1 | /** |
2 | * \brief HAVEGE: HArdware Volatile Entropy Gathering and Expansion |
3 | * |
4 | * Copyright The Mbed TLS Contributors |
5 | * SPDX-License-Identifier: Apache-2.0 |
6 | * |
7 | * Licensed under the Apache License, Version 2.0 (the "License"); you may |
8 | * not use this file except in compliance with the License. |
9 | * You may obtain a copy of the License at |
10 | * |
11 | * http://www.apache.org/licenses/LICENSE-2.0 |
12 | * |
13 | * Unless required by applicable law or agreed to in writing, software |
14 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
15 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
16 | * See the License for the specific language governing permissions and |
17 | * limitations under the License. |
18 | */ |
19 | /* |
20 | * The HAVEGE RNG was designed by Andre Seznec in 2002. |
21 | * |
22 | * http://www.irisa.fr/caps/projects/hipsor/publi.php |
23 | * |
24 | * Contact: seznec(at)irisa_dot_fr - orocheco(at)irisa_dot_fr |
25 | */ |
26 | |
27 | #include "common.h" |
28 | |
29 | #if defined(MBEDTLS_HAVEGE_C) |
30 | |
31 | #include "mbedtls/havege.h" |
32 | #include "mbedtls/timing.h" |
33 | #include "mbedtls/platform_util.h" |
34 | |
35 | #include <stdint.h> |
36 | #include <string.h> |
37 | |
38 | /* ------------------------------------------------------------------------ |
39 | * On average, one iteration accesses two 8-word blocks in the havege WALK |
40 | * table, and generates 16 words in the RES array. |
41 | * |
42 | * The data read in the WALK table is updated and permuted after each use. |
43 | * The result of the hardware clock counter read is used for this update. |
44 | * |
45 | * 25 conditional tests are present. The conditional tests are grouped in |
46 | * two nested groups of 12 conditional tests and 1 test that controls the |
47 | * permutation; on average, there should be 6 tests executed and 3 of them |
48 | * should be mispredicted. |
49 | * ------------------------------------------------------------------------ |
50 | */ |
51 | |
52 | #define SWAP(X, Y) { uint32_t *T = (X); (X) = (Y); (Y) = T; } |
53 | |
54 | #define TST1_ENTER if (PTEST & 1) { PTEST ^= 3; PTEST >>= 1; |
55 | #define TST2_ENTER if (PTEST & 1) { PTEST ^= 3; PTEST >>= 1; |
56 | |
57 | #define TST1_LEAVE U1++; } |
58 | #define TST2_LEAVE U2++; } |
59 | |
60 | #define ONE_ITERATION \ |
61 | \ |
62 | PTEST = PT1 >> 20; \ |
63 | \ |
64 | TST1_ENTER TST1_ENTER TST1_ENTER TST1_ENTER \ |
65 | TST1_ENTER TST1_ENTER TST1_ENTER TST1_ENTER \ |
66 | TST1_ENTER TST1_ENTER TST1_ENTER TST1_ENTER \ |
67 | \ |
68 | TST1_LEAVE TST1_LEAVE TST1_LEAVE TST1_LEAVE \ |
69 | TST1_LEAVE TST1_LEAVE TST1_LEAVE TST1_LEAVE \ |
70 | TST1_LEAVE TST1_LEAVE TST1_LEAVE TST1_LEAVE \ |
71 | \ |
72 | PTX = (PT1 >> 18) & 7; \ |
73 | PT1 &= 0x1FFF; \ |
74 | PT2 &= 0x1FFF; \ |
75 | CLK = (uint32_t) mbedtls_timing_hardclock(); \ |
76 | \ |
77 | i = 0; \ |
78 | A = &WALK[PT1]; RES[i++] ^= *A; \ |
79 | B = &WALK[PT2]; RES[i++] ^= *B; \ |
80 | C = &WALK[PT1 ^ 1]; RES[i++] ^= *C; \ |
81 | D = &WALK[PT2 ^ 4]; RES[i++] ^= *D; \ |
82 | \ |
83 | IN = (*A >> (1)) ^ (*A << (31)) ^ CLK; \ |
84 | *A = (*B >> (2)) ^ (*B << (30)) ^ CLK; \ |
85 | *B = IN ^ U1; \ |
86 | *C = (*C >> (3)) ^ (*C << (29)) ^ CLK; \ |
87 | *D = (*D >> (4)) ^ (*D << (28)) ^ CLK; \ |
88 | \ |
89 | A = &WALK[PT1 ^ 2]; RES[i++] ^= *A; \ |
90 | B = &WALK[PT2 ^ 2]; RES[i++] ^= *B; \ |
91 | C = &WALK[PT1 ^ 3]; RES[i++] ^= *C; \ |
92 | D = &WALK[PT2 ^ 6]; RES[i++] ^= *D; \ |
93 | \ |
94 | if (PTEST & 1) SWAP(A, C); \ |
95 | \ |
96 | IN = (*A >> (5)) ^ (*A << (27)) ^ CLK; \ |
97 | *A = (*B >> (6)) ^ (*B << (26)) ^ CLK; \ |
98 | *B = IN; CLK = (uint32_t) mbedtls_timing_hardclock(); \ |
99 | *C = (*C >> (7)) ^ (*C << (25)) ^ CLK; \ |
100 | *D = (*D >> (8)) ^ (*D << (24)) ^ CLK; \ |
101 | \ |
102 | A = &WALK[PT1 ^ 4]; \ |
103 | B = &WALK[PT2 ^ 1]; \ |
104 | \ |
105 | PTEST = PT2 >> 1; \ |
106 | \ |
107 | PT2 = (RES[(i - 8) ^ PTY] ^ WALK[PT2 ^ PTY ^ 7]); \ |
108 | PT2 = ((PT2 & 0x1FFF) & (~8)) ^ ((PT1 ^ 8) & 0x8); \ |
109 | PTY = (PT2 >> 10) & 7; \ |
110 | \ |
111 | TST2_ENTER TST2_ENTER TST2_ENTER TST2_ENTER \ |
112 | TST2_ENTER TST2_ENTER TST2_ENTER TST2_ENTER \ |
113 | TST2_ENTER TST2_ENTER TST2_ENTER TST2_ENTER \ |
114 | \ |
115 | TST2_LEAVE TST2_LEAVE TST2_LEAVE TST2_LEAVE \ |
116 | TST2_LEAVE TST2_LEAVE TST2_LEAVE TST2_LEAVE \ |
117 | TST2_LEAVE TST2_LEAVE TST2_LEAVE TST2_LEAVE \ |
118 | \ |
119 | C = &WALK[PT1 ^ 5]; \ |
120 | D = &WALK[PT2 ^ 5]; \ |
121 | \ |
122 | RES[i++] ^= *A; \ |
123 | RES[i++] ^= *B; \ |
124 | RES[i++] ^= *C; \ |
125 | RES[i++] ^= *D; \ |
126 | \ |
127 | IN = (*A >> (9)) ^ (*A << (23)) ^ CLK; \ |
128 | *A = (*B >> (10)) ^ (*B << (22)) ^ CLK; \ |
129 | *B = IN ^ U2; \ |
130 | *C = (*C >> (11)) ^ (*C << (21)) ^ CLK; \ |
131 | *D = (*D >> (12)) ^ (*D << (20)) ^ CLK; \ |
132 | \ |
133 | A = &WALK[PT1 ^ 6]; RES[i++] ^= *A; \ |
134 | B = &WALK[PT2 ^ 3]; RES[i++] ^= *B; \ |
135 | C = &WALK[PT1 ^ 7]; RES[i++] ^= *C; \ |
136 | D = &WALK[PT2 ^ 7]; RES[i++] ^= *D; \ |
137 | \ |
138 | IN = (*A >> (13)) ^ (*A << (19)) ^ CLK; \ |
139 | *A = (*B >> (14)) ^ (*B << (18)) ^ CLK; \ |
140 | *B = IN; \ |
141 | *C = (*C >> (15)) ^ (*C << (17)) ^ CLK; \ |
142 | *D = (*D >> (16)) ^ (*D << (16)) ^ CLK; \ |
143 | \ |
144 | PT1 = (RES[(i - 8) ^ PTX] ^ \ |
145 | WALK[PT1 ^ PTX ^ 7]) & (~1); \ |
146 | PT1 ^= (PT2 ^ 0x10) & 0x10; \ |
147 | \ |
148 | for (n++, i = 0; i < 16; i++) \ |
149 | hs->pool[n % MBEDTLS_HAVEGE_COLLECT_SIZE] ^= RES[i]; |
150 | |
151 | /* |
152 | * Entropy gathering function |
153 | */ |
154 | static void havege_fill(mbedtls_havege_state *hs) |
155 | { |
156 | size_t n = 0; |
157 | size_t i; |
158 | uint32_t U1, U2, *A, *B, *C, *D; |
159 | uint32_t PT1, PT2, *WALK, RES[16]; |
160 | uint32_t PTX, PTY, CLK, PTEST, IN; |
161 | |
162 | WALK = hs->WALK; |
163 | PT1 = hs->PT1; |
164 | PT2 = hs->PT2; |
165 | |
166 | PTX = U1 = 0; |
167 | PTY = U2 = 0; |
168 | |
169 | (void) PTX; |
170 | |
171 | memset(RES, 0, sizeof(RES)); |
172 | |
173 | while (n < MBEDTLS_HAVEGE_COLLECT_SIZE * 4) { |
174 | ONE_ITERATION |
175 | ONE_ITERATION |
176 | ONE_ITERATION |
177 | ONE_ITERATION |
178 | } |
179 | |
180 | hs->PT1 = PT1; |
181 | hs->PT2 = PT2; |
182 | |
183 | hs->offset[0] = 0; |
184 | hs->offset[1] = MBEDTLS_HAVEGE_COLLECT_SIZE / 2; |
185 | } |
186 | |
187 | /* |
188 | * HAVEGE initialization |
189 | */ |
190 | void mbedtls_havege_init(mbedtls_havege_state *hs) |
191 | { |
192 | memset(hs, 0, sizeof(mbedtls_havege_state)); |
193 | |
194 | havege_fill(hs); |
195 | } |
196 | |
197 | void mbedtls_havege_free(mbedtls_havege_state *hs) |
198 | { |
199 | if (hs == NULL) { |
200 | return; |
201 | } |
202 | |
203 | mbedtls_platform_zeroize(hs, sizeof(mbedtls_havege_state)); |
204 | } |
205 | |
206 | /* |
207 | * HAVEGE rand function |
208 | */ |
209 | int mbedtls_havege_random(void *p_rng, unsigned char *buf, size_t len) |
210 | { |
211 | uint32_t val; |
212 | size_t use_len; |
213 | mbedtls_havege_state *hs = (mbedtls_havege_state *) p_rng; |
214 | unsigned char *p = buf; |
215 | |
216 | while (len > 0) { |
217 | use_len = len; |
218 | if (use_len > sizeof(val)) { |
219 | use_len = sizeof(val); |
220 | } |
221 | |
222 | if (hs->offset[1] >= MBEDTLS_HAVEGE_COLLECT_SIZE) { |
223 | havege_fill(hs); |
224 | } |
225 | |
226 | val = hs->pool[hs->offset[0]++]; |
227 | val ^= hs->pool[hs->offset[1]++]; |
228 | |
229 | memcpy(p, &val, use_len); |
230 | |
231 | len -= use_len; |
232 | p += use_len; |
233 | } |
234 | |
235 | return 0; |
236 | } |
237 | |
238 | #endif /* MBEDTLS_HAVEGE_C */ |
239 | |