3 * $Id: rand.c,v 1.5 2000/06/17 11:53:55 mdw Exp $
5 * Secure random number generator
7 * (c) 1998 Straylight/Edgeware
10 /*----- Licensing notice --------------------------------------------------*
12 * This file is part of Catacomb.
14 * Catacomb is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU Library General Public License as
16 * published by the Free Software Foundation; either version 2 of the
17 * License, or (at your option) any later version.
19 * Catacomb is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU Library General Public License for more details.
24 * You should have received a copy of the GNU Library General Public
25 * License along with Catacomb; if not, write to the Free
26 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
30 /*----- Revision history --------------------------------------------------*
33 * Revision 1.5 2000/06/17 11:53:55 mdw
34 * Deprecate `rand_getgood'. Provide a new interface to ensure that a pool
35 * is well seeded. Use secure arena for memory allocation.
37 * Revision 1.4 1999/12/13 15:34:28 mdw
38 * Increase the entropy threshhold in rand_getgood.
40 * Revision 1.3 1999/12/10 23:28:07 mdw
41 * Bug fix: rand_getgood didn't update buffer pointer.
43 * Revision 1.2 1999/10/12 21:00:15 mdw
44 * Make pool and buffer sizes more sensible.
46 * Revision 1.1 1999/09/03 08:41:12 mdw
51 /*----- Header files ------------------------------------------------------*/
57 #include <mLib/bits.h>
61 #include "blowfish-cbc.h"
65 #include "rmd160-hmac.h"
67 /*----- Static variables --------------------------------------------------*/
69 static const grand_ops gops;
76 static gctx *pool = 0; /* Default random pool */
78 /*----- Macros ------------------------------------------------------------*/
80 #define RAND_RESOLVE(r) do { \
81 if ((r) == RAND_GLOBAL) { \
83 pool = (gctx *)rand_create(); \
88 #define TIMER(r) do { \
89 if ((r)->s && (r)->s->timer) \
93 /*----- Main code ---------------------------------------------------------*/
95 /* --- @rand_init@ --- *
97 * Arguments: @rand_pool *r@ = pointer to a randomness pool
101 * Use: Initializes a randomness pool. The pool doesn't start out
102 * very random: that's your job to sort out. A good suggestion
103 * would be to attach an appropriate noise source and call
107 void rand_init(rand_pool *r)
110 memset(r->pool, 0, sizeof(r->pool));
111 memset(r->buf, 0, sizeof(r->buf));
114 r->ibits = r->obits = 0;
117 rmd160_hmacinit(&r->k, 0, 0);
121 /* --- @rand_noisesrc@ --- *
123 * Arguments: @rand_pool *r@ = pointer to a randomness pool
124 * @const rand_source *s@ = pointer to source definition
128 * Use: Sets a noise source for a randomness pool. When the pool's
129 * estimate of good random bits falls to zero, the @getnoise@
130 * function is called, passing the pool handle as an argument.
131 * It is expected to increase the number of good bits by at
132 * least one, because it'll be called over and over again until
133 * there are enough bits to satisfy the caller. The @timer@
134 * function is called frequently throughout the generator's
138 void rand_noisesrc(rand_pool *r, const rand_source *s)
144 /* --- @rand_seed@ --- *
146 * Arguments: @rand_pool *r@ = pointer to a randomness pool
147 * @unsigned bits@ = number of bits to ensure
151 * Use: Ensures that there are at least @bits@ good bits of entropy
152 * in the pool. It is recommended that you call this after
153 * initializing a new pool. Requesting @bits > RAND_IBITS@ is
154 * doomed to failure (and is an error).
157 void rand_seed(rand_pool *r, unsigned bits)
161 assert(((void)"bits pointlessly large in rand_seed", bits <= RAND_IBITS));
162 assert(((void)"no noise source in rand_seed", r->s));
164 while (r->ibits < bits)
169 /* --- @rand_key@ --- *
171 * Arguments: @rand_pool *r@ = pointer to a randomness pool
172 * @const void *k@ = pointer to key data
173 * @size_t sz@ = size of key data
177 * Use: Sets the secret key for a randomness pool. The key is used
178 * when mixing in new random bits.
181 void rand_key(rand_pool *r, const void *k, size_t sz)
184 rmd160_hmacinit(&r->k, k, sz);
187 /* --- @rand_add@ --- *
189 * Arguments: @rand_pool *r@ = pointer to a randomness pool
190 * @const void *p@ = pointer a buffer of data to add
191 * @size_t sz@ = size of the data buffer
192 * @unsigned goodbits@ = number of good bits estimated in buffer
196 * Use: Mixes the data in the buffer with the contents of the
197 * pool. The estimate of the number of good bits is added to
198 * the pool's own count. The mixing operation is not
199 * cryptographically strong. However, data in the input pool
200 * isn't output directly, only through the one-way gating
201 * operation, so that shouldn't matter.
204 void rand_add(rand_pool *r, const void *p, size_t sz, unsigned goodbits)
209 #if RAND_POOLSZ != 128
210 # error Polynomial in rand_add is out of date. Fix it.
215 i = r->i; rot = r->irot;
219 r->pool[i] ^= (ROL8(o, rot) ^
220 r->pool[(i + 1) % RAND_POOLSZ] ^
221 r->pool[(i + 2) % RAND_POOLSZ] ^
222 r->pool[(i + 7) % RAND_POOLSZ]);
224 i++; if (i >= RAND_POOLSZ) i -= RAND_POOLSZ;
230 r->ibits += goodbits;
231 if (r->ibits > RAND_IBITS)
232 r->ibits = RAND_IBITS;
235 /* --- @rand_goodbits@ --- *
237 * Arguments: @rand_pool *r@ = pointer to a randomness pool
239 * Returns: Estimate of the number of good bits remaining in the pool.
242 unsigned rand_goodbits(rand_pool *r)
245 return (r->ibits + r->obits);
248 /* --- @rand_gate@ --- *
250 * Arguments: @rand_pool *r@ = pointer to a randomness pool
254 * Use: Mixes up the entire state of the generator in a nonreversible
258 void rand_gate(rand_pool *r)
260 octet mac[RMD160_HASHSZ];
265 /* --- Hash up all the data in the pool --- */
270 rmd160_macinit(&mc, &r->k);
271 rmd160_machash(&mc, r->pool, sizeof(r->pool));
272 rmd160_machash(&mc, r->buf, sizeof(r->buf));
273 rmd160_macdone(&mc, mac);
277 /* --- Now mangle all of the data based on the hash --- */
282 blowfish_cbcinit(&bc, mac, sizeof(mac), 0);
283 blowfish_cbcencrypt(&bc, r->pool, r->pool, sizeof(r->pool));
284 blowfish_cbcencrypt(&bc, r->buf, r->buf, sizeof(r->buf));
288 /* --- Reset the various state variables --- */
291 r->obits += r->ibits;
292 if (r->obits > RAND_OBITS) {
293 r->ibits = r->obits - r->ibits;
294 r->obits = RAND_OBITS;
300 /* --- @rand_stretch@ --- *
302 * Arguments: @rand_pool *r@ = pointer to a randomness pool
306 * Use: Stretches the contents of the output buffer by transforming
307 * it in a nonreversible way. This doesn't add any entropy
308 * worth speaking about, but it works well enough when the
309 * caller doesn't care about that sort of thing.
312 void rand_stretch(rand_pool *r)
314 octet mac[RMD160_HASHSZ];
319 /* --- Hash up all the data in the buffer --- */
324 rmd160_macinit(&mc, &r->k);
325 rmd160_machash(&mc, r->pool, sizeof(r->pool));
326 rmd160_machash(&mc, r->buf, sizeof(r->buf));
327 rmd160_macdone(&mc, mac);
331 /* --- Now mangle the buffer based on that hash --- */
336 blowfish_cbcinit(&bc, mac, sizeof(mac), 0);
337 blowfish_cbcencrypt(&bc, r->buf, r->buf, sizeof(r->buf));
341 /* --- Reset the various state variables --- */
347 /* --- @rand_get@ --- *
349 * Arguments: @rand_pool *r@ = pointer to a randomness pool
350 * @void *p@ = pointer to output buffer
351 * @size_t sz@ = size of output buffer
355 * Use: Gets random data from the pool. The pool's contents can't be
356 * determined from the output of this function; nor can the
357 * output data be determined from a knowledge of the data input
358 * to the pool wihtout also having knowledge of the secret key.
359 * The good bits counter is decremented, although no special
360 * action is taken if it reaches zero.
363 void rand_get(rand_pool *r, void *p, size_t sz)
373 if (r->o + sz <= RAND_BUFSZ) {
374 memcpy(o, r->buf + r->o, sz);
378 size_t chunk = RAND_BUFSZ - r->o;
380 memcpy(o, r->buf + r->o, chunk);
388 if (r->obits > sz * 8)
394 /* --- @rand_getgood@ --- *
396 * Arguments: @rand_pool *r@ = pointer to a randomness pool
397 * @void *p@ = pointer to output buffer
398 * @size_t sz@ = size of output buffer
402 * Use: Gets random data from the pool, ensuring that there are
403 * enough good bits. This interface isn't recommended: it makes
404 * the generator slow, and doesn't provide much more security
405 * than @rand_get@, assuming you've previously done a
409 void rand_getgood(rand_pool *r, void *p, size_t sz)
417 if (!r->s || !r->s->getnoise) {
426 if (chunk * 8 > r->obits) {
427 if (chunk * 8 > r->ibits + r->obits)
428 do r->s->getnoise(r); while (r->ibits + r->obits < 256);
430 if (chunk * 8 > r->obits)
431 chunk = r->obits / 8;
434 if (chunk + r->o > RAND_BUFSZ)
435 chunk = RAND_BUFSZ - r->o;
437 memcpy(o, r->buf + r->o, chunk);
439 r->obits -= chunk * 8;
445 /*----- Generic random number generator interface -------------------------*/
447 #define GRESOLVE(g, r) do { \
448 if (r != &rand_global) \
452 pool = (gctx *)rand_create(); \
457 static void gdestroy(grand *r)
467 static int gmisc(grand *r, unsigned op, ...)
477 switch (va_arg(ap, unsigned)) {
480 case GRAND_SEEDUINT32:
481 case GRAND_SEEDBLOCK:
495 case GRAND_SEEDINT: {
496 unsigned u = va_arg(ap, unsigned);
497 rand_add(&g->p, &u, sizeof(u), sizeof(u));
499 case GRAND_SEEDUINT32: {
500 uint32 i = va_arg(ap, uint32);
501 rand_add(&g->p, &i, sizeof(i), 4);
503 case GRAND_SEEDBLOCK: {
504 const void *p = va_arg(ap, const void *);
505 size_t sz = va_arg(ap, size_t);
506 rand_add(&g->p, p, sz, sz);
508 case GRAND_SEEDRAND: {
509 grand *rr = va_arg(ap, grand *);
511 rr->ops->fill(rr, buf, sizeof(buf));
512 rand_add(&g->p, buf, sizeof(buf), 8);
521 const void *k = va_arg(ap, const void *);
522 size_t sz = va_arg(ap, size_t);
523 rand_key(&g->p, k, sz);
526 rand_noisesrc(&g->p, va_arg(ap, const rand_source *));
529 rand_seed(&g->p, va_arg(ap, unsigned));
540 static octet gbyte(grand *r)
545 rand_getgood(&g->p, &o, 1);
549 static uint32 gword(grand *r)
554 rand_getgood(&g->p, &b, sizeof(b));
558 static void gfill(grand *r, void *p, size_t sz)
562 rand_get(&g->p, p, sz);
565 static const grand_ops gops = {
569 gword, gbyte, gword, grand_range, gfill
572 grand rand_global = { &gops };
574 /* --- @rand_create@ --- *
578 * Returns: Pointer to a generic generator.
580 * Use: Constructs a generic generator interface over a Catacomb
581 * entropy pool generator.
584 grand *rand_create(void)
586 gctx *g = S_CREATE(gctx);
592 /*----- That's all, folks -------------------------------------------------*/