|
12 | 12 | #define ROTL32(x, b) (uint32_t)(((x) << (b)) | ((x) >> (32 - (b)))) |
13 | 13 |
|
14 | 14 | #define CHACHA20_QUARTERROUND(A, B, C, D) \ |
15 | | - A += B; \ |
16 | | - D = ROTL32(D ^ A, 16); \ |
17 | | - C += D; \ |
18 | | - B = ROTL32(B ^ C, 12); \ |
19 | | - A += B; \ |
20 | | - D = ROTL32(D ^ A, 8); \ |
21 | | - C += D; \ |
22 | | - B = ROTL32(B ^ C, 7) |
| 15 | + A += B; \ |
| 16 | + D = ROTL32(D ^ A, 16); \ |
| 17 | + C += D; \ |
| 18 | + B = ROTL32(B ^ C, 12); \ |
| 19 | + A += B; \ |
| 20 | + D = ROTL32(D ^ A, 8); \ |
| 21 | + C += D; \ |
| 22 | + B = ROTL32(B ^ C, 7) |
23 | 23 |
|
24 | 24 | static void CHACHA20_ROUNDS(uint32_t st[16]) |
25 | 25 | { |
26 | | - int i; |
27 | | - |
28 | | - for (i = 0; i < 20; i += 2) { |
29 | | - CHACHA20_QUARTERROUND(st[0], st[4], st[8], st[12]); |
30 | | - CHACHA20_QUARTERROUND(st[1], st[5], st[9], st[13]); |
31 | | - CHACHA20_QUARTERROUND(st[2], st[6], st[10], st[14]); |
32 | | - CHACHA20_QUARTERROUND(st[3], st[7], st[11], st[15]); |
33 | | - CHACHA20_QUARTERROUND(st[0], st[5], st[10], st[15]); |
34 | | - CHACHA20_QUARTERROUND(st[1], st[6], st[11], st[12]); |
35 | | - CHACHA20_QUARTERROUND(st[2], st[7], st[8], st[13]); |
36 | | - CHACHA20_QUARTERROUND(st[3], st[4], st[9], st[14]); |
37 | | - } |
| 26 | + int i; |
| 27 | + |
| 28 | + for (i = 0; i < 20; i += 2) { |
| 29 | + CHACHA20_QUARTERROUND(st[0], st[4], st[8], st[12]); |
| 30 | + CHACHA20_QUARTERROUND(st[1], st[5], st[9], st[13]); |
| 31 | + CHACHA20_QUARTERROUND(st[2], st[6], st[10], st[14]); |
| 32 | + CHACHA20_QUARTERROUND(st[3], st[7], st[11], st[15]); |
| 33 | + CHACHA20_QUARTERROUND(st[0], st[5], st[10], st[15]); |
| 34 | + CHACHA20_QUARTERROUND(st[1], st[6], st[11], st[12]); |
| 35 | + CHACHA20_QUARTERROUND(st[2], st[7], st[8], st[13]); |
| 36 | + CHACHA20_QUARTERROUND(st[3], st[4], st[9], st[14]); |
| 37 | + } |
38 | 38 | } |
39 | 39 |
|
40 | 40 | static void chacha20_update(uint8_t out[CHACHA20_BLOCKBYTES], uint32_t st[16]) |
41 | 41 | { |
42 | | - uint32_t ks[16]; |
43 | | - int i; |
44 | | - |
45 | | - memcpy(ks, st, 4 * 16); |
46 | | - CHACHA20_ROUNDS(st); |
47 | | - for (i = 0; i < 16; i++) { |
48 | | - ks[i] += st[i]; |
49 | | - } |
50 | | - memcpy(out, ks, CHACHA20_BLOCKBYTES); |
51 | | - st[12]++; |
| 42 | + uint32_t ks[16]; |
| 43 | + int i; |
| 44 | + |
| 45 | + memcpy(ks, st, 4 * 16); |
| 46 | + CHACHA20_ROUNDS(st); |
| 47 | + for (i = 0; i < 16; i++) { |
| 48 | + ks[i] += st[i]; |
| 49 | + } |
| 50 | + memcpy(out, ks, CHACHA20_BLOCKBYTES); |
| 51 | + st[12]++; |
52 | 52 | } |
53 | 53 |
|
54 | 54 | static void chacha20_init(uint32_t st[16], const uint8_t key[CHACHA20_KEYBYTES]) |
55 | 55 | { |
56 | | - static const uint32_t constants[4] = { 0x61707865, 0x3320646e, 0x79622d32, 0x6b206574 }; |
57 | | - memcpy(&st[0], constants, 4 * 4); |
58 | | - memcpy(&st[4], key, CHACHA20_KEYBYTES); |
59 | | - memset(&st[12], 0, 4 * 4); |
| 56 | + static const uint32_t constants[4] = { 0x61707865, 0x3320646e, 0x79622d32, 0x6b206574 }; |
| 57 | + memcpy(&st[0], constants, 4 * 4); |
| 58 | + memcpy(&st[4], key, CHACHA20_KEYBYTES); |
| 59 | + memset(&st[12], 0, 4 * 4); |
60 | 60 | } |
61 | 61 |
|
62 | 62 | static int chacha20_rng(uint8_t* out, size_t len, uint8_t key[CHACHA20_KEYBYTES]) |
63 | 63 | { |
64 | | - uint32_t st[16]; |
65 | | - size_t off; |
66 | | - |
67 | | - chacha20_init(st, key); |
68 | | - chacha20_update(&out[0], st); |
69 | | - memcpy(key, out, CHACHA20_KEYBYTES); |
70 | | - off = 0; |
71 | | - while (len >= CHACHA20_BLOCKBYTES) { |
72 | | - chacha20_update(&out[off], st); |
73 | | - len -= CHACHA20_BLOCKBYTES; |
74 | | - off += CHACHA20_BLOCKBYTES; |
75 | | - } |
76 | | - if (len > 0) { |
77 | | - uint8_t tmp[CHACHA20_BLOCKBYTES]; |
78 | | - chacha20_update(tmp, st); |
79 | | - memcpy(&out[off], tmp, len); |
80 | | - } |
81 | | - return 0; |
| 64 | + uint32_t st[16]; |
| 65 | + size_t off; |
| 66 | + |
| 67 | + chacha20_init(st, key); |
| 68 | + chacha20_update(&out[0], st); |
| 69 | + memcpy(key, out, CHACHA20_KEYBYTES); |
| 70 | + off = 0; |
| 71 | + while (len >= CHACHA20_BLOCKBYTES) { |
| 72 | + chacha20_update(&out[off], st); |
| 73 | + len -= CHACHA20_BLOCKBYTES; |
| 74 | + off += CHACHA20_BLOCKBYTES; |
| 75 | + } |
| 76 | + if (len > 0) { |
| 77 | + uint8_t tmp[CHACHA20_BLOCKBYTES]; |
| 78 | + chacha20_update(tmp, st); |
| 79 | + memcpy(&out[off], tmp, len); |
| 80 | + } |
| 81 | + return 0; |
82 | 82 | } |
83 | 83 |
|
84 | 84 | struct rng_state { |
85 | | - int initialized; |
86 | | - size_t off; |
87 | | - uint8_t key[CHACHA20_KEYBYTES]; |
88 | | - uint8_t reserve[RNG_RESERVE_LEN]; |
| 85 | + int initialized; |
| 86 | + size_t off; |
| 87 | + uint8_t key[CHACHA20_KEYBYTES]; |
| 88 | + uint8_t reserve[RNG_RESERVE_LEN]; |
89 | 89 | }; |
90 | 90 |
|
91 | 91 | void arc4random_buf(void* buffer, size_t len) |
92 | 92 | { |
93 | | - static _Thread_local struct rng_state rng_state; |
94 | | - |
95 | | - unsigned char* buffer_ = (unsigned char*)buffer; |
96 | | - size_t off; |
97 | | - size_t remaining; |
98 | | - size_t partial; |
99 | | - |
100 | | - if (!rng_state.initialized) { |
101 | | - if (getentropy(rng_state.key, sizeof rng_state.key) != 0) { |
102 | | - assert(0); |
103 | | - } |
104 | | - rng_state.off = RNG_RESERVE_LEN; |
105 | | - rng_state.initialized = 1; |
106 | | - } |
107 | | - off = 0; |
108 | | - remaining = len; |
109 | | - while (remaining > 0) { |
110 | | - if (rng_state.off == RNG_RESERVE_LEN) { |
111 | | - while (remaining >= RNG_RESERVE_LEN) { |
112 | | - chacha20_rng(&buffer_[off], RNG_RESERVE_LEN, rng_state.key); |
113 | | - off += RNG_RESERVE_LEN; |
114 | | - remaining -= RNG_RESERVE_LEN; |
115 | | - } |
116 | | - if (remaining == 0) { |
117 | | - break; |
118 | | - } |
119 | | - chacha20_rng(&rng_state.reserve[0], RNG_RESERVE_LEN, rng_state.key); |
120 | | - rng_state.off = 0; |
121 | | - } |
122 | | - partial = RNG_RESERVE_LEN - rng_state.off; |
123 | | - if (remaining < partial) { |
124 | | - partial = remaining; |
125 | | - } |
126 | | - memcpy(&buffer_[off], &rng_state.reserve[rng_state.off], partial); |
127 | | - memset(&rng_state.reserve[rng_state.off], 0, partial); |
128 | | - rng_state.off += partial; |
129 | | - remaining -= partial; |
130 | | - off += partial; |
131 | | - } |
| 93 | + static _Thread_local struct rng_state rng_state; |
| 94 | + |
| 95 | + unsigned char* buffer_ = (unsigned char*)buffer; |
| 96 | + size_t off; |
| 97 | + size_t remaining; |
| 98 | + size_t partial; |
| 99 | + |
| 100 | + if (!rng_state.initialized) { |
| 101 | + if (getentropy(rng_state.key, sizeof rng_state.key) != 0) { |
| 102 | + assert(0); |
| 103 | + } |
| 104 | + rng_state.off = RNG_RESERVE_LEN; |
| 105 | + rng_state.initialized = 1; |
| 106 | + } |
| 107 | + off = 0; |
| 108 | + remaining = len; |
| 109 | + while (remaining > 0) { |
| 110 | + if (rng_state.off == RNG_RESERVE_LEN) { |
| 111 | + while (remaining >= RNG_RESERVE_LEN) { |
| 112 | + chacha20_rng(&buffer_[off], RNG_RESERVE_LEN, rng_state.key); |
| 113 | + off += RNG_RESERVE_LEN; |
| 114 | + remaining -= RNG_RESERVE_LEN; |
| 115 | + } |
| 116 | + if (remaining == 0) { |
| 117 | + break; |
| 118 | + } |
| 119 | + chacha20_rng(&rng_state.reserve[0], RNG_RESERVE_LEN, rng_state.key); |
| 120 | + rng_state.off = 0; |
| 121 | + } |
| 122 | + partial = RNG_RESERVE_LEN - rng_state.off; |
| 123 | + if (remaining < partial) { |
| 124 | + partial = remaining; |
| 125 | + } |
| 126 | + memcpy(&buffer_[off], &rng_state.reserve[rng_state.off], partial); |
| 127 | + memset(&rng_state.reserve[rng_state.off], 0, partial); |
| 128 | + rng_state.off += partial; |
| 129 | + remaining -= partial; |
| 130 | + off += partial; |
| 131 | + } |
132 | 132 | } |
133 | 133 |
|
134 | 134 | uint32_t arc4random(void) |
135 | 135 | { |
136 | | - uint32_t v; |
| 136 | + uint32_t v; |
137 | 137 |
|
138 | | - arc4random_buf(&v, sizeof v); |
| 138 | + arc4random_buf(&v, sizeof v); |
139 | 139 |
|
140 | | - return v; |
| 140 | + return v; |
141 | 141 | } |
142 | 142 |
|
143 | 143 | uint32_t arc4random_uniform(const uint32_t upper_bound) |
144 | 144 | { |
145 | | - uint32_t min; |
146 | | - uint32_t r; |
147 | | - |
148 | | - if (upper_bound < 2U) { |
149 | | - return 0; |
150 | | - } |
151 | | - min = (1U + ~upper_bound) % upper_bound; /* = 2**32 mod upper_bound */ |
152 | | - do { |
153 | | - r = arc4random(); |
154 | | - } while (r < min); |
155 | | - /* r is now clamped to a set whose size mod upper_bound == 0 |
156 | | - * the worst case (2**31+1) requires 2 attempts on average */ |
157 | | - |
158 | | - return r % upper_bound; |
| 145 | + uint32_t min; |
| 146 | + uint32_t r; |
| 147 | + |
| 148 | + if (upper_bound < 2U) { |
| 149 | + return 0; |
| 150 | + } |
| 151 | + min = (1U + ~upper_bound) % upper_bound; // = 2**32 mod upper_bound |
| 152 | + do { |
| 153 | + r = arc4random(); |
| 154 | + } while (r < min); |
| 155 | + |
| 156 | + // r is now clamped to a set whose size mod upper_bound == 0. |
| 157 | + // The worst case (2**31+1) requires 2 attempts on average. |
| 158 | + |
| 159 | + return r % upper_bound; |
159 | 160 | } |
0 commit comments