|
|
|
|
@ -36,6 +36,7 @@ https://link.springer.com/content/pdf/10.1007%2F978-3-540-72354-7_3.pdf
|
|
|
|
|
|
|
|
|
|
#include "random_delays.h"
|
|
|
|
|
|
|
|
|
|
#include <stdatomic.h>
|
|
|
|
|
#include <stdbool.h>
|
|
|
|
|
|
|
|
|
|
#include "chacha_drbg.h"
|
|
|
|
|
@ -46,91 +47,115 @@ https://link.springer.com/content/pdf/10.1007%2F978-3-540-72354-7_3.pdf
|
|
|
|
|
// from util.s
|
|
|
|
|
extern void shutdown(void);
|
|
|
|
|
|
|
|
|
|
#define DRBG_RESEED_INTERVAL_CALLS 1000
|
|
|
|
|
#define DRBG_TRNG_ENTROPY_LENGTH 50
|
|
|
|
|
_Static_assert(CHACHA_DRBG_OPTIMAL_RESEED_LENGTH(1) == DRBG_TRNG_ENTROPY_LENGTH,
|
|
|
|
|
"");
|
|
|
|
|
#define BUFFER_LENGTH 64
|
|
|
|
|
#define RESEED_INTERVAL 65536
|
|
|
|
|
|
|
|
|
|
static CHACHA_DRBG_CTX drbg_ctx;
|
|
|
|
|
static uint8_t buffer[BUFFER_LENGTH];
|
|
|
|
|
static size_t buffer_index;
|
|
|
|
|
static secbool drbg_initialized = secfalse;
|
|
|
|
|
static uint8_t session_delay;
|
|
|
|
|
static bool refresh_session_delay;
|
|
|
|
|
static secbool rdi_disabled = sectrue;
|
|
|
|
|
|
|
|
|
|
static void rdi_reseed(void) {
|
|
|
|
|
uint8_t entropy[CHACHA_DRBG_SEED_LENGTH];
|
|
|
|
|
random_buffer(entropy, CHACHA_DRBG_SEED_LENGTH);
|
|
|
|
|
chacha_drbg_reseed(&drbg_ctx, entropy, sizeof(entropy), NULL, 0);
|
|
|
|
|
static void drbg_init() {
|
|
|
|
|
uint8_t entropy[DRBG_TRNG_ENTROPY_LENGTH] = {0};
|
|
|
|
|
random_buffer(entropy, sizeof(entropy));
|
|
|
|
|
chacha_drbg_init(&drbg_ctx, entropy, sizeof(entropy), NULL, 0);
|
|
|
|
|
memzero(entropy, sizeof(entropy));
|
|
|
|
|
|
|
|
|
|
drbg_initialized = sectrue;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void buffer_refill(void) {
|
|
|
|
|
chacha_drbg_generate(&drbg_ctx, buffer, BUFFER_LENGTH);
|
|
|
|
|
static void drbg_reseed() {
|
|
|
|
|
ensure(drbg_initialized, NULL);
|
|
|
|
|
|
|
|
|
|
uint8_t entropy[DRBG_TRNG_ENTROPY_LENGTH] = {0};
|
|
|
|
|
random_buffer(entropy, sizeof(entropy));
|
|
|
|
|
chacha_drbg_reseed(&drbg_ctx, entropy, sizeof(entropy), NULL, 0);
|
|
|
|
|
memzero(entropy, sizeof(entropy));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static uint32_t random8(void) {
|
|
|
|
|
buffer_index += 1;
|
|
|
|
|
if (buffer_index >= BUFFER_LENGTH) {
|
|
|
|
|
buffer_refill();
|
|
|
|
|
if (RESEED_INTERVAL != 0 && drbg_ctx.reseed_counter > RESEED_INTERVAL)
|
|
|
|
|
rdi_reseed();
|
|
|
|
|
buffer_index = 0;
|
|
|
|
|
static void drbg_generate(uint8_t *buffer, size_t length) {
|
|
|
|
|
ensure(drbg_initialized, NULL);
|
|
|
|
|
|
|
|
|
|
if (drbg_ctx.reseed_counter > DRBG_RESEED_INTERVAL_CALLS) {
|
|
|
|
|
drbg_reseed();
|
|
|
|
|
}
|
|
|
|
|
return buffer[buffer_index];
|
|
|
|
|
chacha_drbg_generate(&drbg_ctx, buffer, length);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void rdi_refresh_session_delay(void) {
|
|
|
|
|
if (rdi_disabled == secfalse) // if rdi enabled
|
|
|
|
|
refresh_session_delay = true;
|
|
|
|
|
}
|
|
|
|
|
// WARNING: Returns a constant if the function's critical section is locked
|
|
|
|
|
static uint32_t drbg_random8(void) {
|
|
|
|
|
// Since the function is called both from an interrupt (rdi_handler,
|
|
|
|
|
// wait_random) and the main thread (wait_random), we use a lock to
|
|
|
|
|
// synchronise access to global variables
|
|
|
|
|
static volatile atomic_flag locked = ATOMIC_FLAG_INIT;
|
|
|
|
|
|
|
|
|
|
if (atomic_flag_test_and_set(&locked))
|
|
|
|
|
// locked_old = locked; locked = true; locked_old
|
|
|
|
|
{
|
|
|
|
|
// If the critical section is locked we return a non-random value, which
|
|
|
|
|
// should be ok for our purposes
|
|
|
|
|
return 128;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void rdi_handler(uint32_t uw_tick) {
|
|
|
|
|
if (rdi_disabled == secfalse) { // if rdi enabled
|
|
|
|
|
if (refresh_session_delay) {
|
|
|
|
|
session_delay = random8();
|
|
|
|
|
refresh_session_delay = false;
|
|
|
|
|
}
|
|
|
|
|
static size_t buffer_index = 0;
|
|
|
|
|
static uint8_t buffer[BUFFER_LENGTH] = {0};
|
|
|
|
|
|
|
|
|
|
uint32_t delay = random8() + session_delay;
|
|
|
|
|
|
|
|
|
|
// wait (30 + delay) ticks
|
|
|
|
|
asm volatile(
|
|
|
|
|
"ldr r0, %0;" // r0 = delay
|
|
|
|
|
"loop:"
|
|
|
|
|
"subs r0, $3;" // r0 -= 3
|
|
|
|
|
"bhs loop;" // if (r0 >= 3): goto loop
|
|
|
|
|
// loop (delay // 3) times
|
|
|
|
|
// every loop takes 3 ticks
|
|
|
|
|
// r0 == (delay % 3) - 3
|
|
|
|
|
"add r0, $3;" // r0 += 3
|
|
|
|
|
// r0 == delay % 3
|
|
|
|
|
"and r0, r0, $3;" // r0 %= 4, make sure that 0 <= r0 < 4
|
|
|
|
|
"ldr r1, =table;" // r1 = &table
|
|
|
|
|
"tbb [r1, r0];" // jump 2*r1[r0] bytes forward, that is goto wait_r0
|
|
|
|
|
"base:"
|
|
|
|
|
"table:" // table of branch lengths
|
|
|
|
|
".byte (wait_0 - base)/2;"
|
|
|
|
|
".byte (wait_1 - base)/2;"
|
|
|
|
|
".byte (wait_2 - base)/2;"
|
|
|
|
|
".byte (wait_2 - base)/2;" // next instruction must be 2-byte aligned
|
|
|
|
|
"wait_2:"
|
|
|
|
|
"add r0, $1;" // wait one tick
|
|
|
|
|
"wait_1:"
|
|
|
|
|
"add r0, $1;" // wait one tick
|
|
|
|
|
"wait_0:"
|
|
|
|
|
:
|
|
|
|
|
: "m"(delay)
|
|
|
|
|
: "r0", "r1");
|
|
|
|
|
} else { // if rdi disabled or rdi_disabled corrupted
|
|
|
|
|
ensure(rdi_disabled, "Fault detected");
|
|
|
|
|
if (buffer_index == 0) {
|
|
|
|
|
drbg_generate(buffer, sizeof(buffer));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// To be extra sure there is no buffer overflow, we use a local copy of
|
|
|
|
|
// buffer_index
|
|
|
|
|
size_t buffer_index_local = buffer_index % sizeof(buffer);
|
|
|
|
|
uint8_t value = buffer[buffer_index_local];
|
|
|
|
|
memzero(&buffer[buffer_index_local], 1);
|
|
|
|
|
buffer_index = (buffer_index_local + 1) % sizeof(buffer);
|
|
|
|
|
|
|
|
|
|
atomic_flag_clear(&locked); // locked = false
|
|
|
|
|
return value;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void wait(uint32_t delay) {
|
|
|
|
|
// wait (30 + delay) ticks
|
|
|
|
|
asm volatile(
|
|
|
|
|
"ldr r0, %0;" // r0 = delay
|
|
|
|
|
"loop:"
|
|
|
|
|
"subs r0, $3;" // r0 -= 3
|
|
|
|
|
"bhs loop;" // if (r0 >= 3): goto loop
|
|
|
|
|
// loop (delay // 3) times
|
|
|
|
|
// every loop takes 3 ticks
|
|
|
|
|
// r0 == (delay % 3) - 3
|
|
|
|
|
"add r0, $3;" // r0 += 3
|
|
|
|
|
// r0 == delay % 3
|
|
|
|
|
"and r0, r0, $3;" // r0 %= 4, make sure that 0 <= r0 < 4
|
|
|
|
|
"ldr r1, =table;" // r1 = &table
|
|
|
|
|
"tbb [r1, r0];" // jump 2*r1[r0] bytes forward, that is goto wait_r0
|
|
|
|
|
"base:"
|
|
|
|
|
"table:" // table of branch lengths
|
|
|
|
|
".byte (wait_0 - base)/2;"
|
|
|
|
|
".byte (wait_1 - base)/2;"
|
|
|
|
|
".byte (wait_2 - base)/2;"
|
|
|
|
|
".byte (wait_2 - base)/2;" // next instruction must be 2-byte aligned
|
|
|
|
|
"wait_2:"
|
|
|
|
|
"add r0, $1;" // wait one tick
|
|
|
|
|
"wait_1:"
|
|
|
|
|
"add r0, $1;" // wait one tick
|
|
|
|
|
"wait_0:"
|
|
|
|
|
:
|
|
|
|
|
: "m"(delay)
|
|
|
|
|
: "r0", "r1");
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void random_delays_init() { drbg_init(); }
|
|
|
|
|
|
|
|
|
|
void rdi_start(void) {
|
|
|
|
|
ensure(drbg_initialized, NULL);
|
|
|
|
|
|
|
|
|
|
if (rdi_disabled == sectrue) { // if rdi disabled
|
|
|
|
|
uint8_t entropy[CHACHA_DRBG_SEED_LENGTH];
|
|
|
|
|
random_buffer(entropy, CHACHA_DRBG_SEED_LENGTH);
|
|
|
|
|
chacha_drbg_init(&drbg_ctx, entropy, sizeof(entropy), NULL, 0);
|
|
|
|
|
buffer_refill();
|
|
|
|
|
buffer_index = 0;
|
|
|
|
|
refresh_session_delay = true;
|
|
|
|
|
rdi_disabled = secfalse;
|
|
|
|
|
}
|
|
|
|
|
@ -140,7 +165,25 @@ void rdi_stop(void) {
|
|
|
|
|
if (rdi_disabled == secfalse) { // if rdi enabled
|
|
|
|
|
rdi_disabled = sectrue;
|
|
|
|
|
session_delay = 0;
|
|
|
|
|
memzero(&drbg_ctx, sizeof(drbg_ctx));
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void rdi_refresh_session_delay(void) {
|
|
|
|
|
if (rdi_disabled == secfalse) // if rdi enabled
|
|
|
|
|
refresh_session_delay = true;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void rdi_handler(uint32_t uw_tick) {
|
|
|
|
|
if (rdi_disabled == secfalse) { // if rdi enabled
|
|
|
|
|
if (refresh_session_delay) {
|
|
|
|
|
session_delay = drbg_random8();
|
|
|
|
|
refresh_session_delay = false;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
wait(drbg_random8() + session_delay);
|
|
|
|
|
|
|
|
|
|
} else { // if rdi disabled or rdi_disabled corrupted
|
|
|
|
|
ensure(rdi_disabled, "Fault detected");
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
@ -149,7 +192,7 @@ void rdi_stop(void) {
|
|
|
|
|
* against fault injection.
|
|
|
|
|
*/
|
|
|
|
|
void wait_random(void) {
|
|
|
|
|
int wait = drbg_random32() & 0xff;
|
|
|
|
|
int wait = drbg_random8();
|
|
|
|
|
volatile int i = 0;
|
|
|
|
|
volatile int j = wait;
|
|
|
|
|
while (i < wait) {
|
|
|
|
|
|
Ondřej Vejpustek
3 years ago