Fortuna: Add Chacha20 as an alternative stream cipher

[cem]

Summary

Chacha20 with a 256 bit key and 128 bit counter size is a good match for an
AES256-ICM replacement.

In userspace, Chacha20 is typically marginally slower than AES-ICM on
machines with AESNI intrinsics, but typically much faster than AES on
machines without special intrinsics. ChaCha20 does well on typical modern
architectures with SIMD instructions, which includes most types of machines
FreeBSD runs on.

In the kernel, we can't (or don't) make use of AESNI intrinsics for
random(4) anyway. So even on amd64, using Chacha provides a modest
performance improvement in random device throughput today.

This change makes the stream cipher used by random(4) configurable at boot
time with the 'kern.random.use_chacha20_cipher' tunable.

Test Plan

The diff is somewhat clearer with whitespace changes hidden: https://reviews.freebsd.org/D19475?whitespace=ignore-all

Some rough throughput numbers on an amd64 bhyve VM; using pv </dev/random >/dev/null for 30 seconds. The VM host was mostly idle. The same build was used for both tests, switching only the tunable:

Baseline revision	kernel	Stream cipher mode	Throughput (pv)
r344844	GENERIC-NODEBUG	AES-ICM	~180 MB/s
r344844	GENERIC-NODEBUG	Chacha20	~400 MB/s

[markm]

Nice work! Out for interest, why make the output generator selectable? Why not switch completely to Chacha20?

[markm]

sys/dev/random/hash.c

115–120

What happens if somebody changes the sysctl after the key is set?

[cem]

In D19475#416904, @markm wrote:

Nice work! Out for interest, why make the output generator selectable? Why not switch completely to Chacha20?

Thanks! I think it could be done in a later step, but I wanted to add the option conservatively to avoid push-back and "astonishment."

sys/dev/random/hash.c

115–120

It's a tunable — it is set once at boot time. The sysctl node is read-only and cannot be changed. Allowing run-time mode switching would complicate the code for (I felt) little benefit.

[cem]

Fix a 'doh!' copy/paste error on archs without a uint128 type.

[markm]

Very good!

[cem]

Need secteam blessing to touch dev/random. Thanks!

[delphij]

Looks good to me in principle and I like the fact that fortuna.c no longer cares about the keystream context internals.

One request -- Could you please make test of random_chachamode not negative? It would be nice if you could also give union randomdev_key's AES portion a name, but that's optional.

sys/dev/random/hash.c

115

Could you please rearrange the code to avoid negative logic, e.g.:

if (random_chachamode) {

chacha_keysetup(...)

} else {

(AES code block)

}

? This makes the code easier to follow.

135

Similar to above.

sys/dev/random/hash.h

50

(Optional) - maybe give the AES context a name?

[cem]

sys/dev/random/hash.c

115

Sure, will do.

sys/dev/random/hash.h

50

I tried to leave existing AES-ICM mode alone as much as possible — it is visibly unmodified with 'diff -w'. Naming the AES structure here would break that.

[cem]

Put non-negative logical case first, for clarity. Thanks delphij@

[delphij]

LGTM, thanks!

(Note that randomdev_getkey() have similar issue and should be fixed too, feel free to fix it prior to commit)