library/psa_crypto_random.c

/*
 *  PSA crypto random generator.
 */
/*
 *  Copyright The Mbed TLS Contributors
 *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
 */

#include "common.h"

#if defined(MBEDTLS_PSA_CRYPTO_C) && !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)

#include "psa_crypto_core.h"
#include "psa_crypto_random.h"
#include "psa_crypto_random_impl.h"
#include "threading_internal.h"

#if defined(MBEDTLS_PSA_INJECT_ENTROPY)
#include "entropy_poll.h"
#endif

#if defined(MBEDTLS_PLATFORM_IS_UNIXLIKE)
/* For getpid(), for fork protection */
#include <unistd.h>
#if defined(MBEDTLS_HAVE_TIME)
#include <mbedtls/platform_time.h>
#else
/* For gettimeofday(), for fork protection without actual entropy */
#include <sys/time.h>
#endif
#endif

void psa_random_internal_init(mbedtls_psa_random_context_t *rng)
{
    /* Set default configuration if
     * mbedtls_psa_crypto_configure_entropy_sources() hasn't been called. */
    if (rng->entropy_init == NULL) {
        rng->entropy_init = mbedtls_entropy_init;
    }
    if (rng->entropy_free == NULL) {
        rng->entropy_free = mbedtls_entropy_free;
    }

    rng->entropy_init(&rng->entropy);
#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \
    defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES)
    /* The PSA entropy injection feature depends on using NV seed as an entropy
     * source. Add NV seed as an entropy source for PSA entropy injection. */
    mbedtls_entropy_add_source(&rng->entropy,
                               mbedtls_nv_seed_poll, NULL,
                               MBEDTLS_ENTROPY_BLOCK_SIZE,
                               MBEDTLS_ENTROPY_SOURCE_STRONG);
#endif

    mbedtls_psa_drbg_init(&rng->drbg);
}

void psa_random_internal_free(mbedtls_psa_random_context_t *rng)
{
    mbedtls_psa_drbg_free(&rng->drbg);
    rng->entropy_free(&rng->entropy);
}
psa_status_t psa_random_internal_seed(mbedtls_psa_random_context_t *rng)
{
    const unsigned char drbg_seed[] = "PSA";
    int ret = mbedtls_psa_drbg_seed(&rng->drbg, &rng->entropy,
                                    drbg_seed, sizeof(drbg_seed) - 1);
#if defined(MBEDTLS_PLATFORM_IS_UNIXLIKE)
    rng->pid = getpid();
#endif
    return mbedtls_to_psa_error(ret);
}

#if defined(MBEDTLS_PLATFORM_IS_UNIXLIKE)
static psa_status_t psa_random_internal_reseed_child(
    mbedtls_psa_random_context_t *rng,
    intmax_t pid)
{
    /* Reseeding from actual entropy gives the child a unique RNG state
     * which the parent process cannot predict, and wipes the
     * parent's RNG state from the child.
     *
     * However, in some library configurations, there is no actual
     * entropy source, only a nonvolatile seed (MBEDTLS_ENTROPY_NV_SEED
     * enabled and no actual entropy source enabled). In such a
     * configuration, the reseed operation is deterministic and
     * always injects the same content, so with the DRBG reseed
     * process alone, for example, two child processes forked in
     * close sequence would end up with the same RNG state.

     * To avoid this, we use a personalization string that has a high
     * likelihood of being unique. This way, the child has a unique state.
     * The parent can predict the child's RNG state until the next time
     * it reseeds or generates some random output, but that's
     * unavoidable in the absence of actual entropy.
     */
    struct {
        /* Using the PID mostly guarantees that each child gets a
         * unique state. */
        /* Use intmax_t, not pid_t, because some Unix-like platforms
         * don't define pid_t, or more likely nowadays they define
         * pid_t but only with certain platform macros which might not
         * be the exact ones we use. In practice, this only costs
         * a couple of instructions to pass and compare two words
         * rather than one.
         */
        intmax_t pid;
        /* In case an old child had died and its PID is reused for
         * a new child of the same process, also include the time. */
#if defined(MBEDTLS_HAVE_TIME)
        mbedtls_ms_time_t now;
#else
        struct timeval now;
#endif
    } perso;
    memset(&perso, 0, sizeof(perso));
    perso.pid = pid;
#if defined(MBEDTLS_HAVE_TIME)
    perso.now = mbedtls_ms_time();
#else
    /* We don't have mbedtls_ms_time(), but the platform has getpid().
     * Use gettimeofday(), which is a classic Unix function. Modern POSIX
     * has stopped requiring gettimeofday() (in favor of clock_gettime()),
     * but this is fallback code for restricted configurations, so it's
     * more likely to be used on embedded platforms that only have a subset
     * of Unix APIs and are more likely to have the classic gettimeofday(). */
    if (gettimeofday(&perso.now, NULL) == -1) {
        return PSA_ERROR_INSUFFICIENT_ENTROPY;
    }
#endif
    int ret = mbedtls_psa_drbg_reseed(&rng->drbg,
                                      (unsigned char *) &perso, sizeof(perso));
    return mbedtls_to_psa_error(ret);
}
#endif /* MBEDTLS_PLATFORM_IS_UNIXLIKE */

psa_status_t psa_random_internal_generate(
    mbedtls_psa_random_context_t *rng,
    uint8_t *output, size_t output_size)
{
#if defined(MBEDTLS_PLATFORM_IS_UNIXLIKE)
    intmax_t pid = getpid();
    if (pid != rng->pid) {
        /* This is a (grand...)child of the original process, but
         * we inherited the RNG state from our parent. We must reseed! */
#if defined(MBEDTLS_THREADING_C)
        mbedtls_mutex_lock(&mbedtls_threading_psa_rngdata_mutex);
#endif /* defined(MBEDTLS_THREADING_C) */
        psa_status_t status = psa_random_internal_reseed_child(rng, pid);
        if (status == PSA_SUCCESS) {
            rng->pid = pid;
        }
#if defined(MBEDTLS_THREADING_C)
        mbedtls_mutex_unlock(&mbedtls_threading_psa_rngdata_mutex);
#endif /* defined(MBEDTLS_THREADING_C) */
        if (status != PSA_SUCCESS) {
            return status;
        }
    }
#endif /* MBEDTLS_PLATFORM_IS_UNIXLIKE */

    while (output_size > 0) {
        size_t request_size =
            (output_size > MBEDTLS_PSA_RANDOM_MAX_REQUEST ?
             MBEDTLS_PSA_RANDOM_MAX_REQUEST :
             output_size);
#if defined(MBEDTLS_CTR_DRBG_C)
        int ret = mbedtls_ctr_drbg_random(&rng->drbg, output, request_size);
#elif defined(MBEDTLS_HMAC_DRBG_C)
        int ret = mbedtls_hmac_drbg_random(&rng->drbg, output, request_size);
#endif /* !MBEDTLS_CTR_DRBG_C && !MBEDTLS_HMAC_DRBG_C */
        if (ret != 0) {
            return mbedtls_to_psa_error(ret);
        }
        output_size -= request_size;
        output += request_size;
    }
    return PSA_SUCCESS;
}

#endif /* MBEDTLS_PSA_CRYPTO_C && !MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */