--- /dev/null
+/* -*-c-*-
+ *
+ * Secure random number generator
+ *
+ * (c) 1998 Straylight/Edgeware
+ */
+
+/*----- Licensing notice --------------------------------------------------*
+ *
+ * This file is part of Catacomb.
+ *
+ * Catacomb is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Library General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * Catacomb is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public
+ * License along with Catacomb; if not, write to the Free
+ * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
+ * MA 02111-1307, USA.
+ */
+
+/*----- Header files ------------------------------------------------------*/
+
+#include <stdarg.h>
+#include <stdio.h>
+#include <string.h>
+
+#include <mLib/bits.h>
+#include <mLib/sub.h>
+
+#include "arena.h"
+#include "blowfish-cbc.h"
+#include "paranoia.h"
+#include "rand.h"
+#include "rmd160.h"
+#include "rmd160-hmac.h"
+
+/*----- Static variables --------------------------------------------------*/
+
+static const grand_ops gops;
+
+typedef struct gctx {
+ grand r;
+ rand_pool p;
+} gctx;
+
+static gctx *pool = 0; /* Default random pool */
+
+/*----- Macros ------------------------------------------------------------*/
+
+#define RAND_RESOLVE(r) do { \
+ if ((r) == RAND_GLOBAL) { \
+ if (!pool) \
+ pool = (gctx *)rand_create(); \
+ (r) = &pool->p; \
+ } \
+} while (0)
+
+#define TIMER(r) do { \
+ if ((r)->s && (r)->s->timer) \
+ (r)->s->timer(r); \
+} while (0)
+
+/*----- Main code ---------------------------------------------------------*/
+
+/* --- @rand_init@ --- *
+ *
+ * Arguments: @rand_pool *r@ = pointer to a randomness pool
+ *
+ * Returns: ---
+ *
+ * Use: Initializes a randomness pool. The pool doesn't start out
+ * very random: that's your job to sort out. A good suggestion
+ * would be to attach an appropriate noise source and call
+ * @rand_seed@.
+ */
+
+void rand_init(rand_pool *r)
+{
+ RAND_RESOLVE(r);
+ memset(r->pool, 0, sizeof(r->pool));
+ memset(r->buf, 0, sizeof(r->buf));
+ r->i = 0;
+ r->irot = 0;
+ r->ibits = r->obits = 0;
+ r->o = RAND_SECSZ;
+ r->s = 0;
+ rmd160_hmacinit(&r->k, 0, 0);
+ rand_gate(r);
+}
+
+/* --- @rand_noisesrc@ --- *
+ *
+ * Arguments: @rand_pool *r@ = pointer to a randomness pool
+ * @const rand_source *s@ = pointer to source definition
+ *
+ * Returns: ---
+ *
+ * Use: Sets a noise source for a randomness pool. When the pool's
+ * estimate of good random bits falls to zero, the @getnoise@
+ * function is called, passing the pool handle as an argument.
+ * It is expected to increase the number of good bits by at
+ * least one, because it'll be called over and over again until
+ * there are enough bits to satisfy the caller. The @timer@
+ * function is called frequently throughout the generator's
+ * operation.
+ */
+
+void rand_noisesrc(rand_pool *r, const rand_source *s)
+{
+ RAND_RESOLVE(r);
+ r->s = s;
+}
+
+/* --- @rand_seed@ --- *
+ *
+ * Arguments: @rand_pool *r@ = pointer to a randomness pool
+ * @unsigned bits@ = number of bits to ensure
+ *
+ * Returns: ---
+ *
+ * Use: Ensures that there are at least @bits@ good bits of entropy
+ * in the pool. It is recommended that you call this after
+ * initializing a new pool. Requesting @bits > RAND_IBITS@ is
+ * doomed to failure (and is an error).
+ */
+
+void rand_seed(rand_pool *r, unsigned bits)
+{
+ RAND_RESOLVE(r);
+
+ assert(((void)"bits pointlessly large in rand_seed", bits <= RAND_IBITS));
+ assert(((void)"no noise source in rand_seed", r->s));
+
+ while (r->ibits < bits)
+ r->s->getnoise(r);
+ rand_gate(r);
+}
+
+/* --- @rand_key@ --- *
+ *
+ * Arguments: @rand_pool *r@ = pointer to a randomness pool
+ * @const void *k@ = pointer to key data
+ * @size_t sz@ = size of key data
+ *
+ * Returns: ---
+ *
+ * Use: Sets the secret key for a randomness pool. The key is used
+ * when mixing in new random bits.
+ */
+
+void rand_key(rand_pool *r, const void *k, size_t sz)
+{
+ RAND_RESOLVE(r);
+ rmd160_hmacinit(&r->k, k, sz);
+}
+
+/* --- @rand_add@ --- *
+ *
+ * Arguments: @rand_pool *r@ = pointer to a randomness pool
+ * @const void *p@ = pointer a buffer of data to add
+ * @size_t sz@ = size of the data buffer
+ * @unsigned goodbits@ = number of good bits estimated in buffer
+ *
+ * Returns: ---
+ *
+ * Use: Mixes the data in the buffer with the contents of the
+ * pool. The estimate of the number of good bits is added to
+ * the pool's own count. The mixing operation is not
+ * cryptographically strong. However, data in the input pool
+ * isn't output directly, only through the one-way gating
+ * operation, so that shouldn't matter.
+ */
+
+void rand_add(rand_pool *r, const void *p, size_t sz, unsigned goodbits)
+{
+ const octet *c = p;
+ int i, rot;
+
+#if RAND_POOLSZ != 128
+# error Polynomial in rand_add is out of date. Fix it.
+#endif
+
+ RAND_RESOLVE(r);
+
+ i = r->i; rot = r->irot;
+
+ while (sz) {
+ octet o = *c++;
+ r->pool[i] ^= (ROL8(o, rot) ^
+ r->pool[(i + 1) % RAND_POOLSZ] ^
+ r->pool[(i + 2) % RAND_POOLSZ] ^
+ r->pool[(i + 7) % RAND_POOLSZ]);
+ rot = (rot + 5) & 7;
+ i++; if (i >= RAND_POOLSZ) i -= RAND_POOLSZ;
+ sz--;
+ }
+
+ r->i = i;
+ r->irot = rot;
+ r->ibits += goodbits;
+ if (r->ibits > RAND_IBITS)
+ r->ibits = RAND_IBITS;
+}
+
+/* --- @rand_goodbits@ --- *
+ *
+ * Arguments: @rand_pool *r@ = pointer to a randomness pool
+ *
+ * Returns: Estimate of the number of good bits remaining in the pool.
+ */
+
+unsigned rand_goodbits(rand_pool *r)
+{
+ RAND_RESOLVE(r);
+ return (r->ibits + r->obits);
+}
+
+/* --- @rand_gate@ --- *
+ *
+ * Arguments: @rand_pool *r@ = pointer to a randomness pool
+ *
+ * Returns: ---
+ *
+ * Use: Mixes up the entire state of the generator in a nonreversible
+ * way.
+ */
+
+void rand_gate(rand_pool *r)
+{
+ octet mac[RMD160_HASHSZ];
+
+ RAND_RESOLVE(r);
+ TIMER(r);
+
+ /* --- Hash up all the data in the pool --- */
+
+ {
+ rmd160_macctx mc;
+
+ rmd160_macinit(&mc, &r->k);
+ rmd160_machash(&mc, r->pool, sizeof(r->pool));
+ rmd160_machash(&mc, r->buf, sizeof(r->buf));
+ rmd160_macdone(&mc, mac);
+ BURN(mc);
+ }
+
+ /* --- Now mangle all of the data based on the hash --- */
+
+ {
+ blowfish_cbcctx bc;
+
+ blowfish_cbcinit(&bc, mac, sizeof(mac), 0);
+ blowfish_cbcencrypt(&bc, r->pool, r->pool, sizeof(r->pool));
+ blowfish_cbcencrypt(&bc, r->buf, r->buf, sizeof(r->buf));
+ BURN(bc);
+ }
+
+ /* --- Reset the various state variables --- */
+
+ r->o = RAND_SECSZ;
+ r->obits += r->ibits;
+ if (r->obits > RAND_OBITS) {
+ r->ibits = r->obits - r->ibits;
+ r->obits = RAND_OBITS;
+ } else
+ r->ibits = 0;
+ TIMER(r);
+}
+
+/* --- @rand_stretch@ --- *
+ *
+ * Arguments: @rand_pool *r@ = pointer to a randomness pool
+ *
+ * Returns: ---
+ *
+ * Use: Stretches the contents of the output buffer by transforming
+ * it in a nonreversible way. This doesn't add any entropy
+ * worth speaking about, but it works well enough when the
+ * caller doesn't care about that sort of thing.
+ */
+
+void rand_stretch(rand_pool *r)
+{
+ octet mac[RMD160_HASHSZ];
+
+ RAND_RESOLVE(r);
+ TIMER(r);
+
+ /* --- Hash up all the data in the buffer --- */
+
+ {
+ rmd160_macctx mc;
+
+ rmd160_macinit(&mc, &r->k);
+ rmd160_machash(&mc, r->pool, sizeof(r->pool));
+ rmd160_machash(&mc, r->buf, sizeof(r->buf));
+ rmd160_macdone(&mc, mac);
+ BURN(mc);
+ }
+
+ /* --- Now mangle the buffer based on that hash --- */
+
+ {
+ blowfish_cbcctx bc;
+
+ blowfish_cbcinit(&bc, mac, sizeof(mac), 0);
+ blowfish_cbcencrypt(&bc, r->buf, r->buf, sizeof(r->buf));
+ BURN(bc);
+ }
+
+ /* --- Reset the various state variables --- */
+
+ r->o = RAND_SECSZ;
+ TIMER(r);
+}
+
+/* --- @rand_get@ --- *
+ *
+ * Arguments: @rand_pool *r@ = pointer to a randomness pool
+ * @void *p@ = pointer to output buffer
+ * @size_t sz@ = size of output buffer
+ *
+ * Returns: ---
+ *
+ * Use: Gets random data from the pool. The pool's contents can't be
+ * determined from the output of this function; nor can the
+ * output data be determined from a knowledge of the data input
+ * to the pool wihtout also having knowledge of the secret key.
+ * The good bits counter is decremented, although no special
+ * action is taken if it reaches zero.
+ */
+
+void rand_get(rand_pool *r, void *p, size_t sz)
+{
+ octet *o = p;
+
+ RAND_RESOLVE(r);
+ TIMER(r);
+
+ if (!sz)
+ return;
+ for (;;) {
+ if (r->o + sz <= RAND_BUFSZ) {
+ memcpy(o, r->buf + r->o, sz);
+ r->o += sz;
+ break;
+ } else {
+ size_t chunk = RAND_BUFSZ - r->o;
+ if (chunk) {
+ memcpy(o, r->buf + r->o, chunk);
+ sz -= chunk;
+ o += chunk;
+ }
+ rand_stretch(r);
+ }
+ }
+
+ if (r->obits > sz * 8)
+ r->obits -= sz * 8;
+ else
+ r->obits = 0;
+}
+
+/* --- @rand_getgood@ --- *
+ *
+ * Arguments: @rand_pool *r@ = pointer to a randomness pool
+ * @void *p@ = pointer to output buffer
+ * @size_t sz@ = size of output buffer
+ *
+ * Returns: ---
+ *
+ * Use: Gets random data from the pool, ensuring that there are
+ * enough good bits. This interface isn't recommended: it makes
+ * the generator slow, and doesn't provide much more security
+ * than @rand_get@, assuming you've previously done a
+ * @rand_seed@.
+ */
+
+void rand_getgood(rand_pool *r, void *p, size_t sz)
+{
+ octet *o = p;
+
+ RAND_RESOLVE(r);
+
+ if (!sz)
+ return;
+ if (!r->s || !r->s->getnoise) {
+ rand_get(r, p, sz);
+ return;
+ }
+ TIMER(r);
+
+ while (sz) {
+ size_t chunk = sz;
+
+ if (chunk * 8 > r->obits) {
+ if (chunk * 8 > r->ibits + r->obits)
+ do r->s->getnoise(r); while (r->ibits + r->obits < 256);
+ rand_gate(r);
+ if (chunk * 8 > r->obits)
+ chunk = r->obits / 8;
+ }
+
+ if (chunk + r->o > RAND_BUFSZ)
+ chunk = RAND_BUFSZ - r->o;
+
+ memcpy(o, r->buf + r->o, chunk);
+ r->o += chunk;
+ r->obits -= chunk * 8;
+ o += chunk;
+ sz -= chunk;
+ }
+}
+
+/*----- Generic random number generator interface -------------------------*/
+
+#define GRESOLVE(g, r) do { \
+ if (r != &rand_global) \
+ g = (gctx *)r; \
+ else { \
+ if (!pool) \
+ pool = (gctx *)rand_create(); \
+ g = pool; \
+ } \
+} while (0)
+
+static void gdestroy(grand *r)
+{
+ gctx *g;
+ GRESOLVE(g, r);
+ if (g != pool) {
+ BURN(*g);
+ S_DESTROY(g);
+ }
+}
+
+static int gmisc(grand *r, unsigned op, ...)
+{
+ gctx *g;
+ va_list ap;
+ int rc = 0;
+ va_start(ap, op);
+
+ GRESOLVE(g, r);
+ switch (op) {
+ case GRAND_CHECK:
+ switch (va_arg(ap, unsigned)) {
+ case GRAND_CHECK:
+ case GRAND_SEEDINT:
+ case GRAND_SEEDUINT32:
+ case GRAND_SEEDBLOCK:
+ case GRAND_SEEDRAND:
+ case RAND_GATE:
+ case RAND_STRETCH:
+ case RAND_KEY:
+ case RAND_NOISESRC:
+ case RAND_SEED:
+ case RAND_TIMER:
+ case RAND_GOODBITS:
+ case RAND_ADD:
+ rc = 1;
+ break;
+ default:
+ rc = 0;
+ break;
+ }
+ break;
+ case GRAND_SEEDINT: {
+ unsigned u = va_arg(ap, unsigned);
+ rand_add(&g->p, &u, sizeof(u), sizeof(u));
+ } break;
+ case GRAND_SEEDUINT32: {
+ uint32 i = va_arg(ap, uint32);
+ rand_add(&g->p, &i, sizeof(i), 4);
+ } break;
+ case GRAND_SEEDBLOCK: {
+ const void *p = va_arg(ap, const void *);
+ size_t sz = va_arg(ap, size_t);
+ rand_add(&g->p, p, sz, sz);
+ } break;
+ case GRAND_SEEDRAND: {
+ grand *rr = va_arg(ap, grand *);
+ octet buf[16];
+ rr->ops->fill(rr, buf, sizeof(buf));
+ rand_add(&g->p, buf, sizeof(buf), 8);
+ } break;
+ case RAND_GATE:
+ rand_gate(&g->p);
+ break;
+ case RAND_STRETCH:
+ rand_stretch(&g->p);
+ break;
+ case RAND_KEY: {
+ const void *k = va_arg(ap, const void *);
+ size_t sz = va_arg(ap, size_t);
+ rand_key(&g->p, k, sz);
+ } break;
+ case RAND_NOISESRC:
+ rand_noisesrc(&g->p, va_arg(ap, const rand_source *));
+ break;
+ case RAND_SEED:
+ rand_seed(&g->p, va_arg(ap, unsigned));
+ break;
+ case RAND_TIMER:
+ TIMER(&g->p);
+ break;
+ case RAND_GOODBITS:
+ rc = rand_goodbits(&g->p);
+ break;
+ case RAND_ADD: {
+ const void *p = va_arg(ap, const void *);
+ size_t sz = va_arg(ap, size_t);
+ unsigned goodbits = va_arg(ap, unsigned);
+ rand_add(&g->p, p, sz, goodbits);
+ } break;
+ default:
+ GRAND_BADOP;
+ break;
+ }
+
+ va_end(ap);
+ return (rc);
+}
+
+static octet gbyte(grand *r)
+{
+ gctx *g;
+ octet o;
+ GRESOLVE(g, r);
+ rand_getgood(&g->p, &o, 1);
+ return (o);
+}
+
+static uint32 gword(grand *r)
+{
+ gctx *g;
+ octet b[4];
+ GRESOLVE(g, r);
+ rand_getgood(&g->p, &b, sizeof(b));
+ return (LOAD32(b));
+}
+
+static void gfill(grand *r, void *p, size_t sz)
+{
+ gctx *g;
+ GRESOLVE(g, r);
+ rand_get(&g->p, p, sz);
+}
+
+static const grand_ops gops = {
+ "rand",
+ GRAND_CRYPTO, 0,
+ gmisc, gdestroy,
+ gword, gbyte, gword, grand_range, gfill
+};
+
+grand rand_global = { &gops };
+
+/* --- @rand_create@ --- *
+ *
+ * Arguments: ---
+ *
+ * Returns: Pointer to a generic generator.
+ *
+ * Use: Constructs a generic generator interface over a Catacomb
+ * entropy pool generator.
+ */
+
+grand *rand_create(void)
+{
+ gctx *g = S_CREATE(gctx);
+ g->r.ops = &gops;
+ rand_init(&g->p);
+ return (&g->r);
+}
+
+/*----- That's all, folks -------------------------------------------------*/
projects / u / mdw / catacomb / blobdiff