aesCtrDrbg.c File Reference

#include "precomp.h"

Include dependency graph for aesCtrDrbg.c:

Go to the source code of this file.

Macros
#define	SYMCRYPT_RNG_AES_KEY_SIZE   (32)
#define	SYMCRYPT_RNG_AES_KEY_AND_V_SIZE   (32 + 16)
#define	SYMCRYPT_RNG_AES_MAX_REQUEST_SIZE   (1<<16)
#define	SYMCRYPT_RNG_AES_MAX_REQUESTS_PER_RESEED   ((UINT64)1<<48)
#define	TEST_AGAINST_OLD_CODE   0
#define	MAX_CTRMSB64_BLOCKS   (1 << 10)

Functions
VOID SYMCRYPT_CALL	SymCryptRngAesBcc (_In_ PSYMCRYPT_AES_EXPANDED_KEY pKey, _In_reads_(cbData) PCBYTE pcbData, _In_ SIZE_T cbData, _Out_writes_(SYMCRYPT_AES_BLOCK_SIZE) PBYTE pbResult)
VOID SYMCRYPT_CALL	SymCryptRngAesDf (_In_reads_(cbData) PCBYTE pcbData, _In_ SIZE_T cbData, _Out_writes_(SYMCRYPT_RNG_AES_INTERNAL_SEED_SIZE) PBYTE pbSeed)
VOID SYMCRYPT_CALL	SymCryptRngAesGenerateBlocks (_In_ PSYMCRYPT_AES_EXPANDED_KEY pAesKey, _Inout_updates_(SYMCRYPT_AES_BLOCK_SIZE) PBYTE pV, _Out_writes_(cbRandom) PBYTE pbRandom, _In_ SIZE_T cbRandom)
FORCEINLINE int	SymCryptRngAesAreBlocksIdentical (_In_reads_(SYMCRYPT_AES_BLOCK_SIZE) PCBYTE pSrc1, _In_reads_(SYMCRYPT_AES_BLOCK_SIZE) PCBYTE pSrc2)
VOID SYMCRYPT_CALL	SymCryptRngAesCheckBlocksNotIdentical (_Inout_updates_(SYMCRYPT_AES_BLOCK_SIZE) PBYTE pbPreviousBlock, _In_reads_(cbData) PCBYTE pcbData, SIZE_T cbData)
VOID SYMCRYPT_CALL	SymCryptRngAesUpdate (_Inout_ PSYMCRYPT_RNG_AES_STATE pState, _In_reads_opt_(SYMCRYPT_RNG_AES_INTERNAL_SEED_SIZE) PCBYTE pbProvidedData, _In_opt_ PSYMCRYPT_AES_EXPANDED_KEY pAesKey)
SYMCRYPT_ERROR SYMCRYPT_CALL	SymCryptRngAesGenerateSmall (_Inout_ PSYMCRYPT_RNG_AES_STATE pRngState, _Out_writes_(cbRandom) PBYTE pbRandom, SIZE_T cbRandom, _In_reads_opt_(cbAdditionalInput) PCBYTE pbAdditionalInput, SIZE_T cbAdditionalInput)
_Use_decl_annotations_ SYMCRYPT_NOINLINE SYMCRYPT_ERROR SYMCRYPT_CALL	SymCryptRngAesInstantiate (PSYMCRYPT_RNG_AES_STATE pRngState, PCBYTE pcbSeedMaterial, SIZE_T cbSeedMaterial)
_Use_decl_annotations_ SYMCRYPT_NOINLINE VOID SYMCRYPT_CALL	SymCryptRngAesGenerate (PSYMCRYPT_RNG_AES_STATE pRngState, PBYTE pbRandom, SIZE_T cbRandom)
_Use_decl_annotations_ SYMCRYPT_NOINLINE SYMCRYPT_ERROR SYMCRYPT_CALL	SymCryptRngAesReseed (PSYMCRYPT_RNG_AES_STATE pRngState, PCBYTE pcbSeedMaterial, SIZE_T cbSeedMaterial)
_Use_decl_annotations_ SYMCRYPT_NOINLINE VOID SYMCRYPT_CALL	SymCryptRngAesUninstantiate (PSYMCRYPT_RNG_AES_STATE pRngState)
VOID SYMCRYPT_CALL	SymCryptRngAesTestInstantiate (PSYMCRYPT_RNG_AES_STATE pRngState)
VOID SYMCRYPT_CALL	SymCryptRngAesTestReseed (PSYMCRYPT_RNG_AES_STATE pRngState)
VOID SYMCRYPT_CALL	SymCryptRngAesTestGenerate (PSYMCRYPT_RNG_AES_STATE pRngState)
VOID SYMCRYPT_CALL	SymCryptRngAesTestUninstantiate (PSYMCRYPT_RNG_AES_STATE pRngState)
VOID SYMCRYPT_CALL	SymCryptRngAesInstantiateSelftest (void)
VOID SYMCRYPT_CALL	SymCryptRngAesReseedSelftest (void)
VOID SYMCRYPT_CALL	SymCryptRngAesGenerateSelftest (void)
_Use_decl_annotations_ SYMCRYPT_ERROR SYMCRYPT_CALL	SymCryptRngAesFips140_2Instantiate (PSYMCRYPT_RNG_AES_FIPS140_2_STATE pRngState, PCBYTE pcbSeedMaterial, SIZE_T cbSeedMaterial)
_Use_decl_annotations_ VOID SYMCRYPT_CALL	SymCryptRngAesFips140_2Generate (PSYMCRYPT_RNG_AES_FIPS140_2_STATE pRngState, PBYTE pbRandom, SIZE_T cbRandom)
_Use_decl_annotations_ SYMCRYPT_ERROR SYMCRYPT_CALL	SymCryptRngAesFips140_2Reseed (PSYMCRYPT_RNG_AES_FIPS140_2_STATE pRngState, PCBYTE pcbSeedMaterial, SIZE_T cbSeedMaterial)
_Use_decl_annotations_ VOID SYMCRYPT_CALL	SymCryptRngAesFips140_2Uninstantiate (PSYMCRYPT_RNG_AES_FIPS140_2_STATE pRngState)

Variables
static const BYTE	g_abInstantiateEntropyInputPlusNonce []
static const BYTE	g_abReseedEntropy []
static const BYTE	g_abOutput1 [32]
static const BYTE	g_expectedStateAfterInstantiate [SYMCRYPT_RNG_AES_KEY_AND_V_SIZE]
static const BYTE	g_expectedStateAfterReseed [SYMCRYPT_RNG_AES_KEY_AND_V_SIZE]
static const BYTE	g_expectedStateAfterGenerate [SYMCRYPT_RNG_AES_KEY_AND_V_SIZE]

Macro Definition Documentation

MAX_CTRMSB64_BLOCKS

#define MAX_CTRMSB64_BLOCKS   (1 << 10)

SYMCRYPT_RNG_AES_KEY_AND_V_SIZE

#define SYMCRYPT_RNG_AES_KEY_AND_V_SIZE   (32 + 16)

Definition at line 14 of file aesCtrDrbg.c.

SYMCRYPT_RNG_AES_KEY_SIZE

#define SYMCRYPT_RNG_AES_KEY_SIZE   (32)

Definition at line 13 of file aesCtrDrbg.c.

SYMCRYPT_RNG_AES_MAX_REQUEST_SIZE

#define SYMCRYPT_RNG_AES_MAX_REQUEST_SIZE   (1<<16)

Definition at line 15 of file aesCtrDrbg.c.

SYMCRYPT_RNG_AES_MAX_REQUESTS_PER_RESEED

#define SYMCRYPT_RNG_AES_MAX_REQUESTS_PER_RESEED   ((UINT64)1<<48)

Definition at line 16 of file aesCtrDrbg.c.

TEST_AGAINST_OLD_CODE

#define TEST_AGAINST_OLD_CODE   0

Function Documentation

SymCryptRngAesAreBlocksIdentical()

FORCEINLINE int SymCryptRngAesAreBlocksIdentical	(	_In_reads_(SYMCRYPT_AES_BLOCK_SIZE) PCBYTE	pSrc1,
		_In_reads_(SYMCRYPT_AES_BLOCK_SIZE) PCBYTE	pSrc2
	)

Definition at line 299 of file aesCtrDrbg.c.

{
    SYMCRYPT_UNALIGNED const SIZE_T * p1 = (SYMCRYPT_UNALIGNED const SIZE_T *) pSrc1;
    SYMCRYPT_UNALIGNED const SIZE_T * p2 = (SYMCRYPT_UNALIGNED const SIZE_T *) pSrc2;
 
    SIZE_T tmp;
 
#if SYMCRYPT_CPU_X86 | SYMCRYPT_CPU_ARM
 
    C_ASSERT( sizeof( SIZE_T ) == 4 );
    tmp = (p1[0] ^ p2[0]) | (p1[1] ^ p2[1]) | (p1[2] ^ p2[2]) | (p1[3] ^ p2[3]);
 
#elif SYMCRYPT_CPU_AMD64 | SYMCRYPT_CPU_ARM64
 
    C_ASSERT( sizeof( SIZE_T ) == 8 );
    tmp = (p1[0] ^ p2[0]) | (p1[1] ^ p2[1]);
 
#else
 
    SIZE_T i;
 
    C_ASSERT( 16 % sizeof( SIZE_T ) == 0 );
 
    tmp = 0;
    for( i=0; i < 16/sizeof( SIZE_T ); i ++ )
    {
        tmp |= p1[i] ^ p2[i];
    }
 
#endif
 
    return tmp == 0;
}

Referenced by SymCryptRngAesCheckBlocksNotIdentical().

SymCryptRngAesBcc()

VOID SYMCRYPT_CALL SymCryptRngAesBcc	(	_In_ PSYMCRYPT_AES_EXPANDED_KEY	pKey,
		_In_reads_(cbData) PCBYTE	pcbData,
		_In_ SIZE_T	cbData,
		_Out_writes_(SYMCRYPT_AES_BLOCK_SIZE) PBYTE	pbResult
	)

Definition at line 20 of file aesCtrDrbg.c.

{
    //
    //Length of input should always be multiple of the AES block size
    //
    SYMCRYPT_ASSERT(cbData % SYMCRYPT_AES_BLOCK_SIZE == 0);
 
    SymCryptWipe( pbResult, SYMCRYPT_AES_BLOCK_SIZE );
 
    SymCryptAesCbcMac( pKey, pbResult, pcbData, cbData );
}

Referenced by SymCryptRngAesDf().

SymCryptRngAesCheckBlocksNotIdentical()

VOID SYMCRYPT_CALL SymCryptRngAesCheckBlocksNotIdentical	(	_Inout_updates_(SYMCRYPT_AES_BLOCK_SIZE) PBYTE	pbPreviousBlock,
		_In_reads_(cbData) PCBYTE	pcbData,
		SIZE_T	cbData
	)

Definition at line 341 of file aesCtrDrbg.c.

{
    SIZE_T identical;
    SIZE_T i;
 
    SYMCRYPT_ASSERT( ((cbData & 15) == 0) && cbData > 0 );
 
    identical = SymCryptRngAesAreBlocksIdentical( pbPreviousBlock, pcbData );
 
    for( i = SYMCRYPT_AES_BLOCK_SIZE; i < cbData; i += SYMCRYPT_AES_BLOCK_SIZE )
    {
        SYMCRYPT_ASSERT( cbData >= i + SYMCRYPT_AES_BLOCK_SIZE );
        identical |= SymCryptRngAesAreBlocksIdentical( &pcbData[i-SYMCRYPT_AES_BLOCK_SIZE], &pcbData[ i ] );
    }
 
    memcpy( pbPreviousBlock, &pcbData[cbData - SYMCRYPT_AES_BLOCK_SIZE], SYMCRYPT_AES_BLOCK_SIZE );
 
    //
    // The structure of AES-CTR-DRBG makes it impossible for two consecutive blocks of a single request
    // to be equal. The only way this could happen is if the first block of one request is the same as
    // the last block of the previous request. But the probability of this happening is 2^{-128}.
    // This never happens, so the whole check is technically useless.
    // Nevertheless, it is required by FIPS 140-2, so we have to implement it,
    // but we don't have to handle the error usefully in any way.
    // (Trying to handle this error sensibly is far too complicated, and adds far more danger from code
    // bugs than it is worth. It is much better to just treat it as a fatal occurrence.)
    //
 
    if( identical )
    {
        SymCryptFatal( 'acdi' );
    }
}

Referenced by SymCryptRngAesGenerateSmall().

SymCryptRngAesDf()

VOID SYMCRYPT_CALL SymCryptRngAesDf	(	_In_reads_(cbData) PCBYTE	pcbData,
		_In_ SIZE_T	cbData,
		_Out_writes_(SYMCRYPT_RNG_AES_INTERNAL_SEED_SIZE) PBYTE	pbSeed
	)

Definition at line 39 of file aesCtrDrbg.c.

{
    //maximal input length + IV + padding
    SYMCRYPT_ALIGN BYTE         buf[SYMCRYPT_RNG_AES_MAX_SEED_SIZE + 3 * SYMCRYPT_AES_BLOCK_SIZE];
    PBYTE                       pb;
    SIZE_T                      lenIvS;
 
    SYMCRYPT_ALIGN BYTE         temp[SYMCRYPT_RNG_AES_KEY_AND_V_SIZE];
    SYMCRYPT_AES_EXPANDED_KEY   aesKey;
    PBYTE                       pX;
 
    SIZE_T                      i;
 
    C_ASSERT( sizeof( temp ) % SYMCRYPT_AES_BLOCK_SIZE == 0 );
 
    //
    // See SP800-90 section 10.4.2
    //
    // Our buf contains the following data:
    // - 16 bytes IV
    // - 4 bytes L
    // - 4 bytes N
    // - up to SEEDLEN bytes input data
    // - 1 byte 0x80
    // - zeroes to fill to a multiple of 16
    //
 
    SYMCRYPT_ASSERT(    cbData >= SYMCRYPT_RNG_AES_MIN_RESEED_SIZE &&
                        cbData <= SYMCRYPT_RNG_AES_MAX_SEED_SIZE );
 
    //
    // Initialize the entire buf to zero
    //
    SymCryptWipeKnownSize( buf, sizeof( buf ) );
 
    //
    // build the string S in buf[16...]
    //
    pb = &buf[ SYMCRYPT_AES_BLOCK_SIZE ];
 
    //
    // Set L; SP800-90 isn't clear, but we'll use MSB first as that is what is used elsewhere.
    //
    SYMCRYPT_STORE_MSBFIRST32( pb, (UINT32) cbData );
    pb += 4;
 
    //
    // Set N
    //
    SYMCRYPT_STORE_MSBFIRST32( pb, SYMCRYPT_RNG_AES_INTERNAL_SEED_SIZE );
    pb += 4;
 
    //
    // Set input_string
    //
 
    memcpy( pb, pcbData, cbData );
    pb += cbData;
 
    //
    // set padding
    //
    *pb++ = 0x80;
 
    while( (pb - buf) % SYMCRYPT_AES_BLOCK_SIZE != 0 )
    {
#pragma prefast( suppress: 26015, "Logic why this doesn't overflow the buf[] array is too complicated for prefast" )
        *pb++ = 0;
    }
 
    lenIvS = pb - buf;      // Length of IV & S together
 
    //
    // Set up the inital key
    //
 
    for( i = 0; i < SYMCRYPT_RNG_AES_KEY_SIZE; i++ )
    {
        temp[i] = (BYTE) i;
    }
    SymCryptAesExpandKeyEncryptOnly( &aesKey, temp, SYMCRYPT_RNG_AES_KEY_SIZE );
 
 
    //
    // Produce the 'temp' intermediate result.
    //
 
    for( i=0; i< SYMCRYPT_RNG_AES_KEY_AND_V_SIZE / SYMCRYPT_AES_BLOCK_SIZE; i++ )
    {
        //
        // Update the IV with the right i value.
        // i is only 0-2, so we only have to set a single byte
        //
        buf[3] = (BYTE) i;
 
        //
        // Now we perform the BCC function, which is just CbcMac
        // BCC(K,(IV||S))
        SymCryptRngAesBcc( &aesKey, buf, lenIvS, &temp[ i * SYMCRYPT_AES_BLOCK_SIZE ] );
     }
 
    //
    // Second phase, produce the actual output
    //
    SymCryptAesExpandKeyEncryptOnly( &aesKey, temp, SYMCRYPT_RNG_AES_KEY_SIZE );
    pX = &temp[SYMCRYPT_RNG_AES_KEY_SIZE];
 
    for( i=0; i < SYMCRYPT_RNG_AES_INTERNAL_SEED_SIZE; i += SYMCRYPT_AES_BLOCK_SIZE )
    {
        SymCryptAesEncrypt( &aesKey, pX, pX );
        memcpy( &pbSeed[ i ], pX, SYMCRYPT_AES_BLOCK_SIZE );
    }
 
    SymCryptWipeKnownSize( buf, sizeof( buf ) );
    SymCryptWipeKnownSize( temp, sizeof( temp ) );
    SymCryptWipeKnownSize( &aesKey, sizeof( aesKey ) );
}

Referenced by SymCryptRngAesGenerateSmall(), and SymCryptRngAesReseed().

SymCryptRngAesFips140_2Generate()

_Use_decl_annotations_ VOID SYMCRYPT_CALL SymCryptRngAesFips140_2Generate	(	PSYMCRYPT_RNG_AES_FIPS140_2_STATE	pRngState,
		PBYTE	pbRandom,
		SIZE_T	cbRandom
	)

Definition at line 962 of file aesCtrDrbg.c.

{
    SymCryptRngAesGenerate( &pRngState->rng, pbRandom, cbRandom );
}

SymCryptRngAesFips140_2Instantiate()

_Use_decl_annotations_ SYMCRYPT_ERROR SYMCRYPT_CALL SymCryptRngAesFips140_2Instantiate	(	PSYMCRYPT_RNG_AES_FIPS140_2_STATE	pRngState,
		PCBYTE	pcbSeedMaterial,
		SIZE_T	cbSeedMaterial
	)

Definition at line 939 of file aesCtrDrbg.c.

{
    SYMCRYPT_ERROR scError;
 
    scError = SymCryptRngAesInstantiate( &pRngState->rng, pcbSeedMaterial, cbSeedMaterial );
 
    if( scError == SYMCRYPT_NO_ERROR )
    {
        //
        // Generate the first block of output and store it so that we can compare future blocks.
        //
        SymCryptRngAesGenerate( &pRngState->rng, pRngState->rng.previousBlock, sizeof( pRngState->rng.previousBlock ) );
        pRngState->rng.fips140_2Check = TRUE;
    }
 
    return scError;
}

SymCryptRngAesFips140_2Reseed()

_Use_decl_annotations_ SYMCRYPT_ERROR SYMCRYPT_CALL SymCryptRngAesFips140_2Reseed	(	PSYMCRYPT_RNG_AES_FIPS140_2_STATE	pRngState,
		PCBYTE	pcbSeedMaterial,
		SIZE_T	cbSeedMaterial
	)

Definition at line 972 of file aesCtrDrbg.c.

{
    return SymCryptRngAesReseed( &pRngState->rng, pcbSeedMaterial, cbSeedMaterial );
}

SymCryptRngAesFips140_2Uninstantiate()

_Use_decl_annotations_ VOID SYMCRYPT_CALL SymCryptRngAesFips140_2Uninstantiate

(

PSYMCRYPT_RNG_AES_FIPS140_2_STATE

pRngState

)

Definition at line 983 of file aesCtrDrbg.c.

{
    SymCryptRngAesUninstantiate( &pRngState->rng );
}

SymCryptRngAesGenerate()

_Use_decl_annotations_ SYMCRYPT_NOINLINE VOID SYMCRYPT_CALL SymCryptRngAesGenerate	(	PSYMCRYPT_RNG_AES_STATE	pRngState,
		PBYTE	pbRandom,
		SIZE_T	cbRandom
	)

Definition at line 563 of file aesCtrDrbg.c.

{
    SYMCRYPT_ERROR scError;
 
    SYMCRYPT_CHECK_MAGIC( pRngState );
 
    while( cbRandom > SYMCRYPT_RNG_AES_MAX_REQUEST_SIZE )
    {
 
        scError = SymCryptRngAesGenerateSmall( pRngState, pbRandom, SYMCRYPT_RNG_AES_MAX_REQUEST_SIZE, NULL, 0 );
        if( scError != SYMCRYPT_NO_ERROR )
        {
            SymCryptFatal( 'acdx' );
        }
        pbRandom += SYMCRYPT_RNG_AES_MAX_REQUEST_SIZE;
        cbRandom -= SYMCRYPT_RNG_AES_MAX_REQUEST_SIZE;
    }
 
    if( cbRandom > 0 )
    {
        scError = SymCryptRngAesGenerateSmall( pRngState, pbRandom, cbRandom, NULL, 0 );
        if( scError != SYMCRYPT_NO_ERROR )
        {
            SymCryptFatal( 'acdx' );
        }
    }
}

Referenced by SymCryptRngAesFips140_2Generate(), and SymCryptRngAesFips140_2Instantiate().

SymCryptRngAesGenerateBlocks()

VOID SYMCRYPT_CALL SymCryptRngAesGenerateBlocks	(	_In_ PSYMCRYPT_AES_EXPANDED_KEY	pAesKey,
		_Inout_updates_(SYMCRYPT_AES_BLOCK_SIZE) PBYTE	pV,
		_Out_writes_(cbRandom) PBYTE	pbRandom,
		_In_ SIZE_T	cbRandom
	)

Definition at line 163 of file aesCtrDrbg.c.

{
    UINT64  v;
    SIZE_T  cBlocks;
    SIZE_T  blocksToDo;
    SIZE_T  bytesToDo;
 
//
// The roll-over of the counter is hard to test, especially since our
// NIST test vectors only cover small outputs.
// We have an option to test the output against a simpler (older) implementation
// to validate the proper working of the code.
//
#define TEST_AGAINST_OLD_CODE   0
#if TEST_AGAINST_OLD_CODE
    BYTE    Vcopy[16];
    BYTE    buf[16];
    PCBYTE  pbCheck = pbRandom;
    SIZE_T  cbCheck = cbRandom;
 
    memcpy( Vcopy, pV, 16 );
#endif
 
    //
    // cbRandom must be a multiple of BLOCK_LEN and > 0.
    //
    SYMCRYPT_ASSERT( (cbRandom & (SYMCRYPT_AES_BLOCK_SIZE-1)) == 0 );
 
    cBlocks = cbRandom / SYMCRYPT_AES_BLOCK_SIZE;
 
    //
    // We violate the write-once rule here by wiping the output buffer and then
    // filling it with the CTR-mode encryption.
    // This is safe because the caller only learns the proper output anyway.
    //
    SymCryptWipe( pbRandom, cbRandom );
 
    //
    // This loop is a little complicated because we need to pre-increment the 128-bit value V
    // and the SymCryptAesCtrMsb64 function does a 64-bit post-increment.
    //
    while( cBlocks != 0 )
    {
        // Increment V
        v = SYMCRYPT_LOAD_MSBFIRST64( &pV[8] ) + 1;
        SYMCRYPT_STORE_MSBFIRST64( &pV[8], v );
        SYMCRYPT_STORE_MSBFIRST64( &pV[0], SYMCRYPT_LOAD_MSBFIRST64( &pV[0] ) + (v == 0) );
 
        //
        // The SymCryptAesCtrMsb64 routine will increment the last 64 bits of the V value,
        // but not handle the carry to the first 64 bits.
        // We limit how many block we do so that we never cross this boundary.
        // SymCryptAesCtrMsb64 does a post-increment, so it may increment the last 64 bits
        // to zero as long as we don't rely on the V value afterwards.
        // As one-in-2^64 code is not testable, we terminate the Msb64 call earlier, and
        // much earlier on CHKed builds.
        //
#if SYMCRYPT_DEBUG
#define MAX_CTRMSB64_BLOCKS (1 << 3)        // very small; overflow will be triggered by any reasonable test
#else
#define MAX_CTRMSB64_BLOCKS (1 << 10)         // increase when we have this well-tested
#endif
        //
        // 1 + (~v & mask) is the value you can add to v so that the mask bits of the sum
        // end up to be zero. It is in the range 1 .. mask+1
        //
        blocksToDo = SYMCRYPT_MIN( cBlocks, 1 + ( (~v) & (MAX_CTRMSB64_BLOCKS - 1) ) );
 
        bytesToDo = blocksToDo * SYMCRYPT_AES_BLOCK_SIZE;
        SYMCRYPT_ASSERT( bytesToDo <= cbRandom );
        SymCryptAesCtrMsb64( pAesKey, &pV[0], pbRandom, pbRandom, bytesToDo );
        pbRandom += bytesToDo;
        cbRandom -= bytesToDo;          // only used for prefast assertions; optimized away in shipping code
        cBlocks -= blocksToDo;
 
        //
        // Post-decrement the V block to compensate for the post-increment of the Msb64 function
        //
        v += blocksToDo - 1;
        SYMCRYPT_ASSERT( v != 0 );
 
        SYMCRYPT_STORE_MSBFIRST64( &pV[8], v );
        // No need to carry to the first half of V here, it cannot happen
    }
 
#if TEST_AGAINST_OLD_CODE
    //
    // We tried to use the CtrMsb64 mode to generate the blocks, but that leads to
    // a number of complications.
    // The lack of carry means we end up with code paths that run once per 2^64 blocks
    // or so, and that is very hard to test.
    // Furthermore, CtrMsb64 uses post-increment, whereas AES-CTR_DRBG uses pre-increment.
    // That adds sufficient extra complications and testing problems that we went back
    // to the solution below.
    //
 
    while( cbCheck != 0 )
    {
        SYMCRYPT_ASSERT( cbCheck >= SYMCRYPT_AES_BLOCK_SIZE );     // Keep prefast happy
        //
        // Increment the 128-bit block V MSByte first.
        //
        v = SYMCRYPT_LOAD_MSBFIRST64( &Vcopy[8] ) + 1;
        SYMCRYPT_STORE_MSBFIRST64( &Vcopy[8], v );
        if( v == 0 )
        {
            //
            // This almost never happens.
            // Using an if() is not side-channel safe, but in this case
            // the side channel does not reveal anything that actually hurts the
            // security of the algorithm.
            //
            SYMCRYPT_STORE_MSBFIRST64( Vcopy, 1 + LOAD_MSBFIRST64( Vcopy ) );
        }
 
        SymCryptAesEncrypt( pAesKey, Vcopy, buf );
        if( memcmp( buf, pbCheck, 16 ) != 0 )
        {
            SymCryptFatal( 'OLD?' );
        }
        pbCheck += SYMCRYPT_AES_BLOCK_SIZE;
        cbCheck -= SYMCRYPT_AES_BLOCK_SIZE;
    }
#endif
}

Referenced by SymCryptRngAesGenerateSmall(), and SymCryptRngAesUpdate().

SymCryptRngAesGenerateSelftest()

VOID SYMCRYPT_CALL SymCryptRngAesGenerateSelftest

(

void

)

Definition at line 918 of file aesCtrDrbg.c.

{
    SYMCRYPT_RNG_AES_STATE rng;
 
    SymCryptRngAesTestGenerate( &rng );
 
    //
    // Uninstantiate has to be tested whenever another function is tested.
    //
    SymCryptRngAesTestUninstantiate( &rng );
}

SymCryptRngAesGenerateSmall()

SYMCRYPT_ERROR SYMCRYPT_CALL SymCryptRngAesGenerateSmall	(	_Inout_ PSYMCRYPT_RNG_AES_STATE	pRngState,
		_Out_writes_(cbRandom) PBYTE	pbRandom,
		SIZE_T	cbRandom,
		_In_reads_opt_(cbAdditionalInput) PCBYTE	pbAdditionalInput,
		SIZE_T	cbAdditionalInput
	)

Definition at line 436 of file aesCtrDrbg.c.

{
    SYMCRYPT_AES_EXPANDED_KEY   aesKey;
    SYMCRYPT_ALIGN BYTE         buf[SYMCRYPT_AES_BLOCK_SIZE];
    SYMCRYPT_ALIGN BYTE         abSeed[SYMCRYPT_RNG_AES_INTERNAL_SEED_SIZE];
 
    //
    // SP 800-90 9.3.1 requires a check on the length of the request.
    //
    if( cbRandom > SYMCRYPT_RNG_AES_MAX_REQUEST_SIZE )
    {
        return SYMCRYPT_WRONG_DATA_SIZE;
    }
    //
    // The requestCounter test is useless as it can never happen. (It would require
    // 2^48 calls to this function to trigger this error.)
    // Unfortunately, SP800-90 section 11 requires a test of this error, so we have
    // to implement the error.
    //
    if( pRngState->requestCounter > SYMCRYPT_RNG_AES_MAX_REQUESTS_PER_RESEED )
    {
        return SYMCRYPT_FIPS_FAILURE;
    }
 
    if( pbAdditionalInput != NULL )
    {
        // Update additional input using Derivation function
        SymCryptRngAesDf( pbAdditionalInput, cbAdditionalInput, abSeed );
        pbAdditionalInput = &abSeed[0];
 
        // Update state with modified additional input
        SymCryptRngAesUpdate( pRngState, pbAdditionalInput, NULL );
    }
 
    SymCryptAesExpandKeyEncryptOnly( &aesKey, pRngState->keyAndV, SYMCRYPT_RNG_AES_KEY_SIZE );
 
    if( cbRandom >= SYMCRYPT_AES_BLOCK_SIZE )
    {
        SIZE_T wholeBlocks = cbRandom & ~(SYMCRYPT_AES_BLOCK_SIZE - 1);
        SymCryptRngAesGenerateBlocks(   &aesKey,
                                        &pRngState->keyAndV[ SYMCRYPT_RNG_AES_KEY_SIZE],
                                        pbRandom,
                                        wholeBlocks );
        if( pRngState->fips140_2Check )
        {
            SymCryptRngAesCheckBlocksNotIdentical( pRngState->previousBlock, pbRandom, wholeBlocks );
        }
        pbRandom += wholeBlocks;
        cbRandom -= wholeBlocks;
    }
 
    if( cbRandom > 0 )
    {
        SYMCRYPT_ASSERT( cbRandom < SYMCRYPT_AES_BLOCK_SIZE );
        SymCryptRngAesGenerateBlocks(   &aesKey,
                                        &pRngState->keyAndV[ SYMCRYPT_RNG_AES_KEY_SIZE],
                                        buf,
                                        sizeof( buf ) );
        if( pRngState->fips140_2Check )
        {
            SymCryptRngAesCheckBlocksNotIdentical( pRngState->previousBlock, buf, sizeof( buf ) );
        }
 
        memcpy( pbRandom, buf, cbRandom );
        SymCryptWipeKnownSize( buf, sizeof( buf ) );
    }
 
    SymCryptRngAesUpdate( pRngState, pbAdditionalInput, &aesKey );
 
    ++pRngState->requestCounter;
 
    SymCryptWipeKnownSize( &aesKey, sizeof( aesKey ) );
    SymCryptWipeKnownSize( abSeed, sizeof( abSeed ) );
 
    return SYMCRYPT_NO_ERROR;
}

Referenced by SymCryptRngAesGenerate(), and SymCryptRngAesTestGenerate().

SymCryptRngAesInstantiate()

_Use_decl_annotations_ SYMCRYPT_NOINLINE SYMCRYPT_ERROR SYMCRYPT_CALL SymCryptRngAesInstantiate	(	PSYMCRYPT_RNG_AES_STATE	pRngState,
		PCBYTE	pcbSeedMaterial,
		SIZE_T	cbSeedMaterial
	)

Definition at line 527 of file aesCtrDrbg.c.

{
    if( cbSeedMaterial < SYMCRYPT_RNG_AES_MIN_INSTANTIATE_SIZE )
    {
        return SYMCRYPT_EXTERNAL_FAILURE;
    }
 
    //
    // Instantiation of a new state is identical to setting the state to zero
    // and then performing a reseed with the same seed material.
    //
    // See SP 800-90 10.2.1.3.2 & 10.2.1.4.2
    //
    SymCryptWipeKnownSize( pRngState, sizeof( *pRngState ) );
 
    SYMCRYPT_SET_MAGIC( pRngState );
 
    return SymCryptRngAesReseed( pRngState, pcbSeedMaterial, cbSeedMaterial );
}

Referenced by SymCryptRngAesFips140_2Instantiate(), and SymCryptRngAesTestInstantiate().

SymCryptRngAesInstantiateSelftest()

VOID SYMCRYPT_CALL SymCryptRngAesInstantiateSelftest

(

void

)

Definition at line 890 of file aesCtrDrbg.c.

{
    SYMCRYPT_RNG_AES_STATE rng;
 
    SymCryptRngAesTestInstantiate( &rng );
 
    //
    // Uninstantiate has to be tested whenever another function is tested.
    //
    SymCryptRngAesTestUninstantiate( &rng );
}

SymCryptRngAesReseed()

_Use_decl_annotations_ SYMCRYPT_NOINLINE SYMCRYPT_ERROR SYMCRYPT_CALL SymCryptRngAesReseed	(	PSYMCRYPT_RNG_AES_STATE	pRngState,
		PCBYTE	pcbSeedMaterial,
		SIZE_T	cbSeedMaterial
	)

Definition at line 603 of file aesCtrDrbg.c.

{
    SYMCRYPT_ALIGN BYTE    abSeed[SYMCRYPT_RNG_AES_INTERNAL_SEED_SIZE];
 
    SYMCRYPT_CHECK_MAGIC( pRngState );
 
    //
    // For a reseed, the minimum # bits is the security strength, or the key size.
    // We retain the same maximum as that protects our own internal buffers.
    //
    if (cbSeedMaterial < SYMCRYPT_RNG_AES_MIN_RESEED_SIZE ||
        cbSeedMaterial > SYMCRYPT_RNG_AES_MAX_SEED_SIZE )
    {
        return SYMCRYPT_EXTERNAL_FAILURE;     // bug is external to SymCrypt (i.e. the caller)
    }
 
    //
    // We do not perform the FIPS-required reseed self-test here.
    // Rather, we have a function that external callers can use to implement that test before
    // calling this reseed function.
    // This allows callers that are not interested in FIPS certification to skip the test.
    //
 
    SymCryptRngAesDf( pcbSeedMaterial, cbSeedMaterial, abSeed );
 
    SymCryptRngAesUpdate( pRngState, abSeed, NULL );
 
    pRngState->requestCounter = 1;
 
    SymCryptWipeKnownSize( abSeed, sizeof( abSeed ) );
 
    return SYMCRYPT_NO_ERROR;
}

Referenced by SymCryptRngAesFips140_2Reseed(), SymCryptRngAesInstantiate(), and SymCryptRngAesTestReseed().

SymCryptRngAesReseedSelftest()

VOID SYMCRYPT_CALL SymCryptRngAesReseedSelftest

(

void

)

Definition at line 904 of file aesCtrDrbg.c.

{
    SYMCRYPT_RNG_AES_STATE rng;
 
    SymCryptRngAesTestReseed( &rng );
 
    //
    // Uninstantiate has to be tested whenever another function is tested.
    //
    SymCryptRngAesTestUninstantiate( &rng );
}

SymCryptRngAesTestGenerate()

VOID SYMCRYPT_CALL SymCryptRngAesTestGenerate

(

PSYMCRYPT_RNG_AES_STATE

pRngState

)

Definition at line 800 of file aesCtrDrbg.c.

{
    BYTE            abOutput[2*SYMCRYPT_AES_BLOCK_SIZE];
    SYMCRYPT_ERROR  scError;
 
    //
    // Set the state to a known value
    //
    SYMCRYPT_SET_MAGIC( pRngState );
    memcpy( pRngState->keyAndV, g_expectedStateAfterReseed, SYMCRYPT_RNG_AES_KEY_AND_V_SIZE );
    pRngState->requestCounter = 7;
    pRngState->fips140_2Check = FALSE;
 
    //
    // Test the error handling
    // - Too many requests since last reseed
    // - Too many bytes in request
    //
 
    pRngState->requestCounter = SYMCRYPT_RNG_AES_MAX_REQUESTS_PER_RESEED + 1;
    scError = SymCryptRngAesGenerateSmall( pRngState, abOutput, sizeof( g_abOutput1 ), NULL, 0 );
 
    if( scError == SYMCRYPT_NO_ERROR )
    {
        SymCryptFatal( 'acg1' );
    }
    pRngState->requestCounter = 7;
 
#pragma prefast( suppress: 6202 26000, "buffer size of cbOutput is purposely incorrect");
    scError = SymCryptRngAesGenerateSmall( pRngState, abOutput, SYMCRYPT_RNG_AES_MAX_REQUEST_SIZE + 1, NULL, 0 );
 
    if( scError == SYMCRYPT_NO_ERROR )
    {
        SymCryptFatal( 'acg2' );
    }
 
    //
    // Now test for correct output data.
    //
    scError = SymCryptRngAesGenerateSmall( pRngState, abOutput, sizeof( g_abOutput1 ), NULL, 0 );
 
    SymCryptInjectError( abOutput, sizeof( abOutput ) );
 
    if( scError != SYMCRYPT_NO_ERROR || memcmp( abOutput, g_abOutput1, sizeof( g_abOutput1 ) ) != 0 )
    {
        SymCryptFatal( 'acg3' );
    }
 
    //
    // And test for the correct resulting state
    //
    SymCryptInjectError( pRngState->keyAndV, SYMCRYPT_RNG_AES_KEY_AND_V_SIZE );
 
    if ( 0 != memcmp( pRngState->keyAndV,
                        g_expectedStateAfterGenerate,
                        SYMCRYPT_RNG_AES_KEY_AND_V_SIZE ) )
    {
        SymCryptFatal( 'acg4' );
    }
}

Referenced by SymCryptRngAesGenerateSelftest().

SymCryptRngAesTestInstantiate()

VOID SYMCRYPT_CALL SymCryptRngAesTestInstantiate

(

PSYMCRYPT_RNG_AES_STATE

pRngState

)

Definition at line 727 of file aesCtrDrbg.c.

{
    SYMCRYPT_ERROR scError;
    //
    // First test the error handling
    //
#pragma prefast( suppress: 26060 6309 28020, "Deliberate test of invalid parameter");
    scError = SymCryptRngAesInstantiate( pRngState, NULL, 327 );
    if( scError == SYMCRYPT_NO_ERROR )
    {
        SymCryptFatal( 'aci1' );
    }
 
 
    scError = SymCryptRngAesInstantiate( pRngState,
                                         g_abInstantiateEntropyInputPlusNonce,
                                         sizeof( g_abInstantiateEntropyInputPlusNonce )
                                         );
 
    SymCryptInjectError( pRngState->keyAndV, SYMCRYPT_RNG_AES_KEY_AND_V_SIZE );
 
    if ( scError != SYMCRYPT_NO_ERROR ||
         0 != memcmp( pRngState->keyAndV,
                        g_expectedStateAfterInstantiate,
                        SYMCRYPT_RNG_AES_KEY_AND_V_SIZE ))
    {
        SymCryptFatal( 'aci2' );
    }
}

Referenced by SymCryptRngAesInstantiateSelftest().

SymCryptRngAesTestReseed()

VOID SYMCRYPT_CALL SymCryptRngAesTestReseed

(

PSYMCRYPT_RNG_AES_STATE

pRngState

)

Definition at line 763 of file aesCtrDrbg.c.

{
    SYMCRYPT_ERROR scError;
 
    //
    // Set the state to a known state
    //
    SYMCRYPT_SET_MAGIC( pRngState );
    memcpy( pRngState->keyAndV, g_expectedStateAfterInstantiate, SYMCRYPT_RNG_AES_KEY_AND_V_SIZE );
    pRngState->requestCounter = 7;
    pRngState->fips140_2Check = FALSE;
 
    //
    // Test error handling
    //
#pragma prefast(suppress: 26060 6309 28020, "Deliberate test of invalid parameter");
    scError = SymCryptRngAesReseed( pRngState, NULL, 597 );
    if( scError == SYMCRYPT_NO_ERROR )
    {
        SymCryptFatal( 'acr1' );
    }
 
    scError = SymCryptRngAesReseed( pRngState, g_abReseedEntropy, sizeof( g_abReseedEntropy ) );
 
    SymCryptInjectError( pRngState->keyAndV, SYMCRYPT_RNG_AES_KEY_AND_V_SIZE );
 
    if ( scError != SYMCRYPT_NO_ERROR ||
         0 != memcmp( pRngState->keyAndV,
                        g_expectedStateAfterReseed,
                        SYMCRYPT_RNG_AES_KEY_AND_V_SIZE ) )
    {
        SymCryptFatal( 'acr2' );
    }
}

Referenced by SymCryptRngAesReseedSelftest().

SymCryptRngAesTestUninstantiate()

VOID SYMCRYPT_CALL SymCryptRngAesTestUninstantiate

(

PSYMCRYPT_RNG_AES_STATE

pRngState

)

Definition at line 864 of file aesCtrDrbg.c.

{
    const SIZE_T * p = (const SIZE_T *) pRngState;
    SIZE_T t;
    SIZE_T i;
 
    C_ASSERT( sizeof( *pRngState ) % sizeof( SIZE_T ) == 0 );   // This is true on all our platforms.
 
    SYMCRYPT_CHECK_MAGIC( pRngState );
 
    SymCryptRngAesUninstantiate( pRngState );
 
    t = 0;
    for( i=0; i< sizeof( *pRngState ) / sizeof( SIZE_T ); i ++ )
    {
        t |= p[i];
    }
 
    if( t != 0 )
    {
        SymCryptFatal( 'acdu' );
    }
}

Referenced by SymCryptRngAesGenerateSelftest(), SymCryptRngAesInstantiateSelftest(), and SymCryptRngAesReseedSelftest().

SymCryptRngAesUninstantiate()

_Use_decl_annotations_ SYMCRYPT_NOINLINE VOID SYMCRYPT_CALL SymCryptRngAesUninstantiate

(

PSYMCRYPT_RNG_AES_STATE

pRngState

)

Definition at line 643 of file aesCtrDrbg.c.

{
    SymCryptWipeKnownSize( pRngState, sizeof( *pRngState ) );
}

Referenced by SymCryptRngAesFips140_2Uninstantiate(), and SymCryptRngAesTestUninstantiate().

SymCryptRngAesUpdate()

VOID SYMCRYPT_CALL SymCryptRngAesUpdate	(	_Inout_ PSYMCRYPT_RNG_AES_STATE	pState,
		_In_reads_opt_(SYMCRYPT_RNG_AES_INTERNAL_SEED_SIZE) PCBYTE	pbProvidedData,
		_In_opt_ PSYMCRYPT_AES_EXPANDED_KEY	pAesKey
	)

Definition at line 380 of file aesCtrDrbg.c.

{
    SYMCRYPT_AES_EXPANDED_KEY   aesKey;
    PSYMCRYPT_AES_EXPANDED_KEY  pKey;
    SYMCRYPT_ALIGN  BYTE        buf[SYMCRYPT_AES_BLOCK_SIZE];
 
    if(NULL == pAesKey)
    {
        SymCryptAesExpandKeyEncryptOnly( &aesKey, pState->keyAndV, SYMCRYPT_RNG_AES_KEY_SIZE );
        pKey = &aesKey;
    }
    else
    {
        pKey = pAesKey;
    }
 
    //
    // Copy the V value so that we can overwrite it safely.
    //
 
    memcpy( buf, &pState->keyAndV[SYMCRYPT_RNG_AES_KEY_SIZE], sizeof( buf ) );
 
    SymCryptRngAesGenerateBlocks(
            pKey,
            buf,                            // pV
            pState->keyAndV,                // pbRandom
            sizeof( pState->keyAndV) );     // cbRandom
 
    if( pbProvidedData != NULL )
    {
        // XOR provided data in
        SymCryptXorBytes( pState->keyAndV, pbProvidedData, pState->keyAndV, SYMCRYPT_RNG_AES_INTERNAL_SEED_SIZE );
    }
 
    SymCryptWipeKnownSize( buf, sizeof( buf ) );
 
    //
    // Only wipe the key if necessary.
    //
    if( pKey == &aesKey )
    {
        SymCryptWipeKnownSize( &aesKey, sizeof( aesKey ));
    }
}

Referenced by SymCryptRngAesGenerateSmall(), and SymCryptRngAesReseed().

Variable Documentation

g_abInstantiateEntropyInputPlusNonce

const BYTE g_abInstantiateEntropyInputPlusNonce[]

static

Initial value:

=
{
    
 
    0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,
    0x08,0x09,0x0A,0x0B,0x0C,0x0D,0x0E,0x0F,
    0x10,0x11,0x12,0x13,0x14,0x15,0x16,0x17,
    0x18,0x19,0x1A,0x1B,0x1C,0x1D,0x1E,0x1F,
    0x20,0x21,0x22,0x23,0x24,0x25,0x26,0x27,
    0x28,0x29,0x2A,0x2B,0x2C,0x2D,0x2E,0x2F,
 
    
    0x20,0x21,0x22,0x23,0x24,0x25,0x26,0x27,
    0x28,0x29,0x2A,0x2B,0x2C,0x2D,0x2E,0x2F,
 
}

Definition at line 654 of file aesCtrDrbg.c.

Referenced by SymCryptRngAesTestInstantiate().

g_abOutput1

const BYTE g_abOutput1[32]

static

Initial value:

=
{
   0xD1,0xE9,0xC7,0x37,0xB6,0xEB,0xAE,0xD7,
   0x65,0xA0,0xD4,0xE4,0xC6,0xEA,0xEB,0xE2,
   0x67,0xF5,0xE9,0x19,0x36,0x80,0xFD,0xFF,
   0xA6,0x2F,0x48,0x65,0xB3,0xF0,0x09,0xEC,
}

Definition at line 683 of file aesCtrDrbg.c.

Referenced by SymCryptRngAesTestGenerate().

g_abReseedEntropy

const BYTE g_abReseedEntropy[]

static

Initial value:

=
{
 
   0x80,0x81,0x82,0x83,0x84,0x85,0x86,0x87,
   0x88,0x89,0x8A,0x8B,0x8C,0x8D,0x8E,0x8F,
   0x90,0x91,0x92,0x93,0x94,0x95,0x96,0x97,
   0x98,0x99,0x9A,0x9B,0x9C,0x9D,0x9E,0x9F,
   0xA0,0xA1,0xA2,0xA3,0xA4,0xA5,0xA6,0xA7,
   0xA8,0xA9,0xAA,0xAB,0xAC,0xAD,0xAE,0xAF
}

Definition at line 672 of file aesCtrDrbg.c.

Referenced by SymCryptRngAesTestReseed().

g_expectedStateAfterGenerate

const BYTE g_expectedStateAfterGenerate[SYMCRYPT_RNG_AES_KEY_AND_V_SIZE]

static

Initial value:

=
{
    
    0x28, 0xbc, 0x65, 0xa8, 0x6a, 0xb7, 0xc7, 0x4e, 0xdf, 0x4b, 0xb8, 0x72, 0x87, 0xd3, 0x4f, 0xbb,
    0x8d, 0x6f, 0x16, 0xd7, 0xb9, 0x1b, 0x6a, 0xbb, 0xee, 0x7b, 0x88, 0x86, 0x5b, 0x0f, 0xc7, 0xbd,
    
    0xb7, 0x46, 0x11, 0xf3, 0x92, 0x95, 0xa6, 0x25, 0x7c, 0x39, 0x98, 0x4c, 0x9c, 0x09, 0x9b, 0x30,
}

Definition at line 715 of file aesCtrDrbg.c.

Referenced by SymCryptRngAesTestGenerate().

g_expectedStateAfterInstantiate

const BYTE g_expectedStateAfterInstantiate[SYMCRYPT_RNG_AES_KEY_AND_V_SIZE]

static

Initial value:

=
{
    
    0x8C,0x10,0xB6,0x58,0x44,0x0C,0x71,0x35,
    0x64,0x9D,0xC7,0x7B,0xE6,0xE5,0x75,0xCE,
    0x87,0xE7,0x48,0x90,0x83,0x9B,0x89,0x59,
    0x14,0x17,0xAF,0xAD,0x14,0xB2,0x26,0xD5,
    
    0xB4,0x03,0x6B,0x1D,0xBA,0x04,0x3A,0xE6,
    0x55,0xAC,0xD6,0x46,0xEC,0x5A,0xD3,0x5C,
}

Definition at line 691 of file aesCtrDrbg.c.

Referenced by SymCryptRngAesTestInstantiate(), and SymCryptRngAesTestReseed().

g_expectedStateAfterReseed

const BYTE g_expectedStateAfterReseed[SYMCRYPT_RNG_AES_KEY_AND_V_SIZE]

static

Initial value:

=
{
    
    0x17,0x98,0xC0,0xDF,0x09,0x69,0x6A,0x46,
    0x19,0x46,0xFE,0x6D,0x68,0x7D,0x8C,0xC8,
    0x3F,0xEE,0xF1,0x22,0xF3,0xBB,0xC5,0xF2,
    0x9D,0xAC,0x85,0x10,0xF3,0x4A,0xF0,0x15,
    
    0x0B,0xF3,0x34,0x4D,0xF5,0x29,0x27,0x6B,
    0x0D,0x5B,0xBC,0x83,0x9B,0xD3,0x65,0x6A,
}

Definition at line 703 of file aesCtrDrbg.c.

Referenced by SymCryptRngAesTestGenerate(), and SymCryptRngAesTestReseed().