<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Correct, you need to create a provider.<div class=""><br class=""></div><div class=""><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class="">Look at providers/implementations/rands/seed_src.c as an example. You'll need to reimplement seed_src_generate() to use your RNG.</span></div><div class=""><br class=""></div><div class=""><font color="#000000" class=""><span style="caret-color: rgb(0, 0, 0);" class="">Your seed source will need to be wrapped in a provider and registered using a name of your choice. See providers/defltprov.c and search for "seed”.</span></font></div><div class=""><br class=""></div><div class=""><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class="">To use your custom seed source, you can either use the OpenSSL configuration file to set a "random" section that includes a "seed" setting or you can call RAND_set_seed_source_type() early in your startup sequence.</span></div><div class=""><br class=""></div><div class="">If you link in your provider, you will need to call OSSL_PROVIDER_add_builtin() with the name and init function before you call OSSL_PROVIDER_load() to load it. Then call OSSL_PROVIDER_load() for all of the other providers (default, base, FIPS, etc).</div><div class=""><br class=""></div><div class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Sep 25, 2021, at 6:46 AM, Jakob Bohm via openssl-users <<a href="mailto:openssl-users@openssl.org" class="">openssl-users@openssl.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">So is there no longer an API to feed entropy to the default or FIPS default RNG?<br class=""><br class="">Creating an entire provider just to feed input to the FIPS provider seems overkill.<br class=""><br class="">On 2021-09-14 01:00, Dr Paul Dale wrote:<br class=""><blockquote type="cite" class="">Try working from providers/implementations/rands/seed_src.c You'll need to reimplement seed_src_generate() to use your RNG.<br class=""><br class="">To use your custom seed source, you can either use the OpenSSL configuration file to set a "random" section that includes a "seed" setting or you can call RAND_set_seed_source_type() early in your startup sequence.<br class=""><br class=""><br class="">Pauli<br class=""><br class="">On 14/9/21 8:19 am, Kory Hamzeh wrote:<br class=""><blockquote type="cite" class="">Hi,<br class=""><br class="">We are upgrading from OpenSSL 1.0.1g+OpenSSL-FIPS-2.0.5 to 3.0.0. Yes, I know, big jump. We have our own entropy source we use to seed the OpenSSL DRBG. This is a basic code snippet of how we set it up:<br class=""><br class=""> DRBG_CTX *dctx = FIPS_get_default_drbg();<br class=""> FIPS_drbg_init(dctx, NID_aes_256_ctr, DRBG_FLAG_CTR_USE_DF);<br class=""> FIPS_drbg_set_callbacks(dctx,<br class="">rand_get_entropy,<br class="">rand_free_entropy,<br class=""> 0,<br class="">rand_get_entropy,<br class="">rand_free_entropy);<br class=""><br class=""><br class="">Error checking has been removed in the example for the sake of brevity.<br class=""><br class="">I am trying to figure out how to implement this with OpenSSL 3. From what I have read in the docs, I need to create a rand provider. But I still feel like I don’t understand how it all fit together. I did look at fuzz_rand.c and fake_rand.c, and if I understood everything correctly, neither of them use an external entropy/seed source.<br class=""><br class="">Are there better examples of what I am looking for?<br class=""><br class="">Thanks,<br class="">Kory<br class=""><br class=""></blockquote><br class=""></blockquote>Enjoy<br class=""><br class="">Jakob<br class="">-- <br class="">Jakob Bohm, CIO, Partner, WiseMo A/S. <a href="https://www.wisemo.com" class="">https://www.wisemo.com</a><br class="">Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10<br class="">This public discussion message is non-binding and may contain errors.<br class="">WiseMo - Remote Service Management for PCs, Phones and Embedded<br class=""><br class=""></div></div></blockquote></div><br class=""></div></body></html>