/* Initialize CONTEXT with the key KEY of KEY_LENGTH bits. */ static void serpent_setkey_internal (serpent_context_t *context, const byte *key, unsigned int key_length) { serpent_key_t key_prepared; serpent_key_prepare (key, key_length, key_prepared); serpent_subkeys_generate (key_prepared, context->keys); #ifdef USE_AVX2 context->use_avx2 = 0; if ((_gcry_get_hw_features () & HWF_INTEL_AVX2)) { context->use_avx2 = 1; } #endif #ifdef USE_NEON context->use_neon = 0; if ((_gcry_get_hw_features () & HWF_ARM_NEON)) { context->use_neon = 1; } #endif wipememory (key_prepared, sizeof(key_prepared)); }
static gcry_err_code_t camellia_setkey(void *c, const byte *key, unsigned keylen) { CAMELLIA_context *ctx=c; static int initialized=0; static const char *selftest_failed=NULL; #if defined(USE_AESNI_AVX) || defined(USE_AESNI_AVX2) unsigned int hwf = _gcry_get_hw_features (); #endif if(keylen!=16 && keylen!=24 && keylen!=32) return GPG_ERR_INV_KEYLEN; if(!initialized) { initialized=1; selftest_failed=selftest(); if(selftest_failed) log_error("%s\n",selftest_failed); } if(selftest_failed) return GPG_ERR_SELFTEST_FAILED; #ifdef USE_AESNI_AVX ctx->use_aesni_avx = (hwf & HWF_INTEL_AESNI) && (hwf & HWF_INTEL_AVX); #endif #ifdef USE_AESNI_AVX2 ctx->use_aesni_avx2 = (hwf & HWF_INTEL_AESNI) && (hwf & HWF_INTEL_AVX2); #endif ctx->keybitlength=keylen*8; if (0) { } #ifdef USE_AESNI_AVX else if (ctx->use_aesni_avx) _gcry_camellia_aesni_avx_keygen(ctx, key, keylen); else #endif { Camellia_Ekeygen(ctx->keybitlength,key,ctx->keytable); _gcry_burn_stack ((19+34+34)*sizeof(u32)+2*sizeof(void*) /* camellia_setup256 */ +(4+32)*sizeof(u32)+2*sizeof(void*) /* camellia_setup192 */ +0+sizeof(int)+2*sizeof(void*) /* Camellia_Ekeygen */ +3*2*sizeof(void*) /* Function calls. */ ); } return 0; }
static gcry_err_code_t salsa20_do_setkey (SALSA20_context_t *ctx, const byte *key, unsigned int keylen) { static int initialized; static const char *selftest_failed; if (!initialized ) { initialized = 1; selftest_failed = selftest (); if (selftest_failed) log_error ("SALSA20 selftest failed (%s)\n", selftest_failed ); } if (selftest_failed) return GPG_ERR_SELFTEST_FAILED; if (keylen != SALSA20_MIN_KEY_SIZE && keylen != SALSA20_MAX_KEY_SIZE) return GPG_ERR_INV_KEYLEN; /* Default ops. */ ctx->keysetup = salsa20_keysetup; ctx->ivsetup = salsa20_ivsetup; ctx->core = salsa20_core; #ifdef USE_ARM_NEON_ASM ctx->use_neon = (_gcry_get_hw_features () & HWF_ARM_NEON) != 0; if (ctx->use_neon) { /* Use ARM NEON ops instead. */ ctx->keysetup = salsa20_keysetup_neon; ctx->ivsetup = salsa20_ivsetup_neon; ctx->core = salsa20_core_neon; } #endif ctx->keysetup (ctx, key, keylen); /* We default to a zero nonce. */ salsa20_setiv (ctx, NULL, 0); return 0; }
/* Note that the caller needs to make sure that this function is only * called by one thread at a time. The function returns 0 on success * or true on failure (in which case the caller will signal a fatal * error). This function should be entered only by one thread at a * time. */ int _gcry_rndlinux_gather_random (void (*add)(const void*, size_t, enum random_origins), enum random_origins origin, size_t length, int level ) { static int fd_urandom = -1; static int fd_random = -1; static int only_urandom = -1; static unsigned char ever_opened; static volatile pid_t my_pid; /* The volatile is there to make sure * the compiler does not optimize the * code away in case the getpid * function is badly attributed. */ volatile pid_t apid; int fd; int n; byte buffer[768]; size_t n_hw; size_t want = length; size_t last_so_far = 0; int any_need_entropy = 0; int delay; /* On the first call read the conf file to check whether we want to * use only urandom. */ if (only_urandom == -1) { my_pid = getpid (); if ((_gcry_random_read_conf () & RANDOM_CONF_ONLY_URANDOM)) only_urandom = 1; else only_urandom = 0; } if (!add) { /* Special mode to close the descriptors. */ if (fd_random != -1) { close (fd_random); fd_random = -1; } if (fd_urandom != -1) { close (fd_urandom); fd_urandom = -1; } return 0; } /* Detect a fork and close the devices so that we don't use the old * file descriptors. Note that open_device will be called in retry * mode if the devices was opened by the parent process. */ apid = getpid (); if (my_pid != apid) { if (fd_random != -1) { close (fd_random); fd_random = -1; } if (fd_urandom != -1) { close (fd_urandom); fd_urandom = -1; } my_pid = apid; } /* First read from a hardware source. However let it account only for up to 50% (or 25% for RDRAND) of the requested bytes. */ n_hw = _gcry_rndhw_poll_slow (add, origin); if ((_gcry_get_hw_features () & HWF_INTEL_RDRAND)) { if (n_hw > length/4) n_hw = length/4; } else { if (n_hw > length/2) n_hw = length/2; } if (length > 1) length -= n_hw; /* When using a blocking random generator try to get some entropy * from the jitter based RNG. In this case we take up to 50% of the * remaining requested bytes. */ if (level >= GCRY_VERY_STRONG_RANDOM) { n_hw = _gcry_rndjent_poll (add, origin, length/2); if (n_hw > length/2) n_hw = length/2; if (length > 1) length -= n_hw; } /* Open the requested device. The first time a device is to be opened we fail with a fatal error if the device does not exists. In case the device has ever been closed, further open requests will however retry indefinitely. The rationale for this behaviour is that we always require the device to be existent but want a more graceful behaviour if the rarely needed close operation has been used and the device needs to be re-opened later. */ if (level >= GCRY_VERY_STRONG_RANDOM && !only_urandom) { if (fd_random == -1) { fd_random = open_device (NAME_OF_DEV_RANDOM, (ever_opened & 1)); ever_opened |= 1; } fd = fd_random; } else { if (fd_urandom == -1) { fd_urandom = open_device (NAME_OF_DEV_URANDOM, (ever_opened & 2)); ever_opened |= 2; } fd = fd_urandom; } /* Enter the read loop. */ delay = 0; /* Start with 0 seconds so that we do no block on the first iteration and in turn call the progress function before blocking. To give the OS a better chance to return with something we will actually use 100ms. */ while (length) { fd_set rfds; struct timeval tv; int rc; /* If we have a modern Linux kernel, we first try to use the new * getrandom syscall. That call guarantees that the kernel's * RNG has been properly seeded before returning any data. This * is different from /dev/urandom which may, due to its * non-blocking semantics, return data even if the kernel has * not been properly seeded. And it differs from /dev/random by never * blocking once the kernel is seeded. Unfortunately we need to use a * syscall and not a new device and thus we are not able to use * select(2) to have a timeout. */ #if defined(__linux__) && defined(HAVE_SYSCALL) && defined(__NR_getrandom) { long ret; size_t nbytes; do { nbytes = length < sizeof(buffer)? length : sizeof(buffer); if (nbytes > 256) nbytes = 256; _gcry_pre_syscall (); ret = syscall (__NR_getrandom, (void*)buffer, (size_t)nbytes, (unsigned int)0); _gcry_post_syscall (); } while (ret == -1 && errno == EINTR); if (ret == -1 && errno == ENOSYS) ; /* The syscall is not supported - fallback to pulling from fd. */ else { /* The syscall is supported. Some sanity checks. */ if (ret == -1) log_fatal ("unexpected error from getrandom: %s\n", strerror (errno)); else if (ret != nbytes) log_fatal ("getrandom returned only" " %ld of %zu requested bytes\n", ret, nbytes); (*add)(buffer, nbytes, origin); length -= nbytes; continue; /* until LENGTH is zero. */ } } #endif /* If we collected some bytes update the progress indicator. We do this always and not just if the select timed out because often just a few bytes are gathered within the timeout period. */ if (any_need_entropy || last_so_far != (want - length) ) { last_so_far = want - length; _gcry_random_progress ("need_entropy", 'X', (int)last_so_far, (int)want); any_need_entropy = 1; } /* If the system has no limit on the number of file descriptors and we encounter an fd which is larger than the fd_set size, we don't use the select at all. The select code is only used to emit progress messages. A better solution would be to fall back to poll() if available. */ #ifdef FD_SETSIZE if (fd < FD_SETSIZE) #endif { FD_ZERO(&rfds); FD_SET(fd, &rfds); tv.tv_sec = delay; tv.tv_usec = delay? 0 : 100000; _gcry_pre_syscall (); rc = select (fd+1, &rfds, NULL, NULL, &tv); _gcry_post_syscall (); if (!rc) { any_need_entropy = 1; delay = 3; /* Use 3 seconds henceforth. */ continue; } else if( rc == -1 ) { log_error ("select() error: %s\n", strerror(errno)); if (!delay) delay = 1; /* Use 1 second if we encounter an error before we have ever blocked. */ continue; } } do { size_t nbytes; nbytes = length < sizeof(buffer)? length : sizeof(buffer); n = read (fd, buffer, nbytes); if (n >= 0 && n > nbytes) { log_error("bogus read from random device (n=%d)\n", n ); n = nbytes; } } while (n == -1 && errno == EINTR); if (n == -1) log_fatal("read error on random device: %s\n", strerror(errno)); (*add)(buffer, n, origin); length -= n; } wipememory (buffer, sizeof buffer); if (any_need_entropy) _gcry_random_progress ("need_entropy", 'X', (int)want, (int)want); return 0; /* success */ }