Skip to content

Commit

Permalink
Remove jent_read_entropy_safe usage from AWS-LC (main) (#2110)
Browse files Browse the repository at this point in the history
### Issues:
`P186365975`

### Description of changes: 
These changes remove any usage of jent_read_entropy_safe function from
AWS-LC. This function has an implementation vulnerability described
[here](https://github.com/smuellerDD/jitterentropy-library/blob/c62c88645f27716f78e1267a182cff40e96081c2/SECURITY.md#2024-12-30).

jent_read_entropy_safe is now unused in our codebase, however, it is
still present in the Jitter code. These changes are outside the FIPS
boundary and do not impact the FIPS integrity hash.

### Call-outs:
Eventually, we should pull in the newest Jitter release with the
security fix.

### Testing:
How is this change tested (unit tests, fuzz tests, etc.)? Are there any
testing steps to be verified by the reviewer?

By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license and the ISC license.
  • Loading branch information
smittals2 authored Jan 15, 2025
1 parent 13a330b commit 0f8e07e
Showing 1 changed file with 4 additions and 6 deletions.
10 changes: 4 additions & 6 deletions crypto/fipsmodule/rand/cpu_jitter_test.cc
Original file line number Diff line number Diff line change
Expand Up @@ -41,10 +41,8 @@ TEST(CPUJitterEntropyTest, Basic) {
// Draw some entropy to check if it works.
EXPECT_EQ(jent_read_entropy(jitter_ec.instance,
(char*) data0, data_len), data_len);

// Draw some entropy with the "safe" API to check if it works.
EXPECT_EQ(jent_read_entropy_safe(&jitter_ec.instance,
(char*) data1, data_len), data_len);
EXPECT_EQ(jent_read_entropy(jitter_ec.instance,
(char*) data1, data_len), data_len);

// Basic check that the random data is not equal.
EXPECT_NE(Bytes(data0), Bytes(data1));
Expand All @@ -60,8 +58,8 @@ TEST(CPUJitterEntropyTest, Basic) {
// Test drawing entropy from the Jitter object that was reset.
EXPECT_EQ(jent_read_entropy(jitter_ec.instance,
(char*) data0, data_len), data_len);
EXPECT_EQ(jent_read_entropy_safe(&jitter_ec.instance,
(char*) data1, data_len), data_len);
EXPECT_EQ(jent_read_entropy(jitter_ec.instance,
(char*) data1, data_len), data_len);

// Verify that the Jitter library version is v3.4.0.
unsigned int jitter_version = 3040000;
Expand Down

0 comments on commit 0f8e07e

Please sign in to comment.