3 * $Id: dsarand.c,v 1.3 2001/02/03 16:08:56 mdw Exp $
5 * Random number generator for DSA
7 * (c) 1999 Straylight/Edgeware
10 /*----- Licensing notice --------------------------------------------------*
12 * This file is part of Catacomb.
14 * Catacomb is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU Library General Public License as
16 * published by the Free Software Foundation; either version 2 of the
17 * License, or (at your option) any later version.
19 * Catacomb is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU Library General Public License for more details.
24 * You should have received a copy of the GNU Library General Public
25 * License along with Catacomb; if not, write to the Free
26 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
30 /*----- Revision history --------------------------------------------------*
33 * Revision 1.3 2001/02/03 16:08:56 mdw
34 * Give generic random objects separate namespaces for their supported misc
35 * ops. Add operations for reading the current seed value.
37 * Revision 1.2 2000/06/17 10:54:00 mdw
38 * Typesetting fixes. Arena support.
40 * Revision 1.1 1999/12/22 15:53:12 mdw
41 * Random number generator for finding DSA parameters.
45 /*----- Header files ------------------------------------------------------*/
50 #include <mLib/alloc.h>
51 #include <mLib/bits.h>
58 /*----- Main code ---------------------------------------------------------*/
62 * Arguments: @dsarand *d@ = pointer to context
64 * Use: Increments the buffer by one, interpreting it as a big-endian
65 * integer. Carries outside the integer are discarded.
68 #define STEP(d) do { \
71 octet *_q = _p + _d->sz; \
73 while (_c && _q > _p) { \
80 /* --- @dsarand_init@ --- *
82 * Arguments: @dsarand *d@ = pointer to context
83 * @const void *p@ = pointer to seed buffer
84 * @size_t sz@ = size of the buffer
88 * Use: Initializes a DSA random number generator.
91 void dsarand_init(dsarand
*d
, const void *p
, size_t sz
)
100 /* --- @dsarand_reseed@ --- *
102 * Arguments: @dsarand *d@ = pointer to context
103 * @const void *p@ = pointer to seed buffer
104 * @size_t sz@ = size of the buffer
108 * Use: Initializes a DSA random number generator.
111 void dsarand_reseed(dsarand
*d
, const void *p
, size_t sz
)
121 /* --- @dsarand_destroy@ --- *
123 * Arguments: @dsarand *d@ = pointer to context
127 * Use: Disposes of a DSA random number generation context.
130 void dsarand_destroy(dsarand
*d
)
135 /* --- @dsarand_fill@ --- *
137 * Arguments: @dsarand *d@ = pointer to context
138 * @void *p@ = pointer to output buffer
139 * @size_t sz@ = size of output buffer
143 * Use: Fills an output buffer with pseudorandom data.
145 * Let %$p$% be the numerical value of the input buffer, and let
146 * %$b$% be the number of bytes required. Let
147 * %$z = \lceil b / 20 \rceil$% be the number of SHA outputs
148 * required. Then the output of pass %$n$% is
150 * %$P_n = \sum_{0 \le i < z} 2^{160i} SHA(p + nz + i)$%
151 * %${} \bmod 2^{8b}$%
153 * and the actual result in the output buffer is the XOR of all
154 * of the output passes.
156 * The DSA procedure for choosing @q@ involves two passes with
157 * %$z = 1$%; the procedure for choosing @p@ involves one pass
158 * with larger %$z$%. This generalization of the DSA generation
159 * procedure is my own invention but it seems relatively sound.
162 void dsarand_fill(dsarand
*d
, void *p
, size_t sz
)
165 unsigned n
= d
->passes
;
167 /* --- Write out the first pass --- *
169 * This can write directly to the output buffer, so it's done differently
170 * from the latter passes.
179 /* --- Hash the input buffer --- */
182 sha_hash(&h
, d
->p
, d
->sz
);
184 /* --- If enough space, extract the hash output directly --- */
186 if (o
>= SHA_HASHSZ
) {
191 /* --- Otherwise take the hash result out of line and copy it --- */
194 octet hash
[SHA_HASHSZ
];
196 memcpy(q
, hash
+ (SHA_HASHSZ
- o
), o
);
200 /* --- Step the input buffer --- */
205 /* --- Another pass has been done --- */
210 /* --- Write out subsequent passes --- *
212 * The hash output has to be done offline, so this is slightly easier.
220 octet hash
[SHA_HASHSZ
];
224 /* --- Hash the input buffer --- */
227 sha_hash(&h
, d
->p
, d
->sz
);
230 /* --- Work out how much output is wanted --- */
237 /* --- XOR the data out --- */
239 for (pp
= hash
+ (SHA_HASHSZ
- n
), qq
= q
+ o
;
240 pp
< hash
+ SHA_HASHSZ
; pp
++, qq
++)
243 /* --- Step the input buffer --- */
248 /* --- Another pass is done --- */
254 /*----- Generic pseudorandom-number generator interface -------------------*/
256 static const grand_ops gops
;
258 typedef struct gctx
{
263 static void gdestroy(grand
*r
)
266 dsarand_destroy(&g
->d
);
270 static int gmisc(grand
*r
, unsigned op
, ...)
279 switch (va_arg(ap
, unsigned)) {
281 case GRAND_SEEDBLOCK
:
285 case DSARAND_GETSEED
:
293 case GRAND_SEEDBLOCK
: {
294 const void *p
= va_arg(ap
, const void *);
295 size_t sz
= va_arg(ap
, size_t);
296 dsarand_reseed(&g
->d
, p
, sz
);
298 case GRAND_SEEDRAND
: {
299 grand
*rr
= va_arg(ap
, grand
*);
300 rr
->ops
->fill(rr
, g
->d
.p
, g
->d
.sz
);
303 g
->d
.passes
= va_arg(ap
, unsigned);
308 case DSARAND_GETSEED
:
309 memcpy(va_arg(ap
, void *), g
->d
.p
, g
->d
.sz
);
320 static void gfill(grand
*r
, void *p
, size_t sz
)
323 dsarand_fill(&g
->d
, p
, sz
);
326 static const grand_ops gops
= {
330 grand_word
, grand_byte
, grand_word
, grand_range
, gfill
333 /* --- @dsarand_create@ --- *
335 * Arguments: @const void *p@ = pointer to seed buffer
336 * @size_t sz@ = size of seed buffer
338 * Returns: Pointer to a generic generator.
340 * Use: Constructs a generic generator interface over a Catacomb
341 * entropy pool generator.
344 grand
*dsarand_create(const void *p
, size_t sz
)
346 gctx
*g
= CREATE(gctx
);
348 dsarand_init(&g
->d
, p
, sz
);
352 /*----- That's all, folks -------------------------------------------------*/