1 /*
2  *  Entropy accumulator implementation
3  *
4  *  Copyright (C) 2006-2016, ARM Limited, All Rights Reserved
5  *  SPDX-License-Identifier: Apache-2.0
6  *
7  *  Licensed under the Apache License, Version 2.0 (the "License"); you may
8  *  not use this file except in compliance with the License.
9  *  You may obtain a copy of the License at
10  *
11  *  http://www.apache.org/licenses/LICENSE-2.0
12  *
13  *  Unless required by applicable law or agreed to in writing, software
14  *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15  *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  *  See the License for the specific language governing permissions and
17  *  limitations under the License.
18  *
19  *  This file is part of mbed TLS (https://tls.mbed.org)
20  */
21 
22 #if !defined(MBEDTLS_CONFIG_FILE)
23 #include "mbedtls/config.h"
24 #else
25 #include MBEDTLS_CONFIG_FILE
26 #endif
27 
28 #if defined(MBEDTLS_ENTROPY_C)
29 
30 #if defined(MBEDTLS_TEST_NULL_ENTROPY)
31 #warning "**** WARNING!  MBEDTLS_TEST_NULL_ENTROPY defined! "
32 #warning "**** THIS BUILD HAS NO DEFINED ENTROPY SOURCES "
33 #warning "**** THIS BUILD IS *NOT* SUITABLE FOR PRODUCTION USE "
34 #endif
35 
36 #include "mbedtls/entropy.h"
37 #include "mbedtls/entropy_poll.h"
38 #include "mbedtls/platform_util.h"
39 
40 #include <string.h>
41 
42 #if defined(MBEDTLS_FS_IO)
43 #include <stdio.h>
44 #endif
45 
46 #if defined(MBEDTLS_ENTROPY_NV_SEED)
47 #include "mbedtls/platform.h"
48 #endif
49 
50 #if defined(MBEDTLS_SELF_TEST)
51 #if defined(MBEDTLS_PLATFORM_C)
52 #include "mbedtls/platform.h"
53 #else
54 #include <stdio.h>
55 #define mbedtls_printf     printf
56 #endif /* MBEDTLS_PLATFORM_C */
57 #endif /* MBEDTLS_SELF_TEST */
58 
59 #if defined(MBEDTLS_HAVEGE_C)
60 #include "mbedtls/havege.h"
61 #endif
62 
63 #define ENTROPY_MAX_LOOP    256     /**< Maximum amount to loop before error */
64 
mbedtls_entropy_init(mbedtls_entropy_context * ctx)65 void mbedtls_entropy_init( mbedtls_entropy_context *ctx )
66 {
67     ctx->source_count = 0;
68     memset( ctx->source, 0, sizeof( ctx->source ) );
69 
70 #if defined(MBEDTLS_THREADING_C)
71     mbedtls_mutex_init( &ctx->mutex );
72 #endif
73 
74     ctx->accumulator_started = 0;
75 #if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
76     mbedtls_sha512_init( &ctx->accumulator );
77 #else
78     mbedtls_sha256_init( &ctx->accumulator );
79 #endif
80 #if defined(MBEDTLS_HAVEGE_C)
81     mbedtls_havege_init( &ctx->havege_data );
82 #endif
83 
84     /* Reminder: Update ENTROPY_HAVE_STRONG in the test files
85      *           when adding more strong entropy sources here. */
86 
87 #if defined(MBEDTLS_TEST_NULL_ENTROPY)
88     mbedtls_entropy_add_source( ctx, mbedtls_null_entropy_poll, NULL,
89                                 1, MBEDTLS_ENTROPY_SOURCE_STRONG );
90 #endif
91 
92 #if !defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES)
93 #if !defined(MBEDTLS_NO_PLATFORM_ENTROPY)
94     mbedtls_entropy_add_source( ctx, mbedtls_platform_entropy_poll, NULL,
95                                 MBEDTLS_ENTROPY_MIN_PLATFORM,
96                                 MBEDTLS_ENTROPY_SOURCE_STRONG );
97 #endif
98 #if defined(MBEDTLS_TIMING_C)
99     mbedtls_entropy_add_source( ctx, mbedtls_hardclock_poll, NULL,
100                                 MBEDTLS_ENTROPY_MIN_HARDCLOCK,
101                                 MBEDTLS_ENTROPY_SOURCE_WEAK );
102 #endif
103 #if defined(MBEDTLS_HAVEGE_C)
104     mbedtls_entropy_add_source( ctx, mbedtls_havege_poll, &ctx->havege_data,
105                                 MBEDTLS_ENTROPY_MIN_HAVEGE,
106                                 MBEDTLS_ENTROPY_SOURCE_STRONG );
107 #endif
108 #if defined(MBEDTLS_ENTROPY_HARDWARE_ALT)
109     mbedtls_entropy_add_source( ctx, mbedtls_hardware_poll, NULL,
110                                 MBEDTLS_ENTROPY_MIN_HARDWARE,
111                                 MBEDTLS_ENTROPY_SOURCE_STRONG );
112 #endif
113 #if defined(MBEDTLS_ENTROPY_NV_SEED)
114     mbedtls_entropy_add_source( ctx, mbedtls_nv_seed_poll, NULL,
115                                 MBEDTLS_ENTROPY_BLOCK_SIZE,
116                                 MBEDTLS_ENTROPY_SOURCE_STRONG );
117     ctx->initial_entropy_run = 0;
118 #endif
119 #endif /* MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES */
120 }
121 
mbedtls_entropy_free(mbedtls_entropy_context * ctx)122 void mbedtls_entropy_free( mbedtls_entropy_context *ctx )
123 {
124 #if defined(MBEDTLS_HAVEGE_C)
125     mbedtls_havege_free( &ctx->havege_data );
126 #endif
127 #if defined(MBEDTLS_THREADING_C)
128     mbedtls_mutex_free( &ctx->mutex );
129 #endif
130 #if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
131     mbedtls_sha512_free( &ctx->accumulator );
132 #else
133     mbedtls_sha256_free( &ctx->accumulator );
134 #endif
135 #if defined(MBEDTLS_ENTROPY_NV_SEED)
136     ctx->initial_entropy_run = 0;
137 #endif
138     ctx->source_count = 0;
139     mbedtls_platform_zeroize( ctx->source, sizeof( ctx->source ) );
140     ctx->accumulator_started = 0;
141 }
142 
mbedtls_entropy_add_source(mbedtls_entropy_context * ctx,mbedtls_entropy_f_source_ptr f_source,void * p_source,size_t threshold,int strong)143 int mbedtls_entropy_add_source( mbedtls_entropy_context *ctx,
144                         mbedtls_entropy_f_source_ptr f_source, void *p_source,
145                         size_t threshold, int strong )
146 {
147     int idx, ret = 0;
148 
149 #if defined(MBEDTLS_THREADING_C)
150     if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
151         return( ret );
152 #endif
153 
154     idx = ctx->source_count;
155     if( idx >= MBEDTLS_ENTROPY_MAX_SOURCES )
156     {
157         ret = MBEDTLS_ERR_ENTROPY_MAX_SOURCES;
158         goto exit;
159     }
160 
161     ctx->source[idx].f_source  = f_source;
162     ctx->source[idx].p_source  = p_source;
163     ctx->source[idx].threshold = threshold;
164     ctx->source[idx].strong    = strong;
165 
166     ctx->source_count++;
167 
168 exit:
169 #if defined(MBEDTLS_THREADING_C)
170     if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
171         return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
172 #endif
173 
174     return( ret );
175 }
176 
177 /*
178  * Entropy accumulator update
179  */
entropy_update(mbedtls_entropy_context * ctx,unsigned char source_id,const unsigned char * data,size_t len)180 static int entropy_update( mbedtls_entropy_context *ctx, unsigned char source_id,
181                            const unsigned char *data, size_t len )
182 {
183     unsigned char header[2];
184     unsigned char tmp[MBEDTLS_ENTROPY_BLOCK_SIZE];
185     size_t use_len = len;
186     const unsigned char *p = data;
187     int ret = 0;
188 
189     if( use_len > MBEDTLS_ENTROPY_BLOCK_SIZE )
190     {
191 #if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
192         if( ( ret = mbedtls_sha512_ret( data, len, tmp, 0 ) ) != 0 )
193             goto cleanup;
194 #else
195         if( ( ret = mbedtls_sha256_ret( data, len, tmp, 0 ) ) != 0 )
196             goto cleanup;
197 #endif
198         p = tmp;
199         use_len = MBEDTLS_ENTROPY_BLOCK_SIZE;
200     }
201 
202     header[0] = source_id;
203     header[1] = use_len & 0xFF;
204 
205     /*
206      * Start the accumulator if this has not already happened. Note that
207      * it is sufficient to start the accumulator here only because all calls to
208      * gather entropy eventually execute this code.
209      */
210 #if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
211     if( ctx->accumulator_started == 0 &&
212         ( ret = mbedtls_sha512_starts_ret( &ctx->accumulator, 0 ) ) != 0 )
213         goto cleanup;
214     else
215         ctx->accumulator_started = 1;
216     if( ( ret = mbedtls_sha512_update_ret( &ctx->accumulator, header, 2 ) ) != 0 )
217         goto cleanup;
218     ret = mbedtls_sha512_update_ret( &ctx->accumulator, p, use_len );
219 #else
220     if( ctx->accumulator_started == 0 &&
221         ( ret = mbedtls_sha256_starts_ret( &ctx->accumulator, 0 ) ) != 0 )
222         goto cleanup;
223     else
224         ctx->accumulator_started = 1;
225     if( ( ret = mbedtls_sha256_update_ret( &ctx->accumulator, header, 2 ) ) != 0 )
226         goto cleanup;
227     ret = mbedtls_sha256_update_ret( &ctx->accumulator, p, use_len );
228 #endif
229 
230 cleanup:
231     mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
232 
233     return( ret );
234 }
235 
mbedtls_entropy_update_manual(mbedtls_entropy_context * ctx,const unsigned char * data,size_t len)236 int mbedtls_entropy_update_manual( mbedtls_entropy_context *ctx,
237                            const unsigned char *data, size_t len )
238 {
239     int ret;
240 
241 #if defined(MBEDTLS_THREADING_C)
242     if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
243         return( ret );
244 #endif
245 
246     ret = entropy_update( ctx, MBEDTLS_ENTROPY_SOURCE_MANUAL, data, len );
247 
248 #if defined(MBEDTLS_THREADING_C)
249     if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
250         return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
251 #endif
252 
253     return( ret );
254 }
255 
256 /*
257  * Run through the different sources to add entropy to our accumulator
258  */
entropy_gather_internal(mbedtls_entropy_context * ctx)259 static int entropy_gather_internal( mbedtls_entropy_context *ctx )
260 {
261     int ret, i, have_one_strong = 0;
262     unsigned char buf[MBEDTLS_ENTROPY_MAX_GATHER];
263     size_t olen;
264 
265     if( ctx->source_count == 0 )
266         return( MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED );
267 
268     /*
269      * Run through our entropy sources
270      */
271     for( i = 0; i < ctx->source_count; i++ )
272     {
273         if( ctx->source[i].strong == MBEDTLS_ENTROPY_SOURCE_STRONG )
274             have_one_strong = 1;
275 
276         olen = 0;
277         if( ( ret = ctx->source[i].f_source( ctx->source[i].p_source,
278                         buf, MBEDTLS_ENTROPY_MAX_GATHER, &olen ) ) != 0 )
279         {
280             goto cleanup;
281         }
282 
283         /*
284          * Add if we actually gathered something
285          */
286         if( olen > 0 )
287         {
288             if( ( ret = entropy_update( ctx, (unsigned char) i,
289                                         buf, olen ) ) != 0 )
290                 return( ret );
291             ctx->source[i].size += olen;
292         }
293     }
294 
295     if( have_one_strong == 0 )
296         ret = MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE;
297 
298 cleanup:
299     mbedtls_platform_zeroize( buf, sizeof( buf ) );
300 
301     return( ret );
302 }
303 
304 /*
305  * Thread-safe wrapper for entropy_gather_internal()
306  */
mbedtls_entropy_gather(mbedtls_entropy_context * ctx)307 int mbedtls_entropy_gather( mbedtls_entropy_context *ctx )
308 {
309     int ret;
310 
311 #if defined(MBEDTLS_THREADING_C)
312     if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
313         return( ret );
314 #endif
315 
316     ret = entropy_gather_internal( ctx );
317 
318 #if defined(MBEDTLS_THREADING_C)
319     if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
320         return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
321 #endif
322 
323     return( ret );
324 }
325 
mbedtls_entropy_func(void * data,unsigned char * output,size_t len)326 int mbedtls_entropy_func( void *data, unsigned char *output, size_t len )
327 {
328     int ret, count = 0, i, done;
329     mbedtls_entropy_context *ctx = (mbedtls_entropy_context *) data;
330     unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE];
331 
332     if( len > MBEDTLS_ENTROPY_BLOCK_SIZE )
333         return( MBEDTLS_ERR_ENTROPY_SOURCE_FAILED );
334 
335 #if defined(MBEDTLS_ENTROPY_NV_SEED)
336     /* Update the NV entropy seed before generating any entropy for outside
337      * use.
338      */
339     if( ctx->initial_entropy_run == 0 )
340     {
341         ctx->initial_entropy_run = 1;
342         if( ( ret = mbedtls_entropy_update_nv_seed( ctx ) ) != 0 )
343             return( ret );
344     }
345 #endif
346 
347 #if defined(MBEDTLS_THREADING_C)
348     if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
349         return( ret );
350 #endif
351 
352     /*
353      * Always gather extra entropy before a call
354      */
355     do
356     {
357         if( count++ > ENTROPY_MAX_LOOP )
358         {
359             ret = MBEDTLS_ERR_ENTROPY_SOURCE_FAILED;
360             goto exit;
361         }
362 
363         if( ( ret = entropy_gather_internal( ctx ) ) != 0 )
364             goto exit;
365 
366         done = 1;
367         for( i = 0; i < ctx->source_count; i++ )
368             if( ctx->source[i].size < ctx->source[i].threshold )
369                 done = 0;
370     }
371     while( ! done );
372 
373     memset( buf, 0, MBEDTLS_ENTROPY_BLOCK_SIZE );
374 
375 #if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
376     /*
377      * Note that at this stage it is assumed that the accumulator was started
378      * in a previous call to entropy_update(). If this is not guaranteed, the
379      * code below will fail.
380      */
381     if( ( ret = mbedtls_sha512_finish_ret( &ctx->accumulator, buf ) ) != 0 )
382         goto exit;
383 
384     /*
385      * Reset accumulator and counters and recycle existing entropy
386      */
387     mbedtls_sha512_free( &ctx->accumulator );
388     mbedtls_sha512_init( &ctx->accumulator );
389     if( ( ret = mbedtls_sha512_starts_ret( &ctx->accumulator, 0 ) ) != 0 )
390         goto exit;
391     if( ( ret = mbedtls_sha512_update_ret( &ctx->accumulator, buf,
392                                            MBEDTLS_ENTROPY_BLOCK_SIZE ) ) != 0 )
393         goto exit;
394 
395     /*
396      * Perform second SHA-512 on entropy
397      */
398     if( ( ret = mbedtls_sha512_ret( buf, MBEDTLS_ENTROPY_BLOCK_SIZE,
399                                     buf, 0 ) ) != 0 )
400         goto exit;
401 #else /* MBEDTLS_ENTROPY_SHA512_ACCUMULATOR */
402     if( ( ret = mbedtls_sha256_finish_ret( &ctx->accumulator, buf ) ) != 0 )
403         goto exit;
404 
405     /*
406      * Reset accumulator and counters and recycle existing entropy
407      */
408     mbedtls_sha256_free( &ctx->accumulator );
409     mbedtls_sha256_init( &ctx->accumulator );
410     if( ( ret = mbedtls_sha256_starts_ret( &ctx->accumulator, 0 ) ) != 0 )
411         goto exit;
412     if( ( ret = mbedtls_sha256_update_ret( &ctx->accumulator, buf,
413                                            MBEDTLS_ENTROPY_BLOCK_SIZE ) ) != 0 )
414         goto exit;
415 
416     /*
417      * Perform second SHA-256 on entropy
418      */
419     if( ( ret = mbedtls_sha256_ret( buf, MBEDTLS_ENTROPY_BLOCK_SIZE,
420                                     buf, 0 ) ) != 0 )
421         goto exit;
422 #endif /* MBEDTLS_ENTROPY_SHA512_ACCUMULATOR */
423 
424     for( i = 0; i < ctx->source_count; i++ )
425         ctx->source[i].size = 0;
426 
427     memcpy( output, buf, len );
428 
429     ret = 0;
430 
431 exit:
432     mbedtls_platform_zeroize( buf, sizeof( buf ) );
433 
434 #if defined(MBEDTLS_THREADING_C)
435     if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
436         return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
437 #endif
438 
439     return( ret );
440 }
441 
442 #if defined(MBEDTLS_ENTROPY_NV_SEED)
mbedtls_entropy_update_nv_seed(mbedtls_entropy_context * ctx)443 int mbedtls_entropy_update_nv_seed( mbedtls_entropy_context *ctx )
444 {
445     int ret = MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
446     unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE];
447 
448     /* Read new seed  and write it to NV */
449     if( ( ret = mbedtls_entropy_func( ctx, buf, MBEDTLS_ENTROPY_BLOCK_SIZE ) ) != 0 )
450         return( ret );
451 
452     if( mbedtls_nv_seed_write( buf, MBEDTLS_ENTROPY_BLOCK_SIZE ) < 0 )
453         return( MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR );
454 
455     /* Manually update the remaining stream with a separator value to diverge */
456     memset( buf, 0, MBEDTLS_ENTROPY_BLOCK_SIZE );
457     ret = mbedtls_entropy_update_manual( ctx, buf, MBEDTLS_ENTROPY_BLOCK_SIZE );
458 
459     return( ret );
460 }
461 #endif /* MBEDTLS_ENTROPY_NV_SEED */
462 
463 #if defined(MBEDTLS_FS_IO)
mbedtls_entropy_write_seed_file(mbedtls_entropy_context * ctx,const char * path)464 int mbedtls_entropy_write_seed_file( mbedtls_entropy_context *ctx, const char *path )
465 {
466     int ret = MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
467     FILE *f;
468     unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE];
469 
470     if( ( f = fopen( path, "wb" ) ) == NULL )
471         return( MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR );
472 
473     if( ( ret = mbedtls_entropy_func( ctx, buf, MBEDTLS_ENTROPY_BLOCK_SIZE ) ) != 0 )
474         goto exit;
475 
476     if( fwrite( buf, 1, MBEDTLS_ENTROPY_BLOCK_SIZE, f ) != MBEDTLS_ENTROPY_BLOCK_SIZE )
477     {
478         ret = MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
479         goto exit;
480     }
481 
482     ret = 0;
483 
484 exit:
485     mbedtls_platform_zeroize( buf, sizeof( buf ) );
486 
487     fclose( f );
488     return( ret );
489 }
490 
mbedtls_entropy_update_seed_file(mbedtls_entropy_context * ctx,const char * path)491 int mbedtls_entropy_update_seed_file( mbedtls_entropy_context *ctx, const char *path )
492 {
493     int ret = 0;
494     FILE *f;
495     size_t n;
496     unsigned char buf[ MBEDTLS_ENTROPY_MAX_SEED_SIZE ];
497 
498     if( ( f = fopen( path, "rb" ) ) == NULL )
499         return( MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR );
500 
501     fseek( f, 0, SEEK_END );
502     n = (size_t) ftell( f );
503     fseek( f, 0, SEEK_SET );
504 
505     if( n > MBEDTLS_ENTROPY_MAX_SEED_SIZE )
506         n = MBEDTLS_ENTROPY_MAX_SEED_SIZE;
507 
508     if( fread( buf, 1, n, f ) != n )
509         ret = MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
510     else
511         ret = mbedtls_entropy_update_manual( ctx, buf, n );
512 
513     fclose( f );
514 
515     mbedtls_platform_zeroize( buf, sizeof( buf ) );
516 
517     if( ret != 0 )
518         return( ret );
519 
520     return( mbedtls_entropy_write_seed_file( ctx, path ) );
521 }
522 #endif /* MBEDTLS_FS_IO */
523 
524 #if defined(MBEDTLS_SELF_TEST)
525 #if !defined(MBEDTLS_TEST_NULL_ENTROPY)
526 /*
527  * Dummy source function
528  */
entropy_dummy_source(void * data,unsigned char * output,size_t len,size_t * olen)529 static int entropy_dummy_source( void *data, unsigned char *output,
530                                  size_t len, size_t *olen )
531 {
532     ((void) data);
533 
534     memset( output, 0x2a, len );
535     *olen = len;
536 
537     return( 0 );
538 }
539 #endif /* !MBEDTLS_TEST_NULL_ENTROPY */
540 
541 #if defined(MBEDTLS_ENTROPY_HARDWARE_ALT)
542 
mbedtls_entropy_source_self_test_gather(unsigned char * buf,size_t buf_len)543 static int mbedtls_entropy_source_self_test_gather( unsigned char *buf, size_t buf_len )
544 {
545     int ret = 0;
546     size_t entropy_len = 0;
547     size_t olen = 0;
548     size_t attempts = buf_len;
549 
550     while( attempts > 0 && entropy_len < buf_len )
551     {
552         if( ( ret = mbedtls_hardware_poll( NULL, buf + entropy_len,
553             buf_len - entropy_len, &olen ) ) != 0 )
554             return( ret );
555 
556         entropy_len += olen;
557         attempts--;
558     }
559 
560     if( entropy_len < buf_len )
561     {
562         ret = 1;
563     }
564 
565     return( ret );
566 }
567 
568 
mbedtls_entropy_source_self_test_check_bits(const unsigned char * buf,size_t buf_len)569 static int mbedtls_entropy_source_self_test_check_bits( const unsigned char *buf,
570                                                         size_t buf_len )
571 {
572     unsigned char set= 0xFF;
573     unsigned char unset = 0x00;
574     size_t i;
575 
576     for( i = 0; i < buf_len; i++ )
577     {
578         set &= buf[i];
579         unset |= buf[i];
580     }
581 
582     return( set == 0xFF || unset == 0x00 );
583 }
584 
585 /*
586  * A test to ensure hat the entropy sources are functioning correctly
587  * and there is no obvious failure. The test performs the following checks:
588  *  - The entropy source is not providing only 0s (all bits unset) or 1s (all
589  *    bits set).
590  *  - The entropy source is not providing values in a pattern. Because the
591  *    hardware could be providing data in an arbitrary length, this check polls
592  *    the hardware entropy source twice and compares the result to ensure they
593  *    are not equal.
594  *  - The error code returned by the entropy source is not an error.
595  */
mbedtls_entropy_source_self_test(int verbose)596 int mbedtls_entropy_source_self_test( int verbose )
597 {
598     int ret = 0;
599     unsigned char buf0[2 * sizeof( unsigned long long int )];
600     unsigned char buf1[2 * sizeof( unsigned long long int )];
601 
602     if( verbose != 0 )
603         mbedtls_printf( "  ENTROPY_BIAS test: " );
604 
605     memset( buf0, 0x00, sizeof( buf0 ) );
606     memset( buf1, 0x00, sizeof( buf1 ) );
607 
608     if( ( ret = mbedtls_entropy_source_self_test_gather( buf0, sizeof( buf0 ) ) ) != 0 )
609         goto cleanup;
610     if( ( ret = mbedtls_entropy_source_self_test_gather( buf1, sizeof( buf1 ) ) ) != 0 )
611         goto cleanup;
612 
613     /* Make sure that the returned values are not all 0 or 1 */
614     if( ( ret = mbedtls_entropy_source_self_test_check_bits( buf0, sizeof( buf0 ) ) ) != 0 )
615         goto cleanup;
616     if( ( ret = mbedtls_entropy_source_self_test_check_bits( buf1, sizeof( buf1 ) ) ) != 0 )
617         goto cleanup;
618 
619     /* Make sure that the entropy source is not returning values in a
620      * pattern */
621     ret = memcmp( buf0, buf1, sizeof( buf0 ) ) == 0;
622 
623 cleanup:
624     if( verbose != 0 )
625     {
626         if( ret != 0 )
627             mbedtls_printf( "failed\n" );
628         else
629             mbedtls_printf( "passed\n" );
630 
631         mbedtls_printf( "\n" );
632     }
633 
634     return( ret != 0 );
635 }
636 
637 #endif /* MBEDTLS_ENTROPY_HARDWARE_ALT */
638 
639 /*
640  * The actual entropy quality is hard to test, but we can at least
641  * test that the functions don't cause errors and write the correct
642  * amount of data to buffers.
643  */
mbedtls_entropy_self_test(int verbose)644 int mbedtls_entropy_self_test( int verbose )
645 {
646     int ret = 1;
647 #if !defined(MBEDTLS_TEST_NULL_ENTROPY)
648     mbedtls_entropy_context ctx;
649     unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE] = { 0 };
650     unsigned char acc[MBEDTLS_ENTROPY_BLOCK_SIZE] = { 0 };
651     size_t i, j;
652 #endif /* !MBEDTLS_TEST_NULL_ENTROPY */
653 
654     if( verbose != 0 )
655         mbedtls_printf( "  ENTROPY test: " );
656 
657 #if !defined(MBEDTLS_TEST_NULL_ENTROPY)
658     mbedtls_entropy_init( &ctx );
659 
660     /* First do a gather to make sure we have default sources */
661     if( ( ret = mbedtls_entropy_gather( &ctx ) ) != 0 )
662         goto cleanup;
663 
664     ret = mbedtls_entropy_add_source( &ctx, entropy_dummy_source, NULL, 16,
665                                       MBEDTLS_ENTROPY_SOURCE_WEAK );
666     if( ret != 0 )
667         goto cleanup;
668 
669     if( ( ret = mbedtls_entropy_update_manual( &ctx, buf, sizeof buf ) ) != 0 )
670         goto cleanup;
671 
672     /*
673      * To test that mbedtls_entropy_func writes correct number of bytes:
674      * - use the whole buffer and rely on ASan to detect overruns
675      * - collect entropy 8 times and OR the result in an accumulator:
676      *   any byte should then be 0 with probably 2^(-64), so requiring
677      *   each of the 32 or 64 bytes to be non-zero has a false failure rate
678      *   of at most 2^(-58) which is acceptable.
679      */
680     for( i = 0; i < 8; i++ )
681     {
682         if( ( ret = mbedtls_entropy_func( &ctx, buf, sizeof( buf ) ) ) != 0 )
683             goto cleanup;
684 
685         for( j = 0; j < sizeof( buf ); j++ )
686             acc[j] |= buf[j];
687     }
688 
689     for( j = 0; j < sizeof( buf ); j++ )
690     {
691         if( acc[j] == 0 )
692         {
693             ret = 1;
694             goto cleanup;
695         }
696     }
697 
698 #if defined(MBEDTLS_ENTROPY_HARDWARE_ALT)
699     if( ( ret = mbedtls_entropy_source_self_test( 0 ) ) != 0 )
700         goto cleanup;
701 #endif
702 
703 cleanup:
704     mbedtls_entropy_free( &ctx );
705 #endif /* !MBEDTLS_TEST_NULL_ENTROPY */
706 
707     if( verbose != 0 )
708     {
709         if( ret != 0 )
710             mbedtls_printf( "failed\n" );
711         else
712             mbedtls_printf( "passed\n" );
713 
714         mbedtls_printf( "\n" );
715     }
716 
717     return( ret != 0 );
718 }
719 #endif /* MBEDTLS_SELF_TEST */
720 
721 #endif /* MBEDTLS_ENTROPY_C */
722