Skip to content

Adds a new randomness generation API#2963

Merged
torben-hansen merged 3 commits intoaws:mainfrom
torben-hansen:rand_public_api
Jan 28, 2026
Merged

Adds a new randomness generation API#2963
torben-hansen merged 3 commits intoaws:mainfrom
torben-hansen:rand_public_api

Conversation

@torben-hansen
Copy link
Copy Markdown
Contributor

Issues:

CryptoAlg-2253

Description of changes:

Adds a new randomness generation API RAND_public_bytes. The backed for this API uses a new, second thread-local state that has an independent CTR-DRBG state (from the existing thread-local state). This enables separating generated randomness that is made public (e.g. TLS server/client values) from generated randomness that is not make public (e.g. ECDHE private key shares).

Theoretically, this makes is harder to develop vectors against the CTR-DRBG state generating the "private" randomness.

Testing:

Added a few more test cases to attempt to verify independence.

Factor out the thread-local selection into rand_bytes_impl to avoid duplicate code. The diff view is ugly because of this...

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

@torben-hansen torben-hansen requested a review from a team as a code owner January 27, 2026 19:51
@torben-hansen torben-hansen changed the title Rand public api Adds a new randomness generation API Jan 27, 2026
@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Jan 27, 2026

Codecov Report

❌ Patch coverage is 81.53846% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 78.31%. Comparing base (1f0e7fc) to head (5a4808d).
⚠️ Report is 79 commits behind head on main.

Files with missing lines Patch % Lines
crypto/fipsmodule/rand/rand.c 70.00% 6 Missing ⚠️
crypto/fipsmodule/rand/rand_test.cc 86.66% 6 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #2963      +/-   ##
==========================================
- Coverage   78.46%   78.31%   -0.16%     
==========================================
  Files         689      689              
  Lines      120818   120838      +20     
  Branches    16969    16976       +7     
==========================================
- Hits        94802    94629     -173     
- Misses      25123    25317     +194     
+ Partials      893      892       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@torben-hansen torben-hansen enabled auto-merge (squash) January 27, 2026 21:04
@justsmth
Copy link
Copy Markdown
Contributor

  • For compatibility, could we also define RAND_priv_bytes?
  • I assume we went with RAND_public_bytes in order to avoid having to change all of the places we use RAND_bytes for secrets?

@torben-hansen
Copy link
Copy Markdown
Contributor Author

  • For compatibility, could we also define RAND_priv_bytes?
  • I assume we went with RAND_public_bytes in order to avoid having to change all of the places we use RAND_bytes for secrets?
  1. RAND_priv_bytes already exists. It wraps RAND_bytes

  2. Yes. deciding something is "public" should be a deliberate choice. Default is "private"

@torben-hansen torben-hansen merged commit e173b36 into aws:main Jan 28, 2026
398 of 405 checks passed
@torben-hansen torben-hansen deleted the rand_public_api branch January 28, 2026 02:34
@justsmth justsmth mentioned this pull request Feb 20, 2026
justsmth added a commit that referenced this pull request Feb 20, 2026
### Description of changes: 
* Bump urllib3 from 2.6.0 to 2.6.3 in /tests/ci by @dependabot[bot] in
#2932
* Add weekly automated check for outdated third-party test vectors by
@sgmenda in #2933
* Enable Hybrid PQ KeyShares by default by @alexw91 in
#2531
* Remove AVX conditional from cmake script by @torben-hansen in
#2958
* openssl-ca command implementation for self-sign certificates by
@skmcgrail in #2937
* Initial Framework for Using Doxygen to Document Public Header Files by
@m271828 in #2908
* Move md4 out of FIPS module by @torben-hansen in
#2956
* Fix image-build-windows workflow to only push on workflow_call and
workflow_dispatch by @skmcgrail in
#2961
* Remove FIPS counter framework and other tidying up by @torben-hansen
in #2947
* Model Device Farm CI Resources in CDK by @skmcgrail in
#2965
* Adds a new randomness generation API by @torben-hansen in
#2963
* Migrate Android Testing to GitHub Actions by @skmcgrail in
#2969
* Ensure pkcs7 checks ASN1_TYPE->type by @skmcgrail in
#2968
* Fix checkout logic for android-omnibus by @skmcgrail in
#2970
* Add missing env vars to check-vectors workflow step by @sgmenda in
#2962
* Shorten Windows Build Directory Path by @skmcgrail in
#2974
* Bump mysql cluster version by @WillChilds-Klein in
#2967
* Integrate Wycheproof ML-DSA test vectors by @sgmenda in
#2973
* Simplify FIPS conditional in top-level build script by @torben-hansen
in #2976
* Fix aws-lc-rs CI job by @justsmth in
#2966
* Add method to get type of ML-DSA instance configured under EVP PKEY by
@torben-hansen in #2980
* Nmap build needs liblinear by @justsmth in
#2985
* Disable SLP vectorizer for FIPS shared library builds on GCC 14+ by
@geedo0 in #2977
* Update Wycheproof ECDSA test vectors and fix workflow typo by @sgmenda
in #2972
* Address some CMake findings by @skmcgrail in
#2979
* Bump bytes from 1.7.1 to 1.11.1 in /tests/ci/lambda by
@dependabot[bot] in #2983
* Support GCC 4.8 for aarch64 by @justsmth in
#2964
* Free potential memory before assigning new pointer by @torben-hansen
in #2989
* Add PyOpenSSL integration test by @WillChilds-Klein in
#2992
* Ensure index argument is not negative in ASN1_BIT_STRING_set_bit by
@torben-hansen in #2987
* Ensure no overflow in signed output length in do_buf by @torben-hansen
in #2988
* Remove redundant CPython 3.9 integration test by @WillChilds-Klein in
#2996
* Ensure public key is set before verifying through ML-DSA verify by
@torben-hansen in #2990
* Correct CCM nids in object definition by @torben-hansen in
#2991
* Address Reported Bug Findings by @skmcgrail in
#3000
* Fix CI: gcc-4.8 by @justsmth in
#3011
* Fix Windows CI: use `cd /d` in run_windows_tests.bat to handle
cross-drive paths by @justsmth in
#3012
* Fix OPENSSL_memchr per C23 by @justsmth in
#3008
* Fix argument order in `hmac_copy` by @justsmth in
#3014
* Miscellaneous CI improvements by @skmcgrail in
#2978
* Fix CI: mariadb by @justsmth in
#3015
* Update Ubuntu 24:04 image compiler verification by @skmcgrail in
#3017
* Support WASM/Emscripten by @justsmth in
#2959
* Generate Rust Bindings by @justsmth in
#2999

By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license and the ISC license.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants