reactos/dll/3rdparty/mbedtls/havege.c

   1 /**
   2  *  \brief HAVEGE: HArdware Volatile Entropy Gathering and Expansion
   3  *
   4  *  Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
   5  *  SPDX-License-Identifier: GPL-2.0
   6  *
   7  *  This program is free software; you can redistribute it and/or modify
   8  *  it under the terms of the GNU General Public License as published by
   9  *  the Free Software Foundation; either version 2 of the License, or
  10  *  (at your option) any later version.
  11  *
  12  *  This program is distributed in the hope that it will be useful,
  13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *  GNU General Public License for more details.
  16  *
  17  *  You should have received a copy of the GNU General Public License along
  18  *  with this program; if not, write to the Free Software Foundation, Inc.,
  19  *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  20  *
  21  *  This file is part of mbed TLS (https://tls.mbed.org)
  22  */
  23 /*
  24  *  The HAVEGE RNG was designed by Andre Seznec in 2002.
  25  *
  26  *  http://www.irisa.fr/caps/projects/hipsor/publi.php
  27  *
  28  *  Contact: seznec(at)irisa_dot_fr - orocheco(at)irisa_dot_fr
  29  */
  30
  31 #if !defined(MBEDTLS_CONFIG_FILE)
  32 #include "mbedtls/config.h"
  33 #else
  34 #include MBEDTLS_CONFIG_FILE
  35 #endif
  36
  37 #if defined(MBEDTLS_HAVEGE_C)
  38
  39 #include "mbedtls/havege.h"
  40 #include "mbedtls/timing.h"
  41
  42 #include <string.h>
  43
  44 /* Implementation that should never be optimized out by the compiler */
  45 static void mbedtls_zeroize( void *v, size_t n ) {
  46     volatile unsigned char *p = v; while( n-- ) *p++ = 0;
  47 }
  48
  49 /* ------------------------------------------------------------------------
  50  * On average, one iteration accesses two 8-word blocks in the havege WALK
  51  * table, and generates 16 words in the RES array.
  52  *
  53  * The data read in the WALK table is updated and permuted after each use.
  54  * The result of the hardware clock counter read is used  for this update.
  55  *
  56  * 25 conditional tests are present.  The conditional tests are grouped in
  57  * two nested  groups of 12 conditional tests and 1 test that controls the
  58  * permutation; on average, there should be 6 tests executed and 3 of them
  59  * should be mispredicted.
  60  * ------------------------------------------------------------------------
  61  */
  62
  63 #define SWAP(X,Y) { int *T = X; X = Y; Y = T; }
  64
  65 #define TST1_ENTER if( PTEST & 1 ) { PTEST ^= 3; PTEST >>= 1;
  66 #define TST2_ENTER if( PTEST & 1 ) { PTEST ^= 3; PTEST >>= 1;
  67
  68 #define TST1_LEAVE U1++; }
  69 #define TST2_LEAVE U2++; }
  70
  71 #define ONE_ITERATION                                   \
  72                                                         \
  73     PTEST = PT1 >> 20;                                  \
  74                                                         \
  75     TST1_ENTER  TST1_ENTER  TST1_ENTER  TST1_ENTER      \
  76     TST1_ENTER  TST1_ENTER  TST1_ENTER  TST1_ENTER      \
  77     TST1_ENTER  TST1_ENTER  TST1_ENTER  TST1_ENTER      \
  78                                                         \
  79     TST1_LEAVE  TST1_LEAVE  TST1_LEAVE  TST1_LEAVE      \
  80     TST1_LEAVE  TST1_LEAVE  TST1_LEAVE  TST1_LEAVE      \
  81     TST1_LEAVE  TST1_LEAVE  TST1_LEAVE  TST1_LEAVE      \
  82                                                         \
  83     PTX = (PT1 >> 18) & 7;                              \
  84     PT1 &= 0x1FFF;                                      \
  85     PT2 &= 0x1FFF;                                      \
  86     CLK = (int) mbedtls_timing_hardclock();                            \
  87                                                         \
  88     i = 0;                                              \
  89     A = &WALK[PT1    ]; RES[i++] ^= *A;                 \
  90     B = &WALK[PT2    ]; RES[i++] ^= *B;                 \
  91     C = &WALK[PT1 ^ 1]; RES[i++] ^= *C;                 \
  92     D = &WALK[PT2 ^ 4]; RES[i++] ^= *D;                 \
  93                                                         \
  94     IN = (*A >> (1)) ^ (*A << (31)) ^ CLK;              \
  95     *A = (*B >> (2)) ^ (*B << (30)) ^ CLK;              \
  96     *B = IN ^ U1;                                       \
  97     *C = (*C >> (3)) ^ (*C << (29)) ^ CLK;              \
  98     *D = (*D >> (4)) ^ (*D << (28)) ^ CLK;              \
  99                                                         \
 100     A = &WALK[PT1 ^ 2]; RES[i++] ^= *A;                 \
 101     B = &WALK[PT2 ^ 2]; RES[i++] ^= *B;                 \
 102     C = &WALK[PT1 ^ 3]; RES[i++] ^= *C;                 \
 103     D = &WALK[PT2 ^ 6]; RES[i++] ^= *D;                 \
 104                                                         \
 105     if( PTEST & 1 ) SWAP( A, C );                       \
 106                                                         \
 107     IN = (*A >> (5)) ^ (*A << (27)) ^ CLK;              \
 108     *A = (*B >> (6)) ^ (*B << (26)) ^ CLK;              \
 109     *B = IN; CLK = (int) mbedtls_timing_hardclock();                   \
 110     *C = (*C >> (7)) ^ (*C << (25)) ^ CLK;              \
 111     *D = (*D >> (8)) ^ (*D << (24)) ^ CLK;              \
 112                                                         \
 113     A = &WALK[PT1 ^ 4];                                 \
 114     B = &WALK[PT2 ^ 1];                                 \
 115                                                         \
 116     PTEST = PT2 >> 1;                                   \
 117                                                         \
 118     PT2 = (RES[(i - 8) ^ PTY] ^ WALK[PT2 ^ PTY ^ 7]);   \
 119     PT2 = ((PT2 & 0x1FFF) & (~8)) ^ ((PT1 ^ 8) & 0x8);  \
 120     PTY = (PT2 >> 10) & 7;                              \
 121                                                         \
 122     TST2_ENTER  TST2_ENTER  TST2_ENTER  TST2_ENTER      \
 123     TST2_ENTER  TST2_ENTER  TST2_ENTER  TST2_ENTER      \
 124     TST2_ENTER  TST2_ENTER  TST2_ENTER  TST2_ENTER      \
 125                                                         \
 126     TST2_LEAVE  TST2_LEAVE  TST2_LEAVE  TST2_LEAVE      \
 127     TST2_LEAVE  TST2_LEAVE  TST2_LEAVE  TST2_LEAVE      \
 128     TST2_LEAVE  TST2_LEAVE  TST2_LEAVE  TST2_LEAVE      \
 129                                                         \
 130     C = &WALK[PT1 ^ 5];                                 \
 131     D = &WALK[PT2 ^ 5];                                 \
 132                                                         \
 133     RES[i++] ^= *A;                                     \
 134     RES[i++] ^= *B;                                     \
 135     RES[i++] ^= *C;                                     \
 136     RES[i++] ^= *D;                                     \
 137                                                         \
 138     IN = (*A >> ( 9)) ^ (*A << (23)) ^ CLK;             \
 139     *A = (*B >> (10)) ^ (*B << (22)) ^ CLK;             \
 140     *B = IN ^ U2;                                       \
 141     *C = (*C >> (11)) ^ (*C << (21)) ^ CLK;             \
 142     *D = (*D >> (12)) ^ (*D << (20)) ^ CLK;             \
 143                                                         \
 144     A = &WALK[PT1 ^ 6]; RES[i++] ^= *A;                 \
 145     B = &WALK[PT2 ^ 3]; RES[i++] ^= *B;                 \
 146     C = &WALK[PT1 ^ 7]; RES[i++] ^= *C;                 \
 147     D = &WALK[PT2 ^ 7]; RES[i++] ^= *D;                 \
 148                                                         \
 149     IN = (*A >> (13)) ^ (*A << (19)) ^ CLK;             \
 150     *A = (*B >> (14)) ^ (*B << (18)) ^ CLK;             \
 151     *B = IN;                                            \
 152     *C = (*C >> (15)) ^ (*C << (17)) ^ CLK;             \
 153     *D = (*D >> (16)) ^ (*D << (16)) ^ CLK;             \
 154                                                         \
 155     PT1 = ( RES[( i - 8 ) ^ PTX] ^                      \
 156             WALK[PT1 ^ PTX ^ 7] ) & (~1);               \
 157     PT1 ^= (PT2 ^ 0x10) & 0x10;                         \
 158                                                         \
 159     for( n++, i = 0; i < 16; i++ )                      \
 160         hs->pool[n % MBEDTLS_HAVEGE_COLLECT_SIZE] ^= RES[i];
 161
 162 /*
 163  * Entropy gathering function
 164  */
 165 static void havege_fill( mbedtls_havege_state *hs )
 166 {
 167     int i, n = 0;
 168     int  U1,  U2, *A, *B, *C, *D;
 169     int PT1, PT2, *WALK, RES[16];
 170     int PTX, PTY, CLK, PTEST, IN;
 171
 172     WALK = hs->WALK;
 173     PT1  = hs->PT1;
 174     PT2  = hs->PT2;
 175
 176     PTX  = U1 = 0;
 177     PTY  = U2 = 0;
 178
 179     (void)PTX;
 180
 181     memset( RES, 0, sizeof( RES ) );
 182
 183     while( n < MBEDTLS_HAVEGE_COLLECT_SIZE * 4 )
 184     {
 185         ONE_ITERATION
 186         ONE_ITERATION
 187         ONE_ITERATION
 188         ONE_ITERATION
 189     }
 190
 191     hs->PT1 = PT1;
 192     hs->PT2 = PT2;
 193
 194     hs->offset[0] = 0;
 195     hs->offset[1] = MBEDTLS_HAVEGE_COLLECT_SIZE / 2;
 196 }
 197
 198 /*
 199  * HAVEGE initialization
 200  */
 201 void mbedtls_havege_init( mbedtls_havege_state *hs )
 202 {
 203     memset( hs, 0, sizeof( mbedtls_havege_state ) );
 204
 205     havege_fill( hs );
 206 }
 207
 208 void mbedtls_havege_free( mbedtls_havege_state *hs )
 209 {
 210     if( hs == NULL )
 211         return;
 212
 213     mbedtls_zeroize( hs, sizeof( mbedtls_havege_state ) );
 214 }
 215
 216 /*
 217  * HAVEGE rand function
 218  */
 219 int mbedtls_havege_random( void *p_rng, unsigned char *buf, size_t len )
 220 {
 221     int val;
 222     size_t use_len;
 223     mbedtls_havege_state *hs = (mbedtls_havege_state *) p_rng;
 224     unsigned char *p = buf;
 225
 226     while( len > 0 )
 227     {
 228         use_len = len;
 229         if( use_len > sizeof(int) )
 230             use_len = sizeof(int);
 231
 232         if( hs->offset[1] >= MBEDTLS_HAVEGE_COLLECT_SIZE )
 233             havege_fill( hs );
 234
 235         val  = hs->pool[hs->offset[0]++];
 236         val ^= hs->pool[hs->offset[1]++];
 237
 238         memcpy( p, &val, use_len );
 239
 240         len -= use_len;
 241         p += use_len;
 242     }
 243
 244     return( 0 );
 245 }
 246
 247 #endif /* MBEDTLS_HAVEGE_C */