xref: /openbsd-src/lib/libc/net/res_random.c (revision db0ae91f40b14ee4e3b047a0656b6488a6721bf0)
1 /* $OpenBSD: res_random.c,v 1.3 1997/04/19 10:07:01 provos Exp $ */
2 
3 /*
4  * Copyright 1997 Niels Provos <provos@physnet.uni-hamburg.de>
5  * All rights reserved.
6  *
7  * Theo de Raadt <deraadt@openbsd.org> came up with the idea of using
8  * such a mathematical system to generate more random (yet non-repeating)
9  * ids to solve the resolver/named problem.  But Niels designed the
10  * actual system based on the constraints.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. All advertising materials mentioning features or use of this software
21  *    must display the following acknowledgement:
22  *      This product includes software developed by Niels Provos.
23  * 4. The name of the author may not be used to endorse or promote products
24  *    derived from this software without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
27  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
28  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
29  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
30  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
31  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
32  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
33  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
34  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36  */
37 
38 /*
39  * seed = random 15bit
40  * n = prime, g0 = generator to n,
41  * j = random so that gcd(j,n-1) == 1
42  * g = g0^j mod n will be a generator again.
43  *
44  * X[0] = random seed.
45  * X[n] = a*X[n-1]+b mod m is a Linear Congruential Generator
46  * with a = 7^(even random) mod m,
47  *      b = random with gcd(b,m) == 1
48  *      m = 31104 and a maximal period of m-1.
49  *
50  * The transaction id is determined by:
51  * id[n] = seed xor (g^X[n] mod n)
52  *
53  * Effectivly the id is restricted to the lower 15 bits, thus
54  * yielding two different cycles by toggling the msb on and off.
55  * This avoids reuse issues caused by reseeding.
56  *
57  * The 16 bit space is very small and brute force attempts are
58  * entirly feasible, we skip a random number of transaction ids
59  * so that an attacker will not get sequential ids.
60  */
61 
62 #include <sys/types.h>
63 #include <netinet/in.h>
64 #include <sys/time.h>
65 #include <resolv.h>
66 
67 #include <unistd.h>
68 #include <stdlib.h>
69 #include <string.h>
70 
71 #define RU_OUT  180             /* Time after wich will be reseeded */
72 #define RU_MAX	30000		/* Uniq cycle, avoid blackjack prediction */
73 #define RU_GEN	2		/* Starting generator */
74 #define RU_N	32749		/* RU_N-1 = 2*2*3*2729 */
75 #define RU_AGEN	7               /* determine ru_a as RU_AGEN^(2*rand) */
76 #define RU_M	31104           /* RU_M = 2^7*3^5 - don't change */
77 
78 #define PFAC_N 3
79 const static u_int16_t pfacts[PFAC_N] = {
80 	2,
81 	3,
82 	2729
83 };
84 
85 static u_int16_t ru_x;
86 static u_int16_t ru_seed;
87 static u_int16_t ru_a, ru_b;
88 static u_int16_t ru_g;
89 static u_int16_t ru_counter = 0;
90 static u_int16_t ru_msb = 0;
91 static long ru_reseed;
92 static u_int32_t tmp;                /* Storage for unused random */
93 static struct timeval tv;
94 
95 static u_int32_t pmod __P((u_int32_t, u_int32_t, u_int32_t));
96 static void res_initid __P((void));
97 
98 /*
99  * Do a fast modular exponation, returned value will be in the range
100  * of 0 - (mod-1)
101  */
102 
103 static u_int32_t
104 pmod(gen, exp, mod)
105 	u_int32_t gen, exp, mod;
106 {
107 	u_int32_t s, t, u;
108 
109 	s = 1;
110 	t = gen;
111 	u = exp;
112 
113 	while (u) {
114 		if (u & 1)
115 			s = (s*t) % mod;
116 		u >>= 1;
117 		t = (t*t) % mod;
118 	}
119 	return (s);
120 }
121 
122 /*
123  * Initalizes the seed and chooses a suitable generator. Also toggles
124  * the msb flag. The msb flag is used to generate two distinct
125  * cycles of random numbers and thus avoiding reuse of ids.
126  *
127  * This function is called from res_randomid() when needed, an
128  * application does not have to worry about it.
129  */
130 static void
131 res_initid()
132 {
133 	u_int16_t j, i;
134 	int noprime = 1;
135 
136 	tmp = arc4random();
137 	ru_x = (tmp & 0xFFFF) % RU_M;
138 
139 	/* 15 bits of random seed */
140 	ru_seed = (tmp >> 16) & 0x7FFF;
141 
142 	tmp = arc4random();
143 
144 	/* Determine the LCG we use */
145 	ru_b = (tmp & 0xfffe) | 1;
146 	ru_a = pmod(RU_AGEN, (tmp >> 16) & 0xfffe, RU_M);
147 	while (ru_b % 3 == 0)
148 	  ru_b += 2;
149 
150 	tmp = arc4random();
151 	j = tmp % RU_N;
152 	tmp = tmp >> 16;
153 
154 	/*
155 	 * Do a fast gcd(j,RU_N-1), so we can find a j with
156 	 * gcd(j, RU_N-1) == 1, giving a new generator for
157 	 * RU_GEN^j mod RU_N
158 	 */
159 
160 	while (noprime) {
161 		for (i=0; i<PFAC_N; i++)
162 			if (j%pfacts[i] == 0)
163 				break;
164 
165 		if (i>=PFAC_N)
166 			noprime = 0;
167 		else
168 			j = (j+1) % RU_N;
169 	}
170 
171 	ru_g = pmod(RU_GEN,j,RU_N);
172 	ru_counter = 0;
173 
174 	gettimeofday(&tv, NULL);
175 	ru_reseed = tv.tv_sec + RU_OUT;
176 	ru_msb = ru_msb == 0x8000 ? 0 : 0x8000;
177 }
178 
179 u_int
180 res_randomid()
181 {
182         int i, n;
183 
184 	gettimeofday(&tv, NULL);
185 	if (ru_counter >= RU_MAX || tv.tv_sec > ru_reseed)
186 		res_initid();
187 
188 	if (!tmp)
189 	        tmp = arc4random();
190 
191 	/* Skip a random number of ids */
192 	n = tmp & 0x2f; tmp = tmp >> 6;
193 	if (ru_counter + n >= RU_MAX)
194                 res_initid();
195 
196 	for (i=0; i<=n; i++)
197 	        /* Linear Congruential Generator */
198 	        ru_x = (ru_a*ru_x + ru_b) % RU_M;
199 
200 	ru_counter += i;
201 
202 	return (ru_seed ^ pmod(ru_g,ru_x,RU_N)) | ru_msb;
203 }
204 
205 #if 0
206 void
207 main(int argc, char **argv)
208 {
209 	int i, n;
210 	u_int16_t wert;
211 
212 	res_initid();
213 
214 	printf("Generator: %d\n", ru_g);
215 	printf("Seed: %d\n", ru_seed);
216 	printf("Reseed at %ld\n", ru_reseed);
217 	printf("Ru_X: %d\n", ru_x);
218 	printf("Ru_A: %d\n", ru_a);
219 	printf("Ru_B: %d\n", ru_b);
220 
221 	n = atoi(argv[1]);
222 	for (i=0;i<n;i++) {
223 		wert = res_randomid();
224 		printf("%06d\n", wert);
225 	}
226 }
227 #endif
228 
229