/*	$NetBSD$	*/

/*-
 * Copyright (c) 2015 The NetBSD Foundation, Inc.
 * All rights reserved.
 *
 * This code is derived from software contributed to The NetBSD Foundation
 * by Taylor R. Campbell.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

#ifndef	_SYS_ENTPOOL_H
#define	_SYS_ENTPOOL_H

/*
 * Entropy pool: A 1600-bit Keccak state, with an implied input buffer
 * and output buffer.  The input buffer starts out empty and the output
 * buffer starts out full.  The two cannot be used simultaneously:
 *
 * - Extracting output always permutes the state, for the sake of key
 *   erasure, a.k.a. forward secrecy, a.k.a. backtracking resistance,
 *   which resets both buffers.
 *
 * - Entering input empties the output buffer, requiring another
 *   permutation before any output can be had.
 */
struct entpool {
	union {
		uint64_t	u64[25];	/* Keccak state */
		uint8_t		u8[200];	/* bytes */
	}		ep_state;
	unsigned	ep_inleft;		/* bytes left to fill input */
	unsigned	ep_outleft;		/* bytes output left */
};

#define	ENTPOOL_OUTRATE_BYTES	32	/* tunable: `SHA3-256' for now */
#define	ENTPOOL_INRATE_BYTES	(200 - 2*ENTPOOL_OUTRATE_BYTES)

void	entpool_enter(struct entpool *, const void *, size_t);
size_t	entpool_enter_nostir(struct entpool *, const void *, size_t);
void	entpool_extract(struct entpool *, void *, size_t);
void	entpool_stir(struct entpool *);

#endif	/* _SYS_ENTPOOL_H */