READ THE CODE

Inside Bitcoin

The code behind the network, with room to understand it.

Stable release v32.1bitcoin/bitcoin · f0de87f04062 ↗3,020 source files · 47.5 MB stored on the server440 file guides

Release published 2026-10-28 · Snapshot fetched 2026-11-01. Latest stable release at fetch time; development branches and Git history are excluded. Only the selected code window and visible folders load here.

24,555 bytes · SHA-256 36c7f0204674539f… · View upstream ↗

1// Copyright (c) 2009-2010 Satoshi Nakamoto
2// Copyright (c) 2009-present The Bitcoin Core developers
3// Distributed under the MIT software license, see the accompanying
4// file COPYING or http://www.opensource.org/licenses/mit-license.php.
5
6#include <bitcoin-build-config.h> // IWYU pragma: keep
7
8#include <random.h>
9
10#include <compat/compat.h>
11#include <compat/cpuid.h>
12#include <crypto/chacha20.h>
13#include <crypto/sha256.h>
14#include <crypto/sha512.h>
15#include <randomenv.h>
16#include <span.h>
17#include <support/allocators/secure.h>
18#include <support/cleanse.h>
19#include <sync.h>
20#include <util/log.h>
21#include <util/time.h>
22
23#include <array>
24#include <cmath>
25#include <cstdlib>
26#include <optional>
27#include <thread>
28
29#ifdef WIN32
30#include <bcrypt.h>
31#else
32#include <fcntl.h>
33#include <sys/time.h>
34#endif
35
36#if defined(HAVE_GETRANDOM) || (defined(HAVE_GETENTROPY_RAND) && defined(__APPLE__))
37#include <sys/random.h>
38#endif
39
40#ifdef HAVE_SYSCTL_ARND
41#include <sys/sysctl.h>
42#endif
43
44namespace {
45
46/* Number of random bytes returned by GetOSRand.
47 * When changing this constant make sure to change all call sites, and make
48 * sure that the underlying OS APIs for all platforms support the number.
49 * (many cap out at 256 bytes).
50 */
51static const int NUM_OS_RANDOM_BYTES = 32;
52
53
54[[noreturn]] void RandFailure()
55{
56    LogError("Failed to read randomness, aborting\n");
57    std::abort();
58}
59
60inline int64_t GetPerformanceCounter() noexcept
61{
62    // Read the hardware time stamp counter when available.
63    // See https://en.wikipedia.org/wiki/Time_Stamp_Counter for more information.
64#if defined(_MSC_VER) && (defined(_M_IX86) || defined(_M_X64))
65    return __rdtsc();
66#elif !defined(_MSC_VER) && defined(__i386__)
67    uint64_t r = 0;
68    __asm__ volatile ("rdtsc" : "=A"(r)); // Constrain the r variable to the eax:edx pair.
69    return r;
70#elif !defined(_MSC_VER) && (defined(__x86_64__) || defined(__amd64__))
71    uint64_t r1 = 0, r2 = 0;
72    __asm__ volatile ("rdtsc" : "=a"(r1), "=d"(r2)); // Constrain r1 to rax and r2 to rdx.
73    return (r2 << 32) | r1;
74#else
75    // Fall back to using standard library clock (usually microsecond or nanosecond precision)
76    return std::chrono::high_resolution_clock::now().time_since_epoch().count();
77#endif
78}
79
80#ifdef HAVE_GETCPUID
81bool g_rdrand_supported = false;
82bool g_rdseed_supported = false;
83constexpr uint32_t CPUID_F1_ECX_RDRAND = 0x40000000;
84constexpr uint32_t CPUID_F7_EBX_RDSEED = 0x00040000;
85#ifdef bit_RDRND
86static_assert(CPUID_F1_ECX_RDRAND == bit_RDRND, "Unexpected value for bit_RDRND");
87#endif
88#ifdef bit_RDSEED
89static_assert(CPUID_F7_EBX_RDSEED == bit_RDSEED, "Unexpected value for bit_RDSEED");
90#endif
91
92void InitHardwareRand()
93{
94    uint32_t eax, ebx, ecx, edx;
95    GetCPUID(1, 0, eax, ebx, ecx, edx);
96    if (ecx & CPUID_F1_ECX_RDRAND) {
97        g_rdrand_supported = true;
98    }
99    GetCPUID(7, 0, eax, ebx, ecx, edx);
100    if (ebx & CPUID_F7_EBX_RDSEED) {
101        g_rdseed_supported = true;
102    }
103}
104
105void ReportHardwareRand()
106{
107    // This must be done in a separate function, as InitHardwareRand() may be indirectly called
108    // from global constructors, before logging is initialized.
109    if (g_rdseed_supported) {
110        LogInfo("Using RdSeed as an additional entropy source");
111    }
112    if (g_rdrand_supported) {
113        LogInfo("Using RdRand as an additional entropy source");
114    }
115}
116
117/** Read 64 bits of entropy using rdrand.
118 *
119 * Must only be called when RdRand is supported.
120 */
121uint64_t GetRdRand() noexcept
122{
123    // RdRand may very rarely fail. Invoke it up to 10 times in a loop to reduce this risk.
124#ifdef __i386__
125    uint8_t ok = 0;
126    // Initialize to 0 to silence a compiler warning that r1 or r2 may be used
127    // uninitialized. Even if rdrand fails (!ok) it will set the output to 0,
128    // but there is no way that the compiler could know that.
129    uint32_t r1 = 0, r2 = 0;
130    for (int i = 0; i < 10; ++i) {
131        __asm__ volatile (".byte 0x0f, 0xc7, 0xf0; setc %1" : "=a"(r1), "=q"(ok) :: "cc"); // rdrand %eax
132        if (ok) break;
133    }
134    for (int i = 0; i < 10; ++i) {
135        __asm__ volatile (".byte 0x0f, 0xc7, 0xf0; setc %1" : "=a"(r2), "=q"(ok) :: "cc"); // rdrand %eax
136        if (ok) break;
137    }
138    return (((uint64_t)r2) << 32) | r1;
139#elif defined(__x86_64__) || defined(__amd64__)
140    uint8_t ok = 0;
141    uint64_t r1 = 0; // See above why we initialize to 0.
142    for (int i = 0; i < 10; ++i) {
143        __asm__ volatile (".byte 0x48, 0x0f, 0xc7, 0xf0; setc %1" : "=a"(r1), "=q"(ok) :: "cc"); // rdrand %rax
144        if (ok) break;
145    }
146    return r1;
147#else
148#error "RdRand is only supported on x86 and x86_64"
149#endif
150}
151
152/** Read 64 bits of entropy using rdseed.
153 *
154 * Must only be called when RdSeed is supported.
155 */
156uint64_t GetRdSeed() noexcept
157{
158    // RdSeed may fail when the HW RNG is overloaded. Loop indefinitely until enough entropy is gathered,
159    // but pause after every failure.
160#ifdef __i386__
161    uint8_t ok = 0;
162    uint32_t r1, r2;
163    do {
164        __asm__ volatile (".byte 0x0f, 0xc7, 0xf8; setc %1" : "=a"(r1), "=q"(ok) :: "cc"); // rdseed %eax
165        if (ok) break;
166        __asm__ volatile ("pause");
167    } while(true);
168    do {
169        __asm__ volatile (".byte 0x0f, 0xc7, 0xf8; setc %1" : "=a"(r2), "=q"(ok) :: "cc"); // rdseed %eax
170        if (ok) break;
171        __asm__ volatile ("pause");
172    } while(true);
173    return (((uint64_t)r2) << 32) | r1;
174#elif defined(__x86_64__) || defined(__amd64__)
175    uint8_t ok;
176    uint64_t r1;
177    do {
178        __asm__ volatile (".byte 0x48, 0x0f, 0xc7, 0xf8; setc %1" : "=a"(r1), "=q"(ok) :: "cc"); // rdseed %rax
179        if (ok) break;
180        __asm__ volatile ("pause");
181    } while(true);
182    return r1;
183#else
184#error "RdSeed is only supported on x86 and x86_64"
185#endif
186}
187
188#else
189/* Access to other hardware random number generators could be added here later,
190 * assuming it is sufficiently fast (in the order of a few hundred CPU cycles).
191 * Slower sources should probably be invoked separately, and/or only from
192 * RandAddPeriodic (which is called once a minute).
193 */
194void InitHardwareRand() {}
195void ReportHardwareRand() {}
196#endif
197
198/** Add 64 bits of entropy gathered from hardware to hasher. Do nothing if not supported. */
199void SeedHardwareFast(CSHA512& hasher) noexcept {
200#if defined(__x86_64__) || defined(__amd64__) || defined(__i386__)
201    if (g_rdrand_supported) {
202        uint64_t out = GetRdRand();
203        hasher.Write((const unsigned char*)&out, sizeof(out));
204        return;
205    }
206#endif
207}
208
209/** Add 256 bits of entropy gathered from hardware to hasher. Do nothing if not supported. */
210void SeedHardwareSlow(CSHA512& hasher) noexcept {
211#if defined(__x86_64__) || defined(__amd64__) || defined(__i386__)
212    // When we want 256 bits of entropy, prefer RdSeed over RdRand, as it's
213    // guaranteed to produce independent randomness on every call.
214    if (g_rdseed_supported) {
215        for (int i = 0; i < 4; ++i) {
216            uint64_t out = GetRdSeed();
217            hasher.Write((const unsigned char*)&out, sizeof(out));
218        }
219        return;
220    }
221    // When falling back to RdRand, XOR the result of 1024 results.
222    // This guarantees a reseeding occurs between each.
223    if (g_rdrand_supported) {
224        for (int i = 0; i < 4; ++i) {
225            uint64_t out = 0;
226            for (int j = 0; j < 1024; ++j) out ^= GetRdRand();
227            hasher.Write((const unsigned char*)&out, sizeof(out));
228        }
229        return;
230    }
231#endif
232}
233
234/** Use repeated SHA512 to strengthen the randomness in seed32, and feed into hasher. */
235void Strengthen(const unsigned char (&seed)[32], SteadyClock::duration dur, CSHA512& hasher) noexcept
236{
237    CSHA512 inner_hasher;
238    inner_hasher.Write(seed, sizeof(seed));
239
240    // Hash loop
241    unsigned char buffer[64];
242    const auto stop{SteadyClock::now() + dur};
243    do {
244        for (int i = 0; i < 1000; ++i) {
245            inner_hasher.Finalize(buffer);
246            inner_hasher.Reset();
247            inner_hasher.Write(buffer, sizeof(buffer));
248        }
249        // Benchmark operation and feed it into outer hasher.
250        int64_t perf = GetPerformanceCounter();

src/wallet/receive.cpp

src/wallet/coinselection.cpp

src/consensus/validation.h

src/primitives/transaction.cpp

src/script/descriptor.cpp

src/bitcoin-cli.cpp

src/rpc/blockchain.cpp

src/rpc/rawtransaction.cpp

src/init.cpp

src/crypto/sha256.cpp

src/consensus/merkle.h

src/consensus/tx_check.h

src/consensus/tx_verify.h

src/policy/feerate.h

src/policy/feerate.cpp

src/primitives/transaction_identifier.h

src/chainparamsbase.h

src/chainparamsbase.cpp

src/util/moneystr.cpp

src/crypto/ripemd160.h

src/crypto/sha1.h

src/crypto/sha512.h

src/crypto/hmac_sha256.h

src/crypto/hmac_sha512.h

src/crypto/hmac_sha256.cpp

src/crypto/hmac_sha512.cpp

src/crypto/hkdf_sha256_32.h

src/crypto/hkdf_sha256_32.cpp

src/support/cleanse.h

src/support/cleanse.cpp

src/crypto/siphash.cpp

src/crypto/muhash.h

src/crypto/chacha20.h

src/crypto/poly1305.h

src/crypto/chacha20poly1305.h

src/crypto/chacha20poly1305.cpp

src/util/chaintype.cpp

src/util/obfuscation.h

src/util/byte_units.h

src/util/overflow.h

src/blockencodings.cpp

src/net_permissions.cpp

src/policy/packages.cpp

src/policy/rbf.cpp

src/policy/truc_policy.cpp

src/policy/ephemeral_policy.cpp

src/policy/settings.cpp

src/policy/policy.cpp

src/node/transaction.cpp

src/node/coin.cpp

src/rpc/client.cpp

src/rpc/external_signer.cpp

src/rpc/request.cpp

src/rpc/server_util.cpp

src/rpc/fees.cpp

src/rpc/output_script.cpp

src/rpc/rawtransaction_util.cpp

src/rpc/rawtransaction_util.h

src/rpc/register.h

src/rpc/request.h

src/rpc/server_util.h

src/rpc/protocol.h

src/rpc/server.h

src/rpc/signmessage.cpp

src/rpc/txoutproof.cpp

src/rpc/util.cpp

src/rpc/util.h

src/wallet/rpc/addresses.cpp

src/wallet/rpc/backup.cpp

src/wallet/rpc/coins.cpp

src/wallet/rpc/encrypt.cpp

src/wallet/rpc/signmessage.cpp

src/wallet/rpc/util.cpp

src/wallet/rpc/util.h

src/wallet/coincontrol.cpp

src/wallet/coincontrol.h

src/wallet/context.cpp

src/wallet/context.h

src/wallet/crypter.cpp

src/wallet/crypter.h

src/wallet/db.cpp

src/wallet/export.cpp

src/wallet/external_signer_scriptpubkeyman.cpp

src/wallet/rpc/spend.cpp

src/wallet/rpc/transactions.cpp

src/wallet/rpc/wallet.cpp

src/wallet/feebumper.cpp

src/wallet/feebumper.h

src/index/base.h

src/index/base.cpp

src/index/txindex.h

src/index/txindex.cpp

src/index/txindex_key.h

src/index/txospenderindex.h

src/index/txospenderindex.cpp

src/index/blockfilterindex.h

src/index/blockfilterindex.cpp

src/index/coinstatsindex.h

src/index/coinstatsindex.cpp

src/index/db_key.h

src/index/disktxpos.h

src/kernel/chain.cpp

src/kernel/chain.h

src/kernel/checks.cpp

src/kernel/checks.h

src/kernel/context.cpp

src/kernel/context.h

src/kernel/cs_main.cpp

src/kernel/cs_main.h

src/kernel/disconnected_transactions.cpp

src/kernel/disconnected_transactions.h

src/kernel/mempool_removal_reason.cpp

src/kernel/mempool_removal_reason.h

src/kernel/coinstats.cpp

src/kernel/coinstats.h

src/kernel/chainparams.cpp

src/kernel/chainparams.h

src/wallet/sqlite.cpp

src/wallet/sqlite.h

src/wallet/transaction.cpp

src/wallet/transaction.h

src/wallet/dump.cpp

src/wallet/dump.h

src/wallet/init.cpp

src/wallet/walletutil.cpp

src/wallet/walletutil.h

src/wallet/wallettool.cpp

src/wallet/wallettool.h

src/wallet/export.h

src/wallet/migrate.cpp

src/wallet/migrate.h

src/wallet/db.h

src/wallet/walletdb.cpp

src/wallet/interfaces.cpp

src/wallet/scriptpubkeyman.cpp

src/wallet/scriptpubkeyman.h

src/kernel/bitcoinkernel.cpp

src/kernel/bitcoinkernel.h

src/kernel/bitcoinkernel_wrapper.h

src/node/chainstate.cpp

src/node/chainstate.h

src/node/blockstorage.cpp

src/node/blockstorage.h

src/node/mempool_persist.cpp

src/node/mempool_persist.h

src/node/utxo_snapshot.cpp

src/node/utxo_snapshot.h

src/node/kernel_notifications.cpp

src/node/kernel_notifications.h

src/node/blockmanager_args.cpp

src/kernel/blockmanager_opts.h

src/util/expected.cpp

src/policy/settings.h

src/util/types.h

src/kernel/messagestartchars.h

src/kernel/warning.h

src/util/exception.h

src/common/license_info.h

src/node/coins_view_args.h

src/node/database_args.h

src/util/batchpriority.h

src/util/ui_change_type.h

src/node/coins_view_args.cpp

src/node/peerman_args.h

src/util/serfloat.h

src/node/blockmanager_args.h

src/node/database_args.cpp

src/util/overloaded.h

src/interfaces/types.h

src/node/chainstatemanager_args.h

src/node/minisketchwrapper.h

src/util/macros.h

src/util/syserror.h

src/common/run_command.h

src/util/bytevectorhash.cpp

src/node/mempool_persist_args.cpp

src/util/exec.h

src/util/rbf.h

src/crypto/hex_base.h

src/node/mempool_persist_args.h

src/interfaces/echo.h

src/util/any.h

src/util/batchpriority.cpp

src/util/threadnames.h

src/node/coin.h

src/node/mempool_args.h

src/util/asmap.h

src/util/bytevectorhash.h

src/node/context.cpp

src/util/insert.h

src/util/readwritefile.h

src/node/peerman_args.cpp

src/node/interface_ui.cpp

src/interfaces/handler.h

src/node/mining_args.h

src/util/hasher.cpp

src/common/init.h

src/kernel/mempool_limits.h

src/common/system.h

src/crypto/sha3.h

src/util/threadinterrupt.cpp

src/node/protocol_version.h

src/util/exception.cpp

src/common/messages.h

src/node/connection_types.cpp

src/util/bip32.h

src/common/license_info.cpp

src/util/stdmutex.h

src/common/run_command.cpp

src/util/check.cpp

src/util/golombrice.h

src/node/types.h

src/node/timeoffsets.h

src/util/readwritefile.cpp

src/util/fastrange.h

src/util/signalinterrupt.h

src/util/task_runner.h

src/util/syserror.cpp

src/common/interfaces.cpp

src/common/types.h

src/util/threadinterrupt.h

src/kernel/chainstatemanager_opts.h

src/node/psbt.h

src/policy/ephemeral_policy.h

src/util/trace.h

src/common/url.cpp

src/kernel/mempool_options.h

src/util/serfloat.cpp

src/kernel/notifications_interface.h

src/node/timeoffsets.cpp

src/node/warnings.cpp

src/util/hash_type.h

src/crypto/hex_base.cpp

src/node/eviction.h

src/util/tokenbucket.h

src/crypto/aes.h

src/common/pcp.h

src/util/feefrac.cpp

src/node/transaction.h

src/util/threadnames.cpp

src/common/signmessage.h

src/util/exec.cpp

src/util/signalinterrupt.cpp

src/clientversion.cpp

src/common/signmessage.cpp

src/compat/assumptions.h

src/compat/byteswap.h

src/deploymentinfo.cpp

src/deploymentinfo.h

src/deploymentstatus.cpp

src/deploymentstatus.h

src/dummywallet.cpp

src/external_signer.h

src/init/bitcoin-gui.cpp

src/init/bitcoin-node.cpp

src/init/bitcoin-qt.cpp

src/init/bitcoin-wallet.cpp

src/init/bitcoind.cpp

src/init/common.h

src/interfaces/init.h

src/interfaces/ipc.h

src/key_io.h

src/logging/categories.h

src/logging/timer.h

src/mapport.h

src/musig.h

src/net_permissions.h

src/netgroup.h

src/netmessagemaker.h

src/node/chainstatemanager_args.cpp

src/node/connection_types.h

src/node/context.h

src/node/interface_ui.h

src/node/mempool_args.cpp

src/node/mining_args.cpp

src/node/minisketchwrapper.cpp

src/node/txreconciliation.h

src/policy/fees/estimator_args.cpp

src/policy/fees/estimator_args.h

src/policy/fees/estimator_man.cpp

src/policy/fees/estimator_man.h

src/policy/packages.h

src/policy/rbf.h

src/policy/truc_policy.h

src/pow.h

src/primitives/block.cpp

src/randomenv.h

src/rest.h

src/script/keyorigin.h

src/script/parsing.cpp

src/script/parsing.h

src/script/script_error.h

src/script/sigcache.cpp

src/script/sigcache.h

src/script/solver.h

src/script/verify_flags.h

src/semaphore_grant.h

src/signet.h

src/span.h

src/support/allocators/secure.h

src/support/allocators/zeroafterfree.h

src/util/tokenpipe.cpp

src/util/translation.h

src/util/vector.h

src/versionbits.h

src/versionbits_impl.h

src/wallet/external_signer_scriptpubkeyman.h

src/wallet/fees.h

src/wallet/load.h

src/wallet/receive.h

src/wallet/rpc/wallet.h

src/wallet/types.h

src/walletinitinterface.h

src/zmq/zmqabstractnotifier.cpp

Independent explanations by MyBitcoinExplorer. Not affiliated with or endorsed by Bitcoin Core. Guides are educational and do not replace the source or its tests.

Bitcoin Core source © its contributors, distributed under the MIT license. Original notices and bundled third-party licenses are retained in the source tree.