blob: 12184d670419d3d728ca0acd298823b462ebafed [file] [log] [blame]
Paul Bakker6083fd22011-12-03 21:45:14 +00001/*
2 * Entropy accumulator implementation
3 *
Bence Szépkúti1e148272020-08-07 13:07:28 +02004 * Copyright The Mbed TLS Contributors
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakker6083fd22011-12-03 21:45:14 +000018 */
19
Gilles Peskinedb09ef62020-06-03 01:43:33 +020020#include "common.h"
Paul Bakker6083fd22011-12-03 21:45:14 +000021
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020022#if defined(MBEDTLS_ENTROPY_C)
Paul Bakker6083fd22011-12-03 21:45:14 +000023
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000024#include "mbedtls/entropy.h"
Chris Jonesea0a8652021-03-09 19:11:19 +000025#include "entropy_poll.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050026#include "mbedtls/platform_util.h"
Janos Follath24eed8d2019-11-22 13:21:35 +000027#include "mbedtls/error.h"
Paul Bakker6083fd22011-12-03 21:45:14 +000028
Rich Evans00ab4702015-02-06 13:43:58 +000029#include <string.h>
30
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020031#if defined(MBEDTLS_FS_IO)
Paul Bakker66ff70d2014-03-26 11:54:05 +010032#include <stdio.h>
33#endif
34
Paul Bakker217efbc2016-07-14 14:30:03 +010035#include "mbedtls/platform.h"
Paul Bakker217efbc2016-07-14 14:30:03 +010036
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020037#if defined(MBEDTLS_SELF_TEST)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000038#include "mbedtls/platform.h"
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020039#endif /* MBEDTLS_SELF_TEST */
Rich Evans00ab4702015-02-06 13:43:58 +000040
Paul Bakker28c7e7f2011-12-15 19:49:30 +000041
Paul Bakker6083fd22011-12-03 21:45:14 +000042#define ENTROPY_MAX_LOOP 256 /**< Maximum amount to loop before error */
43
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020044void mbedtls_entropy_init( mbedtls_entropy_context *ctx )
Paul Bakker6083fd22011-12-03 21:45:14 +000045{
Andres Amaya Garciaa7559cb2017-06-29 16:12:31 +010046 ctx->source_count = 0;
47 memset( ctx->source, 0, sizeof( ctx->source ) );
Paul Bakker6083fd22011-12-03 21:45:14 +000048
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020049#if defined(MBEDTLS_THREADING_C)
50 mbedtls_mutex_init( &ctx->mutex );
Paul Bakkerf4e7dc52013-09-28 15:23:57 +020051#endif
52
Andres Amaya Garcia95869c42017-06-29 16:31:44 +010053 ctx->accumulator_started = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020054#if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
Andres Amaya Garciaa7559cb2017-06-29 16:12:31 +010055 mbedtls_sha512_init( &ctx->accumulator );
Paul Bakkerfb08fd22013-08-27 15:06:26 +020056#else
Andres Amaya Garciaa7559cb2017-06-29 16:12:31 +010057 mbedtls_sha256_init( &ctx->accumulator );
Paul Bakkerfb08fd22013-08-27 15:06:26 +020058#endif
Paul Bakker6083fd22011-12-03 21:45:14 +000059
Hanno Beckerd4a872e2017-09-07 08:09:33 +010060 /* Reminder: Update ENTROPY_HAVE_STRONG in the test files
Hanno Becker47deec42017-07-24 12:27:09 +010061 * when adding more strong entropy sources here. */
Hanno Beckerc6deafc2017-07-23 14:06:42 +010062
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020063#if !defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES)
64#if !defined(MBEDTLS_NO_PLATFORM_ENTROPY)
65 mbedtls_entropy_add_source( ctx, mbedtls_platform_entropy_poll, NULL,
Manuel Pégourié-Gonnard7580ba42015-06-19 10:26:32 +020066 MBEDTLS_ENTROPY_MIN_PLATFORM,
67 MBEDTLS_ENTROPY_SOURCE_STRONG );
Paul Bakker6083fd22011-12-03 21:45:14 +000068#endif
Manuel Pégourié-Gonnard3f77dfb2015-06-19 10:06:21 +020069#if defined(MBEDTLS_ENTROPY_HARDWARE_ALT)
Manuel Pégourié-Gonnardfc2ccfe2015-07-10 11:15:50 +010070 mbedtls_entropy_add_source( ctx, mbedtls_hardware_poll, NULL,
Manuel Pégourié-Gonnard7580ba42015-06-19 10:26:32 +020071 MBEDTLS_ENTROPY_MIN_HARDWARE,
72 MBEDTLS_ENTROPY_SOURCE_STRONG );
Manuel Pégourié-Gonnard3f77dfb2015-06-19 10:06:21 +020073#endif
Paul Bakker9988d6b2016-06-01 11:29:42 +010074#if defined(MBEDTLS_ENTROPY_NV_SEED)
75 mbedtls_entropy_add_source( ctx, mbedtls_nv_seed_poll, NULL,
76 MBEDTLS_ENTROPY_BLOCK_SIZE,
77 MBEDTLS_ENTROPY_SOURCE_STRONG );
Andres Amaya Garciaa7559cb2017-06-29 16:12:31 +010078 ctx->initial_entropy_run = 0;
Paul Bakker9988d6b2016-06-01 11:29:42 +010079#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020080#endif /* MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES */
Paul Bakker6083fd22011-12-03 21:45:14 +000081}
82
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020083void mbedtls_entropy_free( mbedtls_entropy_context *ctx )
Paul Bakker1ffefac2013-09-28 15:23:03 +020084{
Gilles Peskineb1583212021-02-22 21:26:54 +010085 /* If the context was already free, don't call free() again.
86 * This is important for mutexes which don't allow double-free. */
87 if( ctx->accumulator_started == -1 )
88 return;
89
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020090#if defined(MBEDTLS_THREADING_C)
91 mbedtls_mutex_free( &ctx->mutex );
Paul Bakkerf4e7dc52013-09-28 15:23:57 +020092#endif
Andres Amaya Garciaa7559cb2017-06-29 16:12:31 +010093#if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
94 mbedtls_sha512_free( &ctx->accumulator );
95#else
96 mbedtls_sha256_free( &ctx->accumulator );
97#endif
98#if defined(MBEDTLS_ENTROPY_NV_SEED)
99 ctx->initial_entropy_run = 0;
100#endif
101 ctx->source_count = 0;
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500102 mbedtls_platform_zeroize( ctx->source, sizeof( ctx->source ) );
Gilles Peskineb1583212021-02-22 21:26:54 +0100103 ctx->accumulator_started = -1;
Paul Bakker1ffefac2013-09-28 15:23:03 +0200104}
105
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200106int mbedtls_entropy_add_source( mbedtls_entropy_context *ctx,
107 mbedtls_entropy_f_source_ptr f_source, void *p_source,
Manuel Pégourié-Gonnard7580ba42015-06-19 10:26:32 +0200108 size_t threshold, int strong )
Paul Bakker6083fd22011-12-03 21:45:14 +0000109{
Hanno Becker61937d42017-04-26 15:01:23 +0100110 int idx, ret = 0;
Paul Bakkerbd4a9d02011-12-10 17:02:19 +0000111
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200112#if defined(MBEDTLS_THREADING_C)
113 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
Paul Bakker47703a02014-02-06 15:01:20 +0100114 return( ret );
115#endif
116
Hanno Becker61937d42017-04-26 15:01:23 +0100117 idx = ctx->source_count;
118 if( idx >= MBEDTLS_ENTROPY_MAX_SOURCES )
Paul Bakker47703a02014-02-06 15:01:20 +0100119 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200120 ret = MBEDTLS_ERR_ENTROPY_MAX_SOURCES;
Paul Bakker47703a02014-02-06 15:01:20 +0100121 goto exit;
122 }
Paul Bakker6083fd22011-12-03 21:45:14 +0000123
Hanno Becker61937d42017-04-26 15:01:23 +0100124 ctx->source[idx].f_source = f_source;
125 ctx->source[idx].p_source = p_source;
126 ctx->source[idx].threshold = threshold;
127 ctx->source[idx].strong = strong;
Paul Bakker6083fd22011-12-03 21:45:14 +0000128
129 ctx->source_count++;
130
Paul Bakker47703a02014-02-06 15:01:20 +0100131exit:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200132#if defined(MBEDTLS_THREADING_C)
133 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
134 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
Paul Bakker47703a02014-02-06 15:01:20 +0100135#endif
136
137 return( ret );
Paul Bakker6083fd22011-12-03 21:45:14 +0000138}
139
140/*
141 * Entropy accumulator update
142 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200143static int entropy_update( mbedtls_entropy_context *ctx, unsigned char source_id,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200144 const unsigned char *data, size_t len )
Paul Bakker6083fd22011-12-03 21:45:14 +0000145{
146 unsigned char header[2];
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200147 unsigned char tmp[MBEDTLS_ENTROPY_BLOCK_SIZE];
Paul Bakker6083fd22011-12-03 21:45:14 +0000148 size_t use_len = len;
149 const unsigned char *p = data;
Jaeden Amero66954e12018-01-25 16:05:54 +0000150 int ret = 0;
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200151
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200152 if( use_len > MBEDTLS_ENTROPY_BLOCK_SIZE )
Paul Bakker6083fd22011-12-03 21:45:14 +0000153 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200154#if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
TRodziewicz26371e42021-06-08 16:45:41 +0200155 if( ( ret = mbedtls_sha512( data, len, tmp, 0 ) ) != 0 )
Jaeden Amero66954e12018-01-25 16:05:54 +0000156 goto cleanup;
Paul Bakkerfb08fd22013-08-27 15:06:26 +0200157#else
TRodziewicz26371e42021-06-08 16:45:41 +0200158 if( ( ret = mbedtls_sha256( data, len, tmp, 0 ) ) != 0 )
Jaeden Amero66954e12018-01-25 16:05:54 +0000159 goto cleanup;
Paul Bakkerfb08fd22013-08-27 15:06:26 +0200160#endif
Paul Bakker6083fd22011-12-03 21:45:14 +0000161 p = tmp;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200162 use_len = MBEDTLS_ENTROPY_BLOCK_SIZE;
Paul Bakker6083fd22011-12-03 21:45:14 +0000163 }
164
165 header[0] = source_id;
166 header[1] = use_len & 0xFF;
167
Andres Amaya Garcia95869c42017-06-29 16:31:44 +0100168 /*
169 * Start the accumulator if this has not already happened. Note that
170 * it is sufficient to start the accumulator here only because all calls to
171 * gather entropy eventually execute this code.
172 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200173#if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
Andres Amaya Garcia95869c42017-06-29 16:31:44 +0100174 if( ctx->accumulator_started == 0 &&
TRodziewicz26371e42021-06-08 16:45:41 +0200175 ( ret = mbedtls_sha512_starts( &ctx->accumulator, 0 ) ) != 0 )
Jaeden Amero66954e12018-01-25 16:05:54 +0000176 goto cleanup;
Andres Amaya Garcia95869c42017-06-29 16:31:44 +0100177 else
178 ctx->accumulator_started = 1;
TRodziewicz26371e42021-06-08 16:45:41 +0200179 if( ( ret = mbedtls_sha512_update( &ctx->accumulator, header, 2 ) ) != 0 )
Jaeden Amero66954e12018-01-25 16:05:54 +0000180 goto cleanup;
TRodziewicz26371e42021-06-08 16:45:41 +0200181 ret = mbedtls_sha512_update( &ctx->accumulator, p, use_len );
Paul Bakkerfb08fd22013-08-27 15:06:26 +0200182#else
Andres Amaya Garcia95869c42017-06-29 16:31:44 +0100183 if( ctx->accumulator_started == 0 &&
TRodziewicz26371e42021-06-08 16:45:41 +0200184 ( ret = mbedtls_sha256_starts( &ctx->accumulator, 0 ) ) != 0 )
Jaeden Amero66954e12018-01-25 16:05:54 +0000185 goto cleanup;
Andres Amaya Garcia95869c42017-06-29 16:31:44 +0100186 else
187 ctx->accumulator_started = 1;
TRodziewicz26371e42021-06-08 16:45:41 +0200188 if( ( ret = mbedtls_sha256_update( &ctx->accumulator, header, 2 ) ) != 0 )
Jaeden Amero66954e12018-01-25 16:05:54 +0000189 goto cleanup;
TRodziewicz26371e42021-06-08 16:45:41 +0200190 ret = mbedtls_sha256_update( &ctx->accumulator, p, use_len );
Paul Bakkerfb08fd22013-08-27 15:06:26 +0200191#endif
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200192
Jaeden Amero66954e12018-01-25 16:05:54 +0000193cleanup:
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500194 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
Andres Amaya Garcia65121932017-07-05 15:45:47 +0100195
Jaeden Amero66954e12018-01-25 16:05:54 +0000196 return( ret );
Paul Bakker6083fd22011-12-03 21:45:14 +0000197}
198
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200199int mbedtls_entropy_update_manual( mbedtls_entropy_context *ctx,
Paul Bakker6083fd22011-12-03 21:45:14 +0000200 const unsigned char *data, size_t len )
201{
Janos Follath24eed8d2019-11-22 13:21:35 +0000202 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker47703a02014-02-06 15:01:20 +0100203
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200204#if defined(MBEDTLS_THREADING_C)
205 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
Paul Bakker47703a02014-02-06 15:01:20 +0100206 return( ret );
207#endif
208
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200209 ret = entropy_update( ctx, MBEDTLS_ENTROPY_SOURCE_MANUAL, data, len );
Paul Bakker47703a02014-02-06 15:01:20 +0100210
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200211#if defined(MBEDTLS_THREADING_C)
212 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
213 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
Paul Bakker47703a02014-02-06 15:01:20 +0100214#endif
215
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200216 return( ret );
Paul Bakker6083fd22011-12-03 21:45:14 +0000217}
218
219/*
220 * Run through the different sources to add entropy to our accumulator
221 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200222static int entropy_gather_internal( mbedtls_entropy_context *ctx )
Paul Bakker6083fd22011-12-03 21:45:14 +0000223{
Gilles Peskine006c1b52019-09-30 17:29:54 +0200224 int ret = MBEDTLS_ERR_ENTROPY_SOURCE_FAILED;
225 int i;
226 int have_one_strong = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200227 unsigned char buf[MBEDTLS_ENTROPY_MAX_GATHER];
Paul Bakker6083fd22011-12-03 21:45:14 +0000228 size_t olen;
Paul Bakker47703a02014-02-06 15:01:20 +0100229
Paul Bakker43655f42011-12-15 20:11:16 +0000230 if( ctx->source_count == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200231 return( MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED );
Paul Bakker43655f42011-12-15 20:11:16 +0000232
Paul Bakker6083fd22011-12-03 21:45:14 +0000233 /*
234 * Run through our entropy sources
235 */
236 for( i = 0; i < ctx->source_count; i++ )
237 {
Manuel Pégourié-Gonnard7580ba42015-06-19 10:26:32 +0200238 if( ctx->source[i].strong == MBEDTLS_ENTROPY_SOURCE_STRONG )
239 have_one_strong = 1;
240
Paul Bakker6083fd22011-12-03 21:45:14 +0000241 olen = 0;
Paul Bakker66d5d072014-06-17 16:39:18 +0200242 if( ( ret = ctx->source[i].f_source( ctx->source[i].p_source,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200243 buf, MBEDTLS_ENTROPY_MAX_GATHER, &olen ) ) != 0 )
Paul Bakker6083fd22011-12-03 21:45:14 +0000244 {
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100245 goto cleanup;
Paul Bakker6083fd22011-12-03 21:45:14 +0000246 }
247
248 /*
249 * Add if we actually gathered something
250 */
251 if( olen > 0 )
Paul Bakkerbd4a9d02011-12-10 17:02:19 +0000252 {
Andres Amaya Garcia95869c42017-06-29 16:31:44 +0100253 if( ( ret = entropy_update( ctx, (unsigned char) i,
254 buf, olen ) ) != 0 )
255 return( ret );
Paul Bakkerbd4a9d02011-12-10 17:02:19 +0000256 ctx->source[i].size += olen;
257 }
Paul Bakker6083fd22011-12-03 21:45:14 +0000258 }
259
Manuel Pégourié-Gonnard7580ba42015-06-19 10:26:32 +0200260 if( have_one_strong == 0 )
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100261 ret = MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE;
Manuel Pégourié-Gonnard7580ba42015-06-19 10:26:32 +0200262
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100263cleanup:
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500264 mbedtls_platform_zeroize( buf, sizeof( buf ) );
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100265
266 return( ret );
Paul Bakker6083fd22011-12-03 21:45:14 +0000267}
268
Paul Bakker47703a02014-02-06 15:01:20 +0100269/*
270 * Thread-safe wrapper for entropy_gather_internal()
271 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200272int mbedtls_entropy_gather( mbedtls_entropy_context *ctx )
Paul Bakker47703a02014-02-06 15:01:20 +0100273{
Janos Follath24eed8d2019-11-22 13:21:35 +0000274 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker47703a02014-02-06 15:01:20 +0100275
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200276#if defined(MBEDTLS_THREADING_C)
277 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
Paul Bakkerddd427a2014-04-09 14:47:58 +0200278 return( ret );
Paul Bakker47703a02014-02-06 15:01:20 +0100279#endif
280
Paul Bakkerddd427a2014-04-09 14:47:58 +0200281 ret = entropy_gather_internal( ctx );
Paul Bakker47703a02014-02-06 15:01:20 +0100282
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200283#if defined(MBEDTLS_THREADING_C)
284 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
285 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
Paul Bakker47703a02014-02-06 15:01:20 +0100286#endif
287
Paul Bakkerddd427a2014-04-09 14:47:58 +0200288 return( ret );
Paul Bakker47703a02014-02-06 15:01:20 +0100289}
290
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200291int mbedtls_entropy_func( void *data, unsigned char *output, size_t len )
Paul Bakker6083fd22011-12-03 21:45:14 +0000292{
Gilles Peskine85485c72019-10-08 15:04:16 +0200293 int ret, count = 0, i, thresholds_reached;
294 size_t strong_size;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200295 mbedtls_entropy_context *ctx = (mbedtls_entropy_context *) data;
296 unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE];
Paul Bakker6083fd22011-12-03 21:45:14 +0000297
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200298 if( len > MBEDTLS_ENTROPY_BLOCK_SIZE )
299 return( MBEDTLS_ERR_ENTROPY_SOURCE_FAILED );
Paul Bakker6083fd22011-12-03 21:45:14 +0000300
Paul Bakkerd5c9f6d2016-06-01 11:30:54 +0100301#if defined(MBEDTLS_ENTROPY_NV_SEED)
302 /* Update the NV entropy seed before generating any entropy for outside
303 * use.
304 */
Paul Bakkerfc9c7c82016-06-01 15:25:50 +0100305 if( ctx->initial_entropy_run == 0 )
Paul Bakkerd5c9f6d2016-06-01 11:30:54 +0100306 {
Paul Bakkerfc9c7c82016-06-01 15:25:50 +0100307 ctx->initial_entropy_run = 1;
Paul Bakkerd5c9f6d2016-06-01 11:30:54 +0100308 if( ( ret = mbedtls_entropy_update_nv_seed( ctx ) ) != 0 )
309 return( ret );
310 }
311#endif
312
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200313#if defined(MBEDTLS_THREADING_C)
314 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
Paul Bakkerf4e7dc52013-09-28 15:23:57 +0200315 return( ret );
316#endif
317
Paul Bakker6083fd22011-12-03 21:45:14 +0000318 /*
319 * Always gather extra entropy before a call
320 */
321 do
322 {
323 if( count++ > ENTROPY_MAX_LOOP )
Paul Bakkerf4e7dc52013-09-28 15:23:57 +0200324 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200325 ret = MBEDTLS_ERR_ENTROPY_SOURCE_FAILED;
Paul Bakkerf4e7dc52013-09-28 15:23:57 +0200326 goto exit;
327 }
Paul Bakker6083fd22011-12-03 21:45:14 +0000328
Paul Bakker47703a02014-02-06 15:01:20 +0100329 if( ( ret = entropy_gather_internal( ctx ) ) != 0 )
Paul Bakkerf4e7dc52013-09-28 15:23:57 +0200330 goto exit;
Paul Bakkerbd4a9d02011-12-10 17:02:19 +0000331
Gilles Peskine85485c72019-10-08 15:04:16 +0200332 thresholds_reached = 1;
333 strong_size = 0;
Paul Bakkerbd4a9d02011-12-10 17:02:19 +0000334 for( i = 0; i < ctx->source_count; i++ )
Gilles Peskine85485c72019-10-08 15:04:16 +0200335 {
Manuel Pégourié-Gonnardbf82ff02015-06-19 09:40:51 +0200336 if( ctx->source[i].size < ctx->source[i].threshold )
Gilles Peskine85485c72019-10-08 15:04:16 +0200337 thresholds_reached = 0;
338 if( ctx->source[i].strong == MBEDTLS_ENTROPY_SOURCE_STRONG )
339 strong_size += ctx->source[i].size;
340 }
Paul Bakker6083fd22011-12-03 21:45:14 +0000341 }
Gilles Peskine85485c72019-10-08 15:04:16 +0200342 while( ! thresholds_reached || strong_size < MBEDTLS_ENTROPY_BLOCK_SIZE );
Paul Bakker6083fd22011-12-03 21:45:14 +0000343
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200344 memset( buf, 0, MBEDTLS_ENTROPY_BLOCK_SIZE );
Paul Bakker6083fd22011-12-03 21:45:14 +0000345
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200346#if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
Andres Amaya Garciab2b063f2017-07-20 16:45:24 +0100347 /*
348 * Note that at this stage it is assumed that the accumulator was started
349 * in a previous call to entropy_update(). If this is not guaranteed, the
350 * code below will fail.
351 */
TRodziewicz26371e42021-06-08 16:45:41 +0200352 if( ( ret = mbedtls_sha512_finish( &ctx->accumulator, buf ) ) != 0 )
Andres Amaya Garcia207cea52017-06-29 13:28:13 +0100353 goto exit;
Paul Bakker9e36f042013-06-30 14:34:05 +0200354
Paul Bakker6083fd22011-12-03 21:45:14 +0000355 /*
Paul Bakkerbd4a9d02011-12-10 17:02:19 +0000356 * Reset accumulator and counters and recycle existing entropy
Paul Bakker6083fd22011-12-03 21:45:14 +0000357 */
Andres Amaya Garciaa7559cb2017-06-29 16:12:31 +0100358 mbedtls_sha512_free( &ctx->accumulator );
359 mbedtls_sha512_init( &ctx->accumulator );
TRodziewicz26371e42021-06-08 16:45:41 +0200360 if( ( ret = mbedtls_sha512_starts( &ctx->accumulator, 0 ) ) != 0 )
Andres Amaya Garcia207cea52017-06-29 13:28:13 +0100361 goto exit;
TRodziewicz26371e42021-06-08 16:45:41 +0200362 if( ( ret = mbedtls_sha512_update( &ctx->accumulator, buf,
Andres Amaya Garcia207cea52017-06-29 13:28:13 +0100363 MBEDTLS_ENTROPY_BLOCK_SIZE ) ) != 0 )
364 goto exit;
Paul Bakkerfb08fd22013-08-27 15:06:26 +0200365
366 /*
Paul Bakkerb13d3ff2014-03-26 12:51:25 +0100367 * Perform second SHA-512 on entropy
Paul Bakkerfb08fd22013-08-27 15:06:26 +0200368 */
TRodziewicz26371e42021-06-08 16:45:41 +0200369 if( ( ret = mbedtls_sha512( buf, MBEDTLS_ENTROPY_BLOCK_SIZE,
Andres Amaya Garcia207cea52017-06-29 13:28:13 +0100370 buf, 0 ) ) != 0 )
371 goto exit;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200372#else /* MBEDTLS_ENTROPY_SHA512_ACCUMULATOR */
TRodziewicz26371e42021-06-08 16:45:41 +0200373 if( ( ret = mbedtls_sha256_finish( &ctx->accumulator, buf ) ) != 0 )
Andres Amaya Garcia207cea52017-06-29 13:28:13 +0100374 goto exit;
Paul Bakkerfb08fd22013-08-27 15:06:26 +0200375
376 /*
377 * Reset accumulator and counters and recycle existing entropy
378 */
Andres Amaya Garciaa7559cb2017-06-29 16:12:31 +0100379 mbedtls_sha256_free( &ctx->accumulator );
380 mbedtls_sha256_init( &ctx->accumulator );
TRodziewicz26371e42021-06-08 16:45:41 +0200381 if( ( ret = mbedtls_sha256_starts( &ctx->accumulator, 0 ) ) != 0 )
Andres Amaya Garcia207cea52017-06-29 13:28:13 +0100382 goto exit;
TRodziewicz26371e42021-06-08 16:45:41 +0200383 if( ( ret = mbedtls_sha256_update( &ctx->accumulator, buf,
Andres Amaya Garcia207cea52017-06-29 13:28:13 +0100384 MBEDTLS_ENTROPY_BLOCK_SIZE ) ) != 0 )
385 goto exit;
Paul Bakkerb13d3ff2014-03-26 12:51:25 +0100386
387 /*
388 * Perform second SHA-256 on entropy
389 */
TRodziewicz26371e42021-06-08 16:45:41 +0200390 if( ( ret = mbedtls_sha256( buf, MBEDTLS_ENTROPY_BLOCK_SIZE,
Andres Amaya Garcia207cea52017-06-29 13:28:13 +0100391 buf, 0 ) ) != 0 )
392 goto exit;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200393#endif /* MBEDTLS_ENTROPY_SHA512_ACCUMULATOR */
Paul Bakkerbd4a9d02011-12-10 17:02:19 +0000394
395 for( i = 0; i < ctx->source_count; i++ )
396 ctx->source[i].size = 0;
Paul Bakker6083fd22011-12-03 21:45:14 +0000397
398 memcpy( output, buf, len );
399
Paul Bakkerf4e7dc52013-09-28 15:23:57 +0200400 ret = 0;
401
402exit:
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500403 mbedtls_platform_zeroize( buf, sizeof( buf ) );
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100404
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200405#if defined(MBEDTLS_THREADING_C)
406 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
407 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
Paul Bakkerf4e7dc52013-09-28 15:23:57 +0200408#endif
409
410 return( ret );
Paul Bakker6083fd22011-12-03 21:45:14 +0000411}
412
Paul Bakkerd5c9f6d2016-06-01 11:30:54 +0100413#if defined(MBEDTLS_ENTROPY_NV_SEED)
414int mbedtls_entropy_update_nv_seed( mbedtls_entropy_context *ctx )
415{
416 int ret = MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
Andres Amaya Garciaaf0b31d2017-07-05 14:23:54 +0100417 unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE];
Paul Bakkerd5c9f6d2016-06-01 11:30:54 +0100418
419 /* Read new seed and write it to NV */
420 if( ( ret = mbedtls_entropy_func( ctx, buf, MBEDTLS_ENTROPY_BLOCK_SIZE ) ) != 0 )
421 return( ret );
422
423 if( mbedtls_nv_seed_write( buf, MBEDTLS_ENTROPY_BLOCK_SIZE ) < 0 )
424 return( MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR );
425
426 /* Manually update the remaining stream with a separator value to diverge */
427 memset( buf, 0, MBEDTLS_ENTROPY_BLOCK_SIZE );
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100428 ret = mbedtls_entropy_update_manual( ctx, buf, MBEDTLS_ENTROPY_BLOCK_SIZE );
Paul Bakkerd5c9f6d2016-06-01 11:30:54 +0100429
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100430 return( ret );
Paul Bakkerd5c9f6d2016-06-01 11:30:54 +0100431}
432#endif /* MBEDTLS_ENTROPY_NV_SEED */
433
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200434#if defined(MBEDTLS_FS_IO)
435int mbedtls_entropy_write_seed_file( mbedtls_entropy_context *ctx, const char *path )
Paul Bakker66ff70d2014-03-26 11:54:05 +0100436{
Victor Krasnoshchoka0c2d192020-09-03 00:07:05 +0300437 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Victor Krasnoshchoke79812e2020-08-27 00:19:55 +0300438 FILE *f = NULL;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200439 unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE];
Paul Bakker66ff70d2014-03-26 11:54:05 +0100440
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200441 if( ( ret = mbedtls_entropy_func( ctx, buf, MBEDTLS_ENTROPY_BLOCK_SIZE ) ) != 0 )
Paul Bakker66ff70d2014-03-26 11:54:05 +0100442 {
Victor Krasnoshchokb3129ba2020-08-29 22:54:37 +0300443 ret = MBEDTLS_ERR_ENTROPY_SOURCE_FAILED;
Paul Bakker66ff70d2014-03-26 11:54:05 +0100444 goto exit;
Victor Krasnoshchokb3129ba2020-08-29 22:54:37 +0300445 }
446
447 if( ( f = fopen( path, "wb" ) ) == NULL )
448 {
449 ret = MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
450 goto exit;
451 }
Paul Bakker66ff70d2014-03-26 11:54:05 +0100452
Gilles Peskineda0913b2022-06-30 17:03:40 +0200453 /* Ensure no stdio buffering of secrets, as such buffers cannot be wiped. */
454 mbedtls_setbuf( f, NULL );
455
Paul Bakker66ff70d2014-03-26 11:54:05 +0100456 if( fwrite( buf, 1, MBEDTLS_ENTROPY_BLOCK_SIZE, f ) != MBEDTLS_ENTROPY_BLOCK_SIZE )
457 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200458 ret = MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
Paul Bakker66ff70d2014-03-26 11:54:05 +0100459 goto exit;
460 }
461
462 ret = 0;
463
464exit:
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500465 mbedtls_platform_zeroize( buf, sizeof( buf ) );
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100466
Victor Krasnoshchokb3129ba2020-08-29 22:54:37 +0300467 if( f != NULL )
Victor Krasnoshchoke79812e2020-08-27 00:19:55 +0300468 fclose( f );
469
Paul Bakker66ff70d2014-03-26 11:54:05 +0100470 return( ret );
471}
472
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200473int mbedtls_entropy_update_seed_file( mbedtls_entropy_context *ctx, const char *path )
Paul Bakker66ff70d2014-03-26 11:54:05 +0100474{
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100475 int ret = 0;
Paul Bakker66ff70d2014-03-26 11:54:05 +0100476 FILE *f;
477 size_t n;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200478 unsigned char buf[ MBEDTLS_ENTROPY_MAX_SEED_SIZE ];
Paul Bakker66ff70d2014-03-26 11:54:05 +0100479
480 if( ( f = fopen( path, "rb" ) ) == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200481 return( MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR );
Paul Bakker66ff70d2014-03-26 11:54:05 +0100482
Gilles Peskineda0913b2022-06-30 17:03:40 +0200483 /* Ensure no stdio buffering of secrets, as such buffers cannot be wiped. */
484 mbedtls_setbuf( f, NULL );
485
Paul Bakker66ff70d2014-03-26 11:54:05 +0100486 fseek( f, 0, SEEK_END );
487 n = (size_t) ftell( f );
488 fseek( f, 0, SEEK_SET );
489
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200490 if( n > MBEDTLS_ENTROPY_MAX_SEED_SIZE )
491 n = MBEDTLS_ENTROPY_MAX_SEED_SIZE;
Paul Bakker66ff70d2014-03-26 11:54:05 +0100492
493 if( fread( buf, 1, n, f ) != n )
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100494 ret = MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
495 else
496 ret = mbedtls_entropy_update_manual( ctx, buf, n );
Paul Bakker66ff70d2014-03-26 11:54:05 +0100497
498 fclose( f );
499
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500500 mbedtls_platform_zeroize( buf, sizeof( buf ) );
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100501
502 if( ret != 0 )
503 return( ret );
Paul Bakker66ff70d2014-03-26 11:54:05 +0100504
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200505 return( mbedtls_entropy_write_seed_file( ctx, path ) );
Paul Bakker66ff70d2014-03-26 11:54:05 +0100506}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200507#endif /* MBEDTLS_FS_IO */
Paul Bakker66ff70d2014-03-26 11:54:05 +0100508
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200509#if defined(MBEDTLS_SELF_TEST)
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200510/*
511 * Dummy source function
512 */
513static int entropy_dummy_source( void *data, unsigned char *output,
514 size_t len, size_t *olen )
515{
516 ((void) data);
517
518 memset( output, 0x2a, len );
519 *olen = len;
520
521 return( 0 );
522}
523
Andres AGe7723ec2016-08-25 10:18:50 +0100524#if defined(MBEDTLS_ENTROPY_HARDWARE_ALT)
Andres AGb34e42e2016-08-22 11:08:50 +0100525
Andres AGe7723ec2016-08-25 10:18:50 +0100526static int mbedtls_entropy_source_self_test_gather( unsigned char *buf, size_t buf_len )
527{
528 int ret = 0;
529 size_t entropy_len = 0;
530 size_t olen = 0;
531 size_t attempts = buf_len;
532
533 while( attempts > 0 && entropy_len < buf_len )
534 {
535 if( ( ret = mbedtls_hardware_poll( NULL, buf + entropy_len,
536 buf_len - entropy_len, &olen ) ) != 0 )
537 return( ret );
538
539 entropy_len += olen;
540 attempts--;
541 }
542
543 if( entropy_len < buf_len )
544 {
545 ret = 1;
546 }
547
548 return( ret );
549}
550
551
552static int mbedtls_entropy_source_self_test_check_bits( const unsigned char *buf,
553 size_t buf_len )
554{
555 unsigned char set= 0xFF;
556 unsigned char unset = 0x00;
557 size_t i;
558
559 for( i = 0; i < buf_len; i++ )
560 {
561 set &= buf[i];
562 unset |= buf[i];
563 }
564
565 return( set == 0xFF || unset == 0x00 );
566}
Andres AGb34e42e2016-08-22 11:08:50 +0100567
568/*
Andres AGe7723ec2016-08-25 10:18:50 +0100569 * A test to ensure hat the entropy sources are functioning correctly
570 * and there is no obvious failure. The test performs the following checks:
Andres AGb34e42e2016-08-22 11:08:50 +0100571 * - The entropy source is not providing only 0s (all bits unset) or 1s (all
572 * bits set).
573 * - The entropy source is not providing values in a pattern. Because the
Andres AGe7723ec2016-08-25 10:18:50 +0100574 * hardware could be providing data in an arbitrary length, this check polls
575 * the hardware entropy source twice and compares the result to ensure they
576 * are not equal.
Andres AGb34e42e2016-08-22 11:08:50 +0100577 * - The error code returned by the entropy source is not an error.
578 */
Andres AGe7723ec2016-08-25 10:18:50 +0100579int mbedtls_entropy_source_self_test( int verbose )
Andres AGb34e42e2016-08-22 11:08:50 +0100580{
581 int ret = 0;
Andres AGe7723ec2016-08-25 10:18:50 +0100582 unsigned char buf0[2 * sizeof( unsigned long long int )];
583 unsigned char buf1[2 * sizeof( unsigned long long int )];
Andres AGb34e42e2016-08-22 11:08:50 +0100584
585 if( verbose != 0 )
586 mbedtls_printf( " ENTROPY_BIAS test: " );
587
Andres AGe7723ec2016-08-25 10:18:50 +0100588 memset( buf0, 0x00, sizeof( buf0 ) );
589 memset( buf1, 0x00, sizeof( buf1 ) );
Andres AGb34e42e2016-08-22 11:08:50 +0100590
Andres AGe7723ec2016-08-25 10:18:50 +0100591 if( ( ret = mbedtls_entropy_source_self_test_gather( buf0, sizeof( buf0 ) ) ) != 0 )
Andres AGb34e42e2016-08-22 11:08:50 +0100592 goto cleanup;
Andres AGe7723ec2016-08-25 10:18:50 +0100593 if( ( ret = mbedtls_entropy_source_self_test_gather( buf1, sizeof( buf1 ) ) ) != 0 )
594 goto cleanup;
595
596 /* Make sure that the returned values are not all 0 or 1 */
597 if( ( ret = mbedtls_entropy_source_self_test_check_bits( buf0, sizeof( buf0 ) ) ) != 0 )
598 goto cleanup;
599 if( ( ret = mbedtls_entropy_source_self_test_check_bits( buf1, sizeof( buf1 ) ) ) != 0 )
600 goto cleanup;
Andres AGb34e42e2016-08-22 11:08:50 +0100601
602 /* Make sure that the entropy source is not returning values in a
603 * pattern */
Andres AGe7723ec2016-08-25 10:18:50 +0100604 ret = memcmp( buf0, buf1, sizeof( buf0 ) ) == 0;
Andres AGb34e42e2016-08-22 11:08:50 +0100605
606cleanup:
Andres AGb34e42e2016-08-22 11:08:50 +0100607 if( verbose != 0 )
608 {
609 if( ret != 0 )
610 mbedtls_printf( "failed\n" );
611 else
612 mbedtls_printf( "passed\n" );
613
614 mbedtls_printf( "\n" );
615 }
616
617 return( ret != 0 );
618}
Andres AGe7723ec2016-08-25 10:18:50 +0100619
620#endif /* MBEDTLS_ENTROPY_HARDWARE_ALT */
Andres AGb34e42e2016-08-22 11:08:50 +0100621
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200622/*
623 * The actual entropy quality is hard to test, but we can at least
624 * test that the functions don't cause errors and write the correct
625 * amount of data to buffers.
626 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200627int mbedtls_entropy_self_test( int verbose )
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200628{
Andres Amaya Garciaa928e672016-09-13 13:30:02 +0100629 int ret = 1;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200630 mbedtls_entropy_context ctx;
631 unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE] = { 0 };
632 unsigned char acc[MBEDTLS_ENTROPY_BLOCK_SIZE] = { 0 };
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200633 size_t i, j;
634
635 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200636 mbedtls_printf( " ENTROPY test: " );
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200637
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200638 mbedtls_entropy_init( &ctx );
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200639
Manuel Pégourié-Gonnard7580ba42015-06-19 10:26:32 +0200640 /* First do a gather to make sure we have default sources */
Manuel Pégourié-Gonnarde94bfe62015-05-14 13:57:50 +0200641 if( ( ret = mbedtls_entropy_gather( &ctx ) ) != 0 )
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200642 goto cleanup;
643
Manuel Pégourié-Gonnard7580ba42015-06-19 10:26:32 +0200644 ret = mbedtls_entropy_add_source( &ctx, entropy_dummy_source, NULL, 16,
645 MBEDTLS_ENTROPY_SOURCE_WEAK );
Manuel Pégourié-Gonnarde94bfe62015-05-14 13:57:50 +0200646 if( ret != 0 )
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200647 goto cleanup;
648
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200649 if( ( ret = mbedtls_entropy_update_manual( &ctx, buf, sizeof buf ) ) != 0 )
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200650 goto cleanup;
651
652 /*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200653 * To test that mbedtls_entropy_func writes correct number of bytes:
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200654 * - use the whole buffer and rely on ASan to detect overruns
655 * - collect entropy 8 times and OR the result in an accumulator:
656 * any byte should then be 0 with probably 2^(-64), so requiring
657 * each of the 32 or 64 bytes to be non-zero has a false failure rate
658 * of at most 2^(-58) which is acceptable.
659 */
660 for( i = 0; i < 8; i++ )
661 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200662 if( ( ret = mbedtls_entropy_func( &ctx, buf, sizeof( buf ) ) ) != 0 )
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200663 goto cleanup;
664
665 for( j = 0; j < sizeof( buf ); j++ )
666 acc[j] |= buf[j];
667 }
668
669 for( j = 0; j < sizeof( buf ); j++ )
670 {
671 if( acc[j] == 0 )
672 {
673 ret = 1;
674 goto cleanup;
675 }
676 }
677
Andres AGe7723ec2016-08-25 10:18:50 +0100678#if defined(MBEDTLS_ENTROPY_HARDWARE_ALT)
679 if( ( ret = mbedtls_entropy_source_self_test( 0 ) ) != 0 )
680 goto cleanup;
681#endif
682
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200683cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200684 mbedtls_entropy_free( &ctx );
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200685
686 if( verbose != 0 )
687 {
688 if( ret != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200689 mbedtls_printf( "failed\n" );
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200690 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200691 mbedtls_printf( "passed\n" );
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200692
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200693 mbedtls_printf( "\n" );
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200694 }
695
696 return( ret != 0 );
697}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200698#endif /* MBEDTLS_SELF_TEST */
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200699
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200700#endif /* MBEDTLS_ENTROPY_C */