2 * THE BEER-WARE LICENSE
4 * <dan@FreeBSD.ORG> wrote this file. As long as you retain this notice you
5 * can do whatever you want with this stuff. If we meet some day, and you
6 * think this stuff is worth it, you can buy me a beer in return.
11 #include <sys/cdefs.h>
12 __FBSDID("$FreeBSD$");
14 #include <sys/types.h>
15 #include <sys/param.h>
16 #include <sys/kernel.h>
17 #include <sys/random.h>
18 #include <sys/libkern.h>
20 #include <sys/mutex.h>
23 #include <sys/malloc.h>
25 #define ARC4_RESEED_BYTES 65536
26 #define ARC4_RESEED_SECONDS 300
27 #define ARC4_KEYBYTES 256
29 int arc4rand_iniseed_state = ARC4_ENTR_NONE;
31 MALLOC_DEFINE(M_ARC4RANDOM, "arc4random", "arc4random structures");
40 } __aligned(CACHE_LINE_SIZE);
42 static struct arc4_s *arc4inst = NULL;
44 #define ARC4_FOREACH(_arc4) \
45 for (_arc4 = &arc4inst[0]; _arc4 <= &arc4inst[mp_maxid]; _arc4++)
47 static u_int8_t arc4_randbyte(struct arc4_s *arc4);
50 arc4_swap(u_int8_t *a, u_int8_t *b)
63 arc4_randomstir(struct arc4_s* arc4)
65 u_int8_t key[ARC4_KEYBYTES];
67 struct timeval tv_now;
70 * XXX: FIX!! This isn't brilliant. Need more confidence.
71 * This returns zero entropy before random(4) is seeded.
73 (void)read_random(key, ARC4_KEYBYTES);
74 getmicrouptime(&tv_now);
76 for (n = 0; n < 256; n++) {
77 arc4->j = (arc4->j + arc4->sbox[n] + key[n]) % 256;
78 arc4_swap(&arc4->sbox[n], &arc4->sbox[arc4->j]);
80 arc4->i = arc4->j = 0;
81 /* Reset for next reseed cycle. */
82 arc4->t_reseed = tv_now.tv_sec + ARC4_RESEED_SECONDS;
85 * Throw away the first N words of output, as suggested in the
86 * paper "Weaknesses in the Key Scheduling Algorithm of RC4"
87 * by Fluher, Mantin, and Shamir. (N = 768 in our case.)
89 * http://dl.acm.org/citation.cfm?id=646557.694759
91 for (n = 0; n < 768*4; n++)
94 mtx_unlock(&arc4->mtx);
98 * Initialize our S-box to its beginning defaults.
106 arc4inst = malloc((mp_maxid + 1) * sizeof(struct arc4_s),
107 M_ARC4RANDOM, M_NOWAIT | M_ZERO);
108 KASSERT(arc4inst != NULL, ("arc4_init: memory allocation error"));
111 mtx_init(&arc4->mtx, "arc4_mtx", NULL, MTX_DEF);
113 arc4->i = arc4->j = 0;
114 for (n = 0; n < 256; n++)
115 arc4->sbox[n] = (u_int8_t) n;
121 SYSINIT(arc4, SI_SUB_LOCK, SI_ORDER_ANY, arc4_init, NULL);
130 mtx_destroy(&arc4->mtx);
133 free(arc4inst, M_ARC4RANDOM);
136 SYSUNINIT(arc4, SI_SUB_LOCK, SI_ORDER_ANY, arc4_uninit, NULL);
140 * Generate a random byte.
143 arc4_randbyte(struct arc4_s *arc4)
147 arc4->i = (arc4->i + 1) % 256;
148 arc4->j = (arc4->j + arc4->sbox[arc4->i]) % 256;
150 arc4_swap(&arc4->sbox[arc4->i], &arc4->sbox[arc4->j]);
152 arc4_t = (arc4->sbox[arc4->i] + arc4->sbox[arc4->j]) % 256;
153 return arc4->sbox[arc4_t];
160 arc4rand(void *ptr, u_int len, int reseed)
166 if (reseed || atomic_cmpset_int(&arc4rand_iniseed_state,
167 ARC4_ENTR_HAVE, ARC4_ENTR_SEED)) {
169 arc4_randomstir(arc4);
172 arc4 = &arc4inst[curcpu];
174 if ((arc4->numruns > ARC4_RESEED_BYTES) ||
175 (tv.tv_sec > arc4->t_reseed))
176 arc4_randomstir(arc4);
178 mtx_lock(&arc4->mtx);
179 arc4->numruns += len;
182 *p++ = arc4_randbyte(arc4);
183 mtx_unlock(&arc4->mtx);
191 arc4rand(&ret, sizeof ret, 0);