Provide FIPS_is_entropy_cpu_jitter() (#2088)

aws · Jan 3, 2025 · 71e915d · 71e915d
1 parent 591c67e
commit 71e915d
Show file tree

Hide file tree

Showing 3 changed files with 20 additions and 0 deletions.
diff --git a/crypto/crypto_test.cc b/crypto/crypto_test.cc
@@ -73,6 +73,14 @@ TEST(CryptoTest, Strndup) {
   EXPECT_STREQ("", str.get());
 }
 
+TEST(CryptoTest, aws_lc_assert_entropy_cpu_jitter) {
+#if defined(FIPS_ENTROPY_SOURCE_JITTER_CPU)
+  ASSERT_EQ(1, FIPS_is_entropy_cpu_jitter());
+#else
+  ASSERT_EQ(0, FIPS_is_entropy_cpu_jitter());
+#endif
+}
+
 TEST(CryptoTest, OPENSSL_hexstr2buf) {
   const char *test_cases[][2] = {{"a2", "\xa2"},
                                  {"a213", "\xa2\x13"},

diff --git a/crypto/fipsmodule/self_check/fips.c b/crypto/fipsmodule/self_check/fips.c
@@ -28,6 +28,14 @@ int FIPS_mode(void) {
 #endif
 }
 
+int FIPS_is_entropy_cpu_jitter(void) {
+#if defined(FIPS_ENTROPY_SOURCE_JITTER_CPU)
+  return 1;
+#else
+  return 0;
+#endif
+}
+
 int FIPS_mode_set(int on) { return on == FIPS_mode(); }
 
 #if defined(BORINGSSL_FIPS_140_3)

diff --git a/include/openssl/crypto.h b/include/openssl/crypto.h
@@ -117,6 +117,10 @@ OPENSSL_EXPORT void armv8_enable_dit(void);
 // which case it returns one.
 OPENSSL_EXPORT int FIPS_mode(void);
 
+// FIPS_is_entropy_cpu_jitter returns 1 if CPU jitter is used as the entropy source
+// for AWS-LC. Otherwise, returns 0;
+OPENSSL_EXPORT int FIPS_is_entropy_cpu_jitter(void);
+
 // fips_counter_t denotes specific APIs/algorithms. A counter is maintained for
 // each in FIPS mode so that tests can be written to assert that the expected,
 // FIPS functions are being called by a certain peice of code.