summaryrefslogtreecommitdiff
path: root/sys/dev/rnd.c
AgeCommit message (Collapse)Author
2014-10-24obvious sizes for freeTed Unangst
2014-10-20typo; deraadtTed Unangst
2014-10-20use SHA512 to hash entropy instead of MD5Ted Unangst
2014-09-15update comments to reflect chacha20. from Max FillingerTed Unangst
2014-07-17zero entropy bufTed Unangst
2014-07-12add a size argument to free. will be used soon, but for now default to 0.Ted Unangst
after discussions with beck deraadt kettenis.
2014-06-14Change return value of getentropy() to int 0 for success. MaximumTheo de Raadt
buffersize is enforced strictly, this supplies sufficient entropy payload to act as seed material. Discourage general use of this API, but lock down this function name as the go-to for userland PRNG seeding. Improve documentation. ok miod matthew
2014-06-13Add new getentropy() system call. Code and pressure from matthew.Theo de Raadt
I accepted that he's right (again) to seperate this out from heavy sysctl API and this will simply a variety of things. Functionname is not used by anyone in the ports tree, so we guess we can use it. Shocking that no application has a function called this. ok matthew & others who pushed him to start this early on
2014-02-05tiny style adjustmentsTed Unangst
2014-01-22Emit a warning if no entropy was supplied by the boot loader.Joel Sing
ok deraadt@
2014-01-19Refactor rnd startup so arc4random/arc4random_buf can create a chacha stateTheo de Raadt
on first call, very early on, from boot-supplied entropy, then feed from that. Later when we have more subsystems ready, the main() can properly initialize the entropy-driven model. Lots of discussion with mikeb. ok kettenis markus mikeb
2014-01-19With the earlier initialization of the random subsystem, random_hostseed()Theo de Raadt
is no longer providing significant value. The random subsystem is in pretty good state, and moments later userland will feed the dmesg. ok jsing
2014-01-19In random_start() we can assume the msg buffer is mapped, all systems doTheo de Raadt
it at startup, or in cpu_startup(). Improve comments to explain what is happening here. ok kettenis jsing
2013-12-28Put the entropy_pool[] into the ELF .openbsd.randomdata segment.Theo de Raadt
Also allow random_init() to be called later, by moving a few entropy control initializions into the lower-level _rs_seed() layer. tested by jsing, phessler and a few others
2013-12-22spacing; Loganaden VelvindronTheo de Raadt
2013-12-11Revert change to sha256: ramdisks don't build with this and the obviousPhilip Guenther
conf/files change isn't enough due to size limits
2013-12-11update a few RC4 references to ChaCha. thanks sthenTed Unangst
2013-12-11md5 smells bad. switch to sha256. ok deraadt matthew mikebTed Unangst
2013-11-02replace rc4 with ChaCha20 here, too; ok djm, tedu, deraadtMarkus Friedl
2013-10-30replace workq_add_task with the task api.David Gwynne
this guarantees the reliability of the arc4_reinit task being run by not relying on a pool to give us memory in an interrupt context. ok mpi@
2013-07-09Fix a pair of aesthetic nits in dev/rnd.c:Bret Lambert
fix language (feed -> fed) in a comment 16 -> MD5_DIGEST_LENGTH for legibility No change to resulting object file. ok djm@
2013-03-25reseed the random pool with 'dmesg' when more devices are attachedMarkus Friedl
from hshoexer@; ok tedu@, "looks good" deraadt@
2012-06-24Change arc4random_uniform() to calculate ``2**32 % upper_bound'' asMatthew Dempsky
``-upper_bound % upper_bound''. Simplifies the code and makes it the same on both ILP32 and LP64 architectures, and also slightly faster on LP64 architectures by using a 32-bit remainder instead of a 64-bit remainder. Pointed out by Jorden Verwer on tech@ ok deraadt; no objections from djm or otto
2011-07-06Add a new kqfilter for random which returns ARC4_MAIN_MAX_BYTES for readNicholas Marriott
and POOLBYTES for write. looks right to deraadt
2011-01-11bring back carrying over state from the previous RC4 instance whenDamien Miller
rekeying; ok deraadt@
2011-01-11all the bzeros in rnd are important, use explicit_bzeroTed Unangst
2011-01-10update the documentation regarding the *4 vs *6 decision for early RC4Theo de Raadt
stream discard. this continues to be under discussion... at least this moves the large-buffer transactions to using a *6 discard discussed at length with djm and kjell
2011-01-10move comment block regarding ARC4_MAIN_MAX_BYTESTheo de Raadt
2011-01-10randomread does its own rekeying now, so we don't need the large buf function.Ted Unangst
ok deraadt
2011-01-10OK, this is getting silly, but we might as well zero the entropy bufferTheo de Raadt
supplied by root (it can be large enough to overwhelm the entropy buffer, and we are doing a re-key almost immediately)
2011-01-10zero another intermediate key storage areaTheo de Raadt
2011-01-09be more careful with nanotime() calls in early entropy storage, sinceTheo de Raadt
at least sparc may not have the clock mapped (found by miod). while here, protect some more timeout_*() calls with timeout_initialized()
2011-01-08split randomattach into random_init() and random_start(), so that weTheo de Raadt
can make attempts to load 'entropy' into the RC4. ok miod ariane
2011-01-08spacesTheo de Raadt
2011-01-08switch back from PAGE_SIZE for the sake of sparcTheo de Raadt
2011-01-08destatic. ok deraadtTed Unangst
2011-01-07some minor improvements to rnd.Ted Unangst
1. only support pool words == 2048. 2. define the amount of key we use. 3. define the amount of rc4 we skip. 4. use arc4random_buf instead of reimplementing inline. 5. bzero some more "secrets". ok deraadt djm
2011-01-07substantial rewrite. put a very thin mutex at the entropy-collectionTheo de Raadt
side so that entropy events can come in from any kernel context. place a 2nd very thin mutex at the call-down path as well, so that any context can request random data. in the middle, meet with a bcopy that has no mutex, but copying unlocked data is actually a benefit. move the pool->MD5->RC4init sequence into a workq driven from a timeout, so that we can do all the heavy work without any mutex held or IPL; only grab the 2nd mutex to swap to a new RC4 state. (this workq design from tedu) ok dlg tedu
2011-01-07since randomwrite() also has no blocking operations at all, we need toTheo de Raadt
do a yield, otherwise an accidental cat by root into /dev/random kind of makes your machine hurt a lot.
2011-01-06For very large operations in randomread(), use a local rc4 instanceTheo de Raadt
much like arc4random_buf_large does, but without re-initializing it every 8K. ok tedu
2011-01-06make all /dev/*random nodes respond; in fact, don't even worry aboutTheo de Raadt
the minor number at all. The chances of an application ignoring the error on /dev/random are *greater* than the risk of an application getting bad data from it. ok dlg tedu kjell
2011-01-04in arc4_stir() only grab 64 bytes from the MD5 output. Grabbing moreTheo de Raadt
does not substantially increase the quality of the RC4 state. These days we may have lots more userland libc's initializing themselves, or lots of largebuf kernel calls which re-initialize their own RC4, and thus deplete the MD5 more than originally intended. discussed at length with tedu, djm, kjell and kettenis ok kettenis
2011-01-01Do not fold the MD5 in half. This might have made sense to someone whenTheo de Raadt
we were feeding the MD5 output direct to consumers, but now we only feed the RC4, so the effect is to throw away half of the stretched data. ok tedu djm, initial discussion started by kjell
2011-01-01comment cleanupTheo de Raadt
2010-12-31make randomattach do the parts of it's job in the right order, then moveTheo de Raadt
it to where it belongs
2010-12-31cleanup the ioctl functionTheo de Raadt
2010-12-31delete includes we do not needTheo de Raadt
2010-12-31further improvements describing what we are doingTheo de Raadt
2010-12-31all random nodes have been arc4-based for a while, so none of them everTheo de Raadt
block. the kq and poll code should have been replaced with "selltrue" type code a while ago. with and ok nicm
2010-12-30be more cynical about boot-time entropy, and fold time and entropy data in.Theo de Raadt
ok djm
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-14 21:45:00 +0000