randen_traits.h (3779B)
1 // Copyright 2017 The Abseil Authors. 2 // 3 // Licensed under the Apache License, Version 2.0 (the "License"); 4 // you may not use this file except in compliance with the License. 5 // You may obtain a copy of the License at 6 // 7 // https://www.apache.org/licenses/LICENSE-2.0 8 // 9 // Unless required by applicable law or agreed to in writing, software 10 // distributed under the License is distributed on an "AS IS" BASIS, 11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 // See the License for the specific language governing permissions and 13 // limitations under the License. 14 15 #ifndef ABSL_RANDOM_INTERNAL_RANDEN_TRAITS_H_ 16 #define ABSL_RANDOM_INTERNAL_RANDEN_TRAITS_H_ 17 18 // HERMETIC NOTE: The randen_hwaes target must not introduce duplicate 19 // symbols from arbitrary system and other headers, since it may be built 20 // with different flags from other targets, using different levels of 21 // optimization, potentially introducing ODR violations. 22 23 #include <cstddef> 24 25 #include "absl/base/config.h" 26 27 namespace absl { 28 ABSL_NAMESPACE_BEGIN 29 namespace random_internal { 30 31 // RANDen = RANDom generator or beetroots in Swiss High German. 32 // 'Strong' (well-distributed, unpredictable, backtracking-resistant) random 33 // generator, faster in some benchmarks than std::mt19937_64 and pcg64_c32. 34 // 35 // High-level summary: 36 // 1) Reverie (see "A Robust and Sponge-Like PRNG with Improved Efficiency") is 37 // a sponge-like random generator that requires a cryptographic permutation. 38 // It improves upon "Provably Robust Sponge-Based PRNGs and KDFs" by 39 // achieving backtracking resistance with only one Permute() per buffer. 40 // 41 // 2) "Simpira v2: A Family of Efficient Permutations Using the AES Round 42 // Function" constructs up to 1024-bit permutations using an improved 43 // Generalized Feistel network with 2-round AES-128 functions. This Feistel 44 // block shuffle achieves diffusion faster and is less vulnerable to 45 // sliced-biclique attacks than the Type-2 cyclic shuffle. 46 // 47 // 3) "Improving the Generalized Feistel" and "New criterion for diffusion 48 // property" extends the same kind of improved Feistel block shuffle to 16 49 // branches, which enables a 2048-bit permutation. 50 // 51 // Combine these three ideas and also change Simpira's subround keys from 52 // structured/low-entropy counters to digits of Pi (or other random source). 53 54 // RandenTraits contains the basic algorithm traits, such as the size of the 55 // state, seed, sponge, etc. 56 struct RandenTraits { 57 // Size of the entire sponge / state for the randen PRNG. 58 static constexpr size_t kStateBytes = 256; // 2048-bit 59 60 // Size of the 'inner' (inaccessible) part of the sponge. Larger values would 61 // require more frequent calls to RandenGenerate. 62 static constexpr size_t kCapacityBytes = 16; // 128-bit 63 64 // Size of the default seed consumed by the sponge. 65 static constexpr size_t kSeedBytes = kStateBytes - kCapacityBytes; 66 67 // Assuming 128-bit blocks, the number of blocks in the state. 68 // Largest size for which security proofs are known. 69 static constexpr size_t kFeistelBlocks = 16; 70 71 // Ensures SPRP security and two full subblock diffusions. 72 // Must be > 4 * log2(kFeistelBlocks). 73 static constexpr size_t kFeistelRounds = 16 + 1; 74 75 // Size of the key. A 128-bit key block is used for every-other 76 // feistel block (Type-2 generalized Feistel network) in each round. 77 static constexpr size_t kKeyBytes = 16 * kFeistelRounds * kFeistelBlocks / 2; 78 }; 79 80 // Randen key arrays. In randen_round_keys.cc 81 extern const unsigned char kRandenRoundKeys[RandenTraits::kKeyBytes]; 82 extern const unsigned char kRandenRoundKeysBE[RandenTraits::kKeyBytes]; 83 84 } // namespace random_internal 85 ABSL_NAMESPACE_END 86 } // namespace absl 87 88 #endif // ABSL_RANDOM_INTERNAL_RANDEN_TRAITS_H_