Andreas Hocevar
339 lines
10 KiB
JavaScript
339 lines
10 KiB
JavaScript
// Copyright 2012 The Closure Library Authors. All Rights Reserved.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS-IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
/**
|
|
* @fileoverview Base class for SHA-2 cryptographic hash.
|
|
*
|
|
* Variable names follow the notation in FIPS PUB 180-3:
|
|
* http://csrc.nist.gov/publications/fips/fips180-3/fips180-3_final.pdf.
|
|
*
|
|
* Some code similar to SHA1 are borrowed from sha1.js written by mschilder@.
|
|
*
|
|
*/
|
|
|
|
goog.provide('goog.crypt.Sha2');
|
|
|
|
goog.require('goog.array');
|
|
goog.require('goog.asserts');
|
|
goog.require('goog.crypt.Hash');
|
|
|
|
|
|
|
|
/**
|
|
* SHA-2 cryptographic hash constructor.
|
|
* This constructor should not be used directly to create the object. Rather,
|
|
* one should use the constructor of the sub-classes.
|
|
* @param {number} numHashBlocks The size of output in 16-byte blocks.
|
|
* @param {!Array<number>} initHashBlocks The hash-specific initialization
|
|
* @constructor
|
|
* @extends {goog.crypt.Hash}
|
|
* @struct
|
|
*/
|
|
goog.crypt.Sha2 = function(numHashBlocks, initHashBlocks) {
|
|
goog.crypt.Sha2.base(this, 'constructor');
|
|
|
|
this.blockSize = goog.crypt.Sha2.BLOCKSIZE_;
|
|
|
|
/**
|
|
* A chunk holding the currently processed message bytes. Once the chunk has
|
|
* 64 bytes, we feed it into computeChunk_ function and reset this.chunk_.
|
|
* @private {!Array<number>|!Uint8Array}
|
|
*/
|
|
this.chunk_ = goog.global['Uint8Array'] ?
|
|
new Uint8Array(this.blockSize) : new Array(this.blockSize);
|
|
|
|
/**
|
|
* Current number of bytes in this.chunk_.
|
|
* @private {number}
|
|
*/
|
|
this.inChunk_ = 0;
|
|
|
|
/**
|
|
* Total number of bytes in currently processed message.
|
|
* @private {number}
|
|
*/
|
|
this.total_ = 0;
|
|
|
|
|
|
/**
|
|
* Holds the previous values of accumulated hash a-h in the computeChunk_
|
|
* function.
|
|
* @private {!Array<number>|!Int32Array}
|
|
*/
|
|
this.hash_ = [];
|
|
|
|
/**
|
|
* The number of output hash blocks (each block is 4 bytes long).
|
|
* @private {number}
|
|
*/
|
|
this.numHashBlocks_ = numHashBlocks;
|
|
|
|
/**
|
|
* @private {!Array<number>} initHashBlocks
|
|
*/
|
|
this.initHashBlocks_ = initHashBlocks;
|
|
|
|
/**
|
|
* Temporary array used in chunk computation. Allocate here as a
|
|
* member rather than as a local within computeChunk_() as a
|
|
* performance optimization to reduce the number of allocations and
|
|
* reduce garbage collection.
|
|
* @private {!Int32Array|!Array<number>}
|
|
*/
|
|
this.w_ = goog.global['Int32Array'] ? new Int32Array(64) : new Array(64);
|
|
|
|
if (!goog.isDef(goog.crypt.Sha2.Kx_)) {
|
|
// This is the first time this constructor has been called.
|
|
if (goog.global['Int32Array']) {
|
|
// Typed arrays exist
|
|
goog.crypt.Sha2.Kx_ = new Int32Array(goog.crypt.Sha2.K_);
|
|
} else {
|
|
// Typed arrays do not exist
|
|
goog.crypt.Sha2.Kx_ = goog.crypt.Sha2.K_;
|
|
}
|
|
}
|
|
|
|
this.reset();
|
|
};
|
|
goog.inherits(goog.crypt.Sha2, goog.crypt.Hash);
|
|
|
|
|
|
/**
|
|
* The block size
|
|
* @private {number}
|
|
*/
|
|
goog.crypt.Sha2.BLOCKSIZE_ = 512 / 8;
|
|
|
|
|
|
/**
|
|
* Contains data needed to pad messages less than BLOCK_SIZE_ bytes.
|
|
* @private {!Array<number>}
|
|
*/
|
|
goog.crypt.Sha2.PADDING_ = goog.array.concat(128,
|
|
goog.array.repeat(0, goog.crypt.Sha2.BLOCKSIZE_ - 1));
|
|
|
|
|
|
/** @override */
|
|
goog.crypt.Sha2.prototype.reset = function() {
|
|
this.inChunk_ = 0;
|
|
this.total_ = 0;
|
|
this.hash_ = goog.global['Int32Array'] ?
|
|
new Int32Array(this.initHashBlocks_) :
|
|
goog.array.clone(this.initHashBlocks_);
|
|
};
|
|
|
|
|
|
/**
|
|
* Helper function to compute the hashes for a given 512-bit message chunk.
|
|
* @private
|
|
*/
|
|
goog.crypt.Sha2.prototype.computeChunk_ = function() {
|
|
var chunk = this.chunk_;
|
|
goog.asserts.assert(chunk.length == this.blockSize);
|
|
var rounds = 64;
|
|
|
|
// Divide the chunk into 16 32-bit-words.
|
|
var w = this.w_;
|
|
var index = 0;
|
|
var offset = 0;
|
|
while (offset < chunk.length) {
|
|
w[index++] = (chunk[offset] << 24) |
|
|
(chunk[offset + 1] << 16) |
|
|
(chunk[offset + 2] << 8) |
|
|
(chunk[offset + 3]);
|
|
offset = index * 4;
|
|
}
|
|
|
|
// Extend the w[] array to be the number of rounds.
|
|
for (var i = 16; i < rounds; i++) {
|
|
var w_15 = w[i - 15] | 0;
|
|
var s0 = ((w_15 >>> 7) | (w_15 << 25)) ^
|
|
((w_15 >>> 18) | (w_15 << 14)) ^
|
|
(w_15 >>> 3);
|
|
var w_2 = w[i - 2] | 0;
|
|
var s1 = ((w_2 >>> 17) | (w_2 << 15)) ^
|
|
((w_2 >>> 19) | (w_2 << 13)) ^
|
|
(w_2 >>> 10);
|
|
|
|
// As a performance optimization, construct the sum a pair at a time
|
|
// with casting to integer (bitwise OR) to eliminate unnecessary
|
|
// double<->integer conversions.
|
|
var partialSum1 = ((w[i - 16] | 0) + s0) | 0;
|
|
var partialSum2 = ((w[i - 7] | 0) + s1) | 0;
|
|
w[i] = (partialSum1 + partialSum2) | 0;
|
|
}
|
|
|
|
var a = this.hash_[0] | 0;
|
|
var b = this.hash_[1] | 0;
|
|
var c = this.hash_[2] | 0;
|
|
var d = this.hash_[3] | 0;
|
|
var e = this.hash_[4] | 0;
|
|
var f = this.hash_[5] | 0;
|
|
var g = this.hash_[6] | 0;
|
|
var h = this.hash_[7] | 0;
|
|
for (var i = 0; i < rounds; i++) {
|
|
var S0 = ((a >>> 2) | (a << 30)) ^
|
|
((a >>> 13) | (a << 19)) ^
|
|
((a >>> 22) | (a << 10));
|
|
var maj = ((a & b) ^ (a & c) ^ (b & c));
|
|
var t2 = (S0 + maj) | 0;
|
|
var S1 = ((e >>> 6) | (e << 26)) ^
|
|
((e >>> 11) | (e << 21)) ^
|
|
((e >>> 25) | (e << 7));
|
|
var ch = ((e & f) ^ ((~ e) & g));
|
|
|
|
// As a performance optimization, construct the sum a pair at a time
|
|
// with casting to integer (bitwise OR) to eliminate unnecessary
|
|
// double<->integer conversions.
|
|
var partialSum1 = (h + S1) | 0;
|
|
var partialSum2 = (ch + (goog.crypt.Sha2.Kx_[i] | 0)) | 0;
|
|
var partialSum3 = (partialSum2 + (w[i] | 0)) | 0;
|
|
var t1 = (partialSum1 + partialSum3) | 0;
|
|
|
|
h = g;
|
|
g = f;
|
|
f = e;
|
|
e = (d + t1) | 0;
|
|
d = c;
|
|
c = b;
|
|
b = a;
|
|
a = (t1 + t2) | 0;
|
|
}
|
|
|
|
this.hash_[0] = (this.hash_[0] + a) | 0;
|
|
this.hash_[1] = (this.hash_[1] + b) | 0;
|
|
this.hash_[2] = (this.hash_[2] + c) | 0;
|
|
this.hash_[3] = (this.hash_[3] + d) | 0;
|
|
this.hash_[4] = (this.hash_[4] + e) | 0;
|
|
this.hash_[5] = (this.hash_[5] + f) | 0;
|
|
this.hash_[6] = (this.hash_[6] + g) | 0;
|
|
this.hash_[7] = (this.hash_[7] + h) | 0;
|
|
};
|
|
|
|
|
|
/** @override */
|
|
goog.crypt.Sha2.prototype.update = function(message, opt_length) {
|
|
if (!goog.isDef(opt_length)) {
|
|
opt_length = message.length;
|
|
}
|
|
// Process the message from left to right up to |opt_length| bytes.
|
|
// When we get a 512-bit chunk, compute the hash of it and reset
|
|
// this.chunk_. The message might not be multiple of 512 bits so we
|
|
// might end up with a chunk that is less than 512 bits. We store
|
|
// such partial chunk in this.chunk_ and it will be filled up later
|
|
// in digest().
|
|
var n = 0;
|
|
var inChunk = this.inChunk_;
|
|
|
|
// The input message could be either byte array of string.
|
|
if (goog.isString(message)) {
|
|
while (n < opt_length) {
|
|
this.chunk_[inChunk++] = message.charCodeAt(n++);
|
|
if (inChunk == this.blockSize) {
|
|
this.computeChunk_();
|
|
inChunk = 0;
|
|
}
|
|
}
|
|
} else if (goog.isArrayLike(message)) {
|
|
while (n < opt_length) {
|
|
var b = message[n++];
|
|
if (!('number' == typeof b && 0 <= b && 255 >= b && b == (b | 0))) {
|
|
throw Error('message must be a byte array');
|
|
}
|
|
this.chunk_[inChunk++] = b;
|
|
if (inChunk == this.blockSize) {
|
|
this.computeChunk_();
|
|
inChunk = 0;
|
|
}
|
|
}
|
|
} else {
|
|
throw Error('message must be string or array');
|
|
}
|
|
|
|
// Record the current bytes in chunk to support partial update.
|
|
this.inChunk_ = inChunk;
|
|
|
|
// Record total message bytes we have processed so far.
|
|
this.total_ += opt_length;
|
|
};
|
|
|
|
|
|
/** @override */
|
|
goog.crypt.Sha2.prototype.digest = function() {
|
|
var digest = [];
|
|
var totalBits = this.total_ * 8;
|
|
|
|
// Append pad 0x80 0x00*.
|
|
if (this.inChunk_ < 56) {
|
|
this.update(goog.crypt.Sha2.PADDING_, 56 - this.inChunk_);
|
|
} else {
|
|
this.update(goog.crypt.Sha2.PADDING_,
|
|
this.blockSize - (this.inChunk_ - 56));
|
|
}
|
|
|
|
// Append # bits in the 64-bit big-endian format.
|
|
for (var i = 63; i >= 56; i--) {
|
|
this.chunk_[i] = totalBits & 255;
|
|
totalBits /= 256; // Don't use bit-shifting here!
|
|
}
|
|
this.computeChunk_();
|
|
|
|
// Finally, output the result digest.
|
|
var n = 0;
|
|
for (var i = 0; i < this.numHashBlocks_; i++) {
|
|
for (var j = 24; j >= 0; j -= 8) {
|
|
digest[n++] = ((this.hash_[i] >> j) & 255);
|
|
}
|
|
}
|
|
return digest;
|
|
};
|
|
|
|
|
|
/**
|
|
* Constants used in SHA-2.
|
|
* @const
|
|
* @private {!Array<number>}
|
|
*/
|
|
goog.crypt.Sha2.K_ = [
|
|
0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
|
|
0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
|
|
0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
|
|
0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
|
|
0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
|
|
0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
|
|
0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
|
|
0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
|
|
0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
|
|
0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
|
|
0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3,
|
|
0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
|
|
0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5,
|
|
0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
|
|
0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
|
|
0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
|
|
];
|
|
|
|
|
|
/**
|
|
* Sha2.K as an Int32Array if this JS supports typed arrays; otherwise,
|
|
* the same array as Sha2.K.
|
|
*
|
|
* The compiler cannot remove an Int32Array, even if it is not needed
|
|
* (There are certain cases where creating an Int32Array is not
|
|
* side-effect free). Instead, the first time we construct a Sha2
|
|
* instance, we convert or assign Sha2.K as appropriate.
|
|
* @private {undefined|!Array<number>|!Int32Array}
|
|
*/
|
|
goog.crypt.Sha2.Kx_;
|