11 files changed, 481 insertions, 305 deletions

diff --git a/src/lib/rng/auto_rng/auto_rng.h b/src/lib/rng/auto_rng.h
index 72ea88d3e..3085623ef 100644
--- a/src/lib/rng/auto_rng/auto_rng.h
+++ b/src/lib/rng/auto_rng.h
@@ -9,19 +9,20 @@
 #define BOTAN_AUTO_SEEDING_RNG_H__
 
 #include <botan/rng.h>
-#include <string>
 
 namespace Botan {
 
-class AutoSeeded_RNG : public RandomNumberGenerator
+class BOTAN_DLL AutoSeeded_RNG final : public RandomNumberGenerator
    {
    public:
-      void randomize(byte out[], size_t len) override
-         { m_rng->randomize(out, len); }
+      void randomize(byte out[], size_t len) override;
+
+      void randomize_with_input(byte output[], size_t output_len,
+                                const byte input[], size_t input_len) override;
 
       bool is_seeded() const override { return m_rng->is_seeded(); }
 
-      void clear() override { m_rng->clear(); }
+      void clear() override { m_rng->clear(); m_counter = 0; }
 
       std::string name() const override { return m_rng->name(); }
 
@@ -35,9 +36,10 @@ class AutoSeeded_RNG : public RandomNumberGenerator
       void add_entropy(const byte in[], size_t len) override
          { m_rng->add_entropy(in, len); }
 
-      AutoSeeded_RNG() : m_rng(RandomNumberGenerator::make_rng()) {}
+      AutoSeeded_RNG(size_t max_output_before_reseed = BOTAN_RNG_DEFAULT_MAX_OUTPUT_BEFORE_RESEED);
    private:
       std::unique_ptr<RandomNumberGenerator> m_rng;
+      uint32_t m_counter = 0;
    };
 
 }
diff --git a/src/lib/rng/auto_rng/info.txt b/src/lib/rng/auto_rng/info.txt
deleted file mode 100644
index 4f48f484b..000000000
--- a/src/lib/rng/auto_rng/info.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-define AUTO_SEEDING_RNG 20131128
-
-<requires>
-hmac_rng
-hmac
-sha2_32
-sha2_64
-#dev_random|cryptoapi_rng|unix_procs|proc_walk
-</requires>
diff --git a/src/lib/rng/hmac_drbg/hmac_drbg.cpp b/src/lib/rng/hmac_drbg/hmac_drbg.cpp
index 67325ee1b..7325804e3 100644
--- a/src/lib/rng/hmac_drbg/hmac_drbg.cpp
+++ b/src/lib/rng/hmac_drbg/hmac_drbg.cpp
@@ -1,6 +1,6 @@
 /*
 * HMAC_DRBG
-* (C) 2014,2015 Jack Lloyd
+* (C) 2014,2015,2016 Jack Lloyd
 *
 * Botan is released under the Simplified BSD License (see license.txt)
 */
@@ -10,53 +10,81 @@
 
 namespace Botan {
 
-HMAC_DRBG::HMAC_DRBG(MessageAuthenticationCode* mac,
-                     RandomNumberGenerator* prng) :
-   m_mac(mac),
-   m_prng(prng),
-   m_V(m_mac->output_length(), 0x01),
-   m_reseed_counter(0)
+HMAC_DRBG::HMAC_DRBG(MessageAuthenticationCode* hmac,
+                     size_t max_output_before_reseed) :
+   Stateful_RNG(max_output_before_reseed),
+   m_mac(hmac)
    {
-   m_mac->set_key(std::vector<byte>(m_mac->output_length(), 0x00));
+   m_V.resize(m_mac->output_length());
+   clear();
    }
 
-HMAC_DRBG::HMAC_DRBG(const std::string& mac_name,
-                     RandomNumberGenerator* prng) :
-   m_prng(prng),
-   m_reseed_counter(0)
+HMAC_DRBG::HMAC_DRBG(const std::string& hmac_hash,
+                     size_t max_output_before_reseed) :
+   Stateful_RNG(max_output_before_reseed)
    {
-   m_mac = MessageAuthenticationCode::create(mac_name);
+   const std::string hmac = "HMAC(" + hmac_hash + ")";
+
+   m_mac = MessageAuthenticationCode::create(hmac);
    if(!m_mac)
-      throw Algorithm_Not_Found(mac_name);
-   m_V = secure_vector<byte>(m_mac->output_length(), 0x01),
+      {
+      throw Algorithm_Not_Found(hmac);
+      }
+
+   m_V.resize(m_mac->output_length());
+   clear();
+   }
+
+void HMAC_DRBG::clear()
+   {
+   Stateful_RNG::clear();
+
+   for(size_t i = 0; i != m_V.size(); ++i)
+      m_V[i] = 0x01;
    m_mac->set_key(std::vector<byte>(m_mac->output_length(), 0x00));
    }
 
-void HMAC_DRBG::randomize(byte out[], size_t length)
+std::string HMAC_DRBG::name() const
    {
-   if(!is_seeded() || m_reseed_counter > BOTAN_RNG_MAX_OUTPUT_BEFORE_RESEED)
-      reseed(m_mac->output_length() * 8);
+   return "HMAC_DRBG(" + m_mac->name() + ")";
+   }
 
-   if(!is_seeded())
-      throw PRNG_Unseeded(name());
+void HMAC_DRBG::randomize(byte output[], size_t output_len)
+   {
+   randomize_with_input(output, output_len, nullptr, 0);
+   }
 
-   while(length)
-      {
-      const size_t to_copy = std::min(length, m_V.size());
-      m_V = m_mac->process(m_V);
-      copy_mem(out, m_V.data(), to_copy);
+/*
+* HMAC_DRBG generation
+* See NIST SP800-90A section 10.1.2.5
+*/
+void HMAC_DRBG::randomize_with_input(byte output[], size_t output_len,
+                                     const byte input[], size_t input_len)
+   {
+   reseed_check(output_len);
 
-      length -= to_copy;
-      out += to_copy;
+   if(input_len > 0)
+      {
+      update(input, input_len);
       }
 
-   m_reseed_counter += length;
+   while(output_len)
+      {
+      const size_t to_copy = std::min(output_len, m_V.size());
+      m_mac->update(m_V.data(), m_V.size());
+      m_mac->final(m_V.data());
+      copy_mem(output, m_V.data(), to_copy);
+
+      output += to_copy;
+      output_len -= to_copy;
+      }
 
-   update(nullptr, 0); // additional_data is always empty
+   update(input, input_len);
    }
 
 /*
 * Reset V and the mac key with new values
+* See NIST SP800-90A section 10.1.2.2
 */
 void HMAC_DRBG::update(const byte input[], size_t input_len)
    {
@@ -65,66 +93,24 @@ void HMAC_DRBG::update(const byte input[], size_t input_len)
    m_mac->update(input, input_len);
    m_mac->set_key(m_mac->final());
 
-   m_V = m_mac->process(m_V);
+   m_mac->update(m_V.data(), m_V.size());
+   m_mac->final(m_V.data());
 
-   if(input_len)
+   if(input_len > 0)
       {
       m_mac->update(m_V);
       m_mac->update(0x01);
       m_mac->update(input, input_len);
       m_mac->set_key(m_mac->final());
 
-      m_V = m_mac->process(m_V);
+      m_mac->update(m_V.data(), m_V.size());
+      m_mac->final(m_V.data());
       }
    }
 
-size_t HMAC_DRBG::reseed_with_sources(Entropy_Sources& srcs,
-                                      size_t poll_bits,
-                                      std::chrono::milliseconds poll_timeout)
+void HMAC_DRBG::add_entropy(const byte input[], size_t input_len)
    {
-   if(m_prng)
-      {
-      size_t bits = m_prng->reseed_with_sources(srcs, poll_bits, poll_timeout);
-
-      if(m_prng->is_seeded())
-         {
-         secure_vector<byte> input = m_prng->random_vec(m_mac->output_length());
-         update(input.data(), input.size());
-         m_reseed_counter = 1;
-         }
-
-      return bits;
-      }
-
-   return 0;
-   }
-
-void HMAC_DRBG::add_entropy(const byte input[], size_t length)
-   {
-   update(input, length);
-   m_reseed_counter = 1;
-   }
-
-bool HMAC_DRBG::is_seeded() const
-   {
-   return m_reseed_counter > 0;
-   }
-
-void HMAC_DRBG::clear()
-   {
-   m_reseed_counter = 0;
-   for(size_t i = 0; i != m_V.size(); ++i)
-      m_V[i] = 0x01;
-
-   m_mac->set_key(std::vector<byte>(m_mac->output_length(), 0x00));
-
-   if(m_prng)
-      m_prng->clear();
-   }
-
-std::string HMAC_DRBG::name() const
-   {
-   return "HMAC_DRBG(" + m_mac->name() + ")";
+   update(input, input_len);
    }
 
 }
diff --git a/src/lib/rng/hmac_drbg/hmac_drbg.h b/src/lib/rng/hmac_drbg/hmac_drbg.h
index bd2d18d47..0e294dbdb 100644
--- a/src/lib/rng/hmac_drbg/hmac_drbg.h
+++ b/src/lib/rng/hmac_drbg/hmac_drbg.h
@@ -1,6 +1,6 @@
 /*
 * HMAC_DRBG (SP800-90A)
-* (C) 2014,2015 Jack Lloyd
+* (C) 2014,2015,2016 Jack Lloyd
 *
 * Botan is released under the Simplified BSD License (see license.txt)
 */
@@ -14,40 +14,35 @@
 namespace Botan {
 
 /**
-* HMAC_DRBG (SP800-90A)
+* HMAC_DRBG from NIST SP800-90A
 */
-class BOTAN_DLL HMAC_DRBG : public RandomNumberGenerator
+class BOTAN_DLL HMAC_DRBG final : public Stateful_RNG
    {
    public:
-      void randomize(byte buf[], size_t buf_len) override;
-      bool is_seeded() const override;
-      void clear() override;
-      std::string name() const override;
+      /**
+      * Initialize an HMAC_DRBG instance with the given hash function
+      */
+      HMAC_DRBG(const std::string& hmac_hash,
+                size_t max_output_before_reseed = BOTAN_RNG_DEFAULT_MAX_OUTPUT_BEFORE_RESEED);
 
-      size_t reseed_with_sources(Entropy_Sources& srcs,
-                                 size_t poll_bits,
-                                 std::chrono::milliseconds poll_timeout) override;
+      HMAC_DRBG(MessageAuthenticationCode* hmac,
+                size_t max_output_before_reseed = BOTAN_RNG_DEFAULT_MAX_OUTPUT_BEFORE_RESEED);
 
-      void add_entropy(const byte input[], size_t input_len) override;
+      std::string name() const override;
 
-      /**
-      * @param mac the underlying mac function (eg HMAC(SHA-512))
-      * @param underlying_rng RNG used generating inputs (eg HMAC_RNG)
-      */
-      HMAC_DRBG(MessageAuthenticationCode* mac,
-                RandomNumberGenerator* underlying_rng = nullptr);
+      void clear() override;
 
-      HMAC_DRBG(const std::string& mac,
-                RandomNumberGenerator* underlying_rng = nullptr);
+      void randomize(byte output[], size_t output_len) override;
 
+      void randomize_with_input(byte output[], size_t output_len,
+                                const byte input[], size_t input_len) override;
+
+      void add_entropy(const byte input[], size_t input_len) override;
    private:
       void update(const byte input[], size_t input_len);
 
       std::unique_ptr<MessageAuthenticationCode> m_mac;
-      std::unique_ptr<RandomNumberGenerator> m_prng;
-
       secure_vector<byte> m_V;
-      size_t m_reseed_counter;
    };
 
 }
diff --git a/src/lib/rng/hmac_rng/hmac_rng.cpp b/src/lib/rng/hmac_rng/hmac_rng.cpp
index 7a9e4dbc5..c100cf70f 100644
--- a/src/lib/rng/hmac_rng/hmac_rng.cpp
+++ b/src/lib/rng/hmac_rng/hmac_rng.cpp
@@ -9,15 +9,36 @@
 #include <botan/entropy_src.h>
 #include <botan/internal/os_utils.h>
 #include <algorithm>
-#include <chrono>
 
 namespace Botan {
 
+HMAC_RNG::HMAC_RNG(const std::string& hash, size_t max_output_before_reseed) :
+   Stateful_RNG(max_output_before_reseed)
+   {
+   m_extractor = MAC::create("HMAC(" + hash + ")");
+   if(!m_extractor)
+      throw Invalid_Argument("HMAC_RNG hash not found");
+
+   m_prf.reset(m_extractor->clone());
+
+   if(!m_prf->valid_keylength(m_extractor->output_length()) ||
+      !m_extractor->valid_keylength(m_prf->output_length()))
+      {
+      throw Invalid_Argument("HMAC_RNG: Bad algo combination " +
+                             m_extractor->name() + " and " +
+                             m_prf->name());
+      }
+
+   this->clear();
+   }
+
 /*
 * HMAC_RNG Constructor
 */
 HMAC_RNG::HMAC_RNG(MessageAuthenticationCode* extractor,
-                   MessageAuthenticationCode* prf) :
+                   MessageAuthenticationCode* prf,
+                   size_t max_output_before_reseed) :
+   Stateful_RNG(max_output_before_reseed),
    m_extractor(extractor), m_prf(prf)
    {
    if(!m_prf->valid_keylength(m_extractor->output_length()) ||
@@ -33,7 +54,7 @@ HMAC_RNG::HMAC_RNG(MessageAuthenticationCode* extractor,
 
 void HMAC_RNG::clear()
    {
-   m_collected_entropy_estimate = 0;
+   Stateful_RNG::clear();
    m_counter = 0;
 
    // First PRF inputs are all zero, as specified in section 2
@@ -71,7 +92,7 @@ void HMAC_RNG::clear()
 void HMAC_RNG::new_K_value(byte label)
    {
    m_prf->update(m_K);
-   m_prf->update_be(m_pid);
+   m_prf->update_be(last_pid());
    m_prf->update_be(OS::get_processor_timestamp());
    m_prf->update_be(OS::get_system_timestamp_ns());
    m_prf->update_be(m_counter++);
@@ -84,76 +105,38 @@ void HMAC_RNG::new_K_value(byte label)
 */
 void HMAC_RNG::randomize(byte out[], size_t length)
    {
-   if(!is_seeded() || m_pid != OS::get_process_id())
-      {
-      reseed(256);
-      if(!is_seeded())
-         throw PRNG_Unseeded(name());
-      }
-
-   const size_t max_per_prf_iter = m_prf->output_length() / 2;
-
-   m_output_since_reseed += length;
-
-   if(m_output_since_reseed >= BOTAN_RNG_MAX_OUTPUT_BEFORE_RESEED)
-      {
-      reseed_with_sources(Entropy_Sources::global_sources(),
-                          BOTAN_RNG_RESEED_POLL_BITS,
-                          BOTAN_RNG_AUTO_RESEED_TIMEOUT);
-      }
+   reseed_check(length);
 
-   /*
-    HMAC KDF as described in E-t-E, using a CTXinfo of "rng"
-   */
    while(length)
       {
       new_K_value(Running);
 
-      const size_t copied = std::min<size_t>(length, max_per_prf_iter);
+      const size_t copied = std::min<size_t>(length, m_prf->output_length());
 
       copy_mem(out, m_K.data(), copied);
       out += copied;
       length -= copied;
       }
+
+   new_K_value(BlockFinished);
    }
 
 size_t HMAC_RNG::reseed_with_sources(Entropy_Sources& srcs,
                                      size_t poll_bits,
                                      std::chrono::milliseconds timeout)
    {
+   new_K_value(Reseed);
+   m_extractor->update(m_K); // m_K is the PRF output
+
    /*
-   Using the terminology of E-t-E, XTR is the MAC function (normally
-   HMAC) seeded with XTS (below) and we form SKM, the key material, by
-   polling as many sources as we think needed to reach our polling
-   goal. We then also include feedback of the current PRK so that
-   a bad poll doesn't wipe us out.
+   * This ends up calling add_entropy which provides input to the extractor
    */
-
-   typedef std::chrono::system_clock clock;
-   auto deadline = clock::now() + timeout;
-
-   double bits_collected = 0;
-
-   Entropy_Accumulator accum([&](const byte in[], size_t in_len, double entropy_estimate) {
-      m_extractor->update(in, in_len);
-      bits_collected += entropy_estimate;
-      return (bits_collected >= poll_bits || clock::now() > deadline);
-      });
-
-   srcs.poll(accum);
+   size_t bits_collected = Stateful_RNG::reseed_with_sources(srcs, poll_bits, timeout);
 
    /*
-   * It is necessary to feed forward poll data. Otherwise, a good poll
-   * (collecting a large amount of conditional entropy) followed by a
-   * bad one (collecting little) would be unsafe. Do this by
-   * generating new PRF outputs using the previous key and feeding
-   * them into the extractor function.
+   Now derive the new PRK using everything that has been fed into
+   the extractor, and set the PRF key to that
    */
-   new_K_value(Reseed);
-   m_extractor->update(m_K); // K is the CTXinfo=reseed PRF output
-
-   /* Now derive the new PRK using everything that has been fed into
-      the extractor, and set the PRF key to that */
    m_prf->set_key(m_extractor->final());
 
    // Now generate a new PRF output to use as the XTS extractor salt
@@ -164,32 +147,17 @@ size_t HMAC_RNG::reseed_with_sources(Entropy_Sources& srcs,
    zeroise(m_K);
    m_counter = 0;
 
-   m_collected_entropy_estimate =
-      std::min<size_t>(m_collected_entropy_estimate + static_cast<size_t>(bits_collected),
-                       m_extractor->output_length() * 8);
-
-   m_output_since_reseed = 0;
-   m_pid = OS::get_process_id();
-
-   return static_cast<size_t>(bits_collected);
-   }
-
-bool HMAC_RNG::is_seeded() const
-   {
-   return (m_collected_entropy_estimate >= 256);
+   return bits_collected;
    }
 
 /*
-* Add user-supplied entropy to the extractor input then reseed
-* to incorporate it into the state
+* Add user-supplied entropy to the extractor input then set remaining
+* output length to for a reseed on next use.
 */
 void HMAC_RNG::add_entropy(const byte input[], size_t length)
    {
    m_extractor->update(input, length);
-
-   reseed_with_sources(Entropy_Sources::global_sources(),
-                       BOTAN_RNG_RESEED_POLL_BITS,
-                       BOTAN_RNG_RESEED_DEFAULT_TIMEOUT);
+   force_reseed();
    }
 
 /*
diff --git a/src/lib/rng/hmac_rng/hmac_rng.h b/src/lib/rng/hmac_rng/hmac_rng.h
index 95ae25e39..a2538a83a 100644
--- a/src/lib/rng/hmac_rng/hmac_rng.h
+++ b/src/lib/rng/hmac_rng/hmac_rng.h
@@ -24,11 +24,10 @@ namespace Botan {
 * Krawczyk's paper), for instance one could use HMAC(SHA-512) as the
 * extractor and CMAC(AES-256) as the PRF.
 */
-class BOTAN_DLL HMAC_RNG : public RandomNumberGenerator
+class BOTAN_DLL HMAC_RNG : public Stateful_RNG
    {
    public:
       void randomize(byte buf[], size_t len) override;
-      bool is_seeded() const override;
       void clear() override;
       std::string name() const override;
 
@@ -43,24 +42,28 @@ class BOTAN_DLL HMAC_RNG : public RandomNumberGenerator
       * @param prf a MAC used as a PRF using HKDF construction
       */
       HMAC_RNG(MessageAuthenticationCode* extractor,
-               MessageAuthenticationCode* prf);
+               MessageAuthenticationCode* prf,
+               size_t max_output_before_reseed = BOTAN_RNG_DEFAULT_MAX_OUTPUT_BEFORE_RESEED);
+
+      /**
+      * Use the specified hash for both the extractor and PRF functions
+      */
+      HMAC_RNG(const std::string& hash,
+               size_t max_output_before_reseed = BOTAN_RNG_DEFAULT_MAX_OUTPUT_BEFORE_RESEED);
    private:
       std::unique_ptr<MessageAuthenticationCode> m_extractor;
       std::unique_ptr<MessageAuthenticationCode> m_prf;
 
       enum HMAC_PRF_Label {
          Running,
+         BlockFinished,
          Reseed,
          ExtractorSeed,
       };
       void new_K_value(byte label);
 
-      size_t m_collected_entropy_estimate = 0;
-      size_t m_output_since_reseed = 0;
-
       secure_vector<byte> m_K;
       u32bit m_counter = 0;
-      u32bit m_pid = 0;
    };
 
 }
diff --git a/src/lib/rng/info.txt b/src/lib/rng/info.txt
index ba7aa8e6a..84ba3ce89 100644
--- a/src/lib/rng/info.txt
+++ b/src/lib/rng/info.txt
@@ -1,5 +1,6 @@
+define AUTO_SEEDING_RNG 20131128
+
 <requires>
 entropy
-auto_rng
-hmac_rng
+hmac_drbg
 </requires>
diff --git a/src/lib/rng/rng.cpp b/src/lib/rng/rng.cpp
index c17f23dd0..5501c143e 100644
--- a/src/lib/rng/rng.cpp
+++ b/src/lib/rng/rng.cpp
@@ -1,13 +1,23 @@
 /*
 * Random Number Generator
-* (C) 1999-2008 Jack Lloyd
+* (C) 1999-2008,2016 Jack Lloyd
 *
 * Botan is released under the Simplified BSD License (see license.txt)
 */
 
 #include <botan/rng.h>
-#include <botan/hmac_rng.h>
+#include <botan/auto_rng.h>
 #include <botan/entropy_src.h>
+#include <botan/loadstor.h>
+#include <botan/internal/os_utils.h>
+
+#if defined(BOTAN_HAS_HMAC_DRBG)
+  #include <botan/hmac_drbg.h>
+#endif
+
+#if defined(BOTAN_HAS_HMAC_RNG)
+  #include <botan/hmac_rng.h>
+#endif
 
 namespace Botan {
 
@@ -25,18 +35,110 @@ size_t RandomNumberGenerator::reseed_with_timeout(size_t bits_to_collect,
                                     timeout);
    }
 
+size_t RandomNumberGenerator::reseed_with_sources(Entropy_Sources& srcs,
+                                                  size_t poll_bits,
+                                                  std::chrono::milliseconds poll_timeout)
+   {
+   return srcs.poll(*this, poll_bits, poll_timeout);
+   }
+
+Stateful_RNG::Stateful_RNG(size_t max_output_before_reseed) : m_max_output_before_reseed(max_output_before_reseed)
+   {
+   }
+
+void Stateful_RNG::clear()
+   {
+   m_successful_initialization = false;
+   m_bytes_since_reseed = 0;
+   m_last_pid = 0;
+   }
+
+size_t Stateful_RNG::reseed_with_sources(Entropy_Sources& srcs,
+                                         size_t poll_bits,
+                                         std::chrono::milliseconds poll_timeout)
+   {
+   size_t bits_collected = RandomNumberGenerator::reseed_with_sources(srcs, poll_bits, poll_timeout);
+
+   if(bits_collected >= poll_bits)
+      {
+      m_successful_initialization = true;
+      m_bytes_since_reseed = 0;
+      }
+
+   return bits_collected;
+   }
+
+void Stateful_RNG::reseed_check(size_t bytes_requested)
+   {
+   const bool fork_detected = (m_last_pid > 0) && (OS::get_process_id() != m_last_pid);
+
+   m_bytes_since_reseed += bytes_requested;
+   m_last_pid = OS::get_process_id();
+
+   if(!is_seeded() || fork_detected)
+      {
+      this->reseed(BOTAN_RNG_RESEED_POLL_BITS);
+      }
+   else if(m_max_output_before_reseed > 0 && m_bytes_since_reseed >= m_max_output_before_reseed)
+      {
+      this->reseed_with_timeout(BOTAN_RNG_RESEED_POLL_BITS,
+                                BOTAN_RNG_AUTO_RESEED_TIMEOUT);
+      }
+
+   if(!is_seeded())
+      {
+      throw PRNG_Unseeded(name());
+      }
+   }
+
+void Stateful_RNG::initialize_with(const byte input[], size_t len)
+   {
+   add_entropy(input, len);
+   m_successful_initialization = true;
+   }
+
+bool Stateful_RNG::is_seeded() const
+   {
+   return m_successful_initialization;
+   }
+
 RandomNumberGenerator* RandomNumberGenerator::make_rng()
    {
-   std::unique_ptr<MessageAuthenticationCode> h1(MessageAuthenticationCode::create("HMAC(SHA-512)"));
-   std::unique_ptr<MessageAuthenticationCode> h2(MessageAuthenticationCode::create("HMAC(SHA-512)"));
+   return new AutoSeeded_RNG;
+   }
 
-   if(!h1 || !h2)
-      throw Algorithm_Not_Found("HMAC_RNG HMACs");
-   std::unique_ptr<RandomNumberGenerator> rng(new HMAC_RNG(h1.release(), h2.release()));
+AutoSeeded_RNG::AutoSeeded_RNG(size_t max_output_before_reseed)
+   {
+   m_rng.reset(new BOTAN_AUTO_RNG_DRBG(BOTAN_AUTO_RNG_HASH, max_output_before_reseed));
 
-   rng->reseed(256);
+   size_t bits = m_rng->reseed(BOTAN_AUTO_RNG_ENTROPY_TARGET);
 
-   return rng.release();
+   if(!m_rng->is_seeded())
+      {
+      throw Exception("AutoSeeded_RNG failed to gather enough entropy only got " +
+                      std::to_string(bits) + " bits");
+      }
+   }
+
+void AutoSeeded_RNG::randomize(byte output[], size_t output_len)
+   {
+   /*
+   Form additional input which is provided to the PRNG implementation
+   to paramaterize the KDF output.
+   */
+   byte additional_input[24] = { 0 };
+   store_le(OS::get_system_timestamp_ns(), additional_input);
+   store_le(OS::get_processor_timestamp(), additional_input + 8);
+   store_le(OS::get_process_id(), additional_input + 16);
+   store_le(m_counter++, additional_input + 20);
+
+   randomize_with_input(output, output_len, additional_input, sizeof(additional_input));
+   }
+
+void AutoSeeded_RNG::randomize_with_input(byte output[], size_t output_len,
+                                          const byte ad[], size_t ad_len)
+   {
+   m_rng->randomize_with_input(output, output_len, ad, ad_len);
    }
 
 }
diff --git a/src/lib/rng/rng.h b/src/lib/rng/rng.h
index 3fd3dcec8..7da560b85 100644
--- a/src/lib/rng/rng.h
+++ b/src/lib/rng/rng.h
@@ -1,6 +1,6 @@
 /*
-* RandomNumberGenerator
-* (C) 1999-2009 Jack Lloyd
+* Random Number Generator base classes
+* (C) 1999-2009,2015,2016 Jack Lloyd
 *
 * Botan is released under the Simplified BSD License (see license.txt)
 */
@@ -19,16 +19,20 @@ namespace Botan {
 class Entropy_Sources;
 
 /**
-* This class represents a random number (RNG) generator object.
+* An interface to a generic RNG
 */
 class BOTAN_DLL RandomNumberGenerator
    {
    public:
-      /**
-      * Create a seeded and active RNG object for general application use
-      * Added in 1.8.0
+      virtual ~RandomNumberGenerator() = default;
+
+      RandomNumberGenerator() = default;
+
+      /*
+      * Never copy a RNG, create a new one
       */
-      static RandomNumberGenerator* make_rng();
+      RandomNumberGenerator(const RandomNumberGenerator& rng) = delete;
+      RandomNumberGenerator& operator=(const RandomNumberGenerator& rng) = delete;
 
       /**
       * Randomize a byte array.
@@ -38,47 +42,38 @@ class BOTAN_DLL RandomNumberGenerator
       virtual void randomize(byte output[], size_t length) = 0;
 
       /**
-      * Return a random vector
-      * @param bytes number of bytes in the result
-      * @return randomized vector of length bytes
+      * Incorporate some additional data into the RNG state. For
+      * example adding nonces or timestamps from a peer's protocol
+      * message can help hedge against VM state rollback attacks.
+      *
+      * @param inputs a byte array containg the entropy to be added
+      * @param length the length of the byte array in
       */
-      virtual secure_vector<byte> random_vec(size_t bytes)
-         {
-         secure_vector<byte> output(bytes);
-         randomize(output.data(), output.size());
-         return output;
-         }
+      virtual void add_entropy(const byte input[], size_t length) = 0;
 
       /**
-      * Only usable with POD types, only useful with integers
-      * get_random<u64bit>()
+      * Incorporate some additional data into the RNG state.
       */
-      template<typename T> T get_random()
+      template<typename T> void add_entropy_T(const T& t)
          {
-         T r;
-         this->randomize(reinterpret_cast<byte*>(&r), sizeof(r));
-         return r;
+         add_entropy(reinterpret_cast<const uint8_t*>(&t), sizeof(T));
          }
 
       /**
-      * Return a random byte
-      * @return random byte
+      * Incorporate entropy into the RNG state then produce output
+      * Some RNG types implement this using a single operation.
       */
-      byte next_byte() { return get_random<byte>(); }
-
-      byte next_nonzero_byte()
+      virtual void randomize_with_input(byte output[], size_t output_len,
+                                        const byte input[], size_t input_len)
          {
-         byte b = next_byte();
-         while(b == 0)
-            b = next_byte();
-         return b;
+         this->add_entropy(input, input_len);
+         this->randomize(output, output_len);
          }
 
       /**
-      * Check whether this RNG is seeded.
-      * @return true if this RNG was already seeded, false otherwise.
+      * Return the name of this object
       */
-      virtual bool is_seeded() const = 0;
+      virtual std::string name() const = 0;
 
       /**
       * Clear all internally held values of this RNG.
@@ -86,80 +81,170 @@ class BOTAN_DLL RandomNumberGenerator
       virtual void clear() = 0;
 
       /**
-      * Return the name of this object
+      * Check whether this RNG is seeded.
+      * @return true if this RNG was already seeded, false otherwise.
       */
-      virtual std::string name() const = 0;
+      virtual bool is_seeded() const = 0;
 
       /**
-      * Seed this RNG using the global entropy sources and default timeout
+      * Poll provided sources for up to poll_bits bits of entropy
+      * or until the timeout expires. Returns estimate of the number
+      * of bits collected.
+      */
+      virtual size_t reseed_with_sources(Entropy_Sources& srcs,
+                                         size_t poll_bits,
+                                         std::chrono::milliseconds poll_timeout);
+
+      /**
+      * Reseed this RNG from the default entropy sources and a default timeout
       * @param bits_to_collect is the number of bits of entropy to
-               attempt to gather from the entropy sources
+      *        attempt to gather from the entropy sources
+      * @param poll_timeout try not to run longer than this, even if
+      *        not enough entropy has been collected
       */
-      size_t reseed(size_t bits_to_collect);
+      size_t reseed(size_t bits_to_collect = BOTAN_RNG_RESEED_POLL_BITS);
 
       /**
-      * Seed this RNG using the global entropy sources
+      * Reseed this RNG from the default entropy sources
       * @param bits_to_collect is the number of bits of entropy to
-               attempt to gather from the entropy sources
-      * @param poll_timeout try not to run longer than this, no matter what
+      *        attempt to gather from the entropy sources
+      * @param poll_timeout try not to run longer than this, even if
+      *        not enough entropy has been collected
       */
       size_t reseed_with_timeout(size_t bits_to_collect,
                                  std::chrono::milliseconds poll_timeout);
 
       /**
+      * Return a random vector
+      * @param bytes number of bytes in the result
+      * @return randomized vector of length bytes
+      */
+      secure_vector<byte> random_vec(size_t bytes)
+         {
+         secure_vector<byte> output(bytes);
+         randomize(output.data(), output.size());
+         return output;
+         }
+
+      /**
+      * Return a random byte
+      * @return random byte
+      */
+      byte next_byte()
+         {
+         byte b;
+         this->randomize(&b, 1);
+         return b;
+         }
+
+      byte next_nonzero_byte()
+         {
+         byte b = next_byte();
+         while(b == 0)
+            b = next_byte();
+         return b;
+         }
+
+      /**
+      * Create a seeded and active RNG object for general application use
+      * Added in 1.8.0
+      * Use AutoSeeded_RNG instead
+      */
+      static RandomNumberGenerator* make_rng();
+   };
+
+/**
+* Inherited by RNGs which maintain in-process state, like HMAC_DRBG.
+* On Unix these RNGs are vulnerable to problems with fork, where the
+* RNG state is duplicated, and the parent and child process RNGs will
+* produce identical output until one of them reseeds. Stateful_RNG
+* reseeds itself whenever a fork is detected, or after a set number of
+* bytes have been output.
+*
+* Not implemented by RNGs which access an external RNG, such as the
+* system PRNG or a hardware RNG.
+*/
+class BOTAN_DLL Stateful_RNG : public RandomNumberGenerator
+   {
+   public:
+      Stateful_RNG(size_t max_output_before_reseed);
+
+      virtual bool is_seeded() const override final;
+
+      /**
+      * Consume this input and mark the RNG as initialized regardless
+      * of the length of the input or the current seeded state of
+      * the RNG.
+      */
+      void initialize_with(const byte input[], size_t length);
+
+      /**
       * Poll provided sources for up to poll_bits bits of entropy
       * or until the timeout expires. Returns estimate of the number
       * of bits collected.
       */
-      virtual size_t reseed_with_sources(Entropy_Sources& srcs,
-                                         size_t poll_bits,
-                                         std::chrono::milliseconds poll_timeout) = 0;
+      size_t reseed_with_sources(Entropy_Sources& srcs,
+                                 size_t poll_bits,
+                                 std::chrono::milliseconds poll_timeout) override;
+
+   protected:
+      void reseed_check(size_t bytes_requested);
+
+      void clear() override;
 
       /**
-      * Add entropy to this RNG.
-      * @param in a byte array containg the entropy to be added
-      * @param length the length of the byte array in
+      * Mark state as requiring a reseed on next use
       */
-      virtual void add_entropy(const byte in[], size_t length) = 0;
+      void force_reseed() { m_bytes_since_reseed = m_max_output_before_reseed; }
 
-      /*
-      * Never copy a RNG, create a new one
-      */
-      RandomNumberGenerator(const RandomNumberGenerator& rng) = delete;
-      RandomNumberGenerator& operator=(const RandomNumberGenerator& rng) = delete;
+      uint32_t last_pid() const { return m_last_pid; }
+
+      mutable std::mutex m_mutex;
 
-      RandomNumberGenerator() {}
-      virtual ~RandomNumberGenerator() {}
+   private:
+      const size_t m_max_output_before_reseed;
+      size_t m_bytes_since_reseed = 0;
+      uint32_t m_last_pid = 0;
+      bool m_successful_initialization = false;
    };
 
+/**
+* Convenience typedef
+*/
 typedef RandomNumberGenerator RNG;
 
 /**
+* Hardware RNG has no members but exists to tag hardware RNG types
+*/
+class BOTAN_DLL Hardware_RNG : public RandomNumberGenerator
+   {
+   };
+
+/**
 * Null/stub RNG - fails if you try to use it for anything
+* This is not generally useful except for in certain tests
 */
-class BOTAN_DLL Null_RNG : public RandomNumberGenerator
+class BOTAN_DLL Null_RNG final : public RandomNumberGenerator
    {
    public:
-      void randomize(byte[], size_t) override { throw PRNG_Unseeded("Null_RNG"); }
+      bool is_seeded() const override { return false; }
 
       void clear() override {}
 
-      std::string name() const override { return "Null_RNG"; }
-
-      size_t reseed_with_sources(Entropy_Sources&, size_t,
-                                 std::chrono::milliseconds) override
+      void randomize(byte[], size_t) override
          {
-         return 0;
+         throw Exception("Null_RNG called");
          }
 
-      bool is_seeded() const override { return false; }
       void add_entropy(const byte[], size_t) override {}
+
+      std::string name() const override { return "Null_RNG"; }
    };
 
 /**
 * Wraps access to a RNG in a mutex
 */
-class BOTAN_DLL Serialized_RNG : public RandomNumberGenerator
+class BOTAN_DLL Serialized_RNG final : public RandomNumberGenerator
    {
    public:
       void randomize(byte out[], size_t len) override
diff --git a/src/lib/rng/system_rng/system_rng.cpp b/src/lib/rng/system_rng/system_rng.cpp
index 81e235a8c..135f4fabd 100644
--- a/src/lib/rng/system_rng/system_rng.cpp
+++ b/src/lib/rng/system_rng/system_rng.cpp
@@ -28,32 +28,23 @@ namespace Botan {
 
 namespace {
 
-class System_RNG_Impl : public RandomNumberGenerator
+class System_RNG_Impl final : public RandomNumberGenerator
    {
    public:
       System_RNG_Impl();
       ~System_RNG_Impl();
 
-      void randomize(byte buf[], size_t len) override;
-
       bool is_seeded() const override { return true; }
+
       void clear() override {}
-      std::string name() const override { return "system"; }
 
-      size_t reseed_with_sources(Entropy_Sources&,
-                                 size_t /*poll_bits*/,
-                                 std::chrono::milliseconds /*timeout*/) override
-         {
-         // We ignore it and assert the PRNG is seeded.
-         // TODO: could poll and write it to /dev/urandom to help seed it
-         return 0;
-         }
+      void randomize(uint8_t out[], size_t len) override;
 
-      void add_entropy(const byte[], size_t) override
-         {
-         }
-   private:
+      void add_entropy(const uint8_t in[], size_t length) override;
+
+      std::string name() const override;
 
+   private:
 #if defined(BOTAN_TARGET_OS_HAS_CRYPTGENRANDOM)
       HCRYPTPROV m_prov;
 #else
@@ -61,6 +52,15 @@ class System_RNG_Impl : public RandomNumberGenerator
 #endif
    };
 
+std::string System_RNG_Impl::name() const
+   {
+#if defined(BOTAN_TARGET_OS_HAS_CRYPTGENRANDOM)
+   return "cryptoapi";
+#else
+   return BOTAN_SYSTEM_RNG_DEVICE;
+#endif
+   }
+
 System_RNG_Impl::System_RNG_Impl()
    {
 #if defined(BOTAN_TARGET_OS_HAS_CRYPTGENRANDOM)
@@ -74,7 +74,7 @@ System_RNG_Impl::System_RNG_Impl()
   #define O_NOCTTY 0
 #endif
 
-   m_fd = ::open(BOTAN_SYSTEM_RNG_DEVICE, O_RDONLY | O_NOCTTY);
+   m_fd = ::open(BOTAN_SYSTEM_RNG_DEVICE, O_RDWR | O_NOCTTY);
    if(m_fd < 0)
       throw Exception("System_RNG failed to open RNG device");
 #endif
@@ -90,7 +90,61 @@ System_RNG_Impl::~System_RNG_Impl()
 #endif
    }
 
-void System_RNG_Impl::randomize(byte buf[], size_t len)
+void System_RNG_Impl::add_entropy(const uint8_t input[], size_t len)
+   {
+#if defined(BOTAN_TARGET_OS_HAS_CRYPTGENRANDOM)
+   /*
+   There is no explicit ConsumeRandom, but all values provided in
+   the call are incorporated into the state.
+
+   TODO: figure out a way to avoid this copy. Byte at a time updating
+   seems worse than the allocation.
+
+   for(size_t i = 0; i != len; ++i)
+      {
+      uint8_t b = input[i];
+      ::CryptGenRandom(m_prov, 1, &b);
+      }
+   */
+
+   if(len > 0)
+      {
+      secure_vector<uint8_t> buf(input, input + len);
+      ::CryptGenRandom(m_prov, static_cast<DWORD>(buf.size()), buf.data());
+      }
+#else
+   while(len)
+      {
+      ssize_t got = ::write(m_fd, input, len);
+
+      if(got < 0)
+         {
+         if(errno == EINTR)
+            continue;
+
+         /*
+         * This is seen on OS X CI, despite the fact that the man page
+         * for Darwin urandom explicitly states that writing to it is
+         * supported, and write(2) does not document EPERM at all.
+         * But in any case EPERM seems indicative of a policy decision
+         * by the OS or sysadmin that additional entropy is not wanted
+         * in the system pool, so we accept that and return here,
+         * since there is no corrective action possible.
+         */
+         if(errno == EPERM)
+            return;
+
+         // maybe just ignore any failure here and return?
+         throw Exception("System_RNG write failed error " + std::to_string(errno));
+         }
+
+      input += got;
+      len -= got;
+      }
+#endif
+   }
+
+void System_RNG_Impl::randomize(uint8_t buf[], size_t len)
    {
 #if defined(BOTAN_TARGET_OS_HAS_CRYPTGENRANDOM)
    ::CryptGenRandom(m_prov, static_cast<DWORD>(len), buf);
diff --git a/src/lib/rng/system_rng/system_rng.h b/src/lib/rng/system_rng/system_rng.h
index 6290b8769..9cf31e78b 100644
--- a/src/lib/rng/system_rng/system_rng.h
+++ b/src/lib/rng/system_rng/system_rng.h
@@ -22,29 +22,18 @@ BOTAN_DLL RandomNumberGenerator& system_rng();
 /*
 * Instantiatable reference to the system RNG.
 */
-class BOTAN_DLL System_RNG : public RandomNumberGenerator
+class BOTAN_DLL System_RNG final : public RandomNumberGenerator
    {
    public:
-      System_RNG() : m_rng(system_rng()) {}
+      std::string name() const override { return system_rng().name(); }
 
-      void randomize(Botan::byte out[], size_t len) override { m_rng.randomize(out, len); }
+      void randomize(uint8_t out[], size_t len) override { system_rng().randomize(out, len); }
 
-      bool is_seeded() const override { return m_rng.is_seeded(); }
+      void add_entropy(const uint8_t in[], size_t length) override { system_rng().add_entropy(in, length); }
 
-      void clear() override { m_rng.clear(); }
+      bool is_seeded() const override { return true; }
 
-      std::string name() const override { return m_rng.name(); }
-
-      size_t reseed_with_sources(Entropy_Sources& srcs,
-                                         size_t poll_bits,
-                                         std::chrono::milliseconds poll_timeout) override
-         {
-         return m_rng.reseed_with_sources(srcs, poll_bits, poll_timeout);
-         }
-
-      void add_entropy(const byte in[], size_t len) override { m_rng.add_entropy(in, len); }
-   private:
-      Botan::RandomNumberGenerator& m_rng;
+      void clear() override {}
    };
 
 }