mirror of git://gcc.gnu.org/git/gcc.git
253 lines
7.1 KiB
Java
253 lines
7.1 KiB
Java
/* TLSRandom.java -- The TLS pseudo-random function.
|
|
Copyright (C) 2006 Free Software Foundation, Inc.
|
|
|
|
This file is a part of GNU Classpath.
|
|
|
|
GNU Classpath is free software; you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation; either version 2 of the License, or (at
|
|
your option) any later version.
|
|
|
|
GNU Classpath is distributed in the hope that it will be useful, but
|
|
WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
along with GNU Classpath; if not, write to the Free Software
|
|
Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301
|
|
USA
|
|
|
|
Linking this library statically or dynamically with other modules is
|
|
making a combined work based on this library. Thus, the terms and
|
|
conditions of the GNU General Public License cover the whole
|
|
combination.
|
|
|
|
As a special exception, the copyright holders of this library give you
|
|
permission to link this library with independent modules to produce an
|
|
executable, regardless of the license terms of these independent
|
|
modules, and to copy and distribute the resulting executable under
|
|
terms of your choice, provided that you also meet, for each linked
|
|
independent module, the terms and conditions of the license of that
|
|
module. An independent module is a module which is not derived from
|
|
or based on this library. If you modify this library, you may extend
|
|
this exception to your version of the library, but you are not
|
|
obligated to do so. If you do not wish to do so, delete this
|
|
exception statement from your version. */
|
|
|
|
|
|
package gnu.javax.net.ssl.provider;
|
|
|
|
import java.security.InvalidKeyException;
|
|
import java.util.HashMap;
|
|
import java.util.Map;
|
|
|
|
import gnu.java.security.hash.HashFactory;
|
|
import gnu.javax.crypto.mac.IMac;
|
|
import gnu.java.security.prng.IRandom;
|
|
|
|
class TLSRandom implements IRandom
|
|
{
|
|
|
|
// Fields.
|
|
// -------------------------------------------------------------------------
|
|
|
|
/**
|
|
* Property name for the secret that will be used to initialize the HMACs.
|
|
*/
|
|
static final String SECRET = "jessie.tls.prng.secret";
|
|
|
|
/**
|
|
* Property name for the seed.
|
|
*/
|
|
static final String SEED = "jessie.tls.prng.seed";
|
|
|
|
private final IMac hmac_sha, hmac_md5;
|
|
private byte[] sha_a, md5_a;
|
|
private byte[] seed;
|
|
private final byte[] buffer;
|
|
private int idx;
|
|
private boolean init;
|
|
|
|
// Constructors.
|
|
// -------------------------------------------------------------------------
|
|
|
|
TLSRandom()
|
|
{
|
|
hmac_sha = new TLSHMac(HashFactory.getInstance("SHA1"));
|
|
hmac_md5 = new TLSHMac(HashFactory.getInstance("MD5"));
|
|
buffer = new byte[80]; // 80 == LCM of 16 and 20.
|
|
idx = 0;
|
|
init = false;
|
|
}
|
|
|
|
// Instance methods.
|
|
// -------------------------------------------------------------------------
|
|
|
|
public Object clone()
|
|
{
|
|
try
|
|
{
|
|
return super.clone();
|
|
}
|
|
catch (CloneNotSupportedException shouldNotHappen)
|
|
{
|
|
throw new Error();
|
|
}
|
|
}
|
|
|
|
public void init(Map attributes)
|
|
{
|
|
HashMap sha_attr = new HashMap();
|
|
HashMap md5_attr = new HashMap();
|
|
byte[] secret = (byte[]) attributes.get(SECRET);
|
|
if (secret != null)
|
|
{
|
|
int l = (secret.length >>> 1) + (secret.length & 1);
|
|
byte[] s1 = Util.trim(secret, 0, l);
|
|
byte[] s2 = Util.trim(secret, secret.length - l, l);
|
|
md5_attr.put(IMac.MAC_KEY_MATERIAL, s1);
|
|
sha_attr.put(IMac.MAC_KEY_MATERIAL, s2);
|
|
try
|
|
{
|
|
hmac_md5.init(md5_attr);
|
|
hmac_sha.init(sha_attr);
|
|
}
|
|
catch (InvalidKeyException ike)
|
|
{
|
|
throw new Error(ike.toString());
|
|
}
|
|
}
|
|
else if (!init)
|
|
{
|
|
throw new IllegalArgumentException("no secret supplied");
|
|
}
|
|
// else re-use
|
|
|
|
byte[] seeed = (byte[]) attributes.get(SEED);
|
|
if (seeed != null)
|
|
{
|
|
seed = (byte[]) seeed.clone();
|
|
}
|
|
else if (!init)
|
|
{
|
|
throw new IllegalArgumentException("no seed supplied");
|
|
}
|
|
// else re-use
|
|
|
|
// A(0) is the seed, A(1) = HMAC_hash(secret, A(0)).
|
|
hmac_md5.update(seed, 0, seed.length);
|
|
md5_a = hmac_md5.digest();
|
|
hmac_md5.reset();
|
|
hmac_sha.update(seed, 0, seed.length);
|
|
sha_a = hmac_sha.digest();
|
|
hmac_sha.reset();
|
|
fillBuffer();
|
|
init = true;
|
|
}
|
|
|
|
public String name()
|
|
{
|
|
return "TLSRandom";
|
|
}
|
|
|
|
public byte nextByte()
|
|
{
|
|
if (!init)
|
|
throw new IllegalStateException();
|
|
if (idx >= buffer.length)
|
|
fillBuffer();
|
|
return buffer[idx++];
|
|
}
|
|
|
|
public void nextBytes(byte[] buf, int off, int len)
|
|
{
|
|
if (!init)
|
|
throw new IllegalStateException();
|
|
if (buf == null)
|
|
throw new NullPointerException();
|
|
if (off < 0 || off > buf.length || off + len > buf.length)
|
|
throw new ArrayIndexOutOfBoundsException();
|
|
int count = 0;
|
|
if (idx >= buffer.length)
|
|
fillBuffer();
|
|
while (count < len)
|
|
{
|
|
int l = Math.min(buffer.length-idx, len-count);
|
|
System.arraycopy(buffer, idx, buf, off+count, l);
|
|
idx += l;
|
|
count += l;
|
|
if (count < len && idx >= buffer.length)
|
|
fillBuffer();
|
|
}
|
|
}
|
|
|
|
// For future versions of GNU Crypto. No-ops.
|
|
public void addRandomByte (byte b)
|
|
{
|
|
}
|
|
|
|
public void addRandomBytes(byte[] buffer) {
|
|
addRandomBytes(buffer, 0, buffer.length);
|
|
}
|
|
|
|
public void addRandomBytes (byte[] b, int i, int j)
|
|
{
|
|
}
|
|
|
|
// Own methods.
|
|
// -------------------------------------------------------------------------
|
|
|
|
/*
|
|
* The PRF is defined as:
|
|
*
|
|
* PRF(secret, label, seed) = P_MD5(S1, label + seed) XOR
|
|
* P_SHA-1(S2, label + seed);
|
|
*
|
|
* P_hash is defined as:
|
|
*
|
|
* P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
|
|
* HMAC_hash(secret, A(2) + seed) +
|
|
* HMAC_hash(secret, A(3) + seed) + ...
|
|
*
|
|
* And A() is defined as:
|
|
*
|
|
* A(0) = seed
|
|
* A(i) = HMAC_hash(secret, A(i-1))
|
|
*
|
|
* For simplicity, we compute an 80-byte block on each call, which
|
|
* corresponds to five iterations of MD5, and four of SHA-1.
|
|
*/
|
|
private synchronized void fillBuffer()
|
|
{
|
|
int len = hmac_md5.macSize();
|
|
for (int i = 0; i < buffer.length; i += len)
|
|
{
|
|
hmac_md5.update(md5_a, 0, md5_a.length);
|
|
hmac_md5.update(seed, 0, seed.length);
|
|
byte[] b = hmac_md5.digest();
|
|
hmac_md5.reset();
|
|
System.arraycopy(b, 0, buffer, i, len);
|
|
hmac_md5.update(md5_a, 0, md5_a.length);
|
|
md5_a = hmac_md5.digest();
|
|
hmac_md5.reset();
|
|
}
|
|
len = hmac_sha.macSize();
|
|
for (int i = 0; i < buffer.length; i += len)
|
|
{
|
|
hmac_sha.update(sha_a, 0, sha_a.length);
|
|
hmac_sha.update(seed, 0, seed.length);
|
|
byte[] b = hmac_sha.digest();
|
|
hmac_sha.reset();
|
|
for (int j = 0; j < len; j++)
|
|
{
|
|
buffer[j + i] ^= b[j];
|
|
}
|
|
hmac_sha.update(sha_a, 0, sha_a.length);
|
|
sha_a = hmac_sha.digest();
|
|
hmac_sha.reset();
|
|
}
|
|
idx = 0;
|
|
}
|
|
}
|