From 57b4fccf2d08836127c7162f6fbb9d7d9e4efe8a Mon Sep 17 00:00:00 2001
From: Torben Hansen <50673096+torben-hansen@users.noreply.github.com>
Date: Thu, 2 Apr 2026 15:07:01 -0700
Subject: [PATCH 1/2] Make randomness generation deterministic under
 BORINGSSL_UNSAFE_FUZZER_MODE

---
 .../fipsmodule/rand/entropy/entropy_sources.c | 43 +++++++++++++++++++
 crypto/fipsmodule/rand/entropy/internal.h     |  1 +
 2 files changed, 44 insertions(+)

diff --git a/crypto/fipsmodule/rand/entropy/entropy_sources.c b/crypto/fipsmodule/rand/entropy/entropy_sources.c
index b742225f1b8..574440d13d3 100644
--- a/crypto/fipsmodule/rand/entropy/entropy_sources.c
+++ b/crypto/fipsmodule/rand/entropy/entropy_sources.c
@@ -122,11 +122,54 @@ DEFINE_LOCAL_DATA(struct entropy_source_methods, opt_out_cpu_jitter_entropy_sour
   out->id = OPT_OUT_CPU_JITTER_ENTROPY_SOURCE;
 }
 
+static int entropy_deterministic_initialize(
+  struct entropy_source_t *entropy_source) {
+  return 1;
+}
+
+static void entropy_deterministic_zeroize_thread(struct entropy_source_t *entropy_source) {}
+
+static void entropy_deterministic_free_thread(struct entropy_source_t *entropy_source) {}
+
+static int entropy_deterministic_get(
+  const struct entropy_source_t *entropy_source,
+  uint8_t entropy[CTR_DRBG_ENTROPY_LEN]) {
+  CRYPTO_sysrand(entropy, CTR_DRBG_ENTROPY_LEN);
+  return 1;
+}
+
+static int use_deterministic_entropy(void) {
+#if defined(OPENSSL_RAND_DETERMINISTIC)
+  return 1;
+#else
+  return 0;
+#endif
+}
+
+// Deterministic configuration.
+// - When OPENSSL_RAND_DETERMINISTIC is defined, the expectation is that
+//   generated randomness is deterministic. Typically to support fuzzing.
+// - Using |CRYPTO_sysrand| is deterministic under the
+//   |OPENSSL_RAND_DETERMINISTIC| mode.
+DEFINE_LOCAL_DATA(struct entropy_source_methods, deterministic_entropy_source_methods) {
+  out->initialize = entropy_deterministic_initialize;
+  out->zeroize_thread = entropy_deterministic_zeroize_thread;
+  out->free_thread = entropy_deterministic_free_thread;
+  out->get_seed = entropy_deterministic_get;
+  out->get_extra_entropy = entropy_deterministic_get;
+  out->get_prediction_resistance = NULL;
+  out->id = DETERMINISTIC_ENTROPY_SOURCE;
+}
+
 static const struct entropy_source_methods * get_entropy_source_methods(void) {
   if (*allow_entropy_source_methods_override_bss_get() == 1) {
     return *entropy_source_methods_override_bss_get();
   }
 
+  if (use_deterministic_entropy()) {
+    return deterministic_entropy_source_methods();
+  }
+
   if (use_opt_out_cpu_jitter_entropy()) {
     return opt_out_cpu_jitter_entropy_source_methods();
   }
diff --git a/crypto/fipsmodule/rand/entropy/internal.h b/crypto/fipsmodule/rand/entropy/internal.h
index a2aeadac864..470f5c14ff6 100644
--- a/crypto/fipsmodule/rand/entropy/internal.h
+++ b/crypto/fipsmodule/rand/entropy/internal.h
@@ -16,6 +16,7 @@ extern "C" {
 #define OVERRIDDEN_ENTROPY_SOURCE 0
 #define TREE_DRBG_JITTER_ENTROPY_SOURCE 1
 #define OPT_OUT_CPU_JITTER_ENTROPY_SOURCE 2
+#define DETERMINISTIC_ENTROPY_SOURCE 2
 
 #define ENTROPY_JITTER_MAX_NUM_TRIES (3)
 

From 5d6392a37de551518de23932d7483e0432399f88 Mon Sep 17 00:00:00 2001
From: Torben Hansen <50673096+torben-hansen@users.noreply.github.com>
Date: Thu, 2 Apr 2026 15:26:58 -0700
Subject: [PATCH 2/2] Add test assertion

---
 crypto/fipsmodule/rand/entropy/entropy_source_test.cc | 6 ++++++
 crypto/fipsmodule/rand/entropy/internal.h             | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/crypto/fipsmodule/rand/entropy/entropy_source_test.cc b/crypto/fipsmodule/rand/entropy/entropy_source_test.cc
index 7c3183b87c0..f25af06cd56 100644
--- a/crypto/fipsmodule/rand/entropy/entropy_source_test.cc
+++ b/crypto/fipsmodule/rand/entropy/entropy_source_test.cc
@@ -6,6 +6,7 @@
 #include <openssl/crypto.h>
 
 #include "internal.h"
+#include "../../../rand_extra/internal.h"
 #include "../../../ube/vm_ube_detect.h"
 
 #define MAX_MULTIPLE_FROM_RNG (16)
@@ -79,6 +80,11 @@ TEST(EntropySources, Configuration) {
 #if defined(AWSLC_VM_UBE_TESTING) && defined(OPENSSL_LINUX)
   EXPECT_EQ(OPT_OUT_CPU_JITTER_ENTROPY_SOURCE, get_entropy_source_method_id_FOR_TESTING());
 
+// In this mode, we expect deterministic behaviour from the randomness
+// generation.
+#elif defined(OPENSSL_RAND_DETERMINISTIC)
+  EXPECT_EQ(DETERMINISTIC_ENTROPY_SOURCE, get_entropy_source_method_id_FOR_TESTING());
+
 // If entropy build configuration choose to explicitly opt-out of CPU Jitter
 // Entropy
 #elif defined(DISABLE_CPU_JITTER_ENTROPY)
diff --git a/crypto/fipsmodule/rand/entropy/internal.h b/crypto/fipsmodule/rand/entropy/internal.h
index 470f5c14ff6..9c7f2f24c46 100644
--- a/crypto/fipsmodule/rand/entropy/internal.h
+++ b/crypto/fipsmodule/rand/entropy/internal.h
@@ -16,7 +16,7 @@ extern "C" {
 #define OVERRIDDEN_ENTROPY_SOURCE 0
 #define TREE_DRBG_JITTER_ENTROPY_SOURCE 1
 #define OPT_OUT_CPU_JITTER_ENTROPY_SOURCE 2
-#define DETERMINISTIC_ENTROPY_SOURCE 2
+#define DETERMINISTIC_ENTROPY_SOURCE 3
 
 #define ENTROPY_JITTER_MAX_NUM_TRIES (3)