2020-01-18 08:38:21 +00:00
|
|
|
/*
|
|
|
|
* Copyright (c) 2018-2020, Andreas Kling <kling@serenityos.org>
|
2021-09-01 02:32:46 +00:00
|
|
|
* Copyright (c) 2020, Peter Elliott <pelliott@serenityos.org>
|
2020-01-18 08:38:21 +00:00
|
|
|
*
|
2021-04-22 08:24:48 +00:00
|
|
|
* SPDX-License-Identifier: BSD-2-Clause
|
2020-01-18 08:38:21 +00:00
|
|
|
*/
|
|
|
|
|
2020-01-03 11:36:30 +00:00
|
|
|
#pragma once
|
|
|
|
|
2020-06-22 23:10:45 +00:00
|
|
|
#include <AK/Assertions.h>
|
|
|
|
#include <AK/ByteBuffer.h>
|
2020-01-03 11:36:30 +00:00
|
|
|
#include <AK/Types.h>
|
2021-07-18 07:10:27 +00:00
|
|
|
#include <Kernel/Locking/Mutex.h>
|
2020-06-22 23:10:45 +00:00
|
|
|
#include <Kernel/StdLib.h>
|
2020-06-23 02:23:35 +00:00
|
|
|
#include <LibCrypto/Cipher/AES.h>
|
2020-06-23 20:05:26 +00:00
|
|
|
#include <LibCrypto/Cipher/Cipher.h>
|
2020-06-23 02:23:35 +00:00
|
|
|
#include <LibCrypto/Hash/SHA2.h>
|
2020-01-03 11:36:30 +00:00
|
|
|
|
2020-02-16 00:27:42 +00:00
|
|
|
namespace Kernel {
|
|
|
|
|
2020-06-22 23:10:45 +00:00
|
|
|
template<typename CipherT, typename HashT, int KeySize>
|
|
|
|
class FortunaPRNG {
|
2020-06-23 02:23:35 +00:00
|
|
|
public:
|
2020-06-22 23:10:45 +00:00
|
|
|
constexpr static size_t pool_count = 32;
|
|
|
|
constexpr static size_t reseed_threshold = 16;
|
|
|
|
|
|
|
|
using CipherType = CipherT;
|
2021-02-28 01:31:17 +00:00
|
|
|
using BlockType = typename CipherT::BlockType;
|
2020-06-22 23:10:45 +00:00
|
|
|
using HashType = HashT;
|
2021-02-28 01:31:17 +00:00
|
|
|
using DigestType = typename HashT::DigestType;
|
2020-06-22 23:10:45 +00:00
|
|
|
|
2021-09-05 22:59:52 +00:00
|
|
|
// FIXME: Do something other than VERIFY()'ing inside Optional in case of OOM.
|
2020-06-23 20:05:26 +00:00
|
|
|
FortunaPRNG()
|
2021-09-05 22:59:52 +00:00
|
|
|
: m_counter(ByteBuffer::create_zeroed(BlockType::block_size()).release_value())
|
2020-06-23 20:05:26 +00:00
|
|
|
{
|
|
|
|
}
|
|
|
|
|
2021-09-01 06:28:47 +00:00
|
|
|
bool get_random_bytes(Bytes buffer)
|
2020-06-22 23:10:45 +00:00
|
|
|
{
|
2021-08-21 23:49:22 +00:00
|
|
|
SpinlockLocker lock(m_lock);
|
2021-01-27 20:16:30 +00:00
|
|
|
if (!is_ready())
|
|
|
|
return false;
|
2020-06-22 23:10:45 +00:00
|
|
|
if (m_p0_len >= reseed_threshold) {
|
|
|
|
this->reseed();
|
|
|
|
}
|
|
|
|
|
2021-02-23 19:42:32 +00:00
|
|
|
VERIFY(is_seeded());
|
2020-06-22 23:10:45 +00:00
|
|
|
|
|
|
|
// FIXME: More than 2^20 bytes cannot be generated without refreshing the key.
|
2021-09-01 06:28:47 +00:00
|
|
|
VERIFY(buffer.size() < (1 << 20));
|
2020-06-22 23:10:45 +00:00
|
|
|
|
2020-11-27 20:13:55 +00:00
|
|
|
typename CipherType::CTRMode cipher(m_key, KeySize, Crypto::Cipher::Intent::Encryption);
|
2020-06-22 23:10:45 +00:00
|
|
|
|
2020-08-15 16:38:24 +00:00
|
|
|
auto counter_span = m_counter.bytes();
|
2021-09-01 06:28:47 +00:00
|
|
|
cipher.key_stream(buffer, counter_span, &counter_span);
|
2020-06-22 23:10:45 +00:00
|
|
|
|
|
|
|
// Extract a new key from the prng stream.
|
2020-08-15 16:38:24 +00:00
|
|
|
Bytes key_span = m_key.bytes();
|
2020-08-13 16:53:26 +00:00
|
|
|
cipher.key_stream(key_span, counter_span, &counter_span);
|
2021-01-27 20:16:30 +00:00
|
|
|
return true;
|
2020-06-22 23:10:45 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
template<typename T>
|
|
|
|
void add_random_event(const T& event_data, size_t pool)
|
|
|
|
{
|
|
|
|
pool %= pool_count;
|
|
|
|
if (pool == 0) {
|
|
|
|
m_p0_len++;
|
|
|
|
}
|
2020-06-23 02:23:35 +00:00
|
|
|
m_pools[pool].update(reinterpret_cast<const u8*>(&event_data), sizeof(T));
|
2020-06-22 23:10:45 +00:00
|
|
|
}
|
|
|
|
|
2020-12-26 09:47:08 +00:00
|
|
|
[[nodiscard]] bool is_seeded() const
|
2020-06-27 17:10:01 +00:00
|
|
|
{
|
|
|
|
return m_reseed_number > 0;
|
|
|
|
}
|
|
|
|
|
2020-12-26 09:47:08 +00:00
|
|
|
[[nodiscard]] bool is_ready() const
|
2020-06-27 17:10:01 +00:00
|
|
|
{
|
2021-02-23 19:42:32 +00:00
|
|
|
VERIFY(m_lock.is_locked());
|
2020-06-27 17:10:01 +00:00
|
|
|
return is_seeded() || m_p0_len >= reseed_threshold;
|
|
|
|
}
|
|
|
|
|
2021-09-05 17:02:03 +00:00
|
|
|
Spinlock& get_lock() { return m_lock; }
|
2021-01-27 20:16:30 +00:00
|
|
|
|
2020-06-22 23:10:45 +00:00
|
|
|
private:
|
|
|
|
void reseed()
|
|
|
|
{
|
|
|
|
HashType new_key;
|
|
|
|
new_key.update(m_key);
|
|
|
|
for (size_t i = 0; i < pool_count; ++i) {
|
2021-02-05 19:04:19 +00:00
|
|
|
if (m_reseed_number % (1u << i) == 0) {
|
2020-06-22 23:10:45 +00:00
|
|
|
DigestType digest = m_pools[i].digest();
|
|
|
|
new_key.update(digest.immutable_data(), digest.data_length());
|
|
|
|
}
|
|
|
|
}
|
|
|
|
DigestType digest = new_key.digest();
|
2021-09-05 22:59:52 +00:00
|
|
|
if (m_key.size() == digest.data_length()) {
|
|
|
|
// Avoid reallocating, just overwrite the key.
|
|
|
|
m_key.overwrite(0, digest.immutable_data(), digest.data_length());
|
|
|
|
} else {
|
|
|
|
auto buffer_result = ByteBuffer::copy(digest.immutable_data(), digest.data_length());
|
|
|
|
// If there's no memory left to copy this into, bail out.
|
|
|
|
if (!buffer_result.has_value())
|
|
|
|
return;
|
|
|
|
|
|
|
|
m_key = buffer_result.release_value();
|
|
|
|
}
|
2020-06-22 23:10:45 +00:00
|
|
|
|
|
|
|
m_reseed_number++;
|
|
|
|
m_p0_len = 0;
|
|
|
|
}
|
|
|
|
|
2020-06-23 20:05:26 +00:00
|
|
|
ByteBuffer m_counter;
|
2020-06-22 23:10:45 +00:00
|
|
|
size_t m_reseed_number { 0 };
|
|
|
|
size_t m_p0_len { 0 };
|
|
|
|
ByteBuffer m_key;
|
|
|
|
HashType m_pools[pool_count];
|
2021-09-05 17:02:03 +00:00
|
|
|
Spinlock m_lock;
|
2020-06-22 23:10:45 +00:00
|
|
|
};
|
|
|
|
|
2021-12-26 13:31:45 +00:00
|
|
|
class KernelRng : public FortunaPRNG<Crypto::Cipher::AESCipher, Crypto::Hash::SHA256, 256> {
|
2020-06-23 20:05:26 +00:00
|
|
|
|
2020-06-23 02:23:35 +00:00
|
|
|
public:
|
2020-08-25 01:35:19 +00:00
|
|
|
KernelRng();
|
2020-06-23 02:23:35 +00:00
|
|
|
static KernelRng& the();
|
|
|
|
|
2020-06-27 17:10:01 +00:00
|
|
|
void wait_for_entropy();
|
|
|
|
|
|
|
|
void wake_if_ready();
|
|
|
|
|
2020-06-23 02:23:35 +00:00
|
|
|
private:
|
2020-06-27 17:10:01 +00:00
|
|
|
WaitQueue m_seed_queue;
|
2020-06-23 02:23:35 +00:00
|
|
|
};
|
|
|
|
|
2020-06-24 20:07:28 +00:00
|
|
|
class EntropySource {
|
|
|
|
template<typename T>
|
|
|
|
struct Event {
|
|
|
|
u64 timestamp;
|
|
|
|
size_t source;
|
|
|
|
T event_data;
|
|
|
|
};
|
|
|
|
|
|
|
|
public:
|
2021-01-24 17:17:54 +00:00
|
|
|
enum class Static : size_t {
|
|
|
|
Interrupts,
|
|
|
|
MaxHardcodedSourceIndex,
|
|
|
|
};
|
|
|
|
|
2020-06-24 20:07:28 +00:00
|
|
|
EntropySource()
|
|
|
|
: m_source(next_source++)
|
|
|
|
{
|
|
|
|
}
|
|
|
|
|
2021-01-24 17:17:54 +00:00
|
|
|
EntropySource(Static hardcoded_source)
|
|
|
|
: m_source(static_cast<size_t>(hardcoded_source))
|
|
|
|
{
|
|
|
|
}
|
|
|
|
|
2020-06-24 20:07:28 +00:00
|
|
|
template<typename T>
|
|
|
|
void add_random_event(const T& event_data)
|
|
|
|
{
|
2021-01-27 20:16:30 +00:00
|
|
|
auto& kernel_rng = KernelRng::the();
|
2021-08-21 23:49:22 +00:00
|
|
|
SpinlockLocker lock(kernel_rng.get_lock());
|
2020-06-24 20:07:28 +00:00
|
|
|
// We don't lock this because on the off chance a pool is corrupted, entropy isn't lost.
|
|
|
|
Event<T> event = { read_tsc(), m_source, event_data };
|
2021-12-26 13:31:45 +00:00
|
|
|
kernel_rng.add_random_event(event, m_pool);
|
2020-06-24 20:07:28 +00:00
|
|
|
m_pool++;
|
2021-01-27 20:16:30 +00:00
|
|
|
kernel_rng.wake_if_ready();
|
2020-06-24 20:07:28 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
private:
|
|
|
|
static size_t next_source;
|
|
|
|
size_t m_pool { 0 };
|
|
|
|
size_t m_source;
|
|
|
|
};
|
|
|
|
|
2020-01-03 11:36:30 +00:00
|
|
|
// NOTE: These API's are primarily about expressing intent/needs in the calling code.
|
2020-06-27 17:10:01 +00:00
|
|
|
// The only difference is that get_fast_random is guaranteed not to block.
|
2020-01-03 11:36:30 +00:00
|
|
|
|
2021-09-01 06:28:47 +00:00
|
|
|
void get_fast_random_bytes(Bytes);
|
|
|
|
bool get_good_random_bytes(Bytes bytes, bool allow_wait = true, bool fallback_to_fast = true);
|
2020-01-03 11:36:30 +00:00
|
|
|
|
|
|
|
template<typename T>
|
|
|
|
inline T get_fast_random()
|
|
|
|
{
|
|
|
|
T value;
|
2021-09-01 06:28:47 +00:00
|
|
|
Bytes bytes { reinterpret_cast<u8*>(&value), sizeof(T) };
|
|
|
|
get_fast_random_bytes(bytes);
|
2020-01-03 11:36:30 +00:00
|
|
|
return value;
|
|
|
|
}
|
|
|
|
|
|
|
|
template<typename T>
|
|
|
|
inline T get_good_random()
|
|
|
|
{
|
|
|
|
T value;
|
2021-09-01 06:28:47 +00:00
|
|
|
Bytes bytes { reinterpret_cast<u8*>(&value), sizeof(T) };
|
|
|
|
get_good_random_bytes(bytes);
|
2020-01-03 11:36:30 +00:00
|
|
|
return value;
|
|
|
|
}
|
|
|
|
|
2020-02-16 00:27:42 +00:00
|
|
|
}
|