sha2.js

/**
 * @author KimlikDAO
 */

/**
 * Initial constants
 * @const {!Array<number>}
 */
const IC = [
  0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
  0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19
];

/**
 * Round constants for each of the 64 rounds.
 *
 * @const {!Array<number>}
 */
const RC = [
  0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
  0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
  0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
  0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
  0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
  0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
  0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
  0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
];

/**
 * Given a Uint32Array of length at most 2^32 - 1, outputs the sha256
 * as a Uint32Array of length 8.
 *
 * @param {!Uint32Array} words
 * @return {!Uint32Array} hash as Uint32Array of length 8.
 */
const sha256Uint32 = (words) => {
  /** @const {number} */
  const n = words.length;
  /** @const {!Uint32Array} */
  const s = new Uint32Array(IC);
  /** @const {!Uint32Array} */
  const t = new Uint32Array(64);
  /** @type {number} */
  let i = 0;
  for (const end = n - 15; i < end; i += 16) {
    t.set(words.subarray(i, i + 16))
    f(s, t);
  }
  t.set(words.subarray(i));
  i = n - i;
  t[i] = 1 << 31;
  if (i > 13) {
    if (i == 14) t[15] = 0;
    f(s, t);
    t.fill(0, 0, 14);
  } else
    t.fill(0, i + 1, 14);
  t[14] = n >>> 27;
  t[15] = n << 5;
  f(s, t);
  return s;
}

/** @param {!Uint32Array} t */
const extend = (t) => {
  for (let i = 16, t1, s0, s1; i < 64; ++i) {
    t1 = t[i - 15];
    s0 = ((t1 >>> 7) | (t1 << 25)) ^ ((t1 >>> 18) | (t1 << 14)) ^ (t1 >>> 3);
    t1 = t[i - 2];
    s1 = ((t1 >>> 17) | (t1 << 15)) ^ ((t1 >>> 19) | (t1 << 13)) ^ (t1 >>> 10);
    t[i] = t[i - 16] + s0 + t[i - 7] + s1 << 0;
  }
}

/**
 * The sha256 compression function, implemented 1:1 without loop unrolling.
 *
 * @param {!Uint32Array} s The 8 word working tape, which is also the final out.
 * @param {!Uint32Array} t The 64 word working tape.
 */
const g = (s, t) => {
  extend(t);
  let [a, b, c, d, e, f, g, h] = s;
  for (let i = 0, s0, s1, t1, ch, maj; i < 64; ++i) {
    s0 = ((a >>> 2) | (a << 30)) ^ ((a >>> 13) | (a << 19)) ^ ((a >>> 22) | (a << 10));
    s1 = ((e >>> 6) | (e << 26)) ^ ((e >>> 11) | (e << 21)) ^ ((e >>> 25) | (e << 7));
    ch = (e & f) ^ (~e & g);
    t1 = h + s1 + ch + RC[i] + t[i];
    maj = (a & b) ^ (a & c) ^ (b & c);
    h = g; g = f; f = e; e = d + t1 << 0;
    d = c; c = b; b = a; a = t1 + s0 + maj << 0;
  }
  s[0] += a; s[1] += b; s[2] += c; s[3] += d;
  s[4] += e; s[5] += f; s[6] += g; s[7] += h;
}

/**
 * The sha256 compression function, with 4 rounds unrolled.
 *
 * @param {!Uint32Array} s The 8 word working tape, which is also the final out.
 * @param {!Uint32Array} t The 64 word working tape.
 */
const f = (s, t) => {
  extend(t);
  let [a, b, c, d, e, f, g, h] = s;
  for (let i = 0, s0, s1, maj, t1, t2, ch, ab, da, cd, bc = b & c; i < 64; i += 4) {
    s0 = ((a >>> 2) | (a << 30)) ^ ((a >>> 13) | (a << 19)) ^ ((a >>> 22) | (a << 10));
    s1 = ((e >>> 6) | (e << 26)) ^ ((e >>> 11) | (e << 21)) ^ ((e >>> 25) | (e << 7));
    ab = a & b;
    maj = ab ^ (a & c) ^ bc;
    ch = (e & f) ^ (~e & g);
    t1 = h + s1 + ch + RC[i] + t[i];
    t2 = s0 + maj;
    h = d + t1 << 0;
    d = t1 + t2 << 0;
    s0 = ((d >>> 2) | (d << 30)) ^ ((d >>> 13) | (d << 19)) ^ ((d >>> 22) | (d << 10));
    s1 = ((h >>> 6) | (h << 26)) ^ ((h >>> 11) | (h << 21)) ^ ((h >>> 25) | (h << 7));
    da = d & a;
    maj = da ^ (d & b) ^ ab;
    ch = (h & e) ^ (~h & f);
    t1 = g + s1 + ch + RC[i + 1] + t[i + 1];
    t2 = s0 + maj;
    g = c + t1 << 0;
    c = t1 + t2 << 0;
    s0 = ((c >>> 2) | (c << 30)) ^ ((c >>> 13) | (c << 19)) ^ ((c >>> 22) | (c << 10));
    s1 = ((g >>> 6) | (g << 26)) ^ ((g >>> 11) | (g << 21)) ^ ((g >>> 25) | (g << 7));
    cd = c & d;
    maj = cd ^ (c & a) ^ da;
    ch = (g & h) ^ (~g & e);
    t1 = f + s1 + ch + RC[i + 2] + t[i + 2];
    t2 = s0 + maj;
    f = b + t1 << 0;
    b = t1 + t2 << 0;
    s0 = ((b >>> 2) | (b << 30)) ^ ((b >>> 13) | (b << 19)) ^ ((b >>> 22) | (b << 10));
    s1 = ((f >>> 6) | (f << 26)) ^ ((f >>> 11) | (f << 21)) ^ ((f >>> 25) | (f << 7));
    bc = b & c;
    maj = bc ^ (b & d) ^ cd;
    ch = (f & g) ^ (~f & h);
    t1 = e + s1 + ch + RC[i + 3] + t[i + 3];
    t2 = s0 + maj;
    e = a + t1 << 0;
    a = t1 + t2 << 0;
  }

  s[0] += a; s[1] += b; s[2] += c; s[3] += d;
  s[4] += e; s[5] += f; s[6] += g; s[7] += h;
}

export {
  IC,
  f,
  g,
  sha256Uint32
};