Skip to content

Move the generic SP800-90B noise source into wolfEntropy - #11920

Open
dgarske wants to merge 1 commit into
wolfSSL:masterfrom
dgarske:noisesrc_wolfentropy
Open

dgarske wants to merge 1 commit into
wolfSSL:masterfrom
dgarske:noisesrc_wolfentropy

Conversation

@dgarske

@dgarske dgarske commented Oct 29, 2026

Copy link
Copy Markdown
Member

Description

This PR moves the wc_NoiseSrc_* noise-source layer (WOLFSSL_NOISE_SRC) out of random.c/random.h and into wolfentropy.c/wolfentropy.h, which sit outside the FIPS module boundary, and makes it share wolfEntropy's SP800-90B health tests instead of carrying a second copy.

  • wolfEntropy's Repetition Count and Adaptive Proportion tests now operate on a per-source wc_EntropyHealth struct with tunable cutoffs; the MemUse source keeps one static instance with unchanged behavior.
  • The noise source adopts wolfEntropy semantics: sliding-window APT, SHA3-256 conditioner, and reset-and-retry on a health-test failure (the failing source reruns its startup test on the next call) in place of the latched failure and the dropped-source mask.
  • A zero hmin, margin, cutoff, window or startupOctets selects the wolfEntropy defaults; the C2000 port keeps its own cutoffs.
  • WOLFSSL_C2000_ENTROPY now implies WOLFSSL_NOISE_SRC from settings.h.

Testing

  • --enable-wolfEntropy=noisesrc enables the noise source on its own (without the MemUse seed source) and forces SHA-3 on; yes,noisesrc and thread,noisesrc enable both. CMake builds wolfentropy.c and entropy-timers.c unconditionally, as both are self-gated.
  • noisesrc_test gains startup-rerun, recovery, defaults and validation cases, and both KATs move to SHA3-256.
  • New noisesrc_host CI job runs make check with --enable-wolfEntropy=noisesrc --enable-all; IDE/C2000/compile.sh compiles wolfentropy.c under WOLFSSL_C2000_ENTROPY.
  • Doxygen entries for the wc_NoiseSrc_* API; IDE/C2000/README.md updated.

@github-actions

github-actions Bot commented Oct 29, 2026 •

Copy link
Copy Markdown

@dgarske dgarske assigned wolfSSL-Bot and unassigned dgarske Oct 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants