diff options
| author | Jack Lloyd <[email protected]> | 2016-07-18 15:36:27 -0400 |
|---|---|---|
| committer | Jack Lloyd <[email protected]> | 2016-07-18 15:36:27 -0400 |
| commit | e33c989417b7ad9557b02936a1a814e37bf85fcd (patch) | |
| tree | c36944002c46e7098d4ab33209c2deaca391b4c1 /src/build-data | |
| parent | 7438e0b4c85403ba6f4c864a76cd8865f9659ed3 (diff) | |
| parent | 8f2f800c7ea841fa5ab963349178ac3a9f56a513 (diff) | |
Merge GH #520 RNG changes
Adds Stateful_RNG base class which handles reseeding after some
amount of output (configurable at instantiation time, defaults to
the build.h value) as well as detecting forks (just using pid
comparisons, so still vulnerable to pid wraparound). Implemented
by HMAC_RNG and HMAC_DRBG. I did not update X9.31 since its
underlying RNG should already be fork safe and handle reseeding
at the appropriate time, since a new block is taken from the
underlying RNG (for the datetime vector) for each block of
output.
Adds RNG::randomize_with_input which for most PRNGs is just a
call to add_entropy followed by randomize. However for HMAC_DRBG
it is used for additional input. Adds tests for HMAC_DRBG with AD
from the CAVS file.
RNG::add_entropy is implemented by System_RNG now, as both
CryptGenRandom and /dev/urandom support receiving application
provided data.
The AutoSeeded_RNG underlying type is currently selectable in
build.h and defaults to HMAC_DRBG(SHA-256). AutoSeeded_RNG
provides additional input with each output request, consisting of
the current pid, a counter, and timestamp (unless the application
explicitly calls randomize_with_input, in which case we just take
what they provided). This is the same hedge used in HMAC_RNGs
output PRF.
AutoSeeded_RNG is part of the base library now and cannot be
compiled out.
Removes Entropy_Accumulator type (which just served to bridge
between the RNG and the entropy source), instead the
Entropy_Source is passed a reference to the RNG being reseeded,
and it can call add_entropy on whatever it can come up with.
Diffstat (limited to 'src/build-data')
| -rw-r--r-- | src/build-data/buildh.in | 14 | ||||
| -rw-r--r-- | src/build-data/policy/bsi.txt | 1 | ||||
| -rw-r--r-- | src/build-data/policy/modern.txt | 2 |
3 files changed, 12 insertions, 5 deletions
diff --git a/src/build-data/buildh.in b/src/build-data/buildh.in index d6201be19..222d7cab0 100644 --- a/src/build-data/buildh.in +++ b/src/build-data/buildh.in @@ -99,13 +99,21 @@ /* * RNGs will automatically poll the system for additional seed material -* after producing this many bytes of output. +* after producing this many bytes of output. Set to zero to disable +* automatic reseeding. */ -#define BOTAN_RNG_MAX_OUTPUT_BEFORE_RESEED 4096 -#define BOTAN_RNG_RESEED_POLL_BITS 128 +#define BOTAN_RNG_DEFAULT_MAX_OUTPUT_BEFORE_RESEED 16384 +#define BOTAN_RNG_RESEED_POLL_BITS 256 #define BOTAN_RNG_AUTO_RESEED_TIMEOUT std::chrono::milliseconds(10) #define BOTAN_RNG_RESEED_DEFAULT_TIMEOUT std::chrono::milliseconds(50) +/** +* Controls how AutoSeeded_RNG is instantiated +*/ +#define BOTAN_AUTO_RNG_DRBG HMAC_DRBG +#define BOTAN_AUTO_RNG_HASH "SHA-256" +#define BOTAN_AUTO_RNG_ENTROPY_TARGET 256 + /* * Specifies (in order) the list of entropy sources that will be used * to seed an in-memory RNG. The first few in the default list diff --git a/src/build-data/policy/bsi.txt b/src/build-data/policy/bsi.txt index 5e3c5b921..2ae2ac3b2 100644 --- a/src/build-data/policy/bsi.txt +++ b/src/build-data/policy/bsi.txt @@ -41,7 +41,6 @@ eckcdsa ecdh # rng -auto_rng hmac_rng hmac_drbg </required> diff --git a/src/build-data/policy/modern.txt b/src/build-data/policy/modern.txt index f0b6934f0..5a8a2f126 100644 --- a/src/build-data/policy/modern.txt +++ b/src/build-data/policy/modern.txt @@ -38,8 +38,8 @@ eme_oaep emsa_pssr emsa1 -auto_rng hmac_rng +hmac_drbg ffi </required> |