-
Notifications
You must be signed in to change notification settings - Fork 8
/
expander.go
151 lines (131 loc) · 3.32 KB
/
expander.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
package h2c
import (
"crypto"
"errors"
"io"
"math"
"github.com/armfazh/h2c-go-ref/xof"
)
// MaxDSTLength is the maximum allowed length for domain separatio tags.
const MaxDSTLength = 255
var _LongDSTPrefix = [17]byte{'H', '2', 'C', '-', 'O', 'V', 'E', 'R', 'S', 'I', 'Z', 'E', '-', 'D', 'S', 'T', '-'}
// ExpanderType identifies the type of expander function.
type ExpanderType uint
const (
// XMD denotes an expander based on a Merkle-Damgard hash function.
XMD ExpanderType = iota
// XOF denotes an expander based on an extendable output function.
XOF
// OTHER is reserved for a user-designed expander function (not implemented).
OTHER
)
// ExpanderDesc describes an expander
type ExpanderDesc struct {
Type ExpanderType
ID uint // This id is converted to either crypto.Hash or to xof.Xof
}
// Get returns an XOF-based expander.
func (d ExpanderDesc) Get(dst []byte, k uint) (e Expander, err error) {
switch d.Type {
case XMD:
e = &expanderXMD{dst, crypto.Hash(d.ID)}
case XOF:
e = &expanderXOF{dst, xof.XofID(d.ID), k}
default:
return nil, errors.New("expander not supported")
}
return e, e.constructDSTPrime()
}
// Expander allows to generate a pseudo-random byte string of a determined length.
type Expander interface {
constructDSTPrime() error
Expand(in []byte, len uint) (pseudo []byte)
}
type expanderXOF struct {
dst []byte
id xof.XofID
k uint
}
func (e *expanderXOF) constructDSTPrime() (err error) {
if len(e.dst) > MaxDSTLength {
H := e.id.New()
_, _ = H.Write(_LongDSTPrefix[:])
_, _ = H.Write(e.dst)
e.dst = make([]byte, ((2*e.k)+7)/8)
_, err = io.ReadFull(H, e.dst)
}
e.dst = append(e.dst, byte(len(e.dst)))
return err
}
func (e *expanderXOF) Expand(msg []byte, n uint) []byte {
if n > math.MaxUint16 || len(e.dst) > math.MaxUint8 {
panic(errors.New("requested too many bytes"))
}
bLen := []byte{0, 0}
bLen[0] = byte((n >> 8) & 0xFF)
bLen[1] = byte(n & 0xFF)
pseudo := make([]byte, n)
H := e.id.New()
_, _ = H.Write(msg)
_, _ = H.Write(bLen)
_, _ = H.Write(e.dst)
_, err := io.ReadFull(H, pseudo)
if err != nil {
panic(err)
}
return pseudo
}
type expanderXMD struct {
dst []byte
id crypto.Hash
}
func (e *expanderXMD) constructDSTPrime() error {
if len(e.dst) > MaxDSTLength {
H := e.id.New()
_, _ = H.Write(_LongDSTPrefix[:])
_, _ = H.Write(e.dst)
e.dst = H.Sum(nil)
}
e.dst = append(e.dst, byte(len(e.dst)))
return nil
}
func (e *expanderXMD) Expand(msg []byte, n uint) []byte {
H := e.id.New()
bLen := uint(H.Size())
ell := (n + (bLen - 1)) / bLen
if ell > math.MaxUint8 || n > math.MaxUint16 || len(e.dst) > math.MaxUint8 {
panic(errors.New("requested too many bytes"))
}
zPad := make([]byte, H.BlockSize())
libStr := []byte{0, 0}
libStr[0] = byte((n >> 8) & 0xFF)
libStr[1] = byte(n & 0xFF)
H.Reset()
_, _ = H.Write(zPad)
_, _ = H.Write(msg)
_, _ = H.Write(libStr)
_, _ = H.Write([]byte{0})
_, _ = H.Write(e.dst)
b0 := H.Sum(nil)
H.Reset()
_, _ = H.Write(b0)
_, _ = H.Write([]byte{1})
_, _ = H.Write(e.dst)
bi := H.Sum(nil)
pseudo := append([]byte{}, bi...)
for i := uint(2); i <= ell; i++ {
H.Reset()
_, _ = H.Write(xor(bi, b0))
_, _ = H.Write([]byte{byte(i)})
_, _ = H.Write(e.dst)
bi = H.Sum(nil)
pseudo = append(pseudo, bi...)
}
return pseudo[0:n]
}
func xor(x, y []byte) []byte {
for i := range x {
x[i] ^= y[i]
}
return x
}