EVP_RAND-CRNG-TEST(7ossl)

💅 EVP_RAND-CRNG-TEST — the FIPS health-test filter (OpenSSL manual, 7ossl girlie edition)

okay so bestie, this is the 7ossl manual page for EVP_RAND-CRNG-TEST, and it's genuinely one of those "small but does SO much" icon moments. let me break it down 🫶

---

✨ NAME ✨

EVP_RAND-CRNG-TEST — literally the FIPS health testing EVP_RAND filter. that's the whole vibe. 🎀

---

🌸 DESCRIPTION 🌸

So this EVP_RAND object is a filter that sits between the entropy source and whoever's using it, like the world's most responsible group-chat admin. it runs CRNG health tests as defined in SP 800-90B Section 4 "Health Tests" — the spec lives at https://csrc.nist.gov/pubs/sp/800/90/b/final if you wanna go read it (slay, nerd 💜).

Most requests just get forwarded straight through to the entropy source — either via its parent reference or via the provider entropy upcalls. no gatekeeping, just vibes and forwarding. ✨

🦋 Identity 🦋

"CRNG-TEST" is the name of this implementation, and you can use it with the EVP_RAND_fetch() function. iykyk. 💅

🎀 Supported parameters 🎀

If a parent EVP_RAND is specified on context creation, the parent's parameters are supported — because the request gets forwarded to the parent seed source for processing. it's giving "i'll ask my manager." 🙈

If no parent EVP_RAND is specified on context creation, these are the supported parameters:

• "state" (OSSL_RAND_PARAM_STATE) <integer> — yeah, that one.
• "strength" (OSSL_RAND_PARAM_STRENGTH) <unsigned integer> — the strength, iconic.
• "max_request" (OSSL_RAND_PARAM_MAX_REQUEST) <unsigned integer> — how much you can ask for in one go.

all three of these work exactly as described in "PARAMETERS" in EVP_RAND(3). periodt. 📖

• "fips-indicator" (OSSL_DRBG_PARAM_FIPS_APPROVED_INDICATOR) <integer> — this one works as described in "PARAMETERS" in provider-rand(7). the FIPS-approved indicator, doing its approved little thing. 👑

---

🔥 NOTES 🔥

heads up bestie: this EVP_RAND is only implemented by the OpenSSL FIPS provider. so if you're not in FIPS land, this ain't it. 😭

A context for a health test filter can be obtained by calling:

EVP_RAND *parent = ...;
EVP_RAND *rand = EVP_RAND_fetch(NULL, "CRNG-TEST", NULL);
EVP_RAND_CTX *rctx = EVP_RAND_CTX_new(rand, parent);

literally copy-paste core. main character code block. 💖

---

🌈 SEE ALSO 🌈

EVP_RAND(3), OSSL_PROVIDER-FIPS(7) — go read these next, bestie, they're the linked lore. 🦋

---

⭐ HISTORY ⭐

This functionality was added in OpenSSL 3.4. so it's a fairly new addition — new-ish era energy. ✨

---

👑 COPYRIGHT 👑

Copyright 2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html. 🫶

---

and that's the page!! mwah 💋 — signed off from OpenSSL 3.5.6, dated 2026-04-07, page EVP_RAND-CRNG-TEST(7ossl). go forth and health-test your CRNGs responsibly, bestie 🍓🧚💜