X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff_plain;f=crypto%2Frand%2Fmd_rand.c;h=79438611f284abd48e54b000a54afb6532d3f3ef;hp=f44b36a8b913fff25937421cf6e79dc908539571;hb=4ec2d4d2b3a8cba1fdc656acd6b19d003191d779;hpb=78414a6a897db42c9bcf06aa21c705811ab33921 diff --git a/crypto/rand/md_rand.c b/crypto/rand/md_rand.c index f44b36a8b9..79438611f2 100644 --- a/crypto/rand/md_rand.c +++ b/crypto/rand/md_rand.c @@ -56,22 +56,35 @@ * [including the GNU Public Licence.] */ +#define ENTROPY_NEEDED 16 /* require 128 bits = 16 bytes of randomness */ + +#ifndef MD_RAND_DEBUG +# ifndef NDEBUG +# define NDEBUG +# endif +#endif + +#include #include -#include "cryptlib.h" -#include #include +#include + +#include "openssl/e_os.h" + +#include +#include #if !defined(USE_MD5_RAND) && !defined(USE_SHA1_RAND) && !defined(USE_MDC2_RAND) && !defined(USE_MD2_RAND) -#ifndef NO_MD5 -#define USE_MD5_RAND -#elif !defined(NO_SHA1) +#if !defined(NO_SHA) && !defined(NO_SHA1) #define USE_SHA1_RAND -#elif !defined(NO_MDC2) +#elif !defined(NO_MD5) +#define USE_MD5_RAND +#elif !defined(NO_MDC2) && !defined(NO_DES) #define USE_MDC2_RAND #elif !defined(NO_MD2) #define USE_MD2_RAND #else -We need a message digest of some type +#error No message digest algorithm available #endif #endif @@ -82,73 +95,124 @@ We need a message digest of some type */ #if defined(USE_MD5_RAND) -#include "md5.h" +#include #define MD_DIGEST_LENGTH MD5_DIGEST_LENGTH #define MD_CTX MD5_CTX #define MD_Init(a) MD5_Init(a) #define MD_Update(a,b,c) MD5_Update(a,b,c) #define MD_Final(a,b) MD5_Final(a,b) +#define MD(a,b,c) MD5(a,b,c) #elif defined(USE_SHA1_RAND) -#include "sha.h" +#include #define MD_DIGEST_LENGTH SHA_DIGEST_LENGTH #define MD_CTX SHA_CTX #define MD_Init(a) SHA1_Init(a) #define MD_Update(a,b,c) SHA1_Update(a,b,c) #define MD_Final(a,b) SHA1_Final(a,b) +#define MD(a,b,c) SHA1(a,b,c) #elif defined(USE_MDC2_RAND) -#include "mdc2.h" +#include #define MD_DIGEST_LENGTH MDC2_DIGEST_LENGTH #define MD_CTX MDC2_CTX #define MD_Init(a) MDC2_Init(a) #define MD_Update(a,b,c) MDC2_Update(a,b,c) #define MD_Final(a,b) MDC2_Final(a,b) +#define MD(a,b,c) MDC2(a,b,c) #elif defined(USE_MD2_RAND) -#include "md2.h" +#include #define MD_DIGEST_LENGTH MD2_DIGEST_LENGTH #define MD_CTX MD2_CTX #define MD_Init(a) MD2_Init(a) #define MD_Update(a,b,c) MD2_Update(a,b,c) #define MD_Final(a,b) MD2_Final(a,b) +#define MD(a,b,c) MD2(a,b,c) #endif -#include "rand.h" +#include -/*#define NORAND 1 */ -/*#define PREDICT 1 */ +/* #define NORAND 1 */ +/* #define PREDICT 1 */ #define STATE_SIZE 1023 static int state_num=0,state_index=0; static unsigned char state[STATE_SIZE+MD_DIGEST_LENGTH]; static unsigned char md[MD_DIGEST_LENGTH]; -static int md_count=0; - -char *RAND_version="RAND part of SSLeay 0.9.0b 29-Jun-1998"; +static long md_count[2]={0,0}; +static double entropy=0; +static int initialized=0; + +const char *RAND_version="RAND" OPENSSL_VERSION_PTEXT; + +static void ssleay_rand_cleanup(void); +static void ssleay_rand_seed(const void *buf, int num); +static void ssleay_rand_add(const void *buf, int num, double add_entropy); +static int ssleay_rand_bytes(unsigned char *buf, int num); +static int ssleay_rand_pseudo_bytes(unsigned char *buf, int num); + +RAND_METHOD rand_ssleay_meth={ + ssleay_rand_seed, + ssleay_rand_bytes, + ssleay_rand_cleanup, + ssleay_rand_add, + ssleay_rand_pseudo_bytes, + }; + +RAND_METHOD *RAND_SSLeay(void) + { + return(&rand_ssleay_meth); + } -void RAND_cleanup() +static void ssleay_rand_cleanup(void) { memset(state,0,sizeof(state)); state_num=0; state_index=0; memset(md,0,MD_DIGEST_LENGTH); - md_count=0; + md_count[0]=0; + md_count[1]=0; + entropy=0; } -void RAND_seed(buf,num) -unsigned char *buf; -int num; +static void ssleay_rand_add(const void *buf, int num, double add) { - int i,j,k,st_idx,st_num; + int i,j,k,st_idx; + long md_c[2]; + unsigned char local_md[MD_DIGEST_LENGTH]; MD_CTX m; #ifdef NORAND return; #endif + /* + * (Based on the rand(3) manpage) + * + * The input is chopped up into units of 20 bytes (or less for + * the last block). Each of these blocks is run through the hash + * function as follows: The data passed to the hash function + * is the current 'md', the same number of bytes from the 'state' + * (the location determined by in incremented looping index) as + * the current 'block', the new key data 'block', and 'count' + * (which is incremented after each use). + * The result of this is kept in 'md' and also xored into the + * 'state' at the same locations that were used as input into the + * hash function. + */ + CRYPTO_w_lock(CRYPTO_LOCK_RAND); st_idx=state_index; - st_num=state_num; - state_index=(state_index+num); + /* use our own copies of the counters so that even + * if a concurrent thread seeds with exactly the + * same data and uses the same subarray there's _some_ + * difference */ + md_c[0] = md_count[0]; + md_c[1] = md_count[1]; + + memcpy(local_md, md, sizeof md); + + /* state_index <= state_num <= STATE_SIZE */ + state_index += num; if (state_index >= STATE_SIZE) { state_index%=STATE_SIZE; @@ -159,6 +223,14 @@ int num; if (state_index > state_num) state_num=state_index; } + /* state_index <= state_num <= STATE_SIZE */ + + /* state[st_idx], ..., state[(st_idx + num - 1) % STATE_SIZE] + * are what we will use now, but other threads may use them + * as well */ + + md_count[1] += (num / MD_DIGEST_LENGTH) + (num % MD_DIGEST_LENGTH > 0); + CRYPTO_w_unlock(CRYPTO_LOCK_RAND); for (i=0; i MD_DIGEST_LENGTH)?MD_DIGEST_LENGTH:j; MD_Init(&m); - MD_Update(&m,md,MD_DIGEST_LENGTH); + MD_Update(&m,local_md,MD_DIGEST_LENGTH); k=(st_idx+j)-STATE_SIZE; if (k > 0) { @@ -178,97 +250,158 @@ int num; MD_Update(&m,&(state[st_idx]),j); MD_Update(&m,buf,j); - MD_Final(md,&m); + MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c)); + MD_Final(local_md,&m); + md_c[1]++; - buf+=j; + buf=(const char *)buf + j; for (k=0; k= STATE_SIZE) - { st_idx=0; - st_num=STATE_SIZE; - } } } memset((char *)&m,0,sizeof(m)); + + CRYPTO_w_lock(CRYPTO_LOCK_RAND); + /* Don't just copy back local_md into md -- this could mean that + * other thread's seeding remains without effect (except for + * the incremented counter). By XORing it we keep at least as + * much entropy as fits into md. */ + for (k = 0; k < sizeof md; k++) + { + md[k] ^= local_md[k]; + } + CRYPTO_w_unlock(CRYPTO_LOCK_RAND); + +#ifndef THREADS + assert(md_c[1] == md_count[1]); +#endif + if (entropy < ENTROPY_NEEDED) /* stop counting when we have enough */ + entropy += add; } -void RAND_bytes(buf,num) -unsigned char *buf; -int num; +static void ssleay_rand_seed(const void *buf, int num) + { + ssleay_rand_add(buf, num, num); + } + +static void ssleay_rand_initialize(void) { - int i,j,k,st_num,st_idx; - MD_CTX m; - static int init=1; unsigned long l; +#ifndef GETPID_IS_MEANINGLESS + pid_t curr_pid = getpid(); +#endif #ifdef DEVRANDOM FILE *fh; #endif + CRYPTO_w_unlock(CRYPTO_LOCK_RAND); + /* put in some default random data, we need more than just this */ +#ifndef GETPID_IS_MEANINGLESS + l=curr_pid; + RAND_add(&l,sizeof(l),0); + l=getuid(); + RAND_add(&l,sizeof(l),0); +#endif + l=time(NULL); + RAND_add(&l,sizeof(l),0); + +#ifdef DEVRANDOM + /* Use a random entropy pool device. Linux and FreeBSD have + * this. Use /dev/urandom if you can as /dev/random will block + * if it runs out of random entries. */ + + if ((fh = fopen(DEVRANDOM, "r")) != NULL) + { + unsigned char tmpbuf[ENTROPY_NEEDED]; + int n; + + n=fread((unsigned char *)tmpbuf,1,ENTROPY_NEEDED,fh); + fclose(fh); + RAND_add(tmpbuf,sizeof tmpbuf,n); + memset(tmpbuf,0,n); + } +#endif +#ifdef PURIFY + memset(state,0,STATE_SIZE); + memset(md,0,MD_DIGEST_LENGTH); +#endif + CRYPTO_w_lock(CRYPTO_LOCK_RAND); + initialized=1; + } + +static int ssleay_rand_bytes(unsigned char *buf, int num) + { + int i,j,k,st_num,st_idx; + int ok; + long md_c[2]; + unsigned char local_md[MD_DIGEST_LENGTH]; + MD_CTX m; +#ifndef GETPID_IS_MEANINGLESS + pid_t curr_pid = getpid(); +#endif + #ifdef PREDICT { static unsigned char val=0; for (i=0; i= ENTROPY_NEEDED); st_idx=state_index; st_num=state_num; + md_c[0] = md_count[0]; + md_c[1] = md_count[1]; + memcpy(local_md, md, sizeof md); + state_index+=num; if (state_index > state_num) - state_index=(state_index%state_num); + state_index %= state_num; + /* state[st_idx], ..., state[(st_idx + num - 1) % st_num] + * are now ours (but other threads may use them too) */ + + md_count[0] += 1; CRYPTO_w_unlock(CRYPTO_LOCK_RAND); while (num > 0) @@ -276,7 +409,15 @@ int num; j=(num >= MD_DIGEST_LENGTH/2)?MD_DIGEST_LENGTH/2:num; num-=j; MD_Init(&m); - MD_Update(&m,&(md[MD_DIGEST_LENGTH/2]),MD_DIGEST_LENGTH/2); +#ifndef GETPID_IS_MEANINGLESS + if (curr_pid) /* just in the first iteration to save time */ + { + MD_Update(&m,(unsigned char*)&curr_pid,sizeof curr_pid); + curr_pid = 0; + } +#endif + MD_Update(&m,&(local_md[MD_DIGEST_LENGTH/2]),MD_DIGEST_LENGTH/2); + MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c)); #ifndef PURIFY MD_Update(&m,buf,j); /* purify complains */ #endif @@ -288,27 +429,62 @@ int num; } else MD_Update(&m,&(state[st_idx]),j); - MD_Final(md,&m); + MD_Final(local_md,&m); for (i=0; i= st_num) st_idx=0; - state[st_idx++]^=md[i]; - *(buf++)=md[i+MD_DIGEST_LENGTH/2]; } } MD_Init(&m); - MD_Update(&m,(unsigned char *)&md_count,sizeof(md_count)); md_count++; + MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c)); + MD_Update(&m,local_md,MD_DIGEST_LENGTH); + CRYPTO_w_lock(CRYPTO_LOCK_RAND); MD_Update(&m,md,MD_DIGEST_LENGTH); MD_Final(md,&m); + CRYPTO_w_unlock(CRYPTO_LOCK_RAND); + memset(&m,0,sizeof(m)); + if (ok) + return(1); + else + { + RANDerr(RAND_F_SSLEAY_RAND_BYTES,RAND_R_PRNG_NOT_SEEDED); + return(0); + } + } + +/* pseudo-random bytes that are guaranteed to be unique but not + unpredictable */ +static int ssleay_rand_pseudo_bytes(unsigned char *buf, int num) + { + int ret, err; + + ret = RAND_bytes(buf, num); + if (ret == 0) + { + err = ERR_peek_error(); + if (ERR_GET_LIB(err) == ERR_LIB_RAND && + ERR_GET_REASON(err) == RAND_R_PRNG_NOT_SEEDED) + (void)ERR_get_error(); + } + return (ret); + } + +int RAND_status(void) + { + if (!initialized) + ssleay_rand_initialize(); + return (entropy >= ENTROPY_NEEDED); } #ifdef WINDOWS #include -#include +#include /***************************************************************************** * Initialisation function for the SSL random generator. Takes the contents @@ -320,22 +496,22 @@ int num; * ; * the original copyright message is: * -// (C) Copyright Microsoft Corp. 1993. All rights reserved. -// -// You have a royalty-free right to use, modify, reproduce and -// distribute the Sample Files (and/or any modified version) in -// any way you find useful, provided that you agree that -// Microsoft has no warranty obligations or liability for any -// Sample Application Files which are modified. + * (C) Copyright Microsoft Corp. 1993. All rights reserved. + * + * You have a royalty-free right to use, modify, reproduce and + * distribute the Sample Files (and/or any modified version) in + * any way you find useful, provided that you agree that + * Microsoft has no warranty obligations or liability for any + * Sample Application Files which are modified. */ /* * I have modified the loading of bytes via RAND_seed() mechanism since - * the origional would have been very very CPU intensive since RAND_seed() + * the original would have been very very CPU intensive since RAND_seed() * does an MD5 per 16 bytes of input. The cost to digest 16 bytes is the same * as that to digest 56 bytes. So under the old system, a screen of - * 1024*768*256 would have been CPU cost of approximatly 49,000 56 byte MD5 + * 1024*768*256 would have been CPU cost of approximately 49,000 56 byte MD5 * digests or digesting 2.7 mbytes. What I have put in place would - * be 48 16k MD5 digests, or efectivly 48*16+48 MD5 bytes or 816 kbytes + * be 48 16k MD5 digests, or effectively 48*16+48 MD5 bytes or 816 kbytes * or about 3.5 times as much. * - eric */ @@ -385,7 +561,7 @@ void RAND_screen(void) GetBitmapBits(hBitmap, size, bmbits); /* Get the MD5 of the bitmap */ - MD5(bmbits,size,md); + MD(bmbits,size,md); /* Seed the random generator with the MD5 digest */ RAND_seed(md, MD_DIGEST_LENGTH);