Fast rng #685

nmathewson · 2019-02-07T03:10:21Z

No description provided.

Using an anonymous mmap() is a good way to get pages that we can set kernel-level flags on, like minherit() or madvise() or mlock(). We're going to use that so that we can make uninheritable locked pages to store PRNG data.

I don't know how this got here, but this kind of a wrapper only belongs in a header file.

Some of the code for getting a random value within a range wants to be shared between crypto_rand() and the new crypto_fast_rng() code.

This is the second part of refactoring the random-int-in-range code.

test_crypto.c is pretty big; it wouldn't hurt to split it up some more before I start adding stuff to the PRNG tests.

This module is currently implemented to use the same technique as libottery (later used by the bsds' arc4random replacement), using AES-CTR-256 as its underlying stream cipher. It's backtracking- resistant immediately after each call, and prediction-resistant after a while. Here's how it works: We generate psuedorandom bytes using AES-CTR-256. We generate BUFLEN bytes at a time. When we do this, we keep the first SEED_LEN bytes as the key and the IV for our next invocation of AES_CTR, and yield the remaining BUFLEN - SEED_LEN bytes to the user as they invoke the PRNG. As we yield bytes to the user, we clear them from the buffer. Every RESEED_AFTER times we refill the buffer, we mix in an additional SEED_LEN bytes from our strong PRNG into the seed. If the user ever asks for a huge number of bytes at once, we pull SEED_LEN bytes from the PRNG and use them with our stream cipher to fill the user's request.

coveralls · 2019-02-07T08:21:15Z

Pull Request Test Coverage Report for Build 3798

104 of 112 (92.86%) changed or added relevant lines in 3 files are covered.
1132 unchanged lines in 6 files lost coverage.
Overall coverage increased (+0.03%) to 61.773%

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
src/lib/crypt_ops/crypto_rand_fast.c	50	58	86.21%

Files with Coverage Reduction	New Missed Lines	%
src/feature/hs/hs_client.c	2	51.32%
src/core/or/circuitpadding.c	2	97.27%
src/core/proto/proto_socks.c	11	92.72%
src/lib/sandbox/sandbox.c	182	1.6%
src/feature/nodelist/networkstatus.c	333	53.29%
src/app/config/config.c	602	72.5%

Totals
Change from base Build 3737:	0.03%
Covered Lines:	45336
Relevant Lines:	73391

💛 - Coveralls

src/lib/crypt_ops/crypto_rand_numeric.c

src/lib/crypt_ops/crypto_rand_fast.c

Explain why crypto_rand_int doesn't call IMPLEMENT_RAND_UNSIGNED() directly.

Fix a typo.

Clarify RESEED_AFTER.

Use a symbolic value instead of 4 in the definition of BUFLEN

Clarify that "seed" means "key and IV" in a few more comments.

Use KEY_BITS.

Rename a variable in crypto_fast_rng_getbytes_impl(); add an assert. [I've verified that for me the assert doesn't slow us down.]

nmathewson · 2019-02-14T14:27:23Z

making a new squashed PR

nmathewson added 8 commits Feb 7, 2019

Code for anonymous mappings via mmap() or CreateFileMapping().

8ca808f

Using an anonymous mmap() is a good way to get pages that we can set kernel-level flags on, like minherit() or madvise() or mlock(). We're going to use that so that we can make uninheritable locked pages to store PRNG data.

Remove extraneous #if/#endif wrapper in crypto_rand.c

21d184a

I don't know how this got here, but this kind of a wrapper only belongs in a header file.

Extract numeric CSPRNG functions into a new module.

a49149f

Some of the code for getting a random value within a range wants to be shared between crypto_rand() and the new crypto_fast_rng() code.

Extract the common body of our random-int functions into a macro

a9a478f

This is the second part of refactoring the random-int-in-range code.

Extract RNG tests into a new test module

515dd87

test_crypto.c is pretty big; it wouldn't hurt to split it up some more before I start adding stuff to the PRNG tests.

Add a benchmark for our several PRNGs.

16db660

Add a test-rng program so we can pipe to dieharder.

d9f8e17

nmathewson added 2 commits Feb 7, 2019

Add test for crypto_fast_rng_get_double().

6885147

Add whitebox test for the long-output optimization of fast_rng

cb39ba6