mbedtls: error on mbedtls_ctr_drbg_seed

Question

I'm using mbedtls to run SSL server. The function mbedtls_ctr_drbg_seed returned -34. My code is below:

const char *pers = "ssl_server2";
  mbedtls_havege_state hs;
  mbedtls_ssl_session ssn;
  mbedtls_entropy_context entropy;
  mbedtls_ctr_drbg_context ctr_drbg;
  // One HTTPS Request Handling
  memset( &ssn, 0, sizeof( mbedtls_ssl_session ) );
  /*
  * 4. Setup stuff
  */
  mbedtls_ssl_init( &ssl );
  mbedtls_ssl_config_init( &conf );
  mbedtls_ctr_drbg_init( &ctr_drbg );
  mbedtls_entropy_init( &entropy );
  printf( "  . Setting up the RNG and SSL data...." );
  if( ( ret = mbedtls_ctr_drbg_seed( &ctr_drbg, mbedtls_entropy_func, &entropy, (const unsigned char *) pers, sizeof( pers ) ) ) != 0 )
  {
     printf( " failed\n  ! mbedtls_ctr_drbg_seed returned -0x%x\n", -ret );
     goto ExitFunction;
  }
  else
     printf( " mbedtls_ctr_drbg_seed returned 0x%x ok\n", ret );

I presume that the function is returning -0x34 (CTR_DRBG: The entropy source failed) and not -34 (AES: Invalid data input length). What distribution did you get the mbedtls package from, or how did you build it? What environment are you running it on? This error code indicates that something went wrong on your platform, not in your program, but since you give no information about your platform, we can't help you. — Gilles 'SO- stop being evil', Mar 10 '18 at 21:47
By the way, `sizeof( pers )` is wrong here since `pers` is a pointer and not an array, but that means you're passing 4 as the size of the personalization string and `pers` is more than 4 bytes long so it works anyway. — Gilles 'SO- stop being evil', Mar 10 '18 at 21:48

Ron Eldor · Answer 1 · 2018-03-27T13:26:28.953

As @Gilles rightfully said, the error you are receiving is probably -0x34, which is MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED. This error is returned when the function mbedtls_entropy_func() fails. Please check the the entropy source you are using is strong enough, meaning you have at least one entropy source which is strong, when added with mbedtls_entropy_add_source(). You should also verify that the entropy source you are using can collect enough entropy, and exceeds the threshold set to the source.
There are other locations where mbedtls_entropy_func() might fail, therefore I suggest you check these locations as well.

mbedtls: error on mbedtls_ctr_drbg_seed

1 Answers1