Lines Matching +full:noise +full:- +full:sensitive
2 * Non-physical true random number generator based on timing jitter --
5 * Copyright Stephan Mueller <smueller@chronox.de>, 2015 - 2023
32 * the restrictions contained in a BSD-style copyright.)
54 … be compiled with optimizations. See documentation. Use the compiler switch -O0 for compiling jitt…
65 /* SHA3-256 is used as conditioner */
68 * of the RNG are marked as SENSITIVE. A user must not
71 void *hash_state; /* SENSITIVE hash state entropy pool */
72 __u64 prev_time; /* SENSITIVE Previous time stamp */
73 __u64 last_delta; /* SENSITIVE stuck test */
74 __s64 last_delta2; /* SENSITIVE stuck test */
99 #define JENT_APT_WORD_MASK (JENT_APT_LSB - 1)
113 /* -- error codes for init function -- */
138 * output entropy (that is what SP 800-90B Section 3.1.5.1.2 attempts to bound).
143 * entropy in each bit of output to at least 1-epsilon, where epsilon is
144 * required to be <= 2^(-32).
155 * This test complies with SP800-90B section 4.4.2.
159 * See the SP 800-90B comment #10b for the corrected cutoff for the SP 800-90B
161 * https://www.untruth.org/~josh/sp80090b/UL%20SP800-90B-final%20comments%20v1.9%2020191212.pdf
162 * In the syntax of R, this is C = 2 + qbinom(1 − 2^(−30), 511, 2^(-1/osr)).
167 * For the alpha < 2^-53, R cannot be used as it uses a float data type without
172 * (by FIPS 140-2 IG 7.19 Resolution # 16, we cannot choose a cutoff value that
190 ec->apt_cutoff = jent_apt_cutoff_lookup[ in jent_apt_init()
191 ARRAY_SIZE(jent_apt_cutoff_lookup) - 1]; in jent_apt_init()
192 ec->apt_cutoff_permanent = jent_apt_cutoff_permanent_lookup[ in jent_apt_init()
193 ARRAY_SIZE(jent_apt_cutoff_permanent_lookup) - 1]; in jent_apt_init()
195 ec->apt_cutoff = jent_apt_cutoff_lookup[osr - 1]; in jent_apt_init()
196 ec->apt_cutoff_permanent = in jent_apt_init()
197 jent_apt_cutoff_permanent_lookup[osr - 1]; in jent_apt_init()
208 ec->apt_count = 0; in jent_apt_reset()
209 ec->apt_base = delta_masked; in jent_apt_reset()
210 ec->apt_observations = 0; in jent_apt_reset()
222 if (!ec->apt_base_set) { in jent_apt_insert()
223 ec->apt_base = delta_masked; in jent_apt_insert()
224 ec->apt_base_set = 1; in jent_apt_insert()
228 if (delta_masked == ec->apt_base) { in jent_apt_insert()
229 ec->apt_count++; in jent_apt_insert()
231 /* Note, ec->apt_count starts with one. */ in jent_apt_insert()
232 if (ec->apt_count >= ec->apt_cutoff_permanent) in jent_apt_insert()
233 ec->health_failure |= JENT_APT_FAILURE_PERMANENT; in jent_apt_insert()
234 else if (ec->apt_count >= ec->apt_cutoff) in jent_apt_insert()
235 ec->health_failure |= JENT_APT_FAILURE; in jent_apt_insert()
238 ec->apt_observations++; in jent_apt_insert()
240 if (ec->apt_observations >= JENT_APT_WINDOW_SIZE) in jent_apt_insert()
248 * (RCT) specified in SP800-90B section 4.4.1. Instead of counting identical
249 * back-to-back values, the input to the RCT is the counting of the stuck
252 * The RCT is applied with an alpha of 2^{-30} compliant to FIPS 140-2 IG 9.8.
255 * cut-off value of C. If that value exceeds the allowed cut-off value,
261 * Repetition Count Test as defined in SP800-90B section 4.4.1
269 ec->rct_count++; in jent_rct_insert()
273 * alpha = 2^-30 or 2^-60 as recommended in SP800-90B. in jent_rct_insert()
281 * Note, ec->rct_count (which equals to value B in the pseudo in jent_rct_insert()
282 * code of SP800-90B section 4.4.1) starts with zero. Hence in jent_rct_insert()
284 * following SP800-90B. Thus C = ceil(-log_2(alpha)/H) = 30*osr in jent_rct_insert()
287 if ((unsigned int)ec->rct_count >= (60 * ec->osr)) { in jent_rct_insert()
288 ec->rct_count = -1; in jent_rct_insert()
289 ec->health_failure |= JENT_RCT_FAILURE_PERMANENT; in jent_rct_insert()
290 } else if ((unsigned int)ec->rct_count >= (30 * ec->osr)) { in jent_rct_insert()
291 ec->rct_count = -1; in jent_rct_insert()
292 ec->health_failure |= JENT_RCT_FAILURE; in jent_rct_insert()
296 ec->rct_count = 0; in jent_rct_insert()
303 return (prev < next) ? (next - prev) : in jent_delta()
304 (JENT_UINT64_MAX - prev + 1 + next); in jent_delta()
313 * All values must always be non-zero.
324 __u64 delta2 = jent_delta(ec->last_delta, current_delta); in jent_stuck()
325 __u64 delta3 = jent_delta(ec->last_delta2, delta2); in jent_stuck()
327 ec->last_delta = current_delta; in jent_stuck()
328 ec->last_delta2 = delta2; in jent_stuck()
331 * Insert the result of the comparison of two back-to-back time in jent_stuck()
342 /* RCT with a non-stuck bit */ in jent_stuck()
366 return ec->health_failure; in jent_health_failure()
370 * Noise sources
389 unsigned int mask = (1<<bits) - 1; in jent_loop_shuffle()
397 for (i = 0; ((DATA_SIZE_BITS + bits - 1) / bits) > i; i++) { in jent_loop_shuffle()
410 * CPU Jitter noise source -- this is the noise source based on the CPU
432 ec->rct_count, in jent_condition_data()
433 ec->apt_observations, in jent_condition_data()
434 ec->apt_count, in jent_condition_data()
435 ec->apt_base in jent_condition_data()
438 return jent_hash_time(ec->hash_state, time, (u8 *)&addtl, sizeof(addtl), in jent_condition_data()
443 * Memory Access noise source -- this is a noise source based on variations in
457 * to reliably access either L3 or memory, the ec->mem memory must be quite
460 * @ec [in] Reference to the entropy collector with the memory access data -- if
461 * the reference to the memory block to be accessed is NULL, this noise
475 if (NULL == ec || NULL == ec->mem) in jent_memaccess()
477 wrap = ec->memblocksize * ec->memblocks; in jent_memaccess()
480 * testing purposes -- allow test app to set the counter, not in jent_memaccess()
486 for (i = 0; i < (ec->memaccessloops + acc_loop_cnt); i++) { in jent_memaccess()
487 unsigned char *tmpval = ec->mem + ec->memlocation; in jent_memaccess()
490 * wrap at 255 -- memory access implies read in jent_memaccess()
495 * Addition of memblocksize - 1 to pointer in jent_memaccess()
499 ec->memlocation = ec->memlocation + ec->memblocksize - 1; in jent_memaccess()
500 ec->memlocation = ec->memlocation % wrap; in jent_memaccess()
512 * WARNING: ensure that ->prev_time is primed before using the output
526 /* Invoke one noise source before time measurement to add variations */ in jent_measure_jitter()
534 current_delta = jent_delta(ec->prev_time, time); in jent_measure_jitter()
535 ec->prev_time = time; in jent_measure_jitter()
540 /* Now call the next noise sources which also injects the data */ in jent_measure_jitter()
553 * Function fills rand_data->hash_state
564 /* priming of the ->prev_time value */ in jent_gen_entropy()
573 * We multiply the loop value with ->osr to obtain the in jent_gen_entropy()
576 if (++k >= ((DATA_SIZE_BITS + safety_factor) * ec->osr)) in jent_gen_entropy()
592 * @data [in] pointer to buffer for storing random data -- buffer must already
600 * -1 entropy_collector is NULL or the generation failed
601 * -2 Intermittent health failure
602 * -3 Permanent health failure
610 return -1; in jent_read_entropy()
625 return -3; in jent_read_entropy()
633 ec->health_failure &= in jent_read_entropy()
636 return -3; in jent_read_entropy()
639 return -2; in jent_read_entropy()
643 if (jent_read_random_block(ec->hash_state, p, tocopy)) in jent_read_entropy()
644 return -1; in jent_read_entropy()
646 len -= tocopy; in jent_read_entropy()
671 entropy_collector->mem = jent_kvzalloc(JENT_MEMORY_SIZE); in jent_entropy_collector_alloc()
672 if (!entropy_collector->mem) { in jent_entropy_collector_alloc()
676 entropy_collector->memblocksize = in jent_entropy_collector_alloc()
678 entropy_collector->memblocks = in jent_entropy_collector_alloc()
680 entropy_collector->memaccessloops = JENT_MEMORY_ACCESSLOOPS; in jent_entropy_collector_alloc()
686 entropy_collector->osr = osr; in jent_entropy_collector_alloc()
687 entropy_collector->flags = flags; in jent_entropy_collector_alloc()
689 entropy_collector->hash_state = hash_state; in jent_entropy_collector_alloc()
694 /* fill the data pad with non-zero values */ in jent_entropy_collector_alloc()
702 jent_kvzfree(entropy_collector->mem, JENT_MEMORY_SIZE); in jent_entropy_collector_free()
703 entropy_collector->mem = NULL; in jent_entropy_collector_free()
728 ec->apt_base_set = 0; in jent_entropy_init()
730 ec->rct_count = 0; in jent_entropy_init()
732 ec->health_failure &= (~JENT_RCT_FAILURE); in jent_entropy_init()
733 ec->health_failure &= (~JENT_APT_FAILURE); in jent_entropy_init()
751 * following sanity checks verify that we have a high-resolution in jent_entropy_init()
758 * SP800-90B requires at least 1024 initial test cycles. in jent_entropy_init()
767 end_time = ec->prev_time; in jent_entropy_init()
768 start_time = ec->prev_time - delta; in jent_entropy_init()
778 * delta even when called shortly after each other -- this in jent_entropy_init()