1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * (pseudo) random functions 4 * Currently uses SHA-256 to scramble the PRNG state. 5 * 6 * Copyright IBM Corp. 2024 7 */ 8 9 #include "libcflat.h" 10 #include "rand.h" 11 #include <string.h> 12 13 /* Begin SHA-256 related definitions */ 14 15 #define INITAL_HASH { \ 16 0x6a09e667, \ 17 0xbb67ae85, \ 18 0x3c6ef372, \ 19 0xa54ff53a, \ 20 0x510e527f, \ 21 0x9b05688c, \ 22 0x1f83d9ab, \ 23 0x5be0cd19, \ 24 } 25 26 static const uint32_t K[] = { 27 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5, 28 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 29 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, 30 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967, 31 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 32 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070, 33 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3, 34 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2, 35 }; 36 37 static inline uint32_t ch(uint32_t x, uint32_t y, uint32_t z) 38 { 39 return (x & y) ^ ((~x) & z); 40 } 41 42 static inline uint32_t maj(uint32_t x, uint32_t y, uint32_t z) 43 { 44 return (x & y) ^ (x & z) ^ (y & z); 45 } 46 47 static inline uint32_t rot(uint32_t value, unsigned int count) 48 { 49 return value >> count | value << (32 - count); 50 } 51 52 static inline uint32_t upper_sig0(uint32_t x) 53 { 54 return rot(x, 2) ^ rot(x, 13) ^ rot(x, 22); 55 } 56 57 static inline uint32_t upper_sig1(uint32_t x) 58 { 59 return rot(x, 6) ^ rot(x, 11) ^ rot(x, 25); 60 } 61 62 static inline uint32_t lower_sig0(uint32_t x) 63 { 64 return rot(x, 7) ^ rot(x, 18) ^ (x >> 3); 65 } 66 67 static inline uint32_t lower_sig1(uint32_t x) 68 { 69 return rot(x, 17) ^ rot(x, 19) ^ (x >> 10); 70 } 71 72 enum alphabet { A, B, C, D, E, F, G, H, }; 73 74 static void sha256_chunk(const uint32_t (*chunk)[16], uint32_t (*hash)[8]) 75 { 76 uint32_t w[64]; 77 uint32_t w_hash[8]; 78 79 memcpy(w, chunk, sizeof(*chunk)); 80 81 for (int i = 16; i < 64; i++) 82 w[i] = lower_sig1(w[i - 2]) + w[i - 7] + lower_sig0(w[i - 15]) + w[i - 16]; 83 84 memcpy(w_hash, hash, sizeof(*hash)); 85 86 for (int i = 0; i < 64; i++) { 87 uint32_t t1, t2; 88 89 t1 = w_hash[H] + 90 upper_sig1(w_hash[E]) + 91 ch(w_hash[E], w_hash[F], w_hash[G]) + 92 K[i] + 93 w[i]; 94 95 t2 = upper_sig0(w_hash[A]) + maj(w_hash[A], w_hash[B], w_hash[C]); 96 97 w_hash[H] = w_hash[G]; 98 w_hash[G] = w_hash[F]; 99 w_hash[F] = w_hash[E]; 100 w_hash[E] = w_hash[D] + t1; 101 w_hash[D] = w_hash[C]; 102 w_hash[C] = w_hash[B]; 103 w_hash[B] = w_hash[A]; 104 w_hash[A] = t1 + t2; 105 } 106 107 for (int i = 0; i < 8; i++) 108 (*hash)[i] += w_hash[i]; 109 } 110 111 /** 112 * sha256_hash - Calculate SHA-256 of input. Only a limited subset of inputs supported. 113 * @n: Number of words to hash, must be <= 13 114 * @input: Input data to hash 115 * @hash: Output hash as a word array, ordered such that the first word contains 116 * the first/leftmost bits of the 256 bit hash 117 * 118 * Calculate the SHA-256 hash of the input where the input must be a multiple of 119 * 4 bytes and at most 52 long. The input is used without any adjustment, so, 120 * should the caller want to hash bytes it needs to interpret the bytes in the 121 * ordering as defined by the specification, that is big endian. 122 * The same applies to interpreting the output array as bytes. 123 * The function computes the same as: printf "%08x" ${input[@]} | xxd -r -p | sha256sum . 124 */ 125 static void sha256_hash(unsigned int n, const uint32_t (*input)[n], uint32_t (*hash)[8]) 126 { 127 /* 128 * Pad according to SHA-2 specification. 129 * First set up length in bits. 130 */ 131 uint32_t chunk[16] = { 132 [15] = sizeof(*input) * 8, 133 }; 134 135 memcpy(chunk, input, sizeof(*input)); 136 /* Then add separator */ 137 chunk[n] = 1 << 31; 138 memcpy(hash, (uint32_t[])INITAL_HASH, sizeof(*hash)); 139 sha256_chunk(&chunk, hash); 140 } 141 142 /* End SHA-256 related definitions */ 143 144 prng_state prng_init(uint64_t seed) 145 { 146 prng_state state = { .next_word = 0 }; 147 uint32_t seed_arr[2] = { seed >> 32, seed }; 148 149 sha256_hash(ARRAY_SIZE(seed_arr), &seed_arr, &state.hash); 150 return state; 151 } 152 153 static void prng_scramble(prng_state *state) 154 { 155 uint32_t input[8]; 156 157 memcpy(input, state->hash, sizeof(state->hash)); 158 sha256_hash(ARRAY_SIZE(input), &input, &state->hash); 159 state->next_word = 0; 160 } 161 162 uint32_t prng32(prng_state *state) 163 { 164 if (state->next_word < ARRAY_SIZE(state->hash)) 165 return state->hash[state->next_word++]; 166 167 prng_scramble(state); 168 return prng32(state); 169 } 170 171 uint64_t prng64(prng_state *state) 172 { 173 /* explicitly evaluate the high word first */ 174 uint64_t high = prng32(state); 175 176 return high << 32 | prng32(state); 177 } 178