3 * Random number generator for DSA
5 * (c) 1999 Straylight/Edgeware
8 /*----- Licensing notice --------------------------------------------------*
10 * This file is part of Catacomb.
12 * Catacomb is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU Library General Public License as
14 * published by the Free Software Foundation; either version 2 of the
15 * License, or (at your option) any later version.
17 * Catacomb is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU Library General Public License for more details.
22 * You should have received a copy of the GNU Library General Public
23 * License along with Catacomb; if not, write to the Free
24 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
28 /*----- Header files ------------------------------------------------------*/
33 #include <mLib/alloc.h>
34 #include <mLib/bits.h>
41 /*----- Main code ---------------------------------------------------------*/
45 * Arguments: @dsarand *d@ = pointer to context
47 * Use: Increments the buffer by one, interpreting it as a big-endian
48 * integer. Carries outside the integer are discarded.
51 #define STEP(d) do { \
54 octet *_q = _p + _d->sz; \
56 while (_c && _q > _p) { \
63 /* --- @dsarand_init@ --- *
65 * Arguments: @dsarand *d@ = pointer to context
66 * @const void *p@ = pointer to seed buffer
67 * @size_t sz@ = size of the buffer
71 * Use: Initializes a DSA random number generator.
74 void dsarand_init(dsarand *d, const void *p, size_t sz)
83 /* --- @dsarand_reseed@ --- *
85 * Arguments: @dsarand *d@ = pointer to context
86 * @const void *p@ = pointer to seed buffer
87 * @size_t sz@ = size of the buffer
91 * Use: Initializes a DSA random number generator.
94 void dsarand_reseed(dsarand *d, const void *p, size_t sz)
104 /* --- @dsarand_destroy@ --- *
106 * Arguments: @dsarand *d@ = pointer to context
110 * Use: Disposes of a DSA random number generation context.
113 void dsarand_destroy(dsarand *d)
118 /* --- @dsarand_fill@ --- *
120 * Arguments: @dsarand *d@ = pointer to context
121 * @void *p@ = pointer to output buffer
122 * @size_t sz@ = size of output buffer
126 * Use: Fills an output buffer with pseudorandom data.
128 * Let %$p$% be the numerical value of the input buffer, and let
129 * %$b$% be the number of bytes required. Let
130 * %$z = \lceil b / 20 \rceil$% be the number of SHA outputs
131 * required. Then the output of pass %$n$% is
133 * %$P_n = \sum_{0 \le i < z} 2^{160i} SHA(p + nz + i)$%
134 * %${} \bmod 2^{8b}$%
136 * and the actual result in the output buffer is the XOR of all
137 * of the output passes.
139 * The DSA procedure for choosing @q@ involves two passes with
140 * %$z = 1$%; the procedure for choosing @p@ involves one pass
141 * with larger %$z$%. This generalization of the DSA generation
142 * procedure is my own invention but it seems relatively sound.
145 void dsarand_fill(dsarand *d, void *p, size_t sz)
148 unsigned n = d->passes;
150 /* --- Write out the first pass --- *
152 * This can write directly to the output buffer, so it's done differently
153 * from the latter passes.
162 /* --- Hash the input buffer --- */
165 sha_hash(&h, d->p, d->sz);
167 /* --- If enough space, extract the hash output directly --- */
169 if (o >= SHA_HASHSZ) {
174 /* --- Otherwise take the hash result out of line and copy it --- */
177 octet hash[SHA_HASHSZ];
179 memcpy(q, hash + (SHA_HASHSZ - o), o);
183 /* --- Step the input buffer --- */
188 /* --- Another pass has been done --- */
193 /* --- Write out subsequent passes --- *
195 * The hash output has to be done offline, so this is slightly easier.
203 octet hash[SHA_HASHSZ];
207 /* --- Hash the input buffer --- */
210 sha_hash(&h, d->p, d->sz);
213 /* --- Work out how much output is wanted --- */
220 /* --- XOR the data out --- */
222 for (pp = hash + (SHA_HASHSZ - n), qq = q + o;
223 pp < hash + SHA_HASHSZ; pp++, qq++)
226 /* --- Step the input buffer --- */
231 /* --- Another pass is done --- */
237 /*----- Generic pseudorandom-number generator interface -------------------*/
239 static const grand_ops gops;
241 typedef struct gctx {
246 static void gdestroy(grand *r)
249 dsarand_destroy(&g->d);
253 static int gmisc(grand *r, unsigned op, ...)
262 switch (va_arg(ap, unsigned)) {
264 case GRAND_SEEDBLOCK:
268 case DSARAND_GETSEED:
276 case GRAND_SEEDBLOCK: {
277 const void *p = va_arg(ap, const void *);
278 size_t sz = va_arg(ap, size_t);
279 dsarand_reseed(&g->d, p, sz);
281 case GRAND_SEEDRAND: {
282 grand *rr = va_arg(ap, grand *);
283 rr->ops->fill(rr, g->d.p, g->d.sz);
285 case DSARAND_PASSES: {
286 unsigned n = va_arg(ap, unsigned);
288 if (n > 0) g->d.passes = n;
293 case DSARAND_GETSEED:
294 memcpy(va_arg(ap, void *), g->d.p, g->d.sz);
305 static void gfill(grand *r, void *p, size_t sz)
308 dsarand_fill(&g->d, p, sz);
311 static const grand_ops gops = {
315 grand_defaultword, grand_defaultbyte, grand_defaultword,
316 grand_defaultrange, gfill
319 /* --- @dsarand_create@ --- *
321 * Arguments: @const void *p@ = pointer to seed buffer
322 * @size_t sz@ = size of seed buffer
324 * Returns: Pointer to a generic generator.
326 * Use: Constructs a generic generator interface over a Catacomb
327 * entropy pool generator.
330 grand *dsarand_create(const void *p, size_t sz)
332 gctx *g = CREATE(gctx);
334 dsarand_init(&g->d, p, sz);
338 /*----- That's all, folks -------------------------------------------------*/