/*
 * Copyright (c) 2016, Oracle and/or its affiliates. All rights reserved.
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 *
 * This code is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License version 2 only, as
 * published by the Free Software Foundation.  Oracle designates this
 * particular file as subject to the "Classpath" exception as provided
 * by Oracle in the LICENSE file that accompanied this code.
 *
 * This code is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * version 2 for more details (a copy is included in the LICENSE file that
 * accompanied this code).
 *
 * You should have received a copy of the GNU General Public License version
 * 2 along with this work; if not, write to the Free Software Foundation,
 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
 *
 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
 * or visit www.oracle.com if you need additional information or have any
 * questions.
 */

package sun.security.provider;

import java.math.BigInteger;
import java.security.DigestException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;
import java.security.SecureRandomParameters;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;

public class HashDrbg extends AbstractHashDrbg {

    private static final byte[] ZERO = new byte[1];
    private static final byte[] ONE = new byte[]{1};

    private MessageDigest digest;

    private byte[] v;
    private byte[] c;

    public HashDrbg(SecureRandomParameters params) {
        mechName = "Hash_DRBG";
        configure(params);
    }

    
This call, used by the constructors, instantiates the digest.
/** * This call, used by the constructors, instantiates the digest. */
@Override protected void initEngine() { try { /* * Use the local SUN implementation to avoid native * performance overhead. */ digest = MessageDigest.getInstance(algorithm, "SUN"); } catch (NoSuchProviderException | NoSuchAlgorithmException e) { // Fallback to any available. try { digest = MessageDigest.getInstance(algorithm); } catch (NoSuchAlgorithmException exc) { throw new InternalError( "internal error: " + algorithm + " not available.", exc); } } } private byte[] hashDf(int requested, List<byte[]> inputs) { return hashDf(digest, outLen, requested, inputs); }
A hash-based derivation function defined in NIST SP 800-90Ar1 10.3.1. The function is used inside Hash_DRBG, and can also be used as an approved conditioning function as described in 800-90B 6.4.2.2. Note: In each current call, requested is seedLen, therefore small, no need to worry about overflow.
Params:
  • digest – a MessageDigest object in reset state
  • outLen – MessageDigest.getDigestLength of digest
  • requested – requested output length, in bytes
  • inputs – input data
Returns:the condensed/expanded output
/** * A hash-based derivation function defined in NIST SP 800-90Ar1 10.3.1. * The function is used inside Hash_DRBG, and can also be used as an * approved conditioning function as described in 800-90B 6.4.2.2. * * Note: In each current call, requested is seedLen, therefore small, * no need to worry about overflow. * * @param digest a {@code MessageDigest} object in reset state * @param outLen {@link MessageDigest#getDigestLength} of {@code digest} * @param requested requested output length, in bytes * @param inputs input data * @return the condensed/expanded output */
public static byte[] hashDf(MessageDigest digest, int outLen, int requested, List<byte[]> inputs) { // 1. temp = the Null string. // 2. len = upper_int(no_of_bits_to_return / outLen) int len = (requested + outLen - 1) / outLen; byte[] temp = new byte[len * outLen]; // 3. counter = 0x01 int counter = 1; // 4. For i = 1 to len do for (int i=0; i<len; i++) { // 4.1 temp = temp // || Hash (counter || no_of_bits_to_return || input_string). digest.update((byte) counter); digest.update((byte)(requested >> 21)); // requested*8 as int32 digest.update((byte)(requested >> 13)); digest.update((byte)(requested >> 5)); digest.update((byte)(requested << 3)); for (byte[] input : inputs) { digest.update(input); } try { digest.digest(temp, i * outLen, outLen); } catch (DigestException e) { throw new AssertionError("will not happen", e); } // 4.2 counter = counter + 1 counter++; } // 5. requested_bits = leftmost (temp, no_of_bits_to_return). return temp.length == requested? temp: Arrays.copyOf(temp, requested); // 6. Return } // This method is used by both instantiation and reseeding. @Override protected final synchronized void hashReseedInternal(List<byte[]> inputs) { // 800-90Ar1 10.1.1.2: Instantiate Process. // 800-90Ar1 10.1.1.3: Reseed Process. byte[] seed; // Step 2: seed = Hash_df (seed_material, seedlen). if (v != null) { // Step 1 of 10.1.1.3: Prepend 0x01 || V inputs.add(0, ONE); inputs.add(1, v); seed = hashDf(seedLen, inputs); } else { seed = hashDf(seedLen, inputs); } // Step 3. V = seed. v = seed; // Step 4. C = Hash_df ((0x00 || V), seedlen). inputs = new ArrayList<>(2); inputs.add(ZERO); inputs.add(v); c = hashDf(seedLen, inputs); // Step 5. reseed_counter = 1. reseedCounter = 1; //status(); // Step 6: Return } private void status() { if (debug != null) { debug.println(this, "V = " + hex(v)); debug.println(this, "C = " + hex(c)); debug.println(this, "reseed counter = " + reseedCounter); } }
Adds byte arrays into an existing one.
Params:
  • out – existing array
  • data – more arrays, can be of different length
/** * Adds byte arrays into an existing one. * * @param out existing array * @param data more arrays, can be of different length */
private static void addBytes(byte[] out, int len, byte[]... data) { for (byte[] d: data) { int dlen = d.length; int carry = 0; for (int i = 0; i < len; i++) { int sum = (out[len - i - 1] & 0xff) + carry; if (i < dlen) { sum += (d[dlen - i - 1] & 0xff); } out[len - i - 1] = (byte) sum; carry = sum >> 8; if (i >= dlen - 1 && carry == 0) break; } } }
Generates a user-specified number of random bytes.
Params:
  • result – the array to be filled in with random bytes.
/** * Generates a user-specified number of random bytes. * * @param result the array to be filled in with random bytes. */
@Override public final synchronized void generateAlgorithm( byte[] result, byte[] additionalInput) { if (debug != null) { debug.println(this, "generateAlgorithm"); } // 800-90Ar1 10.1.1.4: Hash_DRBG_Generate Process // Step 1: Check reseed_counter. Will not fail. Already checked in // AbstractDrbg#engineNextBytes. // Step 2: additional_input if (additionalInput != null) { digest.update((byte)2); digest.update(v); digest.update(additionalInput); addBytes(v, seedLen, digest.digest()); } // Step 3. Hashgen (requested_number_of_bits, V). hashGen(result, v); // Step 4. H = Hash (0x03 || V). digest.update((byte)3); digest.update(v); byte[] h = digest.digest(); // Step 5. V = (V + H + C + reseed_counter) mod 2seedlen. byte[] rcBytes; if (reseedCounter < 256) { rcBytes = new byte[]{(byte)reseedCounter}; } else { rcBytes = BigInteger.valueOf(reseedCounter).toByteArray(); } addBytes(v, seedLen, h, c, rcBytes); // Step 6. reseed_counter = reseed_counter + 1. reseedCounter++; //status(); // Step 7: Return. } // 800-90Ar1 10.1.1.4: Hashgen private void hashGen(byte[] output, byte[] v) { // Step 2. data = V byte[] data = v; // Step 3: W is output not filled // Step 4: For i = 1 to m int pos = 0; int len = output.length; while (len > 0) { if (len < outLen) { // Step 4.1 w = Hash (data). // Step 4.2 W = W || w. System.arraycopy(digest.digest(data), 0, output, pos, len); } else { try { // Step 4.1 w = Hash (data). digest.update(data); // Step 4.2 digest into right position, no need to cat digest.digest(output, pos, outLen); } catch (DigestException e) { throw new AssertionError("will not happen", e); } } len -= outLen; if (len <= 0) { // shortcut, so that data and pos needn't be updated break; } // Step 4.3 data = (data + 1) mod 2^seedlen. if (data == v) { data = Arrays.copyOf(v, v.length); } addBytes(data, seedLen, ONE); pos += outLen; } // Step 5: No need to truncate // Step 6: Return } }