[openssl-users] Fips CTR_DRBG

[Piotr Łobacz]

Hello,
i have a question about FIPS CTR_DRBG. I have managed to compile openssl
with fips and everything works fine. The method FIPS_mode returns me 1
so i am in FIPS mode, but what is my problem i dunno how to use properly
FIPS_drbg api. I have managed to create new DRBG context and than i
should instantiate it and here are the ladders showing up, because i
need to call FIPS_drbg_set_callbacks. According to file
openssl-fips-2.0.9/fips/rand/fips_drbg_selftest.c i have created those 2
functions:

static size_t test_entropy(DRBG_CTX *dctx, unsigned char **pout,
                                int entropy, size_t min_len, size_t
max_len)
        {
        TEST_ENT *t = (TEST_ENT*)FIPS_drbg_get_app_data(dctx);
        *pout = (unsigned char *)t->ent;
        t->entcnt++;
        return t->entlen;
        }

static size_t test_nonce(DRBG_CTX *dctx, unsigned char **pout,
                                int entropy, size_t min_len, size_t
max_len)
        {
        TEST_ENT *t = (TEST_ENT*)FIPS_drbg_get_app_data(dctx);
        *pout = (unsigned char *)t->nonce;
        t->noncecnt++;
        return t->noncelen;
        }

and entropy and nonce is being set properly but the result is different
than the one in NIST test vectors. Iam trying to check this one:

[AES-256 use df]
[PredictionResistance = False]
[EntropyInputLen = 256]
[NonceLen = 128]
[PersonalizationStringLen = 0]
[AdditionalInputLen = 0]
[ReturnedBitsLen = 512]

COUNT = 0
EntropyInput =
36401940fa8b1fba91a1661f211d78a0b9389a74e5bccfece8d766af1a6d3b14
Nonce = 496f25b0f1301b4f501be30380a137eb
PersonalizationString = 
** INSTANTIATE:
	Key = 3363d9000e6db47c16d3fc65f2872c08a35f99b2d174afa537a66ec153052d98
	V   = 9ee8d2e9c618ccbb8e66b5eb5333dce1

AdditionalInput = 
** GENERATE (FIRST CALL):
	Key = b1dff09c816af6d4b2111fe63c4507cb196154f8c59957a94a2b641a7c16cc01
	V   = 69eec01b2dd4ff3aab5fac9467f54485

AdditionalInput = 
ReturnedBits =
5862eb38bd558dd978a696e6df164782ddd887e7e9a6c9f3f1fbafb78941b535a64912dfd224c6dc7454e5250b3d97165e16260c2faf1cc7735cb75fb4f07e1d

mine Returned bits are
0a84276ebca04933c92bb9f565dd91819e656009b4d9327edc5c777ee2e05a27d9bfd26ab7a0bf2c689ee358d2982de1b1dff09c816af6d4b2111fe63c4507cb

I would be pleased if somebody could point me what am i doing wrong...
-- 

________________________________________________________________________
Piotr Łobacz

Biuro Systemów i Oprogramowania

RADMOR S.A.

tel. (58) 6996 929

e-mail: piotr.lobacz at radmor.com.pl

www.radmor.com.pl




RADMOR S.A., ul. Hutnicza 3, 81-212 Gdynia

NIP: 586-010-21-39

REGON: 190432077

KRS: 0000074029 (Sąd Rejonowy Gdańsk-Północ w Gdańsku)

Kapitał zakładowy wpłacony: 9 282 830 PLN