Add entropy gathering code. This will work whether the module is
compiled in or loaded.
This commit is contained in:
Mark Murray
parent
f2542885f0
commit
c9ec235ca1
@ -225,6 +225,7 @@ dev/ppbus/ppi.c optional ppi
|
||||
dev/ppbus/pps.c optional pps
|
||||
dev/ppbus/vpo.c optional vpo
|
||||
dev/ppbus/vpoio.c optional vpo
|
||||
dev/randomdev/harvest.c standard
|
||||
dev/randomdev/randomdev.c optional randomdev
|
||||
dev/randomdev/yarrow.c optional randomdev
|
||||
crypto/blowfish/bf_cbc.c optional randomdev
|
||||
|
||||
81
sys/dev/random/harvest.c
Normal file
81
sys/dev/random/harvest.c
Normal file
@ -0,0 +1,81 @@
|
||||
/*-
|
||||
* Copyright (c) 2000 Mark R V Murray
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer
|
||||
* in this position and unchanged.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
|
||||
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
||||
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
|
||||
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
|
||||
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
* $FreeBSD$
|
||||
*/
|
||||
|
||||
#include <sys/param.h>
|
||||
#include <sys/systm.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/queue.h>
|
||||
#include <sys/linker.h>
|
||||
#include <sys/libkern.h>
|
||||
#include <sys/mbuf.h>
|
||||
#include <sys/random.h>
|
||||
#include <sys/time.h>
|
||||
#include <crypto/blowfish/blowfish.h>
|
||||
|
||||
#include <dev/randomdev/yarrow.h>
|
||||
|
||||
/* hold the address of the routine which is actually called if */
|
||||
/* the ramdomdev is loaded */
|
||||
static void (*reap)(struct timespec *, u_int64_t, u_int, u_int, u_int) = NULL;
|
||||
|
||||
/* Initialise the harvester at load time */
|
||||
void
|
||||
random_init_harvester(void (*reaper)(struct timespec *, u_int64_t, u_int, u_int, u_int))
|
||||
{
|
||||
intrmask_t mask;
|
||||
|
||||
mask = splhigh();
|
||||
reap = reaper;
|
||||
splx(mask);
|
||||
}
|
||||
|
||||
/* Deinitialise the harvester at unload time */
|
||||
void
|
||||
random_deinit_harvester(void)
|
||||
{
|
||||
intrmask_t mask;
|
||||
|
||||
mask = splhigh();
|
||||
reap = NULL;
|
||||
splx(mask);
|
||||
}
|
||||
|
||||
/* Entropy harvesting routine. This is supposed to be fast; do */
|
||||
/* not do anything slow in here! */
|
||||
/* Implemented as in indirect call to allow non-inclusion of */
|
||||
/* the entropy device. */
|
||||
void
|
||||
random_harvest(u_int64_t entropy, u_int bits, u_int frac, u_int source)
|
||||
{
|
||||
struct timespec nanotime;
|
||||
|
||||
if (reap) {
|
||||
getnanotime(&nanotime);
|
||||
(*reap)(&nanotime, entropy, bits, frac, source);
|
||||
}
|
||||
}
|
||||
@ -1,5 +1,5 @@
|
||||
/*-
|
||||
* Copyright (c) 2000 Mark Murray
|
||||
* Copyright (c) 2000 Mark R V Murray
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@ -27,12 +27,12 @@
|
||||
*/
|
||||
|
||||
#include <sys/param.h>
|
||||
#include <sys/queue.h>
|
||||
#include <sys/systm.h>
|
||||
#include <sys/conf.h>
|
||||
#include <sys/fcntl.h>
|
||||
#include <sys/uio.h>
|
||||
#include <sys/kernel.h>
|
||||
#include <sys/kobj.h>
|
||||
#include <sys/malloc.h>
|
||||
#include <sys/module.h>
|
||||
#include <sys/bus.h>
|
||||
@ -46,8 +46,8 @@
|
||||
|
||||
#include <dev/randomdev/yarrow.h>
|
||||
|
||||
static d_read_t randomread;
|
||||
static d_write_t randomwrite;
|
||||
static d_read_t random_read;
|
||||
static d_write_t random_write;
|
||||
|
||||
#define CDEV_MAJOR 2
|
||||
#define RANDOM_MINOR 3
|
||||
@ -56,8 +56,8 @@ static d_write_t randomwrite;
|
||||
static struct cdevsw random_cdevsw = {
|
||||
/* open */ (d_open_t *)nullop,
|
||||
/* close */ (d_close_t *)nullop,
|
||||
/* read */ randomread,
|
||||
/* write */ randomwrite,
|
||||
/* read */ random_read,
|
||||
/* write */ random_write,
|
||||
/* ioctl */ noioctl,
|
||||
/* poll */ nopoll,
|
||||
/* mmap */ nommap,
|
||||
@ -71,52 +71,51 @@ static struct cdevsw random_cdevsw = {
|
||||
};
|
||||
|
||||
/* For use with make_dev(9)/destroy_dev(9). */
|
||||
static dev_t randomdev;
|
||||
static dev_t urandomdev;
|
||||
static dev_t random_dev;
|
||||
static dev_t urandom_dev;
|
||||
|
||||
static void *buf;
|
||||
/* Buffer used by uiomove(9) */
|
||||
static void *random_buf;
|
||||
|
||||
extern void randominit(void);
|
||||
|
||||
extern struct state state;
|
||||
|
||||
/* This is mostly academic at the moment; as Yarrow gets extended, it will
|
||||
become more relevant */
|
||||
SYSCTL_NODE(_kern, OID_AUTO, random, CTLFLAG_RW, 0, "Random Number Generator");
|
||||
SYSCTL_NODE(_kern_random, OID_AUTO, yarrow, CTLFLAG_RW, 0, "Yarrow Parameters");
|
||||
SYSCTL_INT(_kern_random_yarrow, OID_AUTO, gengateinterval, CTLFLAG_RW, &state.gengateinterval, 10, "Generator Gate Interval");
|
||||
SYSCTL_INT(_kern_random_yarrow, OID_AUTO, gengateinterval, CTLFLAG_RW, &random_state.gengateinterval, 10, "Generator Gate Interval");
|
||||
SYSCTL_INT(_kern_random_yarrow, OID_AUTO, bins, CTLFLAG_RW, &random_state.bins, 10, "Execution time tuner");
|
||||
SYSCTL_INT(_kern_random_yarrow, OID_AUTO, fastthresh, CTLFLAG_RW, &random_state.pool[0].thresh, 100, "Fast pool reseed threshhold");
|
||||
SYSCTL_INT(_kern_random_yarrow, OID_AUTO, slowthresh, CTLFLAG_RW, &random_state.pool[1].thresh, 100, "Slow pool reseed threshhold");
|
||||
SYSCTL_INT(_kern_random_yarrow, OID_AUTO, slowoverthresh, CTLFLAG_RW, &random_state.slowoverthresh, 2, "Slow pool over-threshhold reseed count");
|
||||
|
||||
static int
|
||||
randomread(dev_t dev, struct uio *uio, int flag)
|
||||
random_read(dev_t dev, struct uio *uio, int flag)
|
||||
{
|
||||
u_int c, ret;
|
||||
int error = 0;
|
||||
|
||||
c = min(uio->uio_resid, PAGE_SIZE);
|
||||
buf = (void *)malloc(c, M_TEMP, M_WAITOK);
|
||||
random_buf = (void *)malloc(c, M_TEMP, M_WAITOK);
|
||||
while (uio->uio_resid > 0 && error == 0) {
|
||||
ret = read_random(buf, c);
|
||||
error = uiomove(buf, ret, uio);
|
||||
ret = read_random(random_buf, c);
|
||||
error = uiomove(random_buf, ret, uio);
|
||||
}
|
||||
free(buf, M_TEMP);
|
||||
free(random_buf, M_TEMP);
|
||||
return error;
|
||||
}
|
||||
|
||||
static int
|
||||
randomwrite(dev_t dev, struct uio *uio, int flag)
|
||||
random_write(dev_t dev, struct uio *uio, int flag)
|
||||
{
|
||||
u_int c;
|
||||
int error = 0;
|
||||
|
||||
buf = (void *)malloc(PAGE_SIZE, M_TEMP, M_WAITOK);
|
||||
random_buf = (void *)malloc(PAGE_SIZE, M_TEMP, M_WAITOK);
|
||||
while (uio->uio_resid > 0) {
|
||||
c = min(uio->uio_resid, PAGE_SIZE);
|
||||
error = uiomove(buf, c, uio);
|
||||
error = uiomove(random_buf, c, uio);
|
||||
if (error)
|
||||
break;
|
||||
/* write_random(buf, c); */
|
||||
/* write_random(random_buf, c); */
|
||||
}
|
||||
free(buf, M_TEMP);
|
||||
free(random_buf, M_TEMP);
|
||||
return error;
|
||||
}
|
||||
|
||||
@ -127,16 +126,17 @@ random_modevent(module_t mod, int type, void *data)
|
||||
case MOD_LOAD:
|
||||
if (bootverbose)
|
||||
printf("random: <entropy source>\n");
|
||||
randomdev = make_dev(&random_cdevsw, RANDOM_MINOR, UID_ROOT,
|
||||
random_dev = make_dev(&random_cdevsw, RANDOM_MINOR, UID_ROOT,
|
||||
GID_WHEEL, 0666, "random");
|
||||
urandomdev = make_dev(&random_cdevsw, URANDOM_MINOR, UID_ROOT,
|
||||
urandom_dev = make_dev(&random_cdevsw, URANDOM_MINOR, UID_ROOT,
|
||||
GID_WHEEL, 0666, "urandom");
|
||||
randominit();
|
||||
random_init();
|
||||
return 0;
|
||||
|
||||
case MOD_UNLOAD:
|
||||
destroy_dev(randomdev);
|
||||
destroy_dev(urandomdev);
|
||||
random_deinit();
|
||||
destroy_dev(random_dev);
|
||||
destroy_dev(urandom_dev);
|
||||
return 0;
|
||||
|
||||
case MOD_SHUTDOWN:
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
/*-
|
||||
* Copyright (c) 2000 Mark Murray
|
||||
* Copyright (c) 2000 Mark R V Murray
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@ -32,103 +32,166 @@
|
||||
#include <sys/param.h>
|
||||
#include <sys/systm.h>
|
||||
#include <sys/queue.h>
|
||||
#include <sys/taskqueue.h>
|
||||
#include <sys/linker.h>
|
||||
#include <sys/libkern.h>
|
||||
#include <sys/mbuf.h>
|
||||
#include <sys/random.h>
|
||||
#include <sys/time.h>
|
||||
#include <sys/types.h>
|
||||
#include <crypto/blowfish/blowfish.h>
|
||||
|
||||
#include <dev/randomdev/yarrow.h>
|
||||
|
||||
void generator_gate(void);
|
||||
void reseed(void);
|
||||
void randominit(void);
|
||||
/* #define DEBUG */
|
||||
|
||||
/* This is the beastie that needs protecting. It contains all of the
|
||||
* state that we are excited about.
|
||||
*/
|
||||
struct state state;
|
||||
static void generator_gate(void);
|
||||
static void reseed(int);
|
||||
static void random_harvest_internal(struct timespec *nanotime, u_int64_t entropy, u_int bits, u_int frac, u_int source);
|
||||
|
||||
void
|
||||
randominit(void)
|
||||
/* Structure holding the entropy state */
|
||||
struct random_state random_state;
|
||||
|
||||
/* When enough entropy has been harvested, asynchronously "stir" it in */
|
||||
static struct task regate_task;
|
||||
|
||||
static struct context {
|
||||
u_int pool;
|
||||
} context = { 0 };
|
||||
|
||||
static void
|
||||
regate(void *context, int pending)
|
||||
{
|
||||
/* XXX much more to come */
|
||||
state.gengateinterval = 10;
|
||||
#ifdef DEBUG
|
||||
printf("Regate task\n");
|
||||
#endif
|
||||
reseed(((struct context *)context)->pool);
|
||||
}
|
||||
|
||||
void
|
||||
reseed(void)
|
||||
random_init(void)
|
||||
{
|
||||
unsigned char v[BINS][KEYSIZE]; /* v[i] */
|
||||
unsigned char hash[KEYSIZE]; /* h' */
|
||||
#ifdef DEBUG
|
||||
printf("Random init\n");
|
||||
#endif
|
||||
random_state.gengateinterval = 10;
|
||||
random_state.bins = 10;
|
||||
random_state.pool[0].thresh = 100;
|
||||
random_state.pool[1].thresh = 160;
|
||||
random_state.slowoverthresh = 2;
|
||||
random_state.which = FAST;
|
||||
TASK_INIT(®ate_task, 0, ®ate, (void *)&context);
|
||||
random_init_harvester(random_harvest_internal);
|
||||
}
|
||||
|
||||
void
|
||||
random_deinit(void)
|
||||
{
|
||||
#ifdef DEBUG
|
||||
printf("Random deinit\n");
|
||||
#endif
|
||||
random_deinit_harvester();
|
||||
}
|
||||
|
||||
static void
|
||||
reseed(int fastslow)
|
||||
{
|
||||
unsigned char v[TIMEBIN][KEYSIZE]; /* v[i] */
|
||||
unsigned char hash[KEYSIZE]; /* h' */
|
||||
BF_KEY hashkey;
|
||||
unsigned char ivec[8];
|
||||
unsigned char temp[KEYSIZE];
|
||||
struct entropy *bucket;
|
||||
int i, j;
|
||||
|
||||
#ifdef DEBUG
|
||||
printf("Reseed type %d\n", fastslow);
|
||||
#endif
|
||||
|
||||
/* 1. Hash the accumulated entropy into v[0] */
|
||||
|
||||
/* XXX to be done properly */
|
||||
bzero((void *)&v[0], KEYSIZE);
|
||||
for (j = 0; j < sizeof(state.randomstuff); j += KEYSIZE) {
|
||||
BF_set_key(&hashkey, KEYSIZE, &state.randomstuff[j]);
|
||||
BF_cbc_encrypt(v[0], temp, KEYSIZE, &hashkey,
|
||||
ivec, BF_ENCRYPT);
|
||||
memcpy(&v[0], temp, KEYSIZE);
|
||||
if (fastslow == SLOW) {
|
||||
/* Feed a hash of the slow pool into the fast pool */
|
||||
for (i = 0; i < ENTROPYSOURCE; i++) {
|
||||
for (j = 0; j < ENTROPYBIN; j++) {
|
||||
bucket = &random_state.pool[SLOW].source[i].entropy[j];
|
||||
if(bucket->nanotime.tv_sec || bucket->nanotime.tv_nsec) {
|
||||
BF_set_key(&hashkey, sizeof(struct entropy),
|
||||
(void *)bucket);
|
||||
BF_cbc_encrypt(v[0], temp, KEYSIZE, &hashkey, ivec,
|
||||
BF_ENCRYPT);
|
||||
memcpy(&v[0], temp, KEYSIZE);
|
||||
bucket->nanotime.tv_sec = 0;
|
||||
bucket->nanotime.tv_nsec = 0;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
for (i = 0; i < ENTROPYSOURCE; i++) {
|
||||
for (j = 0; j < ENTROPYBIN; j++) {
|
||||
bucket = &random_state.pool[FAST].source[i].entropy[j];
|
||||
if(bucket->nanotime.tv_sec || bucket->nanotime.tv_nsec) {
|
||||
BF_set_key(&hashkey, sizeof(struct entropy), (void *)bucket);
|
||||
BF_cbc_encrypt(v[0], temp, KEYSIZE, &hashkey, ivec, BF_ENCRYPT);
|
||||
memcpy(&v[0], temp, KEYSIZE);
|
||||
bucket->nanotime.tv_sec = 0;
|
||||
bucket->nanotime.tv_nsec = 0;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/* 2. Compute hash values for all v. _Supposed_ to be computationally */
|
||||
/* intensive. */
|
||||
|
||||
for (i = 1; i < BINS; i++) {
|
||||
if (random_state.bins > TIMEBIN)
|
||||
random_state.bins = TIMEBIN;
|
||||
for (i = 1; i < random_state.bins; i++) {
|
||||
bzero((void *)&v[i], KEYSIZE);
|
||||
for (j = 0; j < sizeof(state.randomstuff); j += KEYSIZE) {
|
||||
/* v[i] #= h(v[i-1]) */
|
||||
BF_set_key(&hashkey, KEYSIZE, v[i - 1]);
|
||||
BF_cbc_encrypt(v[i], temp, KEYSIZE, &hashkey,
|
||||
ivec, BF_ENCRYPT);
|
||||
memcpy(&v[i], temp, KEYSIZE);
|
||||
/* v[i] #= h(v[0]) */
|
||||
BF_set_key(&hashkey, KEYSIZE, v[0]);
|
||||
BF_cbc_encrypt(v[i], temp, KEYSIZE, &hashkey,
|
||||
ivec, BF_ENCRYPT);
|
||||
memcpy(&v[i], temp, KEYSIZE);
|
||||
/* v[i] #= h(i) */
|
||||
BF_set_key(&hashkey, sizeof(int), (unsigned char *)&i);
|
||||
BF_cbc_encrypt(v[i], temp, KEYSIZE, &hashkey,
|
||||
ivec, BF_ENCRYPT);
|
||||
memcpy(&v[i], temp, KEYSIZE);
|
||||
}
|
||||
/* v[i] #= h(v[i-1]) */
|
||||
BF_set_key(&hashkey, KEYSIZE, v[i - 1]);
|
||||
BF_cbc_encrypt(v[i], temp, KEYSIZE, &hashkey, ivec, BF_ENCRYPT);
|
||||
memcpy(&v[i], temp, KEYSIZE);
|
||||
/* v[i] #= h(v[0]) */
|
||||
BF_set_key(&hashkey, KEYSIZE, v[0]);
|
||||
BF_cbc_encrypt(v[i], temp, KEYSIZE, &hashkey, ivec, BF_ENCRYPT);
|
||||
memcpy(&v[i], temp, KEYSIZE);
|
||||
/* v[i] #= h(i) */
|
||||
BF_set_key(&hashkey, sizeof(int), (unsigned char *)&i);
|
||||
BF_cbc_encrypt(v[i], temp, KEYSIZE, &hashkey, ivec, BF_ENCRYPT);
|
||||
memcpy(&v[i], temp, KEYSIZE);
|
||||
}
|
||||
|
||||
/* 3. Compute a new Key. */
|
||||
|
||||
bzero((void *)hash, KEYSIZE);
|
||||
BF_set_key(&hashkey, KEYSIZE, (unsigned char *)&state.key);
|
||||
BF_cbc_encrypt(hash, temp, KEYSIZE, &hashkey,
|
||||
ivec, BF_ENCRYPT);
|
||||
BF_set_key(&hashkey, KEYSIZE, (unsigned char *)&random_state.key);
|
||||
BF_cbc_encrypt(hash, temp, KEYSIZE, &hashkey, ivec, BF_ENCRYPT);
|
||||
memcpy(hash, temp, KEYSIZE);
|
||||
for (i = 1; i < BINS; i++) {
|
||||
for (i = 1; i < random_state.bins; i++) {
|
||||
BF_set_key(&hashkey, KEYSIZE, v[i]);
|
||||
BF_cbc_encrypt(hash, temp, KEYSIZE, &hashkey,
|
||||
ivec, BF_ENCRYPT);
|
||||
BF_cbc_encrypt(hash, temp, KEYSIZE, &hashkey, ivec, BF_ENCRYPT);
|
||||
memcpy(hash, temp, KEYSIZE);
|
||||
}
|
||||
|
||||
BF_set_key(&state.key, KEYSIZE, hash);
|
||||
BF_set_key(&random_state.key, KEYSIZE, hash);
|
||||
|
||||
/* 4. Recompute the counter */
|
||||
|
||||
state.counter = 0;
|
||||
BF_cbc_encrypt((unsigned char *)&state.counter, temp,
|
||||
sizeof(state.counter), &state.key, state.ivec,
|
||||
BF_ENCRYPT);
|
||||
memcpy(&state.counter, temp, state.counter);
|
||||
random_state.counter = 0;
|
||||
BF_cbc_encrypt((unsigned char *)&random_state.counter, temp,
|
||||
sizeof(random_state.counter), &random_state.key,
|
||||
random_state.ivec, BF_ENCRYPT);
|
||||
memcpy(&random_state.counter, temp, random_state.counter);
|
||||
|
||||
/* 5. Reset all entropy estimate accumulators to zero */
|
||||
/* 5. Reset entropy estimate accumulators to zero */
|
||||
|
||||
bzero((void *)state.randomstuff, sizeof(state.randomstuff));
|
||||
for (i = 0; i <= fastslow; i++) {
|
||||
for (j = 0; j < ENTROPYSOURCE; j++) {
|
||||
random_state.pool[i].source[j].bits = 0;
|
||||
random_state.pool[i].source[j].frac = 0;
|
||||
}
|
||||
}
|
||||
|
||||
/* 6. Wipe memory of intermediate values */
|
||||
|
||||
@ -151,43 +214,46 @@ read_random(char *buf, u_int count)
|
||||
|
||||
if (gate) {
|
||||
generator_gate();
|
||||
state.outputblocks = 0;
|
||||
random_state.outputblocks = 0;
|
||||
gate = 0;
|
||||
}
|
||||
if (count >= sizeof(state.counter)) {
|
||||
if (count >= sizeof(random_state.counter)) {
|
||||
retval = 0;
|
||||
for (i = 0; i < count; i += sizeof(state.counter)) {
|
||||
state.counter++;
|
||||
BF_cbc_encrypt((unsigned char *)&state.counter,
|
||||
(unsigned char *)&genval, sizeof(state.counter),
|
||||
&state.key, state.ivec, BF_ENCRYPT);
|
||||
memcpy(&buf[i], &genval, sizeof(state.counter));
|
||||
if (++state.outputblocks >= state.gengateinterval) {
|
||||
for (i = 0; i < count; i += sizeof(random_state.counter)) {
|
||||
random_state.counter++;
|
||||
BF_cbc_encrypt((unsigned char *)&random_state.counter,
|
||||
(unsigned char *)&genval,
|
||||
sizeof(random_state.counter),
|
||||
&random_state.key, random_state.ivec, BF_ENCRYPT);
|
||||
memcpy(&buf[i], &genval, sizeof(random_state.counter));
|
||||
if (++random_state.outputblocks >= random_state.gengateinterval) {
|
||||
generator_gate();
|
||||
state.outputblocks = 0;
|
||||
random_state.outputblocks = 0;
|
||||
}
|
||||
retval += sizeof(state.counter);
|
||||
retval += sizeof(random_state.counter);
|
||||
}
|
||||
}
|
||||
else {
|
||||
if (!cur) {
|
||||
state.counter++;
|
||||
BF_cbc_encrypt((unsigned char *)&state.counter,
|
||||
(unsigned char *)&genval, sizeof(state.counter),
|
||||
&state.key, state.ivec, BF_ENCRYPT);
|
||||
random_state.counter++;
|
||||
BF_cbc_encrypt((unsigned char *)&random_state.counter,
|
||||
(unsigned char *)&genval,
|
||||
sizeof(random_state.counter),
|
||||
&random_state.key, random_state.ivec,
|
||||
BF_ENCRYPT);
|
||||
memcpy(buf, &genval, count);
|
||||
cur = sizeof(state.counter) - count;
|
||||
if (++state.outputblocks >= state.gengateinterval) {
|
||||
cur = sizeof(random_state.counter) - count;
|
||||
if (++random_state.outputblocks >= random_state.gengateinterval) {
|
||||
generator_gate();
|
||||
state.outputblocks = 0;
|
||||
random_state.outputblocks = 0;
|
||||
}
|
||||
retval = count;
|
||||
}
|
||||
else {
|
||||
retval = cur < count ? cur : count;
|
||||
memcpy(buf,
|
||||
(char *)&state.counter +
|
||||
(sizeof(state.counter) - retval),
|
||||
(char *)&random_state.counter +
|
||||
(sizeof(random_state.counter) - retval),
|
||||
retval);
|
||||
cur -= retval;
|
||||
}
|
||||
@ -195,19 +261,81 @@ read_random(char *buf, u_int count)
|
||||
return retval;
|
||||
}
|
||||
|
||||
void
|
||||
static void
|
||||
generator_gate(void)
|
||||
{
|
||||
int i;
|
||||
unsigned char temp[KEYSIZE];
|
||||
|
||||
for (i = 0; i < KEYSIZE; i += sizeof(state.counter)) {
|
||||
state.counter++;
|
||||
BF_cbc_encrypt((unsigned char *)&state.counter, &temp[i],
|
||||
sizeof(state.counter), &state.key, state.ivec,
|
||||
BF_ENCRYPT);
|
||||
#ifdef DEBUG
|
||||
/* printf("Generator gate\n"); */
|
||||
#endif
|
||||
for (i = 0; i < KEYSIZE; i += sizeof(random_state.counter)) {
|
||||
random_state.counter++;
|
||||
BF_cbc_encrypt((unsigned char *)&random_state.counter,
|
||||
&(temp[i]), sizeof(random_state.counter),
|
||||
&random_state.key, random_state.ivec, BF_ENCRYPT);
|
||||
}
|
||||
|
||||
BF_set_key(&state.key, KEYSIZE, temp);
|
||||
BF_set_key(&random_state.key, KEYSIZE, temp);
|
||||
bzero((void *)temp, KEYSIZE);
|
||||
}
|
||||
|
||||
/* Entropy harvesting routine. This is supposed to be fast; do */
|
||||
/* not do anything slow in here! */
|
||||
|
||||
static void
|
||||
random_harvest_internal(struct timespec *nanotime, u_int64_t entropy,
|
||||
u_int bits, u_int frac, u_int origin)
|
||||
{
|
||||
u_int insert;
|
||||
int which; /* fast or slow */
|
||||
struct entropy *bucket;
|
||||
struct source *source;
|
||||
struct pool *pool;
|
||||
|
||||
#ifdef DEBUG
|
||||
printf("Random harvest\n");
|
||||
#endif
|
||||
if (origin < ENTROPYSOURCE) {
|
||||
|
||||
which = random_state.which;
|
||||
pool = &random_state.pool[which];
|
||||
source = &pool->source[origin];
|
||||
|
||||
insert = source->current + 1;
|
||||
if (insert >= ENTROPYBIN)
|
||||
insert = 0;
|
||||
|
||||
bucket = &source->entropy[insert];
|
||||
|
||||
if (!bucket->nanotime.tv_sec && !bucket->nanotime.tv_nsec) {
|
||||
|
||||
/* nanotime provides clock jitter */
|
||||
bucket->nanotime = *nanotime;
|
||||
|
||||
/* the harvested entropy */
|
||||
bucket->data = entropy;
|
||||
|
||||
/* update the estimates - including "fractional bits" */
|
||||
source->bits += bits;
|
||||
source->frac += frac;
|
||||
if (source->frac >= 1024) {
|
||||
source->bits += source->frac / 1024;
|
||||
source->frac %= 1024;
|
||||
}
|
||||
context.pool = which;
|
||||
if (source->bits >= pool->thresh) {
|
||||
/* XXX Needs to be multiply queued? */
|
||||
taskqueue_enqueue(taskqueue_swi, ®ate_task);
|
||||
}
|
||||
|
||||
/* bump the insertion point */
|
||||
source->current = insert;
|
||||
|
||||
/* toggle the pool for next time */
|
||||
random_state.which = !random_state.which;
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
/*-
|
||||
* Copyright (c) 2000 Mark Murray
|
||||
* Copyright (c) 2000 Mark R V Murray
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@ -26,17 +26,52 @@
|
||||
* $FreeBSD$
|
||||
*/
|
||||
|
||||
#define BINS 10 /* t */
|
||||
#define KEYSIZE 32 /* 32 bytes == 256 bits */
|
||||
#define ENTROPYBIN 256 /* buckets to harvest entropy events */
|
||||
#define ENTROPYSOURCE 2 /* entropy sources (actually classes) */
|
||||
/* The entropy classes will as follows: */
|
||||
/* 0 - Keyboard */
|
||||
/* 1 - Mouse */
|
||||
/* to start with. More will be added */
|
||||
|
||||
#define TIMEBIN 16 /* max value for Pt/t */
|
||||
#define KEYSIZE 32 /* 32 bytes == 256 bits */
|
||||
|
||||
#define FAST 0
|
||||
#define SLOW 1
|
||||
|
||||
void random_init(void);
|
||||
void random_deinit(void);
|
||||
void random_init_harvester(void (*)(struct timespec *, u_int64_t, u_int, u_int, u_int));
|
||||
void random_deinit_harvester(void);
|
||||
|
||||
/* This is the beasite that needs protecting. It contains all of the
|
||||
* state that we are excited about.
|
||||
* This is a biiig structure. It may move over to a malloc(9)ed
|
||||
* replacement.
|
||||
*/
|
||||
struct state {
|
||||
u_int64_t counter; /* C */
|
||||
BF_KEY key; /* K */
|
||||
unsigned char ivec[8]; /* Blowfish internal */
|
||||
int gengateinterval; /* Pg */
|
||||
int outputblocks;
|
||||
unsigned char randomstuff[1024]; /* XXX to be done properly */
|
||||
struct random_state {
|
||||
u_int64_t counter; /* C */
|
||||
BF_KEY key; /* K */
|
||||
int gengateinterval; /* Pg */
|
||||
int bins; /* Pt/t */
|
||||
u_char ivec[8]; /* Blowfish internal */
|
||||
int outputblocks; /* count output blocks for gates */
|
||||
u_int slowoverthresh; /* slow pool overthreshhold reseed count */
|
||||
struct pool {
|
||||
struct source {
|
||||
struct entropy {
|
||||
struct timespec nanotime;
|
||||
u_int64_t data;
|
||||
} entropy[ENTROPYBIN]; /* entropy units - must each
|
||||
be <= KEYSIZE */
|
||||
u_int bits; /* estimated bits of entropy */
|
||||
u_int frac; /* fractional bits of entropy
|
||||
(given as 1024/n) */
|
||||
u_int current; /* next insertion point */
|
||||
} source[ENTROPYSOURCE];
|
||||
u_int thresh; /* pool reseed threshhold */
|
||||
} pool[2]; /* pool[0] is fast, pool[1] is slow */
|
||||
int which; /* toggle - shows the current insertion pool */
|
||||
};
|
||||
|
||||
extern struct random_state random_state;
|
||||
|
||||
81
sys/dev/randomdev/harvest.c
Normal file
81
sys/dev/randomdev/harvest.c
Normal file
@ -0,0 +1,81 @@
|
||||
/*-
|
||||
* Copyright (c) 2000 Mark R V Murray
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer
|
||||
* in this position and unchanged.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
|
||||
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
||||
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
|
||||
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
|
||||
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
* $FreeBSD$
|
||||
*/
|
||||
|
||||
#include <sys/param.h>
|
||||
#include <sys/systm.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/queue.h>
|
||||
#include <sys/linker.h>
|
||||
#include <sys/libkern.h>
|
||||
#include <sys/mbuf.h>
|
||||
#include <sys/random.h>
|
||||
#include <sys/time.h>
|
||||
#include <crypto/blowfish/blowfish.h>
|
||||
|
||||
#include <dev/randomdev/yarrow.h>
|
||||
|
||||
/* hold the address of the routine which is actually called if */
|
||||
/* the ramdomdev is loaded */
|
||||
static void (*reap)(struct timespec *, u_int64_t, u_int, u_int, u_int) = NULL;
|
||||
|
||||
/* Initialise the harvester at load time */
|
||||
void
|
||||
random_init_harvester(void (*reaper)(struct timespec *, u_int64_t, u_int, u_int, u_int))
|
||||
{
|
||||
intrmask_t mask;
|
||||
|
||||
mask = splhigh();
|
||||
reap = reaper;
|
||||
splx(mask);
|
||||
}
|
||||
|
||||
/* Deinitialise the harvester at unload time */
|
||||
void
|
||||
random_deinit_harvester(void)
|
||||
{
|
||||
intrmask_t mask;
|
||||
|
||||
mask = splhigh();
|
||||
reap = NULL;
|
||||
splx(mask);
|
||||
}
|
||||
|
||||
/* Entropy harvesting routine. This is supposed to be fast; do */
|
||||
/* not do anything slow in here! */
|
||||
/* Implemented as in indirect call to allow non-inclusion of */
|
||||
/* the entropy device. */
|
||||
void
|
||||
random_harvest(u_int64_t entropy, u_int bits, u_int frac, u_int source)
|
||||
{
|
||||
struct timespec nanotime;
|
||||
|
||||
if (reap) {
|
||||
getnanotime(&nanotime);
|
||||
(*reap)(&nanotime, entropy, bits, frac, source);
|
||||
}
|
||||
}
|
||||
@ -1,5 +1,5 @@
|
||||
/*-
|
||||
* Copyright (c) 2000 Mark Murray
|
||||
* Copyright (c) 2000 Mark R V Murray
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@ -27,12 +27,12 @@
|
||||
*/
|
||||
|
||||
#include <sys/param.h>
|
||||
#include <sys/queue.h>
|
||||
#include <sys/systm.h>
|
||||
#include <sys/conf.h>
|
||||
#include <sys/fcntl.h>
|
||||
#include <sys/uio.h>
|
||||
#include <sys/kernel.h>
|
||||
#include <sys/kobj.h>
|
||||
#include <sys/malloc.h>
|
||||
#include <sys/module.h>
|
||||
#include <sys/bus.h>
|
||||
@ -46,8 +46,8 @@
|
||||
|
||||
#include <dev/randomdev/yarrow.h>
|
||||
|
||||
static d_read_t randomread;
|
||||
static d_write_t randomwrite;
|
||||
static d_read_t random_read;
|
||||
static d_write_t random_write;
|
||||
|
||||
#define CDEV_MAJOR 2
|
||||
#define RANDOM_MINOR 3
|
||||
@ -56,8 +56,8 @@ static d_write_t randomwrite;
|
||||
static struct cdevsw random_cdevsw = {
|
||||
/* open */ (d_open_t *)nullop,
|
||||
/* close */ (d_close_t *)nullop,
|
||||
/* read */ randomread,
|
||||
/* write */ randomwrite,
|
||||
/* read */ random_read,
|
||||
/* write */ random_write,
|
||||
/* ioctl */ noioctl,
|
||||
/* poll */ nopoll,
|
||||
/* mmap */ nommap,
|
||||
@ -71,52 +71,51 @@ static struct cdevsw random_cdevsw = {
|
||||
};
|
||||
|
||||
/* For use with make_dev(9)/destroy_dev(9). */
|
||||
static dev_t randomdev;
|
||||
static dev_t urandomdev;
|
||||
static dev_t random_dev;
|
||||
static dev_t urandom_dev;
|
||||
|
||||
static void *buf;
|
||||
/* Buffer used by uiomove(9) */
|
||||
static void *random_buf;
|
||||
|
||||
extern void randominit(void);
|
||||
|
||||
extern struct state state;
|
||||
|
||||
/* This is mostly academic at the moment; as Yarrow gets extended, it will
|
||||
become more relevant */
|
||||
SYSCTL_NODE(_kern, OID_AUTO, random, CTLFLAG_RW, 0, "Random Number Generator");
|
||||
SYSCTL_NODE(_kern_random, OID_AUTO, yarrow, CTLFLAG_RW, 0, "Yarrow Parameters");
|
||||
SYSCTL_INT(_kern_random_yarrow, OID_AUTO, gengateinterval, CTLFLAG_RW, &state.gengateinterval, 10, "Generator Gate Interval");
|
||||
SYSCTL_INT(_kern_random_yarrow, OID_AUTO, gengateinterval, CTLFLAG_RW, &random_state.gengateinterval, 10, "Generator Gate Interval");
|
||||
SYSCTL_INT(_kern_random_yarrow, OID_AUTO, bins, CTLFLAG_RW, &random_state.bins, 10, "Execution time tuner");
|
||||
SYSCTL_INT(_kern_random_yarrow, OID_AUTO, fastthresh, CTLFLAG_RW, &random_state.pool[0].thresh, 100, "Fast pool reseed threshhold");
|
||||
SYSCTL_INT(_kern_random_yarrow, OID_AUTO, slowthresh, CTLFLAG_RW, &random_state.pool[1].thresh, 100, "Slow pool reseed threshhold");
|
||||
SYSCTL_INT(_kern_random_yarrow, OID_AUTO, slowoverthresh, CTLFLAG_RW, &random_state.slowoverthresh, 2, "Slow pool over-threshhold reseed count");
|
||||
|
||||
static int
|
||||
randomread(dev_t dev, struct uio *uio, int flag)
|
||||
random_read(dev_t dev, struct uio *uio, int flag)
|
||||
{
|
||||
u_int c, ret;
|
||||
int error = 0;
|
||||
|
||||
c = min(uio->uio_resid, PAGE_SIZE);
|
||||
buf = (void *)malloc(c, M_TEMP, M_WAITOK);
|
||||
random_buf = (void *)malloc(c, M_TEMP, M_WAITOK);
|
||||
while (uio->uio_resid > 0 && error == 0) {
|
||||
ret = read_random(buf, c);
|
||||
error = uiomove(buf, ret, uio);
|
||||
ret = read_random(random_buf, c);
|
||||
error = uiomove(random_buf, ret, uio);
|
||||
}
|
||||
free(buf, M_TEMP);
|
||||
free(random_buf, M_TEMP);
|
||||
return error;
|
||||
}
|
||||
|
||||
static int
|
||||
randomwrite(dev_t dev, struct uio *uio, int flag)
|
||||
random_write(dev_t dev, struct uio *uio, int flag)
|
||||
{
|
||||
u_int c;
|
||||
int error = 0;
|
||||
|
||||
buf = (void *)malloc(PAGE_SIZE, M_TEMP, M_WAITOK);
|
||||
random_buf = (void *)malloc(PAGE_SIZE, M_TEMP, M_WAITOK);
|
||||
while (uio->uio_resid > 0) {
|
||||
c = min(uio->uio_resid, PAGE_SIZE);
|
||||
error = uiomove(buf, c, uio);
|
||||
error = uiomove(random_buf, c, uio);
|
||||
if (error)
|
||||
break;
|
||||
/* write_random(buf, c); */
|
||||
/* write_random(random_buf, c); */
|
||||
}
|
||||
free(buf, M_TEMP);
|
||||
free(random_buf, M_TEMP);
|
||||
return error;
|
||||
}
|
||||
|
||||
@ -127,16 +126,17 @@ random_modevent(module_t mod, int type, void *data)
|
||||
case MOD_LOAD:
|
||||
if (bootverbose)
|
||||
printf("random: <entropy source>\n");
|
||||
randomdev = make_dev(&random_cdevsw, RANDOM_MINOR, UID_ROOT,
|
||||
random_dev = make_dev(&random_cdevsw, RANDOM_MINOR, UID_ROOT,
|
||||
GID_WHEEL, 0666, "random");
|
||||
urandomdev = make_dev(&random_cdevsw, URANDOM_MINOR, UID_ROOT,
|
||||
urandom_dev = make_dev(&random_cdevsw, URANDOM_MINOR, UID_ROOT,
|
||||
GID_WHEEL, 0666, "urandom");
|
||||
randominit();
|
||||
random_init();
|
||||
return 0;
|
||||
|
||||
case MOD_UNLOAD:
|
||||
destroy_dev(randomdev);
|
||||
destroy_dev(urandomdev);
|
||||
random_deinit();
|
||||
destroy_dev(random_dev);
|
||||
destroy_dev(urandom_dev);
|
||||
return 0;
|
||||
|
||||
case MOD_SHUTDOWN:
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
/*-
|
||||
* Copyright (c) 2000 Mark Murray
|
||||
* Copyright (c) 2000 Mark R V Murray
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@ -32,103 +32,166 @@
|
||||
#include <sys/param.h>
|
||||
#include <sys/systm.h>
|
||||
#include <sys/queue.h>
|
||||
#include <sys/taskqueue.h>
|
||||
#include <sys/linker.h>
|
||||
#include <sys/libkern.h>
|
||||
#include <sys/mbuf.h>
|
||||
#include <sys/random.h>
|
||||
#include <sys/time.h>
|
||||
#include <sys/types.h>
|
||||
#include <crypto/blowfish/blowfish.h>
|
||||
|
||||
#include <dev/randomdev/yarrow.h>
|
||||
|
||||
void generator_gate(void);
|
||||
void reseed(void);
|
||||
void randominit(void);
|
||||
/* #define DEBUG */
|
||||
|
||||
/* This is the beastie that needs protecting. It contains all of the
|
||||
* state that we are excited about.
|
||||
*/
|
||||
struct state state;
|
||||
static void generator_gate(void);
|
||||
static void reseed(int);
|
||||
static void random_harvest_internal(struct timespec *nanotime, u_int64_t entropy, u_int bits, u_int frac, u_int source);
|
||||
|
||||
void
|
||||
randominit(void)
|
||||
/* Structure holding the entropy state */
|
||||
struct random_state random_state;
|
||||
|
||||
/* When enough entropy has been harvested, asynchronously "stir" it in */
|
||||
static struct task regate_task;
|
||||
|
||||
static struct context {
|
||||
u_int pool;
|
||||
} context = { 0 };
|
||||
|
||||
static void
|
||||
regate(void *context, int pending)
|
||||
{
|
||||
/* XXX much more to come */
|
||||
state.gengateinterval = 10;
|
||||
#ifdef DEBUG
|
||||
printf("Regate task\n");
|
||||
#endif
|
||||
reseed(((struct context *)context)->pool);
|
||||
}
|
||||
|
||||
void
|
||||
reseed(void)
|
||||
random_init(void)
|
||||
{
|
||||
unsigned char v[BINS][KEYSIZE]; /* v[i] */
|
||||
unsigned char hash[KEYSIZE]; /* h' */
|
||||
#ifdef DEBUG
|
||||
printf("Random init\n");
|
||||
#endif
|
||||
random_state.gengateinterval = 10;
|
||||
random_state.bins = 10;
|
||||
random_state.pool[0].thresh = 100;
|
||||
random_state.pool[1].thresh = 160;
|
||||
random_state.slowoverthresh = 2;
|
||||
random_state.which = FAST;
|
||||
TASK_INIT(®ate_task, 0, ®ate, (void *)&context);
|
||||
random_init_harvester(random_harvest_internal);
|
||||
}
|
||||
|
||||
void
|
||||
random_deinit(void)
|
||||
{
|
||||
#ifdef DEBUG
|
||||
printf("Random deinit\n");
|
||||
#endif
|
||||
random_deinit_harvester();
|
||||
}
|
||||
|
||||
static void
|
||||
reseed(int fastslow)
|
||||
{
|
||||
unsigned char v[TIMEBIN][KEYSIZE]; /* v[i] */
|
||||
unsigned char hash[KEYSIZE]; /* h' */
|
||||
BF_KEY hashkey;
|
||||
unsigned char ivec[8];
|
||||
unsigned char temp[KEYSIZE];
|
||||
struct entropy *bucket;
|
||||
int i, j;
|
||||
|
||||
#ifdef DEBUG
|
||||
printf("Reseed type %d\n", fastslow);
|
||||
#endif
|
||||
|
||||
/* 1. Hash the accumulated entropy into v[0] */
|
||||
|
||||
/* XXX to be done properly */
|
||||
bzero((void *)&v[0], KEYSIZE);
|
||||
for (j = 0; j < sizeof(state.randomstuff); j += KEYSIZE) {
|
||||
BF_set_key(&hashkey, KEYSIZE, &state.randomstuff[j]);
|
||||
BF_cbc_encrypt(v[0], temp, KEYSIZE, &hashkey,
|
||||
ivec, BF_ENCRYPT);
|
||||
memcpy(&v[0], temp, KEYSIZE);
|
||||
if (fastslow == SLOW) {
|
||||
/* Feed a hash of the slow pool into the fast pool */
|
||||
for (i = 0; i < ENTROPYSOURCE; i++) {
|
||||
for (j = 0; j < ENTROPYBIN; j++) {
|
||||
bucket = &random_state.pool[SLOW].source[i].entropy[j];
|
||||
if(bucket->nanotime.tv_sec || bucket->nanotime.tv_nsec) {
|
||||
BF_set_key(&hashkey, sizeof(struct entropy),
|
||||
(void *)bucket);
|
||||
BF_cbc_encrypt(v[0], temp, KEYSIZE, &hashkey, ivec,
|
||||
BF_ENCRYPT);
|
||||
memcpy(&v[0], temp, KEYSIZE);
|
||||
bucket->nanotime.tv_sec = 0;
|
||||
bucket->nanotime.tv_nsec = 0;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
for (i = 0; i < ENTROPYSOURCE; i++) {
|
||||
for (j = 0; j < ENTROPYBIN; j++) {
|
||||
bucket = &random_state.pool[FAST].source[i].entropy[j];
|
||||
if(bucket->nanotime.tv_sec || bucket->nanotime.tv_nsec) {
|
||||
BF_set_key(&hashkey, sizeof(struct entropy), (void *)bucket);
|
||||
BF_cbc_encrypt(v[0], temp, KEYSIZE, &hashkey, ivec, BF_ENCRYPT);
|
||||
memcpy(&v[0], temp, KEYSIZE);
|
||||
bucket->nanotime.tv_sec = 0;
|
||||
bucket->nanotime.tv_nsec = 0;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/* 2. Compute hash values for all v. _Supposed_ to be computationally */
|
||||
/* intensive. */
|
||||
|
||||
for (i = 1; i < BINS; i++) {
|
||||
if (random_state.bins > TIMEBIN)
|
||||
random_state.bins = TIMEBIN;
|
||||
for (i = 1; i < random_state.bins; i++) {
|
||||
bzero((void *)&v[i], KEYSIZE);
|
||||
for (j = 0; j < sizeof(state.randomstuff); j += KEYSIZE) {
|
||||
/* v[i] #= h(v[i-1]) */
|
||||
BF_set_key(&hashkey, KEYSIZE, v[i - 1]);
|
||||
BF_cbc_encrypt(v[i], temp, KEYSIZE, &hashkey,
|
||||
ivec, BF_ENCRYPT);
|
||||
memcpy(&v[i], temp, KEYSIZE);
|
||||
/* v[i] #= h(v[0]) */
|
||||
BF_set_key(&hashkey, KEYSIZE, v[0]);
|
||||
BF_cbc_encrypt(v[i], temp, KEYSIZE, &hashkey,
|
||||
ivec, BF_ENCRYPT);
|
||||
memcpy(&v[i], temp, KEYSIZE);
|
||||
/* v[i] #= h(i) */
|
||||
BF_set_key(&hashkey, sizeof(int), (unsigned char *)&i);
|
||||
BF_cbc_encrypt(v[i], temp, KEYSIZE, &hashkey,
|
||||
ivec, BF_ENCRYPT);
|
||||
memcpy(&v[i], temp, KEYSIZE);
|
||||
}
|
||||
/* v[i] #= h(v[i-1]) */
|
||||
BF_set_key(&hashkey, KEYSIZE, v[i - 1]);
|
||||
BF_cbc_encrypt(v[i], temp, KEYSIZE, &hashkey, ivec, BF_ENCRYPT);
|
||||
memcpy(&v[i], temp, KEYSIZE);
|
||||
/* v[i] #= h(v[0]) */
|
||||
BF_set_key(&hashkey, KEYSIZE, v[0]);
|
||||
BF_cbc_encrypt(v[i], temp, KEYSIZE, &hashkey, ivec, BF_ENCRYPT);
|
||||
memcpy(&v[i], temp, KEYSIZE);
|
||||
/* v[i] #= h(i) */
|
||||
BF_set_key(&hashkey, sizeof(int), (unsigned char *)&i);
|
||||
BF_cbc_encrypt(v[i], temp, KEYSIZE, &hashkey, ivec, BF_ENCRYPT);
|
||||
memcpy(&v[i], temp, KEYSIZE);
|
||||
}
|
||||
|
||||
/* 3. Compute a new Key. */
|
||||
|
||||
bzero((void *)hash, KEYSIZE);
|
||||
BF_set_key(&hashkey, KEYSIZE, (unsigned char *)&state.key);
|
||||
BF_cbc_encrypt(hash, temp, KEYSIZE, &hashkey,
|
||||
ivec, BF_ENCRYPT);
|
||||
BF_set_key(&hashkey, KEYSIZE, (unsigned char *)&random_state.key);
|
||||
BF_cbc_encrypt(hash, temp, KEYSIZE, &hashkey, ivec, BF_ENCRYPT);
|
||||
memcpy(hash, temp, KEYSIZE);
|
||||
for (i = 1; i < BINS; i++) {
|
||||
for (i = 1; i < random_state.bins; i++) {
|
||||
BF_set_key(&hashkey, KEYSIZE, v[i]);
|
||||
BF_cbc_encrypt(hash, temp, KEYSIZE, &hashkey,
|
||||
ivec, BF_ENCRYPT);
|
||||
BF_cbc_encrypt(hash, temp, KEYSIZE, &hashkey, ivec, BF_ENCRYPT);
|
||||
memcpy(hash, temp, KEYSIZE);
|
||||
}
|
||||
|
||||
BF_set_key(&state.key, KEYSIZE, hash);
|
||||
BF_set_key(&random_state.key, KEYSIZE, hash);
|
||||
|
||||
/* 4. Recompute the counter */
|
||||
|
||||
state.counter = 0;
|
||||
BF_cbc_encrypt((unsigned char *)&state.counter, temp,
|
||||
sizeof(state.counter), &state.key, state.ivec,
|
||||
BF_ENCRYPT);
|
||||
memcpy(&state.counter, temp, state.counter);
|
||||
random_state.counter = 0;
|
||||
BF_cbc_encrypt((unsigned char *)&random_state.counter, temp,
|
||||
sizeof(random_state.counter), &random_state.key,
|
||||
random_state.ivec, BF_ENCRYPT);
|
||||
memcpy(&random_state.counter, temp, random_state.counter);
|
||||
|
||||
/* 5. Reset all entropy estimate accumulators to zero */
|
||||
/* 5. Reset entropy estimate accumulators to zero */
|
||||
|
||||
bzero((void *)state.randomstuff, sizeof(state.randomstuff));
|
||||
for (i = 0; i <= fastslow; i++) {
|
||||
for (j = 0; j < ENTROPYSOURCE; j++) {
|
||||
random_state.pool[i].source[j].bits = 0;
|
||||
random_state.pool[i].source[j].frac = 0;
|
||||
}
|
||||
}
|
||||
|
||||
/* 6. Wipe memory of intermediate values */
|
||||
|
||||
@ -151,43 +214,46 @@ read_random(char *buf, u_int count)
|
||||
|
||||
if (gate) {
|
||||
generator_gate();
|
||||
state.outputblocks = 0;
|
||||
random_state.outputblocks = 0;
|
||||
gate = 0;
|
||||
}
|
||||
if (count >= sizeof(state.counter)) {
|
||||
if (count >= sizeof(random_state.counter)) {
|
||||
retval = 0;
|
||||
for (i = 0; i < count; i += sizeof(state.counter)) {
|
||||
state.counter++;
|
||||
BF_cbc_encrypt((unsigned char *)&state.counter,
|
||||
(unsigned char *)&genval, sizeof(state.counter),
|
||||
&state.key, state.ivec, BF_ENCRYPT);
|
||||
memcpy(&buf[i], &genval, sizeof(state.counter));
|
||||
if (++state.outputblocks >= state.gengateinterval) {
|
||||
for (i = 0; i < count; i += sizeof(random_state.counter)) {
|
||||
random_state.counter++;
|
||||
BF_cbc_encrypt((unsigned char *)&random_state.counter,
|
||||
(unsigned char *)&genval,
|
||||
sizeof(random_state.counter),
|
||||
&random_state.key, random_state.ivec, BF_ENCRYPT);
|
||||
memcpy(&buf[i], &genval, sizeof(random_state.counter));
|
||||
if (++random_state.outputblocks >= random_state.gengateinterval) {
|
||||
generator_gate();
|
||||
state.outputblocks = 0;
|
||||
random_state.outputblocks = 0;
|
||||
}
|
||||
retval += sizeof(state.counter);
|
||||
retval += sizeof(random_state.counter);
|
||||
}
|
||||
}
|
||||
else {
|
||||
if (!cur) {
|
||||
state.counter++;
|
||||
BF_cbc_encrypt((unsigned char *)&state.counter,
|
||||
(unsigned char *)&genval, sizeof(state.counter),
|
||||
&state.key, state.ivec, BF_ENCRYPT);
|
||||
random_state.counter++;
|
||||
BF_cbc_encrypt((unsigned char *)&random_state.counter,
|
||||
(unsigned char *)&genval,
|
||||
sizeof(random_state.counter),
|
||||
&random_state.key, random_state.ivec,
|
||||
BF_ENCRYPT);
|
||||
memcpy(buf, &genval, count);
|
||||
cur = sizeof(state.counter) - count;
|
||||
if (++state.outputblocks >= state.gengateinterval) {
|
||||
cur = sizeof(random_state.counter) - count;
|
||||
if (++random_state.outputblocks >= random_state.gengateinterval) {
|
||||
generator_gate();
|
||||
state.outputblocks = 0;
|
||||
random_state.outputblocks = 0;
|
||||
}
|
||||
retval = count;
|
||||
}
|
||||
else {
|
||||
retval = cur < count ? cur : count;
|
||||
memcpy(buf,
|
||||
(char *)&state.counter +
|
||||
(sizeof(state.counter) - retval),
|
||||
(char *)&random_state.counter +
|
||||
(sizeof(random_state.counter) - retval),
|
||||
retval);
|
||||
cur -= retval;
|
||||
}
|
||||
@ -195,19 +261,81 @@ read_random(char *buf, u_int count)
|
||||
return retval;
|
||||
}
|
||||
|
||||
void
|
||||
static void
|
||||
generator_gate(void)
|
||||
{
|
||||
int i;
|
||||
unsigned char temp[KEYSIZE];
|
||||
|
||||
for (i = 0; i < KEYSIZE; i += sizeof(state.counter)) {
|
||||
state.counter++;
|
||||
BF_cbc_encrypt((unsigned char *)&state.counter, &temp[i],
|
||||
sizeof(state.counter), &state.key, state.ivec,
|
||||
BF_ENCRYPT);
|
||||
#ifdef DEBUG
|
||||
/* printf("Generator gate\n"); */
|
||||
#endif
|
||||
for (i = 0; i < KEYSIZE; i += sizeof(random_state.counter)) {
|
||||
random_state.counter++;
|
||||
BF_cbc_encrypt((unsigned char *)&random_state.counter,
|
||||
&(temp[i]), sizeof(random_state.counter),
|
||||
&random_state.key, random_state.ivec, BF_ENCRYPT);
|
||||
}
|
||||
|
||||
BF_set_key(&state.key, KEYSIZE, temp);
|
||||
BF_set_key(&random_state.key, KEYSIZE, temp);
|
||||
bzero((void *)temp, KEYSIZE);
|
||||
}
|
||||
|
||||
/* Entropy harvesting routine. This is supposed to be fast; do */
|
||||
/* not do anything slow in here! */
|
||||
|
||||
static void
|
||||
random_harvest_internal(struct timespec *nanotime, u_int64_t entropy,
|
||||
u_int bits, u_int frac, u_int origin)
|
||||
{
|
||||
u_int insert;
|
||||
int which; /* fast or slow */
|
||||
struct entropy *bucket;
|
||||
struct source *source;
|
||||
struct pool *pool;
|
||||
|
||||
#ifdef DEBUG
|
||||
printf("Random harvest\n");
|
||||
#endif
|
||||
if (origin < ENTROPYSOURCE) {
|
||||
|
||||
which = random_state.which;
|
||||
pool = &random_state.pool[which];
|
||||
source = &pool->source[origin];
|
||||
|
||||
insert = source->current + 1;
|
||||
if (insert >= ENTROPYBIN)
|
||||
insert = 0;
|
||||
|
||||
bucket = &source->entropy[insert];
|
||||
|
||||
if (!bucket->nanotime.tv_sec && !bucket->nanotime.tv_nsec) {
|
||||
|
||||
/* nanotime provides clock jitter */
|
||||
bucket->nanotime = *nanotime;
|
||||
|
||||
/* the harvested entropy */
|
||||
bucket->data = entropy;
|
||||
|
||||
/* update the estimates - including "fractional bits" */
|
||||
source->bits += bits;
|
||||
source->frac += frac;
|
||||
if (source->frac >= 1024) {
|
||||
source->bits += source->frac / 1024;
|
||||
source->frac %= 1024;
|
||||
}
|
||||
context.pool = which;
|
||||
if (source->bits >= pool->thresh) {
|
||||
/* XXX Needs to be multiply queued? */
|
||||
taskqueue_enqueue(taskqueue_swi, ®ate_task);
|
||||
}
|
||||
|
||||
/* bump the insertion point */
|
||||
source->current = insert;
|
||||
|
||||
/* toggle the pool for next time */
|
||||
random_state.which = !random_state.which;
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
/*-
|
||||
* Copyright (c) 2000 Mark Murray
|
||||
* Copyright (c) 2000 Mark R V Murray
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@ -26,17 +26,52 @@
|
||||
* $FreeBSD$
|
||||
*/
|
||||
|
||||
#define BINS 10 /* t */
|
||||
#define KEYSIZE 32 /* 32 bytes == 256 bits */
|
||||
#define ENTROPYBIN 256 /* buckets to harvest entropy events */
|
||||
#define ENTROPYSOURCE 2 /* entropy sources (actually classes) */
|
||||
/* The entropy classes will as follows: */
|
||||
/* 0 - Keyboard */
|
||||
/* 1 - Mouse */
|
||||
/* to start with. More will be added */
|
||||
|
||||
#define TIMEBIN 16 /* max value for Pt/t */
|
||||
#define KEYSIZE 32 /* 32 bytes == 256 bits */
|
||||
|
||||
#define FAST 0
|
||||
#define SLOW 1
|
||||
|
||||
void random_init(void);
|
||||
void random_deinit(void);
|
||||
void random_init_harvester(void (*)(struct timespec *, u_int64_t, u_int, u_int, u_int));
|
||||
void random_deinit_harvester(void);
|
||||
|
||||
/* This is the beasite that needs protecting. It contains all of the
|
||||
* state that we are excited about.
|
||||
* This is a biiig structure. It may move over to a malloc(9)ed
|
||||
* replacement.
|
||||
*/
|
||||
struct state {
|
||||
u_int64_t counter; /* C */
|
||||
BF_KEY key; /* K */
|
||||
unsigned char ivec[8]; /* Blowfish internal */
|
||||
int gengateinterval; /* Pg */
|
||||
int outputblocks;
|
||||
unsigned char randomstuff[1024]; /* XXX to be done properly */
|
||||
struct random_state {
|
||||
u_int64_t counter; /* C */
|
||||
BF_KEY key; /* K */
|
||||
int gengateinterval; /* Pg */
|
||||
int bins; /* Pt/t */
|
||||
u_char ivec[8]; /* Blowfish internal */
|
||||
int outputblocks; /* count output blocks for gates */
|
||||
u_int slowoverthresh; /* slow pool overthreshhold reseed count */
|
||||
struct pool {
|
||||
struct source {
|
||||
struct entropy {
|
||||
struct timespec nanotime;
|
||||
u_int64_t data;
|
||||
} entropy[ENTROPYBIN]; /* entropy units - must each
|
||||
be <= KEYSIZE */
|
||||
u_int bits; /* estimated bits of entropy */
|
||||
u_int frac; /* fractional bits of entropy
|
||||
(given as 1024/n) */
|
||||
u_int current; /* next insertion point */
|
||||
} source[ENTROPYSOURCE];
|
||||
u_int thresh; /* pool reseed threshhold */
|
||||
} pool[2]; /* pool[0] is fast, pool[1] is slow */
|
||||
int which; /* toggle - shows the current insertion pool */
|
||||
};
|
||||
|
||||
extern struct random_state random_state;
|
||||
|
||||
@ -2,12 +2,10 @@
|
||||
|
||||
.PATH: ${.CURDIR}/../../dev/randomdev
|
||||
.PATH: ${.CURDIR}/../../crypto/blowfish
|
||||
#.PATH: ${.CURDIR}/../../crypto/des
|
||||
KMOD = randomdev
|
||||
SRCS = bus_if.h device_if.h randomdev.c yarrow.c
|
||||
SRCS += bf_cbc.c bf_skey.c bf_enc.c
|
||||
CFLAGS += -I${.CURDIR}/../..
|
||||
#SRCS += sha1.c des_setkey.c des_ecb.c
|
||||
NOMAN = yes
|
||||
|
||||
.include <bsd.kmod.mk>
|
||||
|
||||
@ -2,12 +2,10 @@
|
||||
|
||||
.PATH: ${.CURDIR}/../../dev/randomdev
|
||||
.PATH: ${.CURDIR}/../../crypto/blowfish
|
||||
#.PATH: ${.CURDIR}/../../crypto/des
|
||||
KMOD = randomdev
|
||||
SRCS = bus_if.h device_if.h randomdev.c yarrow.c
|
||||
SRCS += bf_cbc.c bf_skey.c bf_enc.c
|
||||
CFLAGS += -I${.CURDIR}/../..
|
||||
#SRCS += sha1.c des_setkey.c des_ecb.c
|
||||
NOMAN = yes
|
||||
|
||||
.include <bsd.kmod.mk>
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user