3 * Secure random number generator
5 * (c) 1998 Straylight/Edgeware
8 /*----- Licensing notice --------------------------------------------------*
10 * This file is part of Catacomb.
12 * Catacomb is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU Library General Public License as
14 * published by the Free Software Foundation; either version 2 of the
15 * License, or (at your option) any later version.
17 * Catacomb is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU Library General Public License for more details.
22 * You should have received a copy of the GNU Library General Public
23 * License along with Catacomb; if not, write to the Free
24 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
28 /*----- Header files ------------------------------------------------------*/
36 #include <mLib/bits.h>
48 #include "twofish-counter.h"
51 #define CIPHER_CTX twofish_counterctx
52 #define CIPHER_INIT twofish_counterinit
53 #define CIPHER_ENCRYPT twofish_counterencrypt
54 #define CIPHER_IVSZ TWOFISH_BLKSZ
55 #define CIPHER_KEYSZ TWOFISH_KEYSZ
57 #define HASH_CTX sha256_ctx
58 #define HASH_INIT sha256_init
59 #define HASH sha256_hash
60 #define HASH_DONE sha256_done
61 #define HASH_SZ SHA256_HASHSZ
63 /*----- Static variables --------------------------------------------------*/
65 static const grand_ops gops;
67 typedef struct rand__gctx {
76 { "Catacomb global random byte pool" },
80 /*----- Macros ------------------------------------------------------------*/
82 #define RAND_RESOLVE(r) \
83 do { if ((r) == RAND_GLOBAL) r = &rand_global.p; } while (0)
85 #define GENCHECK(r) do { \
86 unsigned gen = rand_generation(); \
87 if (r->gen != gen) { r->gen = gen; rand_gate(r); } \
90 static int quick(rand_pool *);
91 #define QUICK(r) do { \
93 if ((r)->s && (r)->s->timer) (r)->s->timer(r); \
96 /*----- Main code ---------------------------------------------------------*/
98 /* --- @rand_init@ --- *
100 * Arguments: @rand_pool *r@ = pointer to a randomness pool
104 * Use: Initializes a randomness pool. The pool doesn't start out
105 * very random: that's your job to sort out. A good suggestion
106 * would be to attach an appropriate noise source and call
110 void rand_init(rand_pool *r)
113 memset(r->pool, 0, sizeof(r->pool));
114 memset(r->buf, 0, sizeof(r->buf));
115 r->gen = rand_generation();
118 r->ibits = r->obits = 0;
120 r->s = &noise_source;
125 /* --- @rand_noisesrc@ --- *
127 * Arguments: @rand_pool *r@ = pointer to a randomness pool
128 * @const rand_source *s@ = pointer to source definition
132 * Use: Sets a noise source for a randomness pool. When the pool's
133 * estimate of good random bits falls to zero, the @getnoise@
134 * function is called, passing the pool handle as an argument.
135 * It is expected to increase the number of good bits by at
136 * least one, because it'll be called over and over again until
137 * there are enough bits to satisfy the caller. The @timer@
138 * function is called frequently throughout the generator's
142 void rand_noisesrc(rand_pool *r, const rand_source *s)
148 /* --- @rand_quick@ --- *
150 * Arguments: @rand_pool *r@ = pointer to a randomness pool
152 * Returns: Zero on success; @-1@ on failure.
154 * Use Attempts to use some machine-specific `quick' source of
155 * entropy to top up @r@. This may not do anything at all on
159 CPU_DISPATCH(static, return, int, quick, (rand_pool *r), (r),
160 pick_quick, trivial_quick);
162 static int trivial_quick(rand_pool *r) { return (-1); }
164 #if CPUFAM_X86 || CPUFAM_AMD64
165 extern int rand_quick_x86ish_rdrand(rand_pool */*r*/);
168 static quick__functype *pick_quick(void)
170 #if CPUFAM_X86 || CPUFAM_AMD64
171 DISPATCH_PICK_COND(rand_quick, rand_quick_x86ish_rdrand,
172 cpu_feature_p(CPUFEAT_X86_RDRAND));
174 DISPATCH_PICK_FALLBACK(rand_quick, trivial_quick);
177 int rand_quick(rand_pool *r) { RAND_RESOLVE(r); return (quick(r)); }
179 /* --- @rand_seed@ --- *
181 * Arguments: @rand_pool *r@ = pointer to a randomness pool
182 * @unsigned bits@ = number of bits to ensure
186 * Use: Ensures that there are at least @bits@ good bits of entropy
187 * in the pool. It is recommended that you call this after
188 * initializing a new pool. Requesting @bits > RAND_IBITS@ is
189 * doomed to failure (and is an error).
192 void rand_seed(rand_pool *r, unsigned bits)
196 assert(((void)"bits pointlessly large in rand_seed", bits <= RAND_IBITS));
197 assert(((void)"no noise source in rand_seed", r->s));
199 while (r->ibits < bits)
204 /* --- @rand_key@ --- *
206 * Arguments: @rand_pool *r@ = pointer to a randomness pool
207 * @const void *k@ = pointer to key data
208 * @size_t sz@ = size of key data
212 * Use: Sets the secret key for a randomness pool. The key is used
213 * when mixing in new random bits.
216 void rand_key(rand_pool *r, const void *k, size_t sz)
220 static const char label[] = "Catacomb random pool key";
224 assert(HASH_SZ >= RAND_KEYSZ);
226 HASH(&hc, label, sizeof(label));
227 if (sz) HASH(&hc, k, sz);
229 memcpy(r->k.k, h, RAND_KEYSZ);
232 /* --- @rand_add@ --- *
234 * Arguments: @rand_pool *r@ = pointer to a randomness pool
235 * @const void *p@ = pointer a buffer of data to add
236 * @size_t sz@ = size of the data buffer
237 * @unsigned goodbits@ = number of good bits estimated in buffer
241 * Use: Mixes the data in the buffer with the contents of the
242 * pool. The estimate of the number of good bits is added to
243 * the pool's own count. The mixing operation is not
244 * cryptographically strong. However, data in the input pool
245 * isn't output directly, only through the one-way gating
246 * operation, so that shouldn't matter.
249 void rand_add(rand_pool *r, const void *p, size_t sz, unsigned goodbits)
254 STATIC_ASSERT(RAND_POOLSZ == 128, "Polynomial doesn't match pool size");
258 i = r->i; rot = r->irot;
262 r->pool[i] ^= (ROL8(o, rot) ^
263 r->pool[(i + 1) % RAND_POOLSZ] ^
264 r->pool[(i + 2) % RAND_POOLSZ] ^
265 r->pool[(i + 7) % RAND_POOLSZ]);
267 i++; if (i >= RAND_POOLSZ) i -= RAND_POOLSZ;
273 r->ibits += goodbits;
274 if (r->ibits > RAND_IBITS)
275 r->ibits = RAND_IBITS;
278 /* --- @rand_goodbits@ --- *
280 * Arguments: @rand_pool *r@ = pointer to a randomness pool
282 * Returns: Estimate of the number of good bits remaining in the pool.
285 unsigned rand_goodbits(rand_pool *r)
288 return (r->ibits + r->obits);
291 /* --- @rand_gate@ --- *
293 * Arguments: @rand_pool *r@ = pointer to a randomness pool
297 * Use: Mixes up the entire state of the generator in a nonreversible
301 void rand_gate(rand_pool *r)
303 octet h[HASH_SZ], g[4];
310 /* --- Hash up all the data in the pool --- */
313 STORE32(g, r->gen); HASH(&hc, g, sizeof(g));
314 HASH(&hc, r->pool, RAND_POOLSZ);
315 HASH(&hc, r->buf, RAND_BUFSZ);
319 /* --- Now mangle all of the data based on the hash --- */
321 assert(CIPHER_KEYSZ <= HASH_SZ);
322 CIPHER_INIT(&cc, h, CIPHER_KEYSZ, 0);
323 CIPHER_ENCRYPT(&cc, r->pool, r->pool, RAND_POOLSZ);
324 CIPHER_ENCRYPT(&cc, r->buf, r->buf, RAND_BUFSZ);
327 /* --- Reset the various state variables --- */
330 r->obits += r->ibits;
331 if (r->obits > RAND_OBITS) {
332 r->ibits = r->obits - r->ibits;
333 r->obits = RAND_OBITS;
339 /* --- @rand_stretch@ --- *
341 * Arguments: @rand_pool *r@ = pointer to a randomness pool
345 * Use: Stretches the contents of the output buffer by transforming
346 * it in a nonreversible way. This doesn't add any entropy
347 * worth speaking about, but it works well enough when the
348 * caller doesn't care about that sort of thing.
351 void rand_stretch(rand_pool *r)
353 octet h[HASH_SZ], g[4];
360 /* --- Hash up all the data in the buffer --- */
363 STORE32(g, r->gen); HASH(&hc, g, sizeof(g));
364 HASH(&hc, r->pool, RAND_POOLSZ);
365 HASH(&hc, r->buf, RAND_BUFSZ);
369 /* --- Now mangle the buffer based on the hash --- */
371 assert(CIPHER_KEYSZ <= HASH_SZ);
372 CIPHER_INIT(&cc, h, CIPHER_KEYSZ, 0);
373 CIPHER_ENCRYPT(&cc, r->buf, r->buf, RAND_BUFSZ);
376 /* --- Reset the various state variables --- */
382 /* --- @rand_get@ --- *
384 * Arguments: @rand_pool *r@ = pointer to a randomness pool
385 * @void *p@ = pointer to output buffer
386 * @size_t sz@ = size of output buffer
390 * Use: Gets random data from the pool. The pool's contents can't be
391 * determined from the output of this function; nor can the
392 * output data be determined from a knowledge of the data input
393 * to the pool wihtout also having knowledge of the secret key.
394 * The good bits counter is decremented, although no special
395 * action is taken if it reaches zero.
398 void rand_get(rand_pool *r, void *p, size_t sz)
409 if (r->o + sz <= RAND_BUFSZ) {
410 memcpy(o, r->buf + r->o, sz);
414 size_t chunk = RAND_BUFSZ - r->o;
416 memcpy(o, r->buf + r->o, chunk);
424 if (r->obits > sz * 8)
430 /* --- @rand_getgood@ --- *
432 * Arguments: @rand_pool *r@ = pointer to a randomness pool
433 * @void *p@ = pointer to output buffer
434 * @size_t sz@ = size of output buffer
438 * Use: Gets random data from the pool, ensuring that there are
439 * enough good bits. This interface isn't recommended: it makes
440 * the generator slow, and doesn't provide much more security
441 * than @rand_get@, assuming you've previously done a
445 void rand_getgood(rand_pool *r, void *p, size_t sz)
453 if (!r->s || !r->s->getnoise) {
463 if (chunk * 8 > r->obits) {
464 if (chunk * 8 > r->ibits + r->obits)
465 do r->s->getnoise(r); while (r->ibits + r->obits < 256);
467 if (chunk * 8 > r->obits)
468 chunk = r->obits / 8;
471 if (chunk + r->o > RAND_BUFSZ)
472 chunk = RAND_BUFSZ - r->o;
474 memcpy(o, r->buf + r->o, chunk);
476 r->obits -= chunk * 8;
482 /*----- Generic random number generator interface -------------------------*/
484 static void gdestroy(grand *r)
487 if (g != &rand_global) {
493 static int gmisc(grand *r, unsigned op, ...)
502 switch (va_arg(ap, unsigned)) {
505 case GRAND_SEEDUINT32:
506 case GRAND_SEEDBLOCK:
523 case GRAND_SEEDINT: {
524 unsigned u = va_arg(ap, unsigned);
525 rand_add(&g->p, &u, sizeof(u), sizeof(u));
527 case GRAND_SEEDUINT32: {
528 uint32 i = va_arg(ap, uint32);
529 rand_add(&g->p, &i, sizeof(i), 4);
531 case GRAND_SEEDBLOCK: {
532 const void *p = va_arg(ap, const void *);
533 size_t sz = va_arg(ap, size_t);
534 rand_add(&g->p, p, sz, sz);
536 case GRAND_SEEDRAND: {
537 grand *rr = va_arg(ap, grand *);
539 rr->ops->fill(rr, buf, sizeof(buf));
540 rand_add(&g->p, buf, sizeof(buf), 8);
549 const void *k = va_arg(ap, const void *);
550 size_t sz = va_arg(ap, size_t);
551 rand_key(&g->p, k, sz);
554 rand_noisesrc(&g->p, va_arg(ap, const rand_source *));
557 rand_seed(&g->p, va_arg(ap, unsigned));
563 rc = rand_goodbits(&g->p);
566 const void *p = va_arg(ap, const void *);
567 size_t sz = va_arg(ap, size_t);
568 unsigned goodbits = va_arg(ap, unsigned);
569 rand_add(&g->p, p, sz, goodbits);
580 static octet gbyte(grand *r)
584 rand_getgood(&g->p, &o, 1);
588 static uint32 gword(grand *r)
592 rand_getgood(&g->p, &b, sizeof(b));
596 static void gfill(grand *r, void *p, size_t sz)
599 rand_get(&g->p, p, sz);
602 static const grand_ops gops = {
606 gword, gbyte, gword, grand_defaultrange, gfill
609 /* --- @rand_create@ --- *
613 * Returns: Pointer to a generic generator.
615 * Use: Constructs a generic generator interface over a Catacomb
616 * entropy pool generator.
619 grand *rand_create(void)
621 gctx *g = S_CREATE(gctx);
627 /*----- That's all, folks -------------------------------------------------*/