Implement mbedtls_mpi_core_fill_random
Turn mpi_fill_random_internal() into mbedtls_mpi_core_fill_random(). It
had basically the right code except for how X is passed to the function.
Write unit tests.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
diff --git a/library/bignum.c b/library/bignum.c
index d33f07c..b5431a0 100644
--- a/library/bignum.c
+++ b/library/bignum.c
@@ -1934,25 +1934,26 @@
/* Fill X with n_bytes random bytes.
* X must already have room for those bytes.
* The ordering of the bytes returned from the RNG is suitable for
- * deterministic ECDSA (see RFC 6979 §3.3 and mbedtls_mpi_random()).
+ * deterministic ECDSA (see RFC 6979 §3.3 and mbedtls_mpi_core_random()).
* The size and sign of X are unchanged.
* n_bytes must not be 0.
*/
-static int mpi_fill_random_internal(
- mbedtls_mpi *X, size_t n_bytes,
+int mbedtls_mpi_core_fill_random(
+ mbedtls_mpi_uint *X, size_t X_limbs,
+ size_t n_bytes,
int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
{
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
const size_t limbs = CHARS_TO_LIMBS( n_bytes );
const size_t overhead = ( limbs * ciL ) - n_bytes;
- if( X->n < limbs )
+ if( X_limbs < limbs )
return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
- memset( X->p, 0, overhead );
- memset( (unsigned char *) X->p + limbs * ciL, 0, ( X->n - limbs ) * ciL );
- MBEDTLS_MPI_CHK( f_rng( p_rng, (unsigned char *) X->p + overhead, n_bytes ) );
- mbedtls_mpi_core_bigendian_to_host( X->p, limbs );
+ memset( X, 0, overhead );
+ memset( (unsigned char *) X + limbs * ciL, 0, ( X_limbs - limbs ) * ciL );
+ MBEDTLS_MPI_CHK( f_rng( p_rng, (unsigned char *) X + overhead, n_bytes ) );
+ mbedtls_mpi_core_bigendian_to_host( X, limbs );
cleanup:
return( ret );
@@ -1980,7 +1981,7 @@
if( size == 0 )
return( 0 );
- ret = mpi_fill_random_internal( X, size, f_rng, p_rng );
+ ret = mbedtls_mpi_core_fill_random( X->p, X->n, size, f_rng, p_rng );
cleanup:
return( ret );
@@ -2042,7 +2043,9 @@
*/
do
{
- MBEDTLS_MPI_CHK( mpi_fill_random_internal( X, n_bytes, f_rng, p_rng ) );
+ MBEDTLS_MPI_CHK( mbedtls_mpi_core_fill_random( X->p, X->n,
+ n_bytes,
+ f_rng, p_rng ) );
MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( X, 8 * n_bytes - n_bits ) );
if( --count == 0 )
diff --git a/tests/suites/test_suite_bignum_core.function b/tests/suites/test_suite_bignum_core.function
index d5d58d8..745a8af 100644
--- a/tests/suites/test_suite_bignum_core.function
+++ b/tests/suites/test_suite_bignum_core.function
@@ -992,3 +992,56 @@
mbedtls_free(dest);
}
/* END_CASE */
+
+/* BEGIN_CASE */
+void mpi_core_fill_random( int wanted_bytes_arg, int extra_rng_bytes,
+ int extra_limbs, int before, int expected_ret )
+{
+ size_t wanted_bytes = wanted_bytes_arg;
+ mbedtls_mpi_uint *X = NULL;
+ size_t X_limbs = CHARS_TO_LIMBS( wanted_bytes ) + extra_limbs;
+ size_t rng_bytes = wanted_bytes + extra_rng_bytes;
+ unsigned char *rnd_data = NULL;
+ mbedtls_test_rnd_buf_info rnd_info = {NULL, rng_bytes, NULL, NULL};
+ int ret;
+
+ /* Prepare an RNG with known output, limited to rng_bytes. */
+ ASSERT_ALLOC( rnd_data, rng_bytes );
+ TEST_EQUAL( 0, mbedtls_test_rnd_std_rand( NULL, rnd_data, rng_bytes ) );
+ rnd_info.buf = rnd_data;
+
+ /* Allocate an MPI with room for wanted_bytes plus extra_limbs.
+ * extra_limbs may be negative but the total limb count must be positive.
+ * Fill the MPI with the byte value in before. */
+ TEST_LE_U( 1, X_limbs );
+ ASSERT_ALLOC( X, X_limbs );
+ memset( X, before, X_limbs * sizeof( *X ) );
+
+ ret = mbedtls_mpi_core_fill_random( X, X_limbs, wanted_bytes,
+ mbedtls_test_rnd_buffer_rand,
+ &rnd_info );
+ TEST_EQUAL( expected_ret, ret );
+
+ if( expected_ret == 0 )
+ {
+ /* mbedtls_mpi_core_fill_random is documented to use bytes from the
+ * RNG as a big-endian representation of the number. We used an RNG
+ * with known output, so check that the output contains the
+ * expected value. Bytes above wanted_bytes must be zero. */
+ for( size_t i = 0; i < wanted_bytes; i++ )
+ {
+ mbedtls_test_set_step( i );
+ TEST_EQUAL( GET_BYTE( X, i ), rnd_data[wanted_bytes - 1 - i] );
+ }
+ for( size_t i = wanted_bytes; i < X_limbs * ciL; i++ )
+ {
+ mbedtls_test_set_step( i );
+ TEST_EQUAL( GET_BYTE( X, i ), 0 );
+ }
+ }
+
+exit:
+ mbedtls_free( rnd_data );
+ mbedtls_free( X );
+}
+/* END_CASE */
diff --git a/tests/suites/test_suite_bignum_core.misc.data b/tests/suites/test_suite_bignum_core.misc.data
index a8fe9ab..743bb3e 100644
--- a/tests/suites/test_suite_bignum_core.misc.data
+++ b/tests/suites/test_suite_bignum_core.misc.data
@@ -364,3 +364,69 @@
mbedtls_mpi_core_get_mont_r2_unsafe #11
mpi_core_get_mont_r2_unsafe:"d1cece570f2f991013f26dd5b03c4c5b65f97be5905f36cb4664f2c78ff80aa8135a4aaf57ccb8a0aca2f394909a74cef1ef6758a64d11e2c149c393659d124bfc94196f0ce88f7d7d567efa5a649e2deefaa6e10fdc3deac60d606bf63fc540ac95294347031aefd73d6a9ee10188aaeb7a90d920894553cb196881691cadc51808715a07e8b24fcb1a63df047c7cdf084dd177ba368c806f3d51ddb5d3898c863e687ecaf7d649a57a46264a582f94d3c8f2edaf59f77a7f6bdaf83c991e8f06abe220ec8507386fce8c3da84c6c3903ab8f3ad4630a204196a7dbcbd9bcca4e40ec5cc5c09938d49f5e1e6181db8896f33bb12e6ef73f12ec5c5ea7a8a337":"12d7243d92ebc8338221f6dcec8ad8a2ec64c10a98339c8721beb1cb79e629253a7aa35e25d5421e6c2b43ddc4310cf4443875c070a7a5a5cc2c4c3eefa8a133af2e477fb7bb5b5058c6120946a7f9f08f2fab51e2f243b9ba206d2bfd62e4ef647dda49100d7004794f28172be2d715905fbd2e9ab8588c774523c0e096b49b6855a10e5ce0d8498370949a29d71d293788bf10a71e2447d4b2f11959a72f7290e2950772d14c83f15532468745fa58a83fca8883b0b6169a27ec0cf922c4f39d283bb20fca5ff1de01d9c66b8a710108b951af634d56c843d9505bf2edd5a7b8f0b72a5c95672151e60075a78084e83fbe284617a90c74c8335cce38bb012e":"12d7243d92ebc8338221f6dcec8ad8a2ec64c10a98339c8721beb1cb79e629253a7aa35e25d5421e6c2b43ddc4310cf4443875c070a7a5a5cc2c4c3eefa8a133af2e477fb7bb5b5058c6120946a7f9f08f2fab51e2f243b9ba206d2bfd62e4ef647dda49100d7004794f28172be2d715905fbd2e9ab8588c774523c0e096b49b6855a10e5ce0d8498370949a29d71d293788bf10a71e2447d4b2f11959a72f7290e2950772d14c83f15532468745fa58a83fca8883b0b6169a27ec0cf922c4f39d283bb20fca5ff1de01d9c66b8a710108b951af634d56c843d9505bf2edd5a7b8f0b72a5c95672151e60075a78084e83fbe284617a90c74c8335cce38bb012e"
+
+Fill random core: 0 bytes
+mpi_core_fill_random:0:0:1:0:0
+
+Fill random core: 1 byte, RNG stops at 0
+mpi_core_fill_random:1:-1:0:0:MBEDTLS_ERR_ENTROPY_SOURCE_FAILED
+
+Fill random core: 1 byte, RNG just sufficient
+mpi_core_fill_random:1:0:0:0:0
+
+Fill random core: 1 byte, RNG not exhausted
+mpi_core_fill_random:1:1:0:0:0
+
+Fill random core: 1 byte, prior content nonzero
+mpi_core_fill_random:1:0:0:0xba:0
+
+Fill random core: 1 byte, 1 extra limb
+mpi_core_fill_random:1:0:1:0:0
+
+Fill random core: 1 byte, 1 extra limb, prior content nonzero
+mpi_core_fill_random:1:0:1:0xba:0
+
+Fill random core: 8 bytes, RNG stops before
+mpi_core_fill_random:8:-1:0:0:MBEDTLS_ERR_ENTROPY_SOURCE_FAILED
+
+Fill random core: 8 bytes, RNG just sufficient
+mpi_core_fill_random:8:0:0:0:0
+
+Fill random core: 8 bytes, RNG not exhausted
+mpi_core_fill_random:8:1:0:0:0
+
+Fill random core: 8 bytes, prior content nonzero
+mpi_core_fill_random:8:0:0:0xba:0
+
+Fill random core: 8 bytes, 1 extra limb
+mpi_core_fill_random:8:0:1:0:0
+
+Fill random core: 8 bytes, 1 extra limb, prior content nonzero
+mpi_core_fill_random:8:0:1:0xba:0
+
+Fill random core: 9 bytes, 1 missing limb
+mpi_core_fill_random:9:0:-1:0:MBEDTLS_ERR_MPI_BAD_INPUT_DATA
+
+Fill random core: 42 bytes, RNG stops before
+mpi_core_fill_random:42:-1:0:0:MBEDTLS_ERR_ENTROPY_SOURCE_FAILED
+
+Fill random core: 42 bytes, RNG just sufficient
+mpi_core_fill_random:42:0:0:0:0
+
+Fill random core: 42 bytes, RNG not exhausted
+mpi_core_fill_random:42:1:0:0:0
+
+Fill random core: 42 bytes, prior content nonzero
+mpi_core_fill_random:42:0:0:0xba:0
+
+Fill random core: 42 bytes, 1 extra limb
+mpi_core_fill_random:42:0:1:0:0
+
+Fill random core: 42 bytes, 1 extra limb, prior content nonzero
+mpi_core_fill_random:42:0:1:0xba:0
+
+Fill random core: 42 bytes, 1 missing limb
+mpi_core_fill_random:42:0:-1:0:MBEDTLS_ERR_MPI_BAD_INPUT_DATA
+
+Fill random core: 42 bytes, 5 missing limbs
+mpi_core_fill_random:42:0:-5:0:MBEDTLS_ERR_MPI_BAD_INPUT_DATA