1ad4174a4SAlex Hornung /*
2ad4174a4SAlex Hornung * Copyright (c) 2014 The DragonFly Project. All rights reserved.
3ad4174a4SAlex Hornung *
4ad4174a4SAlex Hornung * This code is derived from software contributed to The DragonFly Project
5ad4174a4SAlex Hornung * by Alex Hornung <alex@alexhornung.com>
6ad4174a4SAlex Hornung *
7ad4174a4SAlex Hornung * Redistribution and use in source and binary forms, with or without
8ad4174a4SAlex Hornung * modification, are permitted provided that the following conditions
9ad4174a4SAlex Hornung * are met:
10ad4174a4SAlex Hornung *
11ad4174a4SAlex Hornung * 1. Redistributions of source code must retain the above copyright
12ad4174a4SAlex Hornung * notice, this list of conditions and the following disclaimer.
13ad4174a4SAlex Hornung * 2. Redistributions in binary form must reproduce the above copyright
14ad4174a4SAlex Hornung * notice, this list of conditions and the following disclaimer in
15ad4174a4SAlex Hornung * the documentation and/or other materials provided with the
16ad4174a4SAlex Hornung * distribution.
17ad4174a4SAlex Hornung * 3. Neither the name of The DragonFly Project nor the names of its
18ad4174a4SAlex Hornung * contributors may be used to endorse or promote products derived
19ad4174a4SAlex Hornung * from this software without specific, prior written permission.
20ad4174a4SAlex Hornung *
21ad4174a4SAlex Hornung * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22ad4174a4SAlex Hornung * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23ad4174a4SAlex Hornung * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
24ad4174a4SAlex Hornung * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
25ad4174a4SAlex Hornung * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
26ad4174a4SAlex Hornung * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
27ad4174a4SAlex Hornung * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
28ad4174a4SAlex Hornung * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
29ad4174a4SAlex Hornung * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
30ad4174a4SAlex Hornung * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
31ad4174a4SAlex Hornung * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32ad4174a4SAlex Hornung * SUCH DAMAGE.
33ad4174a4SAlex Hornung */
34640491daSAlex Hornung #include <sys/param.h>
35640491daSAlex Hornung #include <sys/systm.h>
36640491daSAlex Hornung #include <sys/kernel.h>
37640491daSAlex Hornung #include <sys/spinlock.h>
38640491daSAlex Hornung #include <sys/spinlock2.h>
39640491daSAlex Hornung #include <sys/csprng.h>
40640491daSAlex Hornung
41*4104d691SAaron LI #define CHACHA_EMBED
42*4104d691SAaron LI #define CHACHA_NONCE0_CTR128
43*4104d691SAaron LI #define KEYSTREAM_ONLY
44*4104d691SAaron LI #include <crypto/chacha20/chacha.c>
45*4104d691SAaron LI #include <crypto/sha2/sha2.h>
46*4104d691SAaron LI
47640491daSAlex Hornung /*
48640491daSAlex Hornung * Minimum amount of bytes in pool before we consider it
49640491daSAlex Hornung * good enough.
50640491daSAlex Hornung * It's 64 + the hash digest size because we always
51640491daSAlex Hornung * reinitialize the pools with a hash of the previous chunk
52640491daSAlex Hornung * of entropy.
53640491daSAlex Hornung */
54f26f7bb3SMatthew Dillon #define MIN_POOL_SIZE (64 + SHA256_DIGEST_LENGTH)
55640491daSAlex Hornung
56640491daSAlex Hornung /* Minimum reseed interval */
57640491daSAlex Hornung #define MIN_RESEED_INTERVAL hz/10
58640491daSAlex Hornung
591cb34a03SMatthew Dillon #if 0
60640491daSAlex Hornung static void csprng_reseed_callout(void *arg);
611cb34a03SMatthew Dillon #endif
62640491daSAlex Hornung static int csprng_reseed(struct csprng_state *state);
63640491daSAlex Hornung
64640491daSAlex Hornung static struct timeval csprng_reseed_interval = { 0, 100000 };
65640491daSAlex Hornung
66640491daSAlex Hornung static
67640491daSAlex Hornung int
csprng_pool_init(struct csprng_pool * pool,uint8_t * buf,size_t len)68640491daSAlex Hornung csprng_pool_init(struct csprng_pool *pool, uint8_t *buf, size_t len)
69640491daSAlex Hornung {
70640491daSAlex Hornung pool->bytes = 0;
71640491daSAlex Hornung SHA256_Init(&pool->hash_ctx);
72640491daSAlex Hornung
73640491daSAlex Hornung if (len > 0)
74640491daSAlex Hornung SHA256_Update(&pool->hash_ctx, buf, len);
75640491daSAlex Hornung
76640491daSAlex Hornung return 0;
77640491daSAlex Hornung }
78640491daSAlex Hornung
79640491daSAlex Hornung int
csprng_init(struct csprng_state * state)80640491daSAlex Hornung csprng_init(struct csprng_state *state)
81640491daSAlex Hornung {
82640491daSAlex Hornung int i, r;
83640491daSAlex Hornung
84640491daSAlex Hornung bzero(state->key, sizeof(state->key));
85640491daSAlex Hornung bzero(&state->cipher_ctx, sizeof(state->cipher_ctx));
86640491daSAlex Hornung bzero(state->src_pool_idx, sizeof(state->src_pool_idx));
87640491daSAlex Hornung bzero(&state->last_reseed, sizeof(state->last_reseed));
88640491daSAlex Hornung
89640491daSAlex Hornung state->reseed_cnt = 0;
90640491daSAlex Hornung state->failed_reseeds = 0;
91640491daSAlex Hornung state->callout_based_reseed = 0;
92640491daSAlex Hornung
93640491daSAlex Hornung for (i = 0; i < 32; i++) {
94640491daSAlex Hornung r = csprng_pool_init(&state->pool[i], NULL, 0);
95640491daSAlex Hornung if (r != 0)
96640491daSAlex Hornung break;
97640491daSAlex Hornung }
98640491daSAlex Hornung
99640491daSAlex Hornung return r;
100640491daSAlex Hornung }
101640491daSAlex Hornung
1021cb34a03SMatthew Dillon #if 0
103640491daSAlex Hornung int
104640491daSAlex Hornung csprng_init_reseed(struct csprng_state *state)
105640491daSAlex Hornung {
106640491daSAlex Hornung state->callout_based_reseed = 1;
107640491daSAlex Hornung
108640491daSAlex Hornung callout_init_mp(&state->reseed_callout);
109640491daSAlex Hornung callout_reset(&state->reseed_callout, MIN_RESEED_INTERVAL,
110640491daSAlex Hornung csprng_reseed_callout, state);
111640491daSAlex Hornung
112640491daSAlex Hornung return 0;
113640491daSAlex Hornung }
1141cb34a03SMatthew Dillon #endif
115640491daSAlex Hornung
116640491daSAlex Hornung /*
117640491daSAlex Hornung * XXX:
118640491daSAlex Hornung * Sources don't really a uniquely-allocated src id...
119640491daSAlex Hornung * another way we could do that is by simply using
120640491daSAlex Hornung * (uint8_t)__LINE__ as the source id... cheap & cheerful.
121640491daSAlex Hornung */
122640491daSAlex Hornung
123640491daSAlex Hornung /*
1241cb34a03SMatthew Dillon * Called with state->spin held.
125640491daSAlex Hornung */
126640491daSAlex Hornung int
csprng_get_random(struct csprng_state * state,uint8_t * out,int bytes,int flags)127640491daSAlex Hornung csprng_get_random(struct csprng_state *state, uint8_t *out, int bytes,
1281b78bc1eSAaron LI int flags)
129640491daSAlex Hornung {
130640491daSAlex Hornung int cnt;
131640491daSAlex Hornung int total_bytes = 0;
132640491daSAlex Hornung
133af641625SAlex Hornung again:
134640491daSAlex Hornung if (!state->callout_based_reseed &&
135640491daSAlex Hornung ratecheck(&state->last_reseed, &csprng_reseed_interval)) {
136347b581fSAlex Hornung csprng_reseed(state);
137640491daSAlex Hornung }
138640491daSAlex Hornung
139ad4174a4SAlex Hornung /*
140ad4174a4SAlex Hornung * If no reseed has occurred yet, we can't possibly give out
141ad4174a4SAlex Hornung * any random data.
1421b78bc1eSAaron LI * If this isn't an unlimited (i.e., /dev/urandom) read, sleep
1431b78bc1eSAaron LI * until entropy is added to the pools (or a callout-based
144ad4174a4SAlex Hornung * reseed, if enabled, occurs).
145ad4174a4SAlex Hornung */
1461b78bc1eSAaron LI if ((flags & CSPRNG_UNLIMITED) == 0 && state->reseed_cnt == 0) {
1471cb34a03SMatthew Dillon ssleep(state, &state->spin, 0, "csprngrsd", 0);
148af641625SAlex Hornung goto again;
149af641625SAlex Hornung }
150640491daSAlex Hornung
151640491daSAlex Hornung while (bytes > 0) {
152640491daSAlex Hornung /* Limit amount of output without rekeying to 2^20 */
153640491daSAlex Hornung cnt = (bytes > (1 << 20)) ? (1 << 20) : bytes;
154640491daSAlex Hornung
155*4104d691SAaron LI chacha_encrypt_bytes(&state->cipher_ctx, NULL, out, cnt);
156640491daSAlex Hornung
157640491daSAlex Hornung /* Update key and rekey cipher */
158*4104d691SAaron LI chacha_encrypt_bytes(&state->cipher_ctx, NULL, state->key,
159f26f7bb3SMatthew Dillon sizeof(state->key));
160640491daSAlex Hornung chacha_keysetup(&state->cipher_ctx, state->key,
161640491daSAlex Hornung 8 * sizeof(state->key));
162640491daSAlex Hornung
163640491daSAlex Hornung out += cnt;
164640491daSAlex Hornung bytes -= cnt;
165640491daSAlex Hornung total_bytes += cnt;
166640491daSAlex Hornung }
167640491daSAlex Hornung
168640491daSAlex Hornung return total_bytes;
169640491daSAlex Hornung }
170640491daSAlex Hornung
1711cb34a03SMatthew Dillon /*
1721cb34a03SMatthew Dillon * Called with state->spin held.
1731cb34a03SMatthew Dillon */
174640491daSAlex Hornung static
175640491daSAlex Hornung int
csprng_reseed(struct csprng_state * state)176640491daSAlex Hornung csprng_reseed(struct csprng_state *state)
177640491daSAlex Hornung {
178640491daSAlex Hornung int i;
179640491daSAlex Hornung struct csprng_pool *pool;
180640491daSAlex Hornung SHA256_CTX hash_ctx;
181640491daSAlex Hornung uint8_t digest[SHA256_DIGEST_LENGTH];
182*4104d691SAaron LI uint8_t counter[16];
183640491daSAlex Hornung
184640491daSAlex Hornung /*
185640491daSAlex Hornung * If there's not enough entropy in the first
186640491daSAlex Hornung * pool, don't reseed.
187640491daSAlex Hornung */
188640491daSAlex Hornung if (state->pool[0].bytes < MIN_POOL_SIZE) {
189640491daSAlex Hornung ++state->failed_reseeds;
190640491daSAlex Hornung return 1;
191640491daSAlex Hornung }
192640491daSAlex Hornung
193640491daSAlex Hornung SHA256_Init(&hash_ctx);
194640491daSAlex Hornung
195640491daSAlex Hornung /*
196640491daSAlex Hornung * Update hash that will result in new key with the
197640491daSAlex Hornung * old key.
198640491daSAlex Hornung */
199640491daSAlex Hornung SHA256_Update(&hash_ctx, state->key, sizeof(state->key));
200640491daSAlex Hornung
201640491daSAlex Hornung state->reseed_cnt++;
202640491daSAlex Hornung
203640491daSAlex Hornung for (i = 0; i < 32; i++) {
204640491daSAlex Hornung if ((state->reseed_cnt % (1 << i)) != 0)
205640491daSAlex Hornung break;
206640491daSAlex Hornung
207640491daSAlex Hornung pool = &state->pool[i];
208640491daSAlex Hornung
209640491daSAlex Hornung /*
210640491daSAlex Hornung * Finalize hash of the entropy in this pool.
211640491daSAlex Hornung */
212640491daSAlex Hornung SHA256_Final(digest, &pool->hash_ctx);
213640491daSAlex Hornung
214640491daSAlex Hornung /*
215640491daSAlex Hornung * Reinitialize pool with a hash of the old pool digest.
216640491daSAlex Hornung * This is a slight deviation from Fortuna as per reference,
217640491daSAlex Hornung * but is in line with other Fortuna implementations.
218640491daSAlex Hornung */
219640491daSAlex Hornung csprng_pool_init(pool, digest, sizeof(digest));
220640491daSAlex Hornung
221640491daSAlex Hornung /*
222640491daSAlex Hornung * Update hash that will result in new key with this
223640491daSAlex Hornung * pool's hashed entropy.
224640491daSAlex Hornung */
225640491daSAlex Hornung SHA256_Update(&hash_ctx, digest, sizeof(digest));
226640491daSAlex Hornung }
227640491daSAlex Hornung
228640491daSAlex Hornung SHA256_Final(state->key, &hash_ctx);
229640491daSAlex Hornung
230640491daSAlex Hornung /* Update key and rekey cipher */
231*4104d691SAaron LI chacha_keysetup(&state->cipher_ctx, state->key, 8*sizeof(state->key));
232640491daSAlex Hornung
233*4104d691SAaron LI /* No IV but a 128-bit counter, should never overflow */
234*4104d691SAaron LI bzero(counter, sizeof(counter));
235*4104d691SAaron LI chacha_ivsetup(&state->cipher_ctx, NULL, counter);
236640491daSAlex Hornung
237640491daSAlex Hornung return 0;
238640491daSAlex Hornung }
239640491daSAlex Hornung
2401cb34a03SMatthew Dillon #if 0
241640491daSAlex Hornung static
242640491daSAlex Hornung void
243640491daSAlex Hornung csprng_reseed_callout(void *arg)
244640491daSAlex Hornung {
245640491daSAlex Hornung struct csprng_state *state = (struct csprng_state *)arg;
246640491daSAlex Hornung int reseed_interval = MIN_RESEED_INTERVAL;
247640491daSAlex Hornung
2481cb34a03SMatthew Dillon spin_lock(&state->spin);
249640491daSAlex Hornung csprng_reseed(arg);
2501cb34a03SMatthew Dillon spin_unlock(&state->spin);
2511cb34a03SMatthew Dillon wakeup(state);
252640491daSAlex Hornung
253640491daSAlex Hornung callout_reset(&state->reseed_callout, reseed_interval,
254640491daSAlex Hornung csprng_reseed_callout, state);
255640491daSAlex Hornung }
2561cb34a03SMatthew Dillon #endif
257640491daSAlex Hornung
2581cb34a03SMatthew Dillon /*
2591cb34a03SMatthew Dillon * Called with state->spin held
2601cb34a03SMatthew Dillon */
261640491daSAlex Hornung int
csprng_add_entropy(struct csprng_state * state,int src_id,const uint8_t * entropy,size_t bytes,int flags)262640491daSAlex Hornung csprng_add_entropy(struct csprng_state *state, int src_id,
263640491daSAlex Hornung const uint8_t *entropy, size_t bytes, int flags)
264640491daSAlex Hornung {
265640491daSAlex Hornung struct csprng_pool *pool;
266640491daSAlex Hornung int pool_id;
267640491daSAlex Hornung
268640491daSAlex Hornung /*
269640491daSAlex Hornung * Pick the next pool for this source on a round-robin
270640491daSAlex Hornung * basis.
271640491daSAlex Hornung */
272640491daSAlex Hornung src_id &= 0xff;
273640491daSAlex Hornung pool_id = state->src_pool_idx[src_id]++ & 0x1f;
274640491daSAlex Hornung pool = &state->pool[pool_id];
275640491daSAlex Hornung
276f26f7bb3SMatthew Dillon SHA256_Update(&pool->hash_ctx, (const uint8_t *)&src_id,
277f26f7bb3SMatthew Dillon sizeof(src_id));
278f26f7bb3SMatthew Dillon SHA256_Update(&pool->hash_ctx, (const uint8_t *)&bytes,
279f26f7bb3SMatthew Dillon sizeof(bytes));
280640491daSAlex Hornung SHA256_Update(&pool->hash_ctx, entropy, bytes);
281640491daSAlex Hornung
282640491daSAlex Hornung pool->bytes += bytes;
283640491daSAlex Hornung
284640491daSAlex Hornung return 0;
285640491daSAlex Hornung }
286