5 * Secure random number generator
7 * (c) 1998 Straylight/Edgeware
10 /*----- Licensing notice --------------------------------------------------*
12 * This file is part of Catacomb.
14 * Catacomb is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU Library General Public License as
16 * published by the Free Software Foundation; either version 2 of the
17 * License, or (at your option) any later version.
19 * Catacomb is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU Library General Public License for more details.
24 * You should have received a copy of the GNU Library General Public
25 * License along with Catacomb; if not, write to the Free
26 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
30 /*----- Header files ------------------------------------------------------*/
36 #include <mLib/bits.h>
40 #include "blowfish-cbc.h"
44 #include "rmd160-hmac.h"
46 /*----- Static variables --------------------------------------------------*/
48 static const grand_ops gops
;
55 static gctx
*pool
= 0; /* Default random pool */
57 /*----- Macros ------------------------------------------------------------*/
59 #define RAND_RESOLVE(r) do { \
60 if ((r) == RAND_GLOBAL) { \
62 pool = (gctx *)rand_create(); \
67 #define TIMER(r) do { \
68 if ((r)->s && (r)->s->timer) \
72 /*----- Main code ---------------------------------------------------------*/
74 /* --- @rand_init@ --- *
76 * Arguments: @rand_pool *r@ = pointer to a randomness pool
80 * Use: Initializes a randomness pool. The pool doesn't start out
81 * very random: that's your job to sort out. A good suggestion
82 * would be to attach an appropriate noise source and call
86 void rand_init(rand_pool
*r
)
89 memset(r
->pool
, 0, sizeof(r
->pool
));
90 memset(r
->buf
, 0, sizeof(r
->buf
));
93 r
->ibits
= r
->obits
= 0;
96 rmd160_hmacinit(&r
->k
, 0, 0);
100 /* --- @rand_noisesrc@ --- *
102 * Arguments: @rand_pool *r@ = pointer to a randomness pool
103 * @const rand_source *s@ = pointer to source definition
107 * Use: Sets a noise source for a randomness pool. When the pool's
108 * estimate of good random bits falls to zero, the @getnoise@
109 * function is called, passing the pool handle as an argument.
110 * It is expected to increase the number of good bits by at
111 * least one, because it'll be called over and over again until
112 * there are enough bits to satisfy the caller. The @timer@
113 * function is called frequently throughout the generator's
117 void rand_noisesrc(rand_pool
*r
, const rand_source
*s
)
123 /* --- @rand_seed@ --- *
125 * Arguments: @rand_pool *r@ = pointer to a randomness pool
126 * @unsigned bits@ = number of bits to ensure
130 * Use: Ensures that there are at least @bits@ good bits of entropy
131 * in the pool. It is recommended that you call this after
132 * initializing a new pool. Requesting @bits > RAND_IBITS@ is
133 * doomed to failure (and is an error).
136 void rand_seed(rand_pool
*r
, unsigned bits
)
140 assert(((void)"bits pointlessly large in rand_seed", bits
<= RAND_IBITS
));
141 assert(((void)"no noise source in rand_seed", r
->s
));
143 while (r
->ibits
< bits
)
148 /* --- @rand_key@ --- *
150 * Arguments: @rand_pool *r@ = pointer to a randomness pool
151 * @const void *k@ = pointer to key data
152 * @size_t sz@ = size of key data
156 * Use: Sets the secret key for a randomness pool. The key is used
157 * when mixing in new random bits.
160 void rand_key(rand_pool
*r
, const void *k
, size_t sz
)
163 rmd160_hmacinit(&r
->k
, k
, sz
);
166 /* --- @rand_add@ --- *
168 * Arguments: @rand_pool *r@ = pointer to a randomness pool
169 * @const void *p@ = pointer a buffer of data to add
170 * @size_t sz@ = size of the data buffer
171 * @unsigned goodbits@ = number of good bits estimated in buffer
175 * Use: Mixes the data in the buffer with the contents of the
176 * pool. The estimate of the number of good bits is added to
177 * the pool's own count. The mixing operation is not
178 * cryptographically strong. However, data in the input pool
179 * isn't output directly, only through the one-way gating
180 * operation, so that shouldn't matter.
183 void rand_add(rand_pool
*r
, const void *p
, size_t sz
, unsigned goodbits
)
188 #if RAND_POOLSZ != 128
189 # error Polynomial in rand_add is out of date. Fix it.
194 i
= r
->i
; rot
= r
->irot
;
198 r
->pool
[i
] ^= (ROL8(o
, rot
) ^
199 r
->pool
[(i
+ 1) % RAND_POOLSZ
] ^
200 r
->pool
[(i
+ 2) % RAND_POOLSZ
] ^
201 r
->pool
[(i
+ 7) % RAND_POOLSZ
]);
203 i
++; if (i
>= RAND_POOLSZ
) i
-= RAND_POOLSZ
;
209 r
->ibits
+= goodbits
;
210 if (r
->ibits
> RAND_IBITS
)
211 r
->ibits
= RAND_IBITS
;
214 /* --- @rand_goodbits@ --- *
216 * Arguments: @rand_pool *r@ = pointer to a randomness pool
218 * Returns: Estimate of the number of good bits remaining in the pool.
221 unsigned rand_goodbits(rand_pool
*r
)
224 return (r
->ibits
+ r
->obits
);
227 /* --- @rand_gate@ --- *
229 * Arguments: @rand_pool *r@ = pointer to a randomness pool
233 * Use: Mixes up the entire state of the generator in a nonreversible
237 void rand_gate(rand_pool
*r
)
239 octet mac
[RMD160_HASHSZ
];
244 /* --- Hash up all the data in the pool --- */
249 rmd160_macinit(&mc
, &r
->k
);
250 rmd160_machash(&mc
, r
->pool
, sizeof(r
->pool
));
251 rmd160_machash(&mc
, r
->buf
, sizeof(r
->buf
));
252 rmd160_macdone(&mc
, mac
);
256 /* --- Now mangle all of the data based on the hash --- */
261 blowfish_cbcinit(&bc
, mac
, sizeof(mac
), 0);
262 blowfish_cbcencrypt(&bc
, r
->pool
, r
->pool
, sizeof(r
->pool
));
263 blowfish_cbcencrypt(&bc
, r
->buf
, r
->buf
, sizeof(r
->buf
));
267 /* --- Reset the various state variables --- */
270 r
->obits
+= r
->ibits
;
271 if (r
->obits
> RAND_OBITS
) {
272 r
->ibits
= r
->obits
- r
->ibits
;
273 r
->obits
= RAND_OBITS
;
279 /* --- @rand_stretch@ --- *
281 * Arguments: @rand_pool *r@ = pointer to a randomness pool
285 * Use: Stretches the contents of the output buffer by transforming
286 * it in a nonreversible way. This doesn't add any entropy
287 * worth speaking about, but it works well enough when the
288 * caller doesn't care about that sort of thing.
291 void rand_stretch(rand_pool
*r
)
293 octet mac
[RMD160_HASHSZ
];
298 /* --- Hash up all the data in the buffer --- */
303 rmd160_macinit(&mc
, &r
->k
);
304 rmd160_machash(&mc
, r
->pool
, sizeof(r
->pool
));
305 rmd160_machash(&mc
, r
->buf
, sizeof(r
->buf
));
306 rmd160_macdone(&mc
, mac
);
310 /* --- Now mangle the buffer based on that hash --- */
315 blowfish_cbcinit(&bc
, mac
, sizeof(mac
), 0);
316 blowfish_cbcencrypt(&bc
, r
->buf
, r
->buf
, sizeof(r
->buf
));
320 /* --- Reset the various state variables --- */
326 /* --- @rand_get@ --- *
328 * Arguments: @rand_pool *r@ = pointer to a randomness pool
329 * @void *p@ = pointer to output buffer
330 * @size_t sz@ = size of output buffer
334 * Use: Gets random data from the pool. The pool's contents can't be
335 * determined from the output of this function; nor can the
336 * output data be determined from a knowledge of the data input
337 * to the pool wihtout also having knowledge of the secret key.
338 * The good bits counter is decremented, although no special
339 * action is taken if it reaches zero.
342 void rand_get(rand_pool
*r
, void *p
, size_t sz
)
352 if (r
->o
+ sz
<= RAND_BUFSZ
) {
353 memcpy(o
, r
->buf
+ r
->o
, sz
);
357 size_t chunk
= RAND_BUFSZ
- r
->o
;
359 memcpy(o
, r
->buf
+ r
->o
, chunk
);
367 if (r
->obits
> sz
* 8)
373 /* --- @rand_getgood@ --- *
375 * Arguments: @rand_pool *r@ = pointer to a randomness pool
376 * @void *p@ = pointer to output buffer
377 * @size_t sz@ = size of output buffer
381 * Use: Gets random data from the pool, ensuring that there are
382 * enough good bits. This interface isn't recommended: it makes
383 * the generator slow, and doesn't provide much more security
384 * than @rand_get@, assuming you've previously done a
388 void rand_getgood(rand_pool
*r
, void *p
, size_t sz
)
396 if (!r
->s
|| !r
->s
->getnoise
) {
405 if (chunk
* 8 > r
->obits
) {
406 if (chunk
* 8 > r
->ibits
+ r
->obits
)
407 do r
->s
->getnoise(r
); while (r
->ibits
+ r
->obits
< 256);
409 if (chunk
* 8 > r
->obits
)
410 chunk
= r
->obits
/ 8;
413 if (chunk
+ r
->o
> RAND_BUFSZ
)
414 chunk
= RAND_BUFSZ
- r
->o
;
416 memcpy(o
, r
->buf
+ r
->o
, chunk
);
418 r
->obits
-= chunk
* 8;
424 /*----- Generic random number generator interface -------------------------*/
426 #define GRESOLVE(g, r) do { \
427 if (r != &rand_global) \
431 pool = (gctx *)rand_create(); \
436 static void gdestroy(grand
*r
)
446 static int gmisc(grand
*r
, unsigned op
, ...)
456 switch (va_arg(ap
, unsigned)) {
459 case GRAND_SEEDUINT32
:
460 case GRAND_SEEDBLOCK
:
477 case GRAND_SEEDINT
: {
478 unsigned u
= va_arg(ap
, unsigned);
479 rand_add(&g
->p
, &u
, sizeof(u
), sizeof(u
));
481 case GRAND_SEEDUINT32
: {
482 uint32 i
= va_arg(ap
, uint32
);
483 rand_add(&g
->p
, &i
, sizeof(i
), 4);
485 case GRAND_SEEDBLOCK
: {
486 const void *p
= va_arg(ap
, const void *);
487 size_t sz
= va_arg(ap
, size_t);
488 rand_add(&g
->p
, p
, sz
, sz
);
490 case GRAND_SEEDRAND
: {
491 grand
*rr
= va_arg(ap
, grand
*);
493 rr
->ops
->fill(rr
, buf
, sizeof(buf
));
494 rand_add(&g
->p
, buf
, sizeof(buf
), 8);
503 const void *k
= va_arg(ap
, const void *);
504 size_t sz
= va_arg(ap
, size_t);
505 rand_key(&g
->p
, k
, sz
);
508 rand_noisesrc(&g
->p
, va_arg(ap
, const rand_source
*));
511 rand_seed(&g
->p
, va_arg(ap
, unsigned));
517 rc
= rand_goodbits(&g
->p
);
520 const void *p
= va_arg(ap
, const void *);
521 size_t sz
= va_arg(ap
, size_t);
522 unsigned goodbits
= va_arg(ap
, unsigned);
523 rand_add(&g
->p
, p
, sz
, goodbits
);
534 static octet
gbyte(grand
*r
)
539 rand_getgood(&g
->p
, &o
, 1);
543 static uint32
gword(grand
*r
)
548 rand_getgood(&g
->p
, &b
, sizeof(b
));
552 static void gfill(grand
*r
, void *p
, size_t sz
)
556 rand_get(&g
->p
, p
, sz
);
559 static const grand_ops gops
= {
563 gword
, gbyte
, gword
, grand_range
, gfill
566 grand rand_global
= { &gops
};
568 /* --- @rand_create@ --- *
572 * Returns: Pointer to a generic generator.
574 * Use: Constructs a generic generator interface over a Catacomb
575 * entropy pool generator.
578 grand
*rand_create(void)
580 gctx
*g
= S_CREATE(gctx
);
586 /*----- That's all, folks -------------------------------------------------*/