trunk/Gnupg/random.c

/* random.c  - random number generator
 *      Copyright (C) 1998, 2000, 2001 Free Software Foundation, Inc.
 *      Copyright (C) 2001, 2002, 2003 Timo Schulz
 * 
 * This file is part of GPGLIB.
 *
 * GPGLIB is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * GPGLIB is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with GPGLIB; if not, write to the Free Software Foundation, 
 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
 *
 * ChangeLog:
 *
 * - Heavily modified to get rid of the log_xxx functions and other stuff
 *   that uses the console.
 * - Applied the XOR bug fix -ts 2002
 * - Removed Libgcrypt malloc stubs and use malloc, calloc and friends directly.
 */

/****************
 * This random number generator is modelled after the one described
 * in Peter Gutmann's Paper: "Software Generation of Practically
 * Strong Random Numbers".
 */

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <assert.h>
#include <errno.h>
#include <string.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <time.h>
#include <process.h>

#include "openpgp.h"
#include "md.h"


int gather_random_fast( void (*add)(const void*, size_t, int), int requester );

void _gpg_secure_random_alloc( void );
int  _gpg_quick_random_gen( int onoff );
int  _gpg_random_is_faked(void);
byte *_gpg_get_random_bits( size_t nbits, int level, int secure );
void _gpg_fast_random_poll( void );
int gather_random( void (*add)(const void*, size_t, int), int requester,
                  size_t length, int level );

#define fast_random_poll() _gpg_fast_random_poll ()

#define SIZEOF_UNSIGNED_LONG 4

#if SIZEOF_UNSIGNED_LONG == 8
  #define ADD_VALUE 0xa5a5a5a5a5a5a5a5
#elif SIZEOF_UNSIGNED_LONG == 4
  #define ADD_VALUE 0xa5a5a5a5
#else
  #error "weird size for an unsigned long"
#endif

#define BLOCKLEN  64   /* hash this amount of bytes */
#define DIGESTLEN 20   /* into a digest of this length (rmd160) */
/* poolblocks is the number of digests which make up the pool
 * and poolsize must be a multiple of the digest length
 * to make the AND operations faster, the size should also be
 * a multiple of u32
 */
#define POOLBLOCKS 30
#define POOLSIZE (POOLBLOCKS*DIGESTLEN)
#if (POOLSIZE % SIZEOF_UNSIGNED_LONG)
  #error Please make sure that poolsize is a multiple of u32
#endif
#define POOLWORDS (POOLSIZE / SIZEOF_UNSIGNED_LONG)


static int is_initialized;
#define MASK_LEVEL(a) do {if( a > 2 ) a = 2; else if( a < 0 ) a = 0; } while(0)
static char *rndpool;   /* allocated size is POOLSIZE+BLOCKLEN */
static char *keypool;   /* allocated size is POOLSIZE+BLOCKLEN */
static size_t pool_readpos;
static size_t pool_writepos;
static int pool_filled;
static int pool_balance;
static int just_mixed;
static int did_initial_extra_seeding;
static char *seed_file_name;
static int allow_seed_file_update;

static int secure_alloc;
static int quick_test;
static int faked_rng;


static byte *get_random_bytes( size_t nbytes, int level, int secure );
static void read_pool( byte *buffer, size_t length, int level );
static void add_randomness( const void *buffer, size_t length, int source );
static void random_poll(void);
static void read_random_source( int requester, size_t length, int level);
static int gather_faked( void (*add)(const void*, size_t, int), int requester,
                                                    size_t length, int level );

static struct {
    u32 mixrnd;
    u32 mixkey;
    u32 slowpolls;
    u32 fastpolls;
    u32 getbytes1;
    u32 ngetbytes1;
    u32 getbytes2;
    u32 ngetbytes2;
    u32 addbytes;
    u32 naddbytes;
} rndstats;

static void
initialize(void)
{
    /* The data buffer is allocated somewhat larger, so that
     * we can use this extra space (which is allocated in secure memory)
     * as a temporary hash buffer */
    rndpool = secure_alloc ? calloc(1,POOLSIZE+BLOCKLEN)
                           : calloc(1,POOLSIZE+BLOCKLEN);
    keypool = secure_alloc ? calloc(1,POOLSIZE+BLOCKLEN)
                           : calloc(1,POOLSIZE+BLOCKLEN);
    is_initialized = 1;
}

static void
burn_stack (int bytes)
{
    char buf[128];
    
    memset (buf, 0, sizeof buf);
    bytes -= sizeof buf;
    if (bytes > 0)
        burn_stack (bytes);
}

static void
random_err(const char *format, ...)
{
    char log[8192]; 
    va_list arg_ptr;

    va_start( arg_ptr, format );    
    _vsnprintf( log, sizeof log-1, format, arg_ptr );
    MessageBox( NULL, log, "Crypto RNG", MB_ICONERROR|MB_OK );
    va_end( arg_ptr );
} /* random_err */


void
_gpg_secure_random_alloc( void )
{
    secure_alloc = 1;
}


int
gpg_quick_random_gen( int onoff )
{
    int last;

    read_random_source(0,0,0); /* init */
    last = quick_test;
    if( onoff != -1 )
        quick_test = onoff;
    return faked_rng? 1 : last;
}


/****************
 * Fill the buffer with LENGTH bytes of cryptographically strong
 * random bytes. level 0 is not very strong, 1 is strong enough
 * for most usage, 2 is good for key generation stuff but may be very slow.
 */
void
gpg_randomize( byte *buffer, size_t length, int level )
{
    char *p = get_random_bytes( length, level, 1 );
    memcpy( buffer, p, length );
    free(p);
}


char
gpg_random_char( int level )
{       
    byte c = 0;

    while ( !isalnum( (int)c ) )
        gpg_randomize(&c, 1, level);    
    return c % 127; 
}


int
_gpg_random_is_faked()
{
    if( !is_initialized )
                initialize();
    return faked_rng || quick_test;
}

/****************
 * Return a pointer to a randomized buffer of level 0 and LENGTH bits
 * caller must free the buffer.
 * Note: The returned value is rounded up to bytes.
 */
static byte *
get_random_bytes( size_t nbytes, int level, int secure )
{
    byte *buf, *p;

    if( quick_test && level > 1 )
                level = 1;
    MASK_LEVEL(level);
    if( level == 1 ) {
        rndstats.getbytes1 += nbytes;
        rndstats.ngetbytes1++;
    }
    else if( level >= 2 ) {
        rndstats.getbytes2 += nbytes;
        rndstats.ngetbytes2++;
    }

    buf = secure && secure_alloc ? malloc( nbytes ) : malloc( nbytes );
    for( p = buf; nbytes > 0; ) {
        size_t n = nbytes > POOLSIZE? POOLSIZE : nbytes;
        read_pool( p, n, level );
        nbytes -= n;
        p += n;
    }
    return buf;
}

void *
gpg_random_bytes( size_t nbytes, int level )
{
    return get_random_bytes( nbytes, level, 0 );
}

void *
gpg_random_bytes_secure( size_t nbytes, int level )
{
    return get_random_bytes( nbytes, level, 1 );
}


/****************
 * Mix the pool
 */
static void
mix_pool(byte *pool)
{
    char *hashbuf = pool + POOLSIZE;
    char *p, *pend;
    int i, n;
    RMD160_CONTEXT md;

    rmd160_init( &md );
    /* loop over the pool */
    pend = pool + POOLSIZE;
    memcpy(hashbuf, pend - DIGESTLEN, DIGESTLEN );
    memcpy(hashbuf+DIGESTLEN, pool, BLOCKLEN-DIGESTLEN);
    rmd160_mixblock( &md, hashbuf);
    memcpy(pool, hashbuf, 20 );

    p = pool;
    for( n=1; n < POOLBLOCKS; n++ ) {
        memcpy(hashbuf, p, DIGESTLEN );
        p += DIGESTLEN;
        if( p+DIGESTLEN+BLOCKLEN < pend )
            memcpy(hashbuf+DIGESTLEN, p+DIGESTLEN, BLOCKLEN-DIGESTLEN);
        else {
            char *pp = p+DIGESTLEN;
            for(i=DIGESTLEN; i < BLOCKLEN; i++ ) {
                if( pp >= pend )
                    pp = pool;
                hashbuf[i] = *pp++;
            }
        }
        rmd160_mixblock( &md, hashbuf);
        memcpy(p, hashbuf, 20 );
    }
    burn_stack (200); /* for the rmd160_mixblock() */
}

void
_gpg_set_random_seed_file( const char *name )
{
    if( seed_file_name )
        random_err("Ohhh jeee, this is a BUG; File %s, Line %d", __FILE__, __LINE__);
    seed_file_name = strdup( name );
}

/****************
 * Read in a seed form the random_seed file
 * and return true if this was successful
 */
static int
read_seed_file()
{
    int fd;
    FILE *fp;
    struct stat sb;
    unsigned char buffer[POOLSIZE];
    int n;

    if( !seed_file_name )
        return 0;
  
        fp = fopen( seed_file_name, "rb" );    
    if( fp == NULL && errno == ENOENT) {
        allow_seed_file_update = 1;
        return 0;
    }
    if( fp == NULL ) {
        random_err("can't open `%s': %s", seed_file_name, strerror(errno));
        return 0;
    }
        fd = fileno(fp);
    if( fstat( fd, &sb ) ) {
        random_err("can't stat `%s': %s", seed_file_name, strerror(errno));
        fclose(fp);
        return 0;
    }
    if( !(sb.st_mode & _S_IFREG) ) {
        fclose(fp);
        return 0;
    }
    if( !sb.st_size ) {
        fclose(fp);
        allow_seed_file_update = 1;
        return 0;
    }
    if( sb.st_size != POOLSIZE ) {
        fclose(fp);
        return 0;
    }
    do {
        n = fread( buffer, 1, POOLSIZE, fp );
    } while( n == -1 && errno == EINTR );
    if( n != POOLSIZE ) {
        random_err("can't read `%s': %s", seed_file_name,strerror(errno));
        fclose(fp);
        return 0;
    }
    fclose(fp);

    add_randomness( buffer, POOLSIZE, 0 );
    /* add some minor entropy to the pool now (this will also force a mixing) */
    {   int x = getpid();
        add_randomness( &x, sizeof(x), 0 );
    }
    {   time_t x = time(NULL);
        add_randomness( &x, sizeof(x), 0 );
    }
    {   clock_t x = clock();
        add_randomness( &x, sizeof(x), 0 );
    }
    /* And read a few bytes from our entropy source.  By using
     * a level of 0 this will not block and might not return anything
     * with some entropy drivers, however the rndlinux driver will use
     * /dev/urandom and return some stuff - Do not read to much as we
     * want to be friendly to the scare system entropy resource. */
    read_random_source( 0, 16, 0 );

    allow_seed_file_update = 1;
    return 1;
}

void
_gpg_update_random_seed_file()
{
    u32 *sp, *dp;
    int i;
        FILE *fp;

    if( !seed_file_name || !is_initialized || !pool_filled )
                return;
    if( !allow_seed_file_update )
                return;

    /* copy the entropy pool to a scratch pool and mix both of them */
    for(i=0,dp=(u32*)keypool, sp=(u32*)rndpool; i < POOLWORDS; i++, dp++, sp++ ) {
        *dp = *sp + ADD_VALUE;
    }
    mix_pool(rndpool); rndstats.mixrnd++;
    mix_pool(keypool); rndstats.mixkey++;
  
    fp = fopen( seed_file_name, "w+b");
    if( fp == NULL ) {
        random_err("can't create `%s': %s\n", seed_file_name, strerror(errno));
        return;
    }
    do {
        i = fwrite( keypool, 1, POOLSIZE, fp );
    } while( i == -1 && errno == EINTR );
    if( i != POOLSIZE ) {
        random_err("can't write `%s': %s\n", seed_file_name, strerror(errno));
    }
    if( fclose(fp) ) {
        random_err("can't close `%s': %s\n", seed_file_name, strerror(errno));  
    }
}


static void
read_pool( byte *buffer, size_t length, int level )
{
    int i;
    u32 *sp, *dp;

    if( length >= POOLSIZE ) {
        random_err("too many random bits requested; the limit is %d\n", POOLSIZE*8-1);
    }
    if( !pool_filled ) {
        if( read_seed_file() )
            pool_filled = 1;
    }

    /* For level 2 quality (key generation) we alwas make
     * sure that the pool has been seeded enough initially */
    if( level == 2 && !did_initial_extra_seeding ) {
        size_t needed;

        pool_balance = 0;
        needed = length - pool_balance;
        if( needed < POOLSIZE/2 )
            needed = POOLSIZE/2;
        else if( needed > POOLSIZE )
            random_err("Ohhh jeee this is a BUG; File %s, Line %d", __FILE__, __LINE__);
        read_random_source( 3, needed, 2 );
        pool_balance += needed;
        did_initial_extra_seeding=1;
    }

    /* for level 2 make sure that there is enough random in the pool */
    if( level == 2 && pool_balance < length ) {
        size_t needed;

        if( pool_balance < 0 )
            pool_balance = 0;
        needed = length - pool_balance;
        if( needed > POOLSIZE )
            random_err("Ohhh jeee this is a BUG; File %s, Line %d", __FILE__, __LINE__);
        read_random_source( 3, needed, 2 );
        pool_balance += needed;
    }

    /* make sure the pool is filled */
    while( !pool_filled )       
        random_poll();

    /* do always a fast random poll */
    fast_random_poll();

    if( !level ) { /* no need for cryptographic strong random */
        /* create a new pool */
        for(i=0,dp=(u32*)keypool, sp=(u32*)rndpool; i < POOLWORDS; i++, dp++, sp++ )
            *dp = *sp + ADD_VALUE;
        /* must mix both pools */
        mix_pool(rndpool); rndstats.mixrnd++;
        mix_pool(keypool); rndstats.mixkey++;
        memcpy( buffer, keypool, length );
    }
    else {
        /* mix the pool (if add_randomness() didn't it) */
        if( !just_mixed ) {
            mix_pool(rndpool);
            rndstats.mixrnd++;
        }
        /* create a new pool */
        for(i=0,dp=(u32*)keypool, sp=(u32*)rndpool;
                                    i < POOLWORDS; i++, dp++, sp++ )
            *dp = *sp + ADD_VALUE;
        /* and mix both pools */
        mix_pool(rndpool); rndstats.mixrnd++;
        mix_pool(keypool); rndstats.mixkey++;
        /* read the required data
         * we use a readpoiter to read from a different postion each
         * time */
        while( length-- ) {
            *buffer++ = keypool[pool_readpos++];
            if( pool_readpos >= POOLSIZE )
                pool_readpos = 0;
            pool_balance--;
        }
        if( pool_balance < 0 )
            pool_balance = 0;
        /* and clear the keypool */
        memset( keypool, 0, POOLSIZE );
    }
}


/****************
 * Add LENGTH bytes of randomness from buffer to the pool.
 * source may be used to specify the randomness source.
 * Source is:
 *      0 - used ony for initialization
 *      1 - fast random poll function
 *      2 - normal poll function
 *      3 - used when level 2 random quality has been requested
 *          to do an extra pool seed.
 */
static void
add_randomness( const void *buffer, size_t length, int source )
{
    const byte *p = buffer;

    if( !is_initialized )
        initialize();
    rndstats.addbytes += length;
    rndstats.naddbytes++;
    while( length-- ) {
        rndpool[pool_writepos++] ^= *p++;
        if( pool_writepos >= POOLSIZE ) {
            if( source > 1 )
                pool_filled = 1;
            pool_writepos = 0;
            mix_pool(rndpool); rndstats.mixrnd++;
            just_mixed = !length;       
        }
    }
}

static void
random_poll( void )
{
    rndstats.slowpolls++;
    read_random_source( 2, POOLSIZE/5, 1 );
}

void
_gpg_fast_random_poll( void )
{
    static void (*fnc)( void (*)(const void*, size_t, int), int) = NULL;
    static int initialized = 0;

    rndstats.fastpolls++;
    if( !initialized ) {
        if( !is_initialized )
            initialize();
        initialized = 1;
        fnc = gather_random_fast;
    }
    if( fnc ) {
        (*fnc)( add_randomness, 1 );
        return;
    }

    /* fall back to the generic function */
      
    /* time and clock are availabe on all systems - so
     * we better do it just in case one of the above functions
     * didn't work */
    {   time_t x = time(NULL);
        add_randomness( &x, sizeof(x), 1 );
    }
    {   clock_t x = clock();
        add_randomness( &x, sizeof(x), 1 );
    }
}

static void
read_random_source( int requester, size_t length, int level )
{
    static int (*fnc)(void (*)(const void*, size_t, int), int,
                                                    size_t, int) = NULL;
    if( !fnc ) {
        if( !is_initialized )
            initialize();
        fnc = gather_random;
        if( !fnc ) {
            faked_rng = 1;
            fnc = gather_faked;
        }
        if( !requester && !length && !level )
            return; /* init only */
    }
    if( (*fnc)( add_randomness, requester, length, level ) < 0 )
        random_err("No way to gather entropy for the RNG\n");
}


static int
gather_faked( void (*add)(const void*, size_t, int), int requester,
                                size_t length, int level )
{
    static int initialized=0;
    size_t n;
    char *buffer, *p;

    if( !initialized ) {
        random_err("WARNING: using insecure random number generator!!\n");
        initialized=1;      
        srand( time(NULL)*getpid());
    }

    p = buffer = malloc( length );
    n = length;  
    while( n-- )
                *p++ = ((unsigned)(1 + (int) (256.0*rand()/(RAND_MAX+1.0)))-1);
    add_randomness( buffer, length, requester );
    free(buffer);
    return 0; /* okay */
}
1	/* random.c - random number generator
2	* Copyright (C) 1998, 2000, 2001 Free Software Foundation, Inc.
3	* Copyright (C) 2001, 2002, 2003 Timo Schulz
4	*
5	* This file is part of GPGLIB.
6	*
7	* GPGLIB is free software; you can redistribute it and/or modify
8	* it under the terms of the GNU General Public License as published by
9	* the Free Software Foundation; either version 2 of the License, or
10	* (at your option) any later version.
11	*
12	* GPGLIB is distributed in the hope that it will be useful,
13	* but WITHOUT ANY WARRANTY; without even the implied warranty of
14	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15	* GNU General Public License for more details.
16	*
17	* You should have received a copy of the GNU General Public License
18	* along with GPGLIB; if not, write to the Free Software Foundation,
19	* Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
20	*
21	* ChangeLog:
22	*
23	* - Heavily modified to get rid of the log_xxx functions and other stuff
24	* that uses the console.
25	* - Applied the XOR bug fix -ts 2002
26	* - Removed Libgcrypt malloc stubs and use malloc, calloc and friends directly.
27	*/
28
29	/****************
30	* This random number generator is modelled after the one described
31	* in Peter Gutmann's Paper: "Software Generation of Practically
32	* Strong Random Numbers".
33	*/
34
35	#include <windows.h>
36	#include <stdio.h>
37	#include <stdlib.h>
38	#include <assert.h>
39	#include <errno.h>
40	#include <string.h>
41	#include <sys/types.h>
42	#include <sys/stat.h>
43	#include <time.h>
44	#include <process.h>
45
46	#include "openpgp.h"
47	#include "md.h"
48
49
50	int gather_random_fast( void (add)(const void, size_t, int), int requester );
51
52	void _gpg_secure_random_alloc( void );
53	int _gpg_quick_random_gen( int onoff );
54	int _gpg_random_is_faked(void);
55	byte *_gpg_get_random_bits( size_t nbits, int level, int secure );
56	void _gpg_fast_random_poll( void );
57	int gather_random( void (add)(const void, size_t, int), int requester,
58	size_t length, int level );
59
60	#define fast_random_poll() _gpg_fast_random_poll ()
61
62	#define SIZEOF_UNSIGNED_LONG 4
63
64	#if SIZEOF_UNSIGNED_LONG == 8
65	#define ADD_VALUE 0xa5a5a5a5a5a5a5a5
66	#elif SIZEOF_UNSIGNED_LONG == 4
67	#define ADD_VALUE 0xa5a5a5a5
68	#else
69	#error "weird size for an unsigned long"
70	#endif
71
72	#define BLOCKLEN 64 /* hash this amount of bytes */
73	#define DIGESTLEN 20 /* into a digest of this length (rmd160) */
74	/* poolblocks is the number of digests which make up the pool
75	* and poolsize must be a multiple of the digest length
76	* to make the AND operations faster, the size should also be
77	* a multiple of u32
78	*/
79	#define POOLBLOCKS 30
80	#define POOLSIZE (POOLBLOCKS*DIGESTLEN)
81	#if (POOLSIZE % SIZEOF_UNSIGNED_LONG)
82	#error Please make sure that poolsize is a multiple of u32
83	#endif
84	#define POOLWORDS (POOLSIZE / SIZEOF_UNSIGNED_LONG)
85
86
87	static int is_initialized;
88	#define MASK_LEVEL(a) do {if( a > 2 ) a = 2; else if( a < 0 ) a = 0; } while(0)
89	static char rndpool; / allocated size is POOLSIZE+BLOCKLEN */
90	static char keypool; / allocated size is POOLSIZE+BLOCKLEN */
91	static size_t pool_readpos;
92	static size_t pool_writepos;
93	static int pool_filled;
94	static int pool_balance;
95	static int just_mixed;
96	static int did_initial_extra_seeding;
97	static char *seed_file_name;
98	static int allow_seed_file_update;
99
100	static int secure_alloc;
101	static int quick_test;
102	static int faked_rng;
103
104
105	static byte *get_random_bytes( size_t nbytes, int level, int secure );
106	static void read_pool( byte *buffer, size_t length, int level );
107	static void add_randomness( const void *buffer, size_t length, int source );
108	static void random_poll(void);
109	static void read_random_source( int requester, size_t length, int level);
110	static int gather_faked( void (add)(const void, size_t, int), int requester,
111	size_t length, int level );
112
113	static struct {
114	u32 mixrnd;
115	u32 mixkey;
116	u32 slowpolls;
117	u32 fastpolls;
118	u32 getbytes1;
119	u32 ngetbytes1;
120	u32 getbytes2;
121	u32 ngetbytes2;
122	u32 addbytes;
123	u32 naddbytes;
124	} rndstats;
125
126	static void
127	initialize(void)
128	{
129	/* The data buffer is allocated somewhat larger, so that
130	* we can use this extra space (which is allocated in secure memory)
131	* as a temporary hash buffer */
132	rndpool = secure_alloc ? calloc(1,POOLSIZE+BLOCKLEN)
133	: calloc(1,POOLSIZE+BLOCKLEN);
134	keypool = secure_alloc ? calloc(1,POOLSIZE+BLOCKLEN)
135	: calloc(1,POOLSIZE+BLOCKLEN);
136	is_initialized = 1;
137	}
138
139	static void
140	burn_stack (int bytes)
141	{
142	char buf[128];
143
144	memset (buf, 0, sizeof buf);
145	bytes -= sizeof buf;
146	if (bytes > 0)
147	burn_stack (bytes);
148	}
149
150	static void
151	random_err(const char *format, ...)
152	{
153	char log[8192];
154	va_list arg_ptr;
155
156	va_start( arg_ptr, format );
157	_vsnprintf( log, sizeof log-1, format, arg_ptr );
158	MessageBox( NULL, log, "Crypto RNG", MB_ICONERROR\|MB_OK );
159	va_end( arg_ptr );
160	} /* random_err */
161
162
163	void
164	_gpg_secure_random_alloc( void )
165	{
166	secure_alloc = 1;
167	}
168
169
170	int
171	gpg_quick_random_gen( int onoff )
172	{
173	int last;
174
175	read_random_source(0,0,0); /* init */
176	last = quick_test;
177	if( onoff != -1 )
178	quick_test = onoff;
179	return faked_rng? 1 : last;
180	}
181
182
183	/****************
184	* Fill the buffer with LENGTH bytes of cryptographically strong
185	* random bytes. level 0 is not very strong, 1 is strong enough
186	* for most usage, 2 is good for key generation stuff but may be very slow.
187	*/
188	void
189	gpg_randomize( byte *buffer, size_t length, int level )
190	{
191	char *p = get_random_bytes( length, level, 1 );
192	memcpy( buffer, p, length );
193	free(p);
194	}
195
196
197	char
198	gpg_random_char( int level )
199	{
200	byte c = 0;
201
202	while ( !isalnum( (int)c ) )
203	gpg_randomize(&c, 1, level);
204	return c % 127;
205	}
206
207
208	int
209	_gpg_random_is_faked()
210	{
211	if( !is_initialized )
212	initialize();
213	return faked_rng \|\| quick_test;
214	}
215
216	/****************
217	* Return a pointer to a randomized buffer of level 0 and LENGTH bits
218	* caller must free the buffer.
219	* Note: The returned value is rounded up to bytes.
220	*/
221	static byte *
222	get_random_bytes( size_t nbytes, int level, int secure )
223	{
224	byte buf, p;
225
226	if( quick_test && level > 1 )
227	level = 1;
228	MASK_LEVEL(level);
229	if( level == 1 ) {
230	rndstats.getbytes1 += nbytes;
231	rndstats.ngetbytes1++;
232	}
233	else if( level >= 2 ) {
234	rndstats.getbytes2 += nbytes;
235	rndstats.ngetbytes2++;
236	}
237
238	buf = secure && secure_alloc ? malloc( nbytes ) : malloc( nbytes );
239	for( p = buf; nbytes > 0; ) {
240	size_t n = nbytes > POOLSIZE? POOLSIZE : nbytes;
241	read_pool( p, n, level );
242	nbytes -= n;
243	p += n;
244	}
245	return buf;
246	}
247
248	void *
249	gpg_random_bytes( size_t nbytes, int level )
250	{
251	return get_random_bytes( nbytes, level, 0 );
252	}
253
254	void *
255	gpg_random_bytes_secure( size_t nbytes, int level )
256	{
257	return get_random_bytes( nbytes, level, 1 );
258	}
259
260
261	/****************
262	* Mix the pool
263	*/
264	static void
265	mix_pool(byte *pool)
266	{
267	char *hashbuf = pool + POOLSIZE;
268	char p, pend;
269	int i, n;
270	RMD160_CONTEXT md;
271
272	rmd160_init( &md );
273	/* loop over the pool */
274	pend = pool + POOLSIZE;
275	memcpy(hashbuf, pend - DIGESTLEN, DIGESTLEN );
276	memcpy(hashbuf+DIGESTLEN, pool, BLOCKLEN-DIGESTLEN);
277	rmd160_mixblock( &md, hashbuf);
278	memcpy(pool, hashbuf, 20 );
279
280	p = pool;
281	for( n=1; n < POOLBLOCKS; n++ ) {
282	memcpy(hashbuf, p, DIGESTLEN );
283	p += DIGESTLEN;
284	if( p+DIGESTLEN+BLOCKLEN < pend )
285	memcpy(hashbuf+DIGESTLEN, p+DIGESTLEN, BLOCKLEN-DIGESTLEN);
286	else {
287	char *pp = p+DIGESTLEN;
288	for(i=DIGESTLEN; i < BLOCKLEN; i++ ) {
289	if( pp >= pend )
290	pp = pool;
291	hashbuf[i] = *pp++;
292	}
293	}
294	rmd160_mixblock( &md, hashbuf);
295	memcpy(p, hashbuf, 20 );
296	}
297	burn_stack (200); /* for the rmd160_mixblock() */
298	}
299
300	void
301	_gpg_set_random_seed_file( const char *name )
302	{
303	if( seed_file_name )
304	random_err("Ohhh jeee, this is a BUG; File %s, Line %d", __FILE__, __LINE__);
305	seed_file_name = strdup( name );
306	}
307
308	/****************
309	* Read in a seed form the random_seed file
310	* and return true if this was successful
311	*/
312	static int
313	read_seed_file()
314	{
315	int fd;
316	FILE *fp;
317	struct stat sb;
318	unsigned char buffer[POOLSIZE];
319	int n;
320
321	if( !seed_file_name )
322	return 0;
323
324	fp = fopen( seed_file_name, "rb" );
325	if( fp == NULL && errno == ENOENT) {
326	allow_seed_file_update = 1;
327	return 0;
328	}
329	if( fp == NULL ) {
330	random_err("can't open `%s': %s", seed_file_name, strerror(errno));
331	return 0;
332	}
333	fd = fileno(fp);
334	if( fstat( fd, &sb ) ) {
335	random_err("can't stat `%s': %s", seed_file_name, strerror(errno));
336	fclose(fp);
337	return 0;
338	}
339	if( !(sb.st_mode & _S_IFREG) ) {
340	fclose(fp);
341	return 0;
342	}
343	if( !sb.st_size ) {
344	fclose(fp);
345	allow_seed_file_update = 1;
346	return 0;
347	}
348	if( sb.st_size != POOLSIZE ) {
349	fclose(fp);
350	return 0;
351	}
352	do {
353	n = fread( buffer, 1, POOLSIZE, fp );
354	} while( n == -1 && errno == EINTR );
355	if( n != POOLSIZE ) {
356	random_err("can't read `%s': %s", seed_file_name,strerror(errno));
357	fclose(fp);
358	return 0;
359	}
360	fclose(fp);
361
362	add_randomness( buffer, POOLSIZE, 0 );
363	/* add some minor entropy to the pool now (this will also force a mixing) */
364	{ int x = getpid();
365	add_randomness( &x, sizeof(x), 0 );
366	}
367	{ time_t x = time(NULL);
368	add_randomness( &x, sizeof(x), 0 );
369	}
370	{ clock_t x = clock();
371	add_randomness( &x, sizeof(x), 0 );
372	}
373	/* And read a few bytes from our entropy source. By using
374	* a level of 0 this will not block and might not return anything
375	* with some entropy drivers, however the rndlinux driver will use
376	* /dev/urandom and return some stuff - Do not read to much as we
377	* want to be friendly to the scare system entropy resource. */
378	read_random_source( 0, 16, 0 );
379
380	allow_seed_file_update = 1;
381	return 1;
382	}
383
384	void
385	_gpg_update_random_seed_file()
386	{
387	u32 sp, dp;
388	int i;
389	FILE *fp;
390
391	if( !seed_file_name \|\| !is_initialized \|\| !pool_filled )
392	return;
393	if( !allow_seed_file_update )
394	return;
395
396	/* copy the entropy pool to a scratch pool and mix both of them */
397	for(i=0,dp=(u32)keypool, sp=(u32)rndpool; i < POOLWORDS; i++, dp++, sp++ ) {
398	dp = sp + ADD_VALUE;
399	}
400	mix_pool(rndpool); rndstats.mixrnd++;
401	mix_pool(keypool); rndstats.mixkey++;
402
403	fp = fopen( seed_file_name, "w+b");
404	if( fp == NULL ) {
405	random_err("can't create `%s': %s\n", seed_file_name, strerror(errno));
406	return;
407	}
408	do {
409	i = fwrite( keypool, 1, POOLSIZE, fp );
410	} while( i == -1 && errno == EINTR );
411	if( i != POOLSIZE ) {
412	random_err("can't write `%s': %s\n", seed_file_name, strerror(errno));
413	}
414	if( fclose(fp) ) {
415	random_err("can't close `%s': %s\n", seed_file_name, strerror(errno));
416	}
417	}
418
419
420	static void
421	read_pool( byte *buffer, size_t length, int level )
422	{
423	int i;
424	u32 sp, dp;
425
426	if( length >= POOLSIZE ) {
427	random_err("too many random bits requested; the limit is %d\n", POOLSIZE*8-1);
428	}
429	if( !pool_filled ) {
430	if( read_seed_file() )
431	pool_filled = 1;
432	}
433
434	/* For level 2 quality (key generation) we alwas make
435	* sure that the pool has been seeded enough initially */
436	if( level == 2 && !did_initial_extra_seeding ) {
437	size_t needed;
438
439	pool_balance = 0;
440	needed = length - pool_balance;
441	if( needed < POOLSIZE/2 )
442	needed = POOLSIZE/2;
443	else if( needed > POOLSIZE )
444	random_err("Ohhh jeee this is a BUG; File %s, Line %d", __FILE__, __LINE__);
445	read_random_source( 3, needed, 2 );
446	pool_balance += needed;
447	did_initial_extra_seeding=1;
448	}
449
450	/* for level 2 make sure that there is enough random in the pool */
451	if( level == 2 && pool_balance < length ) {
452	size_t needed;
453
454	if( pool_balance < 0 )
455	pool_balance = 0;
456	needed = length - pool_balance;
457	if( needed > POOLSIZE )
458	random_err("Ohhh jeee this is a BUG; File %s, Line %d", __FILE__, __LINE__);
459	read_random_source( 3, needed, 2 );
460	pool_balance += needed;
461	}
462
463	/* make sure the pool is filled */
464	while( !pool_filled )
465	random_poll();
466
467	/* do always a fast random poll */
468	fast_random_poll();
469
470	if( !level ) { /* no need for cryptographic strong random */
471	/* create a new pool */
472	for(i=0,dp=(u32)keypool, sp=(u32)rndpool; i < POOLWORDS; i++, dp++, sp++ )
473	dp = sp + ADD_VALUE;
474	/* must mix both pools */
475	mix_pool(rndpool); rndstats.mixrnd++;
476	mix_pool(keypool); rndstats.mixkey++;
477	memcpy( buffer, keypool, length );
478	}
479	else {
480	/* mix the pool (if add_randomness() didn't it) */
481	if( !just_mixed ) {
482	mix_pool(rndpool);
483	rndstats.mixrnd++;
484	}
485	/* create a new pool */
486	for(i=0,dp=(u32)keypool, sp=(u32)rndpool;
487	i < POOLWORDS; i++, dp++, sp++ )
488	dp = sp + ADD_VALUE;
489	/* and mix both pools */
490	mix_pool(rndpool); rndstats.mixrnd++;
491	mix_pool(keypool); rndstats.mixkey++;
492	/* read the required data
493	* we use a readpoiter to read from a different postion each
494	* time */
495	while( length-- ) {
496	*buffer++ = keypool[pool_readpos++];
497	if( pool_readpos >= POOLSIZE )
498	pool_readpos = 0;
499	pool_balance--;
500	}
501	if( pool_balance < 0 )
502	pool_balance = 0;
503	/* and clear the keypool */
504	memset( keypool, 0, POOLSIZE );
505	}
506	}
507
508
509	/****************
510	* Add LENGTH bytes of randomness from buffer to the pool.
511	* source may be used to specify the randomness source.
512	* Source is:
513	* 0 - used ony for initialization
514	* 1 - fast random poll function
515	* 2 - normal poll function
516	* 3 - used when level 2 random quality has been requested
517	* to do an extra pool seed.
518	*/
519	static void
520	add_randomness( const void *buffer, size_t length, int source )
521	{
522	const byte *p = buffer;
523
524	if( !is_initialized )
525	initialize();
526	rndstats.addbytes += length;
527	rndstats.naddbytes++;
528	while( length-- ) {
529	rndpool[pool_writepos++] ^= *p++;
530	if( pool_writepos >= POOLSIZE ) {
531	if( source > 1 )
532	pool_filled = 1;
533	pool_writepos = 0;
534	mix_pool(rndpool); rndstats.mixrnd++;
535	just_mixed = !length;
536	}
537	}
538	}
539
540	static void
541	random_poll( void )
542	{
543	rndstats.slowpolls++;
544	read_random_source( 2, POOLSIZE/5, 1 );
545	}
546
547	void
548	_gpg_fast_random_poll( void )
549	{
550	static void (fnc)( void ()(const void*, size_t, int), int) = NULL;
551	static int initialized = 0;
552
553	rndstats.fastpolls++;
554	if( !initialized ) {
555	if( !is_initialized )
556	initialize();
557	initialized = 1;
558	fnc = gather_random_fast;
559	}
560	if( fnc ) {
561	(*fnc)( add_randomness, 1 );
562	return;
563	}
564
565	/* fall back to the generic function */
566
567	/* time and clock are availabe on all systems - so
568	* we better do it just in case one of the above functions
569	* didn't work */
570	{ time_t x = time(NULL);
571	add_randomness( &x, sizeof(x), 1 );
572	}
573	{ clock_t x = clock();
574	add_randomness( &x, sizeof(x), 1 );
575	}
576	}
577
578	static void
579	read_random_source( int requester, size_t length, int level )
580	{
581	static int (fnc)(void ()(const void*, size_t, int), int,
582	size_t, int) = NULL;
583	if( !fnc ) {
584	if( !is_initialized )
585	initialize();
586	fnc = gather_random;
587	if( !fnc ) {
588	faked_rng = 1;
589	fnc = gather_faked;
590	}
591	if( !requester && !length && !level )
592	return; /* init only */
593	}
594	if( (*fnc)( add_randomness, requester, length, level ) < 0 )
595	random_err("No way to gather entropy for the RNG\n");
596	}
597
598
599	static int
600	gather_faked( void (add)(const void, size_t, int), int requester,
601	size_t length, int level )
602	{
603	static int initialized=0;
604	size_t n;
605	char buffer, p;
606
607	if( !initialized ) {
608	random_err("WARNING: using insecure random number generator!!\n");
609	initialized=1;
610	srand( time(NULL)*getpid());
611	}
612
613	p = buffer = malloc( length );
614	n = length;
615	while( n-- )
616	p++ = ((unsigned)(1 + (int) (256.0rand()/(RAND_MAX+1.0)))-1);
617	add_randomness( buffer, length, requester );
618	free(buffer);
619	return 0; /* okay */
620	}