2 * cryptographic random number generator for PuTTY's ssh client
8 void noise_get_heavy(void (*func) (void *, int));
9 void noise_get_light(void (*func) (void *, int));
12 * `pool' itself is a pool of random data which we actually use: we
13 * return bytes from `pool', at position `poolpos', until `poolpos'
14 * reaches the end of the pool. At this point we generate more
15 * random data, by adding noise, stirring well, and resetting
16 * `poolpos' to point to just past the beginning of the pool (not
17 * _the_ beginning, since otherwise we'd give away the whole
18 * contents of our pool, and attackers would just have to guess the
21 * `incomingb' buffers acquired noise data, until it gets full, at
22 * which point the acquired noise is SHA'ed into `incoming' and
23 * `incomingb' is cleared. The noise in `incoming' is used as part
24 * of the noise for each stirring of the pool, in addition to local
25 * time, process listings, and other such stuff.
28 #define HASHINPUT 64 /* 64 bytes SHA input */
29 #define HASHSIZE 20 /* 160 bits SHA output */
30 #define POOLSIZE 1200 /* size of random pool */
33 unsigned char pool[POOLSIZE];
36 unsigned char incoming[HASHSIZE];
38 unsigned char incomingb[HASHINPUT];
42 static struct RandPool pool;
43 int random_active = 0;
45 static void random_stir(void)
47 word32 block[HASHINPUT / sizeof(word32)];
48 word32 digest[HASHSIZE / sizeof(word32)];
51 noise_get_light(random_add_noise);
53 SHATransform((word32 *) pool.incoming, (word32 *) pool.incomingb);
57 * Chunks of this code are blatantly endianness-dependent, but
58 * as it's all random bits anyway, WHO CARES?
60 memcpy(digest, pool.incoming, sizeof(digest));
63 * Make two passes over the pool.
65 for (i = 0; i < 2; i++) {
68 * We operate SHA in CFB mode, repeatedly adding the same
69 * block of data to the digest. But we're also fiddling
70 * with the digest-so-far, so this shouldn't be Bad or
73 memcpy(block, pool.pool, sizeof(block));
76 * Each pass processes the pool backwards in blocks of
77 * HASHSIZE, just so that in general we get the output of
78 * SHA before the corresponding input, in the hope that
79 * things will be that much less predictable that way
80 * round, when we subsequently return bytes ...
82 for (j = POOLSIZE; (j -= HASHSIZE) >= 0;) {
84 * XOR the bit of the pool we're processing into the
88 for (k = 0; k < sizeof(digest) / sizeof(*digest); k++)
89 digest[k] ^= ((word32 *) (pool.pool + j))[k];
92 * Munge our unrevealed first block of the pool into
95 SHATransform(digest, block);
98 * Stick the result back into the pool.
101 for (k = 0; k < sizeof(digest) / sizeof(*digest); k++)
102 ((word32 *) (pool.pool + j))[k] = digest[k];
107 * Might as well save this value back into `incoming', just so
108 * there'll be some extra bizarreness there.
110 SHATransform(digest, block);
111 memcpy(pool.incoming, digest, sizeof(digest));
113 pool.poolpos = sizeof(pool.incoming);
116 void random_add_noise(void *noise, int length)
118 unsigned char *p = noise;
125 * This function processes HASHINPUT bytes into only HASHSIZE
126 * bytes, so _if_ we were getting incredibly high entropy
127 * sources then we would be throwing away valuable stuff.
129 while (length >= (HASHINPUT - pool.incomingpos)) {
130 memcpy(pool.incomingb + pool.incomingpos, p,
131 HASHINPUT - pool.incomingpos);
132 p += HASHINPUT - pool.incomingpos;
133 length -= HASHINPUT - pool.incomingpos;
134 SHATransform((word32 *) pool.incoming, (word32 *) pool.incomingb);
135 for (i = 0; i < HASHSIZE; i++) {
136 pool.pool[pool.poolpos++] ^= pool.incomingb[i];
137 if (pool.poolpos >= POOLSIZE)
140 if (pool.poolpos < HASHSIZE)
143 pool.incomingpos = 0;
146 memcpy(pool.incomingb + pool.incomingpos, p, length);
147 pool.incomingpos += length;
150 void random_add_heavynoise(void *noise, int length)
152 unsigned char *p = noise;
155 while (length >= POOLSIZE) {
156 for (i = 0; i < POOLSIZE; i++)
157 pool.pool[i] ^= *p++;
162 for (i = 0; i < length; i++)
163 pool.pool[i] ^= *p++;
167 static void random_add_heavynoise_bitbybit(void *noise, int length)
169 unsigned char *p = noise;
172 while (length >= POOLSIZE - pool.poolpos) {
173 for (i = 0; i < POOLSIZE - pool.poolpos; i++)
174 pool.pool[pool.poolpos + i] ^= *p++;
176 length -= POOLSIZE - pool.poolpos;
180 for (i = 0; i < length; i++)
181 pool.pool[i] ^= *p++;
185 void random_init(void)
187 memset(&pool, 0, sizeof(pool)); /* just to start with */
191 noise_get_heavy(random_add_heavynoise_bitbybit);
195 int random_byte(void)
197 if (pool.poolpos >= POOLSIZE)
200 return pool.pool[pool.poolpos++];
203 void random_get_savedata(void **data, int *len)
205 void *buf = smalloc(POOLSIZE / 2);
207 memcpy(buf, pool.pool + pool.poolpos, POOLSIZE / 2);