1/* crypto/rand/md_rand.c */ 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 3 * All rights reserved. 4 * 5 * This package is an SSL implementation written 6 * by Eric Young (eay@cryptsoft.com). 7 * The implementation was written so as to conform with Netscapes SSL. 8 * 9 * This library is free for commercial and non-commercial use as long as 10 * the following conditions are aheared to. The following conditions 11 * apply to all code found in this distribution, be it the RC4, RSA, 12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation 13 * included with this distribution is covered by the same copyright terms 14 * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15 * 16 * Copyright remains Eric Young's, and as such any Copyright notices in 17 * the code are not to be removed. 18 * If this package is used in a product, Eric Young should be given attribution 19 * as the author of the parts of the library used. 20 * This can be in the form of a textual message at program startup or 21 * in documentation (online or textual) provided with the package. 22 * 23 * Redistribution and use in source and binary forms, with or without 24 * modification, are permitted provided that the following conditions 25 * are met: 26 * 1. Redistributions of source code must retain the copyright 27 * notice, this list of conditions and the following disclaimer. 28 * 2. Redistributions in binary form must reproduce the above copyright 29 * notice, this list of conditions and the following disclaimer in the 30 * documentation and/or other materials provided with the distribution. 31 * 3. All advertising materials mentioning features or use of this software 32 * must display the following acknowledgement: 33 * "This product includes cryptographic software written by 34 * Eric Young (eay@cryptsoft.com)" 35 * The word 'cryptographic' can be left out if the rouines from the library 36 * being used are not cryptographic related :-). 37 * 4. If you include any Windows specific code (or a derivative thereof) from 38 * the apps directory (application code) you must include an acknowledgement: 39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40 * 41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 51 * SUCH DAMAGE. 52 * 53 * The licence and distribution terms for any publically available version or 54 * derivative of this code cannot be changed. i.e. this code cannot simply be 55 * copied and put under another distribution licence 56 * [including the GNU Public Licence.] 57 */ 58/* ==================================================================== 59 * Copyright (c) 1998-2001 The OpenSSL Project. All rights reserved. 60 * 61 * Redistribution and use in source and binary forms, with or without 62 * modification, are permitted provided that the following conditions 63 * are met: 64 * 65 * 1. Redistributions of source code must retain the above copyright 66 * notice, this list of conditions and the following disclaimer. 67 * 68 * 2. Redistributions in binary form must reproduce the above copyright 69 * notice, this list of conditions and the following disclaimer in 70 * the documentation and/or other materials provided with the 71 * distribution. 72 * 73 * 3. All advertising materials mentioning features or use of this 74 * software must display the following acknowledgment: 75 * "This product includes software developed by the OpenSSL Project 76 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 77 * 78 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 79 * endorse or promote products derived from this software without 80 * prior written permission. For written permission, please contact 81 * openssl-core@openssl.org. 82 * 83 * 5. Products derived from this software may not be called "OpenSSL" 84 * nor may "OpenSSL" appear in their names without prior written 85 * permission of the OpenSSL Project. 86 * 87 * 6. Redistributions of any form whatsoever must retain the following 88 * acknowledgment: 89 * "This product includes software developed by the OpenSSL Project 90 * for use in the OpenSSL Toolkit (http://www.openssl.org/)" 91 * 92 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 93 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 94 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 95 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 96 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 97 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 98 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 99 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 100 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 101 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 103 * OF THE POSSIBILITY OF SUCH DAMAGE. 104 * ==================================================================== 105 * 106 * This product includes cryptographic software written by Eric Young 107 * (eay@cryptsoft.com). This product includes software written by Tim 108 * Hudson (tjh@cryptsoft.com). 109 * 110 */ 111 112#define OPENSSL_FIPSEVP 113 114#ifdef MD_RAND_DEBUG 115# ifndef NDEBUG 116# define NDEBUG 117# endif 118#endif 119 120#include <assert.h> 121#include <stdio.h> 122#include <string.h> 123 124#include "e_os.h" 125 126#include <openssl/crypto.h> 127#include <openssl/rand.h> 128#include "rand_lcl.h" 129 130#include <openssl/err.h> 131 132#ifdef BN_DEBUG 133# define PREDICT 134#endif 135 136/* #define PREDICT 1 */ 137 138#define STATE_SIZE 1023 139static int state_num=0,state_index=0; 140static unsigned char state[STATE_SIZE+MD_DIGEST_LENGTH]; 141static unsigned char md[MD_DIGEST_LENGTH]; 142static long md_count[2]={0,0}; 143static double entropy=0; 144 145static unsigned int crypto_lock_rand = 0; /* may be set only when a thread 146 * holds CRYPTO_LOCK_RAND 147 * (to prevent double locking) */ 148/* access to lockin_thread is synchronized by CRYPTO_LOCK_RAND2 */ 149static CRYPTO_THREADID locking_threadid; /* valid iff crypto_lock_rand is set */ 150 151 152#ifdef PREDICT 153int rand_predictable=0; 154#endif 155 156const char RAND_version[]="RAND" OPENSSL_VERSION_PTEXT; 157 158static void ssleay_rand_cleanup(void); 159static void ssleay_rand_seed(const void *buf, int num); 160static void ssleay_rand_add(const void *buf, int num, double add_entropy); 161static int ssleay_rand_nopseudo_bytes(unsigned char *buf, int num); 162static int ssleay_rand_pseudo_bytes(unsigned char *buf, int num); 163static int ssleay_rand_status(void); 164 165RAND_METHOD rand_ssleay_meth={ 166 ssleay_rand_seed, 167 ssleay_rand_nopseudo_bytes, 168 ssleay_rand_cleanup, 169 ssleay_rand_add, 170 ssleay_rand_pseudo_bytes, 171 ssleay_rand_status 172 }; 173 174RAND_METHOD *RAND_SSLeay(void) 175 { 176 return(&rand_ssleay_meth); 177 } 178 179static void ssleay_rand_cleanup(void) 180 { 181 OPENSSL_cleanse(state,sizeof(state)); 182 state_num=0; 183 state_index=0; 184 OPENSSL_cleanse(md,MD_DIGEST_LENGTH); 185 md_count[0]=0; 186 md_count[1]=0; 187 entropy=0; 188 } 189 190static void ssleay_rand_add(const void *buf, int num, double add) 191 { 192 int i,j,k,st_idx; 193 long md_c[2]; 194 unsigned char local_md[MD_DIGEST_LENGTH]; 195 EVP_MD_CTX m; 196 int do_not_lock; 197 198 if (!num) 199 return; 200 201 /* 202 * (Based on the rand(3) manpage) 203 * 204 * The input is chopped up into units of 20 bytes (or less for 205 * the last block). Each of these blocks is run through the hash 206 * function as follows: The data passed to the hash function 207 * is the current 'md', the same number of bytes from the 'state' 208 * (the location determined by in incremented looping index) as 209 * the current 'block', the new key data 'block', and 'count' 210 * (which is incremented after each use). 211 * The result of this is kept in 'md' and also xored into the 212 * 'state' at the same locations that were used as input into the 213 * hash function. 214 */ 215 216 /* check if we already have the lock */ 217 if (crypto_lock_rand) 218 { 219 CRYPTO_THREADID cur; 220 CRYPTO_THREADID_current(&cur); 221 CRYPTO_r_lock(CRYPTO_LOCK_RAND2); 222 do_not_lock = !CRYPTO_THREADID_cmp(&locking_threadid, &cur); 223 CRYPTO_r_unlock(CRYPTO_LOCK_RAND2); 224 } 225 else 226 do_not_lock = 0; 227 228 if (!do_not_lock) CRYPTO_w_lock(CRYPTO_LOCK_RAND); 229 st_idx=state_index; 230 231 /* use our own copies of the counters so that even 232 * if a concurrent thread seeds with exactly the 233 * same data and uses the same subarray there's _some_ 234 * difference */ 235 md_c[0] = md_count[0]; 236 md_c[1] = md_count[1]; 237 238 memcpy(local_md, md, sizeof md); 239 240 /* state_index <= state_num <= STATE_SIZE */ 241 state_index += num; 242 if (state_index >= STATE_SIZE) 243 { 244 state_index%=STATE_SIZE; 245 state_num=STATE_SIZE; 246 } 247 else if (state_num < STATE_SIZE) 248 { 249 if (state_index > state_num) 250 state_num=state_index; 251 } 252 /* state_index <= state_num <= STATE_SIZE */ 253 254 /* state[st_idx], ..., state[(st_idx + num - 1) % STATE_SIZE] 255 * are what we will use now, but other threads may use them 256 * as well */ 257 258 md_count[1] += (num / MD_DIGEST_LENGTH) + (num % MD_DIGEST_LENGTH > 0); 259 260 if (!do_not_lock) CRYPTO_w_unlock(CRYPTO_LOCK_RAND); 261 262 EVP_MD_CTX_init(&m); 263 for (i=0; i<num; i+=MD_DIGEST_LENGTH) 264 { 265 j=(num-i); 266 j=(j > MD_DIGEST_LENGTH)?MD_DIGEST_LENGTH:j; 267 268 MD_Init(&m); 269 MD_Update(&m,local_md,MD_DIGEST_LENGTH); 270 k=(st_idx+j)-STATE_SIZE; 271 if (k > 0) 272 { 273 MD_Update(&m,&(state[st_idx]),j-k); 274 MD_Update(&m,&(state[0]),k); 275 } 276 else 277 MD_Update(&m,&(state[st_idx]),j); 278 279 /* DO NOT REMOVE THE FOLLOWING CALL TO MD_Update()! */ 280 MD_Update(&m,buf,j); 281 /* We know that line may cause programs such as 282 purify and valgrind to complain about use of 283 uninitialized data. The problem is not, it's 284 with the caller. Removing that line will make 285 sure you get really bad randomness and thereby 286 other problems such as very insecure keys. */ 287 288 MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c)); 289 MD_Final(&m,local_md); 290 md_c[1]++; 291 292 buf=(const char *)buf + j; 293 294 for (k=0; k<j; k++) 295 { 296 /* Parallel threads may interfere with this, 297 * but always each byte of the new state is 298 * the XOR of some previous value of its 299 * and local_md (itermediate values may be lost). 300 * Alway using locking could hurt performance more 301 * than necessary given that conflicts occur only 302 * when the total seeding is longer than the random 303 * state. */ 304 state[st_idx++]^=local_md[k]; 305 if (st_idx >= STATE_SIZE) 306 st_idx=0; 307 } 308 } 309 EVP_MD_CTX_cleanup(&m); 310 311 if (!do_not_lock) CRYPTO_w_lock(CRYPTO_LOCK_RAND); 312 /* Don't just copy back local_md into md -- this could mean that 313 * other thread's seeding remains without effect (except for 314 * the incremented counter). By XORing it we keep at least as 315 * much entropy as fits into md. */ 316 for (k = 0; k < (int)sizeof(md); k++) 317 { 318 md[k] ^= local_md[k]; 319 } 320 if (entropy < ENTROPY_NEEDED) /* stop counting when we have enough */ 321 entropy += add; 322 if (!do_not_lock) CRYPTO_w_unlock(CRYPTO_LOCK_RAND); 323 324#if !defined(OPENSSL_THREADS) && !defined(OPENSSL_SYS_WIN32) 325 assert(md_c[1] == md_count[1]); 326#endif 327 } 328 329static void ssleay_rand_seed(const void *buf, int num) 330 { 331 ssleay_rand_add(buf, num, (double)num); 332 } 333 334int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo, int lock) 335 { 336 static volatile int stirred_pool = 0; 337 int i,j,k,st_num,st_idx; 338 int num_ceil; 339 int ok; 340 long md_c[2]; 341 unsigned char local_md[MD_DIGEST_LENGTH]; 342 EVP_MD_CTX m; 343#ifndef GETPID_IS_MEANINGLESS 344 pid_t curr_pid = getpid(); 345#endif 346 int do_stir_pool = 0; 347 348#ifdef PREDICT 349 if (rand_predictable) 350 { 351 static unsigned char val=0; 352 353 for (i=0; i<num; i++) 354 buf[i]=val++; 355 return(1); 356 } 357#endif 358 359 if (num <= 0) 360 return 1; 361 362 EVP_MD_CTX_init(&m); 363 /* round upwards to multiple of MD_DIGEST_LENGTH/2 */ 364 num_ceil = (1 + (num-1)/(MD_DIGEST_LENGTH/2)) * (MD_DIGEST_LENGTH/2); 365 366 /* 367 * (Based on the rand(3) manpage:) 368 * 369 * For each group of 10 bytes (or less), we do the following: 370 * 371 * Input into the hash function the local 'md' (which is initialized from 372 * the global 'md' before any bytes are generated), the bytes that are to 373 * be overwritten by the random bytes, and bytes from the 'state' 374 * (incrementing looping index). From this digest output (which is kept 375 * in 'md'), the top (up to) 10 bytes are returned to the caller and the 376 * bottom 10 bytes are xored into the 'state'. 377 * 378 * Finally, after we have finished 'num' random bytes for the 379 * caller, 'count' (which is incremented) and the local and global 'md' 380 * are fed into the hash function and the results are kept in the 381 * global 'md'. 382 */ 383 if (lock) 384 CRYPTO_w_lock(CRYPTO_LOCK_RAND); 385 386 /* prevent ssleay_rand_bytes() from trying to obtain the lock again */ 387 CRYPTO_w_lock(CRYPTO_LOCK_RAND2); 388 CRYPTO_THREADID_current(&locking_threadid); 389 CRYPTO_w_unlock(CRYPTO_LOCK_RAND2); 390 crypto_lock_rand = 1; 391 392 if (!stirred_pool) 393 do_stir_pool = 1; 394 395 ok = (entropy >= ENTROPY_NEEDED); 396 if (!ok) 397 { 398 399 RAND_poll(); 400 ok = (entropy >= ENTROPY_NEEDED); 401 402 } 403 404 if (!ok) 405 { 406 407 /* If the PRNG state is not yet unpredictable, then seeing 408 * the PRNG output may help attackers to determine the new 409 * state; thus we have to decrease the entropy estimate. 410 * Once we've had enough initial seeding we don't bother to 411 * adjust the entropy count, though, because we're not ambitious 412 * to provide *information-theoretic* randomness. 413 * 414 * NOTE: This approach fails if the program forks before 415 * we have enough entropy. Entropy should be collected 416 * in a separate input pool and be transferred to the 417 * output pool only when the entropy limit has been reached. 418 */ 419 entropy -= num; 420 if (entropy < 0) 421 entropy = 0; 422 } 423 424 if (do_stir_pool) 425 { 426 /* In the output function only half of 'md' remains secret, 427 * so we better make sure that the required entropy gets 428 * 'evenly distributed' through 'state', our randomness pool. 429 * The input function (ssleay_rand_add) chains all of 'md', 430 * which makes it more suitable for this purpose. 431 */ 432 433 int n = STATE_SIZE; /* so that the complete pool gets accessed */ 434 while (n > 0) 435 { 436#if MD_DIGEST_LENGTH > 20 437# error "Please adjust DUMMY_SEED." 438#endif 439#define DUMMY_SEED "...................." /* at least MD_DIGEST_LENGTH */ 440 /* Note that the seed does not matter, it's just that 441 * ssleay_rand_add expects to have something to hash. */ 442 ssleay_rand_add(DUMMY_SEED, MD_DIGEST_LENGTH, 0.0); 443 n -= MD_DIGEST_LENGTH; 444 } 445 if (ok) 446 stirred_pool = 1; 447 } 448 449 st_idx=state_index; 450 st_num=state_num; 451 md_c[0] = md_count[0]; 452 md_c[1] = md_count[1]; 453 memcpy(local_md, md, sizeof md); 454 455 state_index+=num_ceil; 456 if (state_index > state_num) 457 state_index %= state_num; 458 459 /* state[st_idx], ..., state[(st_idx + num_ceil - 1) % st_num] 460 * are now ours (but other threads may use them too) */ 461 462 md_count[0] += 1; 463 464 /* before unlocking, we must clear 'crypto_lock_rand' */ 465 crypto_lock_rand = 0; 466 if (lock) 467 CRYPTO_w_unlock(CRYPTO_LOCK_RAND); 468 469 while (num > 0) 470 { 471 /* num_ceil -= MD_DIGEST_LENGTH/2 */ 472 j=(num >= MD_DIGEST_LENGTH/2)?MD_DIGEST_LENGTH/2:num; 473 num-=j; 474 MD_Init(&m); 475#ifndef GETPID_IS_MEANINGLESS 476 if (curr_pid) /* just in the first iteration to save time */ 477 { 478 MD_Update(&m,(unsigned char*)&curr_pid,sizeof curr_pid); 479 curr_pid = 0; 480 } 481#endif 482 MD_Update(&m,local_md,MD_DIGEST_LENGTH); 483 MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c)); 484 485#ifndef PURIFY /* purify complains */ 486 /* The following line uses the supplied buffer as a small 487 * source of entropy: since this buffer is often uninitialised 488 * it may cause programs such as purify or valgrind to 489 * complain. So for those builds it is not used: the removal 490 * of such a small source of entropy has negligible impact on 491 * security. 492 */ 493 MD_Update(&m,buf,j); 494#endif 495 496 k=(st_idx+MD_DIGEST_LENGTH/2)-st_num; 497 if (k > 0) 498 { 499 MD_Update(&m,&(state[st_idx]),MD_DIGEST_LENGTH/2-k); 500 MD_Update(&m,&(state[0]),k); 501 } 502 else 503 MD_Update(&m,&(state[st_idx]),MD_DIGEST_LENGTH/2); 504 MD_Final(&m,local_md); 505 506 for (i=0; i<MD_DIGEST_LENGTH/2; i++) 507 { 508 state[st_idx++]^=local_md[i]; /* may compete with other threads */ 509 if (st_idx >= st_num) 510 st_idx=0; 511 if (i < j) 512 *(buf++)=local_md[i+MD_DIGEST_LENGTH/2]; 513 } 514 } 515 516 MD_Init(&m); 517 MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c)); 518 MD_Update(&m,local_md,MD_DIGEST_LENGTH); 519 if (lock) 520 CRYPTO_w_lock(CRYPTO_LOCK_RAND); 521 MD_Update(&m,md,MD_DIGEST_LENGTH); 522 MD_Final(&m,md); 523 if (lock) 524 CRYPTO_w_unlock(CRYPTO_LOCK_RAND); 525 526 EVP_MD_CTX_cleanup(&m); 527 if (ok) 528 return(1); 529 else if (pseudo) 530 return 0; 531 else 532 { 533 RANDerr(RAND_F_SSLEAY_RAND_BYTES,RAND_R_PRNG_NOT_SEEDED); 534 ERR_add_error_data(1, "You need to read the OpenSSL FAQ, " 535 "http://www.openssl.org/support/faq.html"); 536 return(0); 537 } 538 } 539 540static int ssleay_rand_nopseudo_bytes(unsigned char *buf, int num) 541 { 542 return ssleay_rand_bytes(buf, num, 0, 1); 543 } 544 545/* pseudo-random bytes that are guaranteed to be unique but not 546 unpredictable */ 547static int ssleay_rand_pseudo_bytes(unsigned char *buf, int num) 548 { 549 return ssleay_rand_bytes(buf, num, 1, 1); 550 } 551 552static int ssleay_rand_status(void) 553 { 554 CRYPTO_THREADID cur; 555 int ret; 556 int do_not_lock; 557 558 CRYPTO_THREADID_current(&cur); 559 /* check if we already have the lock 560 * (could happen if a RAND_poll() implementation calls RAND_status()) */ 561 if (crypto_lock_rand) 562 { 563 CRYPTO_r_lock(CRYPTO_LOCK_RAND2); 564 do_not_lock = !CRYPTO_THREADID_cmp(&locking_threadid, &cur); 565 CRYPTO_r_unlock(CRYPTO_LOCK_RAND2); 566 } 567 else 568 do_not_lock = 0; 569 570 if (!do_not_lock) 571 { 572 CRYPTO_w_lock(CRYPTO_LOCK_RAND); 573 574 /* prevent ssleay_rand_bytes() from trying to obtain the lock again */ 575 CRYPTO_w_lock(CRYPTO_LOCK_RAND2); 576 CRYPTO_THREADID_cpy(&locking_threadid, &cur); 577 CRYPTO_w_unlock(CRYPTO_LOCK_RAND2); 578 crypto_lock_rand = 1; 579 } 580 581 if (entropy < ENTROPY_NEEDED) 582 { 583 RAND_poll(); 584 } 585 586 ret = entropy >= ENTROPY_NEEDED; 587 588 if (!do_not_lock) 589 { 590 /* before unlocking, we must clear 'crypto_lock_rand' */ 591 crypto_lock_rand = 0; 592 593 CRYPTO_w_unlock(CRYPTO_LOCK_RAND); 594 } 595 596 return ret; 597 } 598