Inside Bitcoin

501    // benchmark of all the entropy gathering sources in this function).
502    SeedTimestamp(hasher);
503}
504
505/** Extract entropy from rng, strengthen it, and feed it into hasher. */
506void SeedStrengthen(CSHA512& hasher, RNGState& rng, SteadyClock::duration dur) noexcept
507{
508    // Generate 32 bytes of entropy from the RNG, and a copy of the entropy already in hasher.
509    // Never use the deterministic PRNG for this, as the result is only used internally.
510    unsigned char strengthen_seed[32];
511    rng.MixExtract(strengthen_seed, sizeof(strengthen_seed), CSHA512(hasher), false, /*always_use_real_rng=*/true);
512    // Strengthen the seed, and feed it into hasher.
513    Strengthen(strengthen_seed, dur, hasher);
514}
515
516void SeedPeriodic(CSHA512& hasher, RNGState& rng) noexcept
517{
518    // Everything that the 'fast' seeder includes
519    SeedFast(hasher);
520
521    // High-precision timestamp
522    SeedTimestamp(hasher);
523
524    // Add the events hasher into the mix
525    rng.SeedEvents(hasher);
526
527    // Dynamic environment data (clocks, resource usage, ...)
528    auto old_size = hasher.Size();
529    RandAddDynamicEnv(hasher);
530    LogDebug(BCLog::RAND, "Feeding %i bytes of dynamic environment data into RNG\n", hasher.Size() - old_size);
531
532    // Strengthen for 10 ms
533    SeedStrengthen(hasher, rng, 10ms);
534}
535
536void SeedStartup(CSHA512& hasher, RNGState& rng) noexcept
537{
538    // Gather 256 bits of hardware randomness, if available
539    SeedHardwareSlow(hasher);
540
541    // Everything that the 'slow' seeder includes.
542    SeedSlow(hasher, rng);
543
544    // Dynamic environment data (clocks, resource usage, ...)
545    auto old_size = hasher.Size();
546    RandAddDynamicEnv(hasher);
547
548    // Static environment data
549    RandAddStaticEnv(hasher);
550    LogDebug(BCLog::RAND, "Feeding %i bytes of environment data into RNG\n", hasher.Size() - old_size);
551
552    // Strengthen for 100 ms
553    SeedStrengthen(hasher, rng, 100ms);
554}
555
556enum class RNGLevel {
557    FAST, //!< Automatically called by GetRandBytes
558    SLOW, //!< Automatically called by GetStrongRandBytes
559    PERIODIC, //!< Called by RandAddPeriodic()
560};
561
562void ProcRand(unsigned char* out, int num, RNGLevel level, bool always_use_real_rng) noexcept
563{
564    // Make sure the RNG is initialized first (as all Seed* function possibly need hwrand to be available).
565    RNGState& rng = GetRNGState();
566
567    assert(num <= 32);
568
569    CSHA512 hasher;
570    switch (level) {
571    case RNGLevel::FAST:
572        SeedFast(hasher);
573        break;
574    case RNGLevel::SLOW:
575        SeedSlow(hasher, rng);
576        break;
577    case RNGLevel::PERIODIC:
578        SeedPeriodic(hasher, rng);
579        break;
580    }
581
582    // Combine with and update state
583    if (!rng.MixExtract(out, num, std::move(hasher), false, always_use_real_rng)) {
584        // On the first invocation, also seed with SeedStartup().
585        CSHA512 startup_hasher;
586        SeedStartup(startup_hasher, rng);
587        rng.MixExtract(out, num, std::move(startup_hasher), true, always_use_real_rng);
588    }
589}
590
591} // namespace
592
593
594/** Internal function to set g_determinstic_rng. Only accessed from tests. */
595void MakeRandDeterministicDANGEROUS(const uint256& seed) noexcept
596{
597    GetRNGState().MakeDeterministic(seed);
598}
599std::atomic<bool> g_used_g_prng{false}; // Only accessed from tests
600
601void GetRandBytes(std::span<unsigned char> bytes) noexcept
602{
603    g_used_g_prng = true;
604    ProcRand(bytes.data(), bytes.size(), RNGLevel::FAST, /*always_use_real_rng=*/false);
605}
606
607void GetStrongRandBytes(std::span<unsigned char> bytes) noexcept
608{
609    ProcRand(bytes.data(), bytes.size(), RNGLevel::SLOW, /*always_use_real_rng=*/true);
610}
611
612void RandAddPeriodic() noexcept
613{
614    ProcRand(nullptr, 0, RNGLevel::PERIODIC, /*always_use_real_rng=*/false);
615}
616
617void RandAddEvent(const uint32_t event_info) noexcept { GetRNGState().AddEvent(event_info); }
618
619void FastRandomContext::RandomSeed() noexcept
620{
621    uint256 seed = GetRandHash();
622    rng.SetKey(MakeByteSpan(seed));
623    requires_seed = false;
624}
625
626void FastRandomContext::fillrand(std::span<std::byte> output) noexcept
627{
628    if (requires_seed) RandomSeed();
629    rng.Keystream(output);
630}
631
632FastRandomContext::FastRandomContext(const uint256& seed) noexcept : requires_seed(false), rng(MakeByteSpan(seed)) {}
633
634void FastRandomContext::Reseed(const uint256& seed) noexcept
635{
636    FlushCache();
637    requires_seed = false;
638    rng = {MakeByteSpan(seed)};
639}
640
641bool Random_SanityCheck()
642{
643    uint64_t start = GetPerformanceCounter();
644
645    /* This does not measure the quality of randomness, but it does test that
646     * GetOSRand() overwrites all 32 bytes of the output given a maximum
647     * number of tries.
648     */
649    static constexpr int MAX_TRIES{1024};
650    uint8_t data[NUM_OS_RANDOM_BYTES];
651    bool overwritten[NUM_OS_RANDOM_BYTES] = {}; /* Tracks which bytes have been overwritten at least once */
652    int num_overwritten;
653    int tries = 0;
654    /* Loop until all bytes have been overwritten at least once, or max number tries reached */
655    do {
656        memset(data, 0, NUM_OS_RANDOM_BYTES);
657        GetOSRand(data);
658        for (int x=0; x < NUM_OS_RANDOM_BYTES; ++x) {
659            overwritten[x] |= (data[x] != 0);
660        }
661
662        num_overwritten = 0;
663        for (int x=0; x < NUM_OS_RANDOM_BYTES; ++x) {
664            if (overwritten[x]) {
665                num_overwritten += 1;
666            }
667        }
668
669        tries += 1;
670    } while (num_overwritten < NUM_OS_RANDOM_BYTES && tries < MAX_TRIES);
671    if (num_overwritten != NUM_OS_RANDOM_BYTES) return false; /* If this failed, bailed out after too many tries */
672
673    // Check that GetPerformanceCounter increases at least during a GetOSRand() call + 1ms sleep.
674    std::this_thread::sleep_for(std::chrono::milliseconds(1));
675    uint64_t stop = GetPerformanceCounter();
676    if (stop == start) return false;
677
678    // We called GetPerformanceCounter. Use it as entropy.
679    CSHA512 to_add;
680    to_add.Write((const unsigned char*)&start, sizeof(start));
681    to_add.Write((const unsigned char*)&stop, sizeof(stop));
682    GetRNGState().MixExtract(nullptr, 0, std::move(to_add), false, /*always_use_real_rng=*/true);
683
684    return true;
685}
686
687static constexpr std::array<std::byte, ChaCha20::KEYLEN> ZERO_KEY{};
688
689FastRandomContext::FastRandomContext(bool fDeterministic) noexcept : requires_seed(!fDeterministic), rng(ZERO_KEY)
690{
691    // Note that despite always initializing with ZERO_KEY, requires_seed is set to true if not
692    // fDeterministic. That means the rng will be reinitialized with a secure random key upon first
693    // use.
694}
695
696void RandomInit()
697{
698    // Invoke RNG code to trigger initialization (if not already performed)
699    ProcRand(nullptr, 0, RNGLevel::FAST, /*always_use_real_rng=*/true);
700
701    ReportHardwareRand();
702}
703
704double MakeExponentiallyDistributed(uint64_t uniform) noexcept
705{
706    // To convert uniform into an exponentially-distributed double, we use two steps:
707    // - Convert uniform into a uniformly-distributed double in range [0, 1), use the expression
708    //   ((uniform >> 11) * 0x1.0p-53), as described in https://prng.di.unimi.it/ under
709    //   "Generating uniform doubles in the unit interval". Call this value x.
710    // - Given an x in uniformly distributed in [0, 1), we find an exponentially distributed value
711    //   by applying the quantile function to it. For the exponential distribution with mean 1 this
712    //   is F(x) = -log(1 - x).
713    //
714    // Combining the two, and using log1p(x) = log(1 + x), we obtain the following:
715    return -std::log1p((uniform >> 11) * -0x1.0p-53);
716}
717