1 /*
2 * Entropy accumulator implementation
3 *
4 * Copyright (C) 2006-2016, ARM Limited, All Rights Reserved
5 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 *
19 * This file is part of mbed TLS (https://tls.mbed.org)
20 */
21
22 #if !defined(MBEDTLS_CONFIG_FILE)
23 #include "mbedtls/config.h"
24 #else
25 #include MBEDTLS_CONFIG_FILE
26 #endif
27
28 #if defined(MBEDTLS_ENTROPY_C)
29
30 #include "mbedtls/entropy.h"
31 #include "mbedtls/entropy_poll.h"
32
33 #include <string.h>
34
35 #if defined(MBEDTLS_FS_IO)
36 #include <stdio.h>
37 #endif
38
39 #include "arc4_alt.h"
40
41 #define ENTROPY_MAX_LOOP 256 /**< Maximum amount to loop before error */
42
mbedtls_entropy_init(mbedtls_entropy_context * ctx)43 void mbedtls_entropy_init( mbedtls_entropy_context *ctx )
44 {
45 memset( ctx, 0, sizeof(mbedtls_entropy_context) );
46
47 #if defined(MBEDTLS_THREADING_C)
48 mbedtls_mutex_init( &ctx->mutex );
49 #endif
50
51 #if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
52 mbedtls_sha512_starts( &ctx->accumulator, 0 );
53 #else
54 mbedtls_sha256_starts( &ctx->accumulator, 0 );
55 #endif
56
57 mbedtls_entropy_add_source( ctx, mbedtls_platform_entropy_poll, NULL,
58 MBEDTLS_ENTROPY_MIN_PLATFORM,
59 MBEDTLS_ENTROPY_SOURCE_STRONG );
60 #if defined(MBEDTLS_TIMING_C)
61 mbedtls_entropy_add_source( ctx, mbedtls_hardclock_poll, NULL,
62 MBEDTLS_ENTROPY_MIN_HARDCLOCK,
63 MBEDTLS_ENTROPY_SOURCE_WEAK );
64 #endif
65 #if defined(MBEDTLS_ENTROPY_HARDWARE_ALT)
66 mbedtls_entropy_add_source( ctx, mbedtls_hardware_poll, NULL,
67 MBEDTLS_ENTROPY_MIN_HARDWARE,
68 MBEDTLS_ENTROPY_SOURCE_STRONG );
69 #endif
70 }
71
mbedtls_entropy_free(mbedtls_entropy_context * ctx)72 void mbedtls_entropy_free( mbedtls_entropy_context *ctx )
73 {
74 #if defined(MBEDTLS_THREADING_C)
75 mbedtls_mutex_free( &ctx->mutex );
76 #endif
77 mbedtls_zeroize( ctx, sizeof( mbedtls_entropy_context ) );
78 }
79
mbedtls_entropy_add_source(mbedtls_entropy_context * ctx,mbedtls_entropy_f_source_ptr f_source,void * p_source,size_t threshold,int strong)80 int mbedtls_entropy_add_source( mbedtls_entropy_context *ctx,
81 mbedtls_entropy_f_source_ptr f_source, void *p_source,
82 size_t threshold, int strong )
83 {
84 int index, ret = 0;
85
86 #if defined(MBEDTLS_THREADING_C)
87 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
88 return( ret );
89 #endif
90
91 index = ctx->source_count;
92 if( index >= MBEDTLS_ENTROPY_MAX_SOURCES )
93 {
94 ret = MBEDTLS_ERR_ENTROPY_MAX_SOURCES;
95 goto exit;
96 }
97
98 ctx->source[index].f_source = f_source;
99 ctx->source[index].p_source = p_source;
100 ctx->source[index].threshold = threshold;
101 ctx->source[index].strong = strong;
102
103 ctx->source_count++;
104
105 exit:
106 #if defined(MBEDTLS_THREADING_C)
107 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
108 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
109 #endif
110
111 return( ret );
112 }
113
114 /*
115 * Entropy accumulator update
116 */
entropy_update(mbedtls_entropy_context * ctx,unsigned char source_id,const unsigned char * data,size_t len)117 static int entropy_update( mbedtls_entropy_context *ctx, unsigned char source_id,
118 const unsigned char *data, size_t len )
119 {
120 unsigned char header[2];
121 unsigned char tmp[MBEDTLS_ENTROPY_BLOCK_SIZE];
122 size_t use_len = len;
123 const unsigned char *p = data;
124
125 if( use_len > MBEDTLS_ENTROPY_BLOCK_SIZE )
126 {
127 #if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
128 mbedtls_sha512( data, len, tmp, 0 );
129 #else
130 mbedtls_sha256( data, len, tmp, 0 );
131 #endif
132 p = tmp;
133 use_len = MBEDTLS_ENTROPY_BLOCK_SIZE;
134 }
135
136 header[0] = source_id;
137 header[1] = use_len & 0xFF;
138
139 #if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
140 mbedtls_sha512_update( &ctx->accumulator, header, 2 );
141 mbedtls_sha512_update( &ctx->accumulator, p, use_len );
142 #else
143 mbedtls_sha256_update( &ctx->accumulator, header, 2 );
144 mbedtls_sha256_update( &ctx->accumulator, p, use_len );
145 #endif
146
147 return( 0 );
148 }
149
mbedtls_entropy_update_manual(mbedtls_entropy_context * ctx,const unsigned char * data,size_t len)150 int mbedtls_entropy_update_manual( mbedtls_entropy_context *ctx,
151 const unsigned char *data, size_t len )
152 {
153 int ret;
154
155 #if defined(MBEDTLS_THREADING_C)
156 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
157 return( ret );
158 #endif
159
160 ret = entropy_update( ctx, MBEDTLS_ENTROPY_SOURCE_MANUAL, data, len );
161
162 #if defined(MBEDTLS_THREADING_C)
163 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
164 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
165 #endif
166
167 return( ret );
168 }
169
170 /*
171 * Run through the different sources to add entropy to our accumulator
172 */
entropy_gather_internal(mbedtls_entropy_context * ctx)173 static int entropy_gather_internal( mbedtls_entropy_context *ctx )
174 {
175 int ret, i, have_one_strong = 0;
176 unsigned char buf[MBEDTLS_ENTROPY_MAX_GATHER];
177 size_t olen;
178
179 if( ctx->source_count == 0 )
180 return( MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED );
181
182 /*
183 * Run through our entropy sources
184 */
185 for( i = 0; i < ctx->source_count; i++ )
186 {
187 if( ctx->source[i].strong == MBEDTLS_ENTROPY_SOURCE_STRONG )
188 have_one_strong = 1;
189
190 olen = 0;
191 if( ( ret = ctx->source[i].f_source( ctx->source[i].p_source,
192 buf, MBEDTLS_ENTROPY_MAX_GATHER, &olen ) ) != 0 )
193 {
194 return( ret );
195 }
196
197 /*
198 * Add if we actually gathered something
199 */
200 if( olen > 0 )
201 {
202 entropy_update( ctx, (unsigned char) i, buf, olen );
203 ctx->source[i].size += olen;
204 }
205 }
206
207 if( have_one_strong == 0 )
208 return( MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE );
209
210 return( 0 );
211 }
212
213 /*
214 * Thread-safe wrapper for entropy_gather_internal()
215 */
mbedtls_entropy_gather(mbedtls_entropy_context * ctx)216 int mbedtls_entropy_gather( mbedtls_entropy_context *ctx )
217 {
218 int ret;
219
220 #if defined(MBEDTLS_THREADING_C)
221 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
222 return( ret );
223 #endif
224
225 ret = entropy_gather_internal( ctx );
226
227 #if defined(MBEDTLS_THREADING_C)
228 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
229 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
230 #endif
231
232 return( ret );
233 }
234
mbedtls_entropy_func(void * data,unsigned char * output,size_t len)235 int mbedtls_entropy_func( void *data, unsigned char *output, size_t len )
236 {
237 int ret, count = 0, i, done;
238 mbedtls_entropy_context *ctx = (mbedtls_entropy_context *) data;
239 unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE];
240
241 if( len > MBEDTLS_ENTROPY_BLOCK_SIZE )
242 return( MBEDTLS_ERR_ENTROPY_SOURCE_FAILED );
243
244 #if defined(MBEDTLS_THREADING_C)
245 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
246 return( ret );
247 #endif
248
249 /*
250 * Always gather extra entropy before a call
251 */
252 do
253 {
254 if( count++ > ENTROPY_MAX_LOOP )
255 {
256 ret = MBEDTLS_ERR_ENTROPY_SOURCE_FAILED;
257 goto exit;
258 }
259
260 if( ( ret = entropy_gather_internal( ctx ) ) != 0 )
261 goto exit;
262
263 done = 1;
264 for( i = 0; i < ctx->source_count; i++ )
265 if( ctx->source[i].size < ctx->source[i].threshold )
266 done = 0;
267 }
268 while( ! done );
269
270 memset( buf, 0, MBEDTLS_ENTROPY_BLOCK_SIZE );
271
272 #if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR)
273 mbedtls_sha512_finish( &ctx->accumulator, buf );
274
275 /*
276 * Reset accumulator and counters and recycle existing entropy
277 */
278 memset( &ctx->accumulator, 0, sizeof( mbedtls_sha512_context ) );
279 mbedtls_sha512_starts( &ctx->accumulator, 0 );
280 mbedtls_sha512_update( &ctx->accumulator, buf, MBEDTLS_ENTROPY_BLOCK_SIZE );
281
282 /*
283 * Perform second SHA-512 on entropy
284 */
285 mbedtls_sha512( buf, MBEDTLS_ENTROPY_BLOCK_SIZE, buf, 0 );
286 #else /* MBEDTLS_ENTROPY_SHA512_ACCUMULATOR */
287 mbedtls_sha256_finish( &ctx->accumulator, buf );
288
289 /*
290 * Reset accumulator and counters and recycle existing entropy
291 */
292 memset( &ctx->accumulator, 0, sizeof( mbedtls_sha256_context ) );
293 mbedtls_sha256_starts( &ctx->accumulator, 0 );
294 mbedtls_sha256_update( &ctx->accumulator, buf, MBEDTLS_ENTROPY_BLOCK_SIZE );
295
296 /*
297 * Perform second SHA-256 on entropy
298 */
299 mbedtls_sha256( buf, MBEDTLS_ENTROPY_BLOCK_SIZE, buf, 0 );
300 #endif /* MBEDTLS_ENTROPY_SHA512_ACCUMULATOR */
301
302 for( i = 0; i < ctx->source_count; i++ )
303 ctx->source[i].size = 0;
304
305 memcpy( output, buf, len );
306
307 ret = 0;
308
309 exit:
310 #if defined(MBEDTLS_THREADING_C)
311 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
312 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
313 #endif
314
315 return( ret );
316 }
317
318 #if defined(MBEDTLS_FS_IO)
mbedtls_entropy_write_seed_file(mbedtls_entropy_context * ctx,const char * path)319 int mbedtls_entropy_write_seed_file( mbedtls_entropy_context *ctx, const char *path )
320 {
321 int ret = MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
322 FILE *f;
323 unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE];
324
325 if( ( f = fopen( path, "wb" ) ) == NULL )
326 return( MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR );
327
328 if( ( ret = mbedtls_entropy_func( ctx, buf, MBEDTLS_ENTROPY_BLOCK_SIZE ) ) != 0 )
329 goto exit;
330
331 if( fwrite( buf, 1, MBEDTLS_ENTROPY_BLOCK_SIZE, f ) != MBEDTLS_ENTROPY_BLOCK_SIZE )
332 {
333 ret = MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR;
334 goto exit;
335 }
336
337 ret = 0;
338
339 exit:
340 fclose( f );
341 return( ret );
342 }
343
mbedtls_entropy_update_seed_file(mbedtls_entropy_context * ctx,const char * path)344 int mbedtls_entropy_update_seed_file( mbedtls_entropy_context *ctx, const char *path )
345 {
346 FILE *f;
347 size_t n;
348 unsigned char buf[ MBEDTLS_ENTROPY_MAX_SEED_SIZE ];
349
350 if( ( f = fopen( path, "rb" ) ) == NULL )
351 return( MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR );
352
353 fseek( f, 0, SEEK_END );
354 n = (size_t) ftell( f );
355 fseek( f, 0, SEEK_SET );
356
357 if( n > MBEDTLS_ENTROPY_MAX_SEED_SIZE )
358 n = MBEDTLS_ENTROPY_MAX_SEED_SIZE;
359
360 if( fread( buf, 1, n, f ) != n )
361 {
362 fclose( f );
363 return( MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR );
364 }
365
366 fclose( f );
367
368 mbedtls_entropy_update_manual( ctx, buf, n );
369
370 return( mbedtls_entropy_write_seed_file( ctx, path ) );
371 }
372 #endif /* MBEDTLS_FS_IO */
373
374 #endif /* MBEDTLS_ENTROPY_C */
375