2 * Copyright (c) 2000-2015 Mark R V Murray
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer
10 * in this position and unchanged.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28 #include <sys/cdefs.h>
29 __FBSDID("$FreeBSD$");
32 #include <sys/param.h>
33 #include <sys/malloc.h>
34 #include <sys/random.h>
35 #include <sys/sysctl.h>
36 #include <sys/systm.h>
38 #include <sys/param.h>
39 #include <sys/types.h>
45 #include "unit_test.h"
49 #define KEYSTREAM_ONLY
50 #define CHACHA_NONCE0_CTR128
51 #include <crypto/chacha20/chacha.c>
52 #include <crypto/rijndael/rijndael-api-fst.h>
53 #include <crypto/sha2/sha256.h>
55 #include <dev/random/hash.h>
57 #include <dev/random/randomdev.h>
60 /* This code presumes that RANDOM_KEYSIZE is twice as large as RANDOM_BLOCKSIZE */
61 CTASSERT(RANDOM_KEYSIZE == 2*RANDOM_BLOCKSIZE);
63 /* Validate that full Chacha IV is as large as the 128-bit counter */
64 _Static_assert(CHACHA_STATELEN == RANDOM_BLOCKSIZE, "");
67 * Experimental Chacha20-based PRF for Fortuna keystream primitive. For now,
68 * disabled by default. But we may enable it in the future.
70 * Benefits include somewhat faster keystream generation compared with
71 * unaccelerated AES-ICM.
73 bool random_chachamode = false;
75 SYSCTL_BOOL(_kern_random, OID_AUTO, use_chacha20_cipher, CTLFLAG_RDTUN,
76 &random_chachamode, 0,
77 "If non-zero, use the ChaCha20 cipher for randomdev PRF. "
78 "If zero, use AES-ICM cipher for randomdev PRF (default).");
81 /* Initialise the hash */
83 randomdev_hash_init(struct randomdev_hash *context)
86 SHA256_Init(&context->sha);
89 /* Iterate the hash */
91 randomdev_hash_iterate(struct randomdev_hash *context, const void *data, size_t size)
94 SHA256_Update(&context->sha, data, size);
97 /* Conclude by returning the hash in the supplied <*buf> which must be
98 * RANDOM_KEYSIZE bytes long.
101 randomdev_hash_finish(struct randomdev_hash *context, void *buf)
104 SHA256_Final(buf, &context->sha);
107 /* Initialise the encryption routine by setting up the key schedule
108 * from the supplied <*data> which must be RANDOM_KEYSIZE bytes of binary
112 randomdev_encrypt_init(union randomdev_key *context, const void *data)
115 if (random_chachamode) {
116 chacha_keysetup(&context->chacha, data, RANDOM_KEYSIZE * 8);
118 rijndael_cipherInit(&context->cipher, MODE_ECB, NULL);
119 rijndael_makeKey(&context->key, DIR_ENCRYPT, RANDOM_KEYSIZE*8, data);
124 * Create a psuedorandom output stream of 'blockcount' blocks using a CTR-mode
125 * cipher or similar. The 128-bit counter is supplied in the in-out parmeter
126 * 'ctr.' The output stream goes to 'd_out.' 'blockcount' RANDOM_BLOCKSIZE
127 * bytes are generated.
130 randomdev_keystream(union randomdev_key *context, uint128_t *ctr,
131 void *d_out, u_int blockcount)
135 if (random_chachamode) {
139 * Chacha always encodes and increments the counter little
140 * endian. So on BE machines, we must provide a swapped
141 * counter to chacha, and swap the output too.
143 le128enc(&lectr, *ctr);
145 chacha_ivsetup(&context->chacha, NULL, (const void *)&lectr);
146 chacha_encrypt_bytes(&context->chacha, NULL, d_out,
147 RANDOM_BLOCKSIZE * blockcount);
150 * Decode Chacha-updated LE counter to native endian and store
151 * it back in the caller's in-out parameter.
153 chacha_ctrsave(&context->chacha, (void *)&lectr);
154 *ctr = le128dec(&lectr);
156 for (i = 0; i < blockcount; i++) {
158 * FS&K - r = r|E(K,C)
161 rijndael_blockEncrypt(&context->cipher, &context->key,
162 (void *)ctr, RANDOM_BLOCKSIZE * 8, d_out);
163 d_out = (char *)d_out + RANDOM_BLOCKSIZE;
164 uint128_increment(ctr);
170 * Fetch a pointer to the relevant key material and its size.
172 * This API is expected to only be used only for reseeding, where the
173 * endianness does not matter; the goal is to simply incorporate the key
174 * material into the hash iterator that will produce key'.
176 * Do not expect the buffer pointed to by this API to match the exact
177 * endianness, etc, as the key material that was supplied to
178 * randomdev_encrypt_init().
181 randomdev_getkey(union randomdev_key *context, const void **keyp, size_t *szp)
184 if (!random_chachamode) {
185 *keyp = &context->key.keyMaterial;
186 *szp = context->key.keyLen / 8;
191 *keyp = (const void *)&context->chacha.input[4];
193 /* Sanity check keysize */
194 if (context->chacha.input[0] == U8TO32_LITTLE(sigma) &&
195 context->chacha.input[1] == U8TO32_LITTLE(&sigma[4]) &&
196 context->chacha.input[2] == U8TO32_LITTLE(&sigma[8]) &&
197 context->chacha.input[3] == U8TO32_LITTLE(&sigma[12])) {
204 * Included for the sake of completeness; as-implemented, Fortuna
205 * doesn't need or use 128-bit Chacha20.
207 if (context->chacha->input[0] == U8TO32_LITTLE(tau) &&
208 context->chacha->input[1] == U8TO32_LITTLE(&tau[4]) &&
209 context->chacha->input[2] == U8TO32_LITTLE(&tau[8]) &&
210 context->chacha->input[3] == U8TO32_LITTLE(&tau[12])) {
217 panic("%s: Invalid chacha20 keysize: %16D\n", __func__,
218 (void *)context->chacha.input, " ");