mirror of
https://gitlab.freedesktop.org/libbsd/libbsd.git
synced 2025-10-22 08:02:10 +02:00
Update arc4random module from OpenBSD and LibreSSL
Rework arc4random_stir() and arc4random_addrandom() code over the new internal API, and documentation in the man page. Adapt the code to the local build system. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=85827
This commit is contained in:
@@ -129,7 +129,7 @@ AC_LINK_IFELSE(
|
|||||||
[AC_MSG_RESULT([no])])
|
[AC_MSG_RESULT([no])])
|
||||||
|
|
||||||
AC_CHECK_FUNCS([clearenv dirfd fopencookie __fpurge \
|
AC_CHECK_FUNCS([clearenv dirfd fopencookie __fpurge \
|
||||||
getentropy getexecname getline \
|
getauxval getentropy getexecname getline \
|
||||||
pstat_getproc sysconf])
|
pstat_getproc sysconf])
|
||||||
AM_CONDITIONAL(HAVE_GETENTROPY, [test "x$ac_cv_func_getentropy" = "xtrue"])
|
AM_CONDITIONAL(HAVE_GETENTROPY, [test "x$ac_cv_func_getentropy" = "xtrue"])
|
||||||
|
|
||||||
|
102
man/arc4random.3
102
man/arc4random.3
@@ -1,4 +1,5 @@
|
|||||||
.\" $OpenBSD: arc4random.3,v 1.2 1997/04/27 22:40:25 angelos Exp $
|
.\" $OpenBSD: arc4random.3,v 1.34 2014/07/19 16:11:16 naddy Exp $
|
||||||
|
.\"
|
||||||
.\" Copyright 1997 Niels Provos <provos@physnet.uni-hamburg.de>
|
.\" Copyright 1997 Niels Provos <provos@physnet.uni-hamburg.de>
|
||||||
.\" All rights reserved.
|
.\" All rights reserved.
|
||||||
.\"
|
.\"
|
||||||
@@ -28,9 +29,8 @@
|
|||||||
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||||
.\"
|
.\"
|
||||||
.\" Manual page, using -mandoc macros
|
.\" Manual page, using -mandoc macros
|
||||||
.\" $FreeBSD$
|
|
||||||
.\"
|
.\"
|
||||||
.Dd April 15, 1997
|
.Dd $Mdocdate: July 19 2014 $
|
||||||
.Dt ARC4RANDOM 3
|
.Dt ARC4RANDOM 3
|
||||||
.Os
|
.Os
|
||||||
.Sh NAME
|
.Sh NAME
|
||||||
@@ -56,45 +56,59 @@
|
|||||||
.Ft void
|
.Ft void
|
||||||
.Fn arc4random_addrandom "unsigned char *dat" "int datlen"
|
.Fn arc4random_addrandom "unsigned char *dat" "int datlen"
|
||||||
.Sh DESCRIPTION
|
.Sh DESCRIPTION
|
||||||
The
|
This family of functions provides higher quality data than those
|
||||||
.Fn arc4random
|
described in
|
||||||
function uses the key stream generator employed by the
|
.Xr rand 3 ,
|
||||||
arc4 cipher, which uses 8*8 8 bit S-Boxes.
|
.Xr random 3 ,
|
||||||
The S-Boxes
|
|
||||||
can be in about
|
|
||||||
.if t 2\u\s71700\s10\d
|
|
||||||
.if n (2**1700)
|
|
||||||
states.
|
|
||||||
The
|
|
||||||
.Fn arc4random
|
|
||||||
function returns pseudo-random numbers in the range of 0 to
|
|
||||||
.if t 2\u\s731\s10\d\(mi1,
|
|
||||||
.if n (2**32)\(mi1,
|
|
||||||
and therefore has twice the range of
|
|
||||||
.Xr rand 3
|
|
||||||
and
|
and
|
||||||
.Xr random 3 .
|
.Xr rand48 3 .
|
||||||
.Pp
|
.Pp
|
||||||
|
Use of these functions is encouraged for almost all random number
|
||||||
|
consumption because the other interfaces are deficient in either
|
||||||
|
quality, portability, standardization, or availability.
|
||||||
|
These functions can be called in almost all coding environments,
|
||||||
|
including
|
||||||
|
.Xr pthreads 3
|
||||||
|
and
|
||||||
|
.Xr chroot 2 .
|
||||||
|
.Pp
|
||||||
|
High quality 32-bit pseudo-random numbers are generated very quickly.
|
||||||
|
On each call, a cryptographic pseudo-random number generator is used
|
||||||
|
to generate a new result.
|
||||||
|
One data pool is used for all consumers in a process, so that consumption
|
||||||
|
under program flow can act as additional stirring.
|
||||||
|
The subsystem is re-seeded from the kernel random number subsystem using
|
||||||
|
.Xr getentropy 2
|
||||||
|
on a regular basis, and also upon
|
||||||
|
.Xr fork 2 .
|
||||||
|
.Pp
|
||||||
|
The
|
||||||
|
.Fn arc4random
|
||||||
|
function returns a single 32-bit value.
|
||||||
|
.Pp
|
||||||
|
The
|
||||||
.Fn arc4random_buf
|
.Fn arc4random_buf
|
||||||
function fills the region
|
function fills the region
|
||||||
.Fa buf
|
.Fa buf
|
||||||
of length
|
of length
|
||||||
.Fa nbytes
|
.Fa nbytes
|
||||||
with ARC4-derived random data.
|
with random data.
|
||||||
.Pp
|
.Pp
|
||||||
.Fn arc4random_uniform
|
.Fn arc4random_uniform
|
||||||
will return a uniformly distributed random number less than
|
will return a single 32-bit value, uniformly distributed but less than
|
||||||
.Fa upper_bound .
|
.Fa upper_bound .
|
||||||
.Fn arc4random_uniform
|
This is recommended over constructions like
|
||||||
is recommended over constructions like
|
|
||||||
.Dq Li arc4random() % upper_bound
|
.Dq Li arc4random() % upper_bound
|
||||||
as it avoids "modulo bias" when the upper bound is not a power of two.
|
as it avoids "modulo bias" when the upper bound is not a power of two.
|
||||||
|
In the worst case, this function may consume multiple iterations
|
||||||
|
to ensure uniformity; see the source code to understand the problem
|
||||||
|
and solution.
|
||||||
.Pp
|
.Pp
|
||||||
The
|
The
|
||||||
.Fn arc4random_stir
|
.Fn arc4random_stir
|
||||||
function reads data from
|
function reads data from
|
||||||
.Pa /dev/urandom
|
.Xr getentropy 2
|
||||||
and uses it to permute the S-Boxes via
|
and uses it to re-seed the subsystem via
|
||||||
.Fn arc4random_addrandom .
|
.Fn arc4random_addrandom .
|
||||||
.Pp
|
.Pp
|
||||||
There is no need to call
|
There is no need to call
|
||||||
@@ -103,26 +117,22 @@ before using
|
|||||||
.Fn arc4random
|
.Fn arc4random
|
||||||
functions family, since
|
functions family, since
|
||||||
they automatically initialize themselves.
|
they automatically initialize themselves.
|
||||||
.Sh EXAMPLES
|
.Sh RETURN VALUES
|
||||||
The following produces a drop-in replacement for the traditional
|
These functions are always successful, and no return value is
|
||||||
.Fn rand
|
reserved to indicate an error.
|
||||||
and
|
|
||||||
.Fn random
|
|
||||||
functions using
|
|
||||||
.Fn arc4random :
|
|
||||||
.Pp
|
|
||||||
.Dl "#define foo4random() (arc4random() % ((unsigned)RAND_MAX + 1))"
|
|
||||||
.Sh SEE ALSO
|
.Sh SEE ALSO
|
||||||
.Xr rand 3 ,
|
.Xr rand 3 ,
|
||||||
.Xr random 3 ,
|
.Xr rand48 3 ,
|
||||||
.Xr srandomdev 3
|
.Xr random 3
|
||||||
.Sh HISTORY
|
.Sh HISTORY
|
||||||
.Pa RC4
|
These functions first appeared in
|
||||||
has been designed by RSA Data Security, Inc.
|
.Ox 2.1 .
|
||||||
It was posted anonymously
|
.Pp
|
||||||
to the USENET and was confirmed to be equivalent by several sources who
|
The original version of this random number generator used the
|
||||||
had access to the original cipher.
|
RC4 (also known as ARC4) algorithm.
|
||||||
Since
|
In
|
||||||
.Pa RC4
|
.Ox 5.5
|
||||||
used to be a trade secret, the cipher is now referred to as
|
it was replaced with the ChaCha20 cipher, and it may be replaced
|
||||||
.Pa ARC4 .
|
again in the future as cryptographic techniques advance.
|
||||||
|
A good mnemonic is
|
||||||
|
.Dq A Replacement Call for Random .
|
||||||
|
@@ -56,7 +56,14 @@ libbsd_la_LDFLAGS = \
|
|||||||
-version-number $(LIBBSD_ABI)
|
-version-number $(LIBBSD_ABI)
|
||||||
libbsd_la_SOURCES = \
|
libbsd_la_SOURCES = \
|
||||||
arc4random.c \
|
arc4random.c \
|
||||||
|
arc4random.h \
|
||||||
|
arc4random_bsd.h \
|
||||||
|
arc4random_linux.h \
|
||||||
|
arc4random_unix.h \
|
||||||
|
arc4random_openbsd.h \
|
||||||
|
arc4random_uniform.c \
|
||||||
bsd_getopt.c \
|
bsd_getopt.c \
|
||||||
|
chacha_private.h \
|
||||||
closefrom.c \
|
closefrom.c \
|
||||||
dehumanize_number.c \
|
dehumanize_number.c \
|
||||||
err.c \
|
err.c \
|
||||||
|
372
src/arc4random.c
372
src/arc4random.c
@@ -1,6 +1,11 @@
|
|||||||
|
/* $OpenBSD: arc4random.c,v 1.53 2015/09/10 18:53:50 bcook Exp $ */
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Copyright (c) 1996, David Mazieres <dm@uun.org>
|
* Copyright (c) 1996, David Mazieres <dm@uun.org>
|
||||||
* Copyright (c) 2008, Damien Miller <djm@openbsd.org>
|
* Copyright (c) 2008, Damien Miller <djm@openbsd.org>
|
||||||
|
* Copyright (c) 2013, Markus Friedl <markus@openbsd.org>
|
||||||
|
* Copyright (c) 2014, Theo de Raadt <deraadt@openbsd.org>
|
||||||
|
* Copyright (c) 2015, Guillem Jover <guillem@hadrons.org>
|
||||||
*
|
*
|
||||||
* Permission to use, copy, modify, and distribute this software for any
|
* Permission to use, copy, modify, and distribute this software for any
|
||||||
* purpose with or without fee is hereby granted, provided that the above
|
* purpose with or without fee is hereby granted, provided that the above
|
||||||
@@ -16,281 +21,192 @@
|
|||||||
*/
|
*/
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Arc4 random number generator for OpenBSD.
|
* ChaCha based random number generator for OpenBSD.
|
||||||
*
|
|
||||||
* This code is derived from section 17.1 of Applied Cryptography,
|
|
||||||
* second edition, which describes a stream cipher allegedly
|
|
||||||
* compatible with RSA Labs "RC4" cipher (the actual description of
|
|
||||||
* which is a trade secret). The same algorithm is used as a stream
|
|
||||||
* cipher called "arcfour" in Tatu Ylonen's ssh package.
|
|
||||||
*
|
|
||||||
* Here the stream cipher has been modified always to include the time
|
|
||||||
* when initializing the state. That makes it impossible to
|
|
||||||
* regenerate the same random sequence twice, so this can't be used
|
|
||||||
* for encryption, but will generate good random numbers.
|
|
||||||
*
|
|
||||||
* RC4 is a registered trademark of RSA Laboratories.
|
|
||||||
*/
|
*/
|
||||||
|
|
||||||
#include <sys/cdefs.h>
|
#include <fcntl.h>
|
||||||
__FBSDID("$FreeBSD$");
|
#include <limits.h>
|
||||||
|
#include <signal.h>
|
||||||
|
#include <stdint.h>
|
||||||
|
#include <stdlib.h>
|
||||||
|
#include <string.h>
|
||||||
|
#include <unistd.h>
|
||||||
#include <sys/types.h>
|
#include <sys/types.h>
|
||||||
#include <sys/time.h>
|
#include <sys/time.h>
|
||||||
#include <stdlib.h>
|
|
||||||
#include <fcntl.h>
|
|
||||||
#include <unistd.h>
|
|
||||||
#include <pthread.h>
|
|
||||||
|
|
||||||
struct arc4_stream {
|
#define KEYSTREAM_ONLY
|
||||||
uint8_t i;
|
#include "chacha_private.h"
|
||||||
uint8_t j;
|
|
||||||
uint8_t s[256];
|
|
||||||
};
|
|
||||||
|
|
||||||
#define RANDOMDEV "/dev/urandom"
|
#define minimum(a, b) ((a) < (b) ? (a) : (b))
|
||||||
#define KEYSIZE 128
|
|
||||||
|
|
||||||
#ifdef __REENTRANT
|
#if defined(__GNUC__) || defined(_MSC_VER)
|
||||||
static pthread_mutex_t arc4random_mtx = PTHREAD_MUTEX_INITIALIZER;
|
#define inline __inline
|
||||||
#define THREAD_LOCK() pthread_mutex_lock(&arc4random_mtx)
|
#else /* __GNUC__ || _MSC_VER */
|
||||||
#define THREAD_UNLOCK() pthread_mutex_unlock(&arc4random_mtx)
|
#define inline
|
||||||
#else
|
#endif /* !__GNUC__ && !_MSC_VER */
|
||||||
#define THREAD_LOCK()
|
|
||||||
#define THREAD_UNLOCK()
|
#define KEYSZ 32
|
||||||
|
#define IVSZ 8
|
||||||
|
#define BLOCKSZ 64
|
||||||
|
#define RSBUFSZ (16*BLOCKSZ)
|
||||||
|
|
||||||
|
/* Marked MAP_INHERIT_ZERO, so zero'd out in fork children. */
|
||||||
|
static struct _rs {
|
||||||
|
size_t rs_have; /* valid bytes at end of rs_buf */
|
||||||
|
size_t rs_count; /* bytes till reseed */
|
||||||
|
} *rs;
|
||||||
|
|
||||||
|
/* Maybe be preserved in fork children, if _rs_allocate() decides. */
|
||||||
|
static struct _rsx {
|
||||||
|
chacha_ctx rs_chacha; /* chacha context for random keystream */
|
||||||
|
u_char rs_buf[RSBUFSZ]; /* keystream blocks */
|
||||||
|
} *rsx;
|
||||||
|
|
||||||
|
static inline int _rs_allocate(struct _rs **, struct _rsx **);
|
||||||
|
static inline void _rs_forkdetect(void);
|
||||||
|
#include "arc4random.h"
|
||||||
|
|
||||||
|
static inline void
|
||||||
|
_rs_init(u_char *buf, size_t n)
|
||||||
|
{
|
||||||
|
if (n < KEYSZ + IVSZ)
|
||||||
|
return;
|
||||||
|
|
||||||
|
if (rs == NULL) {
|
||||||
|
if (_rs_allocate(&rs, &rsx) == -1)
|
||||||
|
abort();
|
||||||
|
}
|
||||||
|
|
||||||
|
chacha_keysetup(&rsx->rs_chacha, buf, KEYSZ * 8, 0);
|
||||||
|
chacha_ivsetup(&rsx->rs_chacha, buf + KEYSZ);
|
||||||
|
}
|
||||||
|
|
||||||
|
static inline void
|
||||||
|
_rs_rekey(u_char *dat, size_t datlen)
|
||||||
|
{
|
||||||
|
#ifndef KEYSTREAM_ONLY
|
||||||
|
memset(rsx->rs_buf, 0, sizeof(rsx->rs_buf));
|
||||||
#endif
|
#endif
|
||||||
|
/* fill rs_buf with the keystream */
|
||||||
|
chacha_encrypt_bytes(&rsx->rs_chacha, rsx->rs_buf,
|
||||||
|
rsx->rs_buf, sizeof(rsx->rs_buf));
|
||||||
|
/* mix in optional user provided data */
|
||||||
|
if (dat) {
|
||||||
|
size_t i, m;
|
||||||
|
|
||||||
static struct arc4_stream rs;
|
m = minimum(datlen, KEYSZ + IVSZ);
|
||||||
static int rs_initialized;
|
for (i = 0; i < m; i++)
|
||||||
static int rs_stired;
|
rsx->rs_buf[i] ^= dat[i];
|
||||||
static int arc4_count;
|
|
||||||
|
|
||||||
static inline uint8_t arc4_getbyte(void);
|
|
||||||
static void arc4_stir(void);
|
|
||||||
|
|
||||||
static inline void
|
|
||||||
arc4_init(void)
|
|
||||||
{
|
|
||||||
int n;
|
|
||||||
|
|
||||||
for (n = 0; n < 256; n++)
|
|
||||||
rs.s[n] = n;
|
|
||||||
rs.i = 0;
|
|
||||||
rs.j = 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
static inline void
|
|
||||||
arc4_addrandom(u_char *dat, int datlen)
|
|
||||||
{
|
|
||||||
int n;
|
|
||||||
uint8_t si;
|
|
||||||
|
|
||||||
rs.i--;
|
|
||||||
for (n = 0; n < 256; n++) {
|
|
||||||
rs.i = (rs.i + 1);
|
|
||||||
si = rs.s[rs.i];
|
|
||||||
rs.j = (rs.j + si + dat[n % datlen]);
|
|
||||||
rs.s[rs.i] = rs.s[rs.j];
|
|
||||||
rs.s[rs.j] = si;
|
|
||||||
}
|
}
|
||||||
rs.j = rs.i;
|
/* immediately reinit for backtracking resistance */
|
||||||
|
_rs_init(rsx->rs_buf, KEYSZ + IVSZ);
|
||||||
|
memset(rsx->rs_buf, 0, KEYSZ + IVSZ);
|
||||||
|
rs->rs_have = sizeof(rsx->rs_buf) - KEYSZ - IVSZ;
|
||||||
}
|
}
|
||||||
|
|
||||||
static void
|
static void
|
||||||
arc4_stir(void)
|
_rs_stir(void)
|
||||||
{
|
{
|
||||||
int done, fd, n;
|
u_char rnd[KEYSZ + IVSZ];
|
||||||
struct {
|
|
||||||
struct timeval tv;
|
|
||||||
pid_t pid;
|
|
||||||
uint8_t rnd[KEYSIZE];
|
|
||||||
} rdat;
|
|
||||||
|
|
||||||
fd = open(RANDOMDEV, O_RDONLY, 0);
|
if (getentropy(rnd, sizeof rnd) == -1)
|
||||||
done = 0;
|
_getentropy_fail();
|
||||||
if (fd >= 0) {
|
|
||||||
if (read(fd, &rdat, KEYSIZE) == KEYSIZE)
|
|
||||||
done = 1;
|
|
||||||
(void)close(fd);
|
|
||||||
}
|
|
||||||
if (!done) {
|
|
||||||
(void)gettimeofday(&rdat.tv, NULL);
|
|
||||||
rdat.pid = getpid();
|
|
||||||
/* We'll just take whatever was on the stack too... */
|
|
||||||
}
|
|
||||||
|
|
||||||
arc4_addrandom((u_char *)&rdat, KEYSIZE);
|
if (!rs)
|
||||||
|
_rs_init(rnd, sizeof(rnd));
|
||||||
|
else
|
||||||
|
_rs_rekey(rnd, sizeof(rnd));
|
||||||
|
explicit_bzero(rnd, sizeof(rnd)); /* discard source seed */
|
||||||
|
|
||||||
/*
|
/* invalidate rs_buf */
|
||||||
* Throw away the first N bytes of output, as suggested in the
|
rs->rs_have = 0;
|
||||||
* paper "Weaknesses in the Key Scheduling Algorithm of RC4"
|
memset(rsx->rs_buf, 0, sizeof(rsx->rs_buf));
|
||||||
* by Fluher, Mantin, and Shamir. N=1024 is based on
|
|
||||||
* suggestions in the paper "(Not So) Random Shuffles of RC4"
|
rs->rs_count = 1600000;
|
||||||
* by Ilya Mironov.
|
|
||||||
*/
|
|
||||||
for (n = 0; n < 1024; n++)
|
|
||||||
(void) arc4_getbyte();
|
|
||||||
arc4_count = 1600000;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
static inline uint8_t
|
static inline void
|
||||||
arc4_getbyte(void)
|
_rs_stir_if_needed(size_t len)
|
||||||
{
|
{
|
||||||
uint8_t si, sj;
|
_rs_forkdetect();
|
||||||
|
if (!rs || rs->rs_count <= len)
|
||||||
rs.i = (rs.i + 1);
|
_rs_stir();
|
||||||
si = rs.s[rs.i];
|
if (rs->rs_count <= len)
|
||||||
rs.j = (rs.j + si);
|
rs->rs_count = 0;
|
||||||
sj = rs.s[rs.j];
|
else
|
||||||
rs.s[rs.i] = sj;
|
rs->rs_count -= len;
|
||||||
rs.s[rs.j] = si;
|
|
||||||
|
|
||||||
return (rs.s[(si + sj) & 0xff]);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
static inline uint32_t
|
static inline void
|
||||||
arc4_getword(void)
|
_rs_random_buf(void *_buf, size_t n)
|
||||||
{
|
{
|
||||||
uint32_t val;
|
u_char *buf = (u_char *)_buf;
|
||||||
|
u_char *keystream;
|
||||||
|
size_t m;
|
||||||
|
|
||||||
val = arc4_getbyte() << 24;
|
_rs_stir_if_needed(n);
|
||||||
val |= arc4_getbyte() << 16;
|
while (n > 0) {
|
||||||
val |= arc4_getbyte() << 8;
|
if (rs->rs_have > 0) {
|
||||||
val |= arc4_getbyte();
|
m = minimum(n, rs->rs_have);
|
||||||
|
keystream = rsx->rs_buf + sizeof(rsx->rs_buf)
|
||||||
return (val);
|
- rs->rs_have;
|
||||||
}
|
memcpy(buf, keystream, m);
|
||||||
|
memset(keystream, 0, m);
|
||||||
static void
|
buf += m;
|
||||||
arc4_check_init(void)
|
n -= m;
|
||||||
{
|
rs->rs_have -= m;
|
||||||
if (!rs_initialized) {
|
}
|
||||||
arc4_init();
|
if (rs->rs_have == 0)
|
||||||
rs_initialized = 1;
|
_rs_rekey(NULL, 0);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
static inline void
|
static inline void
|
||||||
arc4_check_stir(void)
|
_rs_random_u32(uint32_t *val)
|
||||||
{
|
{
|
||||||
if (!rs_stired || arc4_count <= 0) {
|
u_char *keystream;
|
||||||
arc4_stir();
|
|
||||||
rs_stired = 1;
|
_rs_stir_if_needed(sizeof(*val));
|
||||||
}
|
if (rs->rs_have < sizeof(*val))
|
||||||
|
_rs_rekey(NULL, 0);
|
||||||
|
keystream = rsx->rs_buf + sizeof(rsx->rs_buf) - rs->rs_have;
|
||||||
|
memcpy(val, keystream, sizeof(*val));
|
||||||
|
memset(keystream, 0, sizeof(*val));
|
||||||
|
rs->rs_have -= sizeof(*val);
|
||||||
}
|
}
|
||||||
|
|
||||||
void
|
void
|
||||||
arc4random_stir(void)
|
arc4random_stir(void)
|
||||||
{
|
{
|
||||||
THREAD_LOCK();
|
_ARC4_LOCK();
|
||||||
arc4_check_init();
|
_rs_stir();
|
||||||
arc4_stir();
|
_ARC4_UNLOCK();
|
||||||
rs_stired = 1;
|
|
||||||
THREAD_UNLOCK();
|
|
||||||
}
|
}
|
||||||
|
|
||||||
void
|
void
|
||||||
arc4random_addrandom(u_char *dat, int datlen)
|
arc4random_addrandom(u_char *dat, int datlen)
|
||||||
{
|
{
|
||||||
THREAD_LOCK();
|
_ARC4_LOCK();
|
||||||
arc4_check_init();
|
_rs_stir_if_needed(datlen);
|
||||||
arc4_check_stir();
|
_rs_rekey(dat, datlen);
|
||||||
arc4_addrandom(dat, datlen);
|
_ARC4_UNLOCK();
|
||||||
THREAD_UNLOCK();
|
|
||||||
}
|
}
|
||||||
|
|
||||||
uint32_t
|
uint32_t
|
||||||
arc4random(void)
|
arc4random(void)
|
||||||
{
|
{
|
||||||
uint32_t rnd;
|
uint32_t val;
|
||||||
|
|
||||||
THREAD_LOCK();
|
_ARC4_LOCK();
|
||||||
arc4_check_init();
|
_rs_random_u32(&val);
|
||||||
arc4_check_stir();
|
_ARC4_UNLOCK();
|
||||||
rnd = arc4_getword();
|
return val;
|
||||||
arc4_count -= 4;
|
|
||||||
THREAD_UNLOCK();
|
|
||||||
|
|
||||||
return (rnd);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
void
|
void
|
||||||
arc4random_buf(void *_buf, size_t n)
|
arc4random_buf(void *buf, size_t n)
|
||||||
{
|
{
|
||||||
u_char *buf = (u_char *)_buf;
|
_ARC4_LOCK();
|
||||||
|
_rs_random_buf(buf, n);
|
||||||
THREAD_LOCK();
|
_ARC4_UNLOCK();
|
||||||
arc4_check_init();
|
|
||||||
while (n--) {
|
|
||||||
arc4_check_stir();
|
|
||||||
buf[n] = arc4_getbyte();
|
|
||||||
arc4_count--;
|
|
||||||
}
|
|
||||||
THREAD_UNLOCK();
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/*
|
|
||||||
* Calculate a uniformly distributed random number less than upper_bound
|
|
||||||
* avoiding "modulo bias".
|
|
||||||
*
|
|
||||||
* Uniformity is achieved by generating new random numbers until the one
|
|
||||||
* returned is outside the range [0, 2**32 % upper_bound). This
|
|
||||||
* guarantees the selected random number will be inside
|
|
||||||
* [2**32 % upper_bound, 2**32) which maps back to [0, upper_bound)
|
|
||||||
* after reduction modulo upper_bound.
|
|
||||||
*/
|
|
||||||
uint32_t
|
|
||||||
arc4random_uniform(uint32_t upper_bound)
|
|
||||||
{
|
|
||||||
uint32_t r, min;
|
|
||||||
|
|
||||||
if (upper_bound < 2)
|
|
||||||
return (0);
|
|
||||||
|
|
||||||
#if (ULONG_MAX > 0xffffffffUL)
|
|
||||||
min = 0x100000000UL % upper_bound;
|
|
||||||
#else
|
|
||||||
/* Calculate (2**32 % upper_bound) avoiding 64-bit math */
|
|
||||||
if (upper_bound > 0x80000000)
|
|
||||||
min = 1 + ~upper_bound; /* 2**32 - upper_bound */
|
|
||||||
else {
|
|
||||||
/* (2**32 - (x * 2)) % x == 2**32 % x when x <= 2**31 */
|
|
||||||
min = ((0xffffffff - (upper_bound * 2)) + 1) % upper_bound;
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
|
|
||||||
/*
|
|
||||||
* This could theoretically loop forever but each retry has
|
|
||||||
* p > 0.5 (worst case, usually far better) of selecting a
|
|
||||||
* number inside the range we need, so it should rarely need
|
|
||||||
* to re-roll.
|
|
||||||
*/
|
|
||||||
for (;;) {
|
|
||||||
r = arc4random();
|
|
||||||
if (r >= min)
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
|
|
||||||
return (r % upper_bound);
|
|
||||||
}
|
|
||||||
|
|
||||||
#if 0
|
|
||||||
/*-------- Test code for i386 --------*/
|
|
||||||
#include <stdio.h>
|
|
||||||
#include <machine/pctr.h>
|
|
||||||
int
|
|
||||||
main(int argc, char **argv)
|
|
||||||
{
|
|
||||||
const int iter = 1000000;
|
|
||||||
int i;
|
|
||||||
pctrval v;
|
|
||||||
|
|
||||||
v = rdtsc();
|
|
||||||
for (i = 0; i < iter; i++)
|
|
||||||
arc4random();
|
|
||||||
v = rdtsc() - v;
|
|
||||||
v /= iter;
|
|
||||||
|
|
||||||
printf("%qd cycles\n", v);
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
|
29
src/arc4random.h
Normal file
29
src/arc4random.h
Normal file
@@ -0,0 +1,29 @@
|
|||||||
|
#ifndef LIBBSD_ARC4RANDOM_H
|
||||||
|
#define LIBBSD_ARC4RANDOM_H
|
||||||
|
|
||||||
|
#include <sys/param.h>
|
||||||
|
|
||||||
|
int
|
||||||
|
getentropy(void *buf, size_t len);
|
||||||
|
|
||||||
|
#if defined(__linux__)
|
||||||
|
#include "arc4random_linux.h"
|
||||||
|
#elif defined(__FreeBSD__)
|
||||||
|
#include "arc4random_bsd.h"
|
||||||
|
#elif defined(__NetBSD__)
|
||||||
|
#include "arc4random_bsd.h"
|
||||||
|
#elif defined(__OpenBSD__)
|
||||||
|
#include "arc4random_openbsd.h"
|
||||||
|
#elif defined(__sun)
|
||||||
|
#include "arc4random_unix.h"
|
||||||
|
#elif defined(__APPLE__)
|
||||||
|
#include "arc4random_unix.h"
|
||||||
|
#elif defined(_AIX)
|
||||||
|
#include "arc4random_unix.h"
|
||||||
|
#elif defined(__hpux)
|
||||||
|
#include "arc4random_unix.h"
|
||||||
|
#else
|
||||||
|
#error "No arc4random hooks defined for this platform."
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#endif
|
86
src/arc4random_bsd.h
Normal file
86
src/arc4random_bsd.h
Normal file
@@ -0,0 +1,86 @@
|
|||||||
|
/* $OpenBSD: arc4random_freebsd.h,v 1.2 2015/01/15 06:57:18 deraadt Exp $ */
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Copyright (c) 1996, David Mazieres <dm@uun.org>
|
||||||
|
* Copyright (c) 2008, Damien Miller <djm@openbsd.org>
|
||||||
|
* Copyright (c) 2013, Markus Friedl <markus@openbsd.org>
|
||||||
|
* Copyright (c) 2014, Theo de Raadt <deraadt@openbsd.org>
|
||||||
|
*
|
||||||
|
* Permission to use, copy, modify, and distribute this software for any
|
||||||
|
* purpose with or without fee is hereby granted, provided that the above
|
||||||
|
* copyright notice and this permission notice appear in all copies.
|
||||||
|
*
|
||||||
|
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
||||||
|
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
||||||
|
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
||||||
|
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
||||||
|
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
||||||
|
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
||||||
|
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||||
|
*/
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Stub functions for portability.
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include <sys/mman.h>
|
||||||
|
|
||||||
|
#include <pthread.h>
|
||||||
|
#include <signal.h>
|
||||||
|
|
||||||
|
static pthread_mutex_t arc4random_mtx = PTHREAD_MUTEX_INITIALIZER;
|
||||||
|
#define _ARC4_LOCK() pthread_mutex_lock(&arc4random_mtx)
|
||||||
|
#define _ARC4_UNLOCK() pthread_mutex_unlock(&arc4random_mtx)
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Unfortunately, pthread_atfork() is broken on FreeBSD (at least 9 and 10) if
|
||||||
|
* a program does not link to -lthr. Callbacks registered with pthread_atfork()
|
||||||
|
* appear to fail silently. So, it is not always possible to detect a PID
|
||||||
|
* wraparound.
|
||||||
|
*/
|
||||||
|
#define _ARC4_ATFORK(f) pthread_atfork(NULL, NULL, (f))
|
||||||
|
|
||||||
|
static inline void
|
||||||
|
_getentropy_fail(void)
|
||||||
|
{
|
||||||
|
raise(SIGKILL);
|
||||||
|
}
|
||||||
|
|
||||||
|
static volatile sig_atomic_t _rs_forked;
|
||||||
|
|
||||||
|
static inline void
|
||||||
|
_rs_forkhandler(void)
|
||||||
|
{
|
||||||
|
_rs_forked = 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
static inline void
|
||||||
|
_rs_forkdetect(void)
|
||||||
|
{
|
||||||
|
static pid_t _rs_pid = 0;
|
||||||
|
pid_t pid = getpid();
|
||||||
|
|
||||||
|
if (_rs_pid == 0 || _rs_pid != pid || _rs_forked) {
|
||||||
|
_rs_pid = pid;
|
||||||
|
_rs_forked = 0;
|
||||||
|
if (rs)
|
||||||
|
memset(rs, 0, sizeof(*rs));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
static inline int
|
||||||
|
_rs_allocate(struct _rs **rsp, struct _rsx **rsxp)
|
||||||
|
{
|
||||||
|
if ((*rsp = mmap(NULL, sizeof(**rsp), PROT_READ|PROT_WRITE,
|
||||||
|
MAP_ANON|MAP_PRIVATE, -1, 0)) == MAP_FAILED)
|
||||||
|
return (-1);
|
||||||
|
|
||||||
|
if ((*rsxp = mmap(NULL, sizeof(**rsxp), PROT_READ|PROT_WRITE,
|
||||||
|
MAP_ANON|MAP_PRIVATE, -1, 0)) == MAP_FAILED) {
|
||||||
|
munmap(*rsp, sizeof(**rsp));
|
||||||
|
return (-1);
|
||||||
|
}
|
||||||
|
|
||||||
|
_ARC4_ATFORK(_rs_forkhandler);
|
||||||
|
return (0);
|
||||||
|
}
|
86
src/arc4random_linux.h
Normal file
86
src/arc4random_linux.h
Normal file
@@ -0,0 +1,86 @@
|
|||||||
|
/* $OpenBSD: arc4random_linux.h,v 1.8 2014/08/13 06:04:10 deraadt Exp $ */
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Copyright (c) 1996, David Mazieres <dm@uun.org>
|
||||||
|
* Copyright (c) 2008, Damien Miller <djm@openbsd.org>
|
||||||
|
* Copyright (c) 2013, Markus Friedl <markus@openbsd.org>
|
||||||
|
* Copyright (c) 2014, Theo de Raadt <deraadt@openbsd.org>
|
||||||
|
*
|
||||||
|
* Permission to use, copy, modify, and distribute this software for any
|
||||||
|
* purpose with or without fee is hereby granted, provided that the above
|
||||||
|
* copyright notice and this permission notice appear in all copies.
|
||||||
|
*
|
||||||
|
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
||||||
|
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
||||||
|
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
||||||
|
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
||||||
|
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
||||||
|
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
||||||
|
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||||
|
*/
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Stub functions for portability.
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include <sys/mman.h>
|
||||||
|
|
||||||
|
#include <pthread.h>
|
||||||
|
#include <signal.h>
|
||||||
|
|
||||||
|
static pthread_mutex_t arc4random_mtx = PTHREAD_MUTEX_INITIALIZER;
|
||||||
|
#define _ARC4_LOCK() pthread_mutex_lock(&arc4random_mtx)
|
||||||
|
#define _ARC4_UNLOCK() pthread_mutex_unlock(&arc4random_mtx)
|
||||||
|
|
||||||
|
#ifdef __GLIBC__
|
||||||
|
extern void *__dso_handle;
|
||||||
|
extern int __register_atfork(void (*)(void), void(*)(void), void (*)(void), void *);
|
||||||
|
#define _ARC4_ATFORK(f) __register_atfork(NULL, NULL, (f), __dso_handle)
|
||||||
|
#else
|
||||||
|
#define _ARC4_ATFORK(f) pthread_atfork(NULL, NULL, (f))
|
||||||
|
#endif
|
||||||
|
|
||||||
|
static inline void
|
||||||
|
_getentropy_fail(void)
|
||||||
|
{
|
||||||
|
raise(SIGKILL);
|
||||||
|
}
|
||||||
|
|
||||||
|
static volatile sig_atomic_t _rs_forked;
|
||||||
|
|
||||||
|
static inline void
|
||||||
|
_rs_forkhandler(void)
|
||||||
|
{
|
||||||
|
_rs_forked = 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
static inline void
|
||||||
|
_rs_forkdetect(void)
|
||||||
|
{
|
||||||
|
static pid_t _rs_pid = 0;
|
||||||
|
pid_t pid = getpid();
|
||||||
|
|
||||||
|
if (_rs_pid == 0 || _rs_pid != pid || _rs_forked) {
|
||||||
|
_rs_pid = pid;
|
||||||
|
_rs_forked = 0;
|
||||||
|
if (rs)
|
||||||
|
memset(rs, 0, sizeof(*rs));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
static inline int
|
||||||
|
_rs_allocate(struct _rs **rsp, struct _rsx **rsxp)
|
||||||
|
{
|
||||||
|
if ((*rsp = mmap(NULL, sizeof(**rsp), PROT_READ|PROT_WRITE,
|
||||||
|
MAP_ANON|MAP_PRIVATE, -1, 0)) == MAP_FAILED)
|
||||||
|
return (-1);
|
||||||
|
|
||||||
|
if ((*rsxp = mmap(NULL, sizeof(**rsxp), PROT_READ|PROT_WRITE,
|
||||||
|
MAP_ANON|MAP_PRIVATE, -1, 0)) == MAP_FAILED) {
|
||||||
|
munmap(*rsp, sizeof(**rsp));
|
||||||
|
return (-1);
|
||||||
|
}
|
||||||
|
|
||||||
|
_ARC4_ATFORK(_rs_forkhandler);
|
||||||
|
return (0);
|
||||||
|
}
|
61
src/arc4random_openbsd.h
Normal file
61
src/arc4random_openbsd.h
Normal file
@@ -0,0 +1,61 @@
|
|||||||
|
/* $OpenBSD: arc4random.h,v 1.3 2014/07/20 20:51:13 bcook Exp $ */
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Copyright (c) 1996, David Mazieres <dm@uun.org>
|
||||||
|
* Copyright (c) 2008, Damien Miller <djm@openbsd.org>
|
||||||
|
* Copyright (c) 2013, Markus Friedl <markus@openbsd.org>
|
||||||
|
* Copyright (c) 2014, Theo de Raadt <deraadt@openbsd.org>
|
||||||
|
*
|
||||||
|
* Permission to use, copy, modify, and distribute this software for any
|
||||||
|
* purpose with or without fee is hereby granted, provided that the above
|
||||||
|
* copyright notice and this permission notice appear in all copies.
|
||||||
|
*
|
||||||
|
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
||||||
|
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
||||||
|
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
||||||
|
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
||||||
|
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
||||||
|
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
||||||
|
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||||
|
*/
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Stub functions for portability.
|
||||||
|
*/
|
||||||
|
#include <sys/mman.h>
|
||||||
|
|
||||||
|
#include <signal.h>
|
||||||
|
|
||||||
|
#include "thread_private.h"
|
||||||
|
|
||||||
|
static inline void
|
||||||
|
_getentropy_fail(void)
|
||||||
|
{
|
||||||
|
raise(SIGKILL);
|
||||||
|
}
|
||||||
|
|
||||||
|
static inline int
|
||||||
|
_rs_allocate(struct _rs **rsp, struct _rsx **rsxp)
|
||||||
|
{
|
||||||
|
struct {
|
||||||
|
struct _rs rs;
|
||||||
|
struct _rsx rsx;
|
||||||
|
} *p;
|
||||||
|
|
||||||
|
if ((p = mmap(NULL, sizeof(*p), PROT_READ|PROT_WRITE,
|
||||||
|
MAP_ANON|MAP_PRIVATE, -1, 0)) == MAP_FAILED)
|
||||||
|
return (-1);
|
||||||
|
if (minherit(p, sizeof(*p), MAP_INHERIT_ZERO) == -1) {
|
||||||
|
munmap(p, sizeof(*p));
|
||||||
|
return (-1);
|
||||||
|
}
|
||||||
|
|
||||||
|
*rsp = &p->rs;
|
||||||
|
*rsxp = &p->rsx;
|
||||||
|
return (0);
|
||||||
|
}
|
||||||
|
|
||||||
|
static inline void
|
||||||
|
_rs_forkdetect(void)
|
||||||
|
{
|
||||||
|
}
|
57
src/arc4random_uniform.c
Normal file
57
src/arc4random_uniform.c
Normal file
@@ -0,0 +1,57 @@
|
|||||||
|
/* $OpenBSD: arc4random_uniform.c,v 1.1 2014/07/12 13:24:54 deraadt Exp $ */
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Copyright (c) 2008, Damien Miller <djm@openbsd.org>
|
||||||
|
*
|
||||||
|
* Permission to use, copy, modify, and distribute this software for any
|
||||||
|
* purpose with or without fee is hereby granted, provided that the above
|
||||||
|
* copyright notice and this permission notice appear in all copies.
|
||||||
|
*
|
||||||
|
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
||||||
|
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
||||||
|
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
||||||
|
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
||||||
|
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
||||||
|
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
||||||
|
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include <sys/types.h>
|
||||||
|
#include <stdlib.h>
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Calculate a uniformly distributed random number less than upper_bound
|
||||||
|
* avoiding "modulo bias".
|
||||||
|
*
|
||||||
|
* Uniformity is achieved by generating new random numbers until the one
|
||||||
|
* returned is outside the range [0, 2**32 % upper_bound). This
|
||||||
|
* guarantees the selected random number will be inside
|
||||||
|
* [2**32 % upper_bound, 2**32) which maps back to [0, upper_bound)
|
||||||
|
* after reduction modulo upper_bound.
|
||||||
|
*/
|
||||||
|
uint32_t
|
||||||
|
arc4random_uniform(uint32_t upper_bound)
|
||||||
|
{
|
||||||
|
uint32_t r, min;
|
||||||
|
|
||||||
|
if (upper_bound < 2)
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
/* 2**32 % x == (2**32 - x) % x */
|
||||||
|
min = -upper_bound % upper_bound;
|
||||||
|
|
||||||
|
/*
|
||||||
|
* This could theoretically loop forever but each retry has
|
||||||
|
* p > 0.5 (worst case, usually far better) of selecting a
|
||||||
|
* number inside the range we need, so it should rarely need
|
||||||
|
* to re-roll.
|
||||||
|
*/
|
||||||
|
for (;;) {
|
||||||
|
r = arc4random();
|
||||||
|
if (r >= min)
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
|
||||||
|
return r % upper_bound;
|
||||||
|
}
|
||||||
|
//DEF_WEAK(arc4random_uniform);
|
80
src/arc4random_unix.h
Normal file
80
src/arc4random_unix.h
Normal file
@@ -0,0 +1,80 @@
|
|||||||
|
/* $OpenBSD: arc4random_hpux.h,v 1.1 2015/01/06 21:08:11 bcook Exp $ */
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Copyright (c) 1996, David Mazieres <dm@uun.org>
|
||||||
|
* Copyright (c) 2008, Damien Miller <djm@openbsd.org>
|
||||||
|
* Copyright (c) 2013, Markus Friedl <markus@openbsd.org>
|
||||||
|
* Copyright (c) 2014, Theo de Raadt <deraadt@openbsd.org>
|
||||||
|
*
|
||||||
|
* Permission to use, copy, modify, and distribute this software for any
|
||||||
|
* purpose with or without fee is hereby granted, provided that the above
|
||||||
|
* copyright notice and this permission notice appear in all copies.
|
||||||
|
*
|
||||||
|
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
||||||
|
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
||||||
|
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
||||||
|
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
||||||
|
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
||||||
|
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
||||||
|
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||||
|
*/
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Stub functions for portability.
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include <sys/mman.h>
|
||||||
|
|
||||||
|
#include <pthread.h>
|
||||||
|
#include <signal.h>
|
||||||
|
|
||||||
|
static pthread_mutex_t arc4random_mtx = PTHREAD_MUTEX_INITIALIZER;
|
||||||
|
#define _ARC4_LOCK() pthread_mutex_lock(&arc4random_mtx)
|
||||||
|
#define _ARC4_UNLOCK() pthread_mutex_unlock(&arc4random_mtx)
|
||||||
|
|
||||||
|
#define _ARC4_ATFORK(f) pthread_atfork(NULL, NULL, (f))
|
||||||
|
|
||||||
|
static inline void
|
||||||
|
_getentropy_fail(void)
|
||||||
|
{
|
||||||
|
raise(SIGKILL);
|
||||||
|
}
|
||||||
|
|
||||||
|
static volatile sig_atomic_t _rs_forked;
|
||||||
|
|
||||||
|
static inline void
|
||||||
|
_rs_forkhandler(void)
|
||||||
|
{
|
||||||
|
_rs_forked = 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
static inline void
|
||||||
|
_rs_forkdetect(void)
|
||||||
|
{
|
||||||
|
static pid_t _rs_pid = 0;
|
||||||
|
pid_t pid = getpid();
|
||||||
|
|
||||||
|
if (_rs_pid == 0 || _rs_pid != pid || _rs_forked) {
|
||||||
|
_rs_pid = pid;
|
||||||
|
_rs_forked = 0;
|
||||||
|
if (rs)
|
||||||
|
memset(rs, 0, sizeof(*rs));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
static inline int
|
||||||
|
_rs_allocate(struct _rs **rsp, struct _rsx **rsxp)
|
||||||
|
{
|
||||||
|
if ((*rsp = mmap(NULL, sizeof(**rsp), PROT_READ|PROT_WRITE,
|
||||||
|
MAP_ANON|MAP_PRIVATE, -1, 0)) == MAP_FAILED)
|
||||||
|
return (-1);
|
||||||
|
|
||||||
|
if ((*rsxp = mmap(NULL, sizeof(**rsxp), PROT_READ|PROT_WRITE,
|
||||||
|
MAP_ANON|MAP_PRIVATE, -1, 0)) == MAP_FAILED) {
|
||||||
|
munmap(*rsp, sizeof(**rsp));
|
||||||
|
return (-1);
|
||||||
|
}
|
||||||
|
|
||||||
|
_ARC4_ATFORK(_rs_forkhandler);
|
||||||
|
return (0);
|
||||||
|
}
|
222
src/chacha_private.h
Normal file
222
src/chacha_private.h
Normal file
@@ -0,0 +1,222 @@
|
|||||||
|
/*
|
||||||
|
chacha-merged.c version 20080118
|
||||||
|
D. J. Bernstein
|
||||||
|
Public domain.
|
||||||
|
*/
|
||||||
|
|
||||||
|
/* $OpenBSD$ */
|
||||||
|
|
||||||
|
typedef unsigned char u8;
|
||||||
|
typedef unsigned int u32;
|
||||||
|
|
||||||
|
typedef struct
|
||||||
|
{
|
||||||
|
u32 input[16]; /* could be compressed */
|
||||||
|
} chacha_ctx;
|
||||||
|
|
||||||
|
#define U8C(v) (v##U)
|
||||||
|
#define U32C(v) (v##U)
|
||||||
|
|
||||||
|
#define U8V(v) ((u8)(v) & U8C(0xFF))
|
||||||
|
#define U32V(v) ((u32)(v) & U32C(0xFFFFFFFF))
|
||||||
|
|
||||||
|
#define ROTL32(v, n) \
|
||||||
|
(U32V((v) << (n)) | ((v) >> (32 - (n))))
|
||||||
|
|
||||||
|
#define U8TO32_LITTLE(p) \
|
||||||
|
(((u32)((p)[0]) ) | \
|
||||||
|
((u32)((p)[1]) << 8) | \
|
||||||
|
((u32)((p)[2]) << 16) | \
|
||||||
|
((u32)((p)[3]) << 24))
|
||||||
|
|
||||||
|
#define U32TO8_LITTLE(p, v) \
|
||||||
|
do { \
|
||||||
|
(p)[0] = U8V((v) ); \
|
||||||
|
(p)[1] = U8V((v) >> 8); \
|
||||||
|
(p)[2] = U8V((v) >> 16); \
|
||||||
|
(p)[3] = U8V((v) >> 24); \
|
||||||
|
} while (0)
|
||||||
|
|
||||||
|
#define ROTATE(v,c) (ROTL32(v,c))
|
||||||
|
#define XOR(v,w) ((v) ^ (w))
|
||||||
|
#define PLUS(v,w) (U32V((v) + (w)))
|
||||||
|
#define PLUSONE(v) (PLUS((v),1))
|
||||||
|
|
||||||
|
#define QUARTERROUND(a,b,c,d) \
|
||||||
|
a = PLUS(a,b); d = ROTATE(XOR(d,a),16); \
|
||||||
|
c = PLUS(c,d); b = ROTATE(XOR(b,c),12); \
|
||||||
|
a = PLUS(a,b); d = ROTATE(XOR(d,a), 8); \
|
||||||
|
c = PLUS(c,d); b = ROTATE(XOR(b,c), 7);
|
||||||
|
|
||||||
|
static const char sigma[16] = "expand 32-byte k";
|
||||||
|
static const char tau[16] = "expand 16-byte k";
|
||||||
|
|
||||||
|
static void
|
||||||
|
chacha_keysetup(chacha_ctx *x,const u8 *k,u32 kbits,u32 ivbits)
|
||||||
|
{
|
||||||
|
const char *constants;
|
||||||
|
|
||||||
|
x->input[4] = U8TO32_LITTLE(k + 0);
|
||||||
|
x->input[5] = U8TO32_LITTLE(k + 4);
|
||||||
|
x->input[6] = U8TO32_LITTLE(k + 8);
|
||||||
|
x->input[7] = U8TO32_LITTLE(k + 12);
|
||||||
|
if (kbits == 256) { /* recommended */
|
||||||
|
k += 16;
|
||||||
|
constants = sigma;
|
||||||
|
} else { /* kbits == 128 */
|
||||||
|
constants = tau;
|
||||||
|
}
|
||||||
|
x->input[8] = U8TO32_LITTLE(k + 0);
|
||||||
|
x->input[9] = U8TO32_LITTLE(k + 4);
|
||||||
|
x->input[10] = U8TO32_LITTLE(k + 8);
|
||||||
|
x->input[11] = U8TO32_LITTLE(k + 12);
|
||||||
|
x->input[0] = U8TO32_LITTLE(constants + 0);
|
||||||
|
x->input[1] = U8TO32_LITTLE(constants + 4);
|
||||||
|
x->input[2] = U8TO32_LITTLE(constants + 8);
|
||||||
|
x->input[3] = U8TO32_LITTLE(constants + 12);
|
||||||
|
}
|
||||||
|
|
||||||
|
static void
|
||||||
|
chacha_ivsetup(chacha_ctx *x,const u8 *iv)
|
||||||
|
{
|
||||||
|
x->input[12] = 0;
|
||||||
|
x->input[13] = 0;
|
||||||
|
x->input[14] = U8TO32_LITTLE(iv + 0);
|
||||||
|
x->input[15] = U8TO32_LITTLE(iv + 4);
|
||||||
|
}
|
||||||
|
|
||||||
|
static void
|
||||||
|
chacha_encrypt_bytes(chacha_ctx *x,const u8 *m,u8 *c,u32 bytes)
|
||||||
|
{
|
||||||
|
u32 x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;
|
||||||
|
u32 j0, j1, j2, j3, j4, j5, j6, j7, j8, j9, j10, j11, j12, j13, j14, j15;
|
||||||
|
u8 *ctarget = NULL;
|
||||||
|
u8 tmp[64];
|
||||||
|
u_int i;
|
||||||
|
|
||||||
|
if (!bytes) return;
|
||||||
|
|
||||||
|
j0 = x->input[0];
|
||||||
|
j1 = x->input[1];
|
||||||
|
j2 = x->input[2];
|
||||||
|
j3 = x->input[3];
|
||||||
|
j4 = x->input[4];
|
||||||
|
j5 = x->input[5];
|
||||||
|
j6 = x->input[6];
|
||||||
|
j7 = x->input[7];
|
||||||
|
j8 = x->input[8];
|
||||||
|
j9 = x->input[9];
|
||||||
|
j10 = x->input[10];
|
||||||
|
j11 = x->input[11];
|
||||||
|
j12 = x->input[12];
|
||||||
|
j13 = x->input[13];
|
||||||
|
j14 = x->input[14];
|
||||||
|
j15 = x->input[15];
|
||||||
|
|
||||||
|
for (;;) {
|
||||||
|
if (bytes < 64) {
|
||||||
|
for (i = 0;i < bytes;++i) tmp[i] = m[i];
|
||||||
|
m = tmp;
|
||||||
|
ctarget = c;
|
||||||
|
c = tmp;
|
||||||
|
}
|
||||||
|
x0 = j0;
|
||||||
|
x1 = j1;
|
||||||
|
x2 = j2;
|
||||||
|
x3 = j3;
|
||||||
|
x4 = j4;
|
||||||
|
x5 = j5;
|
||||||
|
x6 = j6;
|
||||||
|
x7 = j7;
|
||||||
|
x8 = j8;
|
||||||
|
x9 = j9;
|
||||||
|
x10 = j10;
|
||||||
|
x11 = j11;
|
||||||
|
x12 = j12;
|
||||||
|
x13 = j13;
|
||||||
|
x14 = j14;
|
||||||
|
x15 = j15;
|
||||||
|
for (i = 20;i > 0;i -= 2) {
|
||||||
|
QUARTERROUND( x0, x4, x8,x12)
|
||||||
|
QUARTERROUND( x1, x5, x9,x13)
|
||||||
|
QUARTERROUND( x2, x6,x10,x14)
|
||||||
|
QUARTERROUND( x3, x7,x11,x15)
|
||||||
|
QUARTERROUND( x0, x5,x10,x15)
|
||||||
|
QUARTERROUND( x1, x6,x11,x12)
|
||||||
|
QUARTERROUND( x2, x7, x8,x13)
|
||||||
|
QUARTERROUND( x3, x4, x9,x14)
|
||||||
|
}
|
||||||
|
x0 = PLUS(x0,j0);
|
||||||
|
x1 = PLUS(x1,j1);
|
||||||
|
x2 = PLUS(x2,j2);
|
||||||
|
x3 = PLUS(x3,j3);
|
||||||
|
x4 = PLUS(x4,j4);
|
||||||
|
x5 = PLUS(x5,j5);
|
||||||
|
x6 = PLUS(x6,j6);
|
||||||
|
x7 = PLUS(x7,j7);
|
||||||
|
x8 = PLUS(x8,j8);
|
||||||
|
x9 = PLUS(x9,j9);
|
||||||
|
x10 = PLUS(x10,j10);
|
||||||
|
x11 = PLUS(x11,j11);
|
||||||
|
x12 = PLUS(x12,j12);
|
||||||
|
x13 = PLUS(x13,j13);
|
||||||
|
x14 = PLUS(x14,j14);
|
||||||
|
x15 = PLUS(x15,j15);
|
||||||
|
|
||||||
|
#ifndef KEYSTREAM_ONLY
|
||||||
|
x0 = XOR(x0,U8TO32_LITTLE(m + 0));
|
||||||
|
x1 = XOR(x1,U8TO32_LITTLE(m + 4));
|
||||||
|
x2 = XOR(x2,U8TO32_LITTLE(m + 8));
|
||||||
|
x3 = XOR(x3,U8TO32_LITTLE(m + 12));
|
||||||
|
x4 = XOR(x4,U8TO32_LITTLE(m + 16));
|
||||||
|
x5 = XOR(x5,U8TO32_LITTLE(m + 20));
|
||||||
|
x6 = XOR(x6,U8TO32_LITTLE(m + 24));
|
||||||
|
x7 = XOR(x7,U8TO32_LITTLE(m + 28));
|
||||||
|
x8 = XOR(x8,U8TO32_LITTLE(m + 32));
|
||||||
|
x9 = XOR(x9,U8TO32_LITTLE(m + 36));
|
||||||
|
x10 = XOR(x10,U8TO32_LITTLE(m + 40));
|
||||||
|
x11 = XOR(x11,U8TO32_LITTLE(m + 44));
|
||||||
|
x12 = XOR(x12,U8TO32_LITTLE(m + 48));
|
||||||
|
x13 = XOR(x13,U8TO32_LITTLE(m + 52));
|
||||||
|
x14 = XOR(x14,U8TO32_LITTLE(m + 56));
|
||||||
|
x15 = XOR(x15,U8TO32_LITTLE(m + 60));
|
||||||
|
#endif
|
||||||
|
|
||||||
|
j12 = PLUSONE(j12);
|
||||||
|
if (!j12) {
|
||||||
|
j13 = PLUSONE(j13);
|
||||||
|
/* stopping at 2^70 bytes per nonce is user's responsibility */
|
||||||
|
}
|
||||||
|
|
||||||
|
U32TO8_LITTLE(c + 0,x0);
|
||||||
|
U32TO8_LITTLE(c + 4,x1);
|
||||||
|
U32TO8_LITTLE(c + 8,x2);
|
||||||
|
U32TO8_LITTLE(c + 12,x3);
|
||||||
|
U32TO8_LITTLE(c + 16,x4);
|
||||||
|
U32TO8_LITTLE(c + 20,x5);
|
||||||
|
U32TO8_LITTLE(c + 24,x6);
|
||||||
|
U32TO8_LITTLE(c + 28,x7);
|
||||||
|
U32TO8_LITTLE(c + 32,x8);
|
||||||
|
U32TO8_LITTLE(c + 36,x9);
|
||||||
|
U32TO8_LITTLE(c + 40,x10);
|
||||||
|
U32TO8_LITTLE(c + 44,x11);
|
||||||
|
U32TO8_LITTLE(c + 48,x12);
|
||||||
|
U32TO8_LITTLE(c + 52,x13);
|
||||||
|
U32TO8_LITTLE(c + 56,x14);
|
||||||
|
U32TO8_LITTLE(c + 60,x15);
|
||||||
|
|
||||||
|
if (bytes <= 64) {
|
||||||
|
if (bytes < 64) {
|
||||||
|
for (i = 0;i < bytes;++i) ctarget[i] = c[i];
|
||||||
|
}
|
||||||
|
x->input[12] = j12;
|
||||||
|
x->input[13] = j13;
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
bytes -= 64;
|
||||||
|
c += 64;
|
||||||
|
#ifndef KEYSTREAM_ONLY
|
||||||
|
m += 64;
|
||||||
|
#endif
|
||||||
|
}
|
||||||
|
}
|
Reference in New Issue
Block a user