2 * util/random.c - thread safe random generator, which is reasonably secure.
4 * Copyright (c) 2007, NLnet Labs. All rights reserved.
6 * This software is open source.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * Redistributions of source code must retain the above copyright notice,
13 * this list of conditions and the following disclaimer.
15 * Redistributions in binary form must reproduce the above copyright notice,
16 * this list of conditions and the following disclaimer in the documentation
17 * and/or other materials provided with the distribution.
19 * Neither the name of the NLNET LABS nor the names of its contributors may
20 * be used to endorse or promote products derived from this software without
21 * specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
38 * Thread safe random functions. Similar to arc4random() with an explicit
39 * initialisation routine.
41 * The code in this file is based on arc4random from
42 * openssh-4.0p1/openbsd-compat/bsd-arc4random.c
43 * That code is also BSD licensed. Here is their statement:
45 * Copyright (c) 1996, David Mazieres <dm@uun.org>
46 * Copyright (c) 2008, Damien Miller <djm@openbsd.org>
48 * Permission to use, copy, modify, and distribute this software for any
49 * purpose with or without fee is hereby granted, provided that the above
50 * copyright notice and this permission notice appear in all copies.
52 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
53 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
54 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
55 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
56 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
57 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
58 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
61 #include "util/random.h"
65 #include <openssl/rand.h>
66 #include <openssl/rc4.h>
67 #include <openssl/err.h>
68 #elif defined(HAVE_NSS)
77 * Max random value. Similar to RAND_MAX, but more portable
78 * (mingw uses only 15 bits random).
80 #define MAX_VALUE 0x7fffffff
84 * Struct with per-thread random state.
85 * Keeps SSL types away from the header file.
88 /** key used for arc4random generation */
90 /** keeps track of key usage */
94 /** Size of key to use (must be multiple of 8) */
97 /** Number of bytes to reseed after */
98 #define REKEY_BYTES (1 << 24)
100 /* (re)setup system seed */
102 ub_systemseed(unsigned int seed)
104 /* RAND_ is threadsafe, by the way */
107 unsigned char buf[256];
108 unsigned int v = seed;
110 for(i=0; i<256/sizeof(seed); i++) {
111 memmove(buf+i*sizeof(seed), &v, sizeof(seed));
112 v = v*seed + (unsigned int)i;
116 log_err("Random generator has no entropy "
117 "(error %ld)", ERR_get_error());
119 verbose(VERB_OPS, "openssl has no entropy, "
120 "seeding with time and pid");
125 /** reseed random generator */
127 ub_arc4random_stir(struct ub_randstate* s, struct ub_randstate* from)
129 /* not as unsigned char, but longerint so that it is
130 aligned properly on alignment sensitive platforms */
131 uint64_t rand_buf[SEED_SIZE/sizeof(uint64_t)];
134 memset(&s->rc4, 0, sizeof(s->rc4));
135 memset(rand_buf, 0xc, sizeof(rand_buf));
137 uint8_t* rbuf = (uint8_t*)rand_buf;
138 for(i=0; i<SEED_SIZE; i++)
139 rbuf[i] = (uint8_t)ub_random(from);
142 ub_systemseed((unsigned)getpid()^(unsigned)time(NULL));
143 if (RAND_bytes((unsigned char*)rand_buf,
144 (int)sizeof(rand_buf)) <= 0) {
145 /* very unlikely that this happens, since we seeded
146 * above, if it does; complain and keep going */
147 log_err("Couldn't obtain random bytes (error %ld)",
153 #ifdef HAVE_FIPS_MODE
155 /* RC4 is not allowed, get some trustworthy randomness */
156 /* double certainty here, this routine should not be
157 * called in FIPS_mode */
158 memset(rand_buf, 0, sizeof(rand_buf));
159 s->rc4_ready = REKEY_BYTES;
162 #endif /* FIPS_MODE */
163 RC4_set_key(&s->rc4, SEED_SIZE, (unsigned char*)rand_buf);
166 * Discard early keystream, as per recommendations in:
167 * http://www.wisdom.weizmann.ac.il/~itsik/RC4/Papers/Rc4_ksa.ps
169 for(i = 0; i <= 256; i += sizeof(rand_buf))
170 RC4(&s->rc4, sizeof(rand_buf), (unsigned char*)rand_buf,
171 (unsigned char*)rand_buf);
173 memset(rand_buf, 0, sizeof(rand_buf));
175 s->rc4_ready = REKEY_BYTES;
179 ub_initstate(unsigned int seed, struct ub_randstate* from)
181 struct ub_randstate* s = (struct ub_randstate*)calloc(1, sizeof(*s));
183 log_err("malloc failure in random init");
187 #ifdef HAVE_FIPS_MODE
190 ub_arc4random_stir(s, from);
195 ub_random(struct ub_randstate* s)
198 #ifdef HAVE_FIPS_MODE
200 /* RC4 is not allowed, get some trustworthy randomness */
201 /* we use pseudo bytes: it tries to return secure randomness
202 * but returns 'something' if that fails. We need something
203 * else if it fails, because we cannot block here */
204 if(RAND_pseudo_bytes((unsigned char*)&r, (int)sizeof(r))
206 log_err("FIPSmode, no arc4random but RAND failed "
207 "(error %ld)", ERR_get_error());
209 return (long int)((r) % (((unsigned)MAX_VALUE + 1)));
211 #endif /* FIPS_MODE */
212 if (s->rc4_ready <= 0) {
213 ub_arc4random_stir(s, NULL);
216 RC4(&s->rc4, sizeof(r),
217 (unsigned char *)&r, (unsigned char *)&r);
218 s->rc4_ready -= sizeof(r);
219 return (long int)((r) % (((unsigned)MAX_VALUE + 1)));
222 #elif defined(HAVE_NSS)
224 /* not much to remember for NSS since we use its pk11_random, placeholder */
225 struct ub_randstate {
229 void ub_systemseed(unsigned int ATTR_UNUSED(seed))
233 struct ub_randstate* ub_initstate(unsigned int ATTR_UNUSED(seed),
234 struct ub_randstate* ATTR_UNUSED(from))
236 struct ub_randstate* s = (struct ub_randstate*)calloc(1, sizeof(*s));
238 log_err("malloc failure in random init");
244 long int ub_random(struct ub_randstate* ATTR_UNUSED(state))
247 /* random 31 bit value. */
248 SECStatus s = PK11_GenerateRandom((unsigned char*)&x, (int)sizeof(x));
249 if(s != SECSuccess) {
250 log_err("PK11_GenerateRandom error: %s",
251 PORT_ErrorToString(PORT_GetError()));
253 return x & MAX_VALUE;
256 #endif /* HAVE_SSL or HAVE_NSS */
259 ub_random_max(struct ub_randstate* state, long int x)
261 /* make sure we fetch in a range that is divisible by x. ignore
262 * values from d .. MAX_VALUE, instead draw a new number */
263 long int d = MAX_VALUE - (MAX_VALUE % x); /* d is divisible by x */
264 long int v = ub_random(state);
266 v = ub_random(state);
271 ub_randfree(struct ub_randstate* s)
275 /* user app must do RAND_cleanup(); */