entropy.c 18 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655
  1. /*
  2. * Entropy accumulator implementation
  3. *
  4. * Copyright (C) 2006-2016, ARM Limited, All Rights Reserved
  5. * SPDX-License-Identifier: Apache-2.0
  6. *
  7. * Licensed under the Apache License, Version 2.0 (the "License"); you may
  8. * not use this file except in compliance with the License.
  9. * You may obtain a copy of the License at
  10. *
  11. * http://www.apache.org/licenses/LICENSE-2.0
  12. *
  13. * Unless required by applicable law or agreed to in writing, software
  14. * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  15. * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16. * See the License for the specific language governing permissions and
  17. * limitations under the License.
  18. *
  19. * This file is part of mbed TLS (https://tls.mbed.org)
  20. */
  21. #if !defined(MBEDTLS_CONFIG_FILE)
  22. #include "mbedtls/config.h"
  23. #else
  24. #include MBEDTLS_CONFIG_FILE
  25. #endif
  26. #if defined(MBEDTLS_ENTROPY_C)
  27. #if defined(MBEDTLS_TEST_NULL_ENTROPY)
  28. #warning "**** WARNING! MBEDTLS_TEST_NULL_ENTROPY defined! "
  29. #warning "**** THIS BUILD HAS NO DEFINED ENTROPY SOURCES "
  30. #warning "**** THIS BUILD IS *NOT* SUITABLE FOR PRODUCTION USE "
  31. #endif
  32. #include "mbedtls/entropy.h"
  33. #include "mbedtls/entropy_poll.h"
  34. #include <string.h>
  35. #if defined(MBEDTLS_FS_IO)
  36. #include <stdio.h>
  37. #endif
  38. #if defined(MBEDTLS_ENTROPY_NV_SEED)
  39. #include "mbedtls/platform.h"
  40. #endif
  41. #if defined(MBEDTLS_SELF_TEST)
  42. #if defined(MBEDTLS_PLATFORM_C)
  43. #include "mbedtls/platform.h"
  44. #else
  45. #include <stdio.h>
  46. #define mbedtls_printf printf
  47. #endif /* MBEDTLS_PLATFORM_C */
  48. #endif /* MBEDTLS_SELF_TEST */
  49. #if defined(MBEDTLS_HAVEGE_C)
  50. #include "mbedtls/havege.h"
  51. #endif
  52. /* Implementation that should never be optimized out by the compiler */
  53. static void mbedtls_zeroize( void *v, size_t n ) {
  54. volatile unsigned char *p = v; while( n-- ) *p++ = 0;
  55. }
  56. #define ENTROPY_MAX_LOOP 256 /**< Maximum amount to loop before error */
  57. void mbedtls_entropy_init( mbedtls_entropy_context *ctx )
  58. {
  59. memset( ctx, 0, sizeof(mbedtls_entropy_context) );
  60. #if defined(MBEDTLS_THREADING_C)
  61. mbedtls_mutex_init( &ctx->mutex );
  62. #endif
  63. #if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
  64. mbedtls_sha512_starts( &ctx->accumulator, 0 );
  65. #else
  66. mbedtls_sha256_starts( &ctx->accumulator, 0 );
  67. #endif
  68. #if defined(MBEDTLS_HAVEGE_C)
  69. mbedtls_havege_init( &ctx->havege_data );
  70. #endif
  71. #if defined(MBEDTLS_TEST_NULL_ENTROPY)
  72. mbedtls_entropy_add_source( ctx, mbedtls_null_entropy_poll, NULL,
  73. 1, MBEDTLS_ENTROPY_SOURCE_STRONG );
  74. #endif
  75. #if !defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES)
  76. #if !defined(MBEDTLS_NO_PLATFORM_ENTROPY)
  77. mbedtls_entropy_add_source( ctx, mbedtls_platform_entropy_poll, NULL,
  78. MBEDTLS_ENTROPY_MIN_PLATFORM,
  79. MBEDTLS_ENTROPY_SOURCE_STRONG );
  80. #endif
  81. #if defined(MBEDTLS_TIMING_C)
  82. mbedtls_entropy_add_source( ctx, mbedtls_hardclock_poll, NULL,
  83. MBEDTLS_ENTROPY_MIN_HARDCLOCK,
  84. MBEDTLS_ENTROPY_SOURCE_WEAK );
  85. #endif
  86. #if defined(MBEDTLS_HAVEGE_C)
  87. mbedtls_entropy_add_source( ctx, mbedtls_havege_poll, &ctx->havege_data,
  88. MBEDTLS_ENTROPY_MIN_HAVEGE,
  89. MBEDTLS_ENTROPY_SOURCE_STRONG );
  90. #endif
  91. #if defined(MBEDTLS_ENTROPY_HARDWARE_ALT)
  92. mbedtls_entropy_add_source( ctx, mbedtls_hardware_poll, NULL,
  93. MBEDTLS_ENTROPY_MIN_HARDWARE,
  94. MBEDTLS_ENTROPY_SOURCE_STRONG );
  95. #endif
  96. #if defined(MBEDTLS_ENTROPY_NV_SEED)
  97. mbedtls_entropy_add_source( ctx, mbedtls_nv_seed_poll, NULL,
  98. MBEDTLS_ENTROPY_BLOCK_SIZE,
  99. MBEDTLS_ENTROPY_SOURCE_STRONG );
  100. #endif
  101. #endif /* MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES */
  102. }
  103. void mbedtls_entropy_free( mbedtls_entropy_context *ctx )
  104. {
  105. #if defined(MBEDTLS_HAVEGE_C)
  106. mbedtls_havege_free( &ctx->havege_data );
  107. #endif
  108. #if defined(MBEDTLS_THREADING_C)
  109. mbedtls_mutex_free( &ctx->mutex );
  110. #endif
  111. mbedtls_zeroize( ctx, sizeof( mbedtls_entropy_context ) );
  112. }
  113. int mbedtls_entropy_add_source( mbedtls_entropy_context *ctx,
  114. mbedtls_entropy_f_source_ptr f_source, void *p_source,
  115. size_t threshold, int strong )
  116. {
  117. int idx, ret = 0;
  118. #if defined(MBEDTLS_THREADING_C)
  119. if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
  120. return( ret );
  121. #endif
  122. idx = ctx->source_count;
  123. if( idx >= MBEDTLS_ENTROPY_MAX_SOURCES )
  124. {
  125. ret = MBEDTLS_ERR_ENTROPY_MAX_SOURCES;
  126. goto exit;
  127. }
  128. ctx->source[idx].f_source = f_source;
  129. ctx->source[idx].p_source = p_source;
  130. ctx->source[idx].threshold = threshold;
  131. ctx->source[idx].strong = strong;
  132. ctx->source_count++;
  133. exit:
  134. #if defined(MBEDTLS_THREADING_C)
  135. if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
  136. return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
  137. #endif
  138. return( ret );
  139. }
  140. /*
  141. * Entropy accumulator update
  142. */
  143. static int entropy_update( mbedtls_entropy_context *ctx, unsigned char source_id,
  144. const unsigned char *data, size_t len )
  145. {
  146. unsigned char header[2];
  147. unsigned char tmp[MBEDTLS_ENTROPY_BLOCK_SIZE];
  148. size_t use_len = len;
  149. const unsigned char *p = data;
  150. if( use_len > MBEDTLS_ENTROPY_BLOCK_SIZE )
  151. {
  152. #if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
  153. mbedtls_sha512( data, len, tmp, 0 );
  154. #else
  155. mbedtls_sha256( data, len, tmp, 0 );
  156. #endif
  157. p = tmp;
  158. use_len = MBEDTLS_ENTROPY_BLOCK_SIZE;
  159. }
  160. header[0] = source_id;
  161. header[1] = use_len & 0xFF;
  162. #if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
  163. mbedtls_sha512_update( &ctx->accumulator, header, 2 );
  164. mbedtls_sha512_update( &ctx->accumulator, p, use_len );
  165. #else
  166. mbedtls_sha256_update( &ctx->accumulator, header, 2 );
  167. mbedtls_sha256_update( &ctx->accumulator, p, use_len );
  168. #endif
  169. return( 0 );
  170. }
  171. int mbedtls_entropy_update_manual( mbedtls_entropy_context *ctx,
  172. const unsigned char *data, size_t len )
  173. {
  174. int ret;
  175. #if defined(MBEDTLS_THREADING_C)
  176. if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
  177. return( ret );
  178. #endif
  179. ret = entropy_update( ctx, MBEDTLS_ENTROPY_SOURCE_MANUAL, data, len );
  180. #if defined(MBEDTLS_THREADING_C)
  181. if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
  182. return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
  183. #endif
  184. return( ret );
  185. }
  186. /*
  187. * Run through the different sources to add entropy to our accumulator
  188. */
  189. static int entropy_gather_internal( mbedtls_entropy_context *ctx )
  190. {
  191. int ret, i, have_one_strong = 0;
  192. unsigned char buf[MBEDTLS_ENTROPY_MAX_GATHER];
  193. size_t olen;
  194. if( ctx->source_count == 0 )
  195. return( MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED );
  196. /*
  197. * Run through our entropy sources
  198. */
  199. for( i = 0; i < ctx->source_count; i++ )
  200. {
  201. if( ctx->source[i].strong == MBEDTLS_ENTROPY_SOURCE_STRONG )
  202. have_one_strong = 1;
  203. olen = 0;
  204. if( ( ret = ctx->source[i].f_source( ctx->source[i].p_source,
  205. buf, MBEDTLS_ENTROPY_MAX_GATHER, &olen ) ) != 0 )
  206. {
  207. return( ret );
  208. }
  209. /*
  210. * Add if we actually gathered something
  211. */
  212. if( olen > 0 )
  213. {
  214. entropy_update( ctx, (unsigned char) i, buf, olen );
  215. ctx->source[i].size += olen;
  216. }
  217. }
  218. if( have_one_strong == 0 )
  219. return( MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE );
  220. return( 0 );
  221. }
  222. /*
  223. * Thread-safe wrapper for entropy_gather_internal()
  224. */
  225. int mbedtls_entropy_gather( mbedtls_entropy_context *ctx )
  226. {
  227. int ret;
  228. #if defined(MBEDTLS_THREADING_C)
  229. if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
  230. return( ret );
  231. #endif
  232. ret = entropy_gather_internal( ctx );
  233. #if defined(MBEDTLS_THREADING_C)
  234. if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
  235. return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
  236. #endif
  237. return( ret );
  238. }
  239. int mbedtls_entropy_func( void *data, unsigned char *output, size_t len )
  240. {
  241. int ret, count = 0, i, done;
  242. mbedtls_entropy_context *ctx = (mbedtls_entropy_context *) data;
  243. unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE];
  244. if( len > MBEDTLS_ENTROPY_BLOCK_SIZE )
  245. return( MBEDTLS_ERR_ENTROPY_SOURCE_FAILED );
  246. #if defined(MBEDTLS_ENTROPY_NV_SEED)
  247. /* Update the NV entropy seed before generating any entropy for outside
  248. * use.
  249. */
  250. if( ctx->initial_entropy_run == 0 )
  251. {
  252. ctx->initial_entropy_run = 1;
  253. if( ( ret = mbedtls_entropy_update_nv_seed( ctx ) ) != 0 )
  254. return( ret );
  255. }
  256. #endif
  257. #if defined(MBEDTLS_THREADING_C)
  258. if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
  259. return( ret );
  260. #endif
  261. /*
  262. * Always gather extra entropy before a call
  263. */
  264. do
  265. {
  266. if( count++ > ENTROPY_MAX_LOOP )
  267. {
  268. ret = MBEDTLS_ERR_ENTROPY_SOURCE_FAILED;
  269. goto exit;
  270. }
  271. if( ( ret = entropy_gather_internal( ctx ) ) != 0 )
  272. goto exit;
  273. done = 1;
  274. for( i = 0; i < ctx->source_count; i++ )
  275. if( ctx->source[i].size < ctx->source[i].threshold )
  276. done = 0;
  277. }
  278. while( ! done );
  279. memset( buf, 0, MBEDTLS_ENTROPY_BLOCK_SIZE );
  280. #if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
  281. mbedtls_sha512_finish( &ctx->accumulator, buf );
  282. /*
  283. * Reset accumulator and counters and recycle existing entropy
  284. */
  285. memset( &ctx->accumulator, 0, sizeof( mbedtls_sha512_context ) );
  286. mbedtls_sha512_starts( &ctx->accumulator, 0 );
  287. mbedtls_sha512_update( &ctx->accumulator, buf, MBEDTLS_ENTROPY_BLOCK_SIZE );
  288. /*
  289. * Perform second SHA-512 on entropy
  290. */
  291. mbedtls_sha512( buf, MBEDTLS_ENTROPY_BLOCK_SIZE, buf, 0 );
  292. #else /* MBEDTLS_ENTROPY_SHA512_ACCUMULATOR */
  293. mbedtls_sha256_finish( &ctx->accumulator, buf );
  294. /*
  295. * Reset accumulator and counters and recycle existing entropy
  296. */
  297. memset( &ctx->accumulator, 0, sizeof( mbedtls_sha256_context ) );
  298. mbedtls_sha256_starts( &ctx->accumulator, 0 );
  299. mbedtls_sha256_update( &ctx->accumulator, buf, MBEDTLS_ENTROPY_BLOCK_SIZE );
  300. /*
  301. * Perform second SHA-256 on entropy
  302. */
  303. mbedtls_sha256( buf, MBEDTLS_ENTROPY_BLOCK_SIZE, buf, 0 );
  304. #endif /* MBEDTLS_ENTROPY_SHA512_ACCUMULATOR */
  305. for( i = 0; i < ctx->source_count; i++ )
  306. ctx->source[i].size = 0;
  307. memcpy( output, buf, len );
  308. ret = 0;
  309. exit:
  310. #if defined(MBEDTLS_THREADING_C)
  311. if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
  312. return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
  313. #endif
  314. return( ret );
  315. }
  316. #if defined(MBEDTLS_ENTROPY_NV_SEED)
  317. int mbedtls_entropy_update_nv_seed( mbedtls_entropy_context *ctx )
  318. {
  319. int ret = MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
  320. unsigned char buf[ MBEDTLS_ENTROPY_MAX_SEED_SIZE ];
  321. /* Read new seed and write it to NV */
  322. if( ( ret = mbedtls_entropy_func( ctx, buf, MBEDTLS_ENTROPY_BLOCK_SIZE ) ) != 0 )
  323. return( ret );
  324. if( mbedtls_nv_seed_write( buf, MBEDTLS_ENTROPY_BLOCK_SIZE ) < 0 )
  325. return( MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR );
  326. /* Manually update the remaining stream with a separator value to diverge */
  327. memset( buf, 0, MBEDTLS_ENTROPY_BLOCK_SIZE );
  328. mbedtls_entropy_update_manual( ctx, buf, MBEDTLS_ENTROPY_BLOCK_SIZE );
  329. return( 0 );
  330. }
  331. #endif /* MBEDTLS_ENTROPY_NV_SEED */
  332. #if defined(MBEDTLS_FS_IO)
  333. int mbedtls_entropy_write_seed_file( mbedtls_entropy_context *ctx, const char *path )
  334. {
  335. int ret = MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
  336. FILE *f;
  337. unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE];
  338. if( ( f = fopen( path, "wb" ) ) == NULL )
  339. return( MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR );
  340. if( ( ret = mbedtls_entropy_func( ctx, buf, MBEDTLS_ENTROPY_BLOCK_SIZE ) ) != 0 )
  341. goto exit;
  342. if( fwrite( buf, 1, MBEDTLS_ENTROPY_BLOCK_SIZE, f ) != MBEDTLS_ENTROPY_BLOCK_SIZE )
  343. {
  344. ret = MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
  345. goto exit;
  346. }
  347. ret = 0;
  348. exit:
  349. fclose( f );
  350. return( ret );
  351. }
  352. int mbedtls_entropy_update_seed_file( mbedtls_entropy_context *ctx, const char *path )
  353. {
  354. FILE *f;
  355. size_t n;
  356. unsigned char buf[ MBEDTLS_ENTROPY_MAX_SEED_SIZE ];
  357. if( ( f = fopen( path, "rb" ) ) == NULL )
  358. return( MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR );
  359. fseek( f, 0, SEEK_END );
  360. n = (size_t) ftell( f );
  361. fseek( f, 0, SEEK_SET );
  362. if( n > MBEDTLS_ENTROPY_MAX_SEED_SIZE )
  363. n = MBEDTLS_ENTROPY_MAX_SEED_SIZE;
  364. if( fread( buf, 1, n, f ) != n )
  365. {
  366. fclose( f );
  367. return( MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR );
  368. }
  369. fclose( f );
  370. mbedtls_entropy_update_manual( ctx, buf, n );
  371. return( mbedtls_entropy_write_seed_file( ctx, path ) );
  372. }
  373. #endif /* MBEDTLS_FS_IO */
  374. #if defined(MBEDTLS_SELF_TEST)
  375. #if !defined(MBEDTLS_TEST_NULL_ENTROPY)
  376. /*
  377. * Dummy source function
  378. */
  379. static int entropy_dummy_source( void *data, unsigned char *output,
  380. size_t len, size_t *olen )
  381. {
  382. ((void) data);
  383. memset( output, 0x2a, len );
  384. *olen = len;
  385. return( 0 );
  386. }
  387. #endif /* !MBEDTLS_TEST_NULL_ENTROPY */
  388. #if defined(MBEDTLS_ENTROPY_HARDWARE_ALT)
  389. static int mbedtls_entropy_source_self_test_gather( unsigned char *buf, size_t buf_len )
  390. {
  391. int ret = 0;
  392. size_t entropy_len = 0;
  393. size_t olen = 0;
  394. size_t attempts = buf_len;
  395. while( attempts > 0 && entropy_len < buf_len )
  396. {
  397. if( ( ret = mbedtls_hardware_poll( NULL, buf + entropy_len,
  398. buf_len - entropy_len, &olen ) ) != 0 )
  399. return( ret );
  400. entropy_len += olen;
  401. attempts--;
  402. }
  403. if( entropy_len < buf_len )
  404. {
  405. ret = 1;
  406. }
  407. return( ret );
  408. }
  409. static int mbedtls_entropy_source_self_test_check_bits( const unsigned char *buf,
  410. size_t buf_len )
  411. {
  412. unsigned char set= 0xFF;
  413. unsigned char unset = 0x00;
  414. size_t i;
  415. for( i = 0; i < buf_len; i++ )
  416. {
  417. set &= buf[i];
  418. unset |= buf[i];
  419. }
  420. return( set == 0xFF || unset == 0x00 );
  421. }
  422. /*
  423. * A test to ensure hat the entropy sources are functioning correctly
  424. * and there is no obvious failure. The test performs the following checks:
  425. * - The entropy source is not providing only 0s (all bits unset) or 1s (all
  426. * bits set).
  427. * - The entropy source is not providing values in a pattern. Because the
  428. * hardware could be providing data in an arbitrary length, this check polls
  429. * the hardware entropy source twice and compares the result to ensure they
  430. * are not equal.
  431. * - The error code returned by the entropy source is not an error.
  432. */
  433. int mbedtls_entropy_source_self_test( int verbose )
  434. {
  435. int ret = 0;
  436. unsigned char buf0[2 * sizeof( unsigned long long int )];
  437. unsigned char buf1[2 * sizeof( unsigned long long int )];
  438. if( verbose != 0 )
  439. mbedtls_printf( " ENTROPY_BIAS test: " );
  440. memset( buf0, 0x00, sizeof( buf0 ) );
  441. memset( buf1, 0x00, sizeof( buf1 ) );
  442. if( ( ret = mbedtls_entropy_source_self_test_gather( buf0, sizeof( buf0 ) ) ) != 0 )
  443. goto cleanup;
  444. if( ( ret = mbedtls_entropy_source_self_test_gather( buf1, sizeof( buf1 ) ) ) != 0 )
  445. goto cleanup;
  446. /* Make sure that the returned values are not all 0 or 1 */
  447. if( ( ret = mbedtls_entropy_source_self_test_check_bits( buf0, sizeof( buf0 ) ) ) != 0 )
  448. goto cleanup;
  449. if( ( ret = mbedtls_entropy_source_self_test_check_bits( buf1, sizeof( buf1 ) ) ) != 0 )
  450. goto cleanup;
  451. /* Make sure that the entropy source is not returning values in a
  452. * pattern */
  453. ret = memcmp( buf0, buf1, sizeof( buf0 ) ) == 0;
  454. cleanup:
  455. if( verbose != 0 )
  456. {
  457. if( ret != 0 )
  458. mbedtls_printf( "failed\n" );
  459. else
  460. mbedtls_printf( "passed\n" );
  461. mbedtls_printf( "\n" );
  462. }
  463. return( ret != 0 );
  464. }
  465. #endif /* MBEDTLS_ENTROPY_HARDWARE_ALT */
  466. /*
  467. * The actual entropy quality is hard to test, but we can at least
  468. * test that the functions don't cause errors and write the correct
  469. * amount of data to buffers.
  470. */
  471. int mbedtls_entropy_self_test( int verbose )
  472. {
  473. int ret = 1;
  474. #if !defined(MBEDTLS_TEST_NULL_ENTROPY)
  475. mbedtls_entropy_context ctx;
  476. unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE] = { 0 };
  477. unsigned char acc[MBEDTLS_ENTROPY_BLOCK_SIZE] = { 0 };
  478. size_t i, j;
  479. #endif /* !MBEDTLS_TEST_NULL_ENTROPY */
  480. if( verbose != 0 )
  481. mbedtls_printf( " ENTROPY test: " );
  482. #if !defined(MBEDTLS_TEST_NULL_ENTROPY)
  483. mbedtls_entropy_init( &ctx );
  484. /* First do a gather to make sure we have default sources */
  485. if( ( ret = mbedtls_entropy_gather( &ctx ) ) != 0 )
  486. goto cleanup;
  487. ret = mbedtls_entropy_add_source( &ctx, entropy_dummy_source, NULL, 16,
  488. MBEDTLS_ENTROPY_SOURCE_WEAK );
  489. if( ret != 0 )
  490. goto cleanup;
  491. if( ( ret = mbedtls_entropy_update_manual( &ctx, buf, sizeof buf ) ) != 0 )
  492. goto cleanup;
  493. /*
  494. * To test that mbedtls_entropy_func writes correct number of bytes:
  495. * - use the whole buffer and rely on ASan to detect overruns
  496. * - collect entropy 8 times and OR the result in an accumulator:
  497. * any byte should then be 0 with probably 2^(-64), so requiring
  498. * each of the 32 or 64 bytes to be non-zero has a false failure rate
  499. * of at most 2^(-58) which is acceptable.
  500. */
  501. for( i = 0; i < 8; i++ )
  502. {
  503. if( ( ret = mbedtls_entropy_func( &ctx, buf, sizeof( buf ) ) ) != 0 )
  504. goto cleanup;
  505. for( j = 0; j < sizeof( buf ); j++ )
  506. acc[j] |= buf[j];
  507. }
  508. for( j = 0; j < sizeof( buf ); j++ )
  509. {
  510. if( acc[j] == 0 )
  511. {
  512. ret = 1;
  513. goto cleanup;
  514. }
  515. }
  516. #if defined(MBEDTLS_ENTROPY_HARDWARE_ALT)
  517. if( ( ret = mbedtls_entropy_source_self_test( 0 ) ) != 0 )
  518. goto cleanup;
  519. #endif
  520. cleanup:
  521. mbedtls_entropy_free( &ctx );
  522. #endif /* !MBEDTLS_TEST_NULL_ENTROPY */
  523. if( verbose != 0 )
  524. {
  525. if( ret != 0 )
  526. mbedtls_printf( "failed\n" );
  527. else
  528. mbedtls_printf( "passed\n" );
  529. mbedtls_printf( "\n" );
  530. }
  531. return( ret != 0 );
  532. }
  533. #endif /* MBEDTLS_SELF_TEST */
  534. #endif /* MBEDTLS_ENTROPY_C */