Random: add DRBG reseed support

[mjdemilliano]

Only available when Hash-DRBG is enabled, which is the default.

[dgarske]

Skoll Code Review

Scan type: reviewOverall recommendation: COMMENT
Findings: 4 total — 4 posted, 0 skipped
4 finding(s) posted as inline comments (see file-level comments below)

Posted findings

• [Medium] test_reseed_empty asserts nothing and silently passes on either outcome — tests/test_random.py:61-66
• [Low] Non-ASCII em-dash in test comment violates ASCII-only convention — tests/test_random.py:66
• [Low] test_reseed only checks output length, not that reseed had any effect — tests/test_random.py:55-58
• [Low] Per-method feature gate inside class body differs from repo's module-level gating pattern — wolfcrypt/random.py:81-89

Review generated by Skoll

[dgarske]

Skoll Multi-Scan Review

Modes: review + review-securityOverall recommendation: COMMENT
Findings: 3 total — 3 posted, 0 skipped
3 finding(s) posted as inline comments (see file-level comments below)

Posted findings

• [Medium] [review] reseed error branch missing # pragma: no cover used by every other error path — wolfcrypt/random.py:88
• [Low] [review] Trailing whitespace on blank line inside test_reseed_multiple — tests/test_random.py:79
• [Low] [review] Seed bytes use % 255, likely intended % 256 — tests/test_random.py:61,77

Review generated by Skoll

[dgarske]

Skoll Code Review

Scan type: reviewOverall recommendation: COMMENT
Findings: 3 total — 3 posted, 0 skipped
3 finding(s) posted as inline comments (see file-level comments below)

Posted findings

• [Medium] HASHDRBG feature not detected on Windows non-FIPS build; reseed() silently unavailable — scripts/build_ffi.py:381
• [Low] test_reseed_multiple is non-deterministic — tests/test_random.py:72-85
• [Low] reseed() accepts bytes only with no input normalization — wolfcrypt/random.py:82-89

Review generated by Skoll

[dgarske]

#130 (review)

[dgarske]

Skoll Code Review

Scan type: reviewOverall recommendation: COMMENT
Findings: 3 total — 3 posted, 0 skipped
2 finding(s) posted as inline comments (see file-level comments below)
1 finding(s) not tied to a diff line (full detail below)

Posted findings

• [Low] Misleading comment in test_reseed_multiple (no random seed sizes used) — tests/test_random.py:76
• [Low] HASHDRBG feature detection relies on explicit #define that wolfSSL may only set implicitly — scripts/build_ffi.py:381

Findings not tied to a diff line

Type stub lib.pyi not updated with HASHDRBG_ENABLED / wc_RNG_DRBG_Reseed

File: wolfcrypt/_ffi/lib.pyi:33
Function: N/A (module-level stub)
Severity: Medium

The repo maintains a hand-written CFFI type stub at wolfcrypt/_ffi/lib.pyi that enumerates every *_ENABLED feature flag (lines 7-33, including HKDF_ENABLED, ML_DSA_ENABLED, etc.). This PR introduces a new build-time flag HASHDRBG_ENABLED (used in wolfcrypt/random.py:81 and tests/test_random.py:57,71) and a new native function wc_RNG_DRBG_Reseed (used in wolfcrypt/random.py:87), but does not add either to the stub. The project ships mypy and ty in its [dependency-groups] dev (see pyproject.toml), so a type check would report _lib.HASHDRBG_ENABLED as attr-defined error. Adding the flag keeps the stub's flag section complete and consistent.

Recommendation: Add HASHDRBG_ENABLED: int to the flags section of lib.pyi (and, for completeness, wc_RNG_DRBG_Reseed) so the stub stays in sync with the CFFI-generated symbols this PR references.

Referenced code: wolfcrypt/_ffi/lib.pyi:33-36 (4 lines)

---

Review generated by Skoll

[dgarske]

#130 (review)