<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-IN" link="blue" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US">Hi Matthias,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I tried the changes you suggested, it works well. Now T1 can call its own RNG and T2 calls its local DRBG. I don’t find any reasons why it can’t be done this way, may be there are some hidden issues which I have not seen
yet but as of now it looks to be working fine. Thank you very much Matthias and Paul for your help on this.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Vishwanath M</span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="mso-element:para-border-div;border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="border:none;padding:0cm"><b>From: </b><a href="mailto:Matthias.St.Pierre@ncp-e.com">Dr. Matthias St. Pierre</a><br>
<b>Sent: </b>05 April 2021 03:22 PM<br>
<b>To: </b><a href="mailto:pauli@openssl.org">Dr Paul Dale</a>; <a href="mailto:mahajanshetty@outlook.com">
Vishwanath Mahajanshetty</a>; <a href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a><br>
<b>Subject: </b>RE: openssl-users Digest, Vol 77, Issue 6</p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="DE"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">> </span><span lang="EN-US">It isn't possible to do what you are wanting. RAND_METHOD replaces the RNG everywhere.
</span><span lang="DE">It cannot be done on a per thread process.<br>
<br>
</span><span lang="DE"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Well, technically it *<b>is</b>* possible. However, I’m still in doubt whether it is really necessary and should be done.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">The following example assumes you are compiling for linux (or another unix-ish os) and using pthreads:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Assume that you recorded the thread id of your thread T1 (which you obtained from pthread_create())<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">in the static variable ‘tid1’. Then you could take the code from [1] and modify it as follows:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">```<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">static int my_rand_bytes(unsigned char *out, int count)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">{<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> int ret;<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> if (pthread_equal(pthread_self(), tid1) {<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> // ... call your special RNG here<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> } else {<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> RAND_DRBG *drbg = RAND_DRBG_get0_public();<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> if (drbg == NULL)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> return 0;<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> ret = RAND_DRBG_bytes(drbg, out, count);<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> return ret;<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">}<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">```<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">This is just a rough sketch, note that there are more RAND_METHODs to be considered [2].<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Matthias<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">[1] https://github.com/openssl/openssl/blob/OpenSSL_1_1_1-stable/crypto/rand/drbg_lib.c#L958-L970<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">[2] https://github.com/openssl/openssl/blob/OpenSSL_1_1_1-stable/crypto/rand/drbg_lib.c#L1146-L1153<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt">
<p><span lang="DE" style="font-size:10.0pt"> <o:p></o:p></span></p>
<table class="MsoNormalTable" border="0" cellspacing="3" cellpadding="0" width="620" style="width:465.0pt">
<tbody>
<tr style="height:18.75pt">
<td width="171" valign="top" style="width:128.25pt;padding:.75pt .75pt .75pt .75pt;height:18.75pt">
<p class="MsoNormal"><b><img border="0" width="153" height="56" style="width:1.5916in;height:.5833in" id="Picture_x0020_3" src="cid:NCP_logo_2f45208a-c14d-4000-bcd3-1ab400c0e48c.gif" alt="NCP engingeering GmbH"></b><o:p></o:p></p>
</td>
<td width="12" valign="top" style="width:9.0pt;padding:.75pt .75pt .75pt .75pt;height:18.75pt">
</td>
<td width="501" valign="top" style="width:375.75pt;padding:.75pt .75pt .75pt .75pt;height:18.75pt">
<p class="MsoNormal"><strong><span style="font-family:"Calibri",sans-serif">Dr. Matthias St. Pierre</span></strong>
<br>
<br>
Senior Software Engineer <br>
matthias.st.pierre@ncp-e.com <br>
Phone: +49 911 9968-0<br>
www.ncp-e.com <o:p></o:p></p>
</td>
</tr>
<tr style="height:18.75pt">
<td width="684" colspan="3" valign="top" style="width:513.0pt;padding:.75pt .75pt .75pt .75pt;height:18.75pt">
<p><b><span style="font-size:10.0pt"><br>
Follow us on:<o:p></o:p></span></b></p>
<p class="MsoNormal"> <a href="https://www.facebook.com/NCPengineering">Facebook</a> |
<a href="https://twitter.com/NCP_engineering">Twitter</a> | <a href="https://www.xing.com/companies/ncpengineeringgmbh">
Xing</a> | <a href="https://www.youtube.com/user/NCPengineeringGmbH">YouTube</a> |
<a href="http://www.linkedin.com/company/ncp-engineering-inc.?trk=cws-cpw-coname-0-0">
LinkedIn</a><br>
<br>
<strong><span style="font-family:"Calibri",sans-serif">Headquarters Germany: </span>
</strong>NCP engineering GmbH • Dombuehler Str. 2 • 90449 • Nuremberg <br>
<strong><span style="font-family:"Calibri",sans-serif">North American HQ:</span></strong> NCP engineering Inc. • 601 Cleveland Str., Suite 501-25 • Clearwater, FL 33755
<o:p></o:p></p>
<p><span style="font-size:10.0pt">Authorized representatives: Peter Soell, Patrick Oliver Graf, Beate Dietrich
<br>
Registry Court: Lower District Court of Nuremberg <br>
Commercial register No.: HRB 7786 Nuremberg, VAT identification No.: DE 133557619
<o:p></o:p></span></p>
<p><span style="font-size:10.0pt">- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
<br>
</span><strong><span style="font-size:10.0pt;font-family:"Calibri",sans-serif">Längere Support-Antwortzeiten durch erhöhtes Anfrage-Aufkommen</span></strong><span style="font-size:10.0pt">
<br>
Aufgrund des anhaltend hohen Anfrage-Aufkommens im Bereich Support und System Engineering kann es aktuell zu längeren Antwortzeiten kommen. Wir setzen alles daran, Ihre Anfragen so schnell wie möglich zu beantworten. Wir bitten Sie hier vorsorglich um Geduld
und danken Ihnen für Ihr Verständnis. <o:p></o:p></span></p>
<p><strong><span style="font-size:10.0pt;font-family:"Calibri",sans-serif">Longer support response times due to high number of requests</span></strong><span style="font-size:10.0pt">
<br>
Due to the continuing high volume of requests, support and system engineering response times may be longer than expected at present. We will do our best to answer your requests as soon as possible. We ask for your patience during this time and appreciate your
understanding. <o:p></o:p></span></p>
<p><span style="font-size:7.0pt;color:#727272">This e-mail message including any attachments is for the sole use of the intended recipient(s) and may contain privileged or confidential information. Any unauthorized review, use, disclosure or distribution is
prohibited. If you are not the intended recipient, please immediately contact the sender by reply e-mail and delete the original message and destroy all copies thereof.</span><span style="font-size:7.0pt">
</span><span style="font-size:10.0pt"><o:p></o:p></span></p>
<p><span style="font-size:10.0pt"> <o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="DE">From:</span></b><span lang="DE"> openssl-users <openssl-users-bounces@openssl.org>
<b>On Behalf Of </b>Dr Paul Dale<br>
<b>Sent:</b> Monday, April 5, 2021 3:18 AM<br>
<b>To:</b> openssl-users@openssl.org<br>
<b>Subject:</b> Re: openssl-users Digest, Vol 77, Issue 6<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="DE"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span lang="DE">Vishwanath,<br>
<br>
It isn't possible to do what you are wanting. RAND_METHOD replaces the RNG everywhere. It cannot be done on a per thread process.<br>
<br>
<br>
Pauli<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span lang="DE">On 4/4/21 9:55 pm, Vishwanath Mahajanshetty wrote:<o:p></o:p></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal" style="margin-left:72.0pt"><span lang="EN-US">Hi Paul,</span><span lang="DE"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:72.0pt"><span lang="EN-US"> </span><span lang="DE"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:72.0pt"><span lang="EN-US">Thanks for your response. I understand the concern for good random numbers; but in this scenario when second thread calls SSL_CTX_new it is waiting forever in RAND_priv_bytes(). Looks like entropy
functions defined by first (bind) thread are very specific for its own use case and can’t be used by other treads.</span><span lang="DE"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:72.0pt"><span lang="EN-US">So I am thinking of using default</span><span lang="DE"> OpenSSL RAND_METHOD for second thread and keep first thread (bind) to use its own random number generators.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:72.0pt"><span lang="DE"> <o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:72.0pt"><span lang="DE">Please let me know how can I make one thread use default RAND_METHOD and keep other thread to use its own method. I have gone through RAND_bytes() and drbg_bytes() but not getting enough idea.
It would be really helpful if you point out APIs which help me to achieve this requirement.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:72.0pt"><span lang="DE"> <o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:72.0pt"><span lang="DE">Thank You,<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:72.0pt"><span lang="DE">Vishwanath M<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:72.0pt"><span lang="EN-US"> </span><span lang="DE"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:72.0pt"><span lang="DE"> <o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:72.0pt"><span lang="DE"> <o:p></o:p></span></p>
</blockquote>
</div>
<p class="MsoNormal"><span lang="DE"><o:p> </o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>