(z, NULL, 0, 0))
+    if (!TEST_true(EVP_RAND_reseed(z, 0, NULL, 0, NULL, 0))
         || !TEST_int_eq(reseed_counter(x), xreseed)
         || !TEST_int_eq(reseed_counter(y), yreseed)
         || !TEST_int_gt(reseed_counter(z), zreseed))
@@ -1067,202 +619,16 @@ static int test_rand_drbg_prediction_resistance(void)
 
     ret = 1;
 err:
-    RAND_DRBG_free(z);
-    RAND_DRBG_free(y);
-    RAND_DRBG_free(x);
+    EVP_RAND_CTX_free(z);
+    EVP_RAND_CTX_free(y);
+    EVP_RAND_CTX_free(x);
     return ret;
 }
 
-static int test_multi_set(void)
-{
-    int rv = 0;
-    RAND_DRBG *drbg = NULL;
-
-    if (crngt_skip())
-        return TEST_skip("CRNGT cannot be disabled");
-
-    /* init drbg with default CTR initializer */
-    if (!TEST_ptr(drbg = RAND_DRBG_new(0, 0, NULL))
-        || !TEST_true(disable_crngt(drbg)))
-        goto err;
-    /* change it to use hmac */
-    if (!TEST_true(RAND_DRBG_set(drbg, NID_sha1, RAND_DRBG_FLAG_HMAC)))
-        goto err;
-    /* use same type */
-    if (!TEST_true(RAND_DRBG_set(drbg, NID_sha1, RAND_DRBG_FLAG_HMAC)))
-        goto err;
-    /* change it to use hash */
-    if (!TEST_true(RAND_DRBG_set(drbg, NID_sha256, 0)))
-        goto err;
-    /* use same type */
-    if (!TEST_true(RAND_DRBG_set(drbg, NID_sha256, 0)))
-        goto err;
-    /* change it to use ctr */
-    if (!TEST_true(RAND_DRBG_set(drbg, NID_aes_192_ctr, 0)))
-        goto err;
-    /* use same type */
-    if (!TEST_true(RAND_DRBG_set(drbg, NID_aes_192_ctr, 0)))
-        goto err;
-    if (!TEST_int_gt(RAND_DRBG_instantiate(drbg, NULL, 0), 0))
-        goto err;
-
-    rv = 1;
-err:
-    uninstantiate(drbg);
-    RAND_DRBG_free(drbg);
-    return rv;
-}
-
-static int test_set_defaults(void)
-{
-    RAND_DRBG *primary = NULL, *public = NULL, *private = NULL;
-
-   /* Check the default type and flags for primary, public and private */
-    return TEST_ptr(primary = RAND_DRBG_get0_master())
-           && TEST_ptr(public = RAND_DRBG_get0_public())
-           && TEST_ptr(private = RAND_DRBG_get0_private())
-           && TEST_int_eq(primary->type, RAND_DRBG_TYPE)
-           && TEST_int_eq(primary->flags,
-                          RAND_DRBG_FLAGS | RAND_DRBG_FLAG_PRIMARY)
-           && TEST_int_eq(public->type, RAND_DRBG_TYPE)
-           && TEST_int_eq(public->flags,
-                          RAND_DRBG_FLAGS | RAND_DRBG_FLAG_PUBLIC)
-           && TEST_int_eq(private->type, RAND_DRBG_TYPE)
-           && TEST_int_eq(private->flags,
-                          RAND_DRBG_FLAGS | RAND_DRBG_FLAG_PRIVATE)
-
-           /* change primary DRBG and check again */
-           && TEST_true(RAND_DRBG_set_defaults(NID_sha256,
-                                               RAND_DRBG_FLAG_PRIMARY))
-           && TEST_true(RAND_DRBG_uninstantiate(primary))
-           && TEST_int_eq(primary->type, NID_sha256)
-           && TEST_int_eq(primary->flags, RAND_DRBG_FLAG_PRIMARY)
-           && TEST_int_eq(public->type, RAND_DRBG_TYPE)
-           && TEST_int_eq(public->flags,
-                          RAND_DRBG_FLAGS | RAND_DRBG_FLAG_PUBLIC)
-           && TEST_int_eq(private->type, RAND_DRBG_TYPE)
-           && TEST_int_eq(private->flags,
-                          RAND_DRBG_FLAGS | RAND_DRBG_FLAG_PRIVATE)
-           /* change private DRBG and check again */
-           && TEST_true(RAND_DRBG_set_defaults(NID_sha256,
-                        RAND_DRBG_FLAG_PRIVATE|RAND_DRBG_FLAG_HMAC))
-           && TEST_true(RAND_DRBG_uninstantiate(private))
-           && TEST_int_eq(primary->type, NID_sha256)
-           && TEST_int_eq(primary->flags, RAND_DRBG_FLAG_PRIMARY)
-           && TEST_int_eq(public->type, RAND_DRBG_TYPE)
-           && TEST_int_eq(public->flags,
-                          RAND_DRBG_FLAGS | RAND_DRBG_FLAG_PUBLIC)
-           && TEST_int_eq(private->type, NID_sha256)
-           && TEST_int_eq(private->flags,
-                          RAND_DRBG_FLAG_PRIVATE | RAND_DRBG_FLAG_HMAC)
-           /* change public DRBG and check again */
-           && TEST_true(RAND_DRBG_set_defaults(NID_sha1,
-                                               RAND_DRBG_FLAG_PUBLIC
-                                               | RAND_DRBG_FLAG_HMAC))
-           && TEST_true(RAND_DRBG_uninstantiate(public))
-           && TEST_int_eq(primary->type, NID_sha256)
-           && TEST_int_eq(primary->flags, RAND_DRBG_FLAG_PRIMARY)
-           && TEST_int_eq(public->type, NID_sha1)
-           && TEST_int_eq(public->flags,
-                          RAND_DRBG_FLAG_PUBLIC | RAND_DRBG_FLAG_HMAC)
-           && TEST_int_eq(private->type, NID_sha256)
-           && TEST_int_eq(private->flags,
-                          RAND_DRBG_FLAG_PRIVATE | RAND_DRBG_FLAG_HMAC)
-           /* Change DRBG defaults and change public and check again */
-           && TEST_true(RAND_DRBG_set_defaults(NID_sha256, 0))
-           && TEST_true(RAND_DRBG_uninstantiate(public))
-           && TEST_int_eq(public->type, NID_sha256)
-           && TEST_int_eq(public->flags, RAND_DRBG_FLAG_PUBLIC)
-
-          /* FIPS mode doesn't support CTR DRBG without a derivation function */
-#ifndef FIPS_MODULE
-          /* Change DRBG defaults and change primary and check again */
-           && TEST_true(RAND_DRBG_set_defaults(NID_aes_256_ctr,
-                                               RAND_DRBG_FLAG_CTR_NO_DF))
-           && TEST_true(RAND_DRBG_uninstantiate(primary))
-           && TEST_int_eq(primary->type, NID_aes_256_ctr)
-           && TEST_int_eq(primary->flags,
-                          RAND_DRBG_FLAG_PRIMARY|RAND_DRBG_FLAG_CTR_NO_DF)
-#endif
-           /* Reset back to the standard defaults */
-           && TEST_true(RAND_DRBG_set_defaults(RAND_DRBG_TYPE,
-                                               RAND_DRBG_FLAGS
-                                               | RAND_DRBG_FLAG_PRIMARY
-                                               | RAND_DRBG_FLAG_PUBLIC
-                                               | RAND_DRBG_FLAG_PRIVATE))
-           && TEST_true(RAND_DRBG_uninstantiate(primary))
-           && TEST_true(RAND_DRBG_uninstantiate(public))
-           && TEST_true(RAND_DRBG_uninstantiate(private));
-}
-
-#if 0
-/*
- * A list of the FIPS DRGB types.
- * Because of the way HMAC DRGBs are implemented, both the NID and flags
- * are required.
- */
-static const struct s_drgb_types {
-    int nid;
-    int flags;
-} drgb_types[] = {
-    { NID_aes_128_ctr,  0                   },
-    { NID_aes_192_ctr,  0                   },
-    { NID_aes_256_ctr,  0                   },
-    { NID_sha1,         0                   },
-    { NID_sha224,       0                   },
-    { NID_sha256,       0                   },
-    { NID_sha384,       0                   },
-    { NID_sha512,       0                   },
-    { NID_sha512_224,   0                   },
-    { NID_sha512_256,   0                   },
-    { NID_sha3_224,     0                   },
-    { NID_sha3_256,     0                   },
-    { NID_sha3_384,     0                   },
-    { NID_sha3_512,     0                   },
-    { NID_sha1,         RAND_DRBG_FLAG_HMAC },
-    { NID_sha224,       RAND_DRBG_FLAG_HMAC },
-    { NID_sha256,       RAND_DRBG_FLAG_HMAC },
-    { NID_sha384,       RAND_DRBG_FLAG_HMAC },
-    { NID_sha512,       RAND_DRBG_FLAG_HMAC },
-    { NID_sha512_224,   RAND_DRBG_FLAG_HMAC },
-    { NID_sha512_256,   RAND_DRBG_FLAG_HMAC },
-    { NID_sha3_224,     RAND_DRBG_FLAG_HMAC },
-    { NID_sha3_256,     RAND_DRBG_FLAG_HMAC },
-    { NID_sha3_384,     RAND_DRBG_FLAG_HMAC },
-    { NID_sha3_512,     RAND_DRBG_FLAG_HMAC },
-};
-
-/* Six cases for each covers seed sizes up to 32 bytes */
-static const size_t crngt_num_cases = 6;
-
-static size_t crngt_case, crngt_idx;
-
-static int crngt_entropy_cb(OPENSSL_CTX *ctx, RAND_POOL *pool,
-                            unsigned char *buf, unsigned char *md,
-                            unsigned int *md_size)
-{
-    size_t i, z;
-
-    if (!TEST_int_lt(crngt_idx, crngt_num_cases))
-        return 0;
-    /* Generate a block of unique data unless this is the duplication point */
-    z = crngt_idx++;
-    if (z > 0 && crngt_case == z)
-        z--;
-    for (i = 0; i < CRNGT_BUFSIZ; i++)
-        buf[i] = (unsigned char)(i + 'A' + z);
-    return EVP_Digest(buf, CRNGT_BUFSIZ, md, md_size, EVP_sha256(), NULL);
-}
-#endif
-
 int setup_tests(void)
 {
-    ADD_ALL_TESTS(test_kats, 1);
-    ADD_ALL_TESTS(test_error_checks, OSSL_NELEM(drbg_test));
     ADD_TEST(test_rand_drbg_reseed);
     ADD_TEST(test_rand_drbg_prediction_resistance);
-    ADD_TEST(test_multi_set);
-    ADD_TEST(test_set_defaults);
 #if defined(OPENSSL_THREADS)
     ADD_TEST(test_multi_thread);
 #endif