|
12 | 12 | #define ROTL32(x, b) (uint32_t)(((x) << (b)) | ((x) >> (32 - (b))))
|
13 | 13 |
|
14 | 14 | #define CHACHA20_QUARTERROUND(A, B, C, D) \
|
15 |
| - A += B; \ |
16 |
| - D = ROTL32(D ^ A, 16); \ |
17 |
| - C += D; \ |
18 |
| - B = ROTL32(B ^ C, 12); \ |
19 |
| - A += B; \ |
20 |
| - D = ROTL32(D ^ A, 8); \ |
21 |
| - C += D; \ |
22 |
| - B = ROTL32(B ^ C, 7) |
| 15 | + A += B; \ |
| 16 | + D = ROTL32(D ^ A, 16); \ |
| 17 | + C += D; \ |
| 18 | + B = ROTL32(B ^ C, 12); \ |
| 19 | + A += B; \ |
| 20 | + D = ROTL32(D ^ A, 8); \ |
| 21 | + C += D; \ |
| 22 | + B = ROTL32(B ^ C, 7) |
23 | 23 |
|
24 | 24 | static void CHACHA20_ROUNDS(uint32_t st[16])
|
25 | 25 | {
|
26 |
| - int i; |
27 |
| - |
28 |
| - for (i = 0; i < 20; i += 2) { |
29 |
| - CHACHA20_QUARTERROUND(st[0], st[4], st[8], st[12]); |
30 |
| - CHACHA20_QUARTERROUND(st[1], st[5], st[9], st[13]); |
31 |
| - CHACHA20_QUARTERROUND(st[2], st[6], st[10], st[14]); |
32 |
| - CHACHA20_QUARTERROUND(st[3], st[7], st[11], st[15]); |
33 |
| - CHACHA20_QUARTERROUND(st[0], st[5], st[10], st[15]); |
34 |
| - CHACHA20_QUARTERROUND(st[1], st[6], st[11], st[12]); |
35 |
| - CHACHA20_QUARTERROUND(st[2], st[7], st[8], st[13]); |
36 |
| - CHACHA20_QUARTERROUND(st[3], st[4], st[9], st[14]); |
37 |
| - } |
| 26 | + int i; |
| 27 | + |
| 28 | + for (i = 0; i < 20; i += 2) { |
| 29 | + CHACHA20_QUARTERROUND(st[0], st[4], st[8], st[12]); |
| 30 | + CHACHA20_QUARTERROUND(st[1], st[5], st[9], st[13]); |
| 31 | + CHACHA20_QUARTERROUND(st[2], st[6], st[10], st[14]); |
| 32 | + CHACHA20_QUARTERROUND(st[3], st[7], st[11], st[15]); |
| 33 | + CHACHA20_QUARTERROUND(st[0], st[5], st[10], st[15]); |
| 34 | + CHACHA20_QUARTERROUND(st[1], st[6], st[11], st[12]); |
| 35 | + CHACHA20_QUARTERROUND(st[2], st[7], st[8], st[13]); |
| 36 | + CHACHA20_QUARTERROUND(st[3], st[4], st[9], st[14]); |
| 37 | + } |
38 | 38 | }
|
39 | 39 |
|
40 | 40 | static void chacha20_update(uint8_t out[CHACHA20_BLOCKBYTES], uint32_t st[16])
|
41 | 41 | {
|
42 |
| - uint32_t ks[16]; |
43 |
| - int i; |
44 |
| - |
45 |
| - memcpy(ks, st, 4 * 16); |
46 |
| - CHACHA20_ROUNDS(st); |
47 |
| - for (i = 0; i < 16; i++) { |
48 |
| - ks[i] += st[i]; |
49 |
| - } |
50 |
| - memcpy(out, ks, CHACHA20_BLOCKBYTES); |
51 |
| - st[12]++; |
| 42 | + uint32_t ks[16]; |
| 43 | + int i; |
| 44 | + |
| 45 | + memcpy(ks, st, 4 * 16); |
| 46 | + CHACHA20_ROUNDS(st); |
| 47 | + for (i = 0; i < 16; i++) { |
| 48 | + ks[i] += st[i]; |
| 49 | + } |
| 50 | + memcpy(out, ks, CHACHA20_BLOCKBYTES); |
| 51 | + st[12]++; |
52 | 52 | }
|
53 | 53 |
|
54 | 54 | static void chacha20_init(uint32_t st[16], const uint8_t key[CHACHA20_KEYBYTES])
|
55 | 55 | {
|
56 |
| - static const uint32_t constants[4] = { 0x61707865, 0x3320646e, 0x79622d32, 0x6b206574 }; |
57 |
| - memcpy(&st[0], constants, 4 * 4); |
58 |
| - memcpy(&st[4], key, CHACHA20_KEYBYTES); |
59 |
| - memset(&st[12], 0, 4 * 4); |
| 56 | + static const uint32_t constants[4] = { 0x61707865, 0x3320646e, 0x79622d32, 0x6b206574 }; |
| 57 | + memcpy(&st[0], constants, 4 * 4); |
| 58 | + memcpy(&st[4], key, CHACHA20_KEYBYTES); |
| 59 | + memset(&st[12], 0, 4 * 4); |
60 | 60 | }
|
61 | 61 |
|
62 | 62 | static int chacha20_rng(uint8_t* out, size_t len, uint8_t key[CHACHA20_KEYBYTES])
|
63 | 63 | {
|
64 |
| - uint32_t st[16]; |
65 |
| - size_t off; |
66 |
| - |
67 |
| - chacha20_init(st, key); |
68 |
| - chacha20_update(&out[0], st); |
69 |
| - memcpy(key, out, CHACHA20_KEYBYTES); |
70 |
| - off = 0; |
71 |
| - while (len >= CHACHA20_BLOCKBYTES) { |
72 |
| - chacha20_update(&out[off], st); |
73 |
| - len -= CHACHA20_BLOCKBYTES; |
74 |
| - off += CHACHA20_BLOCKBYTES; |
75 |
| - } |
76 |
| - if (len > 0) { |
77 |
| - uint8_t tmp[CHACHA20_BLOCKBYTES]; |
78 |
| - chacha20_update(tmp, st); |
79 |
| - memcpy(&out[off], tmp, len); |
80 |
| - } |
81 |
| - return 0; |
| 64 | + uint32_t st[16]; |
| 65 | + size_t off; |
| 66 | + |
| 67 | + chacha20_init(st, key); |
| 68 | + chacha20_update(&out[0], st); |
| 69 | + memcpy(key, out, CHACHA20_KEYBYTES); |
| 70 | + off = 0; |
| 71 | + while (len >= CHACHA20_BLOCKBYTES) { |
| 72 | + chacha20_update(&out[off], st); |
| 73 | + len -= CHACHA20_BLOCKBYTES; |
| 74 | + off += CHACHA20_BLOCKBYTES; |
| 75 | + } |
| 76 | + if (len > 0) { |
| 77 | + uint8_t tmp[CHACHA20_BLOCKBYTES]; |
| 78 | + chacha20_update(tmp, st); |
| 79 | + memcpy(&out[off], tmp, len); |
| 80 | + } |
| 81 | + return 0; |
82 | 82 | }
|
83 | 83 |
|
84 | 84 | struct rng_state {
|
85 |
| - int initialized; |
86 |
| - size_t off; |
87 |
| - uint8_t key[CHACHA20_KEYBYTES]; |
88 |
| - uint8_t reserve[RNG_RESERVE_LEN]; |
| 85 | + int initialized; |
| 86 | + size_t off; |
| 87 | + uint8_t key[CHACHA20_KEYBYTES]; |
| 88 | + uint8_t reserve[RNG_RESERVE_LEN]; |
89 | 89 | };
|
90 | 90 |
|
91 | 91 | void arc4random_buf(void* buffer, size_t len)
|
92 | 92 | {
|
93 |
| - static _Thread_local struct rng_state rng_state; |
94 |
| - |
95 |
| - unsigned char* buffer_ = (unsigned char*)buffer; |
96 |
| - size_t off; |
97 |
| - size_t remaining; |
98 |
| - size_t partial; |
99 |
| - |
100 |
| - if (!rng_state.initialized) { |
101 |
| - if (getentropy(rng_state.key, sizeof rng_state.key) != 0) { |
102 |
| - assert(0); |
103 |
| - } |
104 |
| - rng_state.off = RNG_RESERVE_LEN; |
105 |
| - rng_state.initialized = 1; |
106 |
| - } |
107 |
| - off = 0; |
108 |
| - remaining = len; |
109 |
| - while (remaining > 0) { |
110 |
| - if (rng_state.off == RNG_RESERVE_LEN) { |
111 |
| - while (remaining >= RNG_RESERVE_LEN) { |
112 |
| - chacha20_rng(&buffer_[off], RNG_RESERVE_LEN, rng_state.key); |
113 |
| - off += RNG_RESERVE_LEN; |
114 |
| - remaining -= RNG_RESERVE_LEN; |
115 |
| - } |
116 |
| - if (remaining == 0) { |
117 |
| - break; |
118 |
| - } |
119 |
| - chacha20_rng(&rng_state.reserve[0], RNG_RESERVE_LEN, rng_state.key); |
120 |
| - rng_state.off = 0; |
121 |
| - } |
122 |
| - partial = RNG_RESERVE_LEN - rng_state.off; |
123 |
| - if (remaining < partial) { |
124 |
| - partial = remaining; |
125 |
| - } |
126 |
| - memcpy(&buffer_[off], &rng_state.reserve[rng_state.off], partial); |
127 |
| - memset(&rng_state.reserve[rng_state.off], 0, partial); |
128 |
| - rng_state.off += partial; |
129 |
| - remaining -= partial; |
130 |
| - off += partial; |
131 |
| - } |
| 93 | + static _Thread_local struct rng_state rng_state; |
| 94 | + |
| 95 | + unsigned char* buffer_ = (unsigned char*)buffer; |
| 96 | + size_t off; |
| 97 | + size_t remaining; |
| 98 | + size_t partial; |
| 99 | + |
| 100 | + if (!rng_state.initialized) { |
| 101 | + if (getentropy(rng_state.key, sizeof rng_state.key) != 0) { |
| 102 | + assert(0); |
| 103 | + } |
| 104 | + rng_state.off = RNG_RESERVE_LEN; |
| 105 | + rng_state.initialized = 1; |
| 106 | + } |
| 107 | + off = 0; |
| 108 | + remaining = len; |
| 109 | + while (remaining > 0) { |
| 110 | + if (rng_state.off == RNG_RESERVE_LEN) { |
| 111 | + while (remaining >= RNG_RESERVE_LEN) { |
| 112 | + chacha20_rng(&buffer_[off], RNG_RESERVE_LEN, rng_state.key); |
| 113 | + off += RNG_RESERVE_LEN; |
| 114 | + remaining -= RNG_RESERVE_LEN; |
| 115 | + } |
| 116 | + if (remaining == 0) { |
| 117 | + break; |
| 118 | + } |
| 119 | + chacha20_rng(&rng_state.reserve[0], RNG_RESERVE_LEN, rng_state.key); |
| 120 | + rng_state.off = 0; |
| 121 | + } |
| 122 | + partial = RNG_RESERVE_LEN - rng_state.off; |
| 123 | + if (remaining < partial) { |
| 124 | + partial = remaining; |
| 125 | + } |
| 126 | + memcpy(&buffer_[off], &rng_state.reserve[rng_state.off], partial); |
| 127 | + memset(&rng_state.reserve[rng_state.off], 0, partial); |
| 128 | + rng_state.off += partial; |
| 129 | + remaining -= partial; |
| 130 | + off += partial; |
| 131 | + } |
132 | 132 | }
|
133 | 133 |
|
134 | 134 | uint32_t arc4random(void)
|
135 | 135 | {
|
136 |
| - uint32_t v; |
| 136 | + uint32_t v; |
137 | 137 |
|
138 |
| - arc4random_buf(&v, sizeof v); |
| 138 | + arc4random_buf(&v, sizeof v); |
139 | 139 |
|
140 |
| - return v; |
| 140 | + return v; |
141 | 141 | }
|
142 | 142 |
|
143 | 143 | uint32_t arc4random_uniform(const uint32_t upper_bound)
|
144 | 144 | {
|
145 |
| - uint32_t min; |
146 |
| - uint32_t r; |
147 |
| - |
148 |
| - if (upper_bound < 2U) { |
149 |
| - return 0; |
150 |
| - } |
151 |
| - min = (1U + ~upper_bound) % upper_bound; /* = 2**32 mod upper_bound */ |
152 |
| - do { |
153 |
| - r = arc4random(); |
154 |
| - } while (r < min); |
155 |
| - /* r is now clamped to a set whose size mod upper_bound == 0 |
156 |
| - * the worst case (2**31+1) requires 2 attempts on average */ |
157 |
| - |
158 |
| - return r % upper_bound; |
| 145 | + uint32_t min; |
| 146 | + uint32_t r; |
| 147 | + |
| 148 | + if (upper_bound < 2U) { |
| 149 | + return 0; |
| 150 | + } |
| 151 | + min = (1U + ~upper_bound) % upper_bound; // = 2**32 mod upper_bound |
| 152 | + do { |
| 153 | + r = arc4random(); |
| 154 | + } while (r < min); |
| 155 | + |
| 156 | + // r is now clamped to a set whose size mod upper_bound == 0. |
| 157 | + // The worst case (2**31+1) requires 2 attempts on average. |
| 158 | + |
| 159 | + return r % upper_bound; |
159 | 160 | }
|
0 commit comments