diff --git a/crypto/crypto_test.cc b/crypto/crypto_test.cc index 0f38923402..63d34d3626 100644 --- a/crypto/crypto_test.cc +++ b/crypto/crypto_test.cc @@ -22,6 +22,7 @@ #include #include #include +#include #include #include @@ -73,6 +74,14 @@ TEST(CryptoTest, Strndup) { EXPECT_STREQ("", str.get()); } +TEST(CryptoTest, aws_lc_assert_entropy_cpu_jitter) { +#if defined(FIPS_ENTROPY_SOURCE_JITTER_CPU) + ASSERT_EQ(1, aws_lc_assert_entropy_cpu_jitter()); +#else + ASSERT_DEATH_IF_SUPPORTED( { aws_lc_assert_entropy_cpu_jitter(); } , ""); +#endif +} + TEST(CryptoTest, OPENSSL_hexstr2buf) { const char *test_cases[][2] = {{"a2", "\xa2"}, {"a213", "\xa2\x13"}, diff --git a/crypto/fipsmodule/rand/rand.c b/crypto/fipsmodule/rand/rand.c index 0b76c54eb0..8bae955e28 100644 --- a/crypto/fipsmodule/rand/rand.c +++ b/crypto/fipsmodule/rand/rand.c @@ -74,8 +74,14 @@ #if defined(FIPS_ENTROPY_SOURCE_JITTER_CPU) static const unsigned kReseedInterval = 16777216; +int aws_lc_assert_entropy_cpu_jitter(void) { + return 1; +} #elif defined(FIPS_ENTROPY_SOURCE_PASSIVE) static const unsigned kReseedInterval = 4096; +int aws_lc_assert_entropy_cpu_jitter(void) { + abort(); +} #else #error "A FIPS entropy source must be explicitly defined" #endif @@ -86,7 +92,9 @@ static const unsigned kReseedInterval = 4096; #error "A FIPS entropy source must not be defined for non-FIPS build" #endif static const unsigned kReseedInterval = 4096; - +int aws_lc_assert_entropy_cpu_jitter(void) { + abort(); +} #endif // defined(BORINGSSL_FIPS) diff --git a/include/openssl/rand.h b/include/openssl/rand.h index fddb890f0c..d0c6de05bc 100644 --- a/include/openssl/rand.h +++ b/include/openssl/rand.h @@ -140,6 +140,10 @@ OPENSSL_EXPORT const RAND_METHOD *RAND_get_rand_method(void); // RAND_set_rand_method returns one. OPENSSL_EXPORT int RAND_set_rand_method(const RAND_METHOD *); +// aws_lc_assert_entropy_cpu_jitter will abort the process if CPU jitter entropy +// was not enabled for the build. +OPENSSL_EXPORT int aws_lc_assert_entropy_cpu_jitter(void); + // RAND_keep_random_devices_open does nothing. OPENSSL_EXPORT OPENSSL_DEPRECATED void RAND_keep_random_devices_open(int a);