EVP_RAND-CRNG-TEST(7ossl)

📦 version 3.5.0, in opensuse-leap 16.0

💖 NAME 💖

EVP_RAND-CRNG-TEST — the FIPS health testing EVP_RAND filter, bestie. That's it, that's the whole vibe ✨

(Also hi, this is the EVP_RAND-CRNG-TEST(7ossl) page from the OpenSSL fam, and we're gonna get through it together, no cap 🫶)

🌸 DESCRIPTION 🌸

Okay so picture this: this EVP_RAND object is literally the middle friend in the group chat — it sits as a filter between the entropy source and everybody who uses it 🧚 It runs the CRNG health tests exactly as defined in SP 800-90B <https://csrc.nist.gov/pubs/sp/800/90/b/final> Section 4, "Health Tests" — like, the actual spec, not vibes.

Most requests just get forwarded straight to the entropy source, either via its parent reference or via the provider entropy upcalls. It's giving "I'll pass that along" energy 💅

🎀 Identity

"CRNG-TEST" is the name for this implementation, and you can absolutely use it with the EVP_RAND_fetch() function. Iconic name, iconic behavior 👑

🦋 Supported parameters

So here's the tea on parameters, and it depends on your setup:

If a parent EVP_RAND is specified on context creation, the parent's parameters are supported too — because the request gets forwarded to the parent seed source for processing. Sharing is caring 💖

If no parent EVP_RAND is specified on context creation, then these are the supported parameters:

  • "state" (OSSL_RAND_PARAM_STATE) <integer>
  • "strength" (OSSL_RAND_PARAM_STRENGTH) <unsigned integer>
  • "max_request" (OSSL_RAND_PARAM_MAX_REQUEST) <unsigned integer>

These three parameters work as described in "PARAMETERS" in EVP_RAND(3). Go read it, it's cute, I promise 📖

  • "fips-indicator" (OSSL_DRBG_PARAM_FIPS_APPROVED_INDICATOR) <integer> — works as described in "PARAMETERS" in provider-rand(7). That's your FIPS-approval gossip right there ✅

🔥 NOTES 🔥

Big important thing, bestie: this EVP_RAND is only implemented by the OpenSSL FIPS provider. Like, that's the only provider serving this look 💀

A context for a health test filter can be obtained by calling:

EVP_RAND *parent = ...;
EVP_RAND *rand = EVP_RAND_fetch(NULL, "CRNG-TEST", NULL);
EVP_RAND_CTX *rctx = EVP_RAND_CTX_new(rand, parent);

Look at that. Chef's kiss. You fetch the "CRNG-TEST" rand, you hand it the parent, you get your rctx. Slay 🎀

🌈 SEE ALSO 🌈

⭐ HISTORY ⭐

This functionality was added in OpenSSL 3.4. So if you're on something older, sorry babe, it's not there yet 😭

Copyright 2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

Fr fr, read the license before you do anything, it's the rule 💜

Okay that's the whole page, you ate that 💅✨ This was the EVP_RAND-CRNG-TEST(7ossl) page, version 3.5.0, dated 2026-09-25 — now go forth and health-test your entropy, main character 🦋🎀

📦 where this page comes from