Merge GH #520 RNG changes

Adds Stateful_RNG base class which handles reseeding after some
amount of output (configurable at instantiation time, defaults to
the build.h value) as well as detecting forks (just using pid
comparisons, so still vulnerable to pid wraparound). Implemented
by HMAC_RNG and HMAC_DRBG. I did not update X9.31 since its
underlying RNG should already be fork safe and handle reseeding
at the appropriate time, since a new block is taken from the
underlying RNG (for the datetime vector) for each block of
output.

Adds RNG::randomize_with_input which for most PRNGs is just a
call to add_entropy followed by randomize. However for HMAC_DRBG
it is used for additional input. Adds tests for HMAC_DRBG with AD
from the CAVS file.

RNG::add_entropy is implemented by System_RNG now, as both
CryptGenRandom and /dev/urandom support receiving application
provided data.

The AutoSeeded_RNG underlying type is currently selectable in
build.h and defaults to HMAC_DRBG(SHA-256). AutoSeeded_RNG
provides additional input with each output request, consisting of
the current pid, a counter, and timestamp (unless the application
explicitly calls randomize_with_input, in which case we just take
what they provided). This is the same hedge used in HMAC_RNGs
output PRF.

AutoSeeded_RNG is part of the base library now and cannot be
compiled out.

Removes Entropy_Accumulator type (which just served to bridge
between the RNG and the entropy source), instead the
Entropy_Source is passed a reference to the RNG being reseeded,
and it can call add_entropy on whatever it can come up with.

1 files changed, 7 insertions, 2 deletions

diff --git a/src/lib/pubkey/rfc6979/rfc6979.cpp b/src/lib/pubkey/rfc6979/rfc6979.cpp
index 0b26aadb5..1173eefee 100644
--- a/src/lib/pubkey/rfc6979/rfc6979.cpp
+++ b/src/lib/pubkey/rfc6979/rfc6979.cpp
@@ -17,18 +17,23 @@ RFC6979_Nonce_Generator::RFC6979_Nonce_Generator(const std::string& hash,
    m_order(order),
    m_qlen(m_order.bits()),
    m_rlen(m_qlen / 8 + (m_qlen % 8 ? 1 : 0)),
-   m_hmac_drbg(new HMAC_DRBG(MessageAuthenticationCode::create("HMAC(" + hash + ")").release())),
+   m_hmac_drbg(new HMAC_DRBG(hash, 0)),
    m_rng_in(m_rlen * 2),
    m_rng_out(m_rlen)
    {
    BigInt::encode_1363(m_rng_in.data(), m_rlen, x);
    }
 
+RFC6979_Nonce_Generator::~RFC6979_Nonce_Generator()
+   {
+   // for ~unique_ptr
+   }
+
 const BigInt& RFC6979_Nonce_Generator::nonce_for(const BigInt& m)
    {
    BigInt::encode_1363(&m_rng_in[m_rlen], m_rlen, m);
    m_hmac_drbg->clear();
-   m_hmac_drbg->add_entropy(m_rng_in.data(), m_rng_in.size());
+   m_hmac_drbg->initialize_with(m_rng_in.data(), m_rng_in.size());
 
    do
       {