1
// Copyright 2005 The Closure Library Authors. All Rights Reserved.
2
//
3
// Licensed under the Apache License, Version 2.0 (the "License");
4
// you may not use this file except in compliance with the License.
5
// You may obtain a copy of the License at
6
//
7
//      http://www.apache.org/licenses/LICENSE-2.0
8
//
9
// Unless required by applicable law or agreed to in writing, software
10
// distributed under the License is distributed on an "AS-IS" BASIS,
11
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12
// See the License for the specific language governing permissions and
13
// limitations under the License.
14

15
/**
16
 * @fileoverview SHA-1 cryptographic hash.
17
 * Variable names follow the notation in FIPS PUB 180-3:
18
 * http://csrc.nist.gov/publications/fips/fips180-3/fips180-3_final.pdf.
19
 *
20
 * Usage:
21
 *   var sha1 = new goog.crypt.sha1();
22
 *   sha1.update(bytes);
23
 *   var hash = sha1.digest();
24
 *
25
 * Performance:
26
 *   Chrome 23:   ~400 Mbit/s
27
 *   Firefox 16:  ~250 Mbit/s
28
 *
29
 */
30

31
goog.provide('goog.crypt.Sha1');
32

33
goog.require('goog.crypt.Hash');
34

35

36

37
/**
38
 * SHA-1 cryptographic hash constructor.
39
 *
40
 * The properties declared here are discussed in the above algorithm document.
41
 * @constructor
42
 * @extends {goog.crypt.Hash}
43
 * @final
44
 * @struct
45
 */
46
goog.crypt.Sha1 = function() {
47
  goog.crypt.Sha1.base(this, 'constructor');
48

49
  this.blockSize = 512 / 8;
50

51
  /**
52
   * Holds the previous values of accumulated variables a-e in the compress_
53
   * function.
54
   * @type {!Array<number>}
55
   * @private
56
   */
57
  this.chain_ = [];
58

59
  /**
60
   * A buffer holding the partially computed hash result.
61
   * @type {!Array<number>}
62
   * @private
63
   */
64
  this.buf_ = [];
65

66
  /**
67
   * An array of 80 bytes, each a part of the message to be hashed.  Referred to
68
   * as the message schedule in the docs.
69
   * @type {!Array<number>}
70
   * @private
71
   */
72
  this.W_ = [];
73

74
  /**
75
   * Contains data needed to pad messages less than 64 bytes.
76
   * @type {!Array<number>}
77
   * @private
78
   */
79
  this.pad_ = [];
80

81
  this.pad_[0] = 128;
82
  for (var i = 1; i < this.blockSize; ++i) {
83
    this.pad_[i] = 0;
84
  }
85

86
  /**
87
   * @private {number}
88
   */
89
  this.inbuf_ = 0;
90

91
  /**
92
   * @private {number}
93
   */
94
  this.total_ = 0;
95

96
  this.reset();
97
};
98
goog.inherits(goog.crypt.Sha1, goog.crypt.Hash);
99

100

101
/** @override */
102
goog.crypt.Sha1.prototype.reset = function() {
103
  this.chain_[0] = 0x67452301;
104
  this.chain_[1] = 0xefcdab89;
105
  this.chain_[2] = 0x98badcfe;
106
  this.chain_[3] = 0x10325476;
107
  this.chain_[4] = 0xc3d2e1f0;
108

109
  this.inbuf_ = 0;
110
  this.total_ = 0;
111
};
112

113

114
/**
115
 * Internal compress helper function.
116
 * @param {!Array<number>|!Uint8Array|string} buf Block to compress.
117
 * @param {number=} opt_offset Offset of the block in the buffer.
118
 * @private
119
 */
120
goog.crypt.Sha1.prototype.compress_ = function(buf, opt_offset) {
121
  if (!opt_offset) {
122
    opt_offset = 0;
123
  }
124

125
  var W = this.W_;
126

127
  // get 16 big endian words
128
  if (goog.isString(buf)) {
129
    for (var i = 0; i < 16; i++) {
130
      // TODO(user): [bug 8140122] Recent versions of Safari for Mac OS and iOS
131
      // have a bug that turns the post-increment ++ operator into pre-increment
132
      // during JIT compilation.  We have code that depends heavily on SHA-1 for
133
      // correctness and which is affected by this bug, so I've removed all uses
134
      // of post-increment ++ in which the result value is used.  We can revert
135
      // this change once the Safari bug
136
      // (https://bugs.webkit.org/show_bug.cgi?id=109036) has been fixed and
137
      // most clients have been updated.
138
      W[i] = (buf.charCodeAt(opt_offset) << 24) |
139
          (buf.charCodeAt(opt_offset + 1) << 16) |
140
          (buf.charCodeAt(opt_offset + 2) << 8) |
141
          (buf.charCodeAt(opt_offset + 3));
142
      opt_offset += 4;
143
    }
144
  } else {
145
    for (var i = 0; i < 16; i++) {
146
      W[i] = (buf[opt_offset] << 24) | (buf[opt_offset + 1] << 16) |
147
          (buf[opt_offset + 2] << 8) | (buf[opt_offset + 3]);
148
      opt_offset += 4;
149
    }
150
  }
151

152
  // expand to 80 words
153
  for (var i = 16; i < 80; i++) {
154
    var t = W[i - 3] ^ W[i - 8] ^ W[i - 14] ^ W[i - 16];
155
    W[i] = ((t << 1) | (t >>> 31)) & 0xffffffff;
156
  }
157

158
  var a = this.chain_[0];
159
  var b = this.chain_[1];
160
  var c = this.chain_[2];
161
  var d = this.chain_[3];
162
  var e = this.chain_[4];
163
  var f, k;
164

165
  // TODO(user): Try to unroll this loop to speed up the computation.
166
  for (var i = 0; i < 80; i++) {
167
    if (i < 40) {
168
      if (i < 20) {
169
        f = d ^ (b & (c ^ d));
170
        k = 0x5a827999;
171
      } else {
172
        f = b ^ c ^ d;
173
        k = 0x6ed9eba1;
174
      }
175
    } else {
176
      if (i < 60) {
177
        f = (b & c) | (d & (b | c));
178
        k = 0x8f1bbcdc;
179
      } else {
180
        f = b ^ c ^ d;
181
        k = 0xca62c1d6;
182
      }
183
    }
184

185
    var t = (((a << 5) | (a >>> 27)) + f + e + k + W[i]) & 0xffffffff;
186
    e = d;
187
    d = c;
188
    c = ((b << 30) | (b >>> 2)) & 0xffffffff;
189
    b = a;
190
    a = t;
191
  }
192

193
  this.chain_[0] = (this.chain_[0] + a) & 0xffffffff;
194
  this.chain_[1] = (this.chain_[1] + b) & 0xffffffff;
195
  this.chain_[2] = (this.chain_[2] + c) & 0xffffffff;
196
  this.chain_[3] = (this.chain_[3] + d) & 0xffffffff;
197
  this.chain_[4] = (this.chain_[4] + e) & 0xffffffff;
198
};
199

200

201
/** @override */
202
goog.crypt.Sha1.prototype.update = function(bytes, opt_length) {
203
  // TODO(johnlenz): tighten the function signature and remove this check
204
  if (bytes == null) {
205
    return;
206
  }
207

208
  if (!goog.isDef(opt_length)) {
209
    opt_length = bytes.length;
210
  }
211

212
  var lengthMinusBlock = opt_length - this.blockSize;
213
  var n = 0;
214
  // Using local instead of member variables gives ~5% speedup on Firefox 16.
215
  var buf = this.buf_;
216
  var inbuf = this.inbuf_;
217

218
  // The outer while loop should execute at most twice.
219
  while (n < opt_length) {
220
    // When we have no data in the block to top up, we can directly process the
221
    // input buffer (assuming it contains sufficient data). This gives ~25%
222
    // speedup on Chrome 23 and ~15% speedup on Firefox 16, but requires that
223
    // the data is provided in large chunks (or in multiples of 64 bytes).
224
    if (inbuf == 0) {
225
      while (n <= lengthMinusBlock) {
226
        this.compress_(bytes, n);
227
        n += this.blockSize;
228
      }
229
    }
230

231
    if (goog.isString(bytes)) {
232
      while (n < opt_length) {
233
        buf[inbuf] = bytes.charCodeAt(n);
234
        ++inbuf;
235
        ++n;
236
        if (inbuf == this.blockSize) {
237
          this.compress_(buf);
238
          inbuf = 0;
239
          // Jump to the outer loop so we use the full-block optimization.
240
          break;
241
        }
242
      }
243
    } else {
244
      while (n < opt_length) {
245
        buf[inbuf] = bytes[n];
246
        ++inbuf;
247
        ++n;
248
        if (inbuf == this.blockSize) {
249
          this.compress_(buf);
250
          inbuf = 0;
251
          // Jump to the outer loop so we use the full-block optimization.
252
          break;
253
        }
254
      }
255
    }
256
  }
257

258
  this.inbuf_ = inbuf;
259
  this.total_ += opt_length;
260
};
261

262

263
/** @override */
264
goog.crypt.Sha1.prototype.digest = function() {
265
  var digest = [];
266
  var totalBits = this.total_ * 8;
267

268
  // Add pad 0x80 0x00*.
269
  if (this.inbuf_ < 56) {
270
    this.update(this.pad_, 56 - this.inbuf_);
271
  } else {
272
    this.update(this.pad_, this.blockSize - (this.inbuf_ - 56));
273
  }
274

275
  // Add # bits.
276
  for (var i = this.blockSize - 1; i >= 56; i--) {
277
    this.buf_[i] = totalBits & 255;
278
    totalBits /= 256;  // Don't use bit-shifting here!
279
  }
280

281
  this.compress_(this.buf_);
282

283
  var n = 0;
284
  for (var i = 0; i < 5; i++) {
285
    for (var j = 24; j >= 0; j -= 8) {
286
      digest[n] = (this.chain_[i] >> j) & 255;
287
      ++n;
288
    }
289
  }
290

291
  return digest;
292
};
293

294