From 8f3ebb7d601e9066b6ac1059fe28d57cb5fd24a7 Mon Sep 17 00:00:00 2001 From: Dimitri John Ledkov Date: Thu, 11 Jul 2024 12:20:09 +0100 Subject: [PATCH] JITTER: add documentation Reviewed-by: Shane Lontis Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/24844) --- doc/build.info | 6 +++ doc/man7/EVP_RAND-JITTER.pod | 87 ++++++++++++++++++++++++++++++ doc/man7/OSSL_PROVIDER-base.pod | 6 ++- doc/man7/OSSL_PROVIDER-default.pod | 6 ++- 4 files changed, 101 insertions(+), 4 deletions(-) create mode 100644 doc/man7/EVP_RAND-JITTER.pod diff --git a/doc/build.info b/doc/build.info index 5c24273b63..4b14fb393d 100644 --- a/doc/build.info +++ b/doc/build.info @@ -4743,6 +4743,10 @@ DEPEND[html/man7/EVP_RAND-SEED-SRC.html]=man7/EVP_RAND-SEED-SRC.pod GENERATE[html/man7/EVP_RAND-SEED-SRC.html]=man7/EVP_RAND-SEED-SRC.pod DEPEND[man/man7/EVP_RAND-SEED-SRC.7]=man7/EVP_RAND-SEED-SRC.pod GENERATE[man/man7/EVP_RAND-SEED-SRC.7]=man7/EVP_RAND-SEED-SRC.pod +DEPEND[html/man7/EVP_RAND-JITTER.html]=man7/EVP_RAND-JITTER.pod +GENERATE[html/man7/EVP_RAND-JITTER.html]=man7/EVP_RAND-JITTER.pod +DEPEND[man/man7/EVP_RAND-JITTER.7]=man7/EVP_RAND-JITTER.pod +GENERATE[man/man7/EVP_RAND-JITTER.7]=man7/EVP_RAND-JITTER.pod DEPEND[html/man7/EVP_RAND-TEST-RAND.html]=man7/EVP_RAND-TEST-RAND.pod GENERATE[html/man7/EVP_RAND-TEST-RAND.html]=man7/EVP_RAND-TEST-RAND.pod DEPEND[man/man7/EVP_RAND-TEST-RAND.7]=man7/EVP_RAND-TEST-RAND.pod @@ -5109,6 +5113,7 @@ html/man7/EVP_RAND-CTR-DRBG.html \ html/man7/EVP_RAND-HASH-DRBG.html \ html/man7/EVP_RAND-HMAC-DRBG.html \ html/man7/EVP_RAND-SEED-SRC.html \ +html/man7/EVP_RAND-JITTER.html \ html/man7/EVP_RAND-TEST-RAND.html \ html/man7/EVP_RAND.html \ html/man7/EVP_SIGNATURE-DSA.html \ @@ -5254,6 +5259,7 @@ man/man7/EVP_RAND-CTR-DRBG.7 \ man/man7/EVP_RAND-HASH-DRBG.7 \ man/man7/EVP_RAND-HMAC-DRBG.7 \ man/man7/EVP_RAND-SEED-SRC.7 \ +man/man7/EVP_RAND-JITTER.7 \ man/man7/EVP_RAND-TEST-RAND.7 \ man/man7/EVP_RAND.7 \ man/man7/EVP_SIGNATURE-DSA.7 \ diff --git a/doc/man7/EVP_RAND-JITTER.pod b/doc/man7/EVP_RAND-JITTER.pod new file mode 100644 index 0000000000..01f7ea3ab9 --- /dev/null +++ b/doc/man7/EVP_RAND-JITTER.pod @@ -0,0 +1,87 @@ +=pod + +=head1 NAME + +EVP_RAND-JITTER - The randomness seed source EVP_RAND implementation + +=head1 DESCRIPTION + +Support for deterministic random number generator seeding through the +B API. + +The seed source comes from statically linked jitterentropy-library, +which produces randomness based on tiny CPU "jitter" fluctuations. + +=head2 Identity + +"JITTER" is the name for this implementation; it can be used with the +EVP_RAND_fetch() function. + +=head2 Supported parameters + +The supported parameters are: + +=over 4 + +=item "state" (B) + +=item "strength" (B) + +=item "max_request" (B) + +These parameters work as described in L. + +=back + +=head1 NOTES + +A context for the seed source can be obtained by calling: + + EVP_RAND *rand = EVP_RAND_fetch(NULL, "JITTER", NULL); + EVP_RAND_CTX *rctx = EVP_RAND_CTX_new(rand, NULL); + +=head1 EXAMPLES + + EVP_RAND *rand; + EVP_RAND_CTX *seed, *rctx; + unsigned char bytes[100]; + OSSL_PARAM params[2], *p = params; + unsigned int strength = 128; + + /* Create and instantiate a seed source */ + rand = EVP_RAND_fetch(NULL, "JITTER", NULL); + seed = EVP_RAND_CTX_new(rand, NULL); + EVP_RAND_instantiate(seed, strength, 0, NULL, 0, NULL); + EVP_RAND_free(rand); + + /* Feed this into a DRBG */ + rand = EVP_RAND_fetch(NULL, "CTR-DRBG", NULL); + rctx = EVP_RAND_CTX_new(rand, seed); + EVP_RAND_free(rand); + + /* Configure the DRBG */ + *p++ = OSSL_PARAM_construct_utf8_string(OSSL_DRBG_PARAM_CIPHER, + SN_aes_256_ctr, 0); + *p = OSSL_PARAM_construct_end(); + EVP_RAND_instantiate(rctx, strength, 0, NULL, 0, params); + + EVP_RAND_generate(rctx, bytes, sizeof(bytes), strength, 0, NULL, 0); + + EVP_RAND_CTX_free(rctx); + EVP_RAND_CTX_free(seed); + +=head1 SEE ALSO + +L, +L + +=head1 COPYRIGHT + +Copyright 2024 The OpenSSL Project Authors. All Rights Reserved. + +Licensed under the Apache License 2.0 (the "License"). You may not use +this file except in compliance with the License. You can obtain a copy +in the file LICENSE in the source distribution or at +L. + +=cut diff --git a/doc/man7/OSSL_PROVIDER-base.pod b/doc/man7/OSSL_PROVIDER-base.pod index 93a9029fd6..ccd425401d 100644 --- a/doc/man7/OSSL_PROVIDER-base.pod +++ b/doc/man7/OSSL_PROVIDER-base.pod @@ -63,10 +63,12 @@ The OpenSSL base provider supports these operations and algorithms: =item SEED-SRC, see L +=item JITTER, see L + =back -In addition to this provider, the "SEED-SRC" algorithm is also available in the -default provider. +In addition to this provider, the "SEED-SRC" and "JITTER" algorithms +are also available in the default provider. =head2 Asymmetric Key Encoder diff --git a/doc/man7/OSSL_PROVIDER-default.pod b/doc/man7/OSSL_PROVIDER-default.pod index edfd80d354..bc3fe22e17 100644 --- a/doc/man7/OSSL_PROVIDER-default.pod +++ b/doc/man7/OSSL_PROVIDER-default.pod @@ -279,12 +279,14 @@ The OpenSSL default provider supports these operations and algorithms: =item SEED-SRC, see L +=item JITTER, see L + =item TEST-RAND, see L =back -In addition to this provider, the "SEED-SRC" algorithm is also available in the -base provider. +In addition to this provider, the "SEED-SRC" and "JITTER" algorithms +are also available in the base provider. =head2 Asymmetric Key Encoder