| /* |
| * Licensed to the Apache Software Foundation (ASF) under one or more |
| * contributor license agreements. See the NOTICE file distributed with |
| * this work for additional information regarding copyright ownership. |
| * The ASF licenses this file to You under the Apache License, Version 2.0 |
| * (the "License"); you may not use this file except in compliance with |
| * the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| |
| package org.apache.harmony.security.provider.crypto; |
| |
| import java.io.IOException; |
| import java.io.ObjectInputStream; |
| import java.io.ObjectOutputStream; |
| import java.io.Serializable; |
| import java.security.InvalidParameterException; |
| import java.security.SecureRandomSpi; |
| |
| /** |
| * This class extends the SecureRandomSpi class implementing all its abstract methods. <BR> |
| * <BR> |
| * To generate pseudo-random bits, the implementation uses technique described in |
| * the "Random Number Generator (RNG) algorithms" section, Appendix A, |
| * JavaTM Cryptography Architecture, API Specification&Reference <BR> |
| * <BR> |
| * The class implements the Serializable interface. |
| */ |
| |
| public class SHA1PRNG_SecureRandomImpl extends SecureRandomSpi implements Serializable, SHA1_Data { |
| |
| private static final long serialVersionUID = 283736797212159675L; |
| |
| // constants to use in expressions operating on bytes in int and long variables: |
| // END_FLAGS - final bytes in words to append to message; |
| // see "ch.5.1 Padding the Message, FIPS 180-2" |
| // RIGHT1 - shifts to right for left half of long |
| // RIGHT2 - shifts to right for right half of long |
| // LEFT - shifts to left for bytes |
| // MASK - mask to select counter's bytes after shift to right |
| |
| private static final int[] END_FLAGS = { 0x80000000, 0x800000, 0x8000, 0x80 }; |
| |
| private static final int[] RIGHT1 = { 0, 40, 48, 56 }; |
| |
| private static final int[] RIGHT2 = { 0, 8, 16, 24 }; |
| |
| private static final int[] LEFT = { 0, 24, 16, 8 }; |
| |
| private static final int[] MASK = { 0xFFFFFFFF, 0x00FFFFFF, 0x0000FFFF, |
| 0x000000FF }; |
| |
| // HASHBYTES_TO_USE defines # of bytes returned by "computeHash(byte[])" |
| // to use to form byte array returning by the "nextBytes(byte[])" method |
| // Note, that this implementation uses more bytes than it is defined |
| // in the above specification. |
| private static final int HASHBYTES_TO_USE = 20; |
| |
| // value of 16 defined in the "SECURE HASH STANDARD", FIPS PUB 180-2 |
| private static final int FRAME_LENGTH = 16; |
| |
| // miscellaneous constants defined in this implementation: |
| // COUNTER_BASE - initial value to set to "counter" before computing "nextBytes(..)"; |
| // note, that the exact value is not defined in STANDARD |
| // HASHCOPY_OFFSET - offset for copy of current hash in "copies" array |
| // EXTRAFRAME_OFFSET - offset for extra frame in "copies" array; |
| // as the extra frame follows the current hash frame, |
| // EXTRAFRAME_OFFSET is equal to length of current hash frame |
| // FRAME_OFFSET - offset for frame in "copies" array |
| // MAX_BYTES - maximum # of seed bytes processing which doesn't require extra frame |
| // see (1) comments on usage of "seed" array below and |
| // (2) comments in "engineNextBytes(byte[])" method |
| // |
| // UNDEFINED - three states of engine; initially its state is "UNDEFINED" |
| // SET_SEED call to "engineSetSeed" sets up "SET_SEED" state, |
| // NEXT_BYTES call to "engineNextByte" sets up "NEXT_BYTES" state |
| |
| private static final int COUNTER_BASE = 0; |
| |
| private static final int HASHCOPY_OFFSET = 0; |
| |
| private static final int EXTRAFRAME_OFFSET = 5; |
| |
| private static final int FRAME_OFFSET = 21; |
| |
| private static final int MAX_BYTES = 48; |
| |
| private static final int UNDEFINED = 0; |
| |
| private static final int SET_SEED = 1; |
| |
| private static final int NEXT_BYTES = 2; |
| |
| private static SHA1PRNG_SecureRandomImpl myRandom; |
| |
| // Structure of "seed" array: |
| // - 0-79 - words for computing hash |
| // - 80 - unused |
| // - 81 - # of seed bytes in current seed frame |
| // - 82-86 - 5 words, current seed hash |
| private transient int[] seed; |
| |
| // total length of seed bytes, including all processed |
| private transient long seedLength; |
| |
| // Structure of "copies" array |
| // - 0-4 - 5 words, copy of current seed hash |
| // - 5-20 - extra 16 words frame; |
| // is used if final padding exceeds 512-bit length |
| // - 21-36 - 16 word frame to store a copy of remaining bytes |
| private transient int[] copies; |
| |
| // ready "next" bytes; needed because words are returned |
| private transient byte[] nextBytes; |
| |
| // index of used bytes in "nextBytes" array |
| private transient int nextBIndex; |
| |
| // variable required according to "SECURE HASH STANDARD" |
| private transient long counter; |
| |
| // contains int value corresponding to engine's current state |
| private transient int state; |
| |
| // The "seed" array is used to compute both "current seed hash" and "next bytes". |
| // |
| // As the "SHA1" algorithm computes a hash of entire seed by splitting it into |
| // a number of the 512-bit length frames (512 bits = 64 bytes = 16 words), |
| // "current seed hash" is a hash (5 words, 20 bytes) for all previous full frames; |
| // remaining bytes are stored in the 0-15 word frame of the "seed" array. |
| // |
| // As for calculating "next bytes", |
| // both remaining bytes and "current seed hash" are used, |
| // to preserve the latter for following "setSeed(..)" commands, |
| // the following technique is used: |
| // - upon getting "nextBytes(byte[])" invoked, single or first in row, |
| // which requires computing new hash, that is, |
| // there is no more bytes remaining from previous "next bytes" computation, |
| // remaining bytes are copied into the 21-36 word frame of the "copies" array; |
| // - upon getting "setSeed(byte[])" invoked, single or first in row, |
| // remaining bytes are copied back. |
| |
| /** |
| * Creates object and sets implementation variables to their initial values |
| */ |
| public SHA1PRNG_SecureRandomImpl() { |
| |
| seed = new int[HASH_OFFSET + EXTRAFRAME_OFFSET]; |
| seed[HASH_OFFSET] = H0; |
| seed[HASH_OFFSET + 1] = H1; |
| seed[HASH_OFFSET + 2] = H2; |
| seed[HASH_OFFSET + 3] = H3; |
| seed[HASH_OFFSET + 4] = H4; |
| |
| seedLength = 0; |
| copies = new int[2 * FRAME_LENGTH + EXTRAFRAME_OFFSET]; |
| nextBytes = new byte[DIGEST_LENGTH]; |
| nextBIndex = HASHBYTES_TO_USE; |
| counter = COUNTER_BASE; |
| state = UNDEFINED; |
| } |
| |
| /* |
| * The method invokes the SHA1Impl's "updateHash(..)" method |
| * to update current seed frame and |
| * to compute new intermediate hash value if the frame is full. |
| * |
| * After that it computes a length of whole seed. |
| */ |
| private void updateSeed(byte[] bytes) { |
| |
| // on call: "seed" contains current bytes and current hash; |
| // on return: "seed" contains new current bytes and possibly new current hash |
| // if after adding, seed bytes overfill its buffer |
| SHA1Impl.updateHash(seed, bytes, 0, bytes.length - 1); |
| |
| seedLength += bytes.length; |
| } |
| |
| /** |
| * Changes current seed by supplementing a seed argument to the current seed, |
| * if this already set; |
| * the argument is used as first seed otherwise. <BR> |
| * |
| * The method overrides "engineSetSeed(byte[])" in class SecureRandomSpi. |
| * |
| * @param |
| * seed - byte array |
| * @throws |
| * NullPointerException - if null is passed to the "seed" argument |
| */ |
| protected void engineSetSeed(byte[] seed) { |
| |
| if (seed == null) { |
| throw new NullPointerException("seed == null"); |
| } |
| |
| if (state == NEXT_BYTES) { // first setSeed after NextBytes; restoring hash |
| System.arraycopy(copies, HASHCOPY_OFFSET, this.seed, HASH_OFFSET, |
| EXTRAFRAME_OFFSET); |
| } |
| state = SET_SEED; |
| |
| if (seed.length != 0) { |
| updateSeed(seed); |
| } |
| } |
| |
| /** |
| * Returns a required number of random bytes. <BR> |
| * |
| * The method overrides "engineGenerateSeed (int)" in class SecureRandomSpi. <BR> |
| * |
| * @param |
| * numBytes - number of bytes to return; should be >= 0. |
| * @return |
| * byte array containing bits in order from left to right |
| * @throws |
| * InvalidParameterException - if numBytes < 0 |
| */ |
| protected byte[] engineGenerateSeed(int numBytes) { |
| |
| byte[] myBytes; // byte[] for bytes returned by "nextBytes()" |
| |
| if (numBytes < 0) { |
| throw new NegativeArraySizeException(Integer.toString(numBytes)); |
| } |
| if (numBytes == 0) { |
| return new byte[0]; |
| } |
| |
| if (myRandom == null) { |
| myRandom = new SHA1PRNG_SecureRandomImpl(); |
| myRandom.engineSetSeed(RandomBitsSupplier |
| .getRandomBits(DIGEST_LENGTH)); |
| } |
| |
| myBytes = new byte[numBytes]; |
| myRandom.engineNextBytes(myBytes); |
| |
| return myBytes; |
| } |
| |
| /** |
| * Writes random bytes into an array supplied. |
| * Bits in a byte are from left to right. <BR> |
| * |
| * To generate random bytes, the "expansion of source bits" method is used, |
| * that is, |
| * the current seed with a 64-bit counter appended is used to compute new bits. |
| * The counter is incremented by 1 for each 20-byte output. <BR> |
| * |
| * The method overrides engineNextBytes in class SecureRandomSpi. |
| * |
| * @param |
| * bytes - byte array to be filled in with bytes |
| * @throws |
| * NullPointerException - if null is passed to the "bytes" argument |
| */ |
| protected void engineNextBytes(byte[] bytes) { |
| |
| int i, n; |
| |
| long bits; // number of bits required by Secure Hash Standard |
| int nextByteToReturn; // index of ready bytes in "bytes" array |
| int lastWord; // index of last word in frame containing bytes |
| final int extrabytes = 7;// # of bytes to add in order to computer # of 8 byte words |
| |
| if (bytes == null) { |
| throw new NullPointerException("bytes == null"); |
| } |
| |
| lastWord = seed[BYTES_OFFSET] == 0 ? 0 |
| : (seed[BYTES_OFFSET] + extrabytes) >> 3 - 1; |
| |
| if (state == UNDEFINED) { |
| |
| // no seed supplied by user, hence it is generated thus randomizing internal state |
| updateSeed(RandomBitsSupplier.getRandomBits(DIGEST_LENGTH)); |
| nextBIndex = HASHBYTES_TO_USE; |
| |
| } else if (state == SET_SEED) { |
| |
| System.arraycopy(seed, HASH_OFFSET, copies, HASHCOPY_OFFSET, |
| EXTRAFRAME_OFFSET); |
| |
| // possible cases for 64-byte frame: |
| // |
| // seed bytes < 48 - remaining bytes are enough for all, 8 counter bytes, |
| // 0x80, and 8 seedLength bytes; no extra frame required |
| // 48 < seed bytes < 56 - remaining 9 bytes are for 0x80 and 8 counter bytes |
| // extra frame contains only seedLength value at the end |
| // seed bytes > 55 - extra frame contains both counter's bytes |
| // at the beginning and seedLength value at the end; |
| // note, that beginning extra bytes are not more than 8, |
| // that is, only 2 extra words may be used |
| |
| // no need to set to "0" 3 words after "lastWord" and |
| // more than two words behind frame |
| for (i = lastWord + 3; i < FRAME_LENGTH + 2; i++) { |
| seed[i] = 0; |
| } |
| |
| bits = (seedLength << 3) + 64; // transforming # of bytes into # of bits |
| |
| // putting # of bits into two last words (14,15) of 16 word frame in |
| // seed or copies array depending on total length after padding |
| if (seed[BYTES_OFFSET] < MAX_BYTES) { |
| seed[14] = (int) (bits >>> 32); |
| seed[15] = (int) (bits & 0xFFFFFFFF); |
| } else { |
| copies[EXTRAFRAME_OFFSET + 14] = (int) (bits >>> 32); |
| copies[EXTRAFRAME_OFFSET + 15] = (int) (bits & 0xFFFFFFFF); |
| } |
| |
| nextBIndex = HASHBYTES_TO_USE; // skipping remaining random bits |
| } |
| state = NEXT_BYTES; |
| |
| if (bytes.length == 0) { |
| return; |
| } |
| |
| nextByteToReturn = 0; |
| |
| // possibly not all of HASHBYTES_TO_USE bytes were used previous time |
| n = (HASHBYTES_TO_USE - nextBIndex) < (bytes.length - nextByteToReturn) ? HASHBYTES_TO_USE |
| - nextBIndex |
| : bytes.length - nextByteToReturn; |
| if (n > 0) { |
| System.arraycopy(nextBytes, nextBIndex, bytes, nextByteToReturn, n); |
| nextBIndex += n; |
| nextByteToReturn += n; |
| } |
| |
| if (nextByteToReturn >= bytes.length) { |
| return; // return because "bytes[]" are filled in |
| } |
| |
| n = seed[BYTES_OFFSET] & 0x03; |
| for (;;) { |
| if (n == 0) { |
| |
| seed[lastWord] = (int) (counter >>> 32); |
| seed[lastWord + 1] = (int) (counter & 0xFFFFFFFF); |
| seed[lastWord + 2] = END_FLAGS[0]; |
| |
| } else { |
| |
| seed[lastWord] |= (int) ((counter >>> RIGHT1[n]) & MASK[n]); |
| seed[lastWord + 1] = (int) ((counter >>> RIGHT2[n]) & 0xFFFFFFFF); |
| seed[lastWord + 2] = (int) ((counter << LEFT[n]) | END_FLAGS[n]); |
| } |
| if (seed[BYTES_OFFSET] > MAX_BYTES) { |
| copies[EXTRAFRAME_OFFSET] = seed[FRAME_LENGTH]; |
| copies[EXTRAFRAME_OFFSET + 1] = seed[FRAME_LENGTH + 1]; |
| } |
| |
| SHA1Impl.computeHash(seed); |
| |
| if (seed[BYTES_OFFSET] > MAX_BYTES) { |
| |
| System.arraycopy(seed, 0, copies, FRAME_OFFSET, FRAME_LENGTH); |
| System.arraycopy(copies, EXTRAFRAME_OFFSET, seed, 0, |
| FRAME_LENGTH); |
| |
| SHA1Impl.computeHash(seed); |
| System.arraycopy(copies, FRAME_OFFSET, seed, 0, FRAME_LENGTH); |
| } |
| counter++; |
| |
| int j = 0; |
| for (i = 0; i < EXTRAFRAME_OFFSET; i++) { |
| int k = seed[HASH_OFFSET + i]; |
| nextBytes[j] = (byte) (k >>> 24); // getting first byte from left |
| nextBytes[j + 1] = (byte) (k >>> 16); // getting second byte from left |
| nextBytes[j + 2] = (byte) (k >>> 8); // getting third byte from left |
| nextBytes[j + 3] = (byte) (k); // getting fourth byte from left |
| j += 4; |
| } |
| |
| nextBIndex = 0; |
| j = HASHBYTES_TO_USE < (bytes.length - nextByteToReturn) ? HASHBYTES_TO_USE |
| : bytes.length - nextByteToReturn; |
| |
| if (j > 0) { |
| System.arraycopy(nextBytes, 0, bytes, nextByteToReturn, j); |
| nextByteToReturn += j; |
| nextBIndex += j; |
| } |
| |
| if (nextByteToReturn >= bytes.length) { |
| break; |
| } |
| } |
| } |
| |
| private void writeObject(ObjectOutputStream oos) throws IOException { |
| |
| int[] intData = null; |
| |
| final int only_hash = EXTRAFRAME_OFFSET; |
| final int hashes_and_frame = EXTRAFRAME_OFFSET * 2 + FRAME_LENGTH; |
| final int hashes_and_frame_extra = EXTRAFRAME_OFFSET * 2 + FRAME_LENGTH |
| * 2; |
| |
| oos.writeLong(seedLength); |
| oos.writeLong(counter); |
| oos.writeInt(state); |
| oos.writeInt(seed[BYTES_OFFSET]); |
| |
| int nRemaining = (seed[BYTES_OFFSET] + 3) >> 2; // converting bytes in words |
| // result may be 0 |
| if (state != NEXT_BYTES) { |
| |
| // either the state is UNDEFINED or previous method was "setSeed(..)" |
| // so in "seed[]" to serialize are remaining bytes (seed[0-nRemaining]) and |
| // current hash (seed[82-86]) |
| |
| intData = new int[only_hash + nRemaining]; |
| |
| System.arraycopy(seed, 0, intData, 0, nRemaining); |
| System.arraycopy(seed, HASH_OFFSET, intData, nRemaining, |
| EXTRAFRAME_OFFSET); |
| |
| } else { |
| // previous method was "nextBytes(..)" |
| // so, data to serialize are all the above (two first are in "copies" array) |
| // and current words in both frame and extra frame (as if) |
| |
| int offset = 0; |
| if (seed[BYTES_OFFSET] < MAX_BYTES) { // no extra frame |
| |
| intData = new int[hashes_and_frame + nRemaining]; |
| |
| } else { // extra frame is used |
| |
| intData = new int[hashes_and_frame_extra + nRemaining]; |
| |
| intData[offset] = seed[FRAME_LENGTH]; |
| intData[offset + 1] = seed[FRAME_LENGTH + 1]; |
| intData[offset + 2] = seed[FRAME_LENGTH + 14]; |
| intData[offset + 3] = seed[FRAME_LENGTH + 15]; |
| offset += 4; |
| } |
| |
| System.arraycopy(seed, 0, intData, offset, FRAME_LENGTH); |
| offset += FRAME_LENGTH; |
| |
| System.arraycopy(copies, FRAME_LENGTH + EXTRAFRAME_OFFSET, intData, |
| offset, nRemaining); |
| offset += nRemaining; |
| |
| System.arraycopy(copies, 0, intData, offset, EXTRAFRAME_OFFSET); |
| offset += EXTRAFRAME_OFFSET; |
| |
| System.arraycopy(seed, HASH_OFFSET, intData, offset, |
| EXTRAFRAME_OFFSET); |
| } |
| for (int i = 0; i < intData.length; i++) { |
| oos.writeInt(intData[i]); |
| } |
| |
| oos.writeInt(nextBIndex); |
| oos.write(nextBytes, nextBIndex, HASHBYTES_TO_USE - nextBIndex); |
| } |
| |
| private void readObject(ObjectInputStream ois) throws IOException, |
| ClassNotFoundException { |
| |
| seed = new int[HASH_OFFSET + EXTRAFRAME_OFFSET]; |
| copies = new int[2 * FRAME_LENGTH + EXTRAFRAME_OFFSET]; |
| nextBytes = new byte[DIGEST_LENGTH]; |
| |
| seedLength = ois.readLong(); |
| counter = ois.readLong(); |
| state = ois.readInt(); |
| seed[BYTES_OFFSET] = ois.readInt(); |
| |
| int nRemaining = (seed[BYTES_OFFSET] + 3) >> 2; // converting bytes in words |
| |
| if (state != NEXT_BYTES) { |
| |
| for (int i = 0; i < nRemaining; i++) { |
| seed[i] = ois.readInt(); |
| } |
| for (int i = 0; i < EXTRAFRAME_OFFSET; i++) { |
| seed[HASH_OFFSET + i] = ois.readInt(); |
| } |
| } else { |
| if (seed[BYTES_OFFSET] >= MAX_BYTES) { |
| |
| // reading next bytes in seed extra frame |
| seed[FRAME_LENGTH] = ois.readInt(); |
| seed[FRAME_LENGTH + 1] = ois.readInt(); |
| seed[FRAME_LENGTH + 14] = ois.readInt(); |
| seed[FRAME_LENGTH + 15] = ois.readInt(); |
| } |
| // reading next bytes in seed frame |
| for (int i = 0; i < FRAME_LENGTH; i++) { |
| seed[i] = ois.readInt(); |
| } |
| // reading remaining seed bytes |
| for (int i = 0; i < nRemaining; i++) { |
| copies[FRAME_LENGTH + EXTRAFRAME_OFFSET + i] = ois.readInt(); |
| } |
| // reading copy of current hash |
| for (int i = 0; i < EXTRAFRAME_OFFSET; i++) { |
| copies[i] = ois.readInt(); |
| } |
| // reading current hash |
| for (int i = 0; i < EXTRAFRAME_OFFSET; i++) { |
| seed[HASH_OFFSET + i] = ois.readInt(); |
| } |
| } |
| |
| nextBIndex = ois.readInt(); |
| ois.read(nextBytes, nextBIndex, HASHBYTES_TO_USE - nextBIndex); |
| } |
| |
| } |