SP 800-90B verdict preservation & APT/RCT compliance fixes - #11506

Merged

douzzer merged 15 commits into

wolfSSL:masterfrom

kaleb-himes:PQ-FS-2026-Part3-SecurityReview-nofallback-T

Oct 2, 2026

Commits on Oct 1, 2026

random: keep SP 800-90B RCT/APT verdicts through reseed
kaleb-himes
committed
aeed584
tests/api: stuck seed source at reseed reports ENTROPY_RT_E
kaleb-himes
committed
00a6858
random: seed APT uses the 90B reference window and its own cutoff
kaleb-himes
committed
b084a50
tests/api: cover the seed APT cutoff, windows and remainder
kaleb-himes
committed
2a0d6bb
linuxkm: recover the DRBG on a seed health-test alarm too
kaleb-himes
committed
617ad9b
random: add the all-values seed check as a 4.3 Req 1c extra test
kaleb-himes
committed
0cdb65e
random: hold the seed APT cutoffs as byte deltas from half the window
kaleb-himes
committed
8c7e00c
random: preserve 90B verdicts at instantiate and drop stale returns
kaleb-himes
committed
95ba963
tests/api: sweep every window the seed APT cutoff tables cover
kaleb-himes
committed
b517d91
random: build the seed verdict helper only where DRBG_FAILURE exists
kaleb-himes
committed
04b8bc4
random: guard caller-set seed cutoffs and correct the APT comments
kaleb-himes
committed
5c41bfc
random: condemn on a seed verdict and bound a caller-set APT cutoff
kaleb-himes
committed
4d46a11
linuxkm: reinstantiate up to three times before failing a generate
kaleb-himes
committed
f03294a
random: drop an unsound cutoff bound and stop masking source errors
kaleb-himes
committed
c997468

Commits on Oct 2, 2026

random: a rejected seed fails the reseed, not the instantiation
kaleb-himes
committed
e65f05e