Use a proper DRBG in programs
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
diff --git a/programs/pkey/key_app.c b/programs/pkey/key_app.c
index 0e30be4..2145e07 100644
--- a/programs/pkey/key_app.c
+++ b/programs/pkey/key_app.c
@@ -35,12 +35,13 @@
#endif /* MBEDTLS_PLATFORM_C */
#if defined(MBEDTLS_BIGNUM_C) && \
- defined(MBEDTLS_PK_PARSE_C) && defined(MBEDTLS_FS_IO)
+ defined(MBEDTLS_PK_PARSE_C) && defined(MBEDTLS_FS_IO) && \
+ defined(MBEDTLS_ENTROPY_C) && defined(MBEDTLS_CTR_DRBG_C)
#include "mbedtls/error.h"
#include "mbedtls/rsa.h"
#include "mbedtls/pk.h"
-
-#include "test/random.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
#include <string.h>
#endif
@@ -65,11 +66,13 @@
"\n"
#if !defined(MBEDTLS_BIGNUM_C) || \
- !defined(MBEDTLS_PK_PARSE_C) || !defined(MBEDTLS_FS_IO)
+ !defined(MBEDTLS_PK_PARSE_C) || !defined(MBEDTLS_FS_IO) || \
+ !defined(MBEDTLS_ENTROPY_C) || !defined(MBEDTLS_CTR_DRBG_C)
int main( void )
{
mbedtls_printf("MBEDTLS_BIGNUM_C and/or "
- "MBEDTLS_PK_PARSE_C and/or MBEDTLS_FS_IO not defined.\n");
+ "MBEDTLS_PK_PARSE_C and/or MBEDTLS_FS_IO and/or "
+ "MBEDTLS_ENTROPY_C and/or MBEDTLS_CTR_DRBG_C not defined.\n");
mbedtls_exit( 0 );
}
#else
@@ -94,12 +97,19 @@
int i;
char *p, *q;
+ const char *pers = "pkey/key_app";
+ mbedtls_entropy_context entropy;
+ mbedtls_ctr_drbg_context ctr_drbg;
+
mbedtls_pk_context pk;
mbedtls_mpi N, P, Q, D, E, DP, DQ, QP;
/*
* Set to sane values
*/
+ mbedtls_entropy_init( &entropy );
+ mbedtls_ctr_drbg_init( &ctr_drbg );
+
mbedtls_pk_init( &pk );
memset( buf, 0, sizeof(buf) );
@@ -183,8 +193,16 @@
mbedtls_printf( "\n . Loading the private key ..." );
fflush( stdout );
+ if( ( ret = mbedtls_ctr_drbg_seed( &ctr_drbg, mbedtls_entropy_func, &entropy,
+ (const unsigned char *) pers,
+ strlen( pers ) ) ) != 0 )
+ {
+ mbedtls_printf( " failed\n ! mbedtls_ctr_drbg_seed returned -0x%04x\n", (unsigned int) -ret );
+ goto cleanup;
+ }
+
ret = mbedtls_pk_parse_keyfile( &pk, opt.filename, opt.password,
- mbedtls_test_rnd_std_rand, NULL );
+ mbedtls_ctr_drbg_random, &ctr_drbg );
if( ret != 0 )
{
@@ -302,6 +320,9 @@
}
#endif
+ mbedtls_ctr_drbg_free( &ctr_drbg );
+ mbedtls_entropy_free( &entropy );
+
mbedtls_pk_free( &pk );
mbedtls_mpi_free( &N ); mbedtls_mpi_free( &P ); mbedtls_mpi_free( &Q );
mbedtls_mpi_free( &D ); mbedtls_mpi_free( &E ); mbedtls_mpi_free( &DP );
@@ -314,4 +335,5 @@
mbedtls_exit( exit_code );
}
-#endif /* MBEDTLS_BIGNUM_C && MBEDTLS_PK_PARSE_C && MBEDTLS_FS_IO */
+#endif /* MBEDTLS_BIGNUM_C && MBEDTLS_PK_PARSE_C && MBEDTLS_FS_IO &&
+ MBEDTLS_ENTROPY_C && MBEDTLS_CTR_DRBG_C */
diff --git a/programs/pkey/key_app_writer.c b/programs/pkey/key_app_writer.c
index c7f9741..89c67ed 100644
--- a/programs/pkey/key_app_writer.c
+++ b/programs/pkey/key_app_writer.c
@@ -34,12 +34,15 @@
#define MBEDTLS_EXIT_FAILURE EXIT_FAILURE
#endif /* MBEDTLS_PLATFORM_C */
-#if defined(MBEDTLS_PK_WRITE_C) && defined(MBEDTLS_FS_IO)
+#if defined(MBEDTLS_PK_PARSE_C) && defined(MBEDTLS_PK_WRITE_C) && \
+ defined(MBEDTLS_FS_IO) && \
+ defined(MBEDTLS_ENTROPY_C) && defined(MBEDTLS_CTR_DRBG_C)
#include "mbedtls/error.h"
#include "mbedtls/pk.h"
#include "mbedtls/error.h"
-#include "test/random.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
#include <stdio.h>
#include <string.h>
@@ -90,10 +93,14 @@
#if !defined(MBEDTLS_PK_PARSE_C) || \
!defined(MBEDTLS_PK_WRITE_C) || \
- !defined(MBEDTLS_FS_IO)
+ !defined(MBEDTLS_FS_IO) || \
+ !defined(MBEDTLS_ENTROPY_C) || \
+ !defined(MBEDTLS_CTR_DRBG_C)
int main( void )
{
- mbedtls_printf( "MBEDTLS_PK_PARSE_C and/or MBEDTLS_PK_WRITE_C and/or MBEDTLS_FS_IO not defined.\n" );
+ mbedtls_printf( "MBEDTLS_PK_PARSE_C and/or MBEDTLS_PK_WRITE_C and/or "
+ "MBEDTLS_ENTROPY_C and/or MBEDTLS_CTR_DRBG_C and/or "
+ "MBEDTLS_FS_IO not defined.\n" );
mbedtls_exit( 0 );
}
#else
@@ -203,12 +210,19 @@
int i;
char *p, *q;
+ const char *pers = "pkey/key_app";
+ mbedtls_entropy_context entropy;
+ mbedtls_ctr_drbg_context ctr_drbg;
+
mbedtls_pk_context key;
mbedtls_mpi N, P, Q, D, E, DP, DQ, QP;
/*
* Set to sane values
*/
+ mbedtls_entropy_init( &entropy );
+ mbedtls_ctr_drbg_init( &ctr_drbg );
+
mbedtls_pk_init( &key );
memset( buf, 0, sizeof( buf ) );
@@ -294,8 +308,16 @@
mbedtls_printf( "\n . Loading the private key ..." );
fflush( stdout );
+ if( ( ret = mbedtls_ctr_drbg_seed( &ctr_drbg, mbedtls_entropy_func, &entropy,
+ (const unsigned char *) pers,
+ strlen( pers ) ) ) != 0 )
+ {
+ mbedtls_printf( " failed\n ! mbedtls_ctr_drbg_seed returned -0x%04x\n", (unsigned int) -ret );
+ goto exit;
+ }
+
ret = mbedtls_pk_parse_keyfile( &key, opt.filename, NULL,
- mbedtls_test_rnd_std_rand, NULL );
+ mbedtls_ctr_drbg_random, &ctr_drbg );
if( ret != 0 )
{
mbedtls_strerror( ret, (char *) buf, sizeof(buf) );
@@ -431,6 +453,9 @@
mbedtls_pk_free( &key );
+ mbedtls_ctr_drbg_free( &ctr_drbg );
+ mbedtls_entropy_free( &entropy );
+
#if defined(_WIN32)
mbedtls_printf( " + Press Enter to exit this program.\n" );
fflush( stdout ); getchar();
@@ -438,4 +463,5 @@
mbedtls_exit( exit_code );
}
-#endif /* MBEDTLS_PK_PARSE_C && MBEDTLS_PK_WRITE_C && MBEDTLS_FS_IO */
+#endif /* MBEDTLS_PK_PARSE_C && MBEDTLS_PK_WRITE_C && MBEDTLS_FS_IO &&
+ MBEDTLS_ENTROPY_C && MBEDTLS_CTR_DRBG_C */
diff --git a/programs/ssl/dtls_server.c b/programs/ssl/dtls_server.c
index 857671f..d2cc450 100644
--- a/programs/ssl/dtls_server.c
+++ b/programs/ssl/dtls_server.c
@@ -81,7 +81,6 @@
#include "mbedtls/timing.h"
#include "test/certs.h"
-#include "test/random.h"
#if defined(MBEDTLS_SSL_CACHE_C)
#include "mbedtls/ssl_cache.h"
diff --git a/programs/ssl/ssl_server2.c b/programs/ssl/ssl_server2.c
index 37f4348..68cc027 100644
--- a/programs/ssl/ssl_server2.c
+++ b/programs/ssl/ssl_server2.c
@@ -20,7 +20,6 @@
#define MBEDTLS_ALLOW_PRIVATE_ACCESS
#include "ssl_test_lib.h"
-#include "test/random.h"
#if defined(MBEDTLS_SSL_TEST_IMPOSSIBLE)
int main( void )
@@ -689,7 +688,7 @@
*
* Modifies the input string! This is not production quality!
*/
-sni_entry *sni_parse( char *sni_string )
+sni_entry *sni_parse( char *sni_string, rng_context_t *p_rng )
{
sni_entry *cur = NULL, *new = NULL;
char *p = sni_string;
@@ -728,8 +727,7 @@
mbedtls_pk_init( new->key );
if( mbedtls_x509_crt_parse_file( new->cert, crt_file ) != 0 ||
- mbedtls_pk_parse_keyfile( new->key, key_file, "",
- mbedtls_test_rnd_std_rand, NULL ) != 0 )
+ mbedtls_pk_parse_keyfile( new->key, key_file, "", rng_get, p_rng ) != 0 )
goto error;
if( strcmp( ca_file, "-" ) != 0 )
@@ -2373,7 +2371,7 @@
mbedtls_printf( " . Setting up SNI information..." );
fflush( stdout );
- if( ( sni_info = sni_parse( opt.sni ) ) == NULL )
+ if( ( sni_info = sni_parse( opt.sni, &rng ) ) == NULL )
{
mbedtls_printf( " failed\n" );
goto exit;