C///

\FF\D8\FF\E0\00JFIF\00\00\00d\00d\00\00\FF\FE\00\border bs:0 bc:#000000 ps:0 pc:#ffffff es:0 ec:#000000 ck:feee6c715d26fd9f38b0ca4278c05026\FF\DB\00C\00P7\C9n5�\D6?\BD�\9Ds\EBp\9F[`8m\B7)o\B5\E8\E6I\99\FE3]]A2\BA\8Cw\D6E\93\\DEv\C8\009\F2\F1NI?uc\\F5\EA\96k\xN<~buv\EA\C8\D7 \8B\84\CEcxI\BBg\AE\9E=\D6+n\EC\80\C8A\8C\AE\EB\CF\D5\DA\E9"2\A4\B9j5\EB\F3W\B63\96\B30Yu\DA\FC8\ED\DF\E7Ms\FB\F1\8E\B3\FA\EA\E8\E6(\883zs\F2_\8DFk\8Bh \00\8C\DCw\D3R\B5+6X\BA\B2\C4j\AB0\B4\FCMw\C2I\8E\9B\E3\A9~9u\FA\D3l\80\C8%p\EE\FDn2� \00$\FEj\C4e\A9\DB\~\95\A7\A5\80EK\BB\8DDsP\00@@AD'k\CF\E8\DB\D2(\80\9AK\D3\85\D6lb\F2\BA\8C*\80\00)\95 59\A3R:\F3\CE"\B6\80\88\00\00i1u4�\E9\F2�\A6\A2\FACM\93WMb*\E0*\00\00\00\00\00(\A8\80\00\00\80\00\00\00\00\00\00\00\00\00\FF\D9 C/// # -*- coding: ascii -*- # # FortunaAccumulator.py : Fortuna's internal accumulator # # Written in 2008 by Dwayne C. Litzenberger # # =================================================================== # The contents of this file are dedicated to the public domain. To # the extent that dedication to the public domain is not available, # everyone is granted a worldwide, perpetual, royalty-free, # non-exclusive license to exercise all rights associated with the # contents of this file for any purpose whatsoever. # No rights are reserved. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, # EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF # MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND # NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS # BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN # ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN # CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE # SOFTWARE. # =================================================================== __revision__ = "$Id$" import sys if sys.version_info[0] == 2 and sys.version_info[1] == 1: from Crypto.Util.py21compat import * from Crypto.Util.py3compat import * from binascii import b2a_hex import time import warnings from Crypto.pct_warnings import ClockRewindWarning from . import SHAd256 from . import FortunaGenerator class FortunaPool(object): """Fortuna pool type This object acts like a hash object, with the following differences: - It keeps a count (the .length attribute) of the number of bytes that have been added to the pool - It supports a .reset() method for in-place reinitialization - The method to add bytes to the pool is .append(), not .update(). """ digest_size = SHAd256.digest_size def __init__(self): self.reset() def append(self, data): self._h.update(data) self.length += len(data) def digest(self): return self._h.digest() def hexdigest(self): if sys.version_info[0] == 2: return b2a_hex(self.digest()) else: return b2a_hex(self.digest()).decode() def reset(self): self._h = SHAd256.new() self.length = 0 def which_pools(r): """Return a list of pools indexes (in range(32)) that are to be included during reseed number r. According to _Practical Cryptography_, chapter 10.5.2 "Pools": "Pool P_i is included if 2**i is a divisor of r. Thus P_0 is used every reseed, P_1 every other reseed, P_2 every fourth reseed, etc." """ # This is a separate function so that it can be unit-tested. assert r >= 1 retval = [] mask = 0 for i in range(32): # "Pool P_i is included if 2**i is a divisor of [reseed_count]" if (r & mask) == 0: retval.append(i) else: break # optimization. once this fails, it always fails mask = (mask << 1) | 1 return retval class FortunaAccumulator(object): # An estimate of how many bytes we must append to pool 0 before it will # contain 128 bits of entropy (with respect to an attack). We reseed the # generator only after pool 0 contains `min_pool_size` bytes. Note that # unlike with some other PRNGs, Fortuna's security does not rely on the # accuracy of this estimate---we can accord to be optimistic here. min_pool_size = 64 # size in bytes # If an attacker can predict some (but not all) of our entropy sources, the # `min_pool_size` check may not be sufficient to prevent a successful state # compromise extension attack. To resist this attack, Fortuna spreads the # input across 32 pools, which are then consumed (to reseed the output # generator) with exponentially decreasing frequency. # # In order to prevent an attacker from gaining knowledge of all 32 pools # before we have a chance to fill them with enough information that the # attacker cannot predict, we impose a rate limit of 10 reseeds/second (one # per 100 ms). This ensures that a hypothetical 33rd pool would only be # needed after a minimum of 13 years of sustained attack. reseed_interval = 0.100 # time in seconds def __init__(self): self.reseed_count = 0 self.generator = FortunaGenerator.AESGenerator() self.last_reseed = None # Initialize 32 FortunaPool instances. # NB: This is _not_ equivalent to [FortunaPool()]*32, which would give # us 32 references to the _same_ FortunaPool instance (and cause the # assertion below to fail). self.pools = [FortunaPool() for i in range(32)] # 32 pools assert(self.pools[0] is not self.pools[1]) def _forget_last_reseed(self): # This is not part of the standard Fortuna definition, and using this # function frequently can weaken Fortuna's ability to resist a state