Provide RAND_is_entropy_cpu_jitter

aws · Jan 3, 2025 · f5ecde9 · f5ecde9
1 parent 6aa30a9
commit f5ecde9
Show file tree

Hide file tree

Showing 3 changed files with 22 additions and 1 deletion.
diff --git a/crypto/crypto_test.cc b/crypto/crypto_test.cc
@@ -22,6 +22,7 @@
 #include <openssl/crypto.h>
 #include <openssl/cipher.h>
 #include <openssl/mem.h>
+#include <openssl/rand.h>
 #include <openssl/service_indicator.h>
 
 #include <gtest/gtest.h>
@@ -73,6 +74,14 @@ TEST(CryptoTest, Strndup) {
   EXPECT_STREQ("", str.get());
 }
 
+TEST(CryptoTest, aws_lc_assert_entropy_cpu_jitter) {
+#if defined(FIPS_ENTROPY_SOURCE_JITTER_CPU)
+  ASSERT_EQ(1, RAND_is_entropy_cpu_jitter());
+#else
+  ASSERT_EQ(0, RAND_is_entropy_cpu_jitter());
+#endif
+}
+
 TEST(CryptoTest, OPENSSL_hexstr2buf) {
   const char *test_cases[][2] = {{"a2", "\xa2"},
                                  {"a213", "\xa2\x13"},

diff --git a/crypto/fipsmodule/rand/rand.c b/crypto/fipsmodule/rand/rand.c
@@ -74,8 +74,14 @@
 
 #if defined(FIPS_ENTROPY_SOURCE_JITTER_CPU)
 static const unsigned kReseedInterval = 16777216;
+int RAND_is_entropy_cpu_jitter(void) {
+  return 1;
+}
 #elif defined(FIPS_ENTROPY_SOURCE_PASSIVE)
 static const unsigned kReseedInterval = 4096;
+int RAND_is_entropy_cpu_jitter(void) {
+  return 0;
+}
 #else
 #error "A FIPS entropy source must be explicitly defined"
 #endif
@@ -86,7 +92,9 @@ static const unsigned kReseedInterval = 4096;
 #error "A FIPS entropy source must not be defined for non-FIPS build"
 #endif
 static const unsigned kReseedInterval = 4096;
-
+int RAND_is_entropy_cpu_jitter(void) {
+  return 0;
+}
 #endif // defined(BORINGSSL_FIPS)
 
 

diff --git a/include/openssl/rand.h b/include/openssl/rand.h
@@ -140,6 +140,10 @@ OPENSSL_EXPORT const RAND_METHOD *RAND_get_rand_method(void);
 // RAND_set_rand_method returns one.
 OPENSSL_EXPORT int RAND_set_rand_method(const RAND_METHOD *);
 
+// RAND_is_entropy_cpu_jitter returns 1 if CPU jitter entropy
+// was not enabled for the build. Otherwise, returns 0;
+OPENSSL_EXPORT int RAND_is_entropy_cpu_jitter(void);
+
 // RAND_keep_random_devices_open does nothing.
 OPENSSL_EXPORT OPENSSL_DEPRECATED void RAND_keep_random_devices_open(int a);