EVP_RAND-CRNG-TEST(7SSL)

💖 EVP_RAND-CRNG-TEST(7SSL) 💖

okay bestie, welcome to the EVP_RAND-CRNG-TEST glow-up page — that's a section 7 SSL manual page, and she's from the OpenSSL fam. sit down, grab a strawberry 🍓, and let's get into it.

---

✨ NAME ✨

EVP_RAND-CRNG-TEST — the FIPS health testing EVP_RAND filter. yes she's a filter. yes she's checking vitals. periodt.

---

🌸 DESCRIPTION 🌸

So this EVP_RAND object is basically the bouncer between the entropy source and everybody who wants a piece of it 💅. She runs CRNG health tests, and those are defined in SP 800-90B https://csrc.nist.gov/pubs/sp/800/90/b/final Section 4 "Health Tests". iykyk.

Most requests? She just forwards them straight to the entropy source — either through her parent reference OR through the provider entropy upcalls. queen behavior honestly.

🎀 Identity 🎀

"CRNG-TEST" is the name for this implementation, and you can absolutely use it with the EVP_RAND_fetch() function. that's her government name. no nicknames.

🦋 Supported parameters 🦋

Real talk: if a parent EVP_RAND is specified when you create the context, then the parent's parameters are what's supported, because the request gets forwarded to the parent seed source for processing. she's just the messenger.

But if no parent EVP_RAND is specified on context creation? then these are the ones she supports, bestie:

• "state" (OSSL_RAND_PARAM_STATE) <integer>
• "strength" (OSSL_RAND_PARAM_STRENGTH) <unsigned integer>
• "max_request" (OSSL_RAND_PARAM_MAX_REQUEST) <unsigned integer> — these three work exactly as described in "PARAMETERS" in EVP_RAND(3). no cap.
• "fips-indicator" (OSSL_RAND_PARAM_FIPS_APPROVED_INDICATOR) <integer> — this one works as described in "PARAMETERS" in provider-rand(7).

---

🔥 NOTES 🔥

Heads up bestie, this is important: this EVP_RAND is only implemented by the OpenSSL FIPS provider. that's it. that's the whole roster. 💀

You can get yourself a context for a health test filter by calling this:

EVP_RAND *parent = ...;
EVP_RAND *rand = EVP_RAND_fetch(NULL, "CRNG-TEST", NULL);
EVP_RAND_CTX *rctx = EVP_RAND_CTX_new(rand, parent);

look at her go. main character energy fr fr ✨

---

👑 SEE ALSO 👑

EVP_RAND(3), OSSL_PROVIDER-FIPS(7)

---

🌈 HISTORY 🌈

This functionality was added in OpenSSL 3.4. new girl on the block but she's already iconic.

---

💜 COPYRIGHT 💜

Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

---

okay that's the whole thing, you ate it 🫶 go forth and fetch responsibly.

and that's a wrap on version 4.0.3, dated 2026-09-29, bestie — EVP_RAND-CRNG-TEST(7SSL) out. mwah 💖✨🎀