mphell-drbg.c

Go to the documentation of this file.

/* 
  MPHELL-4.0 
  Author(s): The MPHELL team

 (C) Copyright 2015-2018 - Institut Fourier / Univ. Grenoble Alpes (France) 

 This file is part of the MPHELL Library.
 MPHELL is free software: you can redistribute it and/or modify
 it under the terms of the GNU Lesser General Public License as published by
 the Free Software Foundation, version 3 of the License.
 
 MPHELL is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU Lesser General Public License for more details.

 You should have received a copy of the GNU Lesser General Public License
 along with MPHELL.  If not, see <http://www.gnu.org/licenses/>.
*/

#include "mphell-drbg.h"

/* The DRBG internal state shall exist solely within the DRBG mechanism boundary. 
 * The internal state shall not be accessible by non-DRBG functions or other instantiations of that or other DRBGs 
 */
static drbg_internal_state drbg_internal_states[DRBG_MAX_INTERNAL_STATES];

int8_t drbg_find_empty_state()
{
    uint8_t i;

    for(i = 0; i < DRBG_MAX_INTERNAL_STATES; i++)
    {
        if(drbg_internal_states[i]->type == DRBG_UNSET)
        {
            return i;
        }        
    }
    return -1;
}


int16_t drbg_find_highest_supported_security_strength(const drbg_type type)
{
    int16_t highest_supported_security_strength;
    
    switch(type)
    {
        case DRBG_SHA1 :
            highest_supported_security_strength = 128;
            break;
            
        case DRBG_SHA256 :
            highest_supported_security_strength = 256;
            break;

        case DRBG_AES128 :
            highest_supported_security_strength = 128;
            break;

        case DRBG_AES192 :
            highest_supported_security_strength = 192;
            break;

        case DRBG_AES256 :
            highest_supported_security_strength = 256;
            break;

        default :
            highest_supported_security_strength = -1;

    }

    return highest_supported_security_strength;
}

void 
drbg_instantiate(mphell_status ret, int8_t *state_handle, 
        const uint16_t requested_instantiation_security_strength, 
        const drbg_type type, const entropy_type entropy_src, uint64_t reseed_interval,
        const uint8_t * entropy, const uint16_t entropy_length,
        const uint8_t * nonce, const uint16_t nonce_length,
        const uint8_t* personalization_string, const uint64_t pers_length)
{
    uint8_t security_strength;
    int8_t handle = -1;
    uint8_t *entropy_input = NULL;

    /* Check the validity of input parameters */
 
    if(type == DRBG_UNSET)
    {
        ret->flag = MPHELL_ERROR_RANDOM;
        char *text = "drbg_instantiate : Invalid DRBG type specified";
        ret->info = malloc(strlen(text));
        memcpy(ret->info, text, strlen(text));
        return;
    }

    if(requested_instantiation_security_strength > (entropy_length * 8))
    {
        ret->flag = MPHELL_ERROR_RANDOM;
        char *text = "drbg_instantiate : Requested security_strength is \
                        greater than the provided entropy";
        ret->info = malloc(strlen(text));
        memcpy(ret->info, text, strlen(text));
        return;
    }
    
    if(requested_instantiation_security_strength > 
        (uint16_t) drbg_find_highest_supported_security_strength(type))
    {
        ret->flag = MPHELL_ERROR_RANDOM;
        char *text = "drbg_instantiate : Requested security_strength is \
                        greater than the highest security strength supported \
                        by the drbg type specified";
        ret->info = malloc(strlen(text));
        memcpy(ret->info, text, strlen(text));
        return;
    }
    
    if(pers_length > DRBG_MAX_PERSONALIZATION_STRING_LENGTH)
    {
        ret->flag = MPHELL_ERROR_RANDOM;
        char *text = "drbg_instantiate : The length of the personalization \
                        string is too big";
        ret->info = malloc(strlen(text));
        memcpy(ret->info, text, strlen(text));
        return;
    }
    
    
    if((reseed_interval > DRBG_MAX_RESEED_INTERVAL) || (reseed_interval == 0))
    {
        ret->flag = MPHELL_ERROR_RANDOM;
        char *text = "drbg_instantiate : The reseed interval must be 1 <= reseed_interval <= DRBG_MAX_RESEED_INTERVAL";
        ret->info = malloc(strlen(text));
        memcpy(ret->info, text, strlen(text));
        return;
    }

    /* Check the avialability of an empty internal state */

    handle = drbg_find_empty_state();
    if(handle == -1)
    {
        ret->flag = MPHELL_ERROR_RANDOM;
        char *text = "drbg_instantiate : There is no available empty \
                        internal state";
        ret->info = malloc(strlen(text));
        memcpy(ret->info, text, strlen(text));
        return;
    }

    /* Set security_strength to the lowest security_strength greater than equal
     * to requested_instantiation_security_strength from the set
     *  {112, 128, 192, 256} */

    if(requested_instantiation_security_strength > 192)
    {
        security_strength = 256 / 8;
    }
    else if(requested_instantiation_security_strength > 128)
    {
        security_strength = 192 / 8;
    }
    else if(requested_instantiation_security_strength > 112)
    {
        security_strength = 128 / 8;
    }
    else
    {
        security_strength = 112 / 8;
    }

    /* Set predefined entropy and nonce for drbg test. Never use for random application !!! */
    entropy_input = malloc(entropy_length + nonce_length);
    
    memcpy(entropy_input, entropy, entropy_length);
    memcpy(entropy_input + entropy_length, nonce, nonce_length);
    
    drbg_internal_states[handle]->entropy_src = entropy_src;

    /* Call appropriate instantiation algorithm */

    switch(type)
    {
        case DRBG_SHA1 :
        case DRBG_SHA256 : 
            hash_drbg_instantiate(ret, drbg_internal_states[handle],
                        security_strength, entropy_input, entropy_length + nonce_length,
                        personalization_string, pers_length, type);
            break;

        case DRBG_AES128 :
        case DRBG_AES192 :
        case DRBG_AES256 : 
            ctr_drbg_instantiate(ret, drbg_internal_states[handle],
                        security_strength, entropy_input, entropy_length + nonce_length,
                        personalization_string, pers_length, type);
            break;
        default :
            ret->flag = MPHELL_ERROR_RANDOM;
            char *text = "drbg_instantiate : Invalid drbg type, only \
                            supported DRBG_SHA1, DRBG_SHA256, DRBG_AES128, DRBG_AES192,\
                            DRBG_AES256";
            ret->info = malloc(strlen(text));
            memcpy(ret->info, text, strlen(text));
    }
    if(entropy_input != NULL)
    {
        free(entropy_input);
    }
    if(ret->flag == MPHELL_SUCCESS)
    {
        *state_handle = handle;
        drbg_internal_states[handle]->type = type;
        drbg_internal_states[handle]->info->security_strength = 
            security_strength;
        drbg_internal_states[handle]->info->reseed_interval = 
            reseed_interval;
    }
}

void 
drbg_reseed(mphell_status ret, const int8_t state_handle,
        const uint8_t * entropy, const uint16_t entropy_length,
        const uint8_t* additional_input, const uint64_t add_length)
{
    /* Get the current internal state */

    if((state_handle < 0) || (state_handle > DRBG_MAX_INTERNAL_STATES) ||
            ((drbg_internal_states[state_handle])->type == DRBG_UNSET))
    {
        ret->flag = MPHELL_ERROR_RANDOM;
        char *text = "drbg_reseed : Invalid state handle specified";
        ret->info = malloc(strlen(text));
        memcpy(ret->info, text, strlen(text));
        return; 
    }

    drbg_internal_state_t *internal_state = drbg_internal_states[state_handle];

    /* Check the input parameters */ 
    
    if(internal_state->info->security_strength > entropy_length)
    {
        ret->flag = MPHELL_ERROR_RANDOM;
        char *text = "drbg_reseed : security_strength is \
                        greater than the provided entropy";
        ret->info = malloc(strlen(text));
        memcpy(ret->info, text, strlen(text));
        return;
    }

    if(additional_input != NULL && 
            (add_length > DRBG_MAX_ADDITIONAL_INPUT_LENGTH))
    {
        ret->flag = MPHELL_ERROR_RANDOM;
        char *text = "drbg_reseed : The length of the additional_input \
                        string is too big";
        ret->info = malloc(strlen(text));
        memcpy(ret->info, text, strlen(text));
        return;
    }

    /* Call appropriate reseed algorithm */

    switch(internal_state->type)
    {
        case DRBG_SHA1 :
        case DRBG_SHA256 :
            hash_drbg_reseed(ret, internal_state, entropy, entropy_length,
                    additional_input, add_length);
            break;

        case DRBG_AES128 :
        case DRBG_AES192 :
        case DRBG_AES256 :
            ctr_drbg_reseed(ret, internal_state, entropy, entropy_length,
                    additional_input, add_length);
            break;

        default :
            ret->flag = MPHELL_ERROR_RANDOM;
            char *text = "drbg_reseed : Invalid drbg type, only \
                            supported DRBG_SHA1, DRBG_SHA256, DRBG_AES128, DRBG_AES192,\
                            DRBG_AES256";
            ret->info = malloc(strlen(text));
            memcpy(ret->info, text, strlen(text));
    }
}

void drbg_generate(mphell_status ret, uint8_t* returned_bytes, 
        const int8_t state_handle, const uint32_t requested_number_of_bytes, 
        const uint16_t requested_security_strength,
        const uint8_t* additional_input, const uint64_t add_length)
{
    /* Get the current internal state */

    if((state_handle < 0) || (state_handle > DRBG_MAX_INTERNAL_STATES) ||
            ((drbg_internal_states[state_handle])->type == DRBG_UNSET))
    {
        ret->flag = MPHELL_ERROR_RANDOM;
        char *text = "drbg_generate : Invalid state handle specified";
        ret->info = malloc(strlen(text));
        memcpy(ret->info, text, strlen(text));
        return; 
    }

    drbg_internal_state_t *internal_state = drbg_internal_states[state_handle];

    /* Check the input parameters */ 

    if(requested_number_of_bytes > DRBG_MAX_NUMBER_OF_BYTES_PER_REQUEST)
    {
        ret->flag = MPHELL_ERROR_RANDOM;
        char *text = "drbg_generate : requested_number_of bytes is greater \
                        than DRBG_MAX_NUMBER_OF_BYTES_PER_REQUEST";
        ret->info = malloc(strlen(text));
        memcpy(ret->info, text, strlen(text));
        return;
    }

    if((requested_security_strength / 8) > 
            internal_state->info->security_strength)
    {
        ret->flag = MPHELL_ERROR_RANDOM;
        char *text = "drbg_generate : requested_security_strength is greater \
                        than security strength specified in internal state";
        ret->info = malloc(strlen(text));
        memcpy(ret->info, text, strlen(text));
        return;
    }

    if(additional_input != NULL && 
            (add_length > DRBG_MAX_ADDITIONAL_INPUT_LENGTH))
    {
        ret->flag = MPHELL_ERROR_RANDOM;
        char *text = "drbg_generate : The length of the additional_input \
                        string is too big";
        ret->info = malloc(strlen(text));
        memcpy(ret->info, text, strlen(text));
        return;
    }
    
    /* Call appropriate generate algorithm */

    switch(internal_state->type)
    {
        case DRBG_SHA1 :
        case DRBG_SHA256 :
            hash_drbg_generate(ret, returned_bytes, internal_state,
                    requested_number_of_bytes, additional_input, add_length);
            break;

        case DRBG_AES128 :
        case DRBG_AES192 :
        case DRBG_AES256 :
            ctr_drbg_generate(ret, returned_bytes, internal_state,
                    requested_number_of_bytes, additional_input, add_length);
            break;

        default:
            ret->flag = MPHELL_ERROR_RANDOM;
            char *text = "drbg_generate : Invalid drbg type, only \
                            supported DRBG_SHA1, DRBG_SHA256, DRBG_AES128, DRBG_AES192,\
                            DRBG_AES256";
            ret->info = malloc(strlen(text));
            memcpy(ret->info, text, strlen(text));    
    }
    
    /* Call drbg_reseed if reseed is required, and generate random number */
    
    if(ret->flag == MPHELL_RESEED_REQUIRED)
    {
        /* Get entropy from the source */
        drbg_internal_state_t *internal_state = drbg_internal_states[state_handle];
        uint8_t* entropy_input = malloc(2 * internal_state->info->security_strength);
        get_entropy_input(ret, entropy_input, internal_state->entropy_src, 2 * internal_state->info->security_strength);

        char *text;
        if(ret->flag != MPHELL_SUCCESS)
        {
            if(entropy_input != NULL)
            {
                free(entropy_input);
            }
            ret->flag = MPHELL_ERROR_RANDOM;
            text = "drbg_generate : get_entropy_input failed"; 
            ret->info = malloc(strlen(text));
            memcpy(ret->info, text, strlen(text));
            return;
        }
        drbg_reseed(ret, state_handle, entropy_input, 2 * internal_state->info->security_strength, additional_input, add_length);
        if(entropy_input != NULL)
        {
            free(entropy_input);
        }
        if(ret->flag != MPHELL_SUCCESS)
        {
            return;
        }
        
        /* Call appropriate generate algorithm with additional_input = the Null string */

        switch(internal_state->type)
        {
            case DRBG_SHA1 :
            case DRBG_SHA256 :
                hash_drbg_generate(ret, returned_bytes, internal_state,
                        requested_number_of_bytes, NULL, 0);
                break;

            case DRBG_AES128 :
            case DRBG_AES192 :
            case DRBG_AES256 :
                ctr_drbg_generate(ret, returned_bytes, internal_state,
                        requested_number_of_bytes, NULL, 0);
                break;

            default:
                ret->flag = MPHELL_ERROR_RANDOM;
                char *text = "drbg_generate : Invalid drbg type, only \
                                supported DRBG_SHA1, DRBG_SHA256, DRBG_AES128, DRBG_AES192,\
                                DRBG_AES256";
                ret->info = malloc(strlen(text));
                memcpy(ret->info, text, strlen(text));    
        }
    }
}

void
drbg_uninstantiate(mphell_status ret, const int8_t state_handle)
{
    /* Get the current internal state */

    if((state_handle < 0) || (state_handle > DRBG_MAX_INTERNAL_STATES))
    {
        ret->flag = MPHELL_ERROR_RANDOM;
        char *text = "drbg_unsinstantiate : Invalid state handle specified";
        ret->info = malloc(strlen(text));
        memcpy(ret->info, text, strlen(text));
        return; 
    }

    if(drbg_internal_states[state_handle]->type == DRBG_UNSET)
    {
        return;
    }
    drbg_internal_state_t *internal_state = drbg_internal_states[state_handle];
    
    /* Erase the contents of the internal state indicated by state_handle */
    memset(internal_state->state->V, 0, internal_state->info->outlen);
    memset(internal_state->state->C_Key, 0, internal_state->info->seedlen - internal_state->info->outlen);
    free(internal_state->state->V);
    free(internal_state->state->C_Key);
    internal_state->state->V = NULL;
    internal_state->state->C_Key = NULL;
    internal_state->state->reseed_counter = 0;

    internal_state->info->seedlen = 0;
    internal_state->info->outlen = 0;
    internal_state->info->security_strength = 0;

    internal_state->type = DRBG_UNSET;
    ret->flag = MPHELL_SUCCESS;
}