--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/src/java.base/share/classes/sun/security/provider/HashDrbg.java Tue Sep 12 19:03:39 2017 +0200
@@ -0,0 +1,287 @@
+/*
+ * Copyright (c) 2016, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation. Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package sun.security.provider;
+
+import java.math.BigInteger;
+import java.security.DigestException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.NoSuchProviderException;
+import java.security.SecureRandomParameters;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+public class HashDrbg extends AbstractHashDrbg {
+
+ private static final byte[] ZERO = new byte[1];
+ private static final byte[] ONE = new byte[]{1};
+
+ private MessageDigest digest;
+
+ private byte[] v;
+ private byte[] c;
+
+ public HashDrbg(SecureRandomParameters params) {
+ mechName = "Hash_DRBG";
+ configure(params);
+ }
+
+ /**
+ * This call, used by the constructors, instantiates the digest.
+ */
+ @Override
+ protected void initEngine() {
+ try {
+ /*
+ * Use the local SUN implementation to avoid native
+ * performance overhead.
+ */
+ digest = MessageDigest.getInstance(algorithm, "SUN");
+ } catch (NoSuchProviderException | NoSuchAlgorithmException e) {
+ // Fallback to any available.
+ try {
+ digest = MessageDigest.getInstance(algorithm);
+ } catch (NoSuchAlgorithmException exc) {
+ throw new InternalError(
+ "internal error: " + algorithm + " not available.", exc);
+ }
+ }
+ }
+
+ private byte[] hashDf(int requested, List<byte[]> inputs) {
+ return hashDf(digest, outLen, requested, inputs);
+ }
+
+ /**
+ * A hash-based derivation function defined in NIST SP 800-90Ar1 10.3.1.
+ * The function is used inside Hash_DRBG, and can also be used as an
+ * approved conditioning function as described in 800-90B 6.4.2.2.
+ *
+ * Note: In each current call, requested is seedLen, therefore small,
+ * no need to worry about overflow.
+ *
+ * @param digest a {@code MessageDigest} object in reset state
+ * @param outLen {@link MessageDigest#getDigestLength} of {@code digest}
+ * @param requested requested output length, in bytes
+ * @param inputs input data
+ * @return the condensed/expanded output
+ */
+ public static byte[] hashDf(MessageDigest digest, int outLen,
+ int requested, List<byte[]> inputs) {
+ // 1. temp = the Null string.
+ // 2. len = upper_int(no_of_bits_to_return / outLen)
+ int len = (requested + outLen - 1) / outLen;
+ byte[] temp = new byte[len * outLen];
+ // 3. counter = 0x01
+ int counter = 1;
+
+ // 4. For i = 1 to len do
+ for (int i=0; i<len; i++) {
+ // 4.1 temp = temp
+ // || Hash (counter || no_of_bits_to_return || input_string).
+ digest.update((byte) counter);
+ digest.update((byte)(requested >> 21)); // requested*8 as int32
+ digest.update((byte)(requested >> 13));
+ digest.update((byte)(requested >> 5));
+ digest.update((byte)(requested << 3));
+ for (byte[] input : inputs) {
+ digest.update(input);
+ }
+ try {
+ digest.digest(temp, i * outLen, outLen);
+ } catch (DigestException e) {
+ throw new AssertionError("will not happen", e);
+ }
+ // 4.2 counter = counter + 1
+ counter++;
+ }
+ // 5. requested_bits = leftmost (temp, no_of_bits_to_return).
+ return temp.length == requested? temp: Arrays.copyOf(temp, requested);
+ // 6. Return
+ }
+
+ // This method is used by both instantiation and reseeding.
+ @Override
+ protected final synchronized void hashReseedInternal(List<byte[]> inputs) {
+
+ // 800-90Ar1 10.1.1.2: Instantiate Process.
+ // 800-90Ar1 10.1.1.3: Reseed Process.
+ byte[] seed;
+
+ // Step 2: seed = Hash_df (seed_material, seedlen).
+ if (v != null) {
+ // Step 1 of 10.1.1.3: Prepend 0x01 || V
+ inputs.add(0, ONE);
+ inputs.add(1, v);
+ seed = hashDf(seedLen, inputs);
+ } else {
+ seed = hashDf(seedLen, inputs);
+ }
+
+ // Step 3. V = seed.
+ v = seed;
+
+ // Step 4. C = Hash_df ((0x00 || V), seedlen).
+ inputs = new ArrayList<>(2);
+ inputs.add(ZERO);
+ inputs.add(v);
+ c = hashDf(seedLen, inputs);
+
+ // Step 5. reseed_counter = 1.
+ reseedCounter = 1;
+
+ //status();
+
+ // Step 6: Return
+ }
+
+ private void status() {
+ if (debug != null) {
+ debug.println(this, "V = " + hex(v));
+ debug.println(this, "C = " + hex(c));
+ debug.println(this, "reseed counter = " + reseedCounter);
+ }
+ }
+
+ /**
+ * Adds byte arrays into an existing one.
+ *
+ * @param out existing array
+ * @param data more arrays, can be of different length
+ */
+ private static void addBytes(byte[] out, int len, byte[]... data) {
+ for (byte[] d: data) {
+ int dlen = d.length;
+ int carry = 0;
+ for (int i = 0; i < len; i++) {
+ int sum = (out[len - i - 1] & 0xff) + carry;
+ if (i < dlen) {
+ sum += (d[dlen - i - 1] & 0xff);
+ }
+ out[len - i - 1] = (byte) sum;
+ carry = sum >> 8;
+ if (i >= dlen - 1 && carry == 0) break;
+ }
+ }
+ }
+
+ /**
+ * Generates a user-specified number of random bytes.
+ *
+ * @param result the array to be filled in with random bytes.
+ */
+ @Override
+ public final synchronized void generateAlgorithm(
+ byte[] result, byte[] additionalInput) {
+
+ if (debug != null) {
+ debug.println(this, "generateAlgorithm");
+ }
+
+ // 800-90Ar1 10.1.1.4: Hash_DRBG_Generate Process
+
+ // Step 1: Check reseed_counter. Will not fail. Already checked in
+ // AbstractDrbg#engineNextBytes.
+
+ // Step 2: additional_input
+ if (additionalInput != null) {
+ digest.update((byte)2);
+ digest.update(v);
+ digest.update(additionalInput);
+ addBytes(v, seedLen, digest.digest());
+ }
+
+ // Step 3. Hashgen (requested_number_of_bits, V).
+ hashGen(result, v);
+
+ // Step 4. H = Hash (0x03 || V).
+ digest.update((byte)3);
+ digest.update(v);
+ byte[] h = digest.digest();
+
+ // Step 5. V = (V + H + C + reseed_counter) mod 2seedlen.
+ byte[] rcBytes;
+ if (reseedCounter < 256) {
+ rcBytes = new byte[]{(byte)reseedCounter};
+ } else {
+ rcBytes = BigInteger.valueOf(reseedCounter).toByteArray();
+ }
+ addBytes(v, seedLen, h, c, rcBytes);
+
+ // Step 6. reseed_counter = reseed_counter + 1.
+ reseedCounter++;
+
+ //status();
+
+ // Step 7: Return.
+ }
+
+ // 800-90Ar1 10.1.1.4: Hashgen
+ private void hashGen(byte[] output, byte[] v) {
+
+ // Step 2. data = V
+ byte[] data = v;
+
+ // Step 3: W is output not filled
+
+ // Step 4: For i = 1 to m
+ int pos = 0;
+ int len = output.length;
+
+ while (len > 0) {
+ if (len < outLen) {
+ // Step 4.1 w = Hash (data).
+ // Step 4.2 W = W || w.
+ System.arraycopy(digest.digest(data), 0, output, pos,
+ len);
+ } else {
+ try {
+ // Step 4.1 w = Hash (data).
+ digest.update(data);
+ // Step 4.2 digest into right position, no need to cat
+ digest.digest(output, pos, outLen);
+ } catch (DigestException e) {
+ throw new AssertionError("will not happen", e);
+ }
+ }
+ len -= outLen;
+ if (len <= 0) {
+ // shortcut, so that data and pos needn't be updated
+ break;
+ }
+ // Step 4.3 data = (data + 1) mod 2^seedlen.
+ if (data == v) {
+ data = Arrays.copyOf(v, v.length);
+ }
+ addBytes(data, seedLen, ONE);
+ pos += outLen;
+ }
+
+ // Step 5: No need to truncate
+ // Step 6: Return
+ }
+}