blob: d1bde6a0df3cb7cd33c4c84c8e3bd8f6e0435f59 [file] [log] [blame]
Paul Bakker6083fd22011-12-03 21:45:14 +00001/*
2 * Entropy accumulator implementation
3 *
Paul Bakker9988d6b2016-06-01 11:29:42 +01004 * Copyright (C) 2006-2016, ARM Limited, All Rights Reserved
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakker6083fd22011-12-03 21:45:14 +000018 *
Manuel Pégourié-Gonnardfe446432015-03-06 13:17:10 +000019 * This file is part of mbed TLS (https://tls.mbed.org)
Paul Bakker6083fd22011-12-03 21:45:14 +000020 */
21
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020022#if !defined(MBEDTLS_CONFIG_FILE)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000023#include "mbedtls/config.h"
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020024#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020025#include MBEDTLS_CONFIG_FILE
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020026#endif
Paul Bakker6083fd22011-12-03 21:45:14 +000027
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020028#if defined(MBEDTLS_ENTROPY_C)
Paul Bakker6083fd22011-12-03 21:45:14 +000029
Simon Butcherab5df402016-06-11 02:31:21 +010030#if defined(MBEDTLS_TEST_NULL_ENTROPY)
Simon Butcher1ceab6e2016-06-21 10:14:00 +010031#warning "**** WARNING! MBEDTLS_TEST_NULL_ENTROPY defined! "
32#warning "**** THIS BUILD HAS NO DEFINED ENTROPY SOURCES "
33#warning "**** THIS BUILD IS *NOT* SUITABLE FOR PRODUCTION USE "
Simon Butcherab5df402016-06-11 02:31:21 +010034#endif
35
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000036#include "mbedtls/entropy.h"
37#include "mbedtls/entropy_poll.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050038#include "mbedtls/platform_util.h"
Paul Bakker6083fd22011-12-03 21:45:14 +000039
Rich Evans00ab4702015-02-06 13:43:58 +000040#include <string.h>
41
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020042#if defined(MBEDTLS_FS_IO)
Paul Bakker66ff70d2014-03-26 11:54:05 +010043#include <stdio.h>
44#endif
45
Paul Bakker217efbc2016-07-14 14:30:03 +010046#include "mbedtls/platform.h"
Paul Bakker217efbc2016-07-14 14:30:03 +010047
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020048#if defined(MBEDTLS_SELF_TEST)
49#if defined(MBEDTLS_PLATFORM_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000050#include "mbedtls/platform.h"
Rich Evans00ab4702015-02-06 13:43:58 +000051#else
52#include <stdio.h>
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020053#define mbedtls_printf printf
54#endif /* MBEDTLS_PLATFORM_C */
55#endif /* MBEDTLS_SELF_TEST */
Rich Evans00ab4702015-02-06 13:43:58 +000056
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020057#if defined(MBEDTLS_HAVEGE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000058#include "mbedtls/havege.h"
Paul Bakker28c7e7f2011-12-15 19:49:30 +000059#endif
60
Paul Bakker6083fd22011-12-03 21:45:14 +000061#define ENTROPY_MAX_LOOP 256 /**< Maximum amount to loop before error */
62
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020063void mbedtls_entropy_init( mbedtls_entropy_context *ctx )
Paul Bakker6083fd22011-12-03 21:45:14 +000064{
Andres Amaya Garciaa7559cb2017-06-29 16:12:31 +010065 ctx->source_count = 0;
Manuel Pégourié-Gonnard99419332019-10-03 10:40:57 +020066 memset( ctx->source, 0, sizeof( ctx->source ) );
Paul Bakker6083fd22011-12-03 21:45:14 +000067
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020068#if defined(MBEDTLS_THREADING_C)
69 mbedtls_mutex_init( &ctx->mutex );
Paul Bakkerf4e7dc52013-09-28 15:23:57 +020070#endif
71
Andres Amaya Garcia95869c42017-06-29 16:31:44 +010072 ctx->accumulator_started = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020073#if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
Andres Amaya Garciaa7559cb2017-06-29 16:12:31 +010074 mbedtls_sha512_init( &ctx->accumulator );
Paul Bakkerfb08fd22013-08-27 15:06:26 +020075#else
Andres Amaya Garciaa7559cb2017-06-29 16:12:31 +010076 mbedtls_sha256_init( &ctx->accumulator );
Paul Bakkerfb08fd22013-08-27 15:06:26 +020077#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020078#if defined(MBEDTLS_HAVEGE_C)
79 mbedtls_havege_init( &ctx->havege_data );
Paul Bakker43655f42011-12-15 20:11:16 +000080#endif
Paul Bakker6083fd22011-12-03 21:45:14 +000081
Hanno Beckerd4a872e2017-09-07 08:09:33 +010082 /* Reminder: Update ENTROPY_HAVE_STRONG in the test files
Hanno Becker47deec42017-07-24 12:27:09 +010083 * when adding more strong entropy sources here. */
Hanno Beckerc6deafc2017-07-23 14:06:42 +010084
Simon Butcherab5df402016-06-11 02:31:21 +010085#if defined(MBEDTLS_TEST_NULL_ENTROPY)
Simon Butcher4157b602016-06-12 00:31:33 +010086 mbedtls_entropy_add_source( ctx, mbedtls_null_entropy_poll, NULL,
Janos Follath53de7842016-06-08 15:29:18 +010087 1, MBEDTLS_ENTROPY_SOURCE_STRONG );
88#endif
89
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020090#if !defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES)
91#if !defined(MBEDTLS_NO_PLATFORM_ENTROPY)
92 mbedtls_entropy_add_source( ctx, mbedtls_platform_entropy_poll, NULL,
Manuel Pégourié-Gonnard7580ba42015-06-19 10:26:32 +020093 MBEDTLS_ENTROPY_MIN_PLATFORM,
94 MBEDTLS_ENTROPY_SOURCE_STRONG );
Paul Bakker6083fd22011-12-03 21:45:14 +000095#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020096#if defined(MBEDTLS_TIMING_C)
Manuel Pégourié-Gonnard7580ba42015-06-19 10:26:32 +020097 mbedtls_entropy_add_source( ctx, mbedtls_hardclock_poll, NULL,
98 MBEDTLS_ENTROPY_MIN_HARDCLOCK,
99 MBEDTLS_ENTROPY_SOURCE_WEAK );
Paul Bakker6083fd22011-12-03 21:45:14 +0000100#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200101#if defined(MBEDTLS_HAVEGE_C)
102 mbedtls_entropy_add_source( ctx, mbedtls_havege_poll, &ctx->havege_data,
Manuel Pégourié-Gonnard7580ba42015-06-19 10:26:32 +0200103 MBEDTLS_ENTROPY_MIN_HAVEGE,
104 MBEDTLS_ENTROPY_SOURCE_STRONG );
Paul Bakker28c7e7f2011-12-15 19:49:30 +0000105#endif
Manuel Pégourié-Gonnard3f77dfb2015-06-19 10:06:21 +0200106#if defined(MBEDTLS_ENTROPY_HARDWARE_ALT)
Manuel Pégourié-Gonnardfc2ccfe2015-07-10 11:15:50 +0100107 mbedtls_entropy_add_source( ctx, mbedtls_hardware_poll, NULL,
Manuel Pégourié-Gonnard7580ba42015-06-19 10:26:32 +0200108 MBEDTLS_ENTROPY_MIN_HARDWARE,
109 MBEDTLS_ENTROPY_SOURCE_STRONG );
Manuel Pégourié-Gonnard3f77dfb2015-06-19 10:06:21 +0200110#endif
Paul Bakker9988d6b2016-06-01 11:29:42 +0100111#if defined(MBEDTLS_ENTROPY_NV_SEED)
112 mbedtls_entropy_add_source( ctx, mbedtls_nv_seed_poll, NULL,
113 MBEDTLS_ENTROPY_BLOCK_SIZE,
114 MBEDTLS_ENTROPY_SOURCE_STRONG );
Andres Amaya Garciaa7559cb2017-06-29 16:12:31 +0100115 ctx->initial_entropy_run = 0;
Paul Bakker9988d6b2016-06-01 11:29:42 +0100116#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200117#endif /* MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES */
Paul Bakker6083fd22011-12-03 21:45:14 +0000118}
119
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200120void mbedtls_entropy_free( mbedtls_entropy_context *ctx )
Paul Bakker1ffefac2013-09-28 15:23:03 +0200121{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200122#if defined(MBEDTLS_HAVEGE_C)
123 mbedtls_havege_free( &ctx->havege_data );
Paul Bakkera317a982014-06-18 16:44:11 +0200124#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200125#if defined(MBEDTLS_THREADING_C)
126 mbedtls_mutex_free( &ctx->mutex );
Paul Bakkerf4e7dc52013-09-28 15:23:57 +0200127#endif
Andres Amaya Garciaa7559cb2017-06-29 16:12:31 +0100128#if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
129 mbedtls_sha512_free( &ctx->accumulator );
130#else
131 mbedtls_sha256_free( &ctx->accumulator );
132#endif
133#if defined(MBEDTLS_ENTROPY_NV_SEED)
134 ctx->initial_entropy_run = 0;
135#endif
136 ctx->source_count = 0;
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500137 mbedtls_platform_zeroize( ctx->source, sizeof( ctx->source ) );
Andres Amaya Garcia95869c42017-06-29 16:31:44 +0100138 ctx->accumulator_started = 0;
Paul Bakker1ffefac2013-09-28 15:23:03 +0200139}
140
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200141int mbedtls_entropy_add_source( mbedtls_entropy_context *ctx,
142 mbedtls_entropy_f_source_ptr f_source, void *p_source,
Manuel Pégourié-Gonnard7580ba42015-06-19 10:26:32 +0200143 size_t threshold, int strong )
Paul Bakker6083fd22011-12-03 21:45:14 +0000144{
Hanno Becker61937d42017-04-26 15:01:23 +0100145 int idx, ret = 0;
Paul Bakkerbd4a9d02011-12-10 17:02:19 +0000146
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200147#if defined(MBEDTLS_THREADING_C)
148 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
Paul Bakker47703a02014-02-06 15:01:20 +0100149 return( ret );
150#endif
151
Hanno Becker61937d42017-04-26 15:01:23 +0100152 idx = ctx->source_count;
153 if( idx >= MBEDTLS_ENTROPY_MAX_SOURCES )
Paul Bakker47703a02014-02-06 15:01:20 +0100154 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200155 ret = MBEDTLS_ERR_ENTROPY_MAX_SOURCES;
Paul Bakker47703a02014-02-06 15:01:20 +0100156 goto exit;
157 }
Paul Bakker6083fd22011-12-03 21:45:14 +0000158
Hanno Becker61937d42017-04-26 15:01:23 +0100159 ctx->source[idx].f_source = f_source;
160 ctx->source[idx].p_source = p_source;
161 ctx->source[idx].threshold = threshold;
162 ctx->source[idx].strong = strong;
Paul Bakker6083fd22011-12-03 21:45:14 +0000163
164 ctx->source_count++;
165
Paul Bakker47703a02014-02-06 15:01:20 +0100166exit:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200167#if defined(MBEDTLS_THREADING_C)
168 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
169 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
Paul Bakker47703a02014-02-06 15:01:20 +0100170#endif
171
172 return( ret );
Paul Bakker6083fd22011-12-03 21:45:14 +0000173}
174
175/*
176 * Entropy accumulator update
177 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200178static int entropy_update( mbedtls_entropy_context *ctx, unsigned char source_id,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200179 const unsigned char *data, size_t len )
Paul Bakker6083fd22011-12-03 21:45:14 +0000180{
181 unsigned char header[2];
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200182 unsigned char tmp[MBEDTLS_ENTROPY_BLOCK_SIZE];
Paul Bakker6083fd22011-12-03 21:45:14 +0000183 size_t use_len = len;
184 const unsigned char *p = data;
Jaeden Amero66954e12018-01-25 16:05:54 +0000185 int ret = 0;
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200186
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200187 if( use_len > MBEDTLS_ENTROPY_BLOCK_SIZE )
Paul Bakker6083fd22011-12-03 21:45:14 +0000188 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200189#if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100190 if( ( ret = mbedtls_sha512_ret( data, len, tmp, 0 ) ) != 0 )
Jaeden Amero66954e12018-01-25 16:05:54 +0000191 goto cleanup;
Paul Bakkerfb08fd22013-08-27 15:06:26 +0200192#else
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100193 if( ( ret = mbedtls_sha256_ret( data, len, tmp, 0 ) ) != 0 )
Jaeden Amero66954e12018-01-25 16:05:54 +0000194 goto cleanup;
Paul Bakkerfb08fd22013-08-27 15:06:26 +0200195#endif
Paul Bakker6083fd22011-12-03 21:45:14 +0000196 p = tmp;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200197 use_len = MBEDTLS_ENTROPY_BLOCK_SIZE;
Paul Bakker6083fd22011-12-03 21:45:14 +0000198 }
199
200 header[0] = source_id;
201 header[1] = use_len & 0xFF;
202
Andres Amaya Garcia95869c42017-06-29 16:31:44 +0100203 /*
204 * Start the accumulator if this has not already happened. Note that
205 * it is sufficient to start the accumulator here only because all calls to
206 * gather entropy eventually execute this code.
207 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200208#if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
Andres Amaya Garcia95869c42017-06-29 16:31:44 +0100209 if( ctx->accumulator_started == 0 &&
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100210 ( ret = mbedtls_sha512_starts_ret( &ctx->accumulator, 0 ) ) != 0 )
Jaeden Amero66954e12018-01-25 16:05:54 +0000211 goto cleanup;
Andres Amaya Garcia95869c42017-06-29 16:31:44 +0100212 else
213 ctx->accumulator_started = 1;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100214 if( ( ret = mbedtls_sha512_update_ret( &ctx->accumulator, header, 2 ) ) != 0 )
Jaeden Amero66954e12018-01-25 16:05:54 +0000215 goto cleanup;
216 ret = mbedtls_sha512_update_ret( &ctx->accumulator, p, use_len );
Paul Bakkerfb08fd22013-08-27 15:06:26 +0200217#else
Andres Amaya Garcia95869c42017-06-29 16:31:44 +0100218 if( ctx->accumulator_started == 0 &&
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100219 ( ret = mbedtls_sha256_starts_ret( &ctx->accumulator, 0 ) ) != 0 )
Jaeden Amero66954e12018-01-25 16:05:54 +0000220 goto cleanup;
Andres Amaya Garcia95869c42017-06-29 16:31:44 +0100221 else
222 ctx->accumulator_started = 1;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100223 if( ( ret = mbedtls_sha256_update_ret( &ctx->accumulator, header, 2 ) ) != 0 )
Jaeden Amero66954e12018-01-25 16:05:54 +0000224 goto cleanup;
225 ret = mbedtls_sha256_update_ret( &ctx->accumulator, p, use_len );
Paul Bakkerfb08fd22013-08-27 15:06:26 +0200226#endif
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200227
Jaeden Amero66954e12018-01-25 16:05:54 +0000228cleanup:
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500229 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
Andres Amaya Garcia65121932017-07-05 15:45:47 +0100230
Jaeden Amero66954e12018-01-25 16:05:54 +0000231 return( ret );
Paul Bakker6083fd22011-12-03 21:45:14 +0000232}
233
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200234int mbedtls_entropy_update_manual( mbedtls_entropy_context *ctx,
Paul Bakker6083fd22011-12-03 21:45:14 +0000235 const unsigned char *data, size_t len )
236{
Paul Bakker47703a02014-02-06 15:01:20 +0100237 int ret;
238
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200239#if defined(MBEDTLS_THREADING_C)
240 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
Paul Bakker47703a02014-02-06 15:01:20 +0100241 return( ret );
242#endif
243
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200244 ret = entropy_update( ctx, MBEDTLS_ENTROPY_SOURCE_MANUAL, data, len );
Paul Bakker47703a02014-02-06 15:01:20 +0100245
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200246#if defined(MBEDTLS_THREADING_C)
247 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
248 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
Paul Bakker47703a02014-02-06 15:01:20 +0100249#endif
250
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200251 return( ret );
Paul Bakker6083fd22011-12-03 21:45:14 +0000252}
253
254/*
255 * Run through the different sources to add entropy to our accumulator
256 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200257static int entropy_gather_internal( mbedtls_entropy_context *ctx )
Paul Bakker6083fd22011-12-03 21:45:14 +0000258{
Jarno Lamsa6122b592019-12-17 10:06:46 +0200259 int i;
260 volatile int ret = MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE;
Jarno Lamsa552e8f22019-11-14 10:05:36 +0200261 volatile int have_one_strong_fi = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200262 unsigned char buf[MBEDTLS_ENTROPY_MAX_GATHER];
Paul Bakker6083fd22011-12-03 21:45:14 +0000263 size_t olen;
Paul Bakker47703a02014-02-06 15:01:20 +0100264
Paul Bakker43655f42011-12-15 20:11:16 +0000265 if( ctx->source_count == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200266 return( MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED );
Paul Bakker43655f42011-12-15 20:11:16 +0000267
Paul Bakker6083fd22011-12-03 21:45:14 +0000268 /*
269 * Run through our entropy sources
270 */
271 for( i = 0; i < ctx->source_count; i++ )
272 {
Jarno Lamsad05da1f2019-11-14 10:12:36 +0200273 volatile int strong_fi = ctx->source[i].strong;
274 if( strong_fi == MBEDTLS_ENTROPY_SOURCE_STRONG )
Jarno Lamsaf5b6af02019-12-19 14:46:40 +0200275 {
276 mbedtls_platform_enforce_volatile_reads();
Jarno Lamsad05da1f2019-11-14 10:12:36 +0200277
Jarno Lamsaf5b6af02019-12-19 14:46:40 +0200278 if( strong_fi == MBEDTLS_ENTROPY_SOURCE_STRONG )
279 have_one_strong_fi = 1;
280 else
281 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
282 }
Manuel Pégourié-Gonnard7580ba42015-06-19 10:26:32 +0200283
Paul Bakker6083fd22011-12-03 21:45:14 +0000284 olen = 0;
Paul Bakker66d5d072014-06-17 16:39:18 +0200285 if( ( ret = ctx->source[i].f_source( ctx->source[i].p_source,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200286 buf, MBEDTLS_ENTROPY_MAX_GATHER, &olen ) ) != 0 )
Paul Bakker6083fd22011-12-03 21:45:14 +0000287 {
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100288 goto cleanup;
Paul Bakker6083fd22011-12-03 21:45:14 +0000289 }
290
291 /*
292 * Add if we actually gathered something
293 */
294 if( olen > 0 )
Paul Bakkerbd4a9d02011-12-10 17:02:19 +0000295 {
Andres Amaya Garcia95869c42017-06-29 16:31:44 +0100296 if( ( ret = entropy_update( ctx, (unsigned char) i,
297 buf, olen ) ) != 0 )
298 return( ret );
Paul Bakkerbd4a9d02011-12-10 17:02:19 +0000299 ctx->source[i].size += olen;
300 }
Paul Bakker6083fd22011-12-03 21:45:14 +0000301 }
302
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100303cleanup:
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500304 mbedtls_platform_zeroize( buf, sizeof( buf ) );
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100305
Jarno Lamsa6122b592019-12-17 10:06:46 +0200306 if( have_one_strong_fi == 1 )
307 {
308 mbedtls_platform_enforce_volatile_reads();
309 if( have_one_strong_fi == 1 )
310 {
311 return( ret );
312 }
Jarno Lamsaf5b6af02019-12-19 14:46:40 +0200313 else
314 {
315 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
316 }
Jarno Lamsa6122b592019-12-17 10:06:46 +0200317 }
318
319 return( MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE );
Paul Bakker6083fd22011-12-03 21:45:14 +0000320}
321
Paul Bakker47703a02014-02-06 15:01:20 +0100322/*
323 * Thread-safe wrapper for entropy_gather_internal()
324 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200325int mbedtls_entropy_gather( mbedtls_entropy_context *ctx )
Paul Bakker47703a02014-02-06 15:01:20 +0100326{
Paul Bakkerddd427a2014-04-09 14:47:58 +0200327 int ret;
Paul Bakker47703a02014-02-06 15:01:20 +0100328
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200329#if defined(MBEDTLS_THREADING_C)
330 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
Paul Bakkerddd427a2014-04-09 14:47:58 +0200331 return( ret );
Paul Bakker47703a02014-02-06 15:01:20 +0100332#endif
333
Paul Bakkerddd427a2014-04-09 14:47:58 +0200334 ret = entropy_gather_internal( ctx );
Paul Bakker47703a02014-02-06 15:01:20 +0100335
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200336#if defined(MBEDTLS_THREADING_C)
337 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
338 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
Paul Bakker47703a02014-02-06 15:01:20 +0100339#endif
340
Paul Bakkerddd427a2014-04-09 14:47:58 +0200341 return( ret );
Paul Bakker47703a02014-02-06 15:01:20 +0100342}
343
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200344int mbedtls_entropy_func( void *data, unsigned char *output, size_t len )
Paul Bakker6083fd22011-12-03 21:45:14 +0000345{
Manuel Pégourié-Gonnardbf82ff02015-06-19 09:40:51 +0200346 int ret, count = 0, i, done;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200347 mbedtls_entropy_context *ctx = (mbedtls_entropy_context *) data;
348 unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE];
Paul Bakker6083fd22011-12-03 21:45:14 +0000349
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200350 if( len > MBEDTLS_ENTROPY_BLOCK_SIZE )
351 return( MBEDTLS_ERR_ENTROPY_SOURCE_FAILED );
Paul Bakker6083fd22011-12-03 21:45:14 +0000352
Paul Bakkerd5c9f6d2016-06-01 11:30:54 +0100353#if defined(MBEDTLS_ENTROPY_NV_SEED)
354 /* Update the NV entropy seed before generating any entropy for outside
355 * use.
356 */
Paul Bakkerfc9c7c82016-06-01 15:25:50 +0100357 if( ctx->initial_entropy_run == 0 )
Paul Bakkerd5c9f6d2016-06-01 11:30:54 +0100358 {
Paul Bakkerfc9c7c82016-06-01 15:25:50 +0100359 ctx->initial_entropy_run = 1;
Paul Bakkerd5c9f6d2016-06-01 11:30:54 +0100360 if( ( ret = mbedtls_entropy_update_nv_seed( ctx ) ) != 0 )
361 return( ret );
362 }
363#endif
364
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200365#if defined(MBEDTLS_THREADING_C)
366 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
Paul Bakkerf4e7dc52013-09-28 15:23:57 +0200367 return( ret );
368#endif
369
Paul Bakker6083fd22011-12-03 21:45:14 +0000370 /*
371 * Always gather extra entropy before a call
372 */
373 do
374 {
375 if( count++ > ENTROPY_MAX_LOOP )
Paul Bakkerf4e7dc52013-09-28 15:23:57 +0200376 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200377 ret = MBEDTLS_ERR_ENTROPY_SOURCE_FAILED;
Paul Bakkerf4e7dc52013-09-28 15:23:57 +0200378 goto exit;
379 }
Paul Bakker6083fd22011-12-03 21:45:14 +0000380
Paul Bakker47703a02014-02-06 15:01:20 +0100381 if( ( ret = entropy_gather_internal( ctx ) ) != 0 )
Paul Bakkerf4e7dc52013-09-28 15:23:57 +0200382 goto exit;
Paul Bakkerbd4a9d02011-12-10 17:02:19 +0000383
Manuel Pégourié-Gonnardbf82ff02015-06-19 09:40:51 +0200384 done = 1;
Paul Bakkerbd4a9d02011-12-10 17:02:19 +0000385 for( i = 0; i < ctx->source_count; i++ )
Manuel Pégourié-Gonnardbf82ff02015-06-19 09:40:51 +0200386 if( ctx->source[i].size < ctx->source[i].threshold )
387 done = 0;
Paul Bakker6083fd22011-12-03 21:45:14 +0000388 }
Manuel Pégourié-Gonnardbf82ff02015-06-19 09:40:51 +0200389 while( ! done );
Paul Bakker6083fd22011-12-03 21:45:14 +0000390
Manuel Pégourié-Gonnard54526c32019-10-03 11:06:55 +0200391 memset( buf, 0, MBEDTLS_ENTROPY_BLOCK_SIZE );
Paul Bakker6083fd22011-12-03 21:45:14 +0000392
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200393#if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
Andres Amaya Garciab2b063f2017-07-20 16:45:24 +0100394 /*
395 * Note that at this stage it is assumed that the accumulator was started
396 * in a previous call to entropy_update(). If this is not guaranteed, the
397 * code below will fail.
398 */
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100399 if( ( ret = mbedtls_sha512_finish_ret( &ctx->accumulator, buf ) ) != 0 )
Andres Amaya Garcia207cea52017-06-29 13:28:13 +0100400 goto exit;
Paul Bakker9e36f042013-06-30 14:34:05 +0200401
Paul Bakker6083fd22011-12-03 21:45:14 +0000402 /*
Paul Bakkerbd4a9d02011-12-10 17:02:19 +0000403 * Reset accumulator and counters and recycle existing entropy
Paul Bakker6083fd22011-12-03 21:45:14 +0000404 */
Andres Amaya Garciaa7559cb2017-06-29 16:12:31 +0100405 mbedtls_sha512_free( &ctx->accumulator );
406 mbedtls_sha512_init( &ctx->accumulator );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100407 if( ( ret = mbedtls_sha512_starts_ret( &ctx->accumulator, 0 ) ) != 0 )
Andres Amaya Garcia207cea52017-06-29 13:28:13 +0100408 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100409 if( ( ret = mbedtls_sha512_update_ret( &ctx->accumulator, buf,
Andres Amaya Garcia207cea52017-06-29 13:28:13 +0100410 MBEDTLS_ENTROPY_BLOCK_SIZE ) ) != 0 )
411 goto exit;
Paul Bakkerfb08fd22013-08-27 15:06:26 +0200412
413 /*
Paul Bakkerb13d3ff2014-03-26 12:51:25 +0100414 * Perform second SHA-512 on entropy
Paul Bakkerfb08fd22013-08-27 15:06:26 +0200415 */
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100416 if( ( ret = mbedtls_sha512_ret( buf, MBEDTLS_ENTROPY_BLOCK_SIZE,
Andres Amaya Garcia207cea52017-06-29 13:28:13 +0100417 buf, 0 ) ) != 0 )
418 goto exit;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200419#else /* MBEDTLS_ENTROPY_SHA512_ACCUMULATOR */
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100420 if( ( ret = mbedtls_sha256_finish_ret( &ctx->accumulator, buf ) ) != 0 )
Andres Amaya Garcia207cea52017-06-29 13:28:13 +0100421 goto exit;
Paul Bakkerfb08fd22013-08-27 15:06:26 +0200422
423 /*
424 * Reset accumulator and counters and recycle existing entropy
425 */
Andres Amaya Garciaa7559cb2017-06-29 16:12:31 +0100426 mbedtls_sha256_free( &ctx->accumulator );
427 mbedtls_sha256_init( &ctx->accumulator );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100428 if( ( ret = mbedtls_sha256_starts_ret( &ctx->accumulator, 0 ) ) != 0 )
Andres Amaya Garcia207cea52017-06-29 13:28:13 +0100429 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100430 if( ( ret = mbedtls_sha256_update_ret( &ctx->accumulator, buf,
Andres Amaya Garcia207cea52017-06-29 13:28:13 +0100431 MBEDTLS_ENTROPY_BLOCK_SIZE ) ) != 0 )
432 goto exit;
Paul Bakkerb13d3ff2014-03-26 12:51:25 +0100433
434 /*
435 * Perform second SHA-256 on entropy
436 */
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100437 if( ( ret = mbedtls_sha256_ret( buf, MBEDTLS_ENTROPY_BLOCK_SIZE,
Andres Amaya Garcia207cea52017-06-29 13:28:13 +0100438 buf, 0 ) ) != 0 )
439 goto exit;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200440#endif /* MBEDTLS_ENTROPY_SHA512_ACCUMULATOR */
Paul Bakkerbd4a9d02011-12-10 17:02:19 +0000441
442 for( i = 0; i < ctx->source_count; i++ )
443 ctx->source[i].size = 0;
Paul Bakker6083fd22011-12-03 21:45:14 +0000444
Teppo Järvelin91d79382019-10-02 09:09:31 +0300445 mbedtls_platform_memcpy( output, buf, len );
Paul Bakker6083fd22011-12-03 21:45:14 +0000446
Paul Bakkerf4e7dc52013-09-28 15:23:57 +0200447 ret = 0;
448
449exit:
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500450 mbedtls_platform_zeroize( buf, sizeof( buf ) );
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100451
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200452#if defined(MBEDTLS_THREADING_C)
453 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
454 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
Paul Bakkerf4e7dc52013-09-28 15:23:57 +0200455#endif
456
457 return( ret );
Paul Bakker6083fd22011-12-03 21:45:14 +0000458}
459
Paul Bakkerd5c9f6d2016-06-01 11:30:54 +0100460#if defined(MBEDTLS_ENTROPY_NV_SEED)
461int mbedtls_entropy_update_nv_seed( mbedtls_entropy_context *ctx )
462{
463 int ret = MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
Andres Amaya Garciaaf0b31d2017-07-05 14:23:54 +0100464 unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE];
Paul Bakkerd5c9f6d2016-06-01 11:30:54 +0100465
466 /* Read new seed and write it to NV */
467 if( ( ret = mbedtls_entropy_func( ctx, buf, MBEDTLS_ENTROPY_BLOCK_SIZE ) ) != 0 )
468 return( ret );
469
470 if( mbedtls_nv_seed_write( buf, MBEDTLS_ENTROPY_BLOCK_SIZE ) < 0 )
471 return( MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR );
472
473 /* Manually update the remaining stream with a separator value to diverge */
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +0200474 mbedtls_platform_memset( buf, 0, MBEDTLS_ENTROPY_BLOCK_SIZE );
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100475 ret = mbedtls_entropy_update_manual( ctx, buf, MBEDTLS_ENTROPY_BLOCK_SIZE );
Paul Bakkerd5c9f6d2016-06-01 11:30:54 +0100476
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100477 return( ret );
Paul Bakkerd5c9f6d2016-06-01 11:30:54 +0100478}
479#endif /* MBEDTLS_ENTROPY_NV_SEED */
480
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200481#if defined(MBEDTLS_FS_IO)
482int mbedtls_entropy_write_seed_file( mbedtls_entropy_context *ctx, const char *path )
Paul Bakker66ff70d2014-03-26 11:54:05 +0100483{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200484 int ret = MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
Paul Bakker66ff70d2014-03-26 11:54:05 +0100485 FILE *f;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200486 unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE];
Paul Bakker66ff70d2014-03-26 11:54:05 +0100487
488 if( ( f = fopen( path, "wb" ) ) == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200489 return( MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR );
Paul Bakker66ff70d2014-03-26 11:54:05 +0100490
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200491 if( ( ret = mbedtls_entropy_func( ctx, buf, MBEDTLS_ENTROPY_BLOCK_SIZE ) ) != 0 )
Paul Bakker66ff70d2014-03-26 11:54:05 +0100492 goto exit;
493
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200494 if( fwrite( buf, 1, MBEDTLS_ENTROPY_BLOCK_SIZE, f ) != MBEDTLS_ENTROPY_BLOCK_SIZE )
Paul Bakker66ff70d2014-03-26 11:54:05 +0100495 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200496 ret = MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
Paul Bakker66ff70d2014-03-26 11:54:05 +0100497 goto exit;
498 }
499
500 ret = 0;
501
502exit:
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500503 mbedtls_platform_zeroize( buf, sizeof( buf ) );
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100504
Paul Bakker66ff70d2014-03-26 11:54:05 +0100505 fclose( f );
506 return( ret );
507}
508
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200509int mbedtls_entropy_update_seed_file( mbedtls_entropy_context *ctx, const char *path )
Paul Bakker66ff70d2014-03-26 11:54:05 +0100510{
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100511 int ret = 0;
Paul Bakker66ff70d2014-03-26 11:54:05 +0100512 FILE *f;
513 size_t n;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200514 unsigned char buf[ MBEDTLS_ENTROPY_MAX_SEED_SIZE ];
Paul Bakker66ff70d2014-03-26 11:54:05 +0100515
516 if( ( f = fopen( path, "rb" ) ) == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200517 return( MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR );
Paul Bakker66ff70d2014-03-26 11:54:05 +0100518
519 fseek( f, 0, SEEK_END );
520 n = (size_t) ftell( f );
521 fseek( f, 0, SEEK_SET );
522
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200523 if( n > MBEDTLS_ENTROPY_MAX_SEED_SIZE )
524 n = MBEDTLS_ENTROPY_MAX_SEED_SIZE;
Paul Bakker66ff70d2014-03-26 11:54:05 +0100525
526 if( fread( buf, 1, n, f ) != n )
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100527 ret = MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
528 else
529 ret = mbedtls_entropy_update_manual( ctx, buf, n );
Paul Bakker66ff70d2014-03-26 11:54:05 +0100530
531 fclose( f );
532
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500533 mbedtls_platform_zeroize( buf, sizeof( buf ) );
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100534
535 if( ret != 0 )
536 return( ret );
Paul Bakker66ff70d2014-03-26 11:54:05 +0100537
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200538 return( mbedtls_entropy_write_seed_file( ctx, path ) );
Paul Bakker66ff70d2014-03-26 11:54:05 +0100539}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200540#endif /* MBEDTLS_FS_IO */
Paul Bakker66ff70d2014-03-26 11:54:05 +0100541
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200542#if defined(MBEDTLS_SELF_TEST)
Simon Butcher669c6352016-09-15 18:57:34 +0100543#if !defined(MBEDTLS_TEST_NULL_ENTROPY)
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200544/*
545 * Dummy source function
546 */
547static int entropy_dummy_source( void *data, unsigned char *output,
548 size_t len, size_t *olen )
549{
550 ((void) data);
551
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +0200552 mbedtls_platform_memset( output, 0x2a, len );
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200553 *olen = len;
554
555 return( 0 );
556}
Simon Butcher669c6352016-09-15 18:57:34 +0100557#endif /* !MBEDTLS_TEST_NULL_ENTROPY */
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200558
Andres AGe7723ec2016-08-25 10:18:50 +0100559#if defined(MBEDTLS_ENTROPY_HARDWARE_ALT)
Andres AGb34e42e2016-08-22 11:08:50 +0100560
Andres AGe7723ec2016-08-25 10:18:50 +0100561static int mbedtls_entropy_source_self_test_gather( unsigned char *buf, size_t buf_len )
562{
563 int ret = 0;
564 size_t entropy_len = 0;
565 size_t olen = 0;
566 size_t attempts = buf_len;
567
568 while( attempts > 0 && entropy_len < buf_len )
569 {
570 if( ( ret = mbedtls_hardware_poll( NULL, buf + entropy_len,
571 buf_len - entropy_len, &olen ) ) != 0 )
572 return( ret );
573
574 entropy_len += olen;
575 attempts--;
576 }
577
578 if( entropy_len < buf_len )
579 {
580 ret = 1;
581 }
582
583 return( ret );
584}
585
586
587static int mbedtls_entropy_source_self_test_check_bits( const unsigned char *buf,
588 size_t buf_len )
589{
590 unsigned char set= 0xFF;
591 unsigned char unset = 0x00;
592 size_t i;
593
594 for( i = 0; i < buf_len; i++ )
595 {
596 set &= buf[i];
597 unset |= buf[i];
598 }
599
600 return( set == 0xFF || unset == 0x00 );
601}
Andres AGb34e42e2016-08-22 11:08:50 +0100602
603/*
Andres AGe7723ec2016-08-25 10:18:50 +0100604 * A test to ensure hat the entropy sources are functioning correctly
605 * and there is no obvious failure. The test performs the following checks:
Andres AGb34e42e2016-08-22 11:08:50 +0100606 * - The entropy source is not providing only 0s (all bits unset) or 1s (all
607 * bits set).
608 * - The entropy source is not providing values in a pattern. Because the
Andres AGe7723ec2016-08-25 10:18:50 +0100609 * hardware could be providing data in an arbitrary length, this check polls
610 * the hardware entropy source twice and compares the result to ensure they
611 * are not equal.
Andres AGb34e42e2016-08-22 11:08:50 +0100612 * - The error code returned by the entropy source is not an error.
613 */
Andres AGe7723ec2016-08-25 10:18:50 +0100614int mbedtls_entropy_source_self_test( int verbose )
Andres AGb34e42e2016-08-22 11:08:50 +0100615{
616 int ret = 0;
Andres AGe7723ec2016-08-25 10:18:50 +0100617 unsigned char buf0[2 * sizeof( unsigned long long int )];
618 unsigned char buf1[2 * sizeof( unsigned long long int )];
Andres AGb34e42e2016-08-22 11:08:50 +0100619
620 if( verbose != 0 )
621 mbedtls_printf( " ENTROPY_BIAS test: " );
622
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +0200623 mbedtls_platform_memset( buf0, 0x00, sizeof( buf0 ) );
624 mbedtls_platform_memset( buf1, 0x00, sizeof( buf1 ) );
Andres AGb34e42e2016-08-22 11:08:50 +0100625
Andres AGe7723ec2016-08-25 10:18:50 +0100626 if( ( ret = mbedtls_entropy_source_self_test_gather( buf0, sizeof( buf0 ) ) ) != 0 )
Andres AGb34e42e2016-08-22 11:08:50 +0100627 goto cleanup;
Andres AGe7723ec2016-08-25 10:18:50 +0100628 if( ( ret = mbedtls_entropy_source_self_test_gather( buf1, sizeof( buf1 ) ) ) != 0 )
629 goto cleanup;
630
631 /* Make sure that the returned values are not all 0 or 1 */
632 if( ( ret = mbedtls_entropy_source_self_test_check_bits( buf0, sizeof( buf0 ) ) ) != 0 )
633 goto cleanup;
634 if( ( ret = mbedtls_entropy_source_self_test_check_bits( buf1, sizeof( buf1 ) ) ) != 0 )
635 goto cleanup;
Andres AGb34e42e2016-08-22 11:08:50 +0100636
637 /* Make sure that the entropy source is not returning values in a
638 * pattern */
Andres AGe7723ec2016-08-25 10:18:50 +0100639 ret = memcmp( buf0, buf1, sizeof( buf0 ) ) == 0;
Andres AGb34e42e2016-08-22 11:08:50 +0100640
641cleanup:
Andres AGb34e42e2016-08-22 11:08:50 +0100642 if( verbose != 0 )
643 {
644 if( ret != 0 )
645 mbedtls_printf( "failed\n" );
646 else
647 mbedtls_printf( "passed\n" );
648
649 mbedtls_printf( "\n" );
650 }
651
652 return( ret != 0 );
653}
Andres AGe7723ec2016-08-25 10:18:50 +0100654
655#endif /* MBEDTLS_ENTROPY_HARDWARE_ALT */
Andres AGb34e42e2016-08-22 11:08:50 +0100656
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200657/*
658 * The actual entropy quality is hard to test, but we can at least
659 * test that the functions don't cause errors and write the correct
660 * amount of data to buffers.
661 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200662int mbedtls_entropy_self_test( int verbose )
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200663{
Andres Amaya Garciaa928e672016-09-13 13:30:02 +0100664 int ret = 1;
Simon Butcher669c6352016-09-15 18:57:34 +0100665#if !defined(MBEDTLS_TEST_NULL_ENTROPY)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200666 mbedtls_entropy_context ctx;
667 unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE] = { 0 };
668 unsigned char acc[MBEDTLS_ENTROPY_BLOCK_SIZE] = { 0 };
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200669 size_t i, j;
Simon Butcher669c6352016-09-15 18:57:34 +0100670#endif /* !MBEDTLS_TEST_NULL_ENTROPY */
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200671
672 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200673 mbedtls_printf( " ENTROPY test: " );
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200674
Andres Amaya Garciaa928e672016-09-13 13:30:02 +0100675#if !defined(MBEDTLS_TEST_NULL_ENTROPY)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200676 mbedtls_entropy_init( &ctx );
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200677
Manuel Pégourié-Gonnard7580ba42015-06-19 10:26:32 +0200678 /* First do a gather to make sure we have default sources */
Manuel Pégourié-Gonnarde94bfe62015-05-14 13:57:50 +0200679 if( ( ret = mbedtls_entropy_gather( &ctx ) ) != 0 )
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200680 goto cleanup;
681
Manuel Pégourié-Gonnard7580ba42015-06-19 10:26:32 +0200682 ret = mbedtls_entropy_add_source( &ctx, entropy_dummy_source, NULL, 16,
683 MBEDTLS_ENTROPY_SOURCE_WEAK );
Manuel Pégourié-Gonnarde94bfe62015-05-14 13:57:50 +0200684 if( ret != 0 )
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200685 goto cleanup;
686
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200687 if( ( ret = mbedtls_entropy_update_manual( &ctx, buf, sizeof buf ) ) != 0 )
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200688 goto cleanup;
689
690 /*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200691 * To test that mbedtls_entropy_func writes correct number of bytes:
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200692 * - use the whole buffer and rely on ASan to detect overruns
693 * - collect entropy 8 times and OR the result in an accumulator:
694 * any byte should then be 0 with probably 2^(-64), so requiring
695 * each of the 32 or 64 bytes to be non-zero has a false failure rate
696 * of at most 2^(-58) which is acceptable.
697 */
698 for( i = 0; i < 8; i++ )
699 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200700 if( ( ret = mbedtls_entropy_func( &ctx, buf, sizeof( buf ) ) ) != 0 )
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200701 goto cleanup;
702
703 for( j = 0; j < sizeof( buf ); j++ )
704 acc[j] |= buf[j];
705 }
706
707 for( j = 0; j < sizeof( buf ); j++ )
708 {
709 if( acc[j] == 0 )
710 {
711 ret = 1;
712 goto cleanup;
713 }
714 }
715
Andres AGe7723ec2016-08-25 10:18:50 +0100716#if defined(MBEDTLS_ENTROPY_HARDWARE_ALT)
717 if( ( ret = mbedtls_entropy_source_self_test( 0 ) ) != 0 )
718 goto cleanup;
719#endif
720
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200721cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200722 mbedtls_entropy_free( &ctx );
Andres Amaya Garciaa928e672016-09-13 13:30:02 +0100723#endif /* !MBEDTLS_TEST_NULL_ENTROPY */
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200724
725 if( verbose != 0 )
726 {
727 if( ret != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200728 mbedtls_printf( "failed\n" );
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200729 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200730 mbedtls_printf( "passed\n" );
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200731
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200732 mbedtls_printf( "\n" );
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200733 }
734
735 return( ret != 0 );
736}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200737#endif /* MBEDTLS_SELF_TEST */
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200738
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200739#endif /* MBEDTLS_ENTROPY_C */