jssha
Version:
jsSHA implements the complete Secure Hash Standard (SHA) family (SHA-1, SHA-224/256/384/512, SHA3-224/256/384/512, SHAKE128/256, cSHAKE128/256, and KMAC128/256) with HMAC
328 lines (306 loc) • 10.6 kB
text/typescript
import { jsSHABase, TWO_PWR_32, H_trunc, H_full, K_sha2, sha_variant_error, parseInputOption } from "./common";
import {
packedValue,
FixedLengthOptionsEncodingType,
FixedLengthOptionsNoEncodingType,
FormatNoTextType,
} from "./custom_types";
import { getStrConverter } from "./converters";
import {
ch_64,
gamma0_64,
gamma1_64,
Int_64,
maj_64,
safeAdd_64_2,
safeAdd_64_4,
safeAdd_64_5,
sigma0_64,
sigma1_64,
} from "./primitives_64";
type VariantType = "SHA-384" | "SHA-512";
const K_sha512 = [
new Int_64(K_sha2[0], 0xd728ae22),
new Int_64(K_sha2[1], 0x23ef65cd),
new Int_64(K_sha2[2], 0xec4d3b2f),
new Int_64(K_sha2[3], 0x8189dbbc),
new Int_64(K_sha2[4], 0xf348b538),
new Int_64(K_sha2[5], 0xb605d019),
new Int_64(K_sha2[6], 0xaf194f9b),
new Int_64(K_sha2[7], 0xda6d8118),
new Int_64(K_sha2[8], 0xa3030242),
new Int_64(K_sha2[9], 0x45706fbe),
new Int_64(K_sha2[10], 0x4ee4b28c),
new Int_64(K_sha2[11], 0xd5ffb4e2),
new Int_64(K_sha2[12], 0xf27b896f),
new Int_64(K_sha2[13], 0x3b1696b1),
new Int_64(K_sha2[14], 0x25c71235),
new Int_64(K_sha2[15], 0xcf692694),
new Int_64(K_sha2[16], 0x9ef14ad2),
new Int_64(K_sha2[17], 0x384f25e3),
new Int_64(K_sha2[18], 0x8b8cd5b5),
new Int_64(K_sha2[19], 0x77ac9c65),
new Int_64(K_sha2[20], 0x592b0275),
new Int_64(K_sha2[21], 0x6ea6e483),
new Int_64(K_sha2[22], 0xbd41fbd4),
new Int_64(K_sha2[23], 0x831153b5),
new Int_64(K_sha2[24], 0xee66dfab),
new Int_64(K_sha2[25], 0x2db43210),
new Int_64(K_sha2[26], 0x98fb213f),
new Int_64(K_sha2[27], 0xbeef0ee4),
new Int_64(K_sha2[28], 0x3da88fc2),
new Int_64(K_sha2[29], 0x930aa725),
new Int_64(K_sha2[30], 0xe003826f),
new Int_64(K_sha2[31], 0x0a0e6e70),
new Int_64(K_sha2[32], 0x46d22ffc),
new Int_64(K_sha2[33], 0x5c26c926),
new Int_64(K_sha2[34], 0x5ac42aed),
new Int_64(K_sha2[35], 0x9d95b3df),
new Int_64(K_sha2[36], 0x8baf63de),
new Int_64(K_sha2[37], 0x3c77b2a8),
new Int_64(K_sha2[38], 0x47edaee6),
new Int_64(K_sha2[39], 0x1482353b),
new Int_64(K_sha2[40], 0x4cf10364),
new Int_64(K_sha2[41], 0xbc423001),
new Int_64(K_sha2[42], 0xd0f89791),
new Int_64(K_sha2[43], 0x0654be30),
new Int_64(K_sha2[44], 0xd6ef5218),
new Int_64(K_sha2[45], 0x5565a910),
new Int_64(K_sha2[46], 0x5771202a),
new Int_64(K_sha2[47], 0x32bbd1b8),
new Int_64(K_sha2[48], 0xb8d2d0c8),
new Int_64(K_sha2[49], 0x5141ab53),
new Int_64(K_sha2[50], 0xdf8eeb99),
new Int_64(K_sha2[51], 0xe19b48a8),
new Int_64(K_sha2[52], 0xc5c95a63),
new Int_64(K_sha2[53], 0xe3418acb),
new Int_64(K_sha2[54], 0x7763e373),
new Int_64(K_sha2[55], 0xd6b2b8a3),
new Int_64(K_sha2[56], 0x5defb2fc),
new Int_64(K_sha2[57], 0x43172f60),
new Int_64(K_sha2[58], 0xa1f0ab72),
new Int_64(K_sha2[59], 0x1a6439ec),
new Int_64(K_sha2[60], 0x23631e28),
new Int_64(K_sha2[61], 0xde82bde9),
new Int_64(K_sha2[62], 0xb2c67915),
new Int_64(K_sha2[63], 0xe372532b),
new Int_64(0xca273ece, 0xea26619c),
new Int_64(0xd186b8c7, 0x21c0c207),
new Int_64(0xeada7dd6, 0xcde0eb1e),
new Int_64(0xf57d4f7f, 0xee6ed178),
new Int_64(0x06f067aa, 0x72176fba),
new Int_64(0x0a637dc5, 0xa2c898a6),
new Int_64(0x113f9804, 0xbef90dae),
new Int_64(0x1b710b35, 0x131c471b),
new Int_64(0x28db77f5, 0x23047d84),
new Int_64(0x32caab7b, 0x40c72493),
new Int_64(0x3c9ebe0a, 0x15c9bebc),
new Int_64(0x431d67c4, 0x9c100d4c),
new Int_64(0x4cc5d4be, 0xcb3e42b6),
new Int_64(0x597f299c, 0xfc657e2a),
new Int_64(0x5fcb6fab, 0x3ad6faec),
new Int_64(0x6c44198c, 0x4a475817),
];
/**
* Gets the state values for the specified SHA variant.
*
* @param variant: The SHA-512 family variant.
* @returns The initial state values.
*/
function getNewState512(variant: VariantType): Int_64[] {
if ("SHA-384" === variant) {
return [
new Int_64(0xcbbb9d5d, H_trunc[0]),
new Int_64(0x0629a292a, H_trunc[1]),
new Int_64(0x9159015a, H_trunc[2]),
new Int_64(0x0152fecd8, H_trunc[3]),
new Int_64(0x67332667, H_trunc[4]),
new Int_64(0x98eb44a87, H_trunc[5]),
new Int_64(0xdb0c2e0d, H_trunc[6]),
new Int_64(0x047b5481d, H_trunc[7]),
];
} else {
/* SHA-512 */
return [
new Int_64(H_full[0], 0xf3bcc908),
new Int_64(H_full[1], 0x84caa73b),
new Int_64(H_full[2], 0xfe94f82b),
new Int_64(H_full[3], 0x5f1d36f1),
new Int_64(H_full[4], 0xade682d1),
new Int_64(H_full[5], 0x2b3e6c1f),
new Int_64(H_full[6], 0xfb41bd6b),
new Int_64(H_full[7], 0x137e2179),
];
}
}
/**
* Performs a round of SHA-512 hashing over a block. This clobbers `H`.
*
* @param block The binary array representation of the block to hash.
* @param H The intermediate H values from a previous round.
* @returns The resulting H values.
*/
function roundSHA512(block: number[], H: Int_64[]): Int_64[] {
let a, b, c, d, e, f, g, h, T1, T2, t, offset;
const W: Int_64[] = [];
a = H[0];
b = H[1];
c = H[2];
d = H[3];
e = H[4];
f = H[5];
g = H[6];
h = H[7];
for (t = 0; t < 80; t += 1) {
if (t < 16) {
offset = t * 2;
W[t] = new Int_64(block[offset], block[offset + 1]);
} else {
W[t] = safeAdd_64_4(gamma1_64(W[t - 2]), W[t - 7], gamma0_64(W[t - 15]), W[t - 16]);
}
T1 = safeAdd_64_5(h, sigma1_64(e), ch_64(e, f, g), K_sha512[t], W[t]);
T2 = safeAdd_64_2(sigma0_64(a), maj_64(a, b, c));
h = g;
g = f;
f = e;
e = safeAdd_64_2(d, T1);
d = c;
c = b;
b = a;
a = safeAdd_64_2(T1, T2);
}
H[0] = safeAdd_64_2(a, H[0]);
H[1] = safeAdd_64_2(b, H[1]);
H[2] = safeAdd_64_2(c, H[2]);
H[3] = safeAdd_64_2(d, H[3]);
H[4] = safeAdd_64_2(e, H[4]);
H[5] = safeAdd_64_2(f, H[5]);
H[6] = safeAdd_64_2(g, H[6]);
H[7] = safeAdd_64_2(h, H[7]);
return H;
}
/**
* Finalizes the SHA-512 hash. This clobbers `remainder` and `H`.
*
* @param remainder Any leftover unprocessed packed ints that still need to be processed.
* @param remainderBinLen The number of bits in `remainder`.
* @param processedBinLen The number of bits already processed.
* @param H The intermediate H values from a previous round.
* @param variant The desired SHA-512 variant.
* @returns The array of integers representing the SHA-512 hash of message.
*/
function finalizeSHA512(
remainder: number[],
remainderBinLen: number,
processedBinLen: number,
H: Int_64[],
variant: VariantType
): number[] {
let i, retVal;
/* The 129 addition is a hack but it works. The correct number is
actually 136 (128 + 8) but the below math fails if
remainderBinLen + 136 % 1024 = 0. Since remainderBinLen % 8 = 0,
"shorting" the addition is OK. */
const offset = (((remainderBinLen + 129) >>> 10) << 5) + 31,
binaryStringInc = 32,
totalLen = remainderBinLen + processedBinLen;
while (remainder.length <= offset) {
remainder.push(0);
}
/* Append '1' at the end of the binary string */
remainder[remainderBinLen >>> 5] |= 0x80 << (24 - (remainderBinLen % 32));
/* Append length of binary string in the position such that the new
* length is correct. JavaScript numbers are limited to 2^53 so it's
* "safe" to treat the totalLen as a 64-bit integer. */
remainder[offset] = totalLen & 0xffffffff;
/* Bitwise operators treat the operand as a 32-bit number so need to
* use hacky division and round to get access to upper 32-ish bits */
remainder[offset - 1] = (totalLen / TWO_PWR_32) | 0;
/* This will always be at least 1 full chunk */
for (i = 0; i < remainder.length; i += binaryStringInc) {
H = roundSHA512(remainder.slice(i, i + binaryStringInc), H);
}
if ("SHA-384" === variant) {
H = (H as unknown) as Int_64[];
retVal = [
H[0].highOrder,
H[0].lowOrder,
H[1].highOrder,
H[1].lowOrder,
H[2].highOrder,
H[2].lowOrder,
H[3].highOrder,
H[3].lowOrder,
H[4].highOrder,
H[4].lowOrder,
H[5].highOrder,
H[5].lowOrder,
];
} else {
/* SHA-512 */
retVal = [
H[0].highOrder,
H[0].lowOrder,
H[1].highOrder,
H[1].lowOrder,
H[2].highOrder,
H[2].lowOrder,
H[3].highOrder,
H[3].lowOrder,
H[4].highOrder,
H[4].lowOrder,
H[5].highOrder,
H[5].lowOrder,
H[6].highOrder,
H[6].lowOrder,
H[7].highOrder,
H[7].lowOrder,
];
}
return retVal;
}
export default class jsSHA extends jsSHABase<Int_64[], VariantType> {
intermediateState: Int_64[];
variantBlockSize: number;
bigEndianMod: -1 | 1;
outputBinLen: number;
isVariableLen: boolean;
HMACSupported: boolean;
/* eslint-disable-next-line @typescript-eslint/no-explicit-any */
converterFunc: (input: any, existingBin: number[], existingBinLen: number) => packedValue;
roundFunc: (block: number[], H: Int_64[]) => Int_64[];
finalizeFunc: (remainder: number[], remainderBinLen: number, processedBinLen: number, H: Int_64[]) => number[];
stateCloneFunc: (state: Int_64[]) => Int_64[];
newStateFunc: (variant: VariantType) => Int_64[];
getMAC: () => number[];
constructor(variant: VariantType, inputFormat: "TEXT", options?: FixedLengthOptionsEncodingType);
constructor(variant: VariantType, inputFormat: FormatNoTextType, options?: FixedLengthOptionsNoEncodingType);
// eslint-disable-next-line @typescript-eslint/no-explicit-any
constructor(variant: any, inputFormat: any, options?: any) {
if (!("SHA-384" === variant || "SHA-512" === variant)) {
throw new Error(sha_variant_error);
}
super(variant, inputFormat, options);
const resolvedOptions = options || {};
// eslint-disable-next-line @typescript-eslint/unbound-method
this.getMAC = this._getHMAC;
this.HMACSupported = true;
this.bigEndianMod = -1;
this.converterFunc = getStrConverter(this.inputFormat, this.utfType, this.bigEndianMod);
this.roundFunc = roundSHA512;
this.stateCloneFunc = function (state): Int_64[] {
return state.slice();
};
this.newStateFunc = getNewState512;
this.finalizeFunc = function (remainder, remainderBinLen, processedBinLen, H): number[] {
return finalizeSHA512(remainder, remainderBinLen, processedBinLen, H, variant);
};
this.intermediateState = getNewState512(variant);
this.variantBlockSize = 1024;
this.outputBinLen = "SHA-384" === variant ? 384 : 512;
this.isVariableLen = false;
if (resolvedOptions["hmacKey"]) {
this._setHMACKey(parseInputOption("hmacKey", resolvedOptions["hmacKey"], this.bigEndianMod));
}
}
}