3 files changed, 38 insertions, 11 deletions
diff --git a/src/crypto/chacha.h b/src/crypto/chacha.h
index 2b3ed8043..1dc270faf 100644
--- a/src/crypto/chacha.h
+++ b/src/crypto/chacha.h
@@ -69,22 +69,26 @@ namespace crypto {
     chacha20(data, length, key.data(), reinterpret_cast<const uint8_t*>(&iv), cipher);
   }
 
-  inline void generate_chacha_key(const void *data, size_t size, chacha_key& key) {
+  inline void generate_chacha_key(const void *data, size_t size, chacha_key& key, uint64_t kdf_rounds) {
     static_assert(sizeof(chacha_key) <= sizeof(hash), "Size of hash must be at least that of chacha_key");
     tools::scrubbed_arr<char, HASH_SIZE> pwd_hash;
     crypto::cn_slow_hash(data, size, pwd_hash.data(), 0/*variant*/, 0/*prehashed*/);
+    for (uint64_t n = 1; n < kdf_rounds; ++n)
+      crypto::cn_slow_hash(pwd_hash.data(), pwd_hash.size(), pwd_hash.data(), 0/*variant*/, 0/*prehashed*/);
     memcpy(&unwrap(key), pwd_hash.data(), sizeof(key));
   }
 
-  inline void generate_chacha_key_prehashed(const void *data, size_t size, chacha_key& key) {
+  inline void generate_chacha_key_prehashed(const void *data, size_t size, chacha_key& key, uint64_t kdf_rounds) {
     static_assert(sizeof(chacha_key) <= sizeof(hash), "Size of hash must be at least that of chacha_key");
     tools::scrubbed_arr<char, HASH_SIZE> pwd_hash;
     crypto::cn_slow_hash(data, size, pwd_hash.data(), 0/*variant*/, 1/*prehashed*/);
+    for (uint64_t n = 1; n < kdf_rounds; ++n)
+      crypto::cn_slow_hash(pwd_hash.data(), pwd_hash.size(), pwd_hash.data(), 0/*variant*/, 0/*prehashed*/);
     memcpy(&unwrap(key), pwd_hash.data(), sizeof(key));
   }
 
-  inline void generate_chacha_key(std::string password, chacha_key& key) {
-    return generate_chacha_key(password.data(), password.size(), key);
+  inline void generate_chacha_key(std::string password, chacha_key& key, uint64_t kdf_rounds) {
+    return generate_chacha_key(password.data(), password.size(), key, kdf_rounds);
   }
 }
 
diff --git a/src/crypto/crypto.cpp b/src/crypto/crypto.cpp
index 0fd6d9363..4243c71fd 100644
--- a/src/crypto/crypto.cpp
+++ b/src/crypto/crypto.cpp
@@ -70,6 +70,9 @@ namespace crypto {
 #include "random.h"
   }
 
+  const crypto::public_key null_pkey = crypto::public_key{};
+  const crypto::secret_key null_skey = crypto::secret_key{};
+
   static inline unsigned char *operator &(ec_point &point) {
     return &reinterpret_cast<unsigned char &>(point);
   }
@@ -93,12 +96,32 @@ namespace crypto {
     generate_random_bytes_not_thread_safe(N, bytes);
   }
 
+  static inline bool less32(const unsigned char *k0, const unsigned char *k1)
+  {
+    for (int n = 31; n >= 0; --n)
+    {
+      if (k0[n] < k1[n])
+        return true;
+      if (k0[n] > k1[n])
+        return false;
+    }
+    return false;
+  }
+
+  void random32_unbiased(unsigned char *bytes)
+  {
+    // l = 2^252 + 27742317777372353535851937790883648493.
+    // it fits 15 in 32 bytes
+    static const unsigned char limit[32] = { 0xe3, 0x6a, 0x67, 0x72, 0x8b, 0xce, 0x13, 0x29, 0x8f, 0x30, 0x82, 0x8c, 0x0b, 0xa4, 0x10, 0x39, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf0 };
+    do
+    {
+      generate_random_bytes_thread_safe(32, bytes);
+    } while (!less32(bytes, limit)); // should be good about 15/16 of the time
+    sc_reduce32(bytes);
+  }
   /* generate a random 32-byte (256-bit) integer and copy it to res */
   static inline void random_scalar(ec_scalar &res) {
-    unsigned char tmp[64];
-    generate_random_bytes_thread_safe(64, tmp);
-    sc_reduce(tmp);
-    memcpy(&res, tmp, 32);
+    random32_unbiased((unsigned char*)res.data);
   }
 
   void hash_to_scalar(const void *data, size_t length, ec_scalar &res) {
diff --git a/src/crypto/crypto.h b/src/crypto/crypto.h
index 9ea0f2ec0..a2d61b04e 100644
--- a/src/crypto/crypto.h
+++ b/src/crypto/crypto.h
@@ -34,7 +34,6 @@
 #include <iostream>
 #include <boost/thread/mutex.hpp>
 #include <boost/thread/lock_guard.hpp>
-#include <boost/utility/value_init.hpp>
 #include <boost/optional.hpp>
 #include <type_traits>
 #include <vector>
@@ -99,6 +98,7 @@ namespace crypto {
 #pragma pack(pop)
 
   void hash_to_scalar(const void *data, size_t length, ec_scalar &res);
+  void random32_unbiased(unsigned char *bytes);
 
   static_assert(sizeof(ec_point) == 32 && sizeof(ec_scalar) == 32 &&
     sizeof(public_key) == 32 && sizeof(secret_key) == 32 &&
@@ -277,8 +277,8 @@ namespace crypto {
     epee::to_hex::formatted(o, epee::as_byte_span(v)); return o;
   }
 
-  const static crypto::public_key null_pkey = boost::value_initialized<crypto::public_key>();
-  const static crypto::secret_key null_skey = boost::value_initialized<crypto::secret_key>();
+  const extern crypto::public_key null_pkey;
+  const extern crypto::secret_key null_skey;
 }
 
 CRYPTO_MAKE_HASHABLE(public_key)