478 lines
18 KiB
Rust
478 lines
18 KiB
Rust
// Copyright 2018 Developers of the Rand project.
|
|
// Copyright 2017-2018 The Rust Project Developers.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 <LICENSE-APACHE or
|
|
// https://www.apache.org/licenses/LICENSE-2.0> or the MIT license
|
|
// <LICENSE-MIT or https://opensource.org/licenses/MIT>, at your
|
|
// option. This file may not be copied, modified, or distributed
|
|
// except according to those terms.
|
|
|
|
//! Random number generation traits
|
|
//!
|
|
//! This crate is mainly of interest to crates publishing implementations of
|
|
//! [`RngCore`]. Other users are encouraged to use the [`rand`] crate instead
|
|
//! which re-exports the main traits and error types.
|
|
//!
|
|
//! [`RngCore`] is the core trait implemented by algorithmic pseudo-random number
|
|
//! generators and external random-number sources.
|
|
//!
|
|
//! [`SeedableRng`] is an extension trait for construction from fixed seeds and
|
|
//! other random number generators.
|
|
//!
|
|
//! [`Error`] is provided for error-handling. It is safe to use in `no_std`
|
|
//! environments.
|
|
//!
|
|
//! The [`impls`] and [`le`] sub-modules include a few small functions to assist
|
|
//! implementation of [`RngCore`].
|
|
//!
|
|
//! [`rand`]: https://docs.rs/rand
|
|
|
|
#![doc(html_logo_url = "https://www.rust-lang.org/logos/rust-logo-128x128-blk.png",
|
|
html_favicon_url = "https://www.rust-lang.org/favicon.ico",
|
|
html_root_url = "https://rust-random.github.io/rand/")]
|
|
|
|
#![deny(missing_docs)]
|
|
#![deny(missing_debug_implementations)]
|
|
#![doc(test(attr(allow(unused_variables), deny(warnings))))]
|
|
|
|
#![cfg_attr(not(feature="std"), no_std)]
|
|
#![cfg_attr(all(feature="alloc", not(feature="std")), feature(alloc))]
|
|
|
|
#[cfg(feature="std")] extern crate core;
|
|
#[cfg(all(feature = "alloc", not(feature="std")))] extern crate alloc;
|
|
#[cfg(feature="serde1")] extern crate serde;
|
|
#[cfg(feature="serde1")] #[macro_use] extern crate serde_derive;
|
|
|
|
|
|
use core::default::Default;
|
|
use core::convert::AsMut;
|
|
use core::ptr::copy_nonoverlapping;
|
|
|
|
#[cfg(all(feature="alloc", not(feature="std")))] use alloc::boxed::Box;
|
|
|
|
pub use error::{ErrorKind, Error};
|
|
|
|
|
|
mod error;
|
|
pub mod block;
|
|
pub mod impls;
|
|
pub mod le;
|
|
|
|
|
|
/// The core of a random number generator.
|
|
///
|
|
/// This trait encapsulates the low-level functionality common to all
|
|
/// generators, and is the "back end", to be implemented by generators.
|
|
/// End users should normally use the `Rng` trait from the [`rand`] crate,
|
|
/// which is automatically implemented for every type implementing `RngCore`.
|
|
///
|
|
/// Three different methods for generating random data are provided since the
|
|
/// optimal implementation of each is dependent on the type of generator. There
|
|
/// is no required relationship between the output of each; e.g. many
|
|
/// implementations of [`fill_bytes`] consume a whole number of `u32` or `u64`
|
|
/// values and drop any remaining unused bytes.
|
|
///
|
|
/// The [`try_fill_bytes`] method is a variant of [`fill_bytes`] allowing error
|
|
/// handling; it is not deemed sufficiently useful to add equivalents for
|
|
/// [`next_u32`] or [`next_u64`] since the latter methods are almost always used
|
|
/// with algorithmic generators (PRNGs), which are normally infallible.
|
|
///
|
|
/// Algorithmic generators implementing [`SeedableRng`] should normally have
|
|
/// *portable, reproducible* output, i.e. fix Endianness when converting values
|
|
/// to avoid platform differences, and avoid making any changes which affect
|
|
/// output (except by communicating that the release has breaking changes).
|
|
///
|
|
/// Typically implementators will implement only one of the methods available
|
|
/// in this trait directly, then use the helper functions from the
|
|
/// [`impls`] module to implement the other methods.
|
|
///
|
|
/// It is recommended that implementations also implement:
|
|
///
|
|
/// - `Debug` with a custom implementation which *does not* print any internal
|
|
/// state (at least, [`CryptoRng`]s should not risk leaking state through
|
|
/// `Debug`).
|
|
/// - `Serialize` and `Deserialize` (from Serde), preferably making Serde
|
|
/// support optional at the crate level in PRNG libs.
|
|
/// - `Clone`, if possible.
|
|
/// - *never* implement `Copy` (accidental copies may cause repeated values).
|
|
/// - *do not* implement `Default` for pseudorandom generators, but instead
|
|
/// implement [`SeedableRng`], to guide users towards proper seeding.
|
|
/// External / hardware RNGs can choose to implement `Default`.
|
|
/// - `Eq` and `PartialEq` could be implemented, but are probably not useful.
|
|
///
|
|
/// # Example
|
|
///
|
|
/// A simple example, obviously not generating very *random* output:
|
|
///
|
|
/// ```
|
|
/// #![allow(dead_code)]
|
|
/// use rand_core::{RngCore, Error, impls};
|
|
///
|
|
/// struct CountingRng(u64);
|
|
///
|
|
/// impl RngCore for CountingRng {
|
|
/// fn next_u32(&mut self) -> u32 {
|
|
/// self.next_u64() as u32
|
|
/// }
|
|
///
|
|
/// fn next_u64(&mut self) -> u64 {
|
|
/// self.0 += 1;
|
|
/// self.0
|
|
/// }
|
|
///
|
|
/// fn fill_bytes(&mut self, dest: &mut [u8]) {
|
|
/// impls::fill_bytes_via_next(self, dest)
|
|
/// }
|
|
///
|
|
/// fn try_fill_bytes(&mut self, dest: &mut [u8]) -> Result<(), Error> {
|
|
/// Ok(self.fill_bytes(dest))
|
|
/// }
|
|
/// }
|
|
/// ```
|
|
///
|
|
/// [`rand`]: https://docs.rs/rand
|
|
/// [`try_fill_bytes`]: RngCore::try_fill_bytes
|
|
/// [`fill_bytes`]: RngCore::fill_bytes
|
|
/// [`next_u32`]: RngCore::next_u32
|
|
/// [`next_u64`]: RngCore::next_u64
|
|
pub trait RngCore {
|
|
/// Return the next random `u32`.
|
|
///
|
|
/// RNGs must implement at least one method from this trait directly. In
|
|
/// the case this method is not implemented directly, it can be implemented
|
|
/// using `self.next_u64() as u32` or via
|
|
/// [`fill_bytes`](impls::next_u32_via_fill).
|
|
fn next_u32(&mut self) -> u32;
|
|
|
|
/// Return the next random `u64`.
|
|
///
|
|
/// RNGs must implement at least one method from this trait directly. In
|
|
/// the case this method is not implemented directly, it can be implemented
|
|
/// via [`next_u32`](impls::next_u64_via_u32) or via
|
|
/// [`fill_bytes`](impls::next_u64_via_fill).
|
|
fn next_u64(&mut self) -> u64;
|
|
|
|
/// Fill `dest` with random data.
|
|
///
|
|
/// RNGs must implement at least one method from this trait directly. In
|
|
/// the case this method is not implemented directly, it can be implemented
|
|
/// via [`next_u*`](impls::fill_bytes_via_next) or
|
|
/// via [`try_fill_bytes`](RngCore::try_fill_bytes); if this generator can
|
|
/// fail the implementation must choose how best to handle errors here
|
|
/// (e.g. panic with a descriptive message or log a warning and retry a few
|
|
/// times).
|
|
///
|
|
/// This method should guarantee that `dest` is entirely filled
|
|
/// with new data, and may panic if this is impossible
|
|
/// (e.g. reading past the end of a file that is being used as the
|
|
/// source of randomness).
|
|
fn fill_bytes(&mut self, dest: &mut [u8]);
|
|
|
|
/// Fill `dest` entirely with random data.
|
|
///
|
|
/// This is the only method which allows an RNG to report errors while
|
|
/// generating random data thus making this the primary method implemented
|
|
/// by external (true) RNGs (e.g. `OsRng`) which can fail. It may be used
|
|
/// directly to generate keys and to seed (infallible) PRNGs.
|
|
///
|
|
/// Other than error handling, this method is identical to [`fill_bytes`];
|
|
/// thus this may be implemented using `Ok(self.fill_bytes(dest))` or
|
|
/// `fill_bytes` may be implemented with
|
|
/// `self.try_fill_bytes(dest).unwrap()` or more specific error handling.
|
|
///
|
|
/// [`fill_bytes`]: RngCore::fill_bytes
|
|
fn try_fill_bytes(&mut self, dest: &mut [u8]) -> Result<(), Error>;
|
|
}
|
|
|
|
/// A marker trait used to indicate that an [`RngCore`] or [`BlockRngCore`]
|
|
/// implementation is supposed to be cryptographically secure.
|
|
///
|
|
/// *Cryptographically secure generators*, also known as *CSPRNGs*, should
|
|
/// satisfy an additional properties over other generators: given the first
|
|
/// *k* bits of an algorithm's output
|
|
/// sequence, it should not be possible using polynomial-time algorithms to
|
|
/// predict the next bit with probability significantly greater than 50%.
|
|
///
|
|
/// Some generators may satisfy an additional property, however this is not
|
|
/// required by this trait: if the CSPRNG's state is revealed, it should not be
|
|
/// computationally-feasible to reconstruct output prior to this. Some other
|
|
/// generators allow backwards-computation and are consided *reversible*.
|
|
///
|
|
/// Note that this trait is provided for guidance only and cannot guarantee
|
|
/// suitability for cryptographic applications. In general it should only be
|
|
/// implemented for well-reviewed code implementing well-regarded algorithms.
|
|
///
|
|
/// Note also that use of a `CryptoRng` does not protect against other
|
|
/// weaknesses such as seeding from a weak entropy source or leaking state.
|
|
///
|
|
/// [`BlockRngCore`]: block::BlockRngCore
|
|
pub trait CryptoRng {}
|
|
|
|
/// A random number generator that can be explicitly seeded.
|
|
///
|
|
/// This trait encapsulates the low-level functionality common to all
|
|
/// pseudo-random number generators (PRNGs, or algorithmic generators).
|
|
///
|
|
/// The `FromEntropy` trait from the [`rand`] crate is automatically
|
|
/// implemented for every type implementing `SeedableRng`, providing
|
|
/// a convenient `from_entropy()` constructor.
|
|
///
|
|
/// [`rand`]: https://docs.rs/rand
|
|
pub trait SeedableRng: Sized {
|
|
/// Seed type, which is restricted to types mutably-dereferencable as `u8`
|
|
/// arrays (we recommend `[u8; N]` for some `N`).
|
|
///
|
|
/// It is recommended to seed PRNGs with a seed of at least circa 100 bits,
|
|
/// which means an array of `[u8; 12]` or greater to avoid picking RNGs with
|
|
/// partially overlapping periods.
|
|
///
|
|
/// For cryptographic RNG's a seed of 256 bits is recommended, `[u8; 32]`.
|
|
///
|
|
///
|
|
/// # Implementing `SeedableRng` for RNGs with large seeds
|
|
///
|
|
/// Note that the required traits `core::default::Default` and
|
|
/// `core::convert::AsMut<u8>` are not implemented for large arrays
|
|
/// `[u8; N]` with `N` > 32. To be able to implement the traits required by
|
|
/// `SeedableRng` for RNGs with such large seeds, the newtype pattern can be
|
|
/// used:
|
|
///
|
|
/// ```
|
|
/// use rand_core::SeedableRng;
|
|
///
|
|
/// const N: usize = 64;
|
|
/// pub struct MyRngSeed(pub [u8; N]);
|
|
/// pub struct MyRng(MyRngSeed);
|
|
///
|
|
/// impl Default for MyRngSeed {
|
|
/// fn default() -> MyRngSeed {
|
|
/// MyRngSeed([0; N])
|
|
/// }
|
|
/// }
|
|
///
|
|
/// impl AsMut<[u8]> for MyRngSeed {
|
|
/// fn as_mut(&mut self) -> &mut [u8] {
|
|
/// &mut self.0
|
|
/// }
|
|
/// }
|
|
///
|
|
/// impl SeedableRng for MyRng {
|
|
/// type Seed = MyRngSeed;
|
|
///
|
|
/// fn from_seed(seed: MyRngSeed) -> MyRng {
|
|
/// MyRng(seed)
|
|
/// }
|
|
/// }
|
|
/// ```
|
|
type Seed: Sized + Default + AsMut<[u8]>;
|
|
|
|
/// Create a new PRNG using the given seed.
|
|
///
|
|
/// PRNG implementations are allowed to assume that bits in the seed are
|
|
/// well distributed. That means usually that the number of one and zero
|
|
/// bits are about equal, and values like 0, 1 and (size - 1) are unlikely.
|
|
///
|
|
/// PRNG implementations are recommended to be reproducible. A PRNG seeded
|
|
/// using this function with a fixed seed should produce the same sequence
|
|
/// of output in the future and on different architectures (with for example
|
|
/// different endianness).
|
|
///
|
|
/// It is however not required that this function yield the same state as a
|
|
/// reference implementation of the PRNG given equivalent seed; if necessary
|
|
/// another constructor replicating behaviour from a reference
|
|
/// implementation can be added.
|
|
///
|
|
/// PRNG implementations should make sure `from_seed` never panics. In the
|
|
/// case that some special values (like an all zero seed) are not viable
|
|
/// seeds it is preferable to map these to alternative constant value(s),
|
|
/// for example `0xBAD5EEDu32` or `0x0DDB1A5E5BAD5EEDu64` ("odd biases? bad
|
|
/// seed"). This is assuming only a small number of values must be rejected.
|
|
fn from_seed(seed: Self::Seed) -> Self;
|
|
|
|
/// Create a new PRNG using a `u64` seed.
|
|
///
|
|
/// This is a convenience-wrapper around `from_seed` to allow construction
|
|
/// of any `SeedableRng` from a simple `u64` value. It is designed such that
|
|
/// low Hamming Weight numbers like 0 and 1 can be used and should still
|
|
/// result in good, independent seeds to the PRNG which is returned.
|
|
///
|
|
/// This **is not suitable for cryptography**, as should be clear given that
|
|
/// the input size is only 64 bits.
|
|
///
|
|
/// Implementations for PRNGs *may* provide their own implementations of
|
|
/// this function, but the default implementation should be good enough for
|
|
/// all purposes. *Changing* the implementation of this function should be
|
|
/// considered a value-breaking change.
|
|
fn seed_from_u64(mut state: u64) -> Self {
|
|
// We use PCG32 to generate a u32 sequence, and copy to the seed
|
|
const MUL: u64 = 6364136223846793005;
|
|
const INC: u64 = 11634580027462260723;
|
|
|
|
let mut seed = Self::Seed::default();
|
|
for chunk in seed.as_mut().chunks_mut(4) {
|
|
// We advance the state first (to get away from the input value,
|
|
// in case it has low Hamming Weight).
|
|
state = state.wrapping_mul(MUL).wrapping_add(INC);
|
|
|
|
// Use PCG output function with to_le to generate x:
|
|
let xorshifted = (((state >> 18) ^ state) >> 27) as u32;
|
|
let rot = (state >> 59) as u32;
|
|
let x = xorshifted.rotate_right(rot).to_le();
|
|
|
|
unsafe {
|
|
let p = &x as *const u32 as *const u8;
|
|
copy_nonoverlapping(p, chunk.as_mut_ptr(), chunk.len());
|
|
}
|
|
}
|
|
|
|
Self::from_seed(seed)
|
|
}
|
|
|
|
/// Create a new PRNG seeded from another `Rng`.
|
|
///
|
|
/// This is the recommended way to initialize PRNGs with fresh entropy. The
|
|
/// `FromEntropy` trait from the [`rand`] crate provides a convenient
|
|
/// `from_entropy` method based on `from_rng`.
|
|
///
|
|
/// Usage of this method is not recommended when reproducibility is required
|
|
/// since implementing PRNGs are not required to fix Endianness and are
|
|
/// allowed to modify implementations in new releases.
|
|
///
|
|
/// It is important to use a good source of randomness to initialize the
|
|
/// PRNG. Cryptographic PRNG may be rendered insecure when seeded from a
|
|
/// non-cryptographic PRNG or with insufficient entropy.
|
|
/// Many non-cryptographic PRNGs will show statistical bias in their first
|
|
/// results if their seed numbers are small or if there is a simple pattern
|
|
/// between them.
|
|
///
|
|
/// Prefer to seed from a strong external entropy source like `OsRng` from
|
|
/// the [`rand_os`] crate or from a cryptographic PRNG; if creating a new
|
|
/// generator for cryptographic uses you *must* seed from a strong source.
|
|
///
|
|
/// Seeding a small PRNG from another small PRNG is possible, but
|
|
/// something to be careful with. An extreme example of how this can go
|
|
/// wrong is seeding an Xorshift RNG from another Xorshift RNG, which
|
|
/// will effectively clone the generator. In general seeding from a
|
|
/// generator which is hard to predict is probably okay.
|
|
///
|
|
/// PRNG implementations are allowed to assume that a good RNG is provided
|
|
/// for seeding, and that it is cryptographically secure when appropriate.
|
|
///
|
|
/// [`rand`]: https://docs.rs/rand
|
|
/// [`rand_os`]: https://docs.rs/rand_os
|
|
fn from_rng<R: RngCore>(mut rng: R) -> Result<Self, Error> {
|
|
let mut seed = Self::Seed::default();
|
|
rng.try_fill_bytes(seed.as_mut())?;
|
|
Ok(Self::from_seed(seed))
|
|
}
|
|
}
|
|
|
|
// Implement `RngCore` for references to an `RngCore`.
|
|
// Force inlining all functions, so that it is up to the `RngCore`
|
|
// implementation and the optimizer to decide on inlining.
|
|
impl<'a, R: RngCore + ?Sized> RngCore for &'a mut R {
|
|
#[inline(always)]
|
|
fn next_u32(&mut self) -> u32 {
|
|
(**self).next_u32()
|
|
}
|
|
|
|
#[inline(always)]
|
|
fn next_u64(&mut self) -> u64 {
|
|
(**self).next_u64()
|
|
}
|
|
|
|
#[inline(always)]
|
|
fn fill_bytes(&mut self, dest: &mut [u8]) {
|
|
(**self).fill_bytes(dest)
|
|
}
|
|
|
|
#[inline(always)]
|
|
fn try_fill_bytes(&mut self, dest: &mut [u8]) -> Result<(), Error> {
|
|
(**self).try_fill_bytes(dest)
|
|
}
|
|
}
|
|
|
|
// Implement `RngCore` for boxed references to an `RngCore`.
|
|
// Force inlining all functions, so that it is up to the `RngCore`
|
|
// implementation and the optimizer to decide on inlining.
|
|
#[cfg(feature="alloc")]
|
|
impl<R: RngCore + ?Sized> RngCore for Box<R> {
|
|
#[inline(always)]
|
|
fn next_u32(&mut self) -> u32 {
|
|
(**self).next_u32()
|
|
}
|
|
|
|
#[inline(always)]
|
|
fn next_u64(&mut self) -> u64 {
|
|
(**self).next_u64()
|
|
}
|
|
|
|
#[inline(always)]
|
|
fn fill_bytes(&mut self, dest: &mut [u8]) {
|
|
(**self).fill_bytes(dest)
|
|
}
|
|
|
|
#[inline(always)]
|
|
fn try_fill_bytes(&mut self, dest: &mut [u8]) -> Result<(), Error> {
|
|
(**self).try_fill_bytes(dest)
|
|
}
|
|
}
|
|
|
|
#[cfg(feature="std")]
|
|
impl std::io::Read for RngCore {
|
|
fn read(&mut self, buf: &mut [u8]) -> Result<usize, std::io::Error> {
|
|
self.try_fill_bytes(buf)?;
|
|
Ok(buf.len())
|
|
}
|
|
}
|
|
|
|
// Implement `CryptoRng` for references to an `CryptoRng`.
|
|
impl<'a, R: CryptoRng + ?Sized> CryptoRng for &'a mut R {}
|
|
|
|
// Implement `CryptoRng` for boxed references to an `CryptoRng`.
|
|
#[cfg(feature="alloc")]
|
|
impl<R: CryptoRng + ?Sized> CryptoRng for Box<R> {}
|
|
|
|
#[cfg(test)]
|
|
mod test {
|
|
use super::*;
|
|
|
|
#[test]
|
|
fn test_seed_from_u64() {
|
|
struct SeedableNum(u64);
|
|
impl SeedableRng for SeedableNum {
|
|
type Seed = [u8; 8];
|
|
fn from_seed(seed: Self::Seed) -> Self {
|
|
let mut x = [0u64; 1];
|
|
le::read_u64_into(&seed, &mut x);
|
|
SeedableNum(x[0])
|
|
}
|
|
}
|
|
|
|
const N: usize = 8;
|
|
const SEEDS: [u64; N] = [0u64, 1, 2, 3, 4, 8, 16, -1i64 as u64];
|
|
let mut results = [0u64; N];
|
|
for (i, seed) in SEEDS.iter().enumerate() {
|
|
let SeedableNum(x) = SeedableNum::seed_from_u64(*seed);
|
|
results[i] = x;
|
|
}
|
|
|
|
for (i1, r1) in results.iter().enumerate() {
|
|
let weight = r1.count_ones();
|
|
// This is the binomial distribution B(64, 0.5), so chance of
|
|
// weight < 20 is binocdf(19, 64, 0.5) = 7.8e-4, and same for
|
|
// weight > 44.
|
|
assert!(weight >= 20 && weight <= 44);
|
|
|
|
for (i2, r2) in results.iter().enumerate() {
|
|
if i1 == i2 { continue; }
|
|
let diff_weight = (r1 ^ r2).count_ones();
|
|
assert!(diff_weight >= 20);
|
|
}
|
|
}
|
|
|
|
// value-breakage test:
|
|
assert_eq!(results[0], 5029875928683246316);
|
|
}
|
|
}
|