EVP_RAND-CRNG-TEST(7ossl)

📦
version 3.5.9 · 8 versions
, in alpine 3.23, alpine 3.24

💖 NAME 💖

Okay so bestie, this page is about EVP_RAND-CRNG-TEST — it's the FIPS health testing EVP_RAND filter, and honestly? She's doing the most important job in the whole vibe check of randomness. We're in the 7ossl manual, brought to you by OpenSSL, and this is the whole tea. 🫶

✨ DESCRIPTION ✨

So picture this: this EVP_RAND object is basically the bodyguard standing between the entropy source and everyone who wants a piece of it. It's a filter, and its whole personality is running CRNG health tests exactly as defined in SP 800-90B Section 4, "Health Tests" (you can find the spec over at https://csrc.nist.gov/pubs/sp/800/90/b/final).

The way it works? Most requests get forwarded straight on to the entropy source — either through its parent reference or through the provider entropy upcalls. She's not gatekeeping, she's just checking vibes first. 💅

🎀 Identity 🎀

"CRNG-TEST" is the name of this implementation, periodt. That's the string you feed to EVP_RAND_fetch() when you want her. Iykyk.

🌸 Supported parameters 🌸

So here's the sitch, depending on how you set things up at context creation:

If you specify a parent EVP_RAND on context creation — the parent's parameters are supported, because ✨ the request gets forwarded to the parent seed source for processing ✨. She just passes the aux cord, no cap.

If you don't specify a parent EVP_RAND on context creation — then the following parameters are the ones supported:

  • "state" (OSSL_RAND_PARAM_STATE) <integer> — the state, bestie.
  • "strength" (OSSL_RAND_PARAM_STRENGTH) <unsigned integer> — the strength.
  • "max_request" (OSSL_RAND_PARAM_MAX_REQUEST) <unsigned integer> — the max request.

These three work exactly as described in "PARAMETERS" in EVP_RAND(3). Go read that if you want the deep lore. 📖

  • "fips-indicator" (OSSL_RAND_PARAM_FIPS_APPROVED_INDICATOR) <integer> — this one works as described in "PARAMETERS" in provider-rand(7).

👑 NOTES 👑

Big important thing, don't skip this: this EVP_RAND is only implemented by the OpenSSL FIPS provider. Like, that's the only place she lives. 🏠

And if you want a context for a health test filter? Here's literally how you get one:

EVP_RAND *parent = ...;
EVP_RAND *rand = EVP_RAND_fetch(NULL, "CRNG-TEST", NULL);
EVP_RAND_CTX *rctx = EVP_RAND_CTX_new(rand, parent);

Iconic. Copy-paste-able. Slay. 🔥

🦋 SEE ALSO 🦋

Go check these out, they're the friends in her group chat:

🌈 HISTORY 🌈

This functionality was added in OpenSSL 3.4. So if you're on something older, sorry babe, she wasn't born yet. 😭

Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

Okay that's the whole page, bestie — every flag, every param, every caveat, all of it. Now go forth and be cryptographically secure. 🧚💖

Mwah 💋 — this was the EVP_RAND-CRNG-TEST(7ossl) page from OpenSSL version 3.5.9, dated 2026-09-29. Catch you in the next manpage! ✨🎀

📦 where this page comes from