libgcrypt/SOURCES/libgcrypt-1.8.3-fips-enttest.patch

diff -up libgcrypt-1.8.3/random/random-drbg.c.fips-enttest libgcrypt-1.8.3/random/random-drbg.c
--- libgcrypt-1.8.3/random/random-drbg.c.fips-enttest	2017-11-23 19:16:58.000000000 +0100
+++ libgcrypt-1.8.3/random/random-drbg.c	2019-06-24 10:04:23.219547141 +0200
@@ -317,6 +317,7 @@ struct drbg_state_s
   unsigned char *ctr_null;	/* CTR mode zero buffer */
   int seeded:1;			/* DRBG fully seeded? */
   int pr:1;			/* Prediction resistance enabled? */
+  int ent_primed:1;             /* Previous entropy data primed? */
   /* Taken from libgcrypt ANSI X9.31 DRNG: We need to keep track of the
    * process which did the initialization so that we can detect a fork.
    * The volatile modifier is required so that the compiler does not
@@ -324,6 +325,7 @@ struct drbg_state_s
   pid_t seed_init_pid;
   const struct drbg_state_ops_s *d_ops;
   const struct drbg_core_s *core;
+  unsigned char ent_hash[64];	/* Hash of previous entropy data */
   struct drbg_test_data_s *test_data;
 };
 
@@ -610,11 +612,13 @@ drbg_get_entropy (drbg_state_t drbg, uns
 		       size_t len)
 {
   int rc = 0;
+  unsigned char newhash[64];
 
   /* Perform testing as defined in 11.3.2 */
   if (drbg->test_data && drbg->test_data->fail_seed_source)
     return -1;
 
+redo:
   read_cb_buffer = buffer;
   read_cb_size = len;
   read_cb_len = 0;
@@ -634,6 +638,27 @@ drbg_get_entropy (drbg_state_t drbg, uns
 #else
   rc = -1;
 #endif
+
+  /* to avoid storing the actual entropy obtained for indefinite
+     time, we just store the SHA-512 hash of the entropy gathered
+   */
+  _gcry_md_hash_buffer (GCRY_MD_SHA512, newhash, buffer, len);
+
+  if (!drbg->ent_primed)
+    {
+      memcpy (drbg->ent_hash, newhash, sizeof (drbg->ent_hash));
+      drbg->ent_primed = 1;
+      goto redo;
+    }
+
+  if (memcmp (newhash, drbg->ent_hash, sizeof (drbg->ent_hash)) == 0)
+    {
+      fips_signal_error ("Entropy source failed the continuous test");
+      return -1;  /* continuous entropy test failed */
+    }
+
+  memcpy (drbg->ent_hash, newhash, sizeof (drbg->ent_hash));
+
   return rc;
 }
 
@@ -1341,26 +1366,38 @@ drbg_seed (drbg_state_t drbg, drbg_strin
     }
   else
     {
+      int nonce = 0;
       /* Gather entropy equal to the security strength of the DRBG.
        * With a derivation function, a nonce is required in addition
        * to the entropy. A nonce must be at least 1/2 of the security
        * strength of the DRBG in size. Thus, entropy * nonce is 3/2
        * of the strength. The consideration of a nonce is only
-       * applicable during initial seeding. */
+       * applicable during initial seeding.
+       * To avoid pulling different length of data from entropy
+       * source, we use 2 * strength for initial seeding. */
       entropylen = drbg_sec_strength (drbg->core->flags);
       if (!entropylen)
 	return GPG_ERR_GENERAL;
       if (0 == reseed)
-	/* make sure we round up strength/2 in
-	 * case it is not divisible by 2 */
-	entropylen = ((entropylen + 1) / 2) * 3;
+        {
+	  nonce = 1;
+        }
       dbg (("DRBG: (re)seeding with %lu bytes of entropy\n", entropylen));
-      entropy = xcalloc_secure (1, entropylen);
+      entropy = xcalloc_secure (nonce + 1, entropylen);
       if (!entropy)
 	return GPG_ERR_ENOMEM;
       ret = drbg_get_entropy (drbg, entropy, entropylen);
       if (ret)
 	goto out;
+      if (nonce)
+        {
+          ret = drbg_get_entropy (drbg, entropy + entropylen, entropylen);
+          if (ret)
+	    goto out;
+	  /* make sure we round up strength/2 in
+	   * case it is not divisible by 2 */
+ 	  entropylen = 2 * entropylen;
+        }
       drbg_string_fill (&data1, entropy, entropylen);
     }
 
@@ -1597,6 +1634,7 @@ drbg_instantiate (drbg_state_t drbg,
   drbg->core = &drbg_cores[coreref];
   drbg->pr = pr;
   drbg->seeded = 0;
+  drbg->ent_primed = 0;
   if (drbg->core->flags & DRBG_HMAC)
     drbg->d_ops = &drbg_hmac_ops;
   else if (drbg->core->flags & DRBG_HASH_MASK)