Externalize the state of a RFC 6979 nonce computation.

This lets you amortize quite a few memory allocations (RNG, various
BigInts, etc) over many nonce generations.

Change generate_rfc6979_nonce to just instantiate one of these states,
call the function once, and return. This doesn't have any additional
overhead versus the previous implementation of this function.

Fix HMAC_DRBG to correctly reset its state to its starting position
when you call clear() on it.

2 files changed, 8 insertions, 6 deletions

diff --git a/src/lib/rng/hmac_drbg/hmac_drbg.cpp b/src/lib/rng/hmac_drbg/hmac_drbg.cpp
index 064088c59..dc0d18afe 100644
--- a/src/lib/rng/hmac_drbg/hmac_drbg.cpp
+++ b/src/lib/rng/hmac_drbg/hmac_drbg.cpp
@@ -1,6 +1,6 @@
 /*
 * HMAC_DRBG
-* (C) 2014 Jack Lloyd
+* (C) 2014,2015 Jack Lloyd
 *
 * Botan is released under the Simplified BSD License (see license.txt)
 */
@@ -17,7 +17,7 @@ HMAC_DRBG::HMAC_DRBG(MessageAuthenticationCode* mac,
    m_V(m_mac->output_length(), 0x01),
    m_reseed_counter(0)
    {
-   m_mac->set_key(secure_vector<byte>(m_mac->output_length(), 0x00));
+   m_mac->set_key(std::vector<byte>(m_mac->output_length(), 0x00));
    }
 
 void HMAC_DRBG::randomize(byte out[], size_t length)
@@ -94,9 +94,11 @@ bool HMAC_DRBG::is_seeded() const
 
 void HMAC_DRBG::clear()
    {
-   zeroise(m_V);
+   m_reseed_counter = 0;
+   for(size_t i = 0; i != m_V.size(); ++i)
+      m_V[i] = 0x01;
 
-   m_mac->clear();
+   m_mac->set_key(std::vector<byte>(m_mac->output_length(), 0x00));
 
    if(m_prng)
       m_prng->clear();
diff --git a/src/lib/rng/hmac_drbg/hmac_drbg.h b/src/lib/rng/hmac_drbg/hmac_drbg.h
index b56e90fc4..979b754b2 100644
--- a/src/lib/rng/hmac_drbg/hmac_drbg.h
+++ b/src/lib/rng/hmac_drbg/hmac_drbg.h
@@ -1,6 +1,6 @@
 /*
 * HMAC_DRBG (SP800-90A)
-* (C) 2014 Jack Lloyd
+* (C) 2014,2015 Jack Lloyd
 *
 * Botan is released under the Simplified BSD License (see license.txt)
 */
@@ -33,7 +33,7 @@ class BOTAN_DLL HMAC_DRBG : public RandomNumberGenerator
       * @param underlying_rng RNG used generating inputs (eg HMAC_RNG)
       */
       HMAC_DRBG(MessageAuthenticationCode* mac,
-                RandomNumberGenerator* underlying_rng);
+                RandomNumberGenerator* underlying_rng = nullptr);
 
    private:
       void update(const byte input[], size_t input_len);