linux-master/crypto/drbg.c

12  * Redistribution and use in source and binary forms, with or without
16  *    notice, and the entire permission notice in its entirety,
18  * 2. Redistributions in binary form must reproduce the above copyright
19  *    notice, this list of conditions and the following disclaimer in the
26  * the GNU General Public License, in which case the provisions of the GPL are
29  * the restrictions contained in a BSD-style copyright.)
112  * they are defined in this array (see drbg_fill_array).
116  * favored DRBGs are the latest entries in this array.
122 		.statelen = 32, /* 256 bits as defined in 10.2.1 */
128 		.statelen = 40, /* 320 bits as defined in 10.2.1 */
134 		.statelen = 48, /* 384 bits as defined in 10.2.1 */
195  * Return: normalized strength in *bytes* value or 32 as default
243 	/* only perform test in FIPS mode */
299 			  const struct drbg_string *in);
307 /* BCC function for CTR DRBG as defined in 10.4.3 */
310 			struct list_head *in)
321 	list_for_each_entry(curr, in, list) {
385 /* Derivation Function for CTR DRBG as defined in 10.4.2 */
473 	/* 10.4.2 step 12: overwriting of outval is implemented in next step */
481 		 * implicit as the key is only drbg_blocklen in size based on
506  * update function of CTR DRBG as defined in 10.2.1.2
582 /* Generate function of CTR DRBG as defined in 10.2.1.5.2 */
624 			   const struct list_head *in);
640 /* update function of HMAC DRBG as defined in 10.1.2.2 */
658 	/* buffer of seed2 will be filled in for loop below with one byte */
692 /* generate function of HMAC DRBG as defined in 10.1.2.5 */
805 /* Derivation Function for Hash DRBG as defined in 10.4.1 */
844 /* update function for Hash DRBG as defined in 10.1.1.2 / 10.1.1.3 */
919 /* Hashgen defined in 10.1.1.4 */
960 /* generate function for Hash DRBG as defined in  10.1.1.4 */
982 	/* this is the value H as documented in 10.1.1.4 */
1105 	/* Don't ever reseed from get_random_bytes() in test mode. */
1111 	 * elapsed in order to still achieve sort of partial
1156 		 * With a derivation function, a nonce is required in addition
1158 		 * strength of the DRBG in size. Thus, entropy + nonce is 3/2
1167 		/* Get seed from in-kernel /dev/urandom */
1182 			 * fatal only in FIPS mode.
1217 	 * the variable pers is directly handed in by the caller, so check its
1238 /* Free all substructures in a DRBG state without the DRBG state structure */
1362  *	  as defined in SP800-90A. The additional input is mixed into
1363  *	  the state in addition to the pulled entropy.
1365  * return: 0 when all bytes are generated; < 0 in case of an error
1454 	 * Albeit the following code is commented out, it is provided in
1524 	/* We do not need an HRNG in test mode. */
1549  *	 as defined in SP800-90A. The additional input is mixed into
1550  *	 the state in addition to the pulled entropy.
1576 	/* 9.1 step 4 is implicit in  drbg_sec_strength */
1637  * Helper function for setting the test data in the DRBG
1708 			   const struct list_head *in)
1714 	list_for_each_entry(input, in, list)
1811 			  const struct drbg_string *in)
1815 	/* there is only component in *in */
1816 	BUG_ON(in->len < drbg_blocklen(drbg));
1817 	crypto_cipher_encrypt_one(tfm, outval, in->buf);
1833 		/* Use scratchpad for in-place operation */
1977  * Tests as defined in 11.3.2 in addition to the cipher tests: testing
1980  * Note: testing of failing seed source as defined in 11.3.2 is not applicable
1999 	/* only perform test in FIPS mode */
2024 	 * string lengths -- in case the error handling does not succeed
2115 	 * we instantiate each DRBG in drbg_cores[] twice.