Inside Bitcoin

251        hasher.Write((const unsigned char*)&perf, sizeof(perf));
252    } while (SteadyClock::now() < stop);
253
254    // Produce output from inner state and feed it to outer hasher.
255    inner_hasher.Finalize(buffer);
256    hasher.Write(buffer, sizeof(buffer));
257    // Try to clean up.
258    inner_hasher.Reset();
259    memory_cleanse(buffer, sizeof(buffer));
260}
261
262#ifndef WIN32
263/** Fallback: get 32 bytes of system entropy from /dev/urandom. The most
264 * compatible way to get cryptographic randomness on UNIX-ish platforms.
265 */
266[[maybe_unused]] void GetDevURandom(unsigned char *ent32)
267{
268    int f = open("/dev/urandom", O_RDONLY);
269    if (f == -1) {
270        RandFailure();
271    }
272    int have = 0;
273    do {
274        ssize_t n = read(f, ent32 + have, NUM_OS_RANDOM_BYTES - have);
275        if (n <= 0 || n + have > NUM_OS_RANDOM_BYTES) {
276            close(f);
277            RandFailure();
278        }
279        have += n;
280    } while (have < NUM_OS_RANDOM_BYTES);
281    close(f);
282}
283#endif
284
285/** Get 32 bytes of system entropy. */
286void GetOSRand(unsigned char *ent32)
287{
288#if defined(WIN32)
289    constexpr uint32_t STATUS_SUCCESS{0x00000000};
290    NTSTATUS status = BCryptGenRandom(/*hAlgorithm=*/NULL,
291                                      /*pbBuffer=*/ent32,
292                                      /*cbBuffer=*/NUM_OS_RANDOM_BYTES,
293                                      /*dwFlags=*/BCRYPT_USE_SYSTEM_PREFERRED_RNG);
294
295    if (status != STATUS_SUCCESS) {
296        RandFailure();
297    }
298#elif defined(HAVE_GETRANDOM)
299    /* Linux. From the getrandom(2) man page:
300     * "If the urandom source has been initialized, reads of up to 256 bytes
301     * will always return as many bytes as requested and will not be
302     * interrupted by signals."
303     */
304    if (getrandom(ent32, NUM_OS_RANDOM_BYTES, 0) != NUM_OS_RANDOM_BYTES) {
305        RandFailure();
306    }
307#elif defined(__OpenBSD__)
308    /* OpenBSD. From the arc4random(3) man page:
309       "Use of these functions is encouraged for almost all random number
310        consumption because the other interfaces are deficient in either
311        quality, portability, standardization, or availability."
312       The function call is always successful.
313     */
314    arc4random_buf(ent32, NUM_OS_RANDOM_BYTES);
315#elif defined(HAVE_GETENTROPY_RAND) && defined(__APPLE__)
316    if (getentropy(ent32, NUM_OS_RANDOM_BYTES) != 0) {
317        RandFailure();
318    }
319#elif defined(HAVE_SYSCTL_ARND)
320    /* FreeBSD, NetBSD and similar. It is possible for the call to return less
321     * bytes than requested, so need to read in a loop.
322     */
323    static int name[2] = {CTL_KERN, KERN_ARND};
324    int have = 0;
325    do {
326        size_t len = NUM_OS_RANDOM_BYTES - have;
327        if (sysctl(name, std::size(name), ent32 + have, &len, nullptr, 0) != 0) {
328            RandFailure();
329        }
330        have += len;
331    } while (have < NUM_OS_RANDOM_BYTES);
332#else
333    /* Fall back to /dev/urandom if there is no specific method implemented to
334     * get system entropy for this OS.
335     */
336    GetDevURandom(ent32);
337#endif
338}
339
340class RNGState {
341    Mutex m_mutex;
342    /* The RNG state consists of 256 bits of entropy, taken from the output of
343     * one operation's SHA512 output, and fed as input to the next one.
344     * Carrying 256 bits of entropy should be sufficient to guarantee
345     * unpredictability as long as any entropy source was ever unpredictable
346     * to an attacker. To protect against situations where an attacker might
347     * observe the RNG's state, fresh entropy is always mixed when
348     * GetStrongRandBytes is called.
349     */
350    unsigned char m_state[32] GUARDED_BY(m_mutex) = {0};
351    uint64_t m_counter GUARDED_BY(m_mutex) = 0;
352    bool m_strongly_seeded GUARDED_BY(m_mutex) = false;
353
354    /** If not nullopt, the output of this RNGState is redirected and drawn from here
355     *  (unless always_use_real_rng is passed to MixExtract). */
356    std::optional<ChaCha20> m_deterministic_prng GUARDED_BY(m_mutex);
357
358    Mutex m_events_mutex;
359    CSHA256 m_events_hasher GUARDED_BY(m_events_mutex);
360
361public:
362    RNGState() noexcept
363    {
364        InitHardwareRand();
365    }
366
367    ~RNGState() = default;
368
369    void AddEvent(uint32_t event_info) noexcept EXCLUSIVE_LOCKS_REQUIRED(!m_events_mutex)
370    {
371        LOCK(m_events_mutex);
372
373        m_events_hasher.Write((const unsigned char *)&event_info, sizeof(event_info));
374        // Get the low four bytes of the performance counter. This translates to roughly the
375        // subsecond part.
376        uint32_t perfcounter = (GetPerformanceCounter() & 0xffffffff);
377        m_events_hasher.Write((const unsigned char*)&perfcounter, sizeof(perfcounter));
378    }
379
380    /**
381     * Feed (the hash of) all events added through AddEvent() to hasher.
382     */
383    void SeedEvents(CSHA512& hasher) noexcept EXCLUSIVE_LOCKS_REQUIRED(!m_events_mutex)
384    {
385        // We use only SHA256 for the events hashing to get the ASM speedups we have for SHA256,
386        // since we want it to be fast as network peers may be able to trigger it repeatedly.
387        LOCK(m_events_mutex);
388
389        unsigned char events_hash[32];
390        m_events_hasher.Finalize(events_hash);
391        hasher.Write(events_hash, 32);
392
393        // Re-initialize the hasher with the finalized state to use later.
394        m_events_hasher.Reset();
395        m_events_hasher.Write(events_hash, 32);
396    }
397
398    /** Make the output of MixExtract (unless always_use_real_rng) deterministic, with specified seed. */
399    void MakeDeterministic(const uint256& seed) noexcept EXCLUSIVE_LOCKS_REQUIRED(!m_mutex)
400    {
401        LOCK(m_mutex);
402        m_deterministic_prng.emplace(MakeByteSpan(seed));
403    }
404
405    /** Extract up to 32 bytes of entropy from the RNG state, mixing in new entropy from hasher.
406     *
407     * If this function has never been called with strong_seed = true, false is returned.
408     *
409     * If always_use_real_rng is false, and MakeDeterministic has been called before, output
410     * from the deterministic PRNG instead.
411     */
412    bool MixExtract(unsigned char* out, size_t num, CSHA512&& hasher, bool strong_seed, bool always_use_real_rng) noexcept EXCLUSIVE_LOCKS_REQUIRED(!m_mutex)
413    {
414        assert(num <= 32);
415        unsigned char buf[64];
416        static_assert(sizeof(buf) == CSHA512::OUTPUT_SIZE, "Buffer needs to have hasher's output size");
417        bool ret;
418        {
419            LOCK(m_mutex);
420            ret = (m_strongly_seeded |= strong_seed);
421            // Write the current state of the RNG into the hasher
422            hasher.Write(m_state, 32);
423            // Write a new counter number into the state
424            hasher.Write((const unsigned char*)&m_counter, sizeof(m_counter));
425            ++m_counter;
426            // Finalize the hasher
427            hasher.Finalize(buf);
428            // Store the last 32 bytes of the hash output as new RNG state.
429            memcpy(m_state, buf + 32, 32);
430            // Handle requests for deterministic randomness.
431            if (!always_use_real_rng && m_deterministic_prng.has_value()) [[unlikely]] {
432                // Overwrite the beginning of buf, which will be used for output.
433                m_deterministic_prng->Keystream(std::as_writable_bytes(std::span{buf, num}));
434                // Do not require strong seeding for deterministic output.
435                ret = true;
436            }
437        }
438        // If desired, copy (up to) the first 32 bytes of the hash output as output.
439        if (num) {
440            assert(out != nullptr);
441            memcpy(out, buf, num);
442        }
443        // Best effort cleanup of internal state
444        hasher.Reset();
445        memory_cleanse(buf, 64);
446        return ret;
447    }
448};
449
450RNGState& GetRNGState() noexcept
451{
452    // This idiom relies on the guarantee that static variable are initialized
453    // on first call, even when multiple parallel calls are permitted.
454    static std::vector<RNGState, secure_allocator<RNGState>> g_rng(1);
455    return g_rng[0];
456}
457
458/* A note on the use of noexcept in the seeding functions below:
459 *
460 * None of the RNG code should ever throw any exception.
461 */
462
463void SeedTimestamp(CSHA512& hasher) noexcept
464{
465    int64_t perfcounter = GetPerformanceCounter();
466    hasher.Write((const unsigned char*)&perfcounter, sizeof(perfcounter));
467}
468
469void SeedFast(CSHA512& hasher) noexcept
470{
471    unsigned char buffer[32];
472
473    // Stack pointer to indirectly commit to thread/callstack
474    const unsigned char* ptr = buffer;
475    hasher.Write((const unsigned char*)&ptr, sizeof(ptr));
476
477    // Hardware randomness is very fast when available; use it always.
478    SeedHardwareFast(hasher);
479
480    // High-precision timestamp
481    SeedTimestamp(hasher);
482}
483
484void SeedSlow(CSHA512& hasher, RNGState& rng) noexcept
485{
486    unsigned char buffer[32];
487
488    // Everything that the 'fast' seeder includes
489    SeedFast(hasher);
490
491    // OS randomness
492    GetOSRand(buffer);
493    hasher.Write(buffer, sizeof(buffer));
494
495    // Add the events hasher into the mix
496    rng.SeedEvents(hasher);
497
498    // High-precision timestamp.
499    //
500    // Note that we also commit to a timestamp in the Fast seeder, so we indirectly commit to a