Skip to content

Commit 0f8e07e

Browse files
authored
Remove jent_read_entropy_safe usage from AWS-LC (main) (#2110)
### Issues: `P186365975` ### Description of changes: These changes remove any usage of jent_read_entropy_safe function from AWS-LC. This function has an implementation vulnerability described [here](https://github.com/smuellerDD/jitterentropy-library/blob/c62c88645f27716f78e1267a182cff40e96081c2/SECURITY.md#2024-12-30). jent_read_entropy_safe is now unused in our codebase, however, it is still present in the Jitter code. These changes are outside the FIPS boundary and do not impact the FIPS integrity hash. ### Call-outs: Eventually, we should pull in the newest Jitter release with the security fix. ### Testing: How is this change tested (unit tests, fuzz tests, etc.)? Are there any testing steps to be verified by the reviewer? By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.
1 parent 13a330b commit 0f8e07e

File tree

1 file changed

+4
-6
lines changed

1 file changed

+4
-6
lines changed

crypto/fipsmodule/rand/cpu_jitter_test.cc

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -41,10 +41,8 @@ TEST(CPUJitterEntropyTest, Basic) {
4141
// Draw some entropy to check if it works.
4242
EXPECT_EQ(jent_read_entropy(jitter_ec.instance,
4343
(char*) data0, data_len), data_len);
44-
45-
// Draw some entropy with the "safe" API to check if it works.
46-
EXPECT_EQ(jent_read_entropy_safe(&jitter_ec.instance,
47-
(char*) data1, data_len), data_len);
44+
EXPECT_EQ(jent_read_entropy(jitter_ec.instance,
45+
(char*) data1, data_len), data_len);
4846

4947
// Basic check that the random data is not equal.
5048
EXPECT_NE(Bytes(data0), Bytes(data1));
@@ -60,8 +58,8 @@ TEST(CPUJitterEntropyTest, Basic) {
6058
// Test drawing entropy from the Jitter object that was reset.
6159
EXPECT_EQ(jent_read_entropy(jitter_ec.instance,
6260
(char*) data0, data_len), data_len);
63-
EXPECT_EQ(jent_read_entropy_safe(&jitter_ec.instance,
64-
(char*) data1, data_len), data_len);
61+
EXPECT_EQ(jent_read_entropy(jitter_ec.instance,
62+
(char*) data1, data_len), data_len);
6563

6664
// Verify that the Jitter library version is v3.4.0.
6765
unsigned int jitter_version = 3040000;

0 commit comments

Comments
 (0)