From 103ef37cc768cb40c9c2cabe1feecffeba13b8e6 Mon Sep 17 00:00:00 2001 From: Daniel Pouzzner Date: Thu, 24 Sep 2026 01:36:32 -0500 Subject: [PATCH 1/5] globally rename WC_RNG_BANK_SUPPORT to HAVE_WC_RNG_BANK, and add WC_RNG_WANT_BANKREF_SUPPORT as an explicit feature flag for the bankref mechanism, always disabled for FIPS configurations. wolfcrypt/src/random.c: allow WC_HAVE_RNG_BANKREF with HAVE_FIPS if WOLFSSL_FIPS_DEV. wolfssl/wolfcrypt/random.h: * remove WC_RNG_BANK_SUPPORT from the exclusion list for WC_RNG_LOCK_ATFORK * pivot WC_HAVE_RNG_BANKREF on WC_RNG_WANT_BANKREF_SUPPORT, with FIPS exclusion. wolfcrypt/src/rng_bank.c: update wc_InitRng_BankRef_local() and wc_BankRef_Release() to use WC_RNG_FLAG_BANKREF, not WC_DRBG_BANKREF. wolfssl/wolfcrypt/rng_bank.h: remove backward-compat clause defining WC_HAVE_RNG_BANKREF. linuxkm/lkcapi_rsa_glue.c: refactor km_rsa_ctx_init_rng() to check ctx->rng.flags, not ctx->rng.status, for bankref status. configure.ac: in ENABLED_RNG_BANK setup, split out WC_RNG_WANT_BANKREF_SUPPORT as a separate flag, and don't define it if FIPS. wolfcrypt/benchmark/fips_cast_bench.c: omit bench_pct_slhdsa() if defined(WOLFSSL_SLHDSA_VERIFY_ONLY). wolfcrypt/test/test.c: in myCryptoDevCb(), add HAVE_INTEL_RDRAND to list of macros enabling use of wc_RNG_GenerateBlock() for WC_ALGO_TYPE_RNG. linuxkm/Makefile: use bash-4.3-compatible syntax in $(()) expression. .wolfssl_known_macro_extras: remove unneeded entries. --- .wolfssl_known_macro_extras | 54 +-------------------------- CMakeLists.txt | 2 +- cmake/options.h.in | 4 +- configure.ac | 6 ++- linuxkm/Makefile | 2 +- linuxkm/lkcapi_rsa_glue.c | 15 +++++--- linuxkm/module_exports.c.template | 2 +- wolfcrypt/benchmark/fips_cast_bench.c | 6 +-- wolfcrypt/src/random.c | 3 +- wolfcrypt/src/rng_bank.c | 10 +++-- wolfcrypt/test/test.c | 31 +++++++-------- wolfcrypt/test/test.h | 2 +- wolfssl/wolfcrypt/random.h | 17 ++++++++- wolfssl/wolfcrypt/rng_bank.h | 11 ++---- 14 files changed, 67 insertions(+), 98 deletions(-) diff --git a/.wolfssl_known_macro_extras b/.wolfssl_known_macro_extras index 4f9a1984761..4f53192b6d2 100644 --- a/.wolfssl_known_macro_extras +++ b/.wolfssl_known_macro_extras @@ -199,7 +199,6 @@ CONFIG_WOLFSSL_CERTIFICATE_BUNDLE CONFIG_WOLFSSL_CERTIFICATE_BUNDLE_DEFAULT_NONE CONFIG_WOLFSSL_CHACHA_POLY CONFIG_WOLFSSL_CRYPTO_CB -CONFIG_WOLFSSL_CRYPTO_ONLY CONFIG_WOLFSSL_CURVE25519 CONFIG_WOLFSSL_DTLS CONFIG_WOLFSSL_ECC @@ -768,10 +767,8 @@ USS_API VLT_TLS_NO_ECDH W64LIT_FORCE_LONG_LONG WC_AESXTS_STREAM_NO_REQUEST_ACCOUNTING -WC_AES_BS_WORD_SIZE WC_AES_GCM_ALLOW_NONSTANDARD_TAG_LENGTH WC_AES_GCM_DEC_AUTH_EARLY -WC_ALLOW_ECC_ZERO_HASH WC_ASN_HASH_SHA256 WC_ASN_RUNTIME_DATE_CHECK_CONTROL WC_ASYNC_ENABLE_ECC_KEYGEN @@ -800,8 +797,6 @@ WC_BLINDING_NO_RNG_ACKNOWLEDGE_WEAKNESS WC_CACHE_RESISTANT_BASE64_TABLE WC_DISABLE_RADIX_ZERO_PAD WC_DRBG_BANKREF -WC_FIPS_AESGCM_NO_SHORT_NONCES -WC_FIPS_AESGCM_ONE_SHOT_EXT_IV_ALLOWED WC_FIPS_ED25519CTX_NOT_APPROVED WC_FLAG_DONT_USE_AESNI WC_FORCE_LINUXKM_FORTIFY_SOURCE @@ -812,22 +807,20 @@ WC_INIT_ERROR_WHEN_CONTENDED WC_LINUXKM_NO_ENTROPY_DAEMON WC_LINUXKM_NO_USE_HEAP_WRAPPERS WC_LINUXKM_SPIN_IN_ATOMIC -WC_LINUXKM_SVR_NO_BATCHING WC_MLDSA_NO_ASM WC_MLKEM_KERNEL_ASM -WC_NOISE_SRC_MAX WC_NO_ASYNC_SLEEP WC_NO_RNG_SIMPLE WC_NO_STATIC_ASSERT WC_NO_VERBOSE_RNG WC_PKCS11_FIND_WITH_ID_ONLY WC_PKCS12_PBKDF_USING_MP_API -WC_PROTECT_ENCRYPTED_MEM WC_PUF_HELPER_COMPACT WC_PUF_SHA3 WC_RNG_BANK_NO_DAEMON_SUPPORT WC_RNG_BANK_NO_DEFAULT_SUPPORT WC_RNG_BLOCKING +WC_RNG_NO_BANKREF_SUPPORT WC_RNG_NO_FREE_HOOK WC_RNG_NO_LOCK WC_RNG_NO_LOCK_FULL_MUTEX @@ -861,7 +854,6 @@ WC_STM32_SAES_DIAG WC_STRICT_SIG WC_SVR_DONT_USE_NATIVE_REG_BUFS WC_SVR_PR_EMERG_ON_ACCEL_FALLBACK -WC_USE_PIE_FENCEPOSTS_FOR_FIPS WC_WANT_FLAG_DONT_USE_VECTOR_OPS WIFIESPAT WIFI_101 @@ -896,7 +888,6 @@ WOLFSSL_ARMASM_NEON_NO_TABLE_LOOKUP WOLFSSL_ARM_ARCH_NEON_64BIT WOLFSSL_ASCON_UNROLL WOLFSSL_ASN_EXTRA -WOLFSSL_ASN_TEMPLATE_TYPE_CHECK WOLFSSL_ATECC508 WOLFSSL_ATECC508A_NOSOFTECC WOLFSSL_ATECC508A_TLS @@ -914,39 +905,19 @@ WOLFSSL_BIO_NO_FLOW_STATS WOLFSSL_BUILD_MSG_NO_ZERO_COPY WOLFSSL_BYTESWAP32_ASM WOLFSSL_C2000_AES -WOLFSSL_C2000_AES_BASE WOLFSSL_C2000_AES_NO_LOCK -WOLFSSL_C2000_AES_SS_BASE -WOLFSSL_C2000_DEVID WOLFSSL_C2000_ENTROPY -WOLFSSL_C2000_ENTROPY_APT_CUTOFF -WOLFSSL_C2000_ENTROPY_APT_WINDOW -WOLFSSL_C2000_ENTROPY_HMIN -WOLFSSL_C2000_ENTROPY_MARGIN -WOLFSSL_C2000_ENTROPY_NO_CLK_INIT WOLFSSL_C2000_ENTROPY_NO_LOCK -WOLFSSL_C2000_ENTROPY_NUM_SRC -WOLFSSL_C2000_ENTROPY_RCT_CUTOFF -WOLFSSL_C2000_ENTROPY_REF_CLK -WOLFSSL_C2000_ENTROPY_SRC0_CLK -WOLFSSL_C2000_ENTROPY_SRC0_DCC -WOLFSSL_C2000_ENTROPY_SRC1_CLK -WOLFSSL_C2000_ENTROPY_SRC1_DCC -WOLFSSL_C2000_ENTROPY_STARTUP_OCTETS -WOLFSSL_C2000_ENTROPY_WINDOW WOLFSSL_CAAM_BLACK_KEY_AESCCM WOLFSSL_CAAM_BLACK_KEY_SM WOLFSSL_CAAM_NO_BLACK_KEY WOLFSSL_CALLBACKS WOLFSSL_CHACHA20_AVX512_ALWAYS WOLFSSL_CHACHA20_AVX512_NEVER -WOLFSSL_CHACHA20_POLY1305_FUSED WOLFSSL_CHACHA20_POLY1305_FUSED_ALWAYS -WOLFSSL_CHACHA20_POLY1305_FUSED_IFMA WOLFSSL_CHACHA20_POLY1305_FUSED_IFMA_ALWAYS WOLFSSL_CHACHA20_POLY1305_FUSED_IFMA_NEVER WOLFSSL_CHACHA20_POLY1305_FUSED_NEVER -WOLFSSL_CHACHA20_POLY1305_SHORT WOLFSSL_CHECK_DESKEY WOLFSSL_CHIBIOS WOLFSSL_CLANG_TIDY @@ -960,7 +931,6 @@ WOLFSSL_DRBG_SHA256 WOLFSSL_DTLS13_ECHO_LEGACY_SESSION_ID WOLFSSL_DTLS13_NO_HRR_ON_RESUME WOLFSSL_DTLS_DISALLOW_FUTURE -WOLFSSL_DTLS_NO_HVR_ON_RESUME WOLFSSL_DTLS_RECORDS_CAN_SPAN_DATAGRAMS WOLFSSL_DTLS_RESEND_ONLY_TIMEOUT WOLFSSL_DUMP_MEMIO_STREAM @@ -972,7 +942,6 @@ WOLFSSL_ECC_NO_SMALL_STACK WOLFSSL_ECC_SIGALG_PARAMS_NULL_ALLOWED WOLFSSL_ECDSA_MATCH_HASH WOLFSSL_ECDSA_SET_K_ONE_LOOP -WOLFSSL_ECIES_STATIC_GCM_NONCE WOLFSSL_EC_POINT_CMP_JACOBIAN WOLFSSL_ED448_NO_LARGE_CODE WOLFSSL_EDDSA_CHECK_PRIV_ON_SIGN @@ -1009,7 +978,6 @@ WOLFSSL_IMX6_CAAM_RNG WOLFSSL_IMXRT_DCP WOLFSSL_ISOTP WOLFSSL_KEEP_HOST_HEADER_PROBES -WOLFSSL_KEIL WOLFSSL_KEIL_NET WOLFSSL_KYBER_NO_DECAPSULATE WOLFSSL_KYBER_NO_ENCAPSULATE @@ -1043,7 +1011,6 @@ WOLFSSL_MULTICIRCULATE_ALTNAMELIST WOLFSSL_MX2_CONF_INCLUDE WOLFSSL_NETX_DUO WOLFSSL_NEW_PRIME_CHECK -WOLFSSL_NOISE_SRC WOLFSSL_NONBLOCK_OCSP WOLFSSL_NOSHA3_384 WOLFSSL_NOT_WINDOWS_API @@ -1109,7 +1076,6 @@ WOLFSSL_PASSTHRU_ERR WOLFSSL_PB WOLFSSL_PEER_ADDRESS_CHANGES WOLFSSL_PKCS11_RW_TOKENS -WOLFSSL_POLY1305_AVX512 WOLFSSL_POLY1305_AVX512_ALWAYS WOLFSSL_POLY1305_AVX512_NEVER WOLFSSL_POLY1305_IFMA_ALWAYS @@ -1135,7 +1101,6 @@ WOLFSSL_RENESAS_RZN2L WOLFSSL_RENESAS_TLS WOLFSSL_RENESAS_TSIP_IAREWRX WOLFSSL_REQUIRE_TCA -WOLFSSL_RISCV_ASM_INLINE WOLFSSL_RISCV_ASM_NO_UNALIGNED WOLFSSL_RNG_USE_FULL_SEED WOLFSSL_RSA_CHECK_D_ON_DECRYPT @@ -1162,25 +1127,20 @@ WOLFSSL_SHA256_ALT_CH_MAJ WOLFSSL_SHA3_AVX2 WOLFSSL_SHA3_NO_AVX2 WOLFSSL_SHA3_PPC64_BLOCKS_N -WOLFSSL_SHA512_HASHTYPE WOLFSSL_SHUTDOWNONCE WOLFSSL_SILABS_TRNG WOLFSSL_SLHDSA_FULL_HASH WOLFSSL_SLHDSA_NO_VERIFY_ONLY WOLFSSL_SNIFFER_NO_RECOVERY -WOLFSSL_SP_ARM32_UDIV WOLFSSL_SP_FAST_NCT_EXPTMOD WOLFSSL_SP_INT_SQR_VOLATILE WOLFSSL_SP_USE_UDIV WOLFSSL_SSLKEYLOGFILE_USE_ENV WOLFSSL_STACK_CHECK -WOLFSSL_STM32C5 WOLFSSL_STM32F3 WOLFSSL_STM32F427_RNG WOLFSSL_STM32U0 -WOLFSSL_STM32V8 WOLFSSL_STM32_DHUK_UNWRAP -WOLFSSL_STM32_USE_SAES WOLFSSL_STRONGEST_HASH_SIG WOLFSSL_STSAFE_TAKES_SLOT WOLFSSL_TELIT_M2MB @@ -1200,7 +1160,6 @@ WOLFSSL_TLS13_DRAFT WOLFSSL_TLS13_IGNORE_AEAD_LIMITS WOLFSSL_TLS13_IGNORE_PT_ALERT_ON_ENC WOLFSSL_TLS13_NULL_CIPHER_IN_DEFAULT -WOLFSSL_TLS13_SHA512 WOLFSSL_TLS13_TICKET_BEFORE_FINISHED WOLFSSL_TLS13_TICKET_CHECK_PSK_MODES WOLFSSL_TLSX_PQC_MLKEM_STORE_PRIV_KEY @@ -1215,7 +1174,6 @@ WOLFSSL_USER_THREADING WOLFSSL_USE_ESP32C3_CRYPT_HASH_HW WOLFSSL_USE_FLASHMEM WOLFSSL_USE_FORCE_ZERO -WOLFSSL_USE_OPTIONS_H WOLFSSL_VA416X0_TRNG WOLFSSL_VALIDATE_DH_KEYGEN WOLFSSL_VALIDATE_MLDSA_KEYGEN @@ -1223,11 +1181,9 @@ WOLFSSL_VALIDATE_MLKEM_KEYGEN WOLFSSL_VALIDATE_SLHDSA_KEYGEN WOLFSSL_VAULTIC_DEBUG WOLFSSL_VERBOSE_LOGGING -WOLFSSL_VERSAL_GEN2_ASU WOLFSSL_VERSAL_GEN2_ASU_CCM_ALIGN_DECLINE WOLFSSL_VERSAL_GEN2_ASU_CTR_WRAP_HW_FIXED WOLFSSL_VERSAL_GEN2_ASU_DEBUG -WOLFSSL_VERSAL_GEN2_ASU_IPI_BASEADDR WOLFSSL_VERSAL_GEN2_ASU_NO_CLIENT_INIT WOLFSSL_VERSAL_GEN2_ASU_NO_COMP_KEY_WARN WOLFSSL_VERSAL_GEN2_ASU_NO_ECC_P521 @@ -1250,10 +1206,6 @@ WOLFSSL_X509_PEM WOLFSSL_X509_STORE_ALLOW_NON_CA_INTERMEDIATE WOLFSSL_X509_STORE_CERTS WOLFSSL_X509_TINY -WOLFSSL_X509_TINY_AKI -WOLFSSL_X509_TINY_NAME_CONSTRAINTS -WOLFSSL_X509_TINY_POLICIES -WOLFSSL_X509_TINY_SKI WOLFSSL_X509_TRUSTED_CERTIFICATE_CALLBACK WOLFSSL_X509_VERIFY_ONLY WOLFSSL_XFREE_NO_NULLNESS_CHECK @@ -1264,11 +1216,7 @@ WOLFSSL_ZEPHYR WOLF_ALLOW_BUILTIN WOLF_CONF_ASN_TIME WOLF_CRYPTO_CB_ASYNC_POLL -WOLF_CRYPTO_CB_CMD -WOLF_CRYPTO_CB_ONLY_FALCON -WOLF_CRYPTO_CB_SEED_ONLY_TEST WOLF_CRYPTO_DEV -WOLF_CRYPT_FIPS_H WOLF_NO_TRAILING_ENUM_COMMAS WindowsCE XASU_AES_INIT diff --git a/CMakeLists.txt b/CMakeLists.txt index 7443387e2b1..65b63bd5dc4 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -3823,7 +3823,7 @@ if(WOLFSSL_RNG_BANK) if(NOT WOLFSSL_RNG) message(FATAL_ERROR "WOLFSSL_RNG_BANK requires WOLFSSL_RNG.") endif() - list(APPEND WOLFSSL_DEFINITIONS "-DWC_RNG_BANK_SUPPORT") + list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_WC_RNG_BANK") endif() # RNG lock (share one WC_RNG between threads) diff --git a/cmake/options.h.in b/cmake/options.h.in index 26d6b3341d3..50af2876437 100644 --- a/cmake/options.h.in +++ b/cmake/options.h.in @@ -603,8 +603,8 @@ extern "C" { #cmakedefine HAVE_CMAC_KDF #undef FP_ECC #cmakedefine FP_ECC -#undef WC_RNG_BANK_SUPPORT -#cmakedefine WC_RNG_BANK_SUPPORT +#undef HAVE_WC_RNG_BANK +#cmakedefine HAVE_WC_RNG_BANK #undef WC_RNG_NO_AUTO_LOCK #cmakedefine WC_RNG_NO_AUTO_LOCK #undef WC_RNG_AUTO_LOCK_DEFAULT_OFF diff --git a/configure.ac b/configure.ac index 8eb17af09df..59971a7381f 100644 --- a/configure.ac +++ b/configure.ac @@ -2829,7 +2829,11 @@ if test "$ENABLED_RNG_BANK" = "yes" then AS_IF([test "$ENABLED_RNG" = "no"], AC_MSG_ERROR([--enable-rng-bank requires --enable-rng])) - AM_CFLAGS="$AM_CFLAGS -DWC_RNG_BANK_SUPPORT" + AM_CFLAGS="$AM_CFLAGS -DHAVE_WC_RNG_BANK" + if test "$ENABLED_FIPS" = "no" + then + AM_CFLAGS="$AM_CFLAGS -DWC_RNG_WANT_BANKREF_SUPPORT" + fi fi diff --git a/linuxkm/Makefile b/linuxkm/Makefile index 00fc70df6a0..2cb90c640e2 100644 --- a/linuxkm/Makefile +++ b/linuxkm/Makefile @@ -366,7 +366,7 @@ module-update-fips-hash: $(LIBWOLFSSL_NAME).ko readarray -t verifyCore_attrs < <($(READELF) --wide --symbols "$<" | \ sed -E -n 's/^[[:space:]]*[0-9]+: ([0-9a-fA-F]+)[[:space:]]+([0-9]+)[[:space:]]+OBJECT[[:space:]]+[A-Z]+[[:space:]]+[A-Z]+[[:space:]]+'"$${rodata_segment[0]}"'[[:space:]]+verifyCore$$/\1\n\2/p'); \ if [[ $${#verifyCore_attrs[@]} != 2 ]]; then echo ' unexpected verifyCore_attrs.' >&2; exit 1; fi - verifyCore_size=$$(("$${verifyCore_attrs[1]}" - 1)) + verifyCore_size=$$(($${verifyCore_attrs[1]} - 1)) if [[ "$$verifyCore_size" != "64" && "$$verifyCore_size" != "128" ]]; then echo " verifyCore has unexpected length $${verifyCore_size}." >&2; exit 1; fi verifyCore_offset=$$((0x$${rodata_segment[1]} + 0x$${verifyCore_attrs[0]})) current_verifyCore=$$(dd bs=1 if="$<" skip=$$verifyCore_offset count=$$verifyCore_size status=none) diff --git a/linuxkm/lkcapi_rsa_glue.c b/linuxkm/lkcapi_rsa_glue.c index b45ede288c8..fbba095633f 100644 --- a/linuxkm/lkcapi_rsa_glue.c +++ b/linuxkm/lkcapi_rsa_glue.c @@ -633,14 +633,16 @@ static int km_rsa_ctx_init(struct km_rsa_ctx * ctx, int hash_oid) } static inline int km_rsa_ctx_init_rng(struct km_rsa_ctx * ctx) { - switch (ctx->rng.status) { - case WC_DRBG_OK: + if ((ctx->rng.status == WC_DRBG_OK) #ifdef WC_HAVE_RNG_BANKREF - case WC_DRBG_BANKREF: + || (ctx->rng.flags & WC_RNG_FLAG_BANKREF) #endif - return 0; - case WC_DRBG_NOT_INIT: + ) { + return 0; + } + + if (ctx->rng.status == WC_DRBG_NOT_INIT) { int err = LKCAPI_INITRNG(&ctx->rng); if (err) { pr_err("%s: init rng returned: %d\n", WOLFKM_RSA_DRIVER, err); @@ -651,7 +653,8 @@ static inline int km_rsa_ctx_init_rng(struct km_rsa_ctx * ctx) { } return 0; } - default: + else + { return -EINVAL; } } diff --git a/linuxkm/module_exports.c.template b/linuxkm/module_exports.c.template index 3d15a50af2b..316e31563a2 100644 --- a/linuxkm/module_exports.c.template +++ b/linuxkm/module_exports.c.template @@ -67,7 +67,7 @@ #include #endif #include - #ifdef WC_RNG_BANK_SUPPORT + #ifdef HAVE_WC_RNG_BANK #include #endif #endif diff --git a/wolfcrypt/benchmark/fips_cast_bench.c b/wolfcrypt/benchmark/fips_cast_bench.c index c61248a975b..43850c41bd6 100644 --- a/wolfcrypt/benchmark/fips_cast_bench.c +++ b/wolfcrypt/benchmark/fips_cast_bench.c @@ -476,7 +476,7 @@ static int bench_pct_mldsa(int iters) #endif /* WOLFSSL_HAVE_MLDSA */ -#ifdef WOLFSSL_HAVE_SLHDSA +#if defined(WOLFSSL_HAVE_SLHDSA) && !defined(WOLFSSL_SLHDSA_VERIFY_ONLY) /* SLH-DSA elected the root recompute over sign and verify. This times what * the module costs now, and the alternative it rejected, so the decision can * be rechecked rather than remembered. */ @@ -644,7 +644,7 @@ static int bench_pct_slhdsa(int iters) printf("\n"); return failures; } -#endif /* WOLFSSL_HAVE_SLHDSA */ +#endif /* WOLFSSL_HAVE_SLHDSA && !WOLFSSL_SLHDSA_VERIFY_ONLY */ /* Returns the number of algorithms whose PCT measurement failed. */ @@ -699,7 +699,7 @@ static int bench_pct(int iters, const char* only) } } #endif -#ifdef WOLFSSL_HAVE_SLHDSA +#if defined(WOLFSSL_HAVE_SLHDSA) && !defined(WOLFSSL_SLHDSA_VERIFY_ONLY) if ((err == 0) && ((only == NULL) || (XSTRCMP(only, "slhdsa") == 0))) { rc = bench_pct_slhdsa(iters); if (rc < 0) diff --git a/wolfcrypt/src/random.c b/wolfcrypt/src/random.c index e4e34cdf59d..93e7802b977 100644 --- a/wolfcrypt/src/random.c +++ b/wolfcrypt/src/random.c @@ -145,7 +145,8 @@ This library contains implementation for the random number generator. #include /* for the fork handlers, whatever the seed source */ #endif #ifdef WC_HAVE_RNG_BANKREF - #if defined(HAVE_FIPS) && !defined(WOLFSSL_EXPERIMENTAL_SETTINGS) + #if defined(HAVE_FIPS) && !defined(WOLFSSL_EXPERIMENTAL_SETTINGS) && \ + !defined(WOLFSSL_FIPS_DEV) #error WC_HAVE_RNG_BANKREF is unsupported in FIPS configurations. #endif #include diff --git a/wolfcrypt/src/rng_bank.c b/wolfcrypt/src/rng_bank.c index 5a9bb74cf0a..32fa40464a8 100644 --- a/wolfcrypt/src/rng_bank.c +++ b/wolfcrypt/src/rng_bank.c @@ -21,7 +21,7 @@ #include -#ifdef WC_RNG_BANK_SUPPORT +#ifdef HAVE_WC_RNG_BANK #include #include @@ -2695,7 +2695,7 @@ static int wc_InitRng_BankRef_local(struct wc_rng_bank *bank, WC_RNG **rng) { XMEMSET(*rng, 0, sizeof(**rng)); (*rng)->heap = bank->heap; - (*rng)->status = WC_DRBG_BANKREF; + (*rng)->flags |= WC_RNG_FLAG_BANKREF; (*rng)->bankref = bank; ret = 0; @@ -2727,6 +2727,8 @@ WOLFSSL_API int wc_BankRef_Release(WC_RNG *rng) int ret = 0; if (rng == NULL) return BAD_FUNC_ARG; + if (! (rng->flags & WC_RNG_FLAG_BANKREF)) + return WRONG_TYPE_OBJECT_E; if (rng->bankref == NULL) return BAD_FUNC_ARG; wolfSSL_RefDec(&rng->bankref->refcount, &isZero, &ret); @@ -2738,7 +2740,7 @@ WOLFSSL_API int wc_BankRef_Release(WC_RNG *rng) (void)isZero; #endif rng->heap = NULL; - rng->status = WC_DRBG_NOT_INIT; + rng->flags &= ~WC_RNG_FLAG_BANKREF; rng->bankref = NULL; return ret; } @@ -3444,4 +3446,4 @@ WOLFSSL_TEST_VIS int wc_RNG_DRBG_Reseed_Now( #endif /* HAVE_FIPS && FIPS_VERSION3_LT(7,0,0) */ -#endif /* WC_RNG_BANK_SUPPORT */ +#endif /* HAVE_WC_RNG_BANK */ diff --git a/wolfcrypt/test/test.c b/wolfcrypt/test/test.c index 8b148c88f88..471e11b454a 100644 --- a/wolfcrypt/test/test.c +++ b/wolfcrypt/test/test.c @@ -364,7 +364,7 @@ static const byte const_byte_array[] = "A+Gd\0\0\0"; #include #if !defined(WC_NO_RNG) #include - #ifdef WC_RNG_BANK_SUPPORT + #ifdef HAVE_WC_RNG_BANK #include #endif #endif @@ -971,7 +971,7 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t rng_flag_abi_test(void); #ifdef WC_TEST_RNG_AUTOLOCK WOLFSSL_TEST_SUBROUTINE wc_test_ret_t random_thread_test(void); #endif -#ifdef WC_RNG_BANK_SUPPORT +#ifdef HAVE_WC_RNG_BANK WOLFSSL_TEST_SUBROUTINE wc_test_ret_t random_bank_test(void); #endif #ifdef WOLFSSL_NOISE_SRC @@ -981,14 +981,14 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t noisesrc_test(void); (!defined(HAVE_FIPS) || FIPS_VERSION3_GE(7,0,0)) && !defined(HAVE_SELFTEST) WOLFSSL_TEST_SUBROUTINE wc_test_ret_t rng_drbg_svc_test(void); #endif -#if defined(WC_RNG_BANK_SUPPORT) && defined(HAVE_HASHDRBG) && \ +#if defined(HAVE_WC_RNG_BANK) && defined(HAVE_HASHDRBG) && \ (!defined(HAVE_FIPS) || FIPS_VERSION3_GE(5,2,4)) && \ !defined(HAVE_INTEL_RDRAND) WOLFSSL_TEST_SUBROUTINE wc_test_ret_t rng_entropy_invalidate_test(void); #endif #if defined(WC_RNG_HAVE_RBGC) && \ (!defined(HAVE_FIPS) || FIPS_VERSION3_GE(7,0,0) || \ - defined(WC_RNG_BANK_SUPPORT)) + defined(HAVE_WC_RNG_BANK)) WOLFSSL_TEST_SUBROUTINE wc_test_ret_t rng_drbg_rbgc_test(void); #endif #ifdef WC_RNG_HAVE_NEXT_SEED @@ -2726,7 +2726,7 @@ options: [-s max_relative_stack_bytes] [-m max_relative_heap_memory_bytes]\n\ else TEST_PASS("RNGTHRD test passed!\n"); #endif -#ifdef WC_RNG_BANK_SUPPORT +#ifdef HAVE_WC_RNG_BANK if ((ret = random_bank_test()) != 0) TEST_FAIL("RNGBANK test failed!\n", ret); else @@ -2745,7 +2745,7 @@ options: [-s max_relative_stack_bytes] [-m max_relative_heap_memory_bytes]\n\ else TEST_PASS("RNGSVC test passed!\n"); #endif -#if defined(WC_RNG_BANK_SUPPORT) && defined(HAVE_HASHDRBG) && \ +#if defined(HAVE_WC_RNG_BANK) && defined(HAVE_HASHDRBG) && \ (!defined(HAVE_FIPS) || FIPS_VERSION3_GE(5,2,4)) && \ !defined(HAVE_INTEL_RDRAND) if ((ret = rng_entropy_invalidate_test()) != 0) @@ -2755,7 +2755,7 @@ options: [-s max_relative_stack_bytes] [-m max_relative_heap_memory_bytes]\n\ #endif #if defined(WC_RNG_HAVE_RBGC) && \ (!defined(HAVE_FIPS) || FIPS_VERSION3_GE(7,0,0) || \ - defined(WC_RNG_BANK_SUPPORT)) + defined(HAVE_WC_RNG_BANK)) if ((ret = rng_drbg_rbgc_test()) != 0) TEST_FAIL("RNGRBGC test failed!\n", ret); else @@ -29635,7 +29635,7 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t random_thread_test(void) #endif /* WC_TEST_RNG_AUTOLOCK */ -#ifdef WC_RNG_BANK_SUPPORT +#ifdef HAVE_WC_RNG_BANK static char *rng_bank_affinity_lock_lock; static int rng_bank_affinity_lock(void *arg) { @@ -30836,7 +30836,7 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t random_bank_test(void) return ret; } -#endif /* WC_RNG_BANK_SUPPORT */ +#endif /* HAVE_WC_RNG_BANK */ #if defined(HAVE_HASHDRBG) && !defined(CUSTOM_RAND_GENERATE_BLOCK) && \ (!defined(HAVE_FIPS) || FIPS_VERSION3_GE(7,0,0)) && !defined(HAVE_SELFTEST) @@ -31096,7 +31096,7 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t rng_drbg_svc_test(void) #endif /* HAVE_HASHDRBG && !CUSTOM_RAND_GENERATE_BLOCK && */ /* (!HAVE_FIPS || FIPS_VERSION3_GE(7,0,0)) */ -#if defined(WC_RNG_BANK_SUPPORT) && defined(HAVE_HASHDRBG) && \ +#if defined(HAVE_WC_RNG_BANK) && defined(HAVE_HASHDRBG) && \ (!defined(HAVE_FIPS) || FIPS_VERSION3_GE(5,2,4)) && \ !defined(HAVE_INTEL_RDRAND) @@ -31687,7 +31687,7 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t rng_entropy_invalidate_test(void) return ret; } -#endif /* WC_RNG_BANK_SUPPORT && (!HAVE_FIPS || FIPS_VERSION3_GE(5,2,4)) && */ +#endif /* HAVE_WC_RNG_BANK && (!HAVE_FIPS || FIPS_VERSION3_GE(5,2,4)) && */ /* !HAVE_INTEL_RDRAND */ #ifdef WC_RNG_HAVE_RBGC @@ -32037,9 +32037,9 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t rng_drbg_rbgc_test(void) return ret; } -#elif defined(WC_RNG_BANK_SUPPORT) +#elif defined(HAVE_WC_RNG_BANK) -/* On old FIPS, WC_RNG_BANK_SUPPORT is needed for RNG-level compat shims. */ +/* On old FIPS, HAVE_WC_RNG_BANK is needed for RNG-level compat shims. */ #ifndef WC_RNG_INIT_FLAG_NONE #define WC_RNG_INIT_FLAG_NONE 0 @@ -32227,7 +32227,7 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t rng_drbg_rbgc_test(void) return ret; } -#endif /* HAVE_FIPS && FIPS_VERSION3_LT(7,0,0) && WC_RNG_BANK_SUPPORT */ +#endif /* HAVE_FIPS && FIPS_VERSION3_LT(7,0,0) && HAVE_WC_RNG_BANK */ #endif /* WC_RNG_HAVE_RBGC */ @@ -87312,7 +87312,8 @@ static int myCryptoDevCb(int devIdArg, wc_CryptoInfo* info, void* ctx) if (info->algo_type == WC_ALGO_TYPE_RNG) { #if defined(WOLF_CRYPTO_CB) && !defined(HAVE_HASHDRBG) && \ - !defined(WC_NO_RNG) && !defined(CUSTOM_RAND_GENERATE_BLOCK) + !defined(WC_NO_RNG) && !defined(CUSTOM_RAND_GENERATE_BLOCK) && \ + !defined(HAVE_INTEL_RDRAND) /* if RNG only supports crypto callback, just use seed */ ret = wc_GenerateSeed(&info->rng.rng->seed, info->rng.out, info->rng.sz); diff --git a/wolfcrypt/test/test.h b/wolfcrypt/test/test.h index da89aa468d2..dc8d1cb4825 100644 --- a/wolfcrypt/test/test.h +++ b/wolfcrypt/test/test.h @@ -287,7 +287,7 @@ extern WOLFSSL_TEST_SUBROUTINE wc_test_ret_t rng_flag_abi_test(void); #ifdef WC_TEST_RNG_AUTOLOCK extern WOLFSSL_TEST_SUBROUTINE wc_test_ret_t random_thread_test(void); #endif -#ifdef WC_RNG_BANK_SUPPORT +#ifdef HAVE_WC_RNG_BANK extern WOLFSSL_TEST_SUBROUTINE wc_test_ret_t random_bank_test(void); #endif #if defined(HAVE_HASHDRBG) && !defined(CUSTOM_RAND_GENERATE_BLOCK) && \ diff --git a/wolfssl/wolfcrypt/random.h b/wolfssl/wolfcrypt/random.h index c3eb98de1e5..2c475c5800a 100644 --- a/wolfssl/wolfcrypt/random.h +++ b/wolfssl/wolfcrypt/random.h @@ -71,7 +71,7 @@ defined(HAVE_THREAD_LS) && !defined(NO_THREAD_LS) && \ defined(HAVE_GETPID) && !defined(WOLFSSL_NO_GETPID) && \ !defined(WOLFSSL_NO_MALLOC) && !defined(HAVE_ENTROPY_MEMUSE) && \ - !defined(WC_RNG_BANK_SUPPORT) && !defined(WOLFSSL_STATIC_MEMORY) && \ + !defined(WOLFSSL_STATIC_MEMORY) && \ !defined(HAVE_WNR) && !defined(WOLFSSL_CHECK_MEM_ZERO) && \ !defined(WOLFSSL_TRACK_MEMORY) && !defined(WOLFSSL_MEM_FAIL_COUNT) #define WC_RNG_LOCK_ATFORK @@ -167,6 +167,21 @@ #undef WC_RNG_HAVE_FREE_HOOK #endif +#ifdef WC_RNG_NO_BANKREF_SUPPORT + #undef WC_RNG_WANT_BANKREF_SUPPORT +#endif +#ifdef WC_RNG_WANT_BANKREF_SUPPORT + #ifdef HAVE_FIPS + #error HAVE_FIPS is incompatible with WC_RNG_WANT_BANKREF_SUPPORT. + #endif + #ifndef HAVE_WC_RNG_BANK + #error WC_RNG_WANT_BANKREF_SUPPORT requires HAVE_WC_RNG_BANK. + #endif + #define WC_HAVE_RNG_BANKREF +#else + #undef WC_HAVE_RNG_BANKREF +#endif + /***** End setup for RNG extra features *****/ /* Maximum generate block length */ diff --git a/wolfssl/wolfcrypt/rng_bank.h b/wolfssl/wolfcrypt/rng_bank.h index 6befe272592..4fa50d0c8e5 100644 --- a/wolfssl/wolfcrypt/rng_bank.h +++ b/wolfssl/wolfcrypt/rng_bank.h @@ -34,10 +34,10 @@ #include #include -#ifdef WC_RNG_BANK_SUPPORT +#ifdef HAVE_WC_RNG_BANK #ifdef WC_NO_RNG - #error WC_RNG_BANK_SUPPORT requires RNG support. + #error HAVE_WC_RNG_BANK requires RNG support. #endif #if !defined(WOLFSSL_NO_ATOMICS) && !defined(WC_RNG_BANK_NO_DAEMON_SUPPORT) @@ -252,11 +252,6 @@ WOLFSSL_API int wc_rng_bank_daemon_release(struct wc_rng_bank *bank, WC_ATOMIC_UINT_ARG magic); #endif /* WC_RNG_BANK_HAVE_DAEMON_SUPPORT */ -#if defined(WC_DRBG_BANKREF) && !defined(WC_HAVE_RNG_BANKREF) - /* forward compat for FIPS v5.2.4 random.h */ - #define WC_HAVE_RNG_BANKREF -#endif - #ifdef WC_HAVE_RNG_BANKREF WOLFSSL_LOCAL int wc_local_rng_bank_checkout_for_bankref( struct wc_rng_bank *bank, @@ -536,6 +531,6 @@ WOLFSSL_API int wc_rng_bank_debug_stats_snap(struct wc_rng_debug_stats_snapshot struct wc_rng_bank *bank); #endif -#endif /* WC_RNG_BANK_SUPPORT */ +#endif /* HAVE_WC_RNG_BANK */ #endif /* WOLF_CRYPT_RNG_BANK_H */ From 331eaa157eb8a8798ccf7199e55606cd76f84031 Mon Sep 17 00:00:00 2001 From: Daniel Pouzzner Date: Thu, 24 Sep 2026 02:30:56 -0500 Subject: [PATCH 2/5] wolfssl/wolfcrypt/random.h: add exemptions for FIPS WC_RNG_WANT_BANKREF_SUPPORT. --- wolfssl/wolfcrypt/random.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/wolfssl/wolfcrypt/random.h b/wolfssl/wolfcrypt/random.h index 2c475c5800a..a133503ac79 100644 --- a/wolfssl/wolfcrypt/random.h +++ b/wolfssl/wolfcrypt/random.h @@ -171,7 +171,8 @@ #undef WC_RNG_WANT_BANKREF_SUPPORT #endif #ifdef WC_RNG_WANT_BANKREF_SUPPORT - #ifdef HAVE_FIPS + #if defined(HAVE_FIPS) && \ + !defined(WOLFSSL_FIPS_DEV) && !defined(WOLFSSL_EXPERIMENTAL_SETTINGS) #error HAVE_FIPS is incompatible with WC_RNG_WANT_BANKREF_SUPPORT. #endif #ifndef HAVE_WC_RNG_BANK From cae706cf1d0054502369e0d8715909cbdc8d1e1a Mon Sep 17 00:00:00 2001 From: Daniel Pouzzner Date: Thu, 24 Sep 2026 09:07:34 -0500 Subject: [PATCH 3/5] configure.ac, CMakeLists.txt, cmake/options.h.in: fix HAVE_WC_RNG_BANK + WC_RNG_AUTOFORK support in autotools/cmake. --- CMakeLists.txt | 3 +++ cmake/options.h.in | 2 ++ configure.ac | 4 ++-- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 65b63bd5dc4..990cc89354d 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -3824,6 +3824,9 @@ if(WOLFSSL_RNG_BANK) message(FATAL_ERROR "WOLFSSL_RNG_BANK requires WOLFSSL_RNG.") endif() list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_WC_RNG_BANK") + if(NOT WOLFSSL_FIPS) + list(APPEND WOLFSSL_DEFINITIONS "-DWC_RNG_WANT_BANKREF_SUPPORT") + endif() endif() # RNG lock (share one WC_RNG between threads) diff --git a/cmake/options.h.in b/cmake/options.h.in index 50af2876437..d56ef78b336 100644 --- a/cmake/options.h.in +++ b/cmake/options.h.in @@ -605,6 +605,8 @@ extern "C" { #cmakedefine FP_ECC #undef HAVE_WC_RNG_BANK #cmakedefine HAVE_WC_RNG_BANK +#undef WC_RNG_WANT_BANKREF_SUPPORT +#cmakedefine WC_RNG_WANT_BANKREF_SUPPORT #undef WC_RNG_NO_AUTO_LOCK #cmakedefine WC_RNG_NO_AUTO_LOCK #undef WC_RNG_AUTO_LOCK_DEFAULT_OFF diff --git a/configure.ac b/configure.ac index 59971a7381f..adba0e688eb 100644 --- a/configure.ac +++ b/configure.ac @@ -13505,11 +13505,11 @@ then *) ENABLED_RNG_AUTOFORK_FLAGS=yes ;; esac if test "$ENABLED_SELFTEST" = "yes" || test "x$ENABLED_HASHDRBG" != "xyes" || \ - test "$ENABLED_ENTROPY_MEMUSE" != "no" || test "$ENABLED_RNG_BANK" = "yes" || \ + test "$ENABLED_ENTROPY_MEMUSE" != "no" || \ test "$ENABLED_RNG_AUTOFORK_FLAGS" = "no" || test "$ENABLED_WNR" = "yes" || \ { test "$ENABLED_FIPS" = "yes" && test "${HAVE_FIPS_VERSION_MAJOR:-0}" -lt 7; } then - RNG_AUTOFORK_NEEDS="${RNG_AUTOFORK_NEEDS:+$RNG_AUTOFORK_NEEDS, and }getpid and the Hash DRBG with a heap, and none of selftest, FIPS before v7, entropy-memuse, rng-bank, static memory, netRandom, memory zero checking or memory tracking" + RNG_AUTOFORK_NEEDS="${RNG_AUTOFORK_NEEDS:+$RNG_AUTOFORK_NEEDS, and }getpid and the Hash DRBG with a heap, and none of selftest, FIPS before v7, entropy-memuse, static memory, netRandom, memory zero checking or memory tracking" fi if test -z "$RNG_AUTOFORK_NEEDS" then From 290eac5f289d451133478a35b08d0f8c48c3ad8f Mon Sep 17 00:00:00 2001 From: Daniel Pouzzner Date: Thu, 24 Sep 2026 10:11:29 -0500 Subject: [PATCH 4/5] linuxkm/lkcapi_rsa_glue.c: fix clang-diagnostic-parentheses-equality in km_rsa_ctx_init_rng(). wolfcrypt/test/test.c: work around false positive cppcheck nullPointer warning in random_bank_test(). CMakeLists.txt, cmake/options.h.in: add WOLFSSL_SLHDSAVERIFYONLY. --- CMakeLists.txt | 11 +++++++++++ cmake/options.h.in | 3 +++ linuxkm/lkcapi_rsa_glue.c | 14 ++++---------- wolfcrypt/test/test.c | 6 +++++- 4 files changed, 23 insertions(+), 11 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 990cc89354d..f1d99d193b2 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -1358,6 +1358,10 @@ add_option(WOLFSSL_SLHDSA "Enable the wolfSSL SLH-DSA implementation (default: disabled)" "no" "yes;no") +add_option(WOLFSSL_SLHDSAVERIFYONLY + "Enable the SLH-DSA verify-only implementation (default: disabled)" + "no" "yes;no") + if (WOLFSSL_SLHDSA) message(STATUS "Automatically set related requirements for SLH-DSA") add_definitions("-DWOLFSSL_HAVE_SLHDSA") @@ -1367,6 +1371,13 @@ if (WOLFSSL_SLHDSA) set_wolfssl_definitions("WOLFSSL_HAVE_SLHDSA" RESULT) set_wolfssl_definitions("WOLFSSL_WC_SLHDSA" RESULT) set_wolfssl_definitions("WOLFSSL_SHAKE256" RESULT) + + if (WOLFSSL_SLHDSAVERIFYONLY) + list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SLHDSA_VERIFY_ONLY") + + set_wolfssl_definitions("WOLFSSL_SLHDSA_VERIFY_ONLY" RESULT) + endif() + message(STATUS "Looking for WOLFSSL_SLHDSA - found") endif() diff --git a/cmake/options.h.in b/cmake/options.h.in index d56ef78b336..bcf1aaef3e2 100644 --- a/cmake/options.h.in +++ b/cmake/options.h.in @@ -457,6 +457,9 @@ extern "C" { #cmakedefine WOLFSSL_HAVE_SLHDSA #undef WOLFSSL_WC_SLHDSA #cmakedefine WOLFSSL_WC_SLHDSA +#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY +#cmakedefine WOLFSSL_SLHDSA_VERIFY_ONLY +#endif #undef WOLFSSL_PQC_HYBRIDS #cmakedefine WOLFSSL_PQC_HYBRIDS #undef WOLFSSL_EXTRA_PQC_HYBRIDS diff --git a/linuxkm/lkcapi_rsa_glue.c b/linuxkm/lkcapi_rsa_glue.c index fbba095633f..203b4684ce1 100644 --- a/linuxkm/lkcapi_rsa_glue.c +++ b/linuxkm/lkcapi_rsa_glue.c @@ -633,15 +633,10 @@ static int km_rsa_ctx_init(struct km_rsa_ctx * ctx, int hash_oid) } static inline int km_rsa_ctx_init_rng(struct km_rsa_ctx * ctx) { - if ((ctx->rng.status == WC_DRBG_OK) -#ifdef WC_HAVE_RNG_BANKREF - || (ctx->rng.flags & WC_RNG_FLAG_BANKREF) -#endif - ) - { + if (ctx->rng.status == WC_DRBG_OK) + return 0; + if (ctx->rng.flags & WC_RNG_FLAG_BANKREF) return 0; - } - if (ctx->rng.status == WC_DRBG_NOT_INIT) { int err = LKCAPI_INITRNG(&ctx->rng); if (err) { @@ -653,8 +648,7 @@ static inline int km_rsa_ctx_init_rng(struct km_rsa_ctx * ctx) { } return 0; } - else - { + else { return -EINVAL; } } diff --git a/wolfcrypt/test/test.c b/wolfcrypt/test/test.c index 471e11b454a..937655707e1 100644 --- a/wolfcrypt/test/test.c +++ b/wolfcrypt/test/test.c @@ -30579,7 +30579,11 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t random_bank_test(void) if (WC_RNG_BANK_INST_TO_RNG(rng_inst) == NULL) ERROR_OUT(WC_TEST_RET_ENC_NC, out); /* take the instance out of service while holding it */ - WC_RNG_BANK_INST_TO_RNG(rng_inst)->status = WC_DRBG_FAILED; + { + WC_RNG *inst_rng = WC_RNG_BANK_INST_TO_RNG(rng_inst); + if (inst_rng != NULL) + inst_rng->status = WC_DRBG_FAILED; + } ret = wc_rng_bank_inst_checkin(&rng_inst); if (ret != 0) ERROR_OUT(WC_TEST_RET_ENC_EC(ret), out); From 19c6f16331430200fe87d4f36db4ded3fc61612e Mon Sep 17 00:00:00 2001 From: Daniel Pouzzner Date: Thu, 24 Sep 2026 15:40:41 -0500 Subject: [PATCH 5/5] linuxkm/lkcapi_rsa_glue.c: in km_rsa_ctx_init_rng(), add back availability gate for the bankref identifier. --- linuxkm/lkcapi_rsa_glue.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/linuxkm/lkcapi_rsa_glue.c b/linuxkm/lkcapi_rsa_glue.c index 203b4684ce1..d4ae5e288f2 100644 --- a/linuxkm/lkcapi_rsa_glue.c +++ b/linuxkm/lkcapi_rsa_glue.c @@ -635,8 +635,10 @@ static int km_rsa_ctx_init(struct km_rsa_ctx * ctx, int hash_oid) static inline int km_rsa_ctx_init_rng(struct km_rsa_ctx * ctx) { if (ctx->rng.status == WC_DRBG_OK) return 0; +#ifdef WC_RNG_FLAG_BANKREF if (ctx->rng.flags & WC_RNG_FLAG_BANKREF) return 0; +#endif if (ctx->rng.status == WC_DRBG_NOT_INIT) { int err = LKCAPI_INITRNG(&ctx->rng); if (err) {