Skip to content

Commit

Permalink
Remove jent_read_entropy_safe usage from AWS-LC (fips-2024-09-27) (#2108
Browse files Browse the repository at this point in the history
)

### Issues:
`P186365975`

### Description of changes:
These changes remove any usage of jent_read_entropy_safe function from
AWS-LC. This function has an implementation vulnerability described
[here](https://github.com/smuellerDD/jitterentropy-library/blob/c62c88645f27716f78e1267a182cff40e96081c2/SECURITY.md#2024-12-30).

jent_read_entropy_safe is now unused in our codebase, however, it is
still present in the Jitter code. These changes are outside the FIPS
boundary and do not impact the FIPS integrity hash.

### Call-outs:
Point out areas that need special attention or support during the review
process. Discuss architecture or design changes.

### Testing:
How is this change tested (unit tests, fuzz tests, etc.)? Are there any
testing steps to be verified by the reviewer?

By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license and the ISC license.
  • Loading branch information
smittals2 authored Jan 15, 2025
1 parent 8ff5cce commit 7b62d56
Show file tree
Hide file tree
Showing 2 changed files with 5 additions and 7 deletions.
10 changes: 4 additions & 6 deletions crypto/fipsmodule/rand/cpu_jitter_test.cc
Original file line number Diff line number Diff line change
Expand Up @@ -41,10 +41,8 @@ TEST(CPUJitterEntropyTest, Basic) {
// Draw some entropy to check if it works.
EXPECT_EQ(jent_read_entropy(jitter_ec.instance,
(char*) data0, data_len), data_len);

// Draw some entropy with the "safe" API to check if it works.
EXPECT_EQ(jent_read_entropy_safe(&jitter_ec.instance,
(char*) data1, data_len), data_len);
EXPECT_EQ(jent_read_entropy(jitter_ec.instance,
(char*) data1, data_len), data_len);

// Basic check that the random data is not equal.
EXPECT_NE(Bytes(data0), Bytes(data1));
Expand All @@ -60,8 +58,8 @@ TEST(CPUJitterEntropyTest, Basic) {
// Test drawing entropy from the Jitter object that was reset.
EXPECT_EQ(jent_read_entropy(jitter_ec.instance,
(char*) data0, data_len), data_len);
EXPECT_EQ(jent_read_entropy_safe(&jitter_ec.instance,
(char*) data1, data_len), data_len);
EXPECT_EQ(jent_read_entropy(jitter_ec.instance,
(char*) data1, data_len), data_len);

// Verify that the Jitter library version is v3.4.0.
unsigned int jitter_version = 3040000;
Expand Down
2 changes: 1 addition & 1 deletion tool/speed.cc
Original file line number Diff line number Diff line change
Expand Up @@ -2356,7 +2356,7 @@ static bool SpeedJitter(size_t chunk_size) {

if (!TimeFunction(&results, [&jitter_ec, &input, chunk_size]() -> bool {
size_t bytes =
jent_read_entropy_safe(&jitter_ec, input.get(), chunk_size);
jent_read_entropy(jitter_ec, input.get(), chunk_size);
if (bytes != chunk_size) {
return false;
}
Expand Down

0 comments on commit 7b62d56

Please sign in to comment.