EVP_RAND-CRNG-TEST7ssl
The fips health testing evp_rand filter
Overview
This EVP_RAND object acts as a filter between the entropy source and its users. It performs CRNG health tests as defined in SP 800-90B <https://csrc.nist.gov/pubs/sp/800/90/b/final> Section 4 "Health Tests". Most requests are forwarded to the entropy source, either via its parent reference or via the provider entropy upcalls.
Identity
"CRNG-TEST" is the name for this implementation; it can be used with the EVP_RAND_fetch() function.
Supported parameters
If a parent EVP_RAND is specified on context creation, the parent's parameters are supported because the request is forwarded to the parent seed source for processing.
If no parent EVP_RAND is specified on context creation, the following parameters are supported:
- "state" (
OSSL_RAND_PARAM_STATE) <integer>
- "strength" (
OSSL_RAND_PARAM_STRENGTH) <unsigned integer>
- "max_request" (
OSSL_RAND_PARAM_MAX_REQUEST) <unsigned integer> -
These parameters work as described in "PARAMETERS" in EVP_RAND(3).
- "fips-indicator" (
OSSL_RAND_PARAM_FIPS_APPROVED_INDICATOR) <integer> -
This parameter works as described in "PARAMETERS" in provider-rand(7).
Notes
This EVP_RAND is only implemented by the OpenSSL FIPS provider.
A context for a health test filter can be obtained by calling:
EVP_RAND *parent = ...;EVP_RAND *rand = EVP_RAND_fetch(NULL, "CRNG-TEST", NULL);EVP_RAND_CTX *rctx = EVP_RAND_CTX_new(rand, parent);
Releases
2 releases since Debian 13 (Trixie); the text changed 1 time.