MFC r315225:

Discard first 3072 bytes of RC4 keystream, this is a bandaid
that allows us to work on switching to a more modern PRNG.

Submitted by: Steven Chamberlain <steven pyro eu org>
Approved by: so

Copy head (r256279) to stable/10 as part of the 10.0-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Attempt to mitigate poor initialization of arc4 by one-shot
reinitialization from yarrow right after good entropy is harvested.

Approved by: secteam (delphij)
MFC after: 1 week

Return arc4_i = arc4_j = 0; line from previous backing out since
just found it in OpenBSD, see their sys/crypto/arc4.c, function
rc4_keysetup, line ctx->x = ctx->y = 0;

Obtained from: OpenBSD

Per rwatson's request:
"If you don't get a review within a day or two, I would firmly recommend
backing out the changes"

back out all my changes as unreviewed by secteam@ yet.

1) Initialize arc4_i and arc4_j to 0 after key mixing as recommended in
draft-kaukonen-cipher-arcfour-03.txt (3.1.5)

2) Drop first 768 bytes as standard RC4-drop(768)

Lock down arc4random so it can be safely called w/o Giant.

Minor code reorganization was required, but the only functional
change was that the first 1024 bytes of output are thrown out
after each reseed, rather than just the initial seed.

Use __FBSDID().

Slight overhaul of arc4random() and friends.

One bug fixed: Use getmicrouptime() to trigger reseeds so that we
cannot be tricked by a clock being stepped backwards.

Express parameters in natural units and with natural names.

Don't use struct timeval more than we need to.

Various stylistic and readability polishing.

Introduce arc4rand(void *ptr, u_int len, int reseed) function which
returns a stream of pseudo-random bytes, observing the automatic
reseed criteria as well as allowing forced reseeds.

Rewrite arc4random() in terms of arc4rand().

Sponsored by: DARPA & NAI Labs.

Fixed some typos, verboseness and misformatting in comments.

Minor improvements to arc4random():

- Decrease reseeding interval from every 64 to every 16384 runs
to reduce entropy usage.
- Add time based reseeding. (Every 5 minutes.)
- Throw away the first 256 words of output as suggested in
"Weaknesses in the Key Scheduling Algorithm of RC4."

Reviewed by: Mark Murray
MFC After: jkh says ok

Recouple arc4random(9) to the entropy device. This works whether the
entropy device is loaded or not.

If the entropy device is NOT loaded, the the quality of perturbations
supplied by this will suffer.

Back out previous revision now that sys/random.h is properly fixed.

Add #include's of sys/proc.h and sys/param.h to silence a warning.

Comment out unavailable call. This needs to be revisited when the entropy
device is complete.
Reviewed by: dfr

In the extremely miniscule chance that read_random returns <= 0, don't try
and use that return code as a modulus (panics are bad, mmmkay?)

Address the concerns of the ``randomness'' of the initial PRNG. Now, we
use bits from /dev/random to stir the S-box. Also add an internal counter to
keep the S-box stirred on a regular basis.

Reviewed by: msmith

Introduce OpenBSD-like Random PIDs. Controlled by a sysctl knob
(kern.randompid), which is currently defaulted off. Use ARC4 (RC4) for our
random number generation, which will not get me executed for violating
crypto laws; a Good Thing(tm).

Reviewed and Approved by: bde, imp