emsa_pss.java

来自「linux下建立JAVA虚拟机的源码KAFFE」· Java 代码 · 共 433 行 · 第 1/2 页

/* EMSA_PSS.java -- 
   Copyright (C) 2001, 2002, 2003, 2006 Free Software Foundation, Inc.

This file is a part of GNU Classpath.

GNU Classpath is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or (at
your option) any later version.

GNU Classpath is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
General Public License for more details.

You should have received a copy of the GNU General Public License
along with GNU Classpath; if not, write to the Free Software
Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301
USA

Linking this library statically or dynamically with other modules is
making a combined work based on this library.  Thus, the terms and
conditions of the GNU General Public License cover the whole
combination.

As a special exception, the copyright holders of this library give you
permission to link this library with independent modules to produce an
executable, regardless of the license terms of these independent
modules, and to copy and distribute the resulting executable under
terms of your choice, provided that you also meet, for each linked
independent module, the terms and conditions of the license of that
module.  An independent module is a module which is not derived from
or based on this library.  If you modify this library, you may extend
this exception to your version of the library, but you are not
obligated to do so.  If you do not wish to do so, delete this
exception statement from your version.  */


package gnu.java.security.sig.rsa;

import gnu.java.security.hash.HashFactory;
import gnu.java.security.hash.IMessageDigest;
import gnu.java.security.util.Util;

import java.io.PrintWriter;
import java.util.Arrays;

/**
 * <p>An implementation of the EMSA-PSS encoding/decoding scheme.</p>
 *
 * <p>EMSA-PSS coincides with EMSA4 in IEEE P1363a D5 except that EMSA-PSS acts
 * on octet strings and not on bit strings. In particular, the bit lengths of
 * the hash and the salt must be multiples of 8 in EMSA-PSS. Moreover, EMSA4
 * outputs an integer of a desired bit length rather than an octet string.</p>
 *
 * <p>EMSA-PSS is parameterized by the choice of hash function Hash and mask
 * generation function MGF. In this submission, MGF is based on a Hash
 * definition that coincides with the corresponding definitions in IEEE Std
 * 1363-2000, PKCS #1 v2.0, and the draft ANSI X9.44. In PKCS #1 v2.0 and the
 * draft ANSI X9.44, the recommended hash function is SHA-1, while IEEE Std
 * 1363-2000 recommends SHA-1 and RIPEMD-160.</p>
 *
 * <p>References:</p>
 * <ol>
 *    <li><a href="http://www.cosic.esat.kuleuven.ac.be/nessie/workshop/submissions/rsa-pss.zip">
 *    RSA-PSS Signature Scheme with Appendix, part B.</a><br>
 *    Primitive specification and supporting documentation.<br>
 *    Jakob Jonsson and Burt Kaliski.</li>
 * </ol>
 *
 * @version $Revision: 1.1 $
 */
public class EMSA_PSS implements Cloneable
{

  // Debugging methods and variables
  // -------------------------------------------------------------------------

  private static final String NAME = "emsa-pss";

  private static final boolean DEBUG = false;

  private static final int debuglevel = 5;

  private static final PrintWriter err = new PrintWriter(System.out, true);

  private static void debug(String s)
  {
    err.println(">>> " + NAME + ": " + s);
  }

  // Constants and variables
  // -------------------------------------------------------------------------

  /** The underlying hash function to use with this instance. */
  private IMessageDigest hash;

  /** The output size of the hash function in octets. */
  private int hLen;

  // Constructor(s)
  // -------------------------------------------------------------------------

  /**
   * <p>Trivial private constructor to enforce use through Factory method.</p>
   *
   * @param hash the message digest instance to use with this scheme instance.
   */
  private EMSA_PSS(IMessageDigest hash)
  {
    super();

    this.hash = hash;
    hLen = hash.hashSize();
  }

  // Class methods
  // -------------------------------------------------------------------------

  /**
   * <p>Returns an instance of this object given a designated name of a hash
   * function.</p>
   *
   * @param mdName the canonical name of a hash function.
   * @return an instance of this object configured for use with the designated
   * options.
   */
  public static EMSA_PSS getInstance(String mdName)
  {
    IMessageDigest hash = HashFactory.getInstance(mdName);
    return new EMSA_PSS(hash);
  }

  // Instance methods
  // -------------------------------------------------------------------------

  // Cloneable interface implementation --------------------------------------

  public Object clone()
  {
    return getInstance(hash.name());
  }

  // own methods -------------------------------------------------------------

  /**
   * <p>The encoding operation EMSA-PSS-Encode computes the hash of a message
   * <code>M</code> using a hash function and maps the result to an encoded
   * message <code>EM</code> of a specified length using a mask generation
   * function.</p>
   *
   * @param mHash the byte sequence resulting from applying the message digest
   * algorithm Hash to the message <i>M</i>.
   * @param emBits the maximal bit length of the integer OS2IP(EM), at least
   * <code>8.hLen + 8.sLen + 9</code>.
   * @param salt the salt to use when encoding the output.
   * @return the encoded message <code>EM</code>, an octet string of length
   * <code>emLen = CEILING(emBits / 8)</code>.
   * @exception IllegalArgumentException if an exception occurs.
   *
   */
  public byte[] encode(byte[] mHash, int emBits, byte[] salt)
  {
    int sLen = salt.length;

    // 1. If the length of M is greater than the input limitation for the hash
    // function (2**61 - 1 octets for SHA-1) then output "message too long"
    // and stop.
    // 2. Let mHash = Hash(M), an octet string of length hLen.
    if (hLen != mHash.length)
      {
        throw new IllegalArgumentException("wrong hash");
      }
    // 3. If emBits < 8.hLen + 8.sLen + 9, output 'encoding error' and stop.
    if (emBits < (8 * hLen + 8 * sLen + 9))
      {
        throw new IllegalArgumentException("encoding error");
      }
    int emLen = (emBits + 7) / 8;
    // 4. Generate a random octet string salt of length sLen; if sLen = 0,
    // then salt is the empty string.
    // ...passed as argument to accomodate JCE
    // 5. Let M0 = 00 00 00 00 00 00 00 00 || mHash || salt;
    // M0 is an octet string of length 8 + hLen + sLen with eight initial zero
    // octets.
    // 6. Let H = Hash(M0), an octet string of length hLen.
    byte[] H;
    int i;
    synchronized (hash)
      {
        for (i = 0; i < 8; i++)
          {
            hash.update((byte) 0x00);
          }
        hash.update(mHash, 0, hLen);
        hash.update(salt, 0, sLen);
        H = hash.digest();
      }
    // 7. Generate an octet string PS consisting of emLen - sLen - hLen - 2
    // zero octets. The length of PS may be 0.
    // 8. Let DB = PS || 01 || salt.
    byte[] DB = new byte[emLen - sLen - hLen - 2 + 1 + sLen];
    DB[emLen - sLen - hLen - 2] = 0x01;
    System.arraycopy(salt, 0, DB, emLen - sLen - hLen - 1, sLen);
    // 9. Let dbMask = MGF(H, emLen - hLen - 1).
    byte[] dbMask = MGF(H, emLen - hLen - 1);
    if (DEBUG && debuglevel > 8)
      {
        debug("dbMask (encode): " + Util.toString(dbMask));
        debug("DB (encode): " + Util.toString(DB));
      }
    // 10. Let maskedDB = DB XOR dbMask.
    for (i = 0; i < DB.length; i++)
      {
        DB[i] = (byte) (DB[i] ^ dbMask[i]);
      }
    // 11. Set the leftmost 8emLen - emBits bits of the leftmost octet in