算法处理分如下几步:
- 消息填充
消息填充分为两部分:第一部分是附加填充比特,第二部分是附加长度,目的是让整个消息满足指定的结构,从而处理起来可以统一化、格式化。
附加填充比特:指在消息尾部进行填充,使报文长度在对1024取模后的余数为896。具体操作是:先被1比特1,然后都被0,直到满足对1024取模余896。需要注意的是:即使原始消息长度已经满足对1024取模余896,补位也需要进行,这时地填充1024比特。所以附加填充时至少补1位,最多补1024位。
附加长度:将原始数据的长度信息补到已经进行了填充的消息后面。
- 消息分组
消息分组指将消息填充后的数据按1024(16*64bit)进行分组,并扩充为80*64bit,扩充算法如下:
当 0 ≤ t ≤ 15 时,W[t] = M[t],M[t]为512bit原始数据中第t个32bit数据。
当 16 ≤ t ≤ 63时,W[t] = W[t-7] + (W[t-2] >>> 19) ⊕ (W[t-2] >>> 61) ⊕ (W[t-2] >> 6) + \
W[t-16] + (W[t-15] >>> 1) ⊕ (W[t-15] >>> 8) ⊕ (W[t-15] >> 7)
消息填充和消息分组处理图示如下:
- 迭代运算
SHA-384/SHA-512算法对输入的消息进行64轮迭代运算,分别输出不同长度的HASH结果。
SHA-384/SHA-512处理过程中会用到8个哈希初值和64个哈希常量。
SHA-384/SHA-512的8个哈希初值分别为:
SHA-384:
A=0xCBBB9D5DC1059ED8,B=0x629A292A367CD507,
C=0x9159015A3070DD17,D=0x152FECD8F70E5939
E=0x67332667FFC00B31,F=0x8EB44A8768581511,
G=0xDB0C2E0D64F98FA7,H=0x47B5481DBEFA4FA4
SHA-512:
A=0x6A09E667F3BCC908,B=0xBB67AE8584CAA73B,
C=0x3C6EF372FE94F82B,D=0xA54FF53A5F1D36F1
E=0x510E527FADE682D1,F=0x9B05688C2B3E6C1F,
G=0x1F83D9ABFB41BD6B,H=0x5BE0CD19137E2179
64个哈希常量:
0x428A2F98D728AE22 | 0x7137449123EF65CD | 0xB5C0FBCFEC4D3B2F | 0xE9B5DBA58189DBBC |
0x3956C25BF348B538 | 0x59F111F1B605D019 | 0x923F82A4AF194F9B | 0xAB1C5ED5DA6D8118 |
0xD807AA98A3030242 | 0x12835B0145706FBE | 0x243185BE4EE4B28C | 0x550C7DC3D5FFB4E2 |
0x72BE5D74F27B896F | 0x80DEB1FE3B1696B1 | 0x9BDC06A725C71235 | 0xC19BF174CF692694 |
0xE49B69C19EF14AD2 | 0xEFBE4786384F25E3 | 0x0FC19DC68B8CD5B5 | 0x240CA1CC77AC9C65 |
0x2DE92C6F592B0275 | 0x4A7484AA6EA6E483 | 0x5CB0A9DCBD41FBD4 | 0x76F988DA831153B5 |
0x983E5152EE66DFAB | 0xA831C66D2DB43210 | 0xB00327C898FB213F | 0xBF597FC7BEEF0EE4 |
0xC6E00BF33DA88FC2 | 0xD5A79147930AA725 | 0x06CA6351E003826F | 0x142929670A0E6E70 |
0x27B70A8546D22FFC | 0x2E1B21385C26C926 | 0x4D2C6DFC5AC42AED | 0x53380D139D95B3DF |
0x650A73548BAF63DE | 0x766A0ABB3C77B2A8 | 0x81C2C92E47EDAEE6 | 0x92722C851482353B |
0xA2BFE8A14CF10364 | 0xA81A664BBC423001 | 0xC24B8B70D0F89791 | 0xC76C51A30654BE30 |
0xD192E819D6EF5218 | 0xD69906245565A910 | 0xF40E35855771202A | 0x106AA07032BBD1B8 |
0x19A4C116B8D2D0C8 | 0x1E376C085141AB53 | 0x2748774CDF8EEB99 | 0x34B0BCB5E19B48A8 |
0x391C0CB3C5C95A63 | 0x4ED8AA4AE3418ACB | 0x5B9CCA4F7763E373 | 0x682E6FF3D6B2B8A3 |
0x748F82EE5DEFB2FC | 0x78A5636F43172F60 | 0x84C87814A1F0AB72 | 0x8CC702081A6439EC |
0x90BEFFFA23631E28 | 0xA4506CEBDE82BDE9 | 0xBEF9A3F7B2C67915 | 0xC67178F2E372532B |
0xCA273ECEEA26619C | 0xD186B8C721C0C207 | 0xEADA7DD6CDE0EB1E | 0xF57D4F7FEE6ED178 |
0x06F067AA72176FBA | 0x0A637DC5A2C898A6 | 0x113F9804BEF90DAE | 0x1B710B35131C471B |
0x28DB77F523047D84 | 0x32CAAB7B40C72493 | 0x3C9EBE0A15C9BEBC | 0x431D67C49C100D4C |
0x4CC5D4BECB3E42B6 | 0x597F299CFC657E2A | 0x5FCB6FAB3AD6FAEC | 0x6C44198C4A475817 |
SHA-384/512迭代运算的详细流程为:
1. 哈希初值赋值:
H0=A,H1=B,H2=C,H3=D,H4=E,H5=F,H6=G,H7=H
2. 80轮迭代运算
for (t=0; t≤64; t++)
{
T1 = H + (E >>> 14) ⊕ (E >>> 18) ⊕ (E >>>41) + (E & F) ⊕ (~E & G) + K[t] + W[t]
T2 = (A >>> 28) ⊕ (A >>> 34) ⊕ (A >>>39) + (A & B) ⊕ (A & C) ⊕ (B & C)
H = G;
G = F;
F = E;
E = D + T1;
D = C;
C = B;
B = A;
A = T1 + T2;
}
3. 结果输出
SHA-384输出384bit:
H0=H0+A,H1=H1+B,H2=H2+C,H3=H3+D,H4=H4+E,H5=H5+F
SHA-512输出512bit:
H0=H0+A,H1=H1+B,H2=H2+C,H3=H3+D,H4=H4+E,H5=H5+F,H6=H6+G,H7=H7+H
SHA-512/224输出224bit:
H0=H0+A,H1=H1+B,H2=H2+C,H3[63:32]=H3[63:32]+D[63:32]
SHA-256输出256bit:
H0=H0+A,H1=H1+B,H2=H2+C,H3=H3+D