Return reset for hash/signature functions

whyoleg · whyoleg · commit 96f1ccc98814 · 2024-10-07T08:08:46.000+03:00
diff --git a/cryptography-core/api/cryptography-core.api b/cryptography-core/api/cryptography-core.api
@@ -866,6 +866,7 @@ public abstract interface class dev/whyoleg/cryptography/operations/SignatureVer
 }
 
 public abstract interface class dev/whyoleg/cryptography/operations/UpdateFunction : java/lang/AutoCloseable {
+	public abstract fun reset ()V
 	public fun update (Lkotlinx/io/RawSource;)V
 	public fun update (Lkotlinx/io/bytestring/ByteString;II)V
 	public abstract fun update ([BII)V
diff --git a/cryptography-core/api/cryptography-core.klib.api b/cryptography-core/api/cryptography-core.klib.api
@@ -685,6 +685,7 @@ abstract interface dev.whyoleg.cryptography.operations/SignatureVerifier { // de
 }
 
 abstract interface dev.whyoleg.cryptography.operations/UpdateFunction : kotlin/AutoCloseable { // dev.whyoleg.cryptography.operations/UpdateFunction|null[0]
+    abstract fun reset() // dev.whyoleg.cryptography.operations/UpdateFunction.reset|reset(){}[0]
     abstract fun update(kotlin/ByteArray, kotlin/Int = ..., kotlin/Int = ...) // dev.whyoleg.cryptography.operations/UpdateFunction.update|update(kotlin.ByteArray;kotlin.Int;kotlin.Int){}[0]
     open fun update(kotlinx.io.bytestring/ByteString, kotlin/Int = ..., kotlin/Int = ...) // dev.whyoleg.cryptography.operations/UpdateFunction.update|update(kotlinx.io.bytestring.ByteString;kotlin.Int;kotlin.Int){}[0]
     open fun update(kotlinx.io/RawSource) // dev.whyoleg.cryptography.operations/UpdateFunction.update|update(kotlinx.io.RawSource){}[0]
diff --git a/cryptography-core/src/commonMain/kotlin/operations/UpdateFunction.kt b/cryptography-core/src/commonMain/kotlin/operations/UpdateFunction.kt
@@ -11,6 +11,8 @@ import kotlinx.io.unsafe.*
 
 @SubclassOptInRequired(CryptographyProviderApi::class)
 public interface UpdateFunction : AutoCloseable {
+    public fun reset()
+
     public fun update(source: ByteArray, startIndex: Int = 0, endIndex: Int = source.size)
     public fun update(source: ByteString, startIndex: Int = 0, endIndex: Int = source.size) {
         update(source.asByteArray(), startIndex, endIndex)
diff --git a/cryptography-providers-tests/src/commonMain/kotlin/default/DigestTest.kt b/cryptography-providers-tests/src/commonMain/kotlin/default/DigestTest.kt
@@ -91,6 +91,33 @@ abstract class DigestTest(provider: CryptographyProvider) : ProviderTest(provide
         }
     }
 
+    @Test
+    fun testFunctionReuse() = testAlgorithm(SHA256) {
+        if (!supportsFunctions()) return@testAlgorithm
+
+        val hasher = algorithm.hasher()
+        val bytes1 = ByteString(CryptographyRandom.nextBytes(10000))
+        val bytes2 = ByteString(CryptographyRandom.nextBytes(10000))
+
+        val digest1 = hasher.hash(bytes1)
+        val digest2 = hasher.hash(bytes2)
+        hasher.createHashFunction().use { function ->
+            function.update(bytes1)
+            assertContentEquals(digest1, function.hash())
+
+            function.update(bytes2)
+            assertContentEquals(digest2, function.hash())
+
+            // update and then discard
+            function.update(bytes1)
+            function.update(bytes1)
+            function.reset()
+            // update after reset
+            function.update(bytes1)
+            assertContentEquals(digest1, function.hash())
+        }
+    }
+
     @Test
     fun testFunctionSource() = testAlgorithm(SHA256) {
         val hasher = algorithm.hasher()
diff --git a/cryptography-providers/apple/src/commonMain/kotlin/algorithms/CCDigest.kt b/cryptography-providers/apple/src/commonMain/kotlin/algorithms/CCDigest.kt
@@ -16,21 +16,20 @@ internal class CCDigest<CTX : CPointed>(
     override val id: CryptographyAlgorithmId<Digest>,
 ) : Hasher, Digest {
     override fun hasher(): Hasher = this
-    override fun createHashFunction(): HashFunction {
-        val context = hashAlgorithm.alloc()
-        // TODO: error handle
-        hashAlgorithm.ccInit(context)
-        return CCHashFunction(
-            algorithm = hashAlgorithm,
-            context = Resource(context, nativeHeap::free)
-        )
-    }
+    override fun createHashFunction(): HashFunction = CCHashFunction(
+        algorithm = hashAlgorithm,
+        context = Resource(hashAlgorithm.alloc(), nativeHeap::free)
+    )
 }
 
 private class CCHashFunction<CTX : CPointed>(
     private val algorithm: CCHashAlgorithm<CTX>,
     private val context: Resource<CPointer<CTX>>,
 ) : HashFunction, SafeCloseable(SafeCloseAction(context, AutoCloseable::close)) {
+    init {
+        reset()
+    }
+
     override fun update(source: ByteArray, startIndex: Int, endIndex: Int) {
         checkBounds(source.size, startIndex, endIndex)
 
@@ -47,7 +46,7 @@ private class CCHashFunction<CTX : CPointed>(
         destination.usePinned {
             check(algorithm.ccFinal(context, it.safeAddressOf(destinationOffset).reinterpret()) > 0)
         }
-        close()
+        reset()
         return algorithm.digestSize
     }
 
@@ -56,4 +55,9 @@ private class CCHashFunction<CTX : CPointed>(
         hashIntoByteArray(output)
         return output
     }
+
+    override fun reset() {
+        val context = context.access()
+        check(algorithm.ccInit(context) > 0)
+    }
 }
diff --git a/cryptography-providers/apple/src/commonMain/kotlin/algorithms/CCHmac.kt b/cryptography-providers/apple/src/commonMain/kotlin/algorithms/CCHmac.kt
@@ -83,25 +83,26 @@ private class HmacSignature(
     private val key: ByteArray,
     private val digestSize: Int,
 ) : SignatureGenerator, SignatureVerifier {
-
-    @OptIn(UnsafeNumber::class)
-    private fun createFunction(): HmacFunction {
-        val context = nativeHeap.alloc<CCHmacContext>().ptr
-        // TODO: error handle?
-        key.usePinned {
-            CCHmacInit(context, hmacAlgorithm, it.safeAddressOf(0), key.size.convert())
-        }
-        return HmacFunction(digestSize, Resource(context, nativeHeap::free))
-    }
+    private fun createFunction() = HmacFunction(
+        hmacAlgorithm = hmacAlgorithm,
+        key = key,
+        digestSize = digestSize,
+        context = Resource(nativeHeap.alloc<CCHmacContext>().ptr, nativeHeap::free)
+    )
 
     override fun createSignFunction(): SignFunction = createFunction()
     override fun createVerifyFunction(): VerifyFunction = createFunction()
 }
 
 private class HmacFunction(
+    private val hmacAlgorithm: CCHmacAlgorithm,
+    private val key: ByteArray,
     private val digestSize: Int,
     private val context: Resource<CPointer<CCHmacContext>>,
 ) : SignFunction, VerifyFunction, SafeCloseable(SafeCloseAction(context, AutoCloseable::close)) {
+    init {
+        reset()
+    }
 
     @OptIn(UnsafeNumber::class)
     override fun update(source: ByteArray, startIndex: Int, endIndex: Int) {
@@ -120,7 +121,7 @@ private class HmacFunction(
         destination.usePinned {
             CCHmacFinal(context, it.safeAddressOf(destinationOffset))
         }
-        close()
+        reset()
         return digestSize
     }
 
@@ -138,4 +139,12 @@ private class HmacFunction(
     override fun verify(signature: ByteArray, startIndex: Int, endIndex: Int) {
         check(tryVerify(signature, startIndex, endIndex)) { "Invalid signature" }
     }
+
+    @OptIn(UnsafeNumber::class)
+    override fun reset() {
+        val context = context.access()
+        key.usePinned {
+            CCHmacInit(context, hmacAlgorithm, it.safeAddressOf(0), key.size.convert())
+        }
+    }
 }
diff --git a/cryptography-providers/apple/src/commonMain/kotlin/algorithms/SecEcdsa.kt b/cryptography-providers/apple/src/commonMain/kotlin/algorithms/SecEcdsa.kt
@@ -278,6 +278,10 @@ private class EcdsaRawSignatureGenerator(
             return rawSignature
         }
 
+        override fun reset() {
+            derSignFunction.reset()
+        }
+
         override fun close() {
             derSignFunction.close()
         }
@@ -322,6 +326,10 @@ private class EcdsaRawSignatureVerifier(
             check(tryVerify(signature, startIndex, endIndex)) { "Invalid signature" }
         }
 
+        override fun reset() {
+            derVerifyFunction.reset()
+        }
+
         override fun close() {
             derVerifyFunction.close()
         }
diff --git a/cryptography-providers/apple/src/commonMain/kotlin/internal/SecSignature.kt b/cryptography-providers/apple/src/commonMain/kotlin/internal/SecSignature.kt
@@ -70,9 +70,14 @@ private class SecVerifyFunction(
                     else   -> error.value.releaseBridgeAs<NSError>()?.description ?: ""
                 }
             }
+        }.also {
+            reset()
         }
-    }.also {
-        close()
+    }
+
+    override fun reset() {
+        ensureNotClosed()
+        accumulator = EmptyByteArray
     }
 
     override fun close() {
@@ -123,9 +128,14 @@ private class SecSignFunction(
             }
 
             signature.toByteArray()
+        }.also {
+            reset()
         }
-    }.also {
-        close()
+    }
+
+    override fun reset() {
+        ensureNotClosed()
+        accumulator = EmptyByteArray
     }
 
     override fun close() {
diff --git a/cryptography-providers/jdk/src/jvmMain/kotlin/algorithms/JdkDigest.kt b/cryptography-providers/jdk/src/jvmMain/kotlin/algorithms/JdkDigest.kt
@@ -17,9 +17,7 @@ internal class JdkDigest(
 ) : Hasher, Digest {
     private val messageDigest = state.messageDigest(algorithm)
     override fun hasher(): Hasher = this
-    override fun createHashFunction(): HashFunction = JdkHashFunction(messageDigest.borrowResource().also {
-        it.access().reset()
-    })
+    override fun createHashFunction(): HashFunction = JdkHashFunction(messageDigest.borrowResource { reset() })
 }
 
 private class JdkHashFunction(private val messageDigest: Pooled.Resource<JMessageDigest>) : HashFunction {
@@ -35,12 +33,17 @@ private class JdkHashFunction(private val messageDigest: Pooled.Resource<JMessag
 
         checkBounds(destination.size, destinationOffset, destinationOffset + messageDigest.digestLength)
 
-        return messageDigest.digest(destination, destinationOffset, messageDigest.digestLength).also { close() }
+        return messageDigest.digest(destination, destinationOffset, messageDigest.digestLength)
     }
 
     override fun hashToByteArray(): ByteArray {
         val messageDigest = messageDigest.access()
-        return messageDigest.digest().also { close() }
+        return messageDigest.digest()
+    }
+
+    override fun reset() {
+        val messageDigest = messageDigest.access()
+        messageDigest.reset()
     }
 
     override fun close() {
diff --git a/cryptography-providers/jdk/src/jvmMain/kotlin/algorithms/JdkEcdsa.kt b/cryptography-providers/jdk/src/jvmMain/kotlin/algorithms/JdkEcdsa.kt
@@ -90,6 +90,10 @@ private class EcdsaRawSignatureGenerator(
             return rawSignature
         }
 
+        override fun reset() {
+            derSignFunction.reset()
+        }
+
         override fun close() {
             derSignFunction.close()
         }
@@ -134,6 +138,10 @@ private class EcdsaRawSignatureVerifier(
             check(tryVerify(signature, startIndex, endIndex)) { "Invalid signature" }
         }
 
+        override fun reset() {
+            derVerifyFunction.reset()
+        }
+
         override fun close() {
             derVerifyFunction.close()
         }
diff --git a/cryptography-providers/jdk/src/jvmMain/kotlin/operations/JdkMacSignature.kt b/cryptography-providers/jdk/src/jvmMain/kotlin/operations/JdkMacSignature.kt
@@ -15,15 +15,15 @@ internal class JdkMacSignature(
 ) : SignatureGenerator, SignatureVerifier {
     private val mac = state.mac(algorithm)
 
-    private fun createFunction() = JdkMacFunction(mac.borrowResource().also {
-        it.access().init(key)
-    })
+    private fun createFunction() = JdkMacFunction(mac.borrowResource { init(key) })
 
     override fun createSignFunction(): SignFunction = createFunction()
     override fun createVerifyFunction(): VerifyFunction = createFunction()
 }
 
-private class JdkMacFunction(private val mac: Pooled.Resource<JMac>) : SignFunction, VerifyFunction {
+private class JdkMacFunction(
+    private val mac: Pooled.Resource<JMac>,
+) : SignFunction, VerifyFunction {
     override fun update(source: ByteArray, startIndex: Int, endIndex: Int) {
         checkBounds(source.size, startIndex, endIndex)
         val mac = mac.access()
@@ -35,13 +35,13 @@ private class JdkMacFunction(private val mac: Pooled.Resource<JMac>) : SignFunct
 
         checkBounds(destination.size, destinationOffset, destinationOffset + mac.macLength)
 
-        mac.doFinal(destination, destinationOffset).also { close() }
+        mac.doFinal(destination, destinationOffset)
         return mac.macLength
     }
 
     override fun signToByteArray(): ByteArray {
         val mac = mac.access()
-        return mac.doFinal().also { close() }
+        return mac.doFinal()
     }
 
     override fun tryVerify(signature: ByteArray, startIndex: Int, endIndex: Int): Boolean {
@@ -53,6 +53,10 @@ private class JdkMacFunction(private val mac: Pooled.Resource<JMac>) : SignFunct
         check(tryVerify(signature, startIndex, endIndex)) { "Invalid signature" }
     }
 
+    override fun reset() {
+        mac.access().reset()
+    }
+
     override fun close() {
         mac.close()
     }
diff --git a/cryptography-providers/jdk/src/jvmMain/kotlin/operations/JdkSignatureGenerator.kt b/cryptography-providers/jdk/src/jvmMain/kotlin/operations/JdkSignatureGenerator.kt
@@ -16,14 +16,19 @@ internal class JdkSignatureGenerator(
     private val parameters: AlgorithmParameterSpec?,
 ) : SignatureGenerator {
     private val signature = state.signature(algorithm)
-    override fun createSignFunction(): SignFunction = JdkSignFunction(signature.borrowResource().also {
-        val jsignature = it.access()
-        jsignature.initSign(key, state.secureRandom)
-        parameters?.let(jsignature::setParameter)
-    })
+    override fun createSignFunction(): SignFunction = JdkSignFunction(state, key, parameters, signature.borrowResource())
 }
 
-private class JdkSignFunction(private val jsignature: Pooled.Resource<JSignature>) : SignFunction {
+private class JdkSignFunction(
+    private val state: JdkCryptographyState,
+    private val key: JPrivateKey,
+    private val parameters: AlgorithmParameterSpec?,
+    private val jsignature: Pooled.Resource<JSignature>,
+) : SignFunction {
+    init {
+        reset()
+    }
+
     override fun update(source: ByteArray, startIndex: Int, endIndex: Int) {
         checkBounds(source.size, startIndex, endIndex)
         val jsignature = jsignature.access()
@@ -39,7 +44,13 @@ private class JdkSignFunction(private val jsignature: Pooled.Resource<JSignature
 
     override fun signToByteArray(): ByteArray {
         val jsignature = jsignature.access()
-        return jsignature.sign().also { close() }
+        return jsignature.sign()
+    }
+
+    override fun reset() {
+        val jsignature = jsignature.access()
+        jsignature.initSign(key, state.secureRandom)
+        parameters?.let(jsignature::setParameter)
     }
 
     override fun close() {
diff --git a/cryptography-providers/jdk/src/jvmMain/kotlin/operations/JdkSignatureVerifier.kt b/cryptography-providers/jdk/src/jvmMain/kotlin/operations/JdkSignatureVerifier.kt
diff --git a/cryptography-providers/openssl3/api/src/commonMain/kotlin/algorithms/Openssl3Digest.kt b/cryptography-providers/openssl3/api/src/commonMain/kotlin/algorithms/Openssl3Digest.kt
diff --git a/cryptography-providers/openssl3/api/src/commonMain/kotlin/algorithms/Openssl3Ecdsa.kt b/cryptography-providers/openssl3/api/src/commonMain/kotlin/algorithms/Openssl3Ecdsa.kt
diff --git a/cryptography-providers/openssl3/api/src/commonMain/kotlin/algorithms/Openssl3Hmac.kt b/cryptography-providers/openssl3/api/src/commonMain/kotlin/algorithms/Openssl3Hmac.kt
diff --git a/cryptography-providers/openssl3/api/src/commonMain/kotlin/operations/Openssl3DigestSignatureGenerator.kt b/cryptography-providers/openssl3/api/src/commonMain/kotlin/operations/Openssl3DigestSignatureGenerator.kt
diff --git a/cryptography-providers/openssl3/api/src/commonMain/kotlin/operations/Openssl3DigestSignatureVerifier.kt b/cryptography-providers/openssl3/api/src/commonMain/kotlin/operations/Openssl3DigestSignatureVerifier.kt

Original file line number	Diff line number	Diff line change
`@@ -866,6 +866,7 @@ public abstract interface class dev/whyoleg/cryptography/operations/SignatureVer`
`866`	`866`	`}`
`867`	`867`
`868`	`868`	`public abstract interface class dev/whyoleg/cryptography/operations/UpdateFunction : java/lang/AutoCloseable {`
	`869`	`+ public abstract fun reset ()V`
`869`	`870`	`public fun update (Lkotlinx/io/RawSource;)V`
`870`	`871`	`public fun update (Lkotlinx/io/bytestring/ByteString;II)V`
`871`	`872`	`public abstract fun update ([BII)V`
Original file line number	Diff line number	Diff line change
`@@ -685,6 +685,7 @@ abstract interface dev.whyoleg.cryptography.operations/SignatureVerifier { // de`
`685`	`685`	`}`
`686`	`686`
`687`	`687`	`abstract interface dev.whyoleg.cryptography.operations/UpdateFunction : kotlin/AutoCloseable { // dev.whyoleg.cryptography.operations/UpdateFunction\|null[0]`
	`688`	`+ abstract fun reset() // dev.whyoleg.cryptography.operations/UpdateFunction.reset\|reset(){}[0]`
`688`	`689`	`abstract fun update(kotlin/ByteArray, kotlin/Int = ..., kotlin/Int = ...) // dev.whyoleg.cryptography.operations/UpdateFunction.update\|update(kotlin.ByteArray;kotlin.Int;kotlin.Int){}[0]`
`689`	`690`	`open fun update(kotlinx.io.bytestring/ByteString, kotlin/Int = ..., kotlin/Int = ...) // dev.whyoleg.cryptography.operations/UpdateFunction.update\|update(kotlinx.io.bytestring.ByteString;kotlin.Int;kotlin.Int){}[0]`
`690`	`691`	`open fun update(kotlinx.io/RawSource) // dev.whyoleg.cryptography.operations/UpdateFunction.update\|update(kotlinx.io.RawSource){}[0]`
Original file line number	Diff line number	Diff line change
`@@ -278,6 +278,10 @@ private class EcdsaRawSignatureGenerator(`
`278`	`278`	`return rawSignature`
`279`	`279`	`}`
`280`	`280`
	`281`	`+ override fun reset() {`
	`282`	`+ derSignFunction.reset()`
	`283`	`+ }`
	`284`	`+`
`281`	`285`	`override fun close() {`
`282`	`286`	`derSignFunction.close()`
`283`	`287`	`}`
`@@ -322,6 +326,10 @@ private class EcdsaRawSignatureVerifier(`
`322`	`326`	`check(tryVerify(signature, startIndex, endIndex)) { "Invalid signature" }`
`323`	`327`	`}`
`324`	`328`
	`329`	`+ override fun reset() {`
	`330`	`+ derVerifyFunction.reset()`
	`331`	`+ }`
	`332`	`+`
`325`	`333`	`override fun close() {`
`326`	`334`	`derVerifyFunction.close()`
`327`	`335`	`}`
Original file line number	Diff line number	Diff line change
`@@ -70,9 +70,14 @@ private class SecVerifyFunction(`
`70`	`70`	`else -> error.value.releaseBridgeAs<NSError>()?.description ?: ""`
`71`	`71`	`}`
`72`	`72`	`}`
	`73`	`+ }.also {`
	`74`	`+ reset()`
`73`	`75`	`}`
`74`		`- }.also {`
`75`		`- close()`
	`76`	`+ }`
	`77`	`+`
	`78`	`+ override fun reset() {`
	`79`	`+ ensureNotClosed()`
	`80`	`+ accumulator = EmptyByteArray`
`76`	`81`	`}`
`77`	`82`
`78`	`83`	`override fun close() {`
`@@ -123,9 +128,14 @@ private class SecSignFunction(`
`123`	`128`	`}`
`124`	`129`
`125`	`130`	`signature.toByteArray()`
	`131`	`+ }.also {`
	`132`	`+ reset()`
`126`	`133`	`}`
`127`		`- }.also {`
`128`		`- close()`
	`134`	`+ }`
	`135`	`+`
	`136`	`+ override fun reset() {`
	`137`	`+ ensureNotClosed()`
	`138`	`+ accumulator = EmptyByteArray`
`129`	`139`	`}`
`130`	`140`
`131`	`141`	`override fun close() {`
Original file line number	Diff line number	Diff line change
`@@ -90,6 +90,10 @@ private class EcdsaRawSignatureGenerator(`
`90`	`90`	`return rawSignature`
`91`	`91`	`}`
`92`	`92`
	`93`	`+ override fun reset() {`
	`94`	`+ derSignFunction.reset()`
	`95`	`+ }`
	`96`	`+`
`93`	`97`	`override fun close() {`
`94`	`98`	`derSignFunction.close()`
`95`	`99`	`}`
`@@ -134,6 +138,10 @@ private class EcdsaRawSignatureVerifier(`
`134`	`138`	`check(tryVerify(signature, startIndex, endIndex)) { "Invalid signature" }`
`135`	`139`	`}`
`136`	`140`
	`141`	`+ override fun reset() {`
	`142`	`+ derVerifyFunction.reset()`
	`143`	`+ }`
	`144`	`+`
`137`	`145`	`override fun close() {`
`138`	`146`	`derVerifyFunction.close()`
`139`	`147`	`}`