1e9a2e4d1SXin LI /* $OpenBSD: arc4random.c,v 1.58 2022/07/31 13:41:45 tb Exp $ */
2c0b48470SDavid Schultz
383a03b38SAndrey A. Chernov /*
4860c4e58SAndrey A. Chernov * Copyright (c) 1996, David Mazieres <dm@uun.org>
5860c4e58SAndrey A. Chernov * Copyright (c) 2008, Damien Miller <djm@openbsd.org>
6c1e80940SXin LI * Copyright (c) 2013, Markus Friedl <markus@openbsd.org>
7c1e80940SXin LI * Copyright (c) 2014, Theo de Raadt <deraadt@openbsd.org>
883a03b38SAndrey A. Chernov *
9860c4e58SAndrey A. Chernov * Permission to use, copy, modify, and distribute this software for any
10860c4e58SAndrey A. Chernov * purpose with or without fee is hereby granted, provided that the above
11860c4e58SAndrey A. Chernov * copyright notice and this permission notice appear in all copies.
12860c4e58SAndrey A. Chernov *
13860c4e58SAndrey A. Chernov * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
14860c4e58SAndrey A. Chernov * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
15860c4e58SAndrey A. Chernov * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
16860c4e58SAndrey A. Chernov * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
17860c4e58SAndrey A. Chernov * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18860c4e58SAndrey A. Chernov * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19860c4e58SAndrey A. Chernov * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
2083a03b38SAndrey A. Chernov */
2183a03b38SAndrey A. Chernov
2283a03b38SAndrey A. Chernov /*
23c1e80940SXin LI * ChaCha based random number generator for OpenBSD.
2483a03b38SAndrey A. Chernov */
2583a03b38SAndrey A. Chernov
26d201fe46SDaniel Eischen #include "namespace.h"
27f8e8a06dSConrad Meyer #if defined(__FreeBSD__)
28f8e8a06dSConrad Meyer #include <assert.h>
29f8e8a06dSConrad Meyer #endif
3083a03b38SAndrey A. Chernov #include <fcntl.h>
317a0789b4SDavid Schultz #include <limits.h>
325295209eSBrian Feldman #include <pthread.h>
33c1e80940SXin LI #include <signal.h>
34c1e80940SXin LI #include <stdint.h>
35c1e80940SXin LI #include <stdlib.h>
36c1e80940SXin LI #include <string.h>
37c1e80940SXin LI #include <unistd.h>
38c1e80940SXin LI #include <sys/types.h>
39c1e80940SXin LI #include <sys/time.h>
405295209eSBrian Feldman
415295209eSBrian Feldman #include "libc_private.h"
42d201fe46SDaniel Eischen #include "un-namespace.h"
4383a03b38SAndrey A. Chernov
44243e0943SConrad Meyer #define CHACHA_EMBED
45c1e80940SXin LI #define KEYSTREAM_ONLY
46c2ca0667SAlex Richardson #if defined(__FreeBSD__)
47c2ca0667SAlex Richardson #define ARC4RANDOM_FXRNG 1
48c2ca0667SAlex Richardson #else
49c2ca0667SAlex Richardson #define ARC4RANDOM_FXRNG 0
50c2ca0667SAlex Richardson #endif
51c1e80940SXin LI #include "chacha.c"
52c1e80940SXin LI
53c1e80940SXin LI #define minimum(a, b) ((a) < (b) ? (a) : (b))
54c1e80940SXin LI
55c1e80940SXin LI #if defined(__GNUC__) || defined(_MSC_VER)
56c0b48470SDavid Schultz #define inline __inline
57c1e80940SXin LI #else /* __GNUC__ || _MSC_VER */
58c0b48470SDavid Schultz #define inline
59c1e80940SXin LI #endif /* !__GNUC__ && !_MSC_VER */
60c0b48470SDavid Schultz
61c1e80940SXin LI #define KEYSZ 32
62c1e80940SXin LI #define IVSZ 8
63c1e80940SXin LI #define BLOCKSZ 64
64c1e80940SXin LI #define RSBUFSZ (16*BLOCKSZ)
6583a03b38SAndrey A. Chernov
66e9a2e4d1SXin LI #define REKEY_BASE (1024*1024) /* NB. should be a power of 2 */
67e9a2e4d1SXin LI
68c1e80940SXin LI /* Marked INHERIT_ZERO, so zero'd out in fork children. */
69c1e80940SXin LI static struct _rs {
70c1e80940SXin LI size_t rs_have; /* valid bytes at end of rs_buf */
71c1e80940SXin LI size_t rs_count; /* bytes till reseed */
72c1e80940SXin LI } *rs;
735295209eSBrian Feldman
74c1e80940SXin LI /* Maybe be preserved in fork children, if _rs_allocate() decides. */
75c1e80940SXin LI static struct _rsx {
76c1e80940SXin LI chacha_ctx rs_chacha; /* chacha context for random keystream */
77c1e80940SXin LI u_char rs_buf[RSBUFSZ]; /* keystream blocks */
78f8e8a06dSConrad Meyer #ifdef __FreeBSD__
79f8e8a06dSConrad Meyer uint32_t rs_seed_generation; /* 32-bit userspace RNG version */
80f8e8a06dSConrad Meyer #endif
81c1e80940SXin LI } *rsx;
825295209eSBrian Feldman
83c1e80940SXin LI static inline int _rs_allocate(struct _rs **, struct _rsx **);
84c1e80940SXin LI static inline void _rs_forkdetect(void);
85c1e80940SXin LI #include "arc4random.h"
865295209eSBrian Feldman
87c1e80940SXin LI static inline void _rs_rekey(u_char *dat, size_t datlen);
8860ce8b0eSDavid Schultz
8983a03b38SAndrey A. Chernov static inline void
_rs_init(u_char * buf,size_t n)90c1e80940SXin LI _rs_init(u_char *buf, size_t n)
9183a03b38SAndrey A. Chernov {
92c1e80940SXin LI if (n < KEYSZ + IVSZ)
93c1e80940SXin LI return;
9483a03b38SAndrey A. Chernov
95c1e80940SXin LI if (rs == NULL) {
96c1e80940SXin LI if (_rs_allocate(&rs, &rsx) == -1)
97d25a1430SXin LI _exit(1);
9849a6e1baSEd Maste }
9983a03b38SAndrey A. Chernov
100c1e80940SXin LI chacha_keysetup(&rsx->rs_chacha, buf, KEYSZ * 8);
101c1e80940SXin LI chacha_ivsetup(&rsx->rs_chacha, buf + KEYSZ, NULL);
10283a03b38SAndrey A. Chernov }
10383a03b38SAndrey A. Chernov
1047a0789b4SDavid Schultz static void
_rs_stir(void)105c1e80940SXin LI _rs_stir(void)
1067a0789b4SDavid Schultz {
107c1e80940SXin LI u_char rnd[KEYSZ + IVSZ];
108e9a2e4d1SXin LI uint32_t rekey_fuzz = 0;
1097a0789b4SDavid Schultz
110f8e8a06dSConrad Meyer #if defined(__FreeBSD__)
111f8e8a06dSConrad Meyer bool need_init;
112f8e8a06dSConrad Meyer
113f8e8a06dSConrad Meyer /*
114f8e8a06dSConrad Meyer * De-couple allocation (which locates the vdso_fxrngp pointer in
115f8e8a06dSConrad Meyer * auxinfo) from initialization. This allows us to read the root seed
116f8e8a06dSConrad Meyer * version before we fetch system entropy, maintaining the invariant
117f8e8a06dSConrad Meyer * that the PRF was seeded with entropy from rs_seed_generation or a
118f8e8a06dSConrad Meyer * later generation. But never seeded from an earlier generation.
119f8e8a06dSConrad Meyer * This invariant prevents us from missing a root reseed event.
120f8e8a06dSConrad Meyer */
121f8e8a06dSConrad Meyer need_init = false;
122f8e8a06dSConrad Meyer if (rs == NULL) {
123f8e8a06dSConrad Meyer if (_rs_allocate(&rs, &rsx) == -1)
124f8e8a06dSConrad Meyer abort();
125f8e8a06dSConrad Meyer need_init = true;
126f8e8a06dSConrad Meyer }
127f8e8a06dSConrad Meyer /*
128f8e8a06dSConrad Meyer * Transition period: new userspace on old kernel. This should become
129f8e8a06dSConrad Meyer * a hard error at some point, if the scheme is adopted.
130f8e8a06dSConrad Meyer */
131f8e8a06dSConrad Meyer if (vdso_fxrngp != NULL)
132f8e8a06dSConrad Meyer rsx->rs_seed_generation =
133f8e8a06dSConrad Meyer fxrng_load_acq_generation(&vdso_fxrngp->fx_generation32);
134f8e8a06dSConrad Meyer #endif
135f8e8a06dSConrad Meyer
136c1e80940SXin LI if (getentropy(rnd, sizeof rnd) == -1)
137c1e80940SXin LI _getentropy_fail();
138c1e80940SXin LI
139f8e8a06dSConrad Meyer #if !defined(__FreeBSD__)
140c1e80940SXin LI if (!rs)
141c1e80940SXin LI _rs_init(rnd, sizeof(rnd));
142f8e8a06dSConrad Meyer #else /* __FreeBSD__ */
143f8e8a06dSConrad Meyer assert(rs != NULL);
144f8e8a06dSConrad Meyer if (need_init)
145f8e8a06dSConrad Meyer _rs_init(rnd, sizeof(rnd));
146f8e8a06dSConrad Meyer #endif
147c1e80940SXin LI else
148c1e80940SXin LI _rs_rekey(rnd, sizeof(rnd));
149c1e80940SXin LI explicit_bzero(rnd, sizeof(rnd)); /* discard source seed */
150c1e80940SXin LI
151c1e80940SXin LI /* invalidate rs_buf */
152c1e80940SXin LI rs->rs_have = 0;
153c1e80940SXin LI memset(rsx->rs_buf, 0, sizeof(rsx->rs_buf));
154c1e80940SXin LI
155e9a2e4d1SXin LI /* rekey interval should not be predictable */
156e9a2e4d1SXin LI chacha_encrypt_bytes(&rsx->rs_chacha, (uint8_t *)&rekey_fuzz,
157e9a2e4d1SXin LI (uint8_t *)&rekey_fuzz, sizeof(rekey_fuzz));
158e9a2e4d1SXin LI rs->rs_count = REKEY_BASE + (rekey_fuzz % REKEY_BASE);
1597a0789b4SDavid Schultz }
1607a0789b4SDavid Schultz
161c1e80940SXin LI static inline void
_rs_stir_if_needed(size_t len)162c1e80940SXin LI _rs_stir_if_needed(size_t len)
16383a03b38SAndrey A. Chernov {
164c1e80940SXin LI _rs_forkdetect();
165c1e80940SXin LI if (!rs || rs->rs_count <= len)
166c1e80940SXin LI _rs_stir();
167c1e80940SXin LI if (rs->rs_count <= len)
168c1e80940SXin LI rs->rs_count = 0;
169c1e80940SXin LI else
170c1e80940SXin LI rs->rs_count -= len;
17183a03b38SAndrey A. Chernov }
17283a03b38SAndrey A. Chernov
173c1e80940SXin LI static inline void
_rs_rekey(u_char * dat,size_t datlen)174c1e80940SXin LI _rs_rekey(u_char *dat, size_t datlen)
17583a03b38SAndrey A. Chernov {
176c1e80940SXin LI #ifndef KEYSTREAM_ONLY
177c1e80940SXin LI memset(rsx->rs_buf, 0, sizeof(rsx->rs_buf));
178c1e80940SXin LI #endif
179c1e80940SXin LI /* fill rs_buf with the keystream */
180c1e80940SXin LI chacha_encrypt_bytes(&rsx->rs_chacha, rsx->rs_buf,
181c1e80940SXin LI rsx->rs_buf, sizeof(rsx->rs_buf));
182c1e80940SXin LI /* mix in optional user provided data */
183c1e80940SXin LI if (dat) {
184c1e80940SXin LI size_t i, m;
185c1e80940SXin LI
186c1e80940SXin LI m = minimum(datlen, KEYSZ + IVSZ);
187c1e80940SXin LI for (i = 0; i < m; i++)
188c1e80940SXin LI rsx->rs_buf[i] ^= dat[i];
189c1e80940SXin LI }
190c1e80940SXin LI /* immediately reinit for backtracking resistance */
191c1e80940SXin LI _rs_init(rsx->rs_buf, KEYSZ + IVSZ);
192c1e80940SXin LI memset(rsx->rs_buf, 0, KEYSZ + IVSZ);
193c1e80940SXin LI rs->rs_have = sizeof(rsx->rs_buf) - KEYSZ - IVSZ;
19483a03b38SAndrey A. Chernov }
19583a03b38SAndrey A. Chernov
196c1e80940SXin LI static inline void
_rs_random_buf(void * _buf,size_t n)197c1e80940SXin LI _rs_random_buf(void *_buf, size_t n)
198bc6847e2SAndrey A. Chernov {
199bc6847e2SAndrey A. Chernov u_char *buf = (u_char *)_buf;
200c1e80940SXin LI u_char *keystream;
201c1e80940SXin LI size_t m;
202c1e80940SXin LI
203c1e80940SXin LI _rs_stir_if_needed(n);
204c1e80940SXin LI while (n > 0) {
205c1e80940SXin LI if (rs->rs_have > 0) {
206c1e80940SXin LI m = minimum(n, rs->rs_have);
207c1e80940SXin LI keystream = rsx->rs_buf + sizeof(rsx->rs_buf)
208c1e80940SXin LI - rs->rs_have;
209c1e80940SXin LI memcpy(buf, keystream, m);
210c1e80940SXin LI memset(keystream, 0, m);
211c1e80940SXin LI buf += m;
212c1e80940SXin LI n -= m;
213c1e80940SXin LI rs->rs_have -= m;
214bc6847e2SAndrey A. Chernov }
215c1e80940SXin LI if (rs->rs_have == 0)
216c1e80940SXin LI _rs_rekey(NULL, 0);
217c1e80940SXin LI }
218c1e80940SXin LI }
219c1e80940SXin LI
220c1e80940SXin LI static inline void
_rs_random_u32(uint32_t * val)221c1e80940SXin LI _rs_random_u32(uint32_t *val)
222c1e80940SXin LI {
223c1e80940SXin LI u_char *keystream;
224c1e80940SXin LI
225c1e80940SXin LI _rs_stir_if_needed(sizeof(*val));
226c1e80940SXin LI if (rs->rs_have < sizeof(*val))
227c1e80940SXin LI _rs_rekey(NULL, 0);
228c1e80940SXin LI keystream = rsx->rs_buf + sizeof(rsx->rs_buf) - rs->rs_have;
229c1e80940SXin LI memcpy(val, keystream, sizeof(*val));
230c1e80940SXin LI memset(keystream, 0, sizeof(*val));
231c1e80940SXin LI rs->rs_have -= sizeof(*val);
232c1e80940SXin LI }
233c1e80940SXin LI
234c1e80940SXin LI uint32_t
arc4random(void)235c1e80940SXin LI arc4random(void)
236c1e80940SXin LI {
237c1e80940SXin LI uint32_t val;
238c1e80940SXin LI
239c1e80940SXin LI _ARC4_LOCK();
240c1e80940SXin LI _rs_random_u32(&val);
241c1e80940SXin LI _ARC4_UNLOCK();
242c1e80940SXin LI return val;
243c1e80940SXin LI }
244c1e80940SXin LI
245c1e80940SXin LI void
arc4random_buf(void * buf,size_t n)246c1e80940SXin LI arc4random_buf(void *buf, size_t n)
247c1e80940SXin LI {
248c1e80940SXin LI _ARC4_LOCK();
249c1e80940SXin LI _rs_random_buf(buf, n);
250c0b48470SDavid Schultz _ARC4_UNLOCK();
251bc6847e2SAndrey A. Chernov }
252