Add implementation of the Fortuna CSPRNG

[apoelstra]

Closes #103.

[apoelstra]

Sorry, the accumulator is not quite correct. I will push another commit which fixes it (and adds a bunch of unit tests verified against the Go and Python implementations of Fortuna). Edit: Fixed.

[apoelstra]

Updated to move counter-increment into its own function, and to remove the Vecs from the pool, using a running Sha256 state instead. This avoids concerns about having entropy stored in RAM and not getting zeroed after use, and also removes all allocations from the Fortuna, always a good thing.

There is some concern about fork-safety, see rust-lang/rust#16799. If your process forks the Fortuna will not see this and you'll get two processes with identical RNG state. Current word from Rust devs is that forking with the stdlib is UB anyway :/.

Thanks ariel for discussion on IRC.

[DaGenix]

When I created rust-crypto, I left this notice on any file that I borrowed from Rust. I think this clause has mostly been omitted on any new files created specifically for rust-crypto, though, since they aren't directly related to the Rust project itself. IANAL, though, so if you feel that this notice is appropriate, just let me know.

[DaGenix]

PRNGs do make me a bit nervous. My concern is that if there are bugs, that it might be a bit harder to notice with a PRNG than with some other algorithms. I'm not sure if that concern is really founded though - Rust-Crypto is already a toolbox with lots of pointy edges. So I would like to merge this if you feel that its ready.

[apoelstra]

I will add a note about the lack of fork resistance. It's unfortunate that we can't do this, because I believe #[no_std] code can fork, and I try to make my library code as allocation-free as possible exactly to support freestanding users. (In this case, with ariel's help there is no allocation at all.)

After that I feel that this is ready for merge.

I share your nervousness about PRNG's. One nice thing though is that a dumb mistake in implementation will cause the output to be catastrophically different, so because I wrote my test code from the output of pycrypto (but did not write my code from theirs!) and got passing tests, that is some assurance. Another nice thing is that this RNG is very simple (the actual generator is just "use AES in CTR mode to get the output, then use it again to reseed" which is a pretty common idiom) and Rust very explicit, so there are no dark corners where I was at all unsure of what was going on...so presumably there is no room for smart mistakes ;)

Edit: Oh, I didn't see your note about the copyright notice. I think you're right that it "rust project devs" doesn't belong there, I've dropped it.

[DaGenix]

Thanks!