1 /*- 2 * Copyright (c) 2000-2015 Mark R V Murray 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer 10 * in this position and unchanged. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 25 * 26 */ 27 28 #include <sys/cdefs.h> 29 __FBSDID("$FreeBSD$"); 30 31 #ifdef _KERNEL 32 #include <sys/param.h> 33 #include <sys/malloc.h> 34 #include <sys/random.h> 35 #include <sys/sysctl.h> 36 #include <sys/systm.h> 37 #else /* !_KERNEL */ 38 #include <sys/param.h> 39 #include <sys/types.h> 40 #include <inttypes.h> 41 #include <stdio.h> 42 #include <stdlib.h> 43 #include <string.h> 44 #include <threads.h> 45 #include "unit_test.h" 46 #endif /* _KERNEL */ 47 48 #define CHACHA_EMBED 49 #define KEYSTREAM_ONLY 50 #define CHACHA_NONCE0_CTR128 51 #include <crypto/chacha20/chacha.c> 52 #include <crypto/rijndael/rijndael-api-fst.h> 53 #include <crypto/sha2/sha256.h> 54 55 #include <dev/random/hash.h> 56 #ifdef _KERNEL 57 #include <dev/random/randomdev.h> 58 #endif 59 60 /* This code presumes that RANDOM_KEYSIZE is twice as large as RANDOM_BLOCKSIZE */ 61 CTASSERT(RANDOM_KEYSIZE == 2*RANDOM_BLOCKSIZE); 62 63 /* Validate that full Chacha IV is as large as the 128-bit counter */ 64 _Static_assert(CHACHA_STATELEN == RANDOM_BLOCKSIZE, ""); 65 66 /* 67 * Experimental Chacha20-based PRF for Fortuna keystream primitive. For now, 68 * disabled by default. But we may enable it in the future. 69 * 70 * Benefits include somewhat faster keystream generation compared with 71 * unaccelerated AES-ICM. 72 */ 73 bool random_chachamode = false; 74 #ifdef _KERNEL 75 SYSCTL_BOOL(_kern_random, OID_AUTO, use_chacha20_cipher, CTLFLAG_RDTUN, 76 &random_chachamode, 0, 77 "If non-zero, use the ChaCha20 cipher for randomdev PRF. " 78 "If zero, use AES-ICM cipher for randomdev PRF (default)."); 79 #endif 80 81 /* Initialise the hash */ 82 void 83 randomdev_hash_init(struct randomdev_hash *context) 84 { 85 86 SHA256_Init(&context->sha); 87 } 88 89 /* Iterate the hash */ 90 void 91 randomdev_hash_iterate(struct randomdev_hash *context, const void *data, size_t size) 92 { 93 94 SHA256_Update(&context->sha, data, size); 95 } 96 97 /* Conclude by returning the hash in the supplied <*buf> which must be 98 * RANDOM_KEYSIZE bytes long. 99 */ 100 void 101 randomdev_hash_finish(struct randomdev_hash *context, void *buf) 102 { 103 104 SHA256_Final(buf, &context->sha); 105 } 106 107 /* Initialise the encryption routine by setting up the key schedule 108 * from the supplied <*data> which must be RANDOM_KEYSIZE bytes of binary 109 * data. 110 */ 111 void 112 randomdev_encrypt_init(union randomdev_key *context, const void *data) 113 { 114 115 if (random_chachamode) { 116 chacha_keysetup(&context->chacha, data, RANDOM_KEYSIZE * 8); 117 } else { 118 rijndael_cipherInit(&context->cipher, MODE_ECB, NULL); 119 rijndael_makeKey(&context->key, DIR_ENCRYPT, RANDOM_KEYSIZE*8, data); 120 } 121 } 122 123 /* 124 * Create a psuedorandom output stream of 'blockcount' blocks using a CTR-mode 125 * cipher or similar. The 128-bit counter is supplied in the in-out parmeter 126 * 'ctr.' The output stream goes to 'd_out.' 'blockcount' RANDOM_BLOCKSIZE 127 * bytes are generated. 128 */ 129 void 130 randomdev_keystream(union randomdev_key *context, uint128_t *ctr, 131 void *d_out, u_int blockcount) 132 { 133 u_int i; 134 135 if (random_chachamode) { 136 uint128_t lectr; 137 138 /* 139 * Chacha always encodes and increments the counter little 140 * endian. So on BE machines, we must provide a swapped 141 * counter to chacha, and swap the output too. 142 */ 143 le128enc(&lectr, *ctr); 144 145 chacha_ivsetup(&context->chacha, NULL, (const void *)&lectr); 146 chacha_encrypt_bytes(&context->chacha, NULL, d_out, 147 RANDOM_BLOCKSIZE * blockcount); 148 149 /* 150 * Decode Chacha-updated LE counter to native endian and store 151 * it back in the caller's in-out parameter. 152 */ 153 chacha_ctrsave(&context->chacha, (void *)&lectr); 154 *ctr = le128dec(&lectr); 155 } else { 156 for (i = 0; i < blockcount; i++) { 157 /*- 158 * FS&K - r = r|E(K,C) 159 * - C = C + 1 160 */ 161 rijndael_blockEncrypt(&context->cipher, &context->key, 162 (void *)ctr, RANDOM_BLOCKSIZE * 8, d_out); 163 d_out = (char *)d_out + RANDOM_BLOCKSIZE; 164 uint128_increment(ctr); 165 } 166 } 167 } 168 169 /* 170 * Fetch a pointer to the relevant key material and its size. 171 * 172 * This API is expected to only be used only for reseeding, where the 173 * endianness does not matter; the goal is to simply incorporate the key 174 * material into the hash iterator that will produce key'. 175 * 176 * Do not expect the buffer pointed to by this API to match the exact 177 * endianness, etc, as the key material that was supplied to 178 * randomdev_encrypt_init(). 179 */ 180 void 181 randomdev_getkey(union randomdev_key *context, const void **keyp, size_t *szp) 182 { 183 184 if (!random_chachamode) { 185 *keyp = &context->key.keyMaterial; 186 *szp = context->key.keyLen / 8; 187 return; 188 } 189 190 /* Chacha20 mode */ 191 *keyp = (const void *)&context->chacha.input[4]; 192 193 /* Sanity check keysize */ 194 if (context->chacha.input[0] == U8TO32_LITTLE(sigma) && 195 context->chacha.input[1] == U8TO32_LITTLE(&sigma[4]) && 196 context->chacha.input[2] == U8TO32_LITTLE(&sigma[8]) && 197 context->chacha.input[3] == U8TO32_LITTLE(&sigma[12])) { 198 *szp = 32; 199 return; 200 } 201 202 #if 0 203 /* 204 * Included for the sake of completeness; as-implemented, Fortuna 205 * doesn't need or use 128-bit Chacha20. 206 */ 207 if (context->chacha->input[0] == U8TO32_LITTLE(tau) && 208 context->chacha->input[1] == U8TO32_LITTLE(&tau[4]) && 209 context->chacha->input[2] == U8TO32_LITTLE(&tau[8]) && 210 context->chacha->input[3] == U8TO32_LITTLE(&tau[12])) { 211 *szp = 16; 212 return; 213 } 214 #endif 215 216 #ifdef _KERNEL 217 panic("%s: Invalid chacha20 keysize: %16D\n", __func__, 218 (void *)context->chacha.input, " "); 219 #else 220 raise(SIGKILL); 221 #endif 222 } 223