2 * util/random.c - thread safe random generator, which is reasonably secure.
4 * Copyright (c) 2007, NLnet Labs. All rights reserved.
6 * This software is open source.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * Redistributions of source code must retain the above copyright notice,
13 * this list of conditions and the following disclaimer.
15 * Redistributions in binary form must reproduce the above copyright notice,
16 * this list of conditions and the following disclaimer in the documentation
17 * and/or other materials provided with the distribution.
19 * Neither the name of the NLNET LABS nor the names of its contributors may
20 * be used to endorse or promote products derived from this software without
21 * specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
38 * Thread safe random functions. Similar to arc4random() with an explicit
39 * initialisation routine.
41 * The code in this file is based on arc4random from
42 * openssh-4.0p1/openbsd-compat/bsd-arc4random.c
43 * That code is also BSD licensed. Here is their statement:
45 * Copyright (c) 1996, David Mazieres <dm@uun.org>
46 * Copyright (c) 2008, Damien Miller <djm@openbsd.org>
48 * Permission to use, copy, modify, and distribute this software for any
49 * purpose with or without fee is hereby granted, provided that the above
50 * copyright notice and this permission notice appear in all copies.
52 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
53 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
54 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
55 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
56 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
57 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
58 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
61 #include "util/random.h"
71 #elif defined(HAVE_NETTLE)
76 * Max random value. Similar to RAND_MAX, but more portable
77 * (mingw uses only 15 bits random).
79 #define MAX_VALUE 0x7fffffff
83 ub_systemseed(unsigned int ATTR_UNUSED(seed))
85 /* arc4random_uniform does not need seeds, it gets kernel entropy */
89 ub_initstate(unsigned int ATTR_UNUSED(seed),
90 struct ub_randstate* ATTR_UNUSED(from))
92 struct ub_randstate* s = (struct ub_randstate*)malloc(1);
94 log_err("malloc failure in random init");
101 ub_random(struct ub_randstate* ATTR_UNUSED(s))
103 /* This relies on MAX_VALUE being 0x7fffffff. */
104 return (long)arc4random() & MAX_VALUE;
108 ub_random_max(struct ub_randstate* state, long int x)
111 /* on OpenBSD, this does not need _seed(), or _stir() calls */
112 return (long)arc4random_uniform((uint32_t)x);
115 #elif defined(HAVE_NSS)
117 /* not much to remember for NSS since we use its pk11_random, placeholder */
118 struct ub_randstate {
122 void ub_systemseed(unsigned int ATTR_UNUSED(seed))
126 struct ub_randstate* ub_initstate(unsigned int ATTR_UNUSED(seed),
127 struct ub_randstate* ATTR_UNUSED(from))
129 struct ub_randstate* s = (struct ub_randstate*)calloc(1, sizeof(*s));
131 log_err("malloc failure in random init");
137 long int ub_random(struct ub_randstate* ATTR_UNUSED(state))
140 /* random 31 bit value. */
141 SECStatus s = PK11_GenerateRandom((unsigned char*)&x, (int)sizeof(x));
142 if(s != SECSuccess) {
143 log_err("PK11_GenerateRandom error: %s",
144 PORT_ErrorToString(PORT_GetError()));
146 return x & MAX_VALUE;
149 #elif defined(HAVE_NETTLE)
152 * libnettle implements a Yarrow-256 generator (SHA256 + AES),
153 * and we have to ensure it is seeded before use.
155 struct ub_randstate {
156 struct yarrow256_ctx ctx;
160 void ub_systemseed(unsigned int ATTR_UNUSED(seed))
163 * We seed on init and not here, as we need the ctx to re-seed.
164 * This also means that re-seeding is not supported.
166 log_err("Re-seeding not supported, generator untouched");
169 struct ub_randstate* ub_initstate(unsigned int seed,
170 struct ub_randstate* ATTR_UNUSED(from))
172 struct ub_randstate* s = (struct ub_randstate*)calloc(1, sizeof(*s));
173 uint8_t buf[YARROW256_SEED_FILE_SIZE];
175 log_err("malloc failure in random init");
178 /* Setup Yarrow context */
179 yarrow256_init(&s->ctx, 0, NULL);
181 if(getentropy(buf, sizeof(buf)) != -1) {
183 yarrow256_seed(&s->ctx, YARROW256_SEED_FILE_SIZE, buf);
184 s->seeded = yarrow256_is_seeded(&s->ctx);
186 /* Stretch the uint32 input seed and feed it to Yarrow */
189 for(i=0; i < (YARROW256_SEED_FILE_SIZE/sizeof(seed)); i++) {
190 memmove(buf+i*sizeof(seed), &v, sizeof(seed));
191 v = v*seed + (uint32_t)i;
193 yarrow256_seed(&s->ctx, YARROW256_SEED_FILE_SIZE, buf);
194 s->seeded = yarrow256_is_seeded(&s->ctx);
200 long int ub_random(struct ub_randstate* s)
202 /* random 31 bit value. */
204 if (!s || !s->seeded) {
205 log_err("Couldn't generate randomness, Yarrow-256 generator not yet seeded");
207 yarrow256_random(&s->ctx, sizeof(x), (uint8_t *)&x);
209 return x & MAX_VALUE;
211 #endif /* HAVE_SSL or HAVE_NSS or HAVE_NETTLE */
214 #if defined(HAVE_NSS) || defined(HAVE_NETTLE)
216 ub_random_max(struct ub_randstate* state, long int x)
218 /* make sure we fetch in a range that is divisible by x. ignore
219 * values from d .. MAX_VALUE, instead draw a new number */
220 long int d = MAX_VALUE - (MAX_VALUE % x); /* d is divisible by x */
221 long int v = ub_random(state);
223 v = ub_random(state);
226 #endif /* HAVE_NSS or HAVE_NETTLE */
229 ub_randfree(struct ub_randstate* s)
233 /* user app must do RAND_cleanup(); */