1 /* crypto/rand/md_rand.c */
2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
58 /* ====================================================================
59 * Copyright (c) 1998-2001 The OpenSSL Project. All rights reserved.
61 * Redistribution and use in source and binary forms, with or without
62 * modification, are permitted provided that the following conditions
65 * 1. Redistributions of source code must retain the above copyright
66 * notice, this list of conditions and the following disclaimer.
68 * 2. Redistributions in binary form must reproduce the above copyright
69 * notice, this list of conditions and the following disclaimer in
70 * the documentation and/or other materials provided with the
73 * 3. All advertising materials mentioning features or use of this
74 * software must display the following acknowledgment:
75 * "This product includes software developed by the OpenSSL Project
76 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
78 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79 * endorse or promote products derived from this software without
80 * prior written permission. For written permission, please contact
81 * openssl-core@openssl.org.
83 * 5. Products derived from this software may not be called "OpenSSL"
84 * nor may "OpenSSL" appear in their names without prior written
85 * permission of the OpenSSL Project.
87 * 6. Redistributions of any form whatsoever must retain the following
89 * "This product includes software developed by the OpenSSL Project
90 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
92 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
96 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103 * OF THE POSSIBILITY OF SUCH DAMAGE.
104 * ====================================================================
106 * This product includes cryptographic software written by Eric Young
107 * (eay@cryptsoft.com). This product includes software written by Tim
108 * Hudson (tjh@cryptsoft.com).
112 #define OPENSSL_FIPSAPI
126 #if !(defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_VXWORKS) || defined(OPENSSL_SYSNAME_DSPBIOS))
127 # include <sys/time.h>
129 #if defined(OPENSSL_SYS_VXWORKS)
133 #include <openssl/crypto.h>
134 #include <openssl/rand.h>
135 #include "rand_lcl.h"
137 #include <openssl/err.h>
140 #include <openssl/fips.h>
147 /* #define PREDICT 1 */
149 #define STATE_SIZE 1023
150 static int state_num=0,state_index=0;
151 static unsigned char state[STATE_SIZE+MD_DIGEST_LENGTH];
152 static unsigned char md[MD_DIGEST_LENGTH];
153 static long md_count[2]={0,0};
154 static double entropy=0;
155 static int initialized=0;
157 static unsigned int crypto_lock_rand = 0; /* may be set only when a thread
158 * holds CRYPTO_LOCK_RAND
159 * (to prevent double locking) */
160 /* access to lockin_thread is synchronized by CRYPTO_LOCK_RAND2 */
161 static CRYPTO_THREADID locking_threadid; /* valid iff crypto_lock_rand is set */
165 int rand_predictable=0;
168 const char RAND_version[]="RAND" OPENSSL_VERSION_PTEXT;
170 static void rand_hw_seed(EVP_MD_CTX *ctx);
172 static void ssleay_rand_cleanup(void);
173 static int ssleay_rand_seed(const void *buf, int num);
174 static int ssleay_rand_add(const void *buf, int num, double add_entropy);
175 static int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo);
176 static int ssleay_rand_nopseudo_bytes(unsigned char *buf, int num);
177 static int ssleay_rand_pseudo_bytes(unsigned char *buf, int num);
178 static int ssleay_rand_status(void);
180 static RAND_METHOD rand_ssleay_meth={
182 ssleay_rand_nopseudo_bytes,
185 ssleay_rand_pseudo_bytes,
189 RAND_METHOD *RAND_SSLeay(void)
191 return(&rand_ssleay_meth);
194 static void ssleay_rand_cleanup(void)
196 OPENSSL_cleanse(state,sizeof(state));
199 OPENSSL_cleanse(md,MD_DIGEST_LENGTH);
206 static int ssleay_rand_add(const void *buf, int num, double add)
210 unsigned char local_md[MD_DIGEST_LENGTH];
219 * (Based on the rand(3) manpage)
221 * The input is chopped up into units of 20 bytes (or less for
222 * the last block). Each of these blocks is run through the hash
223 * function as follows: The data passed to the hash function
224 * is the current 'md', the same number of bytes from the 'state'
225 * (the location determined by in incremented looping index) as
226 * the current 'block', the new key data 'block', and 'count'
227 * (which is incremented after each use).
228 * The result of this is kept in 'md' and also xored into the
229 * 'state' at the same locations that were used as input into the
234 /* check if we already have the lock */
235 if (crypto_lock_rand)
238 CRYPTO_THREADID_current(&cur);
239 CRYPTO_r_lock(CRYPTO_LOCK_RAND2);
240 do_not_lock = !CRYPTO_THREADID_cmp(&locking_threadid, &cur);
241 CRYPTO_r_unlock(CRYPTO_LOCK_RAND2);
246 if (!do_not_lock) CRYPTO_w_lock(CRYPTO_LOCK_RAND);
249 /* use our own copies of the counters so that even
250 * if a concurrent thread seeds with exactly the
251 * same data and uses the same subarray there's _some_
253 md_c[0] = md_count[0];
254 md_c[1] = md_count[1];
256 memcpy(local_md, md, sizeof md);
258 /* state_index <= state_num <= STATE_SIZE */
260 if (state_index >= STATE_SIZE)
262 state_index%=STATE_SIZE;
263 state_num=STATE_SIZE;
265 else if (state_num < STATE_SIZE)
267 if (state_index > state_num)
268 state_num=state_index;
270 /* state_index <= state_num <= STATE_SIZE */
272 /* state[st_idx], ..., state[(st_idx + num - 1) % STATE_SIZE]
273 * are what we will use now, but other threads may use them
276 md_count[1] += (num / MD_DIGEST_LENGTH) + (num % MD_DIGEST_LENGTH > 0);
278 if (!do_not_lock) CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
280 for (i=0; i<num; i+=MD_DIGEST_LENGTH)
283 j=(j > MD_DIGEST_LENGTH)?MD_DIGEST_LENGTH:j;
287 if (!MD_Update(&m,local_md,MD_DIGEST_LENGTH))
289 k=(st_idx+j)-STATE_SIZE;
292 if (!MD_Update(&m,&(state[st_idx]),j-k))
294 if (!MD_Update(&m,&(state[0]),k))
298 if (!MD_Update(&m,&(state[st_idx]),j))
301 /* DO NOT REMOVE THE FOLLOWING CALL TO MD_Update()! */
302 if (!MD_Update(&m,buf,j))
304 /* We know that line may cause programs such as
305 purify and valgrind to complain about use of
306 uninitialized data. The problem is not, it's
307 with the caller. Removing that line will make
308 sure you get really bad randomness and thereby
309 other problems such as very insecure keys. */
311 if (!MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c)))
313 if (!MD_Final(&m,local_md))
317 buf=(const char *)buf + j;
321 /* Parallel threads may interfere with this,
322 * but always each byte of the new state is
323 * the XOR of some previous value of its
324 * and local_md (itermediate values may be lost).
325 * Alway using locking could hurt performance more
326 * than necessary given that conflicts occur only
327 * when the total seeding is longer than the random
329 state[st_idx++]^=local_md[k];
330 if (st_idx >= STATE_SIZE)
335 if (!do_not_lock) CRYPTO_w_lock(CRYPTO_LOCK_RAND);
336 /* Don't just copy back local_md into md -- this could mean that
337 * other thread's seeding remains without effect (except for
338 * the incremented counter). By XORing it we keep at least as
339 * much entropy as fits into md. */
340 for (k = 0; k < (int)sizeof(md); k++)
342 md[k] ^= local_md[k];
344 if (entropy < ENTROPY_NEEDED) /* stop counting when we have enough */
346 if (!do_not_lock) CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
348 #if !defined(OPENSSL_THREADS) && !defined(OPENSSL_SYS_WIN32)
349 assert(md_c[1] == md_count[1]);
353 EVP_MD_CTX_cleanup(&m);
357 static int ssleay_rand_seed(const void *buf, int num)
359 return ssleay_rand_add(buf, num, (double)num);
362 static int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo)
364 static volatile int stirred_pool = 0;
365 int i,j,k,st_num,st_idx;
369 unsigned char local_md[MD_DIGEST_LENGTH];
371 #ifndef GETPID_IS_MEANINGLESS
372 pid_t curr_pid = getpid();
374 time_t curr_time = time(NULL);
375 int do_stir_pool = 0;
376 /* time value for various platforms */
377 #ifdef OPENSSL_SYS_WIN32
382 SystemTimeToFileTime(&t, &tv);
384 GetSystemTimeAsFileTime(&tv);
386 #elif defined(OPENSSL_SYS_VXWORKS)
388 clock_gettime(CLOCK_REALTIME, &ts);
389 #elif defined(OPENSSL_SYSNAME_DSPBIOS)
390 unsigned long long tv, OPENSSL_rdtsc();
391 tv = OPENSSL_rdtsc();
394 gettimeofday(&tv, NULL);
398 if (rand_predictable)
400 static unsigned char val=0;
402 for (i=0; i<num; i++)
412 /* round upwards to multiple of MD_DIGEST_LENGTH/2 */
413 num_ceil = (1 + (num-1)/(MD_DIGEST_LENGTH/2)) * (MD_DIGEST_LENGTH/2);
416 * (Based on the rand(3) manpage:)
418 * For each group of 10 bytes (or less), we do the following:
420 * Input into the hash function the local 'md' (which is initialized from
421 * the global 'md' before any bytes are generated), the bytes that are to
422 * be overwritten by the random bytes, and bytes from the 'state'
423 * (incrementing looping index). From this digest output (which is kept
424 * in 'md'), the top (up to) 10 bytes are returned to the caller and the
425 * bottom 10 bytes are xored into the 'state'.
427 * Finally, after we have finished 'num' random bytes for the
428 * caller, 'count' (which is incremented) and the local and global 'md'
429 * are fed into the hash function and the results are kept in the
433 CRYPTO_w_lock(CRYPTO_LOCK_RAND);
435 /* prevent ssleay_rand_bytes() from trying to obtain the lock again */
436 CRYPTO_w_lock(CRYPTO_LOCK_RAND2);
437 CRYPTO_THREADID_current(&locking_threadid);
438 CRYPTO_w_unlock(CRYPTO_LOCK_RAND2);
439 crypto_lock_rand = 1;
450 ok = (entropy >= ENTROPY_NEEDED);
453 /* If the PRNG state is not yet unpredictable, then seeing
454 * the PRNG output may help attackers to determine the new
455 * state; thus we have to decrease the entropy estimate.
456 * Once we've had enough initial seeding we don't bother to
457 * adjust the entropy count, though, because we're not ambitious
458 * to provide *information-theoretic* randomness.
460 * NOTE: This approach fails if the program forks before
461 * we have enough entropy. Entropy should be collected
462 * in a separate input pool and be transferred to the
463 * output pool only when the entropy limit has been reached.
472 /* In the output function only half of 'md' remains secret,
473 * so we better make sure that the required entropy gets
474 * 'evenly distributed' through 'state', our randomness pool.
475 * The input function (ssleay_rand_add) chains all of 'md',
476 * which makes it more suitable for this purpose.
479 int n = STATE_SIZE; /* so that the complete pool gets accessed */
482 #if MD_DIGEST_LENGTH > 20
483 # error "Please adjust DUMMY_SEED."
485 #define DUMMY_SEED "...................." /* at least MD_DIGEST_LENGTH */
486 /* Note that the seed does not matter, it's just that
487 * ssleay_rand_add expects to have something to hash. */
488 ssleay_rand_add(DUMMY_SEED, MD_DIGEST_LENGTH, 0.0);
489 n -= MD_DIGEST_LENGTH;
497 md_c[0] = md_count[0];
498 md_c[1] = md_count[1];
499 memcpy(local_md, md, sizeof md);
501 state_index+=num_ceil;
502 if (state_index > state_num)
503 state_index %= state_num;
505 /* state[st_idx], ..., state[(st_idx + num_ceil - 1) % st_num]
506 * are now ours (but other threads may use them too) */
510 /* before unlocking, we must clear 'crypto_lock_rand' */
511 crypto_lock_rand = 0;
512 CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
516 /* num_ceil -= MD_DIGEST_LENGTH/2 */
517 j=(num >= MD_DIGEST_LENGTH/2)?MD_DIGEST_LENGTH/2:num;
521 #ifndef GETPID_IS_MEANINGLESS
522 if (curr_pid) /* just in the first iteration to save time */
524 if (!MD_Update(&m,(unsigned char*)&curr_pid,
530 if (curr_time) /* just in the first iteration to save time */
532 if (!MD_Update(&m,(unsigned char*)&curr_time,
535 if (!MD_Update(&m,(unsigned char*)&tv,
541 if (!MD_Update(&m,local_md,MD_DIGEST_LENGTH))
543 if (!MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c)))
546 #ifndef PURIFY /* purify complains */
547 /* The following line uses the supplied buffer as a small
548 * source of entropy: since this buffer is often uninitialised
549 * it may cause programs such as purify or valgrind to
550 * complain. So for those builds it is not used: the removal
551 * of such a small source of entropy has negligible impact on
554 if (!MD_Update(&m,buf,j))
558 k=(st_idx+MD_DIGEST_LENGTH/2)-st_num;
561 if (!MD_Update(&m,&(state[st_idx]),MD_DIGEST_LENGTH/2-k))
563 if (!MD_Update(&m,&(state[0]),k))
567 if (!MD_Update(&m,&(state[st_idx]),MD_DIGEST_LENGTH/2))
569 if (!MD_Final(&m,local_md))
572 for (i=0; i<MD_DIGEST_LENGTH/2; i++)
574 state[st_idx++]^=local_md[i]; /* may compete with other threads */
575 if (st_idx >= st_num)
578 *(buf++)=local_md[i+MD_DIGEST_LENGTH/2];
583 || !MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c))
584 || !MD_Update(&m,local_md,MD_DIGEST_LENGTH))
586 CRYPTO_w_lock(CRYPTO_LOCK_RAND);
587 if (!MD_Update(&m,md,MD_DIGEST_LENGTH) || !MD_Final(&m,md))
589 CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
592 CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
594 EVP_MD_CTX_cleanup(&m);
601 RANDerr(RAND_F_SSLEAY_RAND_BYTES,RAND_R_PRNG_NOT_SEEDED);
602 ERR_add_error_data(1, "You need to read the OpenSSL FAQ, "
603 "http://www.openssl.org/support/faq.html");
607 EVP_MD_CTX_cleanup(&m);
608 RANDerr(RAND_F_SSLEAY_RAND_BYTES,ERR_R_EVP_LIB);
613 static int ssleay_rand_nopseudo_bytes(unsigned char *buf, int num)
615 return ssleay_rand_bytes(buf, num, 0);
618 /* pseudo-random bytes that are guaranteed to be unique but not
620 static int ssleay_rand_pseudo_bytes(unsigned char *buf, int num)
622 return ssleay_rand_bytes(buf, num, 1);
625 static int ssleay_rand_status(void)
631 CRYPTO_THREADID_current(&cur);
632 /* check if we already have the lock
633 * (could happen if a RAND_poll() implementation calls RAND_status()) */
634 if (crypto_lock_rand)
636 CRYPTO_r_lock(CRYPTO_LOCK_RAND2);
637 do_not_lock = !CRYPTO_THREADID_cmp(&locking_threadid, &cur);
638 CRYPTO_r_unlock(CRYPTO_LOCK_RAND2);
645 CRYPTO_w_lock(CRYPTO_LOCK_RAND);
647 /* prevent ssleay_rand_bytes() from trying to obtain the lock again */
648 CRYPTO_w_lock(CRYPTO_LOCK_RAND2);
649 CRYPTO_THREADID_cpy(&locking_threadid, &cur);
650 CRYPTO_w_unlock(CRYPTO_LOCK_RAND2);
651 crypto_lock_rand = 1;
660 ret = entropy >= ENTROPY_NEEDED;
664 /* before unlocking, we must clear 'crypto_lock_rand' */
665 crypto_lock_rand = 0;
667 CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
673 /* rand_hw_seed: get seed data from any available hardware RNG.
674 * only currently supports rdrand.
677 /* Adapted from eng_rdrand.c */
679 #if (defined(__i386) || defined(__i386__) || defined(_M_IX86) || \
680 defined(__x86_64) || defined(__x86_64__) || \
681 defined(_M_AMD64) || defined (_M_X64)) && defined(OPENSSL_CPUID_OBJ)
683 #define RDRAND_CALLS 4
685 size_t OPENSSL_ia32_rdrand(void);
686 extern unsigned int OPENSSL_ia32cap_P[];
688 static void rand_hw_seed(EVP_MD_CTX *ctx)
691 if (!(OPENSSL_ia32cap_P[1] & (1<<(62-32))))
693 for (i = 0; i < RDRAND_CALLS; i++)
696 rnd = OPENSSL_ia32_rdrand();
699 MD_Update(ctx, (unsigned char *)&rnd, sizeof(size_t));
703 /* XOR an existing buffer with random data */
705 void rand_hw_xor(unsigned char *buf, size_t num)
708 if (!(OPENSSL_ia32cap_P[1] & (1<<(62-32))))
710 while (num >= sizeof(size_t))
712 rnd = OPENSSL_ia32_rdrand();
715 *((size_t *)buf) ^= rnd;
716 buf += sizeof(size_t);
717 num -= sizeof(size_t);
721 rnd = OPENSSL_ia32_rdrand();
737 static void rand_hw_seed(EVP_MD_CTX *ctx)
742 void rand_hw_xor(unsigned char *buf, size_t num)