1 /* crypto/rand/md_rand.c */
2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
58 /* ====================================================================
59 * Copyright (c) 1998-2001 The OpenSSL Project. All rights reserved.
61 * Redistribution and use in source and binary forms, with or without
62 * modification, are permitted provided that the following conditions
65 * 1. Redistributions of source code must retain the above copyright
66 * notice, this list of conditions and the following disclaimer.
68 * 2. Redistributions in binary form must reproduce the above copyright
69 * notice, this list of conditions and the following disclaimer in
70 * the documentation and/or other materials provided with the
73 * 3. All advertising materials mentioning features or use of this
74 * software must display the following acknowledgment:
75 * "This product includes software developed by the OpenSSL Project
76 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
78 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79 * endorse or promote products derived from this software without
80 * prior written permission. For written permission, please contact
81 * openssl-core@openssl.org.
83 * 5. Products derived from this software may not be called "OpenSSL"
84 * nor may "OpenSSL" appear in their names without prior written
85 * permission of the OpenSSL Project.
87 * 6. Redistributions of any form whatsoever must retain the following
89 * "This product includes software developed by the OpenSSL Project
90 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
92 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
96 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103 * OF THE POSSIBILITY OF SUCH DAMAGE.
104 * ====================================================================
106 * This product includes cryptographic software written by Eric Young
107 * (eay@cryptsoft.com). This product includes software written by Tim
108 * Hudson (tjh@cryptsoft.com).
126 #if !(defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_VXWORKS) || defined(OPENSSL_SYSNAME_DSPBIOS))
127 # include <sys/time.h>
129 #if defined(OPENSSL_SYS_VXWORKS)
133 #include <openssl/crypto.h>
134 #include <openssl/rand.h>
135 #include "rand_lcl.h"
137 #include <openssl/err.h>
140 #include <openssl/fips.h>
147 /* #define PREDICT 1 */
149 #define STATE_SIZE 1023
150 static int state_num=0,state_index=0;
151 static unsigned char state[STATE_SIZE+MD_DIGEST_LENGTH];
152 static unsigned char md[MD_DIGEST_LENGTH];
153 static long md_count[2]={0,0};
154 static double entropy=0;
155 static int initialized=0;
157 static unsigned int crypto_lock_rand = 0; /* may be set only when a thread
158 * holds CRYPTO_LOCK_RAND
159 * (to prevent double locking) */
160 /* access to lockin_thread is synchronized by CRYPTO_LOCK_RAND2 */
161 /* valid iff crypto_lock_rand is set */
162 static CRYPTO_THREADID locking_threadid;
166 int rand_predictable=0;
169 const char RAND_version[]="RAND" OPENSSL_VERSION_PTEXT;
171 static void rand_hw_seed(EVP_MD_CTX *ctx);
173 static void ssleay_rand_cleanup(void);
174 static int ssleay_rand_seed(const void *buf, int num);
175 static int ssleay_rand_add(const void *buf, int num, double add_entropy);
176 static int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo);
177 static int ssleay_rand_nopseudo_bytes(unsigned char *buf, int num);
178 static int ssleay_rand_pseudo_bytes(unsigned char *buf, int num);
179 static int ssleay_rand_status(void);
181 static RAND_METHOD rand_ssleay_meth={
183 ssleay_rand_nopseudo_bytes,
186 ssleay_rand_pseudo_bytes,
190 RAND_METHOD *RAND_SSLeay(void)
192 return(&rand_ssleay_meth);
195 static void ssleay_rand_cleanup(void)
197 OPENSSL_cleanse(state,sizeof(state));
200 OPENSSL_cleanse(md,MD_DIGEST_LENGTH);
207 static int ssleay_rand_add(const void *buf, int num, double add)
211 unsigned char local_md[MD_DIGEST_LENGTH];
220 * (Based on the rand(3) manpage)
222 * The input is chopped up into units of 20 bytes (or less for
223 * the last block). Each of these blocks is run through the hash
224 * function as follows: The data passed to the hash function
225 * is the current 'md', the same number of bytes from the 'state'
226 * (the location determined by in incremented looping index) as
227 * the current 'block', the new key data 'block', and 'count'
228 * (which is incremented after each use).
229 * The result of this is kept in 'md' and also xored into the
230 * 'state' at the same locations that were used as input into the
235 /* check if we already have the lock */
236 if (crypto_lock_rand)
239 CRYPTO_THREADID_current(&cur);
240 CRYPTO_r_lock(CRYPTO_LOCK_RAND2);
241 do_not_lock = !CRYPTO_THREADID_cmp(&locking_threadid, &cur);
242 CRYPTO_r_unlock(CRYPTO_LOCK_RAND2);
247 if (!do_not_lock) CRYPTO_w_lock(CRYPTO_LOCK_RAND);
250 /* use our own copies of the counters so that even
251 * if a concurrent thread seeds with exactly the
252 * same data and uses the same subarray there's _some_
254 md_c[0] = md_count[0];
255 md_c[1] = md_count[1];
257 memcpy(local_md, md, sizeof md);
259 /* state_index <= state_num <= STATE_SIZE */
261 if (state_index >= STATE_SIZE)
263 state_index%=STATE_SIZE;
264 state_num=STATE_SIZE;
266 else if (state_num < STATE_SIZE)
268 if (state_index > state_num)
269 state_num=state_index;
271 /* state_index <= state_num <= STATE_SIZE */
273 /* state[st_idx], ..., state[(st_idx + num - 1) % STATE_SIZE]
274 * are what we will use now, but other threads may use them
277 md_count[1] += (num / MD_DIGEST_LENGTH) + (num % MD_DIGEST_LENGTH > 0);
279 if (!do_not_lock) CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
281 for (i=0; i<num; i+=MD_DIGEST_LENGTH)
284 j=(j > MD_DIGEST_LENGTH)?MD_DIGEST_LENGTH:j;
288 if (!MD_Update(&m,local_md,MD_DIGEST_LENGTH))
290 k=(st_idx+j)-STATE_SIZE;
293 if (!MD_Update(&m,&(state[st_idx]),j-k))
295 if (!MD_Update(&m,&(state[0]),k))
299 if (!MD_Update(&m,&(state[st_idx]),j))
302 /* DO NOT REMOVE THE FOLLOWING CALL TO MD_Update()! */
303 if (!MD_Update(&m,buf,j))
305 /* We know that line may cause programs such as
306 purify and valgrind to complain about use of
307 uninitialized data. The problem is not, it's
308 with the caller. Removing that line will make
309 sure you get really bad randomness and thereby
310 other problems such as very insecure keys. */
312 if (!MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c)))
314 if (!MD_Final(&m,local_md))
318 buf=(const char *)buf + j;
322 /* Parallel threads may interfere with this,
323 * but always each byte of the new state is
324 * the XOR of some previous value of its
325 * and local_md (itermediate values may be lost).
326 * Alway using locking could hurt performance more
327 * than necessary given that conflicts occur only
328 * when the total seeding is longer than the random
330 state[st_idx++]^=local_md[k];
331 if (st_idx >= STATE_SIZE)
336 if (!do_not_lock) CRYPTO_w_lock(CRYPTO_LOCK_RAND);
337 /* Don't just copy back local_md into md -- this could mean that
338 * other thread's seeding remains without effect (except for
339 * the incremented counter). By XORing it we keep at least as
340 * much entropy as fits into md. */
341 for (k = 0; k < (int)sizeof(md); k++)
343 md[k] ^= local_md[k];
345 if (entropy < ENTROPY_NEEDED) /* stop counting when we have enough */
347 if (!do_not_lock) CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
349 #if !defined(OPENSSL_THREADS) && !defined(OPENSSL_SYS_WIN32)
350 assert(md_c[1] == md_count[1]);
354 EVP_MD_CTX_cleanup(&m);
358 static int ssleay_rand_seed(const void *buf, int num)
360 return ssleay_rand_add(buf, num, (double)num);
363 static int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo)
365 static volatile int stirred_pool = 0;
366 int i,j,k,st_num,st_idx;
370 unsigned char local_md[MD_DIGEST_LENGTH];
372 #ifndef GETPID_IS_MEANINGLESS
373 pid_t curr_pid = getpid();
375 time_t curr_time = time(NULL);
376 int do_stir_pool = 0;
377 /* time value for various platforms */
378 #ifdef OPENSSL_SYS_WIN32
383 SystemTimeToFileTime(&t, &tv);
385 GetSystemTimeAsFileTime(&tv);
387 #elif defined(OPENSSL_SYS_VXWORKS)
389 clock_gettime(CLOCK_REALTIME, &ts);
390 #elif defined(OPENSSL_SYSNAME_DSPBIOS)
391 unsigned long long tv, OPENSSL_rdtsc();
392 tv = OPENSSL_rdtsc();
395 gettimeofday(&tv, NULL);
399 if (rand_predictable)
401 static unsigned char val=0;
403 for (i=0; i<num; i++)
413 /* round upwards to multiple of MD_DIGEST_LENGTH/2 */
414 num_ceil = (1 + (num-1)/(MD_DIGEST_LENGTH/2)) * (MD_DIGEST_LENGTH/2);
417 * (Based on the rand(3) manpage:)
419 * For each group of 10 bytes (or less), we do the following:
421 * Input into the hash function the local 'md' (which is initialized from
422 * the global 'md' before any bytes are generated), the bytes that are to
423 * be overwritten by the random bytes, and bytes from the 'state'
424 * (incrementing looping index). From this digest output (which is kept
425 * in 'md'), the top (up to) 10 bytes are returned to the caller and the
426 * bottom 10 bytes are xored into the 'state'.
428 * Finally, after we have finished 'num' random bytes for the
429 * caller, 'count' (which is incremented) and the local and global 'md'
430 * are fed into the hash function and the results are kept in the
434 CRYPTO_w_lock(CRYPTO_LOCK_RAND);
436 /* prevent ssleay_rand_bytes() from trying to obtain the lock again */
437 CRYPTO_w_lock(CRYPTO_LOCK_RAND2);
438 CRYPTO_THREADID_current(&locking_threadid);
439 CRYPTO_w_unlock(CRYPTO_LOCK_RAND2);
440 crypto_lock_rand = 1;
451 ok = (entropy >= ENTROPY_NEEDED);
454 /* If the PRNG state is not yet unpredictable, then seeing
455 * the PRNG output may help attackers to determine the new
456 * state; thus we have to decrease the entropy estimate.
457 * Once we've had enough initial seeding we don't bother to
458 * adjust the entropy count, though, because we're not ambitious
459 * to provide *information-theoretic* randomness.
461 * NOTE: This approach fails if the program forks before
462 * we have enough entropy. Entropy should be collected
463 * in a separate input pool and be transferred to the
464 * output pool only when the entropy limit has been reached.
473 /* In the output function only half of 'md' remains secret,
474 * so we better make sure that the required entropy gets
475 * 'evenly distributed' through 'state', our randomness pool.
476 * The input function (ssleay_rand_add) chains all of 'md',
477 * which makes it more suitable for this purpose.
480 int n = STATE_SIZE; /* so that the complete pool gets accessed */
483 #if MD_DIGEST_LENGTH > 20
484 # error "Please adjust DUMMY_SEED."
486 #define DUMMY_SEED "...................." /* at least MD_DIGEST_LENGTH */
487 /* Note that the seed does not matter, it's just that
488 * ssleay_rand_add expects to have something to hash. */
489 ssleay_rand_add(DUMMY_SEED, MD_DIGEST_LENGTH, 0.0);
490 n -= MD_DIGEST_LENGTH;
498 md_c[0] = md_count[0];
499 md_c[1] = md_count[1];
500 memcpy(local_md, md, sizeof md);
502 state_index+=num_ceil;
503 if (state_index > state_num)
504 state_index %= state_num;
506 /* state[st_idx], ..., state[(st_idx + num_ceil - 1) % st_num]
507 * are now ours (but other threads may use them too) */
511 /* before unlocking, we must clear 'crypto_lock_rand' */
512 crypto_lock_rand = 0;
513 CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
517 /* num_ceil -= MD_DIGEST_LENGTH/2 */
518 j=(num >= MD_DIGEST_LENGTH/2)?MD_DIGEST_LENGTH/2:num;
522 #ifndef GETPID_IS_MEANINGLESS
523 if (curr_pid) /* just in the first iteration to save time */
525 if (!MD_Update(&m,(unsigned char*)&curr_pid,
531 if (curr_time) /* just in the first iteration to save time */
533 if (!MD_Update(&m,(unsigned char*)&curr_time,
536 if (!MD_Update(&m,(unsigned char*)&tv,
542 if (!MD_Update(&m,local_md,MD_DIGEST_LENGTH))
544 if (!MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c)))
547 #ifndef PURIFY /* purify complains */
548 /* The following line uses the supplied buffer as a small
549 * source of entropy: since this buffer is often uninitialised
550 * it may cause programs such as purify or valgrind to
551 * complain. So for those builds it is not used: the removal
552 * of such a small source of entropy has negligible impact on
555 if (!MD_Update(&m,buf,j))
559 k=(st_idx+MD_DIGEST_LENGTH/2)-st_num;
562 if (!MD_Update(&m,&(state[st_idx]),MD_DIGEST_LENGTH/2-k))
564 if (!MD_Update(&m,&(state[0]),k))
568 if (!MD_Update(&m,&(state[st_idx]),MD_DIGEST_LENGTH/2))
570 if (!MD_Final(&m,local_md))
573 for (i=0; i<MD_DIGEST_LENGTH/2; i++)
575 /* may compete with other threads */
576 state[st_idx++]^=local_md[i];
577 if (st_idx >= st_num)
580 *(buf++)=local_md[i+MD_DIGEST_LENGTH/2];
585 || !MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c))
586 || !MD_Update(&m,local_md,MD_DIGEST_LENGTH))
588 CRYPTO_w_lock(CRYPTO_LOCK_RAND);
589 if (!MD_Update(&m,md,MD_DIGEST_LENGTH) || !MD_Final(&m,md))
591 CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
594 CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
596 EVP_MD_CTX_cleanup(&m);
603 RANDerr(RAND_F_SSLEAY_RAND_BYTES,RAND_R_PRNG_NOT_SEEDED);
604 ERR_add_error_data(1, "You need to read the OpenSSL FAQ, "
605 "http://www.openssl.org/support/faq.html");
609 EVP_MD_CTX_cleanup(&m);
610 RANDerr(RAND_F_SSLEAY_RAND_BYTES,ERR_R_EVP_LIB);
615 static int ssleay_rand_nopseudo_bytes(unsigned char *buf, int num)
617 return ssleay_rand_bytes(buf, num, 0);
620 /* pseudo-random bytes that are guaranteed to be unique but not
622 static int ssleay_rand_pseudo_bytes(unsigned char *buf, int num)
624 return ssleay_rand_bytes(buf, num, 1);
627 static int ssleay_rand_status(void)
633 CRYPTO_THREADID_current(&cur);
634 /* check if we already have the lock
635 * (could happen if a RAND_poll() implementation calls RAND_status()) */
636 if (crypto_lock_rand)
638 CRYPTO_r_lock(CRYPTO_LOCK_RAND2);
639 do_not_lock = !CRYPTO_THREADID_cmp(&locking_threadid, &cur);
640 CRYPTO_r_unlock(CRYPTO_LOCK_RAND2);
647 CRYPTO_w_lock(CRYPTO_LOCK_RAND);
649 /* prevent ssleay_rand_bytes() from trying to obtain the lock again */
650 CRYPTO_w_lock(CRYPTO_LOCK_RAND2);
651 CRYPTO_THREADID_cpy(&locking_threadid, &cur);
652 CRYPTO_w_unlock(CRYPTO_LOCK_RAND2);
653 crypto_lock_rand = 1;
662 ret = entropy >= ENTROPY_NEEDED;
666 /* before unlocking, we must clear 'crypto_lock_rand' */
667 crypto_lock_rand = 0;
669 CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
675 /* rand_hw_seed: get seed data from any available hardware RNG.
676 * only currently supports rdrand.
679 /* Adapted from eng_rdrand.c */
681 #if (defined(__i386) || defined(__i386__) || defined(_M_IX86) || \
682 defined(__x86_64) || defined(__x86_64__) || \
683 defined(_M_AMD64) || defined (_M_X64)) && defined(OPENSSL_CPUID_OBJ)
685 #define RDRAND_CALLS 4
687 size_t OPENSSL_ia32_rdrand(void);
688 extern unsigned int OPENSSL_ia32cap_P[];
690 static void rand_hw_seed(EVP_MD_CTX *ctx)
693 if (!(OPENSSL_ia32cap_P[1] & (1<<(62-32))))
695 for (i = 0; i < RDRAND_CALLS; i++)
698 rnd = OPENSSL_ia32_rdrand();
701 MD_Update(ctx, (unsigned char *)&rnd, sizeof(size_t));
705 /* XOR an existing buffer with random data */
707 void rand_hw_xor(unsigned char *buf, size_t num)
710 if (!(OPENSSL_ia32cap_P[1] & (1<<(62-32))))
712 while (num >= sizeof(size_t))
714 rnd = OPENSSL_ia32_rdrand();
717 *((size_t *)buf) ^= rnd;
718 buf += sizeof(size_t);
719 num -= sizeof(size_t);
723 rnd = OPENSSL_ia32_rdrand();
739 static void rand_hw_seed(EVP_MD_CTX *ctx)
744 void rand_hw_xor(unsigned char *buf, size_t num)