2 * cryptographic random number generator for PuTTY's ssh client
9 /* Collect environmental noise every 5 minutes */
10 #define NOISE_REGULAR_INTERVAL (5*60*TICKSPERSEC)
12 void noise_get_heavy(void (*func
) (void *, int));
13 void noise_get_light(void (*func
) (void *, int));
16 * `pool' itself is a pool of random data which we actually use: we
17 * return bytes from `pool', at position `poolpos', until `poolpos'
18 * reaches the end of the pool. At this point we generate more
19 * random data, by adding noise, stirring well, and resetting
20 * `poolpos' to point to just past the beginning of the pool (not
21 * _the_ beginning, since otherwise we'd give away the whole
22 * contents of our pool, and attackers would just have to guess the
25 * `incomingb' buffers acquired noise data, until it gets full, at
26 * which point the acquired noise is SHA'ed into `incoming' and
27 * `incomingb' is cleared. The noise in `incoming' is used as part
28 * of the noise for each stirring of the pool, in addition to local
29 * time, process listings, and other such stuff.
32 #define HASHINPUT 64 /* 64 bytes SHA input */
33 #define HASHSIZE 20 /* 160 bits SHA output */
34 #define POOLSIZE 1200 /* size of random pool */
37 unsigned char pool
[POOLSIZE
];
40 unsigned char incoming
[HASHSIZE
];
42 unsigned char incomingb
[HASHINPUT
];
48 static struct RandPool pool
;
49 int random_active
= 0;
50 long next_noise_collection
;
52 static void random_stir(void)
54 word32 block
[HASHINPUT
/ sizeof(word32
)];
55 word32 digest
[HASHSIZE
/ sizeof(word32
)];
59 * noise_get_light will call random_add_noise, which may call
60 * back to here. Prevent recursive stirs.
62 if (pool
.stir_pending
)
64 pool
.stir_pending
= TRUE
;
66 noise_get_light(random_add_noise
);
68 SHATransform((word32
*) pool
.incoming
, (word32
*) pool
.incomingb
);
72 * Chunks of this code are blatantly endianness-dependent, but
73 * as it's all random bits anyway, WHO CARES?
75 memcpy(digest
, pool
.incoming
, sizeof(digest
));
78 * Make two passes over the pool.
80 for (i
= 0; i
< 2; i
++) {
83 * We operate SHA in CFB mode, repeatedly adding the same
84 * block of data to the digest. But we're also fiddling
85 * with the digest-so-far, so this shouldn't be Bad or
88 memcpy(block
, pool
.pool
, sizeof(block
));
91 * Each pass processes the pool backwards in blocks of
92 * HASHSIZE, just so that in general we get the output of
93 * SHA before the corresponding input, in the hope that
94 * things will be that much less predictable that way
95 * round, when we subsequently return bytes ...
97 for (j
= POOLSIZE
; (j
-= HASHSIZE
) >= 0;) {
99 * XOR the bit of the pool we're processing into the
103 for (k
= 0; k
< sizeof(digest
) / sizeof(*digest
); k
++)
104 digest
[k
] ^= ((word32
*) (pool
.pool
+ j
))[k
];
107 * Munge our unrevealed first block of the pool into
110 SHATransform(digest
, block
);
113 * Stick the result back into the pool.
116 for (k
= 0; k
< sizeof(digest
) / sizeof(*digest
); k
++)
117 ((word32
*) (pool
.pool
+ j
))[k
] = digest
[k
];
122 * Might as well save this value back into `incoming', just so
123 * there'll be some extra bizarreness there.
125 SHATransform(digest
, block
);
126 memcpy(pool
.incoming
, digest
, sizeof(digest
));
128 pool
.poolpos
= sizeof(pool
.incoming
);
130 pool
.stir_pending
= FALSE
;
133 void random_add_noise(void *noise
, int length
)
135 unsigned char *p
= noise
;
142 * This function processes HASHINPUT bytes into only HASHSIZE
143 * bytes, so _if_ we were getting incredibly high entropy
144 * sources then we would be throwing away valuable stuff.
146 while (length
>= (HASHINPUT
- pool
.incomingpos
)) {
147 memcpy(pool
.incomingb
+ pool
.incomingpos
, p
,
148 HASHINPUT
- pool
.incomingpos
);
149 p
+= HASHINPUT
- pool
.incomingpos
;
150 length
-= HASHINPUT
- pool
.incomingpos
;
151 SHATransform((word32
*) pool
.incoming
, (word32
*) pool
.incomingb
);
152 for (i
= 0; i
< HASHSIZE
; i
++) {
153 pool
.pool
[pool
.poolpos
++] ^= pool
.incomingb
[i
];
154 if (pool
.poolpos
>= POOLSIZE
)
157 if (pool
.poolpos
< HASHSIZE
)
160 pool
.incomingpos
= 0;
163 memcpy(pool
.incomingb
+ pool
.incomingpos
, p
, length
);
164 pool
.incomingpos
+= length
;
167 void random_add_heavynoise(void *noise
, int length
)
169 unsigned char *p
= noise
;
172 while (length
>= POOLSIZE
) {
173 for (i
= 0; i
< POOLSIZE
; i
++)
174 pool
.pool
[i
] ^= *p
++;
179 for (i
= 0; i
< length
; i
++)
180 pool
.pool
[i
] ^= *p
++;
184 static void random_add_heavynoise_bitbybit(void *noise
, int length
)
186 unsigned char *p
= noise
;
189 while (length
>= POOLSIZE
- pool
.poolpos
) {
190 for (i
= 0; i
< POOLSIZE
- pool
.poolpos
; i
++)
191 pool
.pool
[pool
.poolpos
+ i
] ^= *p
++;
193 length
-= POOLSIZE
- pool
.poolpos
;
197 for (i
= 0; i
< length
; i
++)
198 pool
.pool
[i
] ^= *p
++;
202 static void random_timer(void *ctx
, unsigned long now
)
204 if (random_active
> 0 && now
== next_noise_collection
) {
206 next_noise_collection
=
207 schedule_timer(NOISE_REGULAR_INTERVAL
, random_timer
, &pool
);
211 void random_ref(void)
213 if (!random_active
) {
214 memset(&pool
, 0, sizeof(pool
)); /* just to start with */
216 noise_get_heavy(random_add_heavynoise_bitbybit
);
219 next_noise_collection
=
220 schedule_timer(NOISE_REGULAR_INTERVAL
, random_timer
, &pool
);
226 void random_unref(void)
229 assert(random_active
>= 0);
230 if (random_active
) return;
232 expire_timer_context(&pool
);
235 int random_byte(void)
237 assert(random_active
);
239 if (pool
.poolpos
>= POOLSIZE
)
242 return pool
.pool
[pool
.poolpos
++];
245 void random_get_savedata(void **data
, int *len
)
247 void *buf
= snewn(POOLSIZE
/ 2, char);
249 memcpy(buf
, pool
.pool
+ pool
.poolpos
, POOLSIZE
/ 2);