blob: 1bd6ce54eea23d4a10928378391f65517fb551c7 [file] [log] [blame]
Paul Bakker6083fd22011-12-03 21:45:14 +00001/*
2 * Entropy accumulator implementation
3 *
Paul Bakker9988d6b2016-06-01 11:29:42 +01004 * Copyright (C) 2006-2016, ARM Limited, All Rights Reserved
Bence Szépkútif744bd72020-06-05 13:02:18 +02005 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
6 *
7 * This file is provided under the Apache License 2.0, or the
8 * GNU General Public License v2.0 or later.
9 *
10 * **********
11 * Apache License 2.0:
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +020012 *
13 * Licensed under the Apache License, Version 2.0 (the "License"); you may
14 * not use this file except in compliance with the License.
15 * You may obtain a copy of the License at
16 *
17 * http://www.apache.org/licenses/LICENSE-2.0
18 *
19 * Unless required by applicable law or agreed to in writing, software
20 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
21 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
22 * See the License for the specific language governing permissions and
23 * limitations under the License.
Paul Bakker6083fd22011-12-03 21:45:14 +000024 *
Bence Szépkútif744bd72020-06-05 13:02:18 +020025 * **********
26 *
27 * **********
28 * GNU General Public License v2.0 or later:
29 *
30 * This program is free software; you can redistribute it and/or modify
31 * it under the terms of the GNU General Public License as published by
32 * the Free Software Foundation; either version 2 of the License, or
33 * (at your option) any later version.
34 *
35 * This program is distributed in the hope that it will be useful,
36 * but WITHOUT ANY WARRANTY; without even the implied warranty of
37 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
38 * GNU General Public License for more details.
39 *
40 * You should have received a copy of the GNU General Public License along
41 * with this program; if not, write to the Free Software Foundation, Inc.,
42 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
43 *
44 * **********
45 *
Manuel Pégourié-Gonnardfe446432015-03-06 13:17:10 +000046 * This file is part of mbed TLS (https://tls.mbed.org)
Paul Bakker6083fd22011-12-03 21:45:14 +000047 */
48
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020049#if !defined(MBEDTLS_CONFIG_FILE)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000050#include "mbedtls/config.h"
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020051#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020052#include MBEDTLS_CONFIG_FILE
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020053#endif
Paul Bakker6083fd22011-12-03 21:45:14 +000054
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020055#if defined(MBEDTLS_ENTROPY_C)
Paul Bakker6083fd22011-12-03 21:45:14 +000056
Simon Butcherab5df402016-06-11 02:31:21 +010057#if defined(MBEDTLS_TEST_NULL_ENTROPY)
Simon Butcher1ceab6e2016-06-21 10:14:00 +010058#warning "**** WARNING! MBEDTLS_TEST_NULL_ENTROPY defined! "
59#warning "**** THIS BUILD HAS NO DEFINED ENTROPY SOURCES "
60#warning "**** THIS BUILD IS *NOT* SUITABLE FOR PRODUCTION USE "
Simon Butcherab5df402016-06-11 02:31:21 +010061#endif
62
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000063#include "mbedtls/entropy.h"
64#include "mbedtls/entropy_poll.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050065#include "mbedtls/platform_util.h"
Paul Bakker6083fd22011-12-03 21:45:14 +000066
Rich Evans00ab4702015-02-06 13:43:58 +000067#include <string.h>
68
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020069#if defined(MBEDTLS_FS_IO)
Paul Bakker66ff70d2014-03-26 11:54:05 +010070#include <stdio.h>
71#endif
72
Paul Bakker217efbc2016-07-14 14:30:03 +010073#if defined(MBEDTLS_ENTROPY_NV_SEED)
74#include "mbedtls/platform.h"
75#endif
76
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020077#if defined(MBEDTLS_SELF_TEST)
78#if defined(MBEDTLS_PLATFORM_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000079#include "mbedtls/platform.h"
Rich Evans00ab4702015-02-06 13:43:58 +000080#else
81#include <stdio.h>
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020082#define mbedtls_printf printf
83#endif /* MBEDTLS_PLATFORM_C */
84#endif /* MBEDTLS_SELF_TEST */
Rich Evans00ab4702015-02-06 13:43:58 +000085
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020086#if defined(MBEDTLS_HAVEGE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000087#include "mbedtls/havege.h"
Paul Bakker28c7e7f2011-12-15 19:49:30 +000088#endif
89
Paul Bakker6083fd22011-12-03 21:45:14 +000090#define ENTROPY_MAX_LOOP 256 /**< Maximum amount to loop before error */
91
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020092void mbedtls_entropy_init( mbedtls_entropy_context *ctx )
Paul Bakker6083fd22011-12-03 21:45:14 +000093{
Andres Amaya Garciaa7559cb2017-06-29 16:12:31 +010094 ctx->source_count = 0;
95 memset( ctx->source, 0, sizeof( ctx->source ) );
Paul Bakker6083fd22011-12-03 21:45:14 +000096
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020097#if defined(MBEDTLS_THREADING_C)
98 mbedtls_mutex_init( &ctx->mutex );
Paul Bakkerf4e7dc52013-09-28 15:23:57 +020099#endif
100
Andres Amaya Garcia95869c42017-06-29 16:31:44 +0100101 ctx->accumulator_started = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200102#if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
Andres Amaya Garciaa7559cb2017-06-29 16:12:31 +0100103 mbedtls_sha512_init( &ctx->accumulator );
Paul Bakkerfb08fd22013-08-27 15:06:26 +0200104#else
Andres Amaya Garciaa7559cb2017-06-29 16:12:31 +0100105 mbedtls_sha256_init( &ctx->accumulator );
Paul Bakkerfb08fd22013-08-27 15:06:26 +0200106#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200107#if defined(MBEDTLS_HAVEGE_C)
108 mbedtls_havege_init( &ctx->havege_data );
Paul Bakker43655f42011-12-15 20:11:16 +0000109#endif
Paul Bakker6083fd22011-12-03 21:45:14 +0000110
Hanno Beckerd4a872e2017-09-07 08:09:33 +0100111 /* Reminder: Update ENTROPY_HAVE_STRONG in the test files
Hanno Becker47deec42017-07-24 12:27:09 +0100112 * when adding more strong entropy sources here. */
Hanno Beckerc6deafc2017-07-23 14:06:42 +0100113
Simon Butcherab5df402016-06-11 02:31:21 +0100114#if defined(MBEDTLS_TEST_NULL_ENTROPY)
Simon Butcher4157b602016-06-12 00:31:33 +0100115 mbedtls_entropy_add_source( ctx, mbedtls_null_entropy_poll, NULL,
Janos Follath53de7842016-06-08 15:29:18 +0100116 1, MBEDTLS_ENTROPY_SOURCE_STRONG );
117#endif
118
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200119#if !defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES)
120#if !defined(MBEDTLS_NO_PLATFORM_ENTROPY)
121 mbedtls_entropy_add_source( ctx, mbedtls_platform_entropy_poll, NULL,
Manuel Pégourié-Gonnard7580ba42015-06-19 10:26:32 +0200122 MBEDTLS_ENTROPY_MIN_PLATFORM,
123 MBEDTLS_ENTROPY_SOURCE_STRONG );
Paul Bakker6083fd22011-12-03 21:45:14 +0000124#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200125#if defined(MBEDTLS_TIMING_C)
Manuel Pégourié-Gonnard7580ba42015-06-19 10:26:32 +0200126 mbedtls_entropy_add_source( ctx, mbedtls_hardclock_poll, NULL,
127 MBEDTLS_ENTROPY_MIN_HARDCLOCK,
128 MBEDTLS_ENTROPY_SOURCE_WEAK );
Paul Bakker6083fd22011-12-03 21:45:14 +0000129#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200130#if defined(MBEDTLS_HAVEGE_C)
131 mbedtls_entropy_add_source( ctx, mbedtls_havege_poll, &ctx->havege_data,
Manuel Pégourié-Gonnard7580ba42015-06-19 10:26:32 +0200132 MBEDTLS_ENTROPY_MIN_HAVEGE,
133 MBEDTLS_ENTROPY_SOURCE_STRONG );
Paul Bakker28c7e7f2011-12-15 19:49:30 +0000134#endif
Manuel Pégourié-Gonnard3f77dfb2015-06-19 10:06:21 +0200135#if defined(MBEDTLS_ENTROPY_HARDWARE_ALT)
Manuel Pégourié-Gonnardfc2ccfe2015-07-10 11:15:50 +0100136 mbedtls_entropy_add_source( ctx, mbedtls_hardware_poll, NULL,
Manuel Pégourié-Gonnard7580ba42015-06-19 10:26:32 +0200137 MBEDTLS_ENTROPY_MIN_HARDWARE,
138 MBEDTLS_ENTROPY_SOURCE_STRONG );
Manuel Pégourié-Gonnard3f77dfb2015-06-19 10:06:21 +0200139#endif
Paul Bakker9988d6b2016-06-01 11:29:42 +0100140#if defined(MBEDTLS_ENTROPY_NV_SEED)
141 mbedtls_entropy_add_source( ctx, mbedtls_nv_seed_poll, NULL,
142 MBEDTLS_ENTROPY_BLOCK_SIZE,
143 MBEDTLS_ENTROPY_SOURCE_STRONG );
Andres Amaya Garciaa7559cb2017-06-29 16:12:31 +0100144 ctx->initial_entropy_run = 0;
Paul Bakker9988d6b2016-06-01 11:29:42 +0100145#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200146#endif /* MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES */
Paul Bakker6083fd22011-12-03 21:45:14 +0000147}
148
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200149void mbedtls_entropy_free( mbedtls_entropy_context *ctx )
Paul Bakker1ffefac2013-09-28 15:23:03 +0200150{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200151#if defined(MBEDTLS_HAVEGE_C)
152 mbedtls_havege_free( &ctx->havege_data );
Paul Bakkera317a982014-06-18 16:44:11 +0200153#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200154#if defined(MBEDTLS_THREADING_C)
155 mbedtls_mutex_free( &ctx->mutex );
Paul Bakkerf4e7dc52013-09-28 15:23:57 +0200156#endif
Andres Amaya Garciaa7559cb2017-06-29 16:12:31 +0100157#if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
158 mbedtls_sha512_free( &ctx->accumulator );
159#else
160 mbedtls_sha256_free( &ctx->accumulator );
161#endif
162#if defined(MBEDTLS_ENTROPY_NV_SEED)
163 ctx->initial_entropy_run = 0;
164#endif
165 ctx->source_count = 0;
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500166 mbedtls_platform_zeroize( ctx->source, sizeof( ctx->source ) );
Andres Amaya Garcia95869c42017-06-29 16:31:44 +0100167 ctx->accumulator_started = 0;
Paul Bakker1ffefac2013-09-28 15:23:03 +0200168}
169
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200170int mbedtls_entropy_add_source( mbedtls_entropy_context *ctx,
171 mbedtls_entropy_f_source_ptr f_source, void *p_source,
Manuel Pégourié-Gonnard7580ba42015-06-19 10:26:32 +0200172 size_t threshold, int strong )
Paul Bakker6083fd22011-12-03 21:45:14 +0000173{
Hanno Becker61937d42017-04-26 15:01:23 +0100174 int idx, ret = 0;
Paul Bakkerbd4a9d02011-12-10 17:02:19 +0000175
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200176#if defined(MBEDTLS_THREADING_C)
177 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
Paul Bakker47703a02014-02-06 15:01:20 +0100178 return( ret );
179#endif
180
Hanno Becker61937d42017-04-26 15:01:23 +0100181 idx = ctx->source_count;
182 if( idx >= MBEDTLS_ENTROPY_MAX_SOURCES )
Paul Bakker47703a02014-02-06 15:01:20 +0100183 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200184 ret = MBEDTLS_ERR_ENTROPY_MAX_SOURCES;
Paul Bakker47703a02014-02-06 15:01:20 +0100185 goto exit;
186 }
Paul Bakker6083fd22011-12-03 21:45:14 +0000187
Hanno Becker61937d42017-04-26 15:01:23 +0100188 ctx->source[idx].f_source = f_source;
189 ctx->source[idx].p_source = p_source;
190 ctx->source[idx].threshold = threshold;
191 ctx->source[idx].strong = strong;
Paul Bakker6083fd22011-12-03 21:45:14 +0000192
193 ctx->source_count++;
194
Paul Bakker47703a02014-02-06 15:01:20 +0100195exit:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200196#if defined(MBEDTLS_THREADING_C)
197 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
198 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
Paul Bakker47703a02014-02-06 15:01:20 +0100199#endif
200
201 return( ret );
Paul Bakker6083fd22011-12-03 21:45:14 +0000202}
203
204/*
205 * Entropy accumulator update
206 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200207static int entropy_update( mbedtls_entropy_context *ctx, unsigned char source_id,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200208 const unsigned char *data, size_t len )
Paul Bakker6083fd22011-12-03 21:45:14 +0000209{
210 unsigned char header[2];
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200211 unsigned char tmp[MBEDTLS_ENTROPY_BLOCK_SIZE];
Paul Bakker6083fd22011-12-03 21:45:14 +0000212 size_t use_len = len;
213 const unsigned char *p = data;
Jaeden Amero66954e12018-01-25 16:05:54 +0000214 int ret = 0;
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200215
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200216 if( use_len > MBEDTLS_ENTROPY_BLOCK_SIZE )
Paul Bakker6083fd22011-12-03 21:45:14 +0000217 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200218#if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100219 if( ( ret = mbedtls_sha512_ret( data, len, tmp, 0 ) ) != 0 )
Jaeden Amero66954e12018-01-25 16:05:54 +0000220 goto cleanup;
Paul Bakkerfb08fd22013-08-27 15:06:26 +0200221#else
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100222 if( ( ret = mbedtls_sha256_ret( data, len, tmp, 0 ) ) != 0 )
Jaeden Amero66954e12018-01-25 16:05:54 +0000223 goto cleanup;
Paul Bakkerfb08fd22013-08-27 15:06:26 +0200224#endif
Paul Bakker6083fd22011-12-03 21:45:14 +0000225 p = tmp;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200226 use_len = MBEDTLS_ENTROPY_BLOCK_SIZE;
Paul Bakker6083fd22011-12-03 21:45:14 +0000227 }
228
229 header[0] = source_id;
230 header[1] = use_len & 0xFF;
231
Andres Amaya Garcia95869c42017-06-29 16:31:44 +0100232 /*
233 * Start the accumulator if this has not already happened. Note that
234 * it is sufficient to start the accumulator here only because all calls to
235 * gather entropy eventually execute this code.
236 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200237#if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
Andres Amaya Garcia95869c42017-06-29 16:31:44 +0100238 if( ctx->accumulator_started == 0 &&
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100239 ( ret = mbedtls_sha512_starts_ret( &ctx->accumulator, 0 ) ) != 0 )
Jaeden Amero66954e12018-01-25 16:05:54 +0000240 goto cleanup;
Andres Amaya Garcia95869c42017-06-29 16:31:44 +0100241 else
242 ctx->accumulator_started = 1;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100243 if( ( ret = mbedtls_sha512_update_ret( &ctx->accumulator, header, 2 ) ) != 0 )
Jaeden Amero66954e12018-01-25 16:05:54 +0000244 goto cleanup;
245 ret = mbedtls_sha512_update_ret( &ctx->accumulator, p, use_len );
Paul Bakkerfb08fd22013-08-27 15:06:26 +0200246#else
Andres Amaya Garcia95869c42017-06-29 16:31:44 +0100247 if( ctx->accumulator_started == 0 &&
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100248 ( ret = mbedtls_sha256_starts_ret( &ctx->accumulator, 0 ) ) != 0 )
Jaeden Amero66954e12018-01-25 16:05:54 +0000249 goto cleanup;
Andres Amaya Garcia95869c42017-06-29 16:31:44 +0100250 else
251 ctx->accumulator_started = 1;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100252 if( ( ret = mbedtls_sha256_update_ret( &ctx->accumulator, header, 2 ) ) != 0 )
Jaeden Amero66954e12018-01-25 16:05:54 +0000253 goto cleanup;
254 ret = mbedtls_sha256_update_ret( &ctx->accumulator, p, use_len );
Paul Bakkerfb08fd22013-08-27 15:06:26 +0200255#endif
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200256
Jaeden Amero66954e12018-01-25 16:05:54 +0000257cleanup:
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500258 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
Andres Amaya Garcia65121932017-07-05 15:45:47 +0100259
Jaeden Amero66954e12018-01-25 16:05:54 +0000260 return( ret );
Paul Bakker6083fd22011-12-03 21:45:14 +0000261}
262
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200263int mbedtls_entropy_update_manual( mbedtls_entropy_context *ctx,
Paul Bakker6083fd22011-12-03 21:45:14 +0000264 const unsigned char *data, size_t len )
265{
Paul Bakker47703a02014-02-06 15:01:20 +0100266 int ret;
267
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200268#if defined(MBEDTLS_THREADING_C)
269 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
Paul Bakker47703a02014-02-06 15:01:20 +0100270 return( ret );
271#endif
272
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200273 ret = entropy_update( ctx, MBEDTLS_ENTROPY_SOURCE_MANUAL, data, len );
Paul Bakker47703a02014-02-06 15:01:20 +0100274
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200275#if defined(MBEDTLS_THREADING_C)
276 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
277 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
Paul Bakker47703a02014-02-06 15:01:20 +0100278#endif
279
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200280 return( ret );
Paul Bakker6083fd22011-12-03 21:45:14 +0000281}
282
283/*
284 * Run through the different sources to add entropy to our accumulator
285 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200286static int entropy_gather_internal( mbedtls_entropy_context *ctx )
Paul Bakker6083fd22011-12-03 21:45:14 +0000287{
Manuel Pégourié-Gonnard7580ba42015-06-19 10:26:32 +0200288 int ret, i, have_one_strong = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200289 unsigned char buf[MBEDTLS_ENTROPY_MAX_GATHER];
Paul Bakker6083fd22011-12-03 21:45:14 +0000290 size_t olen;
Paul Bakker47703a02014-02-06 15:01:20 +0100291
Paul Bakker43655f42011-12-15 20:11:16 +0000292 if( ctx->source_count == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200293 return( MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED );
Paul Bakker43655f42011-12-15 20:11:16 +0000294
Paul Bakker6083fd22011-12-03 21:45:14 +0000295 /*
296 * Run through our entropy sources
297 */
298 for( i = 0; i < ctx->source_count; i++ )
299 {
Manuel Pégourié-Gonnard7580ba42015-06-19 10:26:32 +0200300 if( ctx->source[i].strong == MBEDTLS_ENTROPY_SOURCE_STRONG )
301 have_one_strong = 1;
302
Paul Bakker6083fd22011-12-03 21:45:14 +0000303 olen = 0;
Paul Bakker66d5d072014-06-17 16:39:18 +0200304 if( ( ret = ctx->source[i].f_source( ctx->source[i].p_source,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200305 buf, MBEDTLS_ENTROPY_MAX_GATHER, &olen ) ) != 0 )
Paul Bakker6083fd22011-12-03 21:45:14 +0000306 {
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100307 goto cleanup;
Paul Bakker6083fd22011-12-03 21:45:14 +0000308 }
309
310 /*
311 * Add if we actually gathered something
312 */
313 if( olen > 0 )
Paul Bakkerbd4a9d02011-12-10 17:02:19 +0000314 {
Andres Amaya Garcia95869c42017-06-29 16:31:44 +0100315 if( ( ret = entropy_update( ctx, (unsigned char) i,
316 buf, olen ) ) != 0 )
317 return( ret );
Paul Bakkerbd4a9d02011-12-10 17:02:19 +0000318 ctx->source[i].size += olen;
319 }
Paul Bakker6083fd22011-12-03 21:45:14 +0000320 }
321
Manuel Pégourié-Gonnard7580ba42015-06-19 10:26:32 +0200322 if( have_one_strong == 0 )
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100323 ret = MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE;
Manuel Pégourié-Gonnard7580ba42015-06-19 10:26:32 +0200324
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100325cleanup:
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500326 mbedtls_platform_zeroize( buf, sizeof( buf ) );
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100327
328 return( ret );
Paul Bakker6083fd22011-12-03 21:45:14 +0000329}
330
Paul Bakker47703a02014-02-06 15:01:20 +0100331/*
332 * Thread-safe wrapper for entropy_gather_internal()
333 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200334int mbedtls_entropy_gather( mbedtls_entropy_context *ctx )
Paul Bakker47703a02014-02-06 15:01:20 +0100335{
Paul Bakkerddd427a2014-04-09 14:47:58 +0200336 int ret;
Paul Bakker47703a02014-02-06 15:01:20 +0100337
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200338#if defined(MBEDTLS_THREADING_C)
339 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
Paul Bakkerddd427a2014-04-09 14:47:58 +0200340 return( ret );
Paul Bakker47703a02014-02-06 15:01:20 +0100341#endif
342
Paul Bakkerddd427a2014-04-09 14:47:58 +0200343 ret = entropy_gather_internal( ctx );
Paul Bakker47703a02014-02-06 15:01:20 +0100344
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200345#if defined(MBEDTLS_THREADING_C)
346 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
347 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
Paul Bakker47703a02014-02-06 15:01:20 +0100348#endif
349
Paul Bakkerddd427a2014-04-09 14:47:58 +0200350 return( ret );
Paul Bakker47703a02014-02-06 15:01:20 +0100351}
352
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200353int mbedtls_entropy_func( void *data, unsigned char *output, size_t len )
Paul Bakker6083fd22011-12-03 21:45:14 +0000354{
Manuel Pégourié-Gonnardbf82ff02015-06-19 09:40:51 +0200355 int ret, count = 0, i, done;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200356 mbedtls_entropy_context *ctx = (mbedtls_entropy_context *) data;
357 unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE];
Paul Bakker6083fd22011-12-03 21:45:14 +0000358
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200359 if( len > MBEDTLS_ENTROPY_BLOCK_SIZE )
360 return( MBEDTLS_ERR_ENTROPY_SOURCE_FAILED );
Paul Bakker6083fd22011-12-03 21:45:14 +0000361
Paul Bakkerd5c9f6d2016-06-01 11:30:54 +0100362#if defined(MBEDTLS_ENTROPY_NV_SEED)
363 /* Update the NV entropy seed before generating any entropy for outside
364 * use.
365 */
Paul Bakkerfc9c7c82016-06-01 15:25:50 +0100366 if( ctx->initial_entropy_run == 0 )
Paul Bakkerd5c9f6d2016-06-01 11:30:54 +0100367 {
Paul Bakkerfc9c7c82016-06-01 15:25:50 +0100368 ctx->initial_entropy_run = 1;
Paul Bakkerd5c9f6d2016-06-01 11:30:54 +0100369 if( ( ret = mbedtls_entropy_update_nv_seed( ctx ) ) != 0 )
370 return( ret );
371 }
372#endif
373
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200374#if defined(MBEDTLS_THREADING_C)
375 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
Paul Bakkerf4e7dc52013-09-28 15:23:57 +0200376 return( ret );
377#endif
378
Paul Bakker6083fd22011-12-03 21:45:14 +0000379 /*
380 * Always gather extra entropy before a call
381 */
382 do
383 {
384 if( count++ > ENTROPY_MAX_LOOP )
Paul Bakkerf4e7dc52013-09-28 15:23:57 +0200385 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200386 ret = MBEDTLS_ERR_ENTROPY_SOURCE_FAILED;
Paul Bakkerf4e7dc52013-09-28 15:23:57 +0200387 goto exit;
388 }
Paul Bakker6083fd22011-12-03 21:45:14 +0000389
Paul Bakker47703a02014-02-06 15:01:20 +0100390 if( ( ret = entropy_gather_internal( ctx ) ) != 0 )
Paul Bakkerf4e7dc52013-09-28 15:23:57 +0200391 goto exit;
Paul Bakkerbd4a9d02011-12-10 17:02:19 +0000392
Manuel Pégourié-Gonnardbf82ff02015-06-19 09:40:51 +0200393 done = 1;
Paul Bakkerbd4a9d02011-12-10 17:02:19 +0000394 for( i = 0; i < ctx->source_count; i++ )
Manuel Pégourié-Gonnardbf82ff02015-06-19 09:40:51 +0200395 if( ctx->source[i].size < ctx->source[i].threshold )
396 done = 0;
Paul Bakker6083fd22011-12-03 21:45:14 +0000397 }
Manuel Pégourié-Gonnardbf82ff02015-06-19 09:40:51 +0200398 while( ! done );
Paul Bakker6083fd22011-12-03 21:45:14 +0000399
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200400 memset( buf, 0, MBEDTLS_ENTROPY_BLOCK_SIZE );
Paul Bakker6083fd22011-12-03 21:45:14 +0000401
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200402#if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
Andres Amaya Garciab2b063f2017-07-20 16:45:24 +0100403 /*
404 * Note that at this stage it is assumed that the accumulator was started
405 * in a previous call to entropy_update(). If this is not guaranteed, the
406 * code below will fail.
407 */
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100408 if( ( ret = mbedtls_sha512_finish_ret( &ctx->accumulator, buf ) ) != 0 )
Andres Amaya Garcia207cea52017-06-29 13:28:13 +0100409 goto exit;
Paul Bakker9e36f042013-06-30 14:34:05 +0200410
Paul Bakker6083fd22011-12-03 21:45:14 +0000411 /*
Paul Bakkerbd4a9d02011-12-10 17:02:19 +0000412 * Reset accumulator and counters and recycle existing entropy
Paul Bakker6083fd22011-12-03 21:45:14 +0000413 */
Andres Amaya Garciaa7559cb2017-06-29 16:12:31 +0100414 mbedtls_sha512_free( &ctx->accumulator );
415 mbedtls_sha512_init( &ctx->accumulator );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100416 if( ( ret = mbedtls_sha512_starts_ret( &ctx->accumulator, 0 ) ) != 0 )
Andres Amaya Garcia207cea52017-06-29 13:28:13 +0100417 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100418 if( ( ret = mbedtls_sha512_update_ret( &ctx->accumulator, buf,
Andres Amaya Garcia207cea52017-06-29 13:28:13 +0100419 MBEDTLS_ENTROPY_BLOCK_SIZE ) ) != 0 )
420 goto exit;
Paul Bakkerfb08fd22013-08-27 15:06:26 +0200421
422 /*
Paul Bakkerb13d3ff2014-03-26 12:51:25 +0100423 * Perform second SHA-512 on entropy
Paul Bakkerfb08fd22013-08-27 15:06:26 +0200424 */
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100425 if( ( ret = mbedtls_sha512_ret( buf, MBEDTLS_ENTROPY_BLOCK_SIZE,
Andres Amaya Garcia207cea52017-06-29 13:28:13 +0100426 buf, 0 ) ) != 0 )
427 goto exit;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200428#else /* MBEDTLS_ENTROPY_SHA512_ACCUMULATOR */
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100429 if( ( ret = mbedtls_sha256_finish_ret( &ctx->accumulator, buf ) ) != 0 )
Andres Amaya Garcia207cea52017-06-29 13:28:13 +0100430 goto exit;
Paul Bakkerfb08fd22013-08-27 15:06:26 +0200431
432 /*
433 * Reset accumulator and counters and recycle existing entropy
434 */
Andres Amaya Garciaa7559cb2017-06-29 16:12:31 +0100435 mbedtls_sha256_free( &ctx->accumulator );
436 mbedtls_sha256_init( &ctx->accumulator );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100437 if( ( ret = mbedtls_sha256_starts_ret( &ctx->accumulator, 0 ) ) != 0 )
Andres Amaya Garcia207cea52017-06-29 13:28:13 +0100438 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100439 if( ( ret = mbedtls_sha256_update_ret( &ctx->accumulator, buf,
Andres Amaya Garcia207cea52017-06-29 13:28:13 +0100440 MBEDTLS_ENTROPY_BLOCK_SIZE ) ) != 0 )
441 goto exit;
Paul Bakkerb13d3ff2014-03-26 12:51:25 +0100442
443 /*
444 * Perform second SHA-256 on entropy
445 */
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100446 if( ( ret = mbedtls_sha256_ret( buf, MBEDTLS_ENTROPY_BLOCK_SIZE,
Andres Amaya Garcia207cea52017-06-29 13:28:13 +0100447 buf, 0 ) ) != 0 )
448 goto exit;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200449#endif /* MBEDTLS_ENTROPY_SHA512_ACCUMULATOR */
Paul Bakkerbd4a9d02011-12-10 17:02:19 +0000450
451 for( i = 0; i < ctx->source_count; i++ )
452 ctx->source[i].size = 0;
Paul Bakker6083fd22011-12-03 21:45:14 +0000453
454 memcpy( output, buf, len );
455
Paul Bakkerf4e7dc52013-09-28 15:23:57 +0200456 ret = 0;
457
458exit:
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500459 mbedtls_platform_zeroize( buf, sizeof( buf ) );
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100460
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200461#if defined(MBEDTLS_THREADING_C)
462 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
463 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
Paul Bakkerf4e7dc52013-09-28 15:23:57 +0200464#endif
465
466 return( ret );
Paul Bakker6083fd22011-12-03 21:45:14 +0000467}
468
Paul Bakkerd5c9f6d2016-06-01 11:30:54 +0100469#if defined(MBEDTLS_ENTROPY_NV_SEED)
470int mbedtls_entropy_update_nv_seed( mbedtls_entropy_context *ctx )
471{
472 int ret = MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
Andres Amaya Garciaaf0b31d2017-07-05 14:23:54 +0100473 unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE];
Paul Bakkerd5c9f6d2016-06-01 11:30:54 +0100474
475 /* Read new seed and write it to NV */
476 if( ( ret = mbedtls_entropy_func( ctx, buf, MBEDTLS_ENTROPY_BLOCK_SIZE ) ) != 0 )
477 return( ret );
478
479 if( mbedtls_nv_seed_write( buf, MBEDTLS_ENTROPY_BLOCK_SIZE ) < 0 )
480 return( MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR );
481
482 /* Manually update the remaining stream with a separator value to diverge */
483 memset( buf, 0, MBEDTLS_ENTROPY_BLOCK_SIZE );
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100484 ret = mbedtls_entropy_update_manual( ctx, buf, MBEDTLS_ENTROPY_BLOCK_SIZE );
Paul Bakkerd5c9f6d2016-06-01 11:30:54 +0100485
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100486 return( ret );
Paul Bakkerd5c9f6d2016-06-01 11:30:54 +0100487}
488#endif /* MBEDTLS_ENTROPY_NV_SEED */
489
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200490#if defined(MBEDTLS_FS_IO)
491int mbedtls_entropy_write_seed_file( mbedtls_entropy_context *ctx, const char *path )
Paul Bakker66ff70d2014-03-26 11:54:05 +0100492{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200493 int ret = MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
Paul Bakker66ff70d2014-03-26 11:54:05 +0100494 FILE *f;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200495 unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE];
Paul Bakker66ff70d2014-03-26 11:54:05 +0100496
497 if( ( f = fopen( path, "wb" ) ) == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200498 return( MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR );
Paul Bakker66ff70d2014-03-26 11:54:05 +0100499
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200500 if( ( ret = mbedtls_entropy_func( ctx, buf, MBEDTLS_ENTROPY_BLOCK_SIZE ) ) != 0 )
Paul Bakker66ff70d2014-03-26 11:54:05 +0100501 goto exit;
502
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200503 if( fwrite( buf, 1, MBEDTLS_ENTROPY_BLOCK_SIZE, f ) != MBEDTLS_ENTROPY_BLOCK_SIZE )
Paul Bakker66ff70d2014-03-26 11:54:05 +0100504 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200505 ret = MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
Paul Bakker66ff70d2014-03-26 11:54:05 +0100506 goto exit;
507 }
508
509 ret = 0;
510
511exit:
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500512 mbedtls_platform_zeroize( buf, sizeof( buf ) );
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100513
Paul Bakker66ff70d2014-03-26 11:54:05 +0100514 fclose( f );
515 return( ret );
516}
517
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200518int mbedtls_entropy_update_seed_file( mbedtls_entropy_context *ctx, const char *path )
Paul Bakker66ff70d2014-03-26 11:54:05 +0100519{
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100520 int ret = 0;
Paul Bakker66ff70d2014-03-26 11:54:05 +0100521 FILE *f;
522 size_t n;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200523 unsigned char buf[ MBEDTLS_ENTROPY_MAX_SEED_SIZE ];
Paul Bakker66ff70d2014-03-26 11:54:05 +0100524
525 if( ( f = fopen( path, "rb" ) ) == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200526 return( MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR );
Paul Bakker66ff70d2014-03-26 11:54:05 +0100527
528 fseek( f, 0, SEEK_END );
529 n = (size_t) ftell( f );
530 fseek( f, 0, SEEK_SET );
531
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200532 if( n > MBEDTLS_ENTROPY_MAX_SEED_SIZE )
533 n = MBEDTLS_ENTROPY_MAX_SEED_SIZE;
Paul Bakker66ff70d2014-03-26 11:54:05 +0100534
535 if( fread( buf, 1, n, f ) != n )
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100536 ret = MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
537 else
538 ret = mbedtls_entropy_update_manual( ctx, buf, n );
Paul Bakker66ff70d2014-03-26 11:54:05 +0100539
540 fclose( f );
541
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500542 mbedtls_platform_zeroize( buf, sizeof( buf ) );
Andres Amaya Garcia1adcd952017-06-26 09:58:59 +0100543
544 if( ret != 0 )
545 return( ret );
Paul Bakker66ff70d2014-03-26 11:54:05 +0100546
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200547 return( mbedtls_entropy_write_seed_file( ctx, path ) );
Paul Bakker66ff70d2014-03-26 11:54:05 +0100548}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200549#endif /* MBEDTLS_FS_IO */
Paul Bakker66ff70d2014-03-26 11:54:05 +0100550
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200551#if defined(MBEDTLS_SELF_TEST)
Simon Butcher669c6352016-09-15 18:57:34 +0100552#if !defined(MBEDTLS_TEST_NULL_ENTROPY)
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200553/*
554 * Dummy source function
555 */
556static int entropy_dummy_source( void *data, unsigned char *output,
557 size_t len, size_t *olen )
558{
559 ((void) data);
560
561 memset( output, 0x2a, len );
562 *olen = len;
563
564 return( 0 );
565}
Simon Butcher669c6352016-09-15 18:57:34 +0100566#endif /* !MBEDTLS_TEST_NULL_ENTROPY */
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200567
Andres AGe7723ec2016-08-25 10:18:50 +0100568#if defined(MBEDTLS_ENTROPY_HARDWARE_ALT)
Andres AGb34e42e2016-08-22 11:08:50 +0100569
Andres AGe7723ec2016-08-25 10:18:50 +0100570static int mbedtls_entropy_source_self_test_gather( unsigned char *buf, size_t buf_len )
571{
572 int ret = 0;
573 size_t entropy_len = 0;
574 size_t olen = 0;
575 size_t attempts = buf_len;
576
577 while( attempts > 0 && entropy_len < buf_len )
578 {
579 if( ( ret = mbedtls_hardware_poll( NULL, buf + entropy_len,
580 buf_len - entropy_len, &olen ) ) != 0 )
581 return( ret );
582
583 entropy_len += olen;
584 attempts--;
585 }
586
587 if( entropy_len < buf_len )
588 {
589 ret = 1;
590 }
591
592 return( ret );
593}
594
595
596static int mbedtls_entropy_source_self_test_check_bits( const unsigned char *buf,
597 size_t buf_len )
598{
599 unsigned char set= 0xFF;
600 unsigned char unset = 0x00;
601 size_t i;
602
603 for( i = 0; i < buf_len; i++ )
604 {
605 set &= buf[i];
606 unset |= buf[i];
607 }
608
609 return( set == 0xFF || unset == 0x00 );
610}
Andres AGb34e42e2016-08-22 11:08:50 +0100611
612/*
Andres AGe7723ec2016-08-25 10:18:50 +0100613 * A test to ensure hat the entropy sources are functioning correctly
614 * and there is no obvious failure. The test performs the following checks:
Andres AGb34e42e2016-08-22 11:08:50 +0100615 * - The entropy source is not providing only 0s (all bits unset) or 1s (all
616 * bits set).
617 * - The entropy source is not providing values in a pattern. Because the
Andres AGe7723ec2016-08-25 10:18:50 +0100618 * hardware could be providing data in an arbitrary length, this check polls
619 * the hardware entropy source twice and compares the result to ensure they
620 * are not equal.
Andres AGb34e42e2016-08-22 11:08:50 +0100621 * - The error code returned by the entropy source is not an error.
622 */
Andres AGe7723ec2016-08-25 10:18:50 +0100623int mbedtls_entropy_source_self_test( int verbose )
Andres AGb34e42e2016-08-22 11:08:50 +0100624{
625 int ret = 0;
Andres AGe7723ec2016-08-25 10:18:50 +0100626 unsigned char buf0[2 * sizeof( unsigned long long int )];
627 unsigned char buf1[2 * sizeof( unsigned long long int )];
Andres AGb34e42e2016-08-22 11:08:50 +0100628
629 if( verbose != 0 )
630 mbedtls_printf( " ENTROPY_BIAS test: " );
631
Andres AGe7723ec2016-08-25 10:18:50 +0100632 memset( buf0, 0x00, sizeof( buf0 ) );
633 memset( buf1, 0x00, sizeof( buf1 ) );
Andres AGb34e42e2016-08-22 11:08:50 +0100634
Andres AGe7723ec2016-08-25 10:18:50 +0100635 if( ( ret = mbedtls_entropy_source_self_test_gather( buf0, sizeof( buf0 ) ) ) != 0 )
Andres AGb34e42e2016-08-22 11:08:50 +0100636 goto cleanup;
Andres AGe7723ec2016-08-25 10:18:50 +0100637 if( ( ret = mbedtls_entropy_source_self_test_gather( buf1, sizeof( buf1 ) ) ) != 0 )
638 goto cleanup;
639
640 /* Make sure that the returned values are not all 0 or 1 */
641 if( ( ret = mbedtls_entropy_source_self_test_check_bits( buf0, sizeof( buf0 ) ) ) != 0 )
642 goto cleanup;
643 if( ( ret = mbedtls_entropy_source_self_test_check_bits( buf1, sizeof( buf1 ) ) ) != 0 )
644 goto cleanup;
Andres AGb34e42e2016-08-22 11:08:50 +0100645
646 /* Make sure that the entropy source is not returning values in a
647 * pattern */
Andres AGe7723ec2016-08-25 10:18:50 +0100648 ret = memcmp( buf0, buf1, sizeof( buf0 ) ) == 0;
Andres AGb34e42e2016-08-22 11:08:50 +0100649
650cleanup:
Andres AGb34e42e2016-08-22 11:08:50 +0100651 if( verbose != 0 )
652 {
653 if( ret != 0 )
654 mbedtls_printf( "failed\n" );
655 else
656 mbedtls_printf( "passed\n" );
657
658 mbedtls_printf( "\n" );
659 }
660
661 return( ret != 0 );
662}
Andres AGe7723ec2016-08-25 10:18:50 +0100663
664#endif /* MBEDTLS_ENTROPY_HARDWARE_ALT */
Andres AGb34e42e2016-08-22 11:08:50 +0100665
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200666/*
667 * The actual entropy quality is hard to test, but we can at least
668 * test that the functions don't cause errors and write the correct
669 * amount of data to buffers.
670 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200671int mbedtls_entropy_self_test( int verbose )
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200672{
Andres Amaya Garciaa928e672016-09-13 13:30:02 +0100673 int ret = 1;
Simon Butcher669c6352016-09-15 18:57:34 +0100674#if !defined(MBEDTLS_TEST_NULL_ENTROPY)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200675 mbedtls_entropy_context ctx;
676 unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE] = { 0 };
677 unsigned char acc[MBEDTLS_ENTROPY_BLOCK_SIZE] = { 0 };
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200678 size_t i, j;
Simon Butcher669c6352016-09-15 18:57:34 +0100679#endif /* !MBEDTLS_TEST_NULL_ENTROPY */
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200680
681 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200682 mbedtls_printf( " ENTROPY test: " );
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200683
Andres Amaya Garciaa928e672016-09-13 13:30:02 +0100684#if !defined(MBEDTLS_TEST_NULL_ENTROPY)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200685 mbedtls_entropy_init( &ctx );
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200686
Manuel Pégourié-Gonnard7580ba42015-06-19 10:26:32 +0200687 /* First do a gather to make sure we have default sources */
Manuel Pégourié-Gonnarde94bfe62015-05-14 13:57:50 +0200688 if( ( ret = mbedtls_entropy_gather( &ctx ) ) != 0 )
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200689 goto cleanup;
690
Manuel Pégourié-Gonnard7580ba42015-06-19 10:26:32 +0200691 ret = mbedtls_entropy_add_source( &ctx, entropy_dummy_source, NULL, 16,
692 MBEDTLS_ENTROPY_SOURCE_WEAK );
Manuel Pégourié-Gonnarde94bfe62015-05-14 13:57:50 +0200693 if( ret != 0 )
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200694 goto cleanup;
695
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200696 if( ( ret = mbedtls_entropy_update_manual( &ctx, buf, sizeof buf ) ) != 0 )
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200697 goto cleanup;
698
699 /*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200700 * To test that mbedtls_entropy_func writes correct number of bytes:
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200701 * - use the whole buffer and rely on ASan to detect overruns
702 * - collect entropy 8 times and OR the result in an accumulator:
703 * any byte should then be 0 with probably 2^(-64), so requiring
704 * each of the 32 or 64 bytes to be non-zero has a false failure rate
705 * of at most 2^(-58) which is acceptable.
706 */
707 for( i = 0; i < 8; i++ )
708 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200709 if( ( ret = mbedtls_entropy_func( &ctx, buf, sizeof( buf ) ) ) != 0 )
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200710 goto cleanup;
711
712 for( j = 0; j < sizeof( buf ); j++ )
713 acc[j] |= buf[j];
714 }
715
716 for( j = 0; j < sizeof( buf ); j++ )
717 {
718 if( acc[j] == 0 )
719 {
720 ret = 1;
721 goto cleanup;
722 }
723 }
724
Andres AGe7723ec2016-08-25 10:18:50 +0100725#if defined(MBEDTLS_ENTROPY_HARDWARE_ALT)
726 if( ( ret = mbedtls_entropy_source_self_test( 0 ) ) != 0 )
727 goto cleanup;
728#endif
729
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200730cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200731 mbedtls_entropy_free( &ctx );
Andres Amaya Garciaa928e672016-09-13 13:30:02 +0100732#endif /* !MBEDTLS_TEST_NULL_ENTROPY */
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200733
734 if( verbose != 0 )
735 {
736 if( ret != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200737 mbedtls_printf( "failed\n" );
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200738 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200739 mbedtls_printf( "passed\n" );
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200740
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200741 mbedtls_printf( "\n" );
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200742 }
743
744 return( ret != 0 );
745}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200746#endif /* MBEDTLS_SELF_TEST */
Manuel Pégourié-Gonnard4dd73922014-05-30 10:34:15 +0200747
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200748#endif /* MBEDTLS_ENTROPY_C */