// Copyright 2014 The Closure Library Authors. All Rights Reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS-IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

/**
 * @fileoverview Base class for the 64-bit SHA-2 cryptographic hashes.
 *
 * Variable names follow the notation in FIPS PUB 180-3:
 * http://csrc.nist.gov/publications/fips/fips180-3/fips180-3_final.pdf.
 *
 * This code borrows heavily from the 32-bit SHA2 implementation written by
 * Yue Zhang (zysxqn@).
 *
 * @author fy@google.com (Frank Yellin)
 */

goog.provide('goog.crypt.Sha2_64bit');

goog.require('goog.array');
goog.require('goog.asserts');
goog.require('goog.crypt.Hash');
goog.require('goog.math.Long');



/**
 * Constructs a SHA-2 64-bit cryptographic hash.
 * This class should not be used. Rather, one should use one of its
 * subclasses.
 * @constructor
 * @param {number} numHashBlocks The size of the output in 16-byte blocks
 * @param {!Array<number>} initHashBlocks The hash-specific initialization
 *     vector, as a sequence of sixteen 32-bit numbers.
 * @extends {goog.crypt.Hash}
 * @struct
 */
goog.crypt.Sha2_64bit = function(numHashBlocks, initHashBlocks) {
  goog.crypt.Sha2_64bit.base(this, 'constructor');

  /**
   * The number of bytes that are digested in each pass of this hasher.
   * @const {number}
   */
  this.blockSize = goog.crypt.Sha2_64bit.BLOCK_SIZE_;

  /**
   * A chunk holding the currently processed message bytes. Once the chunk has
   * {@code this.blocksize} bytes, we feed it into [@code computeChunk_}.
   * @private {!Uint8Array|!Array<number>}
   */
  this.chunk_ = goog.global['Uint8Array'] ? new Uint8Array(this.blockSize) :
                                            new Array(this.blockSize);

  /**
   * Current number of bytes in {@code this.chunk_}.
   * @private {number}
   */
  this.chunkBytes_ = 0;

  /**
   * Total number of bytes in currently processed message.
   * @private {number}
   */
  this.total_ = 0;

  /**
   * Holds the previous values of accumulated hash a-h in the
   * {@code computeChunk_} function.
   * @private {!Array<!goog.math.Long>}
   */
  this.hash_ = [];

  /**
   * The number of blocks of output produced by this hash function, where each
   * block is eight bytes long.
   * @private {number}
   */
  this.numHashBlocks_ = numHashBlocks;

  /**
   * Temporary array used in chunk computation.  Allocate here as a
   * member rather than as a local within computeChunk_() as a
   * performance optimization to reduce the number of allocations and
   * reduce garbage collection.
   * @type {!Array<!goog.math.Long>}
   * @private
   */
  this.w_ = [];

  /**
   * The value to which {@code this.hash_} should be reset when this
   * Hasher is reset.
   * @private @const {!Array<!goog.math.Long>}
   */
  this.initHashBlocks_ = goog.crypt.Sha2_64bit.toLongArray_(initHashBlocks);

  /**
   * If true, we have taken the digest from this hasher, but we have not
   * yet reset it.
   *
   * @private {boolean}
   */
  this.needsReset_ = false;

  this.reset();
};
goog.inherits(goog.crypt.Sha2_64bit, goog.crypt.Hash);


/**
 * The number of bytes that are digested in each pass of this hasher.
 * @private @const {number}
 */
goog.crypt.Sha2_64bit.BLOCK_SIZE_ = 1024 / 8;


/**
 * Contains data needed to pad messages less than {@code blocksize} bytes.
 * @private {!Array<number>}
 */
goog.crypt.Sha2_64bit.PADDING_ = goog.array.concat(
    [0x80], goog.array.repeat(0, goog.crypt.Sha2_64bit.BLOCK_SIZE_ - 1));


/**
 * Resets this hash function.
 * @override
 */
goog.crypt.Sha2_64bit.prototype.reset = function() {
  this.chunkBytes_ = 0;
  this.total_ = 0;
  this.hash_ = goog.array.clone(this.initHashBlocks_);
  this.needsReset_ = false;
};


/** @override */
goog.crypt.Sha2_64bit.prototype.update = function(message, opt_length) {
  var length = goog.isDef(opt_length) ? opt_length : message.length;

  // Make sure this hasher is usable.
  if (this.needsReset_) {
    throw Error('this hasher needs to be reset');
  }
  // Process the message from left to right up to |length| bytes.
  // When we get a 512-bit chunk, compute the hash of it and reset
  // this.chunk_. The message might not be multiple of 512 bits so we
  // might end up with a chunk that is less than 512 bits. We store
  // such partial chunk in chunk_ and it will be filled up later
  // in digest().
  var chunkBytes = this.chunkBytes_;

  // The input message could be either byte array or string.
  if (goog.isString(message)) {
    for (var i = 0; i < length; i++) {
      var b = message.charCodeAt(i);
      if (b > 255) {
        throw Error('Characters must be in range [0,255]');
      }
      this.chunk_[chunkBytes++] = b;
      if (chunkBytes == this.blockSize) {
        this.computeChunk_();
        chunkBytes = 0;
      }
    }
  } else if (goog.isArrayLike(message)) {
    for (var i = 0; i < length; i++) {
      var b = message[i];
      // Hack:  b|0 coerces b to an integer, so the last part confirms that
      // b has no fractional part.
      if (!goog.isNumber(b) || b < 0 || b > 255 || b != (b | 0)) {
        throw Error('message must be a byte array');
      }
      this.chunk_[chunkBytes++] = b;
      if (chunkBytes == this.blockSize) {
        this.computeChunk_();
        chunkBytes = 0;
      }
    }
  } else {
    throw Error('message must be string or array');
  }

  // Record the current bytes in chunk to support partial update.
  this.chunkBytes_ = chunkBytes;

  // Record total message bytes we have processed so far.
  this.total_ += length;
};


/** @override */
goog.crypt.Sha2_64bit.prototype.digest = function() {
  if (this.needsReset_) {
    throw Error('this hasher needs to be reset');
  }
  var totalBits = this.total_ * 8;

  // Append pad 0x80 0x00* until this.chunkBytes_ == 112
  if (this.chunkBytes_ < 112) {
    this.update(goog.crypt.Sha2_64bit.PADDING_, 112 - this.chunkBytes_);
  } else {
    // the rest of this block, plus 112 bytes of next block
    this.update(
        goog.crypt.Sha2_64bit.PADDING_,
        this.blockSize - this.chunkBytes_ + 112);
  }

  // Append # bits in the 64-bit big-endian format.
  for (var i = 127; i >= 112; i--) {
    this.chunk_[i] = totalBits & 255;
    totalBits /= 256;  // Don't use bit-shifting here!
  }
  this.computeChunk_();

  // Finally, output the result digest.
  var n = 0;
  var digest = new Array(8 * this.numHashBlocks_);
  for (var i = 0; i < this.numHashBlocks_; i++) {
    var block = this.hash_[i];
    var high = block.getHighBits();
    var low = block.getLowBits();
    for (var j = 24; j >= 0; j -= 8) {
      digest[n++] = ((high >> j) & 255);
    }
    for (var j = 24; j >= 0; j -= 8) {
      digest[n++] = ((low >> j) & 255);
    }
  }

  // The next call to this hasher must be a reset
  this.needsReset_ = true;
  return digest;
};


/**
 * Updates this hash by processing the 1024-bit message chunk in this.chunk_.
 * @private
 */
goog.crypt.Sha2_64bit.prototype.computeChunk_ = function() {
  var chunk = this.chunk_;
  var K_ = goog.crypt.Sha2_64bit.K_;

  // Divide the chunk into 16 64-bit-words.
  var w = this.w_;
  for (var i = 0; i < 16; i++) {
    var offset = i * 8;
    w[i] = new goog.math.Long(
        (chunk[offset + 4] << 24) | (chunk[offset + 5] << 16) |
            (chunk[offset + 6] << 8) | (chunk[offset + 7]),
        (chunk[offset] << 24) | (chunk[offset + 1] << 16) |
            (chunk[offset + 2] << 8) | (chunk[offset + 3]));
  }

  // Extend the w[] array to be the number of rounds.
  for (var i = 16; i < 80; i++) {
    var s0 = this.sigma0_(w[i - 15]);
    var s1 = this.sigma1_(w[i - 2]);
    w[i] = this.sum_(w[i - 16], w[i - 7], s0, s1);
  }

  var a = this.hash_[0];
  var b = this.hash_[1];
  var c = this.hash_[2];
  var d = this.hash_[3];
  var e = this.hash_[4];
  var f = this.hash_[5];
  var g = this.hash_[6];
  var h = this.hash_[7];
  for (var i = 0; i < 80; i++) {
    var S0 = this.Sigma0_(a);
    var maj = this.majority_(a, b, c);
    var t2 = S0.add(maj);
    var S1 = this.Sigma1_(e);
    var ch = this.choose_(e, f, g);
    var t1 = this.sum_(h, S1, ch, K_[i], w[i]);
    h = g;
    g = f;
    f = e;
    e = d.add(t1);
    d = c;
    c = b;
    b = a;
    a = t1.add(t2);
  }

  this.hash_[0] = this.hash_[0].add(a);
  this.hash_[1] = this.hash_[1].add(b);
  this.hash_[2] = this.hash_[2].add(c);
  this.hash_[3] = this.hash_[3].add(d);
  this.hash_[4] = this.hash_[4].add(e);
  this.hash_[5] = this.hash_[5].add(f);
  this.hash_[6] = this.hash_[6].add(g);
  this.hash_[7] = this.hash_[7].add(h);
};


/**
 * Calculates the SHA2 64-bit sigma0 function.
 * rotateRight(value, 1) ^ rotateRight(value, 8) ^ (value >>> 7)
 *
 * @private
 * @param {!goog.math.Long} value
 * @return {!goog.math.Long}
 */
goog.crypt.Sha2_64bit.prototype.sigma0_ = function(value) {
  var valueLow = value.getLowBits();
  var valueHigh = value.getHighBits();
  // Implementation note: We purposely do not use the shift operations defined
  // in goog.math.Long.  Inlining the code for specific values of shifting and
  // not generating the intermediate results doubles the speed of this code.
  var low = (valueLow >>> 1) ^ (valueHigh << 31) ^ (valueLow >>> 8) ^
      (valueHigh << 24) ^ (valueLow >>> 7) ^ (valueHigh << 25);
  var high = (valueHigh >>> 1) ^ (valueLow << 31) ^ (valueHigh >>> 8) ^
      (valueLow << 24) ^ (valueHigh >>> 7);
  return new goog.math.Long(low, high);
};


/**
 * Calculates the SHA2 64-bit sigma1 function.
 * rotateRight(value, 19) ^ rotateRight(value, 61) ^ (value >>> 6)
 *
 * @private
 * @param {!goog.math.Long} value
 * @return {!goog.math.Long}
 */
goog.crypt.Sha2_64bit.prototype.sigma1_ = function(value) {
  var valueLow = value.getLowBits();
  var valueHigh = value.getHighBits();
  // Implementation note:  See _sigma0() above
  var low = (valueLow >>> 19) ^ (valueHigh << 13) ^ (valueHigh >>> 29) ^
      (valueLow << 3) ^ (valueLow >>> 6) ^ (valueHigh << 26);
  var high = (valueHigh >>> 19) ^ (valueLow << 13) ^ (valueLow >>> 29) ^
      (valueHigh << 3) ^ (valueHigh >>> 6);
  return new goog.math.Long(low, high);
};


/**
 * Calculates the SHA2 64-bit Sigma0 function.
 * rotateRight(value, 28) ^ rotateRight(value, 34) ^ rotateRight(value, 39)
 *
 * @private
 * @param {!goog.math.Long} value
 * @return {!goog.math.Long}
 */
goog.crypt.Sha2_64bit.prototype.Sigma0_ = function(value) {
  var valueLow = value.getLowBits();
  var valueHigh = value.getHighBits();
  // Implementation note:  See _sigma0() above
  var low = (valueLow >>> 28) ^ (valueHigh << 4) ^ (valueHigh >>> 2) ^
      (valueLow << 30) ^ (valueHigh >>> 7) ^ (valueLow << 25);
  var high = (valueHigh >>> 28) ^ (valueLow << 4) ^ (valueLow >>> 2) ^
      (valueHigh << 30) ^ (valueLow >>> 7) ^ (valueHigh << 25);
  return new goog.math.Long(low, high);
};


/**
 * Calculates the SHA2 64-bit Sigma1 function.
 * rotateRight(value, 14) ^ rotateRight(value, 18) ^ rotateRight(value, 41)
 *
 * @private
 * @param {!goog.math.Long} value
 * @return {!goog.math.Long}
 */
goog.crypt.Sha2_64bit.prototype.Sigma1_ = function(value) {
  var valueLow = value.getLowBits();
  var valueHigh = value.getHighBits();
  // Implementation note:  See _sigma0() above
  var low = (valueLow >>> 14) ^ (valueHigh << 18) ^ (valueLow >>> 18) ^
      (valueHigh << 14) ^ (valueHigh >>> 9) ^ (valueLow << 23);
  var high = (valueHigh >>> 14) ^ (valueLow << 18) ^ (valueHigh >>> 18) ^
      (valueLow << 14) ^ (valueLow >>> 9) ^ (valueHigh << 23);
  return new goog.math.Long(low, high);
};


/**
 * Calculates the SHA-2 64-bit choose function.
 *
 * This function uses {@code value} as a mask to choose bits from either
 * {@code one} if the bit is set or {@code two} if the bit is not set.
 *
 * @private
 * @param {!goog.math.Long} value
 * @param {!goog.math.Long} one
 * @param {!goog.math.Long} two
 * @return {!goog.math.Long}
 */
goog.crypt.Sha2_64bit.prototype.choose_ = function(value, one, two) {
  var valueLow = value.getLowBits();
  var valueHigh = value.getHighBits();
  return new goog.math.Long(
      (valueLow & one.getLowBits()) | (~valueLow & two.getLowBits()),
      (valueHigh & one.getHighBits()) | (~valueHigh & two.getHighBits()));
};


/**
 * Calculates the SHA-2 64-bit majority function.
 * This function returns, for each bit position, the bit held by the majority
 * of its three arguments.
 *
 * @private
 * @param {!goog.math.Long} one
 * @param {!goog.math.Long} two
 * @param {!goog.math.Long} three
 * @return {!goog.math.Long}
 */
goog.crypt.Sha2_64bit.prototype.majority_ = function(one, two, three) {
  return new goog.math.Long(
      (one.getLowBits() & two.getLowBits()) |
          (two.getLowBits() & three.getLowBits()) |
          (one.getLowBits() & three.getLowBits()),
      (one.getHighBits() & two.getHighBits()) |
          (two.getHighBits() & three.getHighBits()) |
          (one.getHighBits() & three.getHighBits()));
};


/**
 * Adds two or more goog.math.Long values.
 *
 * @private
 * @param {!goog.math.Long} one first summand
 * @param {!goog.math.Long} two second summand
 * @param {...goog.math.Long} var_args more arguments to sum
 * @return {!goog.math.Long} The resulting sum.
 */
goog.crypt.Sha2_64bit.prototype.sum_ = function(one, two, var_args) {
  // The low bits may be signed, but they represent a 32-bit unsigned quantity.
  // We must be careful to normalize them.
  // This doesn't matter for the high bits.
  // Implementation note:  Performance testing shows that this method runs
  // fastest when the first two arguments are pulled out of the loop.
  var low = (one.getLowBits() ^ 0x80000000) + (two.getLowBits() ^ 0x80000000);
  var high = one.getHighBits() + two.getHighBits();
  for (var i = arguments.length - 1; i >= 2; --i) {
    low += arguments[i].getLowBits() ^ 0x80000000;
    high += arguments[i].getHighBits();
  }
  // Because of the ^0x80000000, each value we added is 0x80000000 too small.
  // Add arguments.length * 0x80000000 to the current sum.  We can do this
  // quickly by adding 0x80000000 to low when the number of arguments is
  // odd, and adding (number of arguments) >> 1 to high.
  if (arguments.length & 1) {
    low += 0x80000000;
  }
  high += arguments.length >> 1;

  // If low is outside the range [0, 0xFFFFFFFF], its overflow or underflow
  // should be added to high.  We don't actually need to modify low or
  // normalize high because the goog.math.Long constructor already does that.
  high += Math.floor(low / 0x100000000);
  return new goog.math.Long(low, high);
};


/**
 * Converts an array of 32-bit integers into an array of goog.math.Long
 * elements.
 *
 * @private
 * @param {!Array<number>} values An array of 32-bit numbers.  Its length
 *     must be even.  Each pair of numbers represents a 64-bit integer
 *     in big-endian order
 * @return {!Array<!goog.math.Long>}
 */
goog.crypt.Sha2_64bit.toLongArray_ = function(values) {
  goog.asserts.assert(values.length % 2 == 0);
  var result = [];
  for (var i = 0; i < values.length; i += 2) {
    result.push(new goog.math.Long(values[i + 1], values[i]));
  }
  return result;
};


/**
 * Fixed constants used in SHA-512 variants.
 *
 * These values are from Section 4.2.3 of
 * http://csrc.nist.gov/publications/fips/fips180-4/fips-180-4.pdf
 * @const
 * @private {!Array<!goog.math.Long>}
 */
goog.crypt.Sha2_64bit.K_ = goog.crypt.Sha2_64bit.toLongArray_([
  0x428a2f98, 0xd728ae22, 0x71374491, 0x23ef65cd, 0xb5c0fbcf, 0xec4d3b2f,
  0xe9b5dba5, 0x8189dbbc, 0x3956c25b, 0xf348b538, 0x59f111f1, 0xb605d019,
  0x923f82a4, 0xaf194f9b, 0xab1c5ed5, 0xda6d8118, 0xd807aa98, 0xa3030242,
  0x12835b01, 0x45706fbe, 0x243185be, 0x4ee4b28c, 0x550c7dc3, 0xd5ffb4e2,
  0x72be5d74, 0xf27b896f, 0x80deb1fe, 0x3b1696b1, 0x9bdc06a7, 0x25c71235,
  0xc19bf174, 0xcf692694, 0xe49b69c1, 0x9ef14ad2, 0xefbe4786, 0x384f25e3,
  0x0fc19dc6, 0x8b8cd5b5, 0x240ca1cc, 0x77ac9c65, 0x2de92c6f, 0x592b0275,
  0x4a7484aa, 0x6ea6e483, 0x5cb0a9dc, 0xbd41fbd4, 0x76f988da, 0x831153b5,
  0x983e5152, 0xee66dfab, 0xa831c66d, 0x2db43210, 0xb00327c8, 0x98fb213f,
  0xbf597fc7, 0xbeef0ee4, 0xc6e00bf3, 0x3da88fc2, 0xd5a79147, 0x930aa725,
  0x06ca6351, 0xe003826f, 0x14292967, 0x0a0e6e70, 0x27b70a85, 0x46d22ffc,
  0x2e1b2138, 0x5c26c926, 0x4d2c6dfc, 0x5ac42aed, 0x53380d13, 0x9d95b3df,
  0x650a7354, 0x8baf63de, 0x766a0abb, 0x3c77b2a8, 0x81c2c92e, 0x47edaee6,
  0x92722c85, 0x1482353b, 0xa2bfe8a1, 0x4cf10364, 0xa81a664b, 0xbc423001,
  0xc24b8b70, 0xd0f89791, 0xc76c51a3, 0x0654be30, 0xd192e819, 0xd6ef5218,
  0xd6990624, 0x5565a910, 0xf40e3585, 0x5771202a, 0x106aa070, 0x32bbd1b8,
  0x19a4c116, 0xb8d2d0c8, 0x1e376c08, 0x5141ab53, 0x2748774c, 0xdf8eeb99,
  0x34b0bcb5, 0xe19b48a8, 0x391c0cb3, 0xc5c95a63, 0x4ed8aa4a, 0xe3418acb,
  0x5b9cca4f, 0x7763e373, 0x682e6ff3, 0xd6b2b8a3, 0x748f82ee, 0x5defb2fc,
  0x78a5636f, 0x43172f60, 0x84c87814, 0xa1f0ab72, 0x8cc70208, 0x1a6439ec,
  0x90befffa, 0x23631e28, 0xa4506ceb, 0xde82bde9, 0xbef9a3f7, 0xb2c67915,
  0xc67178f2, 0xe372532b, 0xca273ece, 0xea26619c, 0xd186b8c7, 0x21c0c207,
  0xeada7dd6, 0xcde0eb1e, 0xf57d4f7f, 0xee6ed178, 0x06f067aa, 0x72176fba,
  0x0a637dc5, 0xa2c898a6, 0x113f9804, 0xbef90dae, 0x1b710b35, 0x131c471b,
  0x28db77f5, 0x23047d84, 0x32caab7b, 0x40c72493, 0x3c9ebe0a, 0x15c9bebc,
  0x431d67c4, 0x9c100d4c, 0x4cc5d4be, 0xcb3e42b6, 0x597f299c, 0xfc657e2a,
  0x5fcb6fab, 0x3ad6faec, 0x6c44198c, 0x4a475817
]);