Subversion Repositories Kolibri OS

Rev

Blame | Last modification | View Log | Download | RSS feed

  1. /*
  2.  *  CTR_DRBG implementation based on AES-256 (NIST SP 800-90)
  3.  *
  4.  *  Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
  5.  *  SPDX-License-Identifier: GPL-2.0
  6.  *
  7.  *  This program is free software; you can redistribute it and/or modify
  8.  *  it under the terms of the GNU General Public License as published by
  9.  *  the Free Software Foundation; either version 2 of the License, or
  10.  *  (at your option) any later version.
  11.  *
  12.  *  This program is distributed in the hope that it will be useful,
  13.  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14.  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15.  *  GNU General Public License for more details.
  16.  *
  17.  *  You should have received a copy of the GNU General Public License along
  18.  *  with this program; if not, write to the Free Software Foundation, Inc.,
  19.  *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  20.  *
  21.  *  This file is part of mbed TLS (https://tls.mbed.org)
  22.  */
  23. /*
  24.  *  The NIST SP 800-90 DRBGs are described in the following publication.
  25.  *
  26.  *  http://csrc.nist.gov/publications/nistpubs/800-90/SP800-90revised_March2007.pdf
  27.  */
  28.  
  29. #if !defined(MBEDTLS_CONFIG_FILE)
  30. #include "mbedtls/config.h"
  31. #else
  32. #include MBEDTLS_CONFIG_FILE
  33. #endif
  34.  
  35. #if defined(MBEDTLS_CTR_DRBG_C)
  36.  
  37. #include "mbedtls/ctr_drbg.h"
  38. #include "mbedtls/platform_util.h"
  39.  
  40. #include <string.h>
  41.  
  42. #if defined(MBEDTLS_FS_IO)
  43. #include <stdio.h>
  44. #endif
  45.  
  46. #if defined(MBEDTLS_SELF_TEST)
  47. #if defined(MBEDTLS_PLATFORM_C)
  48. #include "mbedtls/platform.h"
  49. #else
  50. #include <stdio.h>
  51. #define mbedtls_printf printf
  52. #endif /* MBEDTLS_PLATFORM_C */
  53. #endif /* MBEDTLS_SELF_TEST */
  54.  
  55. /*
  56.  * CTR_DRBG context initialization
  57.  */
  58. void mbedtls_ctr_drbg_init( mbedtls_ctr_drbg_context *ctx )
  59. {
  60.     memset( ctx, 0, sizeof( mbedtls_ctr_drbg_context ) );
  61.  
  62. #if defined(MBEDTLS_THREADING_C)
  63.     mbedtls_mutex_init( &ctx->mutex );
  64. #endif
  65. }
  66.  
  67. void mbedtls_ctr_drbg_free( mbedtls_ctr_drbg_context *ctx )
  68. {
  69.     if( ctx == NULL )
  70.         return;
  71.  
  72. #if defined(MBEDTLS_THREADING_C)
  73.     mbedtls_mutex_free( &ctx->mutex );
  74. #endif
  75.     mbedtls_aes_free( &ctx->aes_ctx );
  76.     mbedtls_platform_zeroize( ctx, sizeof( mbedtls_ctr_drbg_context ) );
  77. }
  78.  
  79. void mbedtls_ctr_drbg_set_prediction_resistance( mbedtls_ctr_drbg_context *ctx, int resistance )
  80. {
  81.     ctx->prediction_resistance = resistance;
  82. }
  83.  
  84. void mbedtls_ctr_drbg_set_entropy_len( mbedtls_ctr_drbg_context *ctx, size_t len )
  85. {
  86.     ctx->entropy_len = len;
  87. }
  88.  
  89. void mbedtls_ctr_drbg_set_reseed_interval( mbedtls_ctr_drbg_context *ctx, int interval )
  90. {
  91.     ctx->reseed_interval = interval;
  92. }
  93.  
  94. static int block_cipher_df( unsigned char *output,
  95.                             const unsigned char *data, size_t data_len )
  96. {
  97.     unsigned char buf[MBEDTLS_CTR_DRBG_MAX_SEED_INPUT + MBEDTLS_CTR_DRBG_BLOCKSIZE + 16];
  98.     unsigned char tmp[MBEDTLS_CTR_DRBG_SEEDLEN];
  99.     unsigned char key[MBEDTLS_CTR_DRBG_KEYSIZE];
  100.     unsigned char chain[MBEDTLS_CTR_DRBG_BLOCKSIZE];
  101.     unsigned char *p, *iv;
  102.     mbedtls_aes_context aes_ctx;
  103.     int ret = 0;
  104.  
  105.     int i, j;
  106.     size_t buf_len, use_len;
  107.  
  108.     if( data_len > MBEDTLS_CTR_DRBG_MAX_SEED_INPUT )
  109.         return( MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG );
  110.  
  111.     memset( buf, 0, MBEDTLS_CTR_DRBG_MAX_SEED_INPUT + MBEDTLS_CTR_DRBG_BLOCKSIZE + 16 );
  112.     mbedtls_aes_init( &aes_ctx );
  113.  
  114.     /*
  115.      * Construct IV (16 bytes) and S in buffer
  116.      * IV = Counter (in 32-bits) padded to 16 with zeroes
  117.      * S = Length input string (in 32-bits) || Length of output (in 32-bits) ||
  118.      *     data || 0x80
  119.      *     (Total is padded to a multiple of 16-bytes with zeroes)
  120.      */
  121.     p = buf + MBEDTLS_CTR_DRBG_BLOCKSIZE;
  122.     *p++ = ( data_len >> 24 ) & 0xff;
  123.     *p++ = ( data_len >> 16 ) & 0xff;
  124.     *p++ = ( data_len >> 8  ) & 0xff;
  125.     *p++ = ( data_len       ) & 0xff;
  126.     p += 3;
  127.     *p++ = MBEDTLS_CTR_DRBG_SEEDLEN;
  128.     memcpy( p, data, data_len );
  129.     p[data_len] = 0x80;
  130.  
  131.     buf_len = MBEDTLS_CTR_DRBG_BLOCKSIZE + 8 + data_len + 1;
  132.  
  133.     for( i = 0; i < MBEDTLS_CTR_DRBG_KEYSIZE; i++ )
  134.         key[i] = i;
  135.  
  136.     if( ( ret = mbedtls_aes_setkey_enc( &aes_ctx, key, MBEDTLS_CTR_DRBG_KEYBITS ) ) != 0 )
  137.     {
  138.         goto exit;
  139.     }
  140.  
  141.     /*
  142.      * Reduce data to MBEDTLS_CTR_DRBG_SEEDLEN bytes of data
  143.      */
  144.     for( j = 0; j < MBEDTLS_CTR_DRBG_SEEDLEN; j += MBEDTLS_CTR_DRBG_BLOCKSIZE )
  145.     {
  146.         p = buf;
  147.         memset( chain, 0, MBEDTLS_CTR_DRBG_BLOCKSIZE );
  148.         use_len = buf_len;
  149.  
  150.         while( use_len > 0 )
  151.         {
  152.             for( i = 0; i < MBEDTLS_CTR_DRBG_BLOCKSIZE; i++ )
  153.                 chain[i] ^= p[i];
  154.             p += MBEDTLS_CTR_DRBG_BLOCKSIZE;
  155.             use_len -= ( use_len >= MBEDTLS_CTR_DRBG_BLOCKSIZE ) ?
  156.                        MBEDTLS_CTR_DRBG_BLOCKSIZE : use_len;
  157.  
  158.             if( ( ret = mbedtls_aes_crypt_ecb( &aes_ctx, MBEDTLS_AES_ENCRYPT, chain, chain ) ) != 0 )
  159.             {
  160.                 goto exit;
  161.             }
  162.         }
  163.  
  164.         memcpy( tmp + j, chain, MBEDTLS_CTR_DRBG_BLOCKSIZE );
  165.  
  166.         /*
  167.          * Update IV
  168.          */
  169.         buf[3]++;
  170.     }
  171.  
  172.     /*
  173.      * Do final encryption with reduced data
  174.      */
  175.     if( ( ret = mbedtls_aes_setkey_enc( &aes_ctx, tmp, MBEDTLS_CTR_DRBG_KEYBITS ) ) != 0 )
  176.     {
  177.         goto exit;
  178.     }
  179.     iv = tmp + MBEDTLS_CTR_DRBG_KEYSIZE;
  180.     p = output;
  181.  
  182.     for( j = 0; j < MBEDTLS_CTR_DRBG_SEEDLEN; j += MBEDTLS_CTR_DRBG_BLOCKSIZE )
  183.     {
  184.         if( ( ret = mbedtls_aes_crypt_ecb( &aes_ctx, MBEDTLS_AES_ENCRYPT, iv, iv ) ) != 0 )
  185.         {
  186.             goto exit;
  187.         }
  188.         memcpy( p, iv, MBEDTLS_CTR_DRBG_BLOCKSIZE );
  189.         p += MBEDTLS_CTR_DRBG_BLOCKSIZE;
  190.     }
  191. exit:
  192.     mbedtls_aes_free( &aes_ctx );
  193.     /*
  194.     * tidy up the stack
  195.     */
  196.     mbedtls_platform_zeroize( buf, sizeof( buf ) );
  197.     mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
  198.     mbedtls_platform_zeroize( key, sizeof( key ) );
  199.     mbedtls_platform_zeroize( chain, sizeof( chain ) );
  200.     if( 0 != ret )
  201.     {
  202.         /*
  203.         * wipe partial seed from memory
  204.         */
  205.         mbedtls_platform_zeroize( output, MBEDTLS_CTR_DRBG_SEEDLEN );
  206.     }
  207.  
  208.     return( ret );
  209. }
  210.  
  211. /* CTR_DRBG_Update (SP 800-90A &sect;10.2.1.2)
  212.  * ctr_drbg_update_internal(ctx, provided_data)
  213.  * implements
  214.  * CTR_DRBG_Update(provided_data, Key, V)
  215.  * with inputs and outputs
  216.  *   ctx->aes_ctx = Key
  217.  *   ctx->counter = V
  218.  */
  219. static int ctr_drbg_update_internal( mbedtls_ctr_drbg_context *ctx,
  220.                               const unsigned char data[MBEDTLS_CTR_DRBG_SEEDLEN] )
  221. {
  222.     unsigned char tmp[MBEDTLS_CTR_DRBG_SEEDLEN];
  223.     unsigned char *p = tmp;
  224.     int i, j;
  225.     int ret = 0;
  226.  
  227.     memset( tmp, 0, MBEDTLS_CTR_DRBG_SEEDLEN );
  228.  
  229.     for( j = 0; j < MBEDTLS_CTR_DRBG_SEEDLEN; j += MBEDTLS_CTR_DRBG_BLOCKSIZE )
  230.     {
  231.         /*
  232.          * Increase counter
  233.          */
  234.         for( i = MBEDTLS_CTR_DRBG_BLOCKSIZE; i > 0; i-- )
  235.             if( ++ctx->counter[i - 1] != 0 )
  236.                 break;
  237.  
  238.         /*
  239.          * Crypt counter block
  240.          */
  241.         if( ( ret = mbedtls_aes_crypt_ecb( &ctx->aes_ctx, MBEDTLS_AES_ENCRYPT, ctx->counter, p ) ) != 0 )
  242.             goto exit;
  243.  
  244.         p += MBEDTLS_CTR_DRBG_BLOCKSIZE;
  245.     }
  246.  
  247.     for( i = 0; i < MBEDTLS_CTR_DRBG_SEEDLEN; i++ )
  248.         tmp[i] ^= data[i];
  249.  
  250.     /*
  251.      * Update key and counter
  252.      */
  253.     if( ( ret = mbedtls_aes_setkey_enc( &ctx->aes_ctx, tmp, MBEDTLS_CTR_DRBG_KEYBITS ) ) != 0 )
  254.         goto exit;
  255.     memcpy( ctx->counter, tmp + MBEDTLS_CTR_DRBG_KEYSIZE, MBEDTLS_CTR_DRBG_BLOCKSIZE );
  256.  
  257. exit:
  258.     mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
  259.     return( ret );
  260. }
  261.  
  262. /* CTR_DRBG_Instantiate with derivation function (SP 800-90A &sect;10.2.1.3.2)
  263.  * mbedtls_ctr_drbg_update(ctx, additional, add_len)
  264.  * implements
  265.  * CTR_DRBG_Instantiate(entropy_input, nonce, personalization_string,
  266.  *                      security_strength) -> initial_working_state
  267.  * with inputs
  268.  *   ctx->counter = all-bits-0
  269.  *   ctx->aes_ctx = context from all-bits-0 key
  270.  *   additional[:add_len] = entropy_input || nonce || personalization_string
  271.  * and with outputs
  272.  *   ctx = initial_working_state
  273.  */
  274. int mbedtls_ctr_drbg_update_ret( mbedtls_ctr_drbg_context *ctx,
  275.                                  const unsigned char *additional,
  276.                                  size_t add_len )
  277. {
  278.     unsigned char add_input[MBEDTLS_CTR_DRBG_SEEDLEN];
  279.     int ret;
  280.  
  281.     if( add_len == 0 )
  282.         return( 0 );
  283.  
  284.     if( ( ret = block_cipher_df( add_input, additional, add_len ) ) != 0 )
  285.         goto exit;
  286.     if( ( ret = ctr_drbg_update_internal( ctx, add_input ) ) != 0 )
  287.         goto exit;
  288.  
  289. exit:
  290.     mbedtls_platform_zeroize( add_input, sizeof( add_input ) );
  291.     return( ret );
  292. }
  293.  
  294. #if !defined(MBEDTLS_DEPRECATED_REMOVED)
  295. void mbedtls_ctr_drbg_update( mbedtls_ctr_drbg_context *ctx,
  296.                               const unsigned char *additional,
  297.                               size_t add_len )
  298. {
  299.     /* MAX_INPUT would be more logical here, but we have to match
  300.      * block_cipher_df()'s limits since we can't propagate errors */
  301.     if( add_len > MBEDTLS_CTR_DRBG_MAX_SEED_INPUT )
  302.         add_len = MBEDTLS_CTR_DRBG_MAX_SEED_INPUT;
  303.     (void) mbedtls_ctr_drbg_update_ret( ctx, additional, add_len );
  304. }
  305. #endif /* MBEDTLS_DEPRECATED_REMOVED */
  306.  
  307. /* CTR_DRBG_Reseed with derivation function (SP 800-90A &sect;10.2.1.4.2)
  308.  * mbedtls_ctr_drbg_reseed(ctx, additional, len)
  309.  * implements
  310.  * CTR_DRBG_Reseed(working_state, entropy_input, additional_input)
  311.  *                -> new_working_state
  312.  * with inputs
  313.  *   ctx contains working_state
  314.  *   additional[:len] = additional_input
  315.  * and entropy_input comes from calling ctx->f_entropy
  316.  * and with output
  317.  *   ctx contains new_working_state
  318.  */
  319. int mbedtls_ctr_drbg_reseed( mbedtls_ctr_drbg_context *ctx,
  320.                      const unsigned char *additional, size_t len )
  321. {
  322.     unsigned char seed[MBEDTLS_CTR_DRBG_MAX_SEED_INPUT];
  323.     size_t seedlen = 0;
  324.     int ret;
  325.  
  326.     if( ctx->entropy_len > MBEDTLS_CTR_DRBG_MAX_SEED_INPUT ||
  327.         len > MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - ctx->entropy_len )
  328.         return( MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG );
  329.  
  330.     memset( seed, 0, MBEDTLS_CTR_DRBG_MAX_SEED_INPUT );
  331.  
  332.     /*
  333.      * Gather entropy_len bytes of entropy to seed state
  334.      */
  335.     if( 0 != ctx->f_entropy( ctx->p_entropy, seed,
  336.                              ctx->entropy_len ) )
  337.     {
  338.         return( MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED );
  339.     }
  340.  
  341.     seedlen += ctx->entropy_len;
  342.  
  343.     /*
  344.      * Add additional data
  345.      */
  346.     if( additional && len )
  347.     {
  348.         memcpy( seed + seedlen, additional, len );
  349.         seedlen += len;
  350.     }
  351.  
  352.     /*
  353.      * Reduce to 384 bits
  354.      */
  355.     if( ( ret = block_cipher_df( seed, seed, seedlen ) ) != 0 )
  356.         goto exit;
  357.  
  358.     /*
  359.      * Update state
  360.      */
  361.     if( ( ret = ctr_drbg_update_internal( ctx, seed ) ) != 0 )
  362.         goto exit;
  363.     ctx->reseed_counter = 1;
  364.  
  365. exit:
  366.     mbedtls_platform_zeroize( seed, sizeof( seed ) );
  367.     return( ret );
  368. }
  369.  
  370. /* CTR_DRBG_Instantiate with derivation function (SP 800-90A &sect;10.2.1.3.2)
  371.  * mbedtls_ctr_drbg_seed(ctx, f_entropy, p_entropy, custom, len)
  372.  * implements
  373.  * CTR_DRBG_Instantiate(entropy_input, nonce, personalization_string,
  374.  *                      security_strength) -> initial_working_state
  375.  * with inputs
  376.  *   custom[:len] = nonce || personalization_string
  377.  * where entropy_input comes from f_entropy for ctx->entropy_len bytes
  378.  * and with outputs
  379.  *   ctx = initial_working_state
  380.  */
  381. int mbedtls_ctr_drbg_seed( mbedtls_ctr_drbg_context *ctx,
  382.                            int (*f_entropy)(void *, unsigned char *, size_t),
  383.                            void *p_entropy,
  384.                            const unsigned char *custom,
  385.                            size_t len )
  386. {
  387.     int ret;
  388.     unsigned char key[MBEDTLS_CTR_DRBG_KEYSIZE];
  389.  
  390.     memset( key, 0, MBEDTLS_CTR_DRBG_KEYSIZE );
  391.  
  392.     mbedtls_aes_init( &ctx->aes_ctx );
  393.  
  394.     ctx->f_entropy = f_entropy;
  395.     ctx->p_entropy = p_entropy;
  396.  
  397.     if( ctx->entropy_len == 0 )
  398.         ctx->entropy_len = MBEDTLS_CTR_DRBG_ENTROPY_LEN;
  399.     ctx->reseed_interval = MBEDTLS_CTR_DRBG_RESEED_INTERVAL;
  400.  
  401.     /*
  402.      * Initialize with an empty key
  403.      */
  404.     if( ( ret = mbedtls_aes_setkey_enc( &ctx->aes_ctx, key, MBEDTLS_CTR_DRBG_KEYBITS ) ) != 0 )
  405.     {
  406.         return( ret );
  407.     }
  408.  
  409.     if( ( ret = mbedtls_ctr_drbg_reseed( ctx, custom, len ) ) != 0 )
  410.     {
  411.         return( ret );
  412.     }
  413.     return( 0 );
  414. }
  415.  
  416. /* Backward compatibility wrapper */
  417. int mbedtls_ctr_drbg_seed_entropy_len(
  418.     mbedtls_ctr_drbg_context *ctx,
  419.     int (*f_entropy)(void *, unsigned char *, size_t), void *p_entropy,
  420.     const unsigned char *custom, size_t len,
  421.     size_t entropy_len )
  422. {
  423.     mbedtls_ctr_drbg_set_entropy_len( ctx, entropy_len );
  424.     return( mbedtls_ctr_drbg_seed( ctx, f_entropy, p_entropy, custom, len ) );
  425. }
  426.  
  427. /* CTR_DRBG_Generate with derivation function (SP 800-90A &sect;10.2.1.5.2)
  428.  * mbedtls_ctr_drbg_random_with_add(ctx, output, output_len, additional, add_len)
  429.  * implements
  430.  * CTR_DRBG_Reseed(working_state, entropy_input, additional[:add_len])
  431.  *                -> working_state_after_reseed
  432.  *                if required, then
  433.  * CTR_DRBG_Generate(working_state_after_reseed,
  434.  *                   requested_number_of_bits, additional_input)
  435.  *                -> status, returned_bits, new_working_state
  436.  * with inputs
  437.  *   ctx contains working_state
  438.  *   requested_number_of_bits = 8 * output_len
  439.  *   additional[:add_len] = additional_input
  440.  * and entropy_input comes from calling ctx->f_entropy
  441.  * and with outputs
  442.  *   status = SUCCESS (this function does the reseed internally)
  443.  *   returned_bits = output[:output_len]
  444.  *   ctx contains new_working_state
  445.  */
  446. int mbedtls_ctr_drbg_random_with_add( void *p_rng,
  447.                               unsigned char *output, size_t output_len,
  448.                               const unsigned char *additional, size_t add_len )
  449. {
  450.     int ret = 0;
  451.     mbedtls_ctr_drbg_context *ctx = (mbedtls_ctr_drbg_context *) p_rng;
  452.     unsigned char add_input[MBEDTLS_CTR_DRBG_SEEDLEN];
  453.     unsigned char *p = output;
  454.     unsigned char tmp[MBEDTLS_CTR_DRBG_BLOCKSIZE];
  455.     int i;
  456.     size_t use_len;
  457.  
  458.     if( output_len > MBEDTLS_CTR_DRBG_MAX_REQUEST )
  459.         return( MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG );
  460.  
  461.     if( add_len > MBEDTLS_CTR_DRBG_MAX_INPUT )
  462.         return( MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG );
  463.  
  464.     memset( add_input, 0, MBEDTLS_CTR_DRBG_SEEDLEN );
  465.  
  466.     if( ctx->reseed_counter > ctx->reseed_interval ||
  467.         ctx->prediction_resistance )
  468.     {
  469.         if( ( ret = mbedtls_ctr_drbg_reseed( ctx, additional, add_len ) ) != 0 )
  470.         {
  471.             return( ret );
  472.         }
  473.         add_len = 0;
  474.     }
  475.  
  476.     if( add_len > 0 )
  477.     {
  478.         if( ( ret = block_cipher_df( add_input, additional, add_len ) ) != 0 )
  479.             goto exit;
  480.         if( ( ret = ctr_drbg_update_internal( ctx, add_input ) ) != 0 )
  481.             goto exit;
  482.     }
  483.  
  484.     while( output_len > 0 )
  485.     {
  486.         /*
  487.          * Increase counter
  488.          */
  489.         for( i = MBEDTLS_CTR_DRBG_BLOCKSIZE; i > 0; i-- )
  490.             if( ++ctx->counter[i - 1] != 0 )
  491.                 break;
  492.  
  493.         /*
  494.          * Crypt counter block
  495.          */
  496.         if( ( ret = mbedtls_aes_crypt_ecb( &ctx->aes_ctx, MBEDTLS_AES_ENCRYPT, ctx->counter, tmp ) ) != 0 )
  497.             goto exit;
  498.  
  499.         use_len = ( output_len > MBEDTLS_CTR_DRBG_BLOCKSIZE ) ? MBEDTLS_CTR_DRBG_BLOCKSIZE :
  500.                                                        output_len;
  501.         /*
  502.          * Copy random block to destination
  503.          */
  504.         memcpy( p, tmp, use_len );
  505.         p += use_len;
  506.         output_len -= use_len;
  507.     }
  508.  
  509.     if( ( ret = ctr_drbg_update_internal( ctx, add_input ) ) != 0 )
  510.         goto exit;
  511.  
  512.     ctx->reseed_counter++;
  513.  
  514. exit:
  515.     mbedtls_platform_zeroize( add_input, sizeof( add_input ) );
  516.     mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
  517.     return( ret );
  518. }
  519.  
  520. int mbedtls_ctr_drbg_random( void *p_rng, unsigned char *output, size_t output_len )
  521. {
  522.     int ret;
  523.     mbedtls_ctr_drbg_context *ctx = (mbedtls_ctr_drbg_context *) p_rng;
  524.  
  525. #if defined(MBEDTLS_THREADING_C)
  526.     if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
  527.         return( ret );
  528. #endif
  529.  
  530.     ret = mbedtls_ctr_drbg_random_with_add( ctx, output, output_len, NULL, 0 );
  531.  
  532. #if defined(MBEDTLS_THREADING_C)
  533.     if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
  534.         return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
  535. #endif
  536.  
  537.     return( ret );
  538. }
  539.  
  540. #if defined(MBEDTLS_FS_IO)
  541. int mbedtls_ctr_drbg_write_seed_file( mbedtls_ctr_drbg_context *ctx, const char *path )
  542. {
  543.     int ret = MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR;
  544.     FILE *f;
  545.     unsigned char buf[ MBEDTLS_CTR_DRBG_MAX_INPUT ];
  546.  
  547.     if( ( f = fopen( path, "wb" ) ) == NULL )
  548.         return( MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR );
  549.  
  550.     if( ( ret = mbedtls_ctr_drbg_random( ctx, buf, MBEDTLS_CTR_DRBG_MAX_INPUT ) ) != 0 )
  551.         goto exit;
  552.  
  553.     if( fwrite( buf, 1, MBEDTLS_CTR_DRBG_MAX_INPUT, f ) != MBEDTLS_CTR_DRBG_MAX_INPUT )
  554.         ret = MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR;
  555.     else
  556.         ret = 0;
  557.  
  558. exit:
  559.     mbedtls_platform_zeroize( buf, sizeof( buf ) );
  560.  
  561.     fclose( f );
  562.     return( ret );
  563. }
  564.  
  565. int mbedtls_ctr_drbg_update_seed_file( mbedtls_ctr_drbg_context *ctx, const char *path )
  566. {
  567.     int ret = 0;
  568.     FILE *f = NULL;
  569.     size_t n;
  570.     unsigned char buf[ MBEDTLS_CTR_DRBG_MAX_INPUT ];
  571.     unsigned char c;
  572.  
  573.     if( ( f = fopen( path, "rb" ) ) == NULL )
  574.         return( MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR );
  575.  
  576.     n = fread( buf, 1, sizeof( buf ), f );
  577.     if( fread( &c, 1, 1, f ) != 0 )
  578.     {
  579.         ret = MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG;
  580.         goto exit;
  581.     }
  582.     if( n == 0 || ferror( f ) )
  583.     {
  584.         ret = MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR;
  585.         goto exit;
  586.     }
  587.     fclose( f );
  588.     f = NULL;
  589.  
  590.     ret = mbedtls_ctr_drbg_update_ret( ctx, buf, n );
  591.  
  592. exit:
  593.     mbedtls_platform_zeroize( buf, sizeof( buf ) );
  594.     if( f != NULL )
  595.         fclose( f );
  596.     if( ret != 0 )
  597.         return( ret );
  598.     return( mbedtls_ctr_drbg_write_seed_file( ctx, path ) );
  599. }
  600. #endif /* MBEDTLS_FS_IO */
  601.  
  602. #if defined(MBEDTLS_SELF_TEST)
  603.  
  604. static const unsigned char entropy_source_pr[96] =
  605.     { 0xc1, 0x80, 0x81, 0xa6, 0x5d, 0x44, 0x02, 0x16,
  606.       0x19, 0xb3, 0xf1, 0x80, 0xb1, 0xc9, 0x20, 0x02,
  607.       0x6a, 0x54, 0x6f, 0x0c, 0x70, 0x81, 0x49, 0x8b,
  608.       0x6e, 0xa6, 0x62, 0x52, 0x6d, 0x51, 0xb1, 0xcb,
  609.       0x58, 0x3b, 0xfa, 0xd5, 0x37, 0x5f, 0xfb, 0xc9,
  610.       0xff, 0x46, 0xd2, 0x19, 0xc7, 0x22, 0x3e, 0x95,
  611.       0x45, 0x9d, 0x82, 0xe1, 0xe7, 0x22, 0x9f, 0x63,
  612.       0x31, 0x69, 0xd2, 0x6b, 0x57, 0x47, 0x4f, 0xa3,
  613.       0x37, 0xc9, 0x98, 0x1c, 0x0b, 0xfb, 0x91, 0x31,
  614.       0x4d, 0x55, 0xb9, 0xe9, 0x1c, 0x5a, 0x5e, 0xe4,
  615.       0x93, 0x92, 0xcf, 0xc5, 0x23, 0x12, 0xd5, 0x56,
  616.       0x2c, 0x4a, 0x6e, 0xff, 0xdc, 0x10, 0xd0, 0x68 };
  617.  
  618. static const unsigned char entropy_source_nopr[64] =
  619.     { 0x5a, 0x19, 0x4d, 0x5e, 0x2b, 0x31, 0x58, 0x14,
  620.       0x54, 0xde, 0xf6, 0x75, 0xfb, 0x79, 0x58, 0xfe,
  621.       0xc7, 0xdb, 0x87, 0x3e, 0x56, 0x89, 0xfc, 0x9d,
  622.       0x03, 0x21, 0x7c, 0x68, 0xd8, 0x03, 0x38, 0x20,
  623.       0xf9, 0xe6, 0x5e, 0x04, 0xd8, 0x56, 0xf3, 0xa9,
  624.       0xc4, 0x4a, 0x4c, 0xbd, 0xc1, 0xd0, 0x08, 0x46,
  625.       0xf5, 0x98, 0x3d, 0x77, 0x1c, 0x1b, 0x13, 0x7e,
  626.       0x4e, 0x0f, 0x9d, 0x8e, 0xf4, 0x09, 0xf9, 0x2e };
  627.  
  628. static const unsigned char nonce_pers_pr[16] =
  629.     { 0xd2, 0x54, 0xfc, 0xff, 0x02, 0x1e, 0x69, 0xd2,
  630.       0x29, 0xc9, 0xcf, 0xad, 0x85, 0xfa, 0x48, 0x6c };
  631.  
  632. static const unsigned char nonce_pers_nopr[16] =
  633.     { 0x1b, 0x54, 0xb8, 0xff, 0x06, 0x42, 0xbf, 0xf5,
  634.       0x21, 0xf1, 0x5c, 0x1c, 0x0b, 0x66, 0x5f, 0x3f };
  635.  
  636. static const unsigned char result_pr[16] =
  637.     { 0x34, 0x01, 0x16, 0x56, 0xb4, 0x29, 0x00, 0x8f,
  638.       0x35, 0x63, 0xec, 0xb5, 0xf2, 0x59, 0x07, 0x23 };
  639.  
  640. static const unsigned char result_nopr[16] =
  641.     { 0xa0, 0x54, 0x30, 0x3d, 0x8a, 0x7e, 0xa9, 0x88,
  642.       0x9d, 0x90, 0x3e, 0x07, 0x7c, 0x6f, 0x21, 0x8f };
  643.  
  644. static size_t test_offset;
  645. static int ctr_drbg_self_test_entropy( void *data, unsigned char *buf,
  646.                                        size_t len )
  647. {
  648.     const unsigned char *p = data;
  649.     memcpy( buf, p + test_offset, len );
  650.     test_offset += len;
  651.     return( 0 );
  652. }
  653.  
  654. #define CHK( c )    if( (c) != 0 )                          \
  655.                     {                                       \
  656.                         if( verbose != 0 )                  \
  657.                             mbedtls_printf( "failed\n" );  \
  658.                         return( 1 );                        \
  659.                     }
  660.  
  661. /*
  662.  * Checkup routine
  663.  */
  664. int mbedtls_ctr_drbg_self_test( int verbose )
  665. {
  666.     mbedtls_ctr_drbg_context ctx;
  667.     unsigned char buf[16];
  668.  
  669.     mbedtls_ctr_drbg_init( &ctx );
  670.  
  671.     /*
  672.      * Based on a NIST CTR_DRBG test vector (PR = True)
  673.      */
  674.     if( verbose != 0 )
  675.         mbedtls_printf( "  CTR_DRBG (PR = TRUE) : " );
  676.  
  677.     test_offset = 0;
  678.     mbedtls_ctr_drbg_set_entropy_len( &ctx, 32 );
  679.     CHK( mbedtls_ctr_drbg_seed( &ctx,
  680.                                 ctr_drbg_self_test_entropy,
  681.                                 (void *) entropy_source_pr,
  682.                                 nonce_pers_pr, 16 ) );
  683.     mbedtls_ctr_drbg_set_prediction_resistance( &ctx, MBEDTLS_CTR_DRBG_PR_ON );
  684.     CHK( mbedtls_ctr_drbg_random( &ctx, buf, MBEDTLS_CTR_DRBG_BLOCKSIZE ) );
  685.     CHK( mbedtls_ctr_drbg_random( &ctx, buf, MBEDTLS_CTR_DRBG_BLOCKSIZE ) );
  686.     CHK( memcmp( buf, result_pr, MBEDTLS_CTR_DRBG_BLOCKSIZE ) );
  687.  
  688.     mbedtls_ctr_drbg_free( &ctx );
  689.  
  690.     if( verbose != 0 )
  691.         mbedtls_printf( "passed\n" );
  692.  
  693.     /*
  694.      * Based on a NIST CTR_DRBG test vector (PR = FALSE)
  695.      */
  696.     if( verbose != 0 )
  697.         mbedtls_printf( "  CTR_DRBG (PR = FALSE): " );
  698.  
  699.     mbedtls_ctr_drbg_init( &ctx );
  700.  
  701.     test_offset = 0;
  702.     mbedtls_ctr_drbg_set_entropy_len( &ctx, 32 );
  703.     CHK( mbedtls_ctr_drbg_seed( &ctx,
  704.                                 ctr_drbg_self_test_entropy,
  705.                                 (void *) entropy_source_nopr,
  706.                                 nonce_pers_nopr, 16 ) );
  707.     CHK( mbedtls_ctr_drbg_random( &ctx, buf, 16 ) );
  708.     CHK( mbedtls_ctr_drbg_reseed( &ctx, NULL, 0 ) );
  709.     CHK( mbedtls_ctr_drbg_random( &ctx, buf, 16 ) );
  710.     CHK( memcmp( buf, result_nopr, 16 ) );
  711.  
  712.     mbedtls_ctr_drbg_free( &ctx );
  713.  
  714.     if( verbose != 0 )
  715.         mbedtls_printf( "passed\n" );
  716.  
  717.     if( verbose != 0 )
  718.             mbedtls_printf( "\n" );
  719.  
  720.     return( 0 );
  721. }
  722. #endif /* MBEDTLS_SELF_TEST */
  723.  
  724. #endif /* MBEDTLS_CTR_DRBG_C */
  725.