1 /*
   2  * Copyright (c) 2002, 2013, Oracle and/or its affiliates. All rights reserved.
   3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   4  *
   5  * This code is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License version 2 only, as
   7  * published by the Free Software Foundation.  Oracle designates this
   8  * particular file as subject to the "Classpath" exception as provided
   9  * by Oracle in the LICENSE file that accompanied this code.
  10  *
  11  * This code is distributed in the hope that it will be useful, but WITHOUT
  12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * version 2 for more details (a copy is included in the LICENSE file that
  15  * accompanied this code).
  16  *
  17  * You should have received a copy of the GNU General Public License version
  18  * 2 along with this work; if not, write to the Free Software Foundation,
  19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  20  *
  21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  22  * or visit www.oracle.com if you need additional information or have any
  23  * questions.
  24  */
  25 
  26 package sun.security.provider;
  27 
  28 import java.util.Objects;
  29 
  30 import jdk.internal.HotSpotIntrinsicCandidate;
  31 import static sun.security.provider.ByteArrayAccess.*;
  32 
  33 /**
  34  * This class implements the Secure Hash Algorithm SHA-256 developed by
  35  * the National Institute of Standards and Technology along with the
  36  * National Security Agency.
  37  *
  38  * <p>It implements java.security.MessageDigestSpi, and can be used
  39  * through Java Cryptography Architecture (JCA), as a pluggable
  40  * MessageDigest implementation.
  41  *
  42  * @since       1.4.2
  43  * @author      Valerie Peng
  44  * @author      Andreas Sterbenz
  45  */
  46 abstract class SHA2 extends DigestBase {
  47 
  48     private static final int ITERATION = 64;
  49     // Constants for each round
  50     private static final int[] ROUND_CONSTS = {
  51         0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
  52         0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
  53         0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
  54         0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
  55         0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
  56         0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
  57         0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
  58         0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
  59         0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
  60         0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
  61         0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3,
  62         0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
  63         0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5,
  64         0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
  65         0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
  66         0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
  67     };
  68 
  69     // buffer used by implCompress()
  70     private int[] W;
  71 
  72     // state of this object
  73     private int[] state;
  74 
  75     // initial state value. different between SHA-224 and SHA-256
  76     private final int[] initialHashes;
  77 
  78     /**
  79      * Creates a new SHA object.
  80      */
  81     SHA2(String name, int digestLength, int[] initialHashes) {
  82         super(name, digestLength, 64);
  83         this.initialHashes = initialHashes;
  84         state = new int[8];
  85         W = new int[64];
  86         implReset();
  87     }
  88 
  89     /**
  90      * Resets the buffers and hash value to start a new hash.
  91      */
  92     void implReset() {
  93         System.arraycopy(initialHashes, 0, state, 0, state.length);
  94     }
  95 
  96     void implDigest(byte[] out, int ofs) {
  97         long bitsProcessed = bytesProcessed << 3;
  98 
  99         int index = (int)bytesProcessed & 0x3f;
 100         int padLen = (index < 56) ? (56 - index) : (120 - index);
 101         engineUpdate(padding, 0, padLen);
 102 
 103         i2bBig4((int)(bitsProcessed >>> 32), buffer, 56);
 104         i2bBig4((int)bitsProcessed, buffer, 60);
 105         implCompress(buffer, 0);
 106 
 107         i2bBig(state, 0, out, ofs, engineGetDigestLength());
 108     }
 109 
 110     /**
 111      * logical function ch(x,y,z) as defined in spec:
 112      * @return (x and y) xor ((complement x) and z)
 113      * @param x int
 114      * @param y int
 115      * @param z int
 116      */
 117     private static int lf_ch(int x, int y, int z) {
 118         return (x & y) ^ ((~x) & z);
 119     }
 120 
 121     /**
 122      * logical function maj(x,y,z) as defined in spec:
 123      * @return (x and y) xor (x and z) xor (y and z)
 124      * @param x int
 125      * @param y int
 126      * @param z int
 127      */
 128     private static int lf_maj(int x, int y, int z) {
 129         return (x & y) ^ (x & z) ^ (y & z);
 130     }
 131 
 132     /**
 133      * logical function R(x,s) - right shift
 134      * @return x right shift for s times
 135      * @param x int
 136      * @param s int
 137      */
 138     private static int lf_R( int x, int s ) {
 139         return (x >>> s);
 140     }
 141 
 142     /**
 143      * logical function S(x,s) - right rotation
 144      * @return x circular right shift for s times
 145      * @param x int
 146      * @param s int
 147      */
 148     private static int lf_S(int x, int s) {
 149         return (x >>> s) | (x << (32 - s));
 150     }
 151 
 152     /**
 153      * logical function sigma0(x) - xor of results of right rotations
 154      * @return S(x,2) xor S(x,13) xor S(x,22)
 155      * @param x int
 156      */
 157     private static int lf_sigma0(int x) {
 158         return lf_S(x, 2) ^ lf_S(x, 13) ^ lf_S(x, 22);
 159     }
 160 
 161     /**
 162      * logical function sigma1(x) - xor of results of right rotations
 163      * @return S(x,6) xor S(x,11) xor S(x,25)
 164      * @param x int
 165      */
 166     private static int lf_sigma1(int x) {
 167         return lf_S( x, 6 ) ^ lf_S( x, 11 ) ^ lf_S( x, 25 );
 168     }
 169 
 170     /**
 171      * logical function delta0(x) - xor of results of right shifts/rotations
 172      * @return int
 173      * @param x int
 174      */
 175     private static int lf_delta0(int x) {
 176         return lf_S(x, 7) ^ lf_S(x, 18) ^ lf_R(x, 3);
 177     }
 178 
 179     /**
 180      * logical function delta1(x) - xor of results of right shifts/rotations
 181      * @return int
 182      * @param x int
 183      */
 184     private static int lf_delta1(int x) {
 185         return lf_S(x, 17) ^ lf_S(x, 19) ^ lf_R(x, 10);
 186     }
 187 
 188     /**
 189      * Process the current block to update the state variable state.
 190      */
 191     void implCompress(byte[] buf, int ofs) {
 192         implCompressCheck(buf, ofs);
 193         implCompress0(buf, ofs);
 194     }
 195 
 196     private void implCompressCheck(byte[] buf, int ofs) {
 197         Objects.requireNonNull(buf);
 198 
 199         // The checks performed by the method 'b2iBig64'
 200         // are sufficient for the case when the method
 201         // 'implCompressImpl' is replaced with a compiler
 202         // intrinsic.
 203         b2iBig64(buf, ofs, W);
 204     }
 205 
 206     // The method 'implCompressImpl' seems not to use its parameters.
 207     // The method can, however, be replaced with a compiler intrinsic
 208     // that operates directly on the array 'buf' (starting from
 209     // offset 'ofs') and not on array 'W', therefore 'buf' and 'ofs'
 210     // must be passed as parameter to the method.
 211     @HotSpotIntrinsicCandidate
 212     private void implCompress0(byte[] buf, int ofs) {
 213         // The first 16 ints are from the byte stream, compute the rest of
 214         // the W[]'s
 215         for (int t = 16; t < ITERATION; t++) {
 216             W[t] = lf_delta1(W[t-2]) + W[t-7] + lf_delta0(W[t-15])
 217                    + W[t-16];
 218         }
 219 
 220         int a = state[0];
 221         int b = state[1];
 222         int c = state[2];
 223         int d = state[3];
 224         int e = state[4];
 225         int f = state[5];
 226         int g = state[6];
 227         int h = state[7];
 228 
 229         for (int i = 0; i < ITERATION; i++) {
 230             int T1 = h + lf_sigma1(e) + lf_ch(e,f,g) + ROUND_CONSTS[i] + W[i];
 231             int T2 = lf_sigma0(a) + lf_maj(a,b,c);
 232             h = g;
 233             g = f;
 234             f = e;
 235             e = d + T1;
 236             d = c;
 237             c = b;
 238             b = a;
 239             a = T1 + T2;
 240         }
 241         state[0] += a;
 242         state[1] += b;
 243         state[2] += c;
 244         state[3] += d;
 245         state[4] += e;
 246         state[5] += f;
 247         state[6] += g;
 248         state[7] += h;
 249     }
 250 
 251     public Object clone() throws CloneNotSupportedException {
 252         SHA2 copy = (SHA2) super.clone();
 253         copy.state = copy.state.clone();
 254         copy.W = new int[64];
 255         return copy;
 256     }
 257 
 258     /**
 259      * SHA-224 implementation class.
 260      */
 261     public static final class SHA224 extends SHA2 {
 262         private static final int[] INITIAL_HASHES = {
 263             0xc1059ed8, 0x367cd507, 0x3070dd17, 0xf70e5939,
 264             0xffc00b31, 0x68581511, 0x64f98fa7, 0xbefa4fa4
 265         };
 266 
 267         public SHA224() {
 268             super("SHA-224", 28, INITIAL_HASHES);
 269         }
 270     }
 271 
 272     /**
 273      * SHA-256 implementation class.
 274      */
 275     public static final class SHA256 extends SHA2 {
 276         private static final int[] INITIAL_HASHES = {
 277             0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
 278             0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19
 279         };
 280 
 281         public SHA256() {
 282             super("SHA-256", 32, INITIAL_HASHES);
 283         }
 284     }
 285 }