Blob Blame Raw
diff -up openssl-1.0.0-beta3/crypto/fips/fips.c.fipsrng openssl-1.0.0-beta3/crypto/fips/fips.c
--- openssl-1.0.0-beta3/crypto/fips/fips.c.fipsrng	2009-08-11 18:12:14.000000000 +0200
+++ openssl-1.0.0-beta3/crypto/fips/fips.c	2009-08-11 18:14:36.000000000 +0200
@@ -427,22 +427,22 @@ int FIPS_mode_set(int onoff)
 	    goto end;
 	    }
 
+	/* now switch the RNG into FIPS mode */
+	fips_set_rand_check(FIPS_rand_method());
+	RAND_set_rand_method(FIPS_rand_method());
+
 	/* automagically seed PRNG if not already seeded */
 	if(!FIPS_rand_status())
 	    {
-	    if(RAND_bytes(buf,sizeof buf) <= 0)
+	    RAND_poll();
+	    if (!FIPS_rand_status())
 		{
 		fips_selftest_fail = 1;
 		ret = 0;
 		goto end;
 		}
-	    FIPS_rand_set_key(buf,32);
-	    FIPS_rand_seed(buf+32,16);
 	    }
 
-	/* now switch into FIPS mode */
-	fips_set_rand_check(FIPS_rand_method());
-	RAND_set_rand_method(FIPS_rand_method());
 	if(FIPS_selftest())
 	    fips_set_mode(1);
 	else
diff -up openssl-1.0.0-beta3/crypto/fips/fips_rand.c.fipsrng openssl-1.0.0-beta3/crypto/fips/fips_rand.c
--- openssl-1.0.0-beta3/crypto/fips/fips_rand.c.fipsrng	2009-08-11 18:12:14.000000000 +0200
+++ openssl-1.0.0-beta3/crypto/fips/fips_rand.c	2009-08-11 18:16:48.000000000 +0200
@@ -155,7 +155,18 @@ static int fips_set_prng_seed(FIPS_PRNG_
 	{
 	int i;
 	if (!ctx->keyed)
-		return 0;
+		{
+		FIPS_RAND_SIZE_T keylen = 16;
+
+		if (seedlen - keylen < AES_BLOCK_LENGTH)
+			return 0;
+		if (seedlen - keylen - 8 >= AES_BLOCK_LENGTH)
+			keylen += 8;
+		if (seedlen - keylen - 8 >= AES_BLOCK_LENGTH)
+			keylen += 8;
+		seedlen -= keylen;
+		fips_set_prng_key(ctx, seed+seedlen, keylen);
+		}
 	/* In test mode seed is just supplied data */
 	if (ctx->test_mode)
 		{
@@ -276,6 +287,7 @@ static int fips_rand(FIPS_PRNG_CTX *ctx,
 	unsigned char R[AES_BLOCK_LENGTH], I[AES_BLOCK_LENGTH];
 	unsigned char tmp[AES_BLOCK_LENGTH];
 	int i;
+	FIPS_selftest_check();
 	if (ctx->error)
 		{
 		RANDerr(RAND_F_FIPS_RAND,RAND_R_PRNG_ERROR);
diff -up openssl-1.0.0-beta3/crypto/rand/rand_lcl.h.fipsrng openssl-1.0.0-beta3/crypto/rand/rand_lcl.h
--- openssl-1.0.0-beta3/crypto/rand/rand_lcl.h.fipsrng	2009-08-11 18:12:13.000000000 +0200
+++ openssl-1.0.0-beta3/crypto/rand/rand_lcl.h	2009-08-11 18:18:13.000000000 +0200
@@ -112,8 +112,11 @@
 #ifndef HEADER_RAND_LCL_H
 #define HEADER_RAND_LCL_H
 
+#ifndef OPENSSL_FIPS
 #define ENTROPY_NEEDED 32  /* require 256 bits = 32 bytes of randomness */
-
+#else
+#define ENTROPY_NEEDED 48  /* we need 48 bytes of randomness for FIPS rng */
+#endif
 
 #if !defined(USE_MD5_RAND) && !defined(USE_SHA1_RAND) && !defined(USE_MDC2_RAND) && !defined(USE_MD2_RAND)
 #if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA1)