4 * This file is part of BeRTOS.
6 * Bertos is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
20 * As a special exception, you may use this file as part of a free software
21 * library without restriction. Specifically, if other files instantiate
22 * templates or use macros or inline functions from this file, or you compile
23 * this file and link it with other files to produce an executable, this
24 * file does not by itself cause the resulting executable to be covered by
25 * the GNU General Public License. This exception does not however
26 * invalidate any other reasons why the executable file might be covered by
27 * the GNU General Public License.
29 * Copyright 2010 Develer S.r.l. (http://www.develer.com/)
33 * \brief ANSI X9.17 PRNG implementation
34 * \author Giovanni Bajo <rasky@develer.com>
41 #include <drv/timer.h>
42 #include "hw/hw_timer.h"
44 static void x917_next(X917Context *ctx, BlockCipher *cipher, uint8_t *out)
46 const size_t blen = cipher_block_len(cipher);
52 uint8_t padding[blen - sizeof(time_t) - sizeof(hptime_t)];
55 ASSERT(sizeof(DT) == blen);
57 memset(&DT, 0, sizeof(DT));
58 DT.t0 = timer_clock();
59 DT.t1 = timer_hw_hpread();
61 cipher_ecb_encrypt(cipher, &DT);
63 xor_block(out, (uint8_t*)&DT, ctx->state, blen);
64 cipher_ecb_encrypt(cipher, out);
66 xor_block(ctx->state, (uint8_t*)&DT, out, blen);
67 cipher_ecb_encrypt(cipher, ctx->state);
73 static void x917_generate(PRNG *ctx_, uint8_t *data, size_t len)
75 X917Context *ctx = (X917Context *)ctx_;
76 BlockCipher *cipher = AES128_stackinit();
78 const size_t blen = cipher_block_len(cipher);
82 ASSERT(sizeof(ctx->state) >= blen);
83 ASSERT(sizeof(ctx->key) >= cipher_key_len(cipher));
85 cipher_set_key(cipher, ctx->key);
89 size_t L = MIN(blen, len);
90 x917_next(ctx, cipher, temp);
91 memcpy(data, temp, L);
97 static void x917_reseed(PRNG *ctx_, const uint8_t *seed)
99 // The X9.17 standard does not specify reseeding. To avoid external
100 // dependencies, we implement it this way:
101 // * Generate a new random block, xor it with the first part
102 // of the seed, and use the result as new seed.
103 // * Generate and throw away a block to update the state.
104 X917Context *ctx = (X917Context *)ctx_;
105 const size_t klen = sizeof(ctx->key);
106 const size_t blen = sizeof(ctx->state);
108 if (!ctx->rng.seeded)
110 memcpy(ctx->key, seed, klen);
111 memcpy(ctx->state, seed+klen, blen);
116 x917_generate(ctx_, buf, klen);
118 xor_block(ctx->key, buf, seed, klen);
119 xor_block(ctx->state, ctx->state, seed+klen, blen);
125 /*********************************************************************/
127 void x917_init(X917Context *ctx)
129 ctx->rng.reseed = x917_reseed;
130 ctx->rng.generate = x917_generate;
131 ctx->rng.seed_len = sizeof(ctx->key) + sizeof(ctx->state);