forked from smoser/dokucrypt
-
-
Notifications
You must be signed in to change notification settings - Fork 4
/
script.js
2210 lines (1892 loc) · 66.8 KB
/
script.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
var crypt_keys=[];
var tag_enc="ENCRYPTED";
var tag_pt="SECRET";
var encryptForSubmitInUse=false;
/* ahmetsacan: this causes the edit toolbar to break. we moved it into action.php */
/* addInitEvent(function() { return(decryptEditSetup()); }); */
// the function here is borrowed from an anonymous function in
// lib/scripts/edit.js (initChangeCheck()).
// This should be replaced with some way that a plugin can request
// onSubmit handlers for a given form element
function editFormOnSubmit() {
// begin plugin modified code
// need the following to avoid 'msg is not defined' error. I'm not sure why
var msg="Unsaved changes will be lost [edit].\nReally continue?";
if(encryptForSubmit()===false) { return(false); }
// Move the original wiki_text element out of the form like we used to do in decryptEditSetup().
// To prevent accidental submission of unencrypted text.
var wikitext=document.getElementById('wiki__text');
var editform=document.getElementById('dw__editform');
editform.parentNode.insertBefore(wikitext,editform);
// end plugin modified code
var rc = changeCheck(msg);
if(window.event) { window.event.returnValue = rc; }
return rc;
}
/* Set up the decrypt button and necessary functionality. */
function decryptEditSetup(msg) {
//alert('setting up');
var editform=null, wikitext=null, hiddentext=null, preview=null;
if(!(editform=document.getElementById('dw__editform'))) {
// alert("no form dw__editform\n");
return(true);
}
if(!(wikitext=document.getElementById('wiki__text'))) {
// alert("no wiki__text");
return(false);
}
// if there is no preview button, then assume this is a
// "Recover draft" page, dont do anything.
if(!(preview=document.getElementById('edbtn__preview'))) {
return(false);
}
// Create a hidden element with id 'wiki__text_submit' and
// name wikitext (same as the wiki__text).
if(!(hiddentext=document.createElement('input'))) {
return(false);
}
hiddentext.setAttribute('id', 'wiki__text_submit');
hiddentext.setAttribute('name', 'wikitext');
hiddentext.setAttribute('type','hidden');
editform.insertBefore(hiddentext,null);
// Move the real wiki__text element out of the form (so it is not submitted and
// any <SECRET> text left unencrypted).
// Commented out for update 2021-05-18 to fix the broken insert link toolbar button.
// Does this cause any issues? Can we submit unencrypted data?
// Just in case we now do this in editFormOnSubmit().
//editform.parentNode.insertBefore(wikitext,editform);
if(!(decryptButton=document.createElement('input'))) {
return(false);
}
decryptButton.setAttribute('id', 'decryptButton');
decryptButton.setAttribute('name', 'decryptButton');
decryptButton.setAttribute('type','Button');
decryptButton.setAttribute('value','DecryptSecret');
// decryptButton.setAttribute('onclick',decryptEditForm);
decryptButton.onclick=decryptEditForm;
decryptButton.setAttribute('class','button');
decryptButton.setAttribute('className','button'); // required for IE
preview.parentNode.insertBefore(decryptButton,preview);
editform.onsubmit = function() {return editFormOnSubmit();};
// The following is taken from lib/scripts/locktimer.js to make drafts work.
// We override the locktimer refresh function to abort saving of drafts with unencrypted content.
dw_locktimer.refresh = function(){
var now = new Date(),
params = 'call=lock&id=' + dw_locktimer.pageid + '&';
// refresh every minute only
if(now.getTime() - dw_locktimer.lasttime.getTime() <= 30*1000) {
return;
}
// POST everything necessary for draft saving
if(dw_locktimer.draft && jQuery('#dw__editform').find('textarea[name=wikitext]').length > 0){
// *** BEGIN dokucrypt modified code
// Do not allow saving of a draft, if this page needs some content to be encrypted on save.
// Basically abort saving of drafts if this page has some content that needs encrypting.
if(encryptForSubmit()===false) { return(false); }
// *** END dokucrypt modified code
params += jQuery('#dw__editform').find('input[name=prefix], ' +
'textarea[name=wikitext], ' +
'input[name=suffix], ' +
'input[name=date]').serialize();
}
jQuery.post(
DOKU_BASE + 'lib/exe/ajax.php',
params,
dw_locktimer.refreshed,
'html'
);
dw_locktimer.lasttime = now;
/* // ---------------- PREVIOUS VERSION OF DOKUWIKI --------------
var now = new Date();
// refresh every minute only
if(now.getTime() - dw_locktimer.lasttime.getTime() > 30*1000){ //FIXME decide on time
var params = 'call=lock&id='+encodeURIComponent(dw_locktimer.pageid);
if(dw_locktimer.draft){
var dwform = $('dw__editform');
// begin plugin modified code
if(encryptForSubmit()===false) { return(false); }
// end plugin modified code
params += '&prefix='+encodeURIComponent(dwform.elements.prefix.value);
params += '&wikitext='+encodeURIComponent(dwform.elements.wikitext.value);
params += '&suffix='+encodeURIComponent(dwform.elements.suffix.value);
params += '&date='+encodeURIComponent(dwform.elements.date.value);
}
dw_locktimer.sack.runAJAX(params);
dw_locktimer.lasttime = now;
}
// ---------------------------------- Previous Version ---------------
*/
};
}
function encryptForSubmit() {
var wikitext=null, hiddentext=null;
// bad semaphore like protection to avoid multiple calls to this code
// at once (user pushing 'Submit' and draft save running, or multiple draft
// save. its not really safe
while(encryptForSubmitInUse!==false) {
// wish I had sleep here
}
encryptForSubmitInUse=true;
if(!(wikitext=document.getElementById('wiki__text'))) {
alert("failed to get wiki__text");
encryptForSubmitInUse=false; return(false);
}
if(!(hiddentext=document.getElementById('wiki__text_submit'))) {
alert("failed to get wiki__text_submit");
encryptForSubmitInUse=false; return(false);
}
var tosubmit=encryptMixedText(wikitext.value);
if(tosubmit===false) { encryptForSubmitInUse=false; return(false); }
hiddentext.value=tosubmit;
encryptForSubmitInUse=false; return(true);
}
function decryptEditForm() {
var elem=null, newtext="";
if(!(elem=document.getElementById('wiki__text'))) {
// alert("no form wiki__text\n");
return(true);
}
if((newtext=decryptMixedText(elem.value))===false) {
alert("failed to decrypt wiki__text");
return(false);
}
elem.value=newtext;
return(true);
}
function setKeyFromAscii(pass) {
var s = encode_utf8(pass);
var i, kmd5e, kmd5o;
if (s.length == 1) {
s += s;
}
md5_init();
for (i = 0; i < s.length; i += 2) {
md5_update(s.charCodeAt(i));
}
md5_finish();
kmd5e = byteArrayToHex(digestBits);
md5_init();
for (i = 1; i < s.length; i += 2) {
md5_update(s.charCodeAt(i));
}
md5_finish();
kmd5o = byteArrayToHex(digestBits);
var hs = kmd5e + kmd5o;
key = hexToByteArray(hs);
hs = byteArrayToHex(key);
return(key);
}
function toggleElemVisibility(elemid) {
elem=document.getElementById(elemid);
if(elem.style.visibility=="visible") {
elem.style.visibility="hidden";
elem.style.position="absolute";
} else {
elem.style.visibility="visible";
elem.style.position="relative";
}
}
/*
this is called from <A HREF=> links to decrypt the inline html
*/
function toggleCryptDiv(elemid,lock,ctext) {
var elem=null, atab=null, key="", ptext="";
var ctStr="Decrypt Encrypted Text", ptStr="Hide Plaintext";
elem=document.getElementById(elemid);
atag=document.getElementById(elemid + "_atag");
if(elem===null || atag===null) {
alert("failed to find element id " + elemid);
}
if(atag.innerHTML==ptStr) {
// encrypt text (set back to ctext, and forget key)
elem.innerHTML=ctext;
atag.innerHTML=ctStr;
crypt_keys[lock]=undefined;
} else if (atag.innerHTML==ctStr) {
// decrypt text
if((ptext=verifyDecrypt(ctext,lock,false))===false) {
alert("unable to find key for lock " + lock);
return;
}
elem.textContent=ptext;
atag.innerHTML=ptStr;
// make it visible
elem.style.visibility="visible";
elem.style.position="relative";
if (JSINFO["plugin_dokucrypt2_CONFIG_copytoclipboard"] == 1) {
//put it into the clipboard
copyToClipboard(ptext).then(() => {
if (JSINFO['plugin_dokucrypt2_CONFIG_hidepasswordoncopytoclipboard']) {
elem.innerHTML = "{" + JSINFO['plugin_dokucrypt2_TEXT_copied_to_clipboard'] + "}";
} else {
elem.innerHTML += " {" + JSINFO['plugin_dokucrypt2_TEXT_copied_to_clipboard'] + "}";
};
console.log('Encrypted value has been copied to the clipboard.');
}).catch(() => {
console.log('Encrypted value could not be copied to the clipboard.');
});
}
} else { alert("Broken"); return; }
}
function getEncryptionKeyForLock(lock) {
// alert("crypt_keys[" + lock + "]=" + crypt_keys[lock] + "\n");
if(undefined===crypt_keys[lock]) {
var x,y;
x=prompt("Enter passphrase key for lock " + lock);
if(x===null) { return(false); }
y=prompt("Verify passphrase key for lock " + lock);
if(y===null) { return(false); }
if(x!=y) { crypt_debug("passwords do not match\n"); return(false); }
crypt_debug("x=" + x + " y=" + y);
crypt_keys[lock]=x;
return(x);
} else {
return(crypt_keys[lock]);
}
}
var debugval="";
function crypt_debug(str) {
// document.getElementById("debug_field").value+=str + "\n";
debugval+=str;
}
/* decrypt the text between <CRYPT> and </CRYPT> */
function decryptMixedText(x) {
var tag=tag_enc;
var ret="", key="", ctext="";
var tagend=0, opentag=0, blockend=0, pos=0;
while((cur=x.indexOf("<" + tag,pos))!=-1) {
if((opentag_end=x.indexOf(">",cur))==-1) {
alert("unable to close to open tag"); return(false);
}
if((closetag=x.indexOf("</" + tag + ">",opentag_end))==-1) {
alert("unable to find close of " + tag + " tag"); return(false);
}
if(!(ctext=decryptBlock(x.substring(cur,closetag+tag.length+3),false))) {
return(false);
}
ret+=x.substring(pos,cur) + ctext;
pos=closetag+tag.length+3;
}
ret+=x.substring(pos);
return(ret);
}
function encryptMixedText(x) {
var tag=tag_pt;
var ret="", key="", ctext="";
var tagend=0, opentag=0, blockend=0, pos=0;
while((cur=x.indexOf("<" + tag,pos))!=-1) {
if((opentag_end=x.indexOf(">",cur))==-1) {
alert("unable to close to open tag"); return(false);
}
if((closetag=x.indexOf("</" + tag + ">",opentag_end))==-1) {
x=x+"</" + tag + ">";
// if there is no close tag, add one to the end.
closetag=x.indexOf("</" + tag + ">",opentag_end);
// alert("unable to find close of " + tag + " tag"); return(false);
}
if(!(ctext=encryptBlock(x.substring(cur,closetag+tag.length+3),false))) {
alert("failed to encrypt text");
return(false);
}
ret+=x.substring(pos,cur) + ctext;
pos=closetag+tag.length+3;
}
ret+=x.substring(pos);
return(ret);
}
function verifyDecrypt(ctext,lock,key) {
var ptext=null;
if(undefined!==crypt_keys[lock]) { key=crypt_keys[lock]; }
if(key===false && (undefined===crypt_keys[lock])) {
var key=prompt("Enter passphrase for lock " + lock);
if(key===null) { return(false); } // user hit cancel
if(!(ptext=decryptTextString(ctext,key))) {
var pstr="Try again: Enter passphrase for lock " + lock;
while(null!==(key=prompt(pstr))) {
ptext=decryptTextString(ctext,key);
if(ptext) {
break;
}
}
if(key==null) { return(false); } // user hit cancel
}
crypt_keys[lock]=key;
} else {
var xkey=key;
if(key===false) { xkey=crypt_keys[lock]; }
if(!(ptext=decryptTextString(ctext,xkey))) {
if(key!==false) { alert("failed to decrypt with provided key"); }
return(false);
}
}
return(ptext);
}
function decryptBlock(data,key) {
var tagend=0, ptend=0, lock=null, ptext;
if((tagend=data.indexOf(">"))==-1) {
crypt_debug("no > in " + data);
return(false);
}
if((ptend=data.lastIndexOf("</"))==-1) {
crypt_debug(" no </ in " + data);
return(false);
}
lock=getTagAttr(data.substring(0,tagend+1),"LOCK");
if(lock===null) { lock="default"; }
collapsed=getTagAttr(data.substring(0,tagend+1),"COLLAPSED");
if(collapsed===null || collapsed=="null") { collapsed="1"; }
if(!(ptext=verifyDecrypt(data.substring(tagend+1,ptend),lock,key))) {
return(false);
}
return("<" + tag_pt + " LOCK=" + lock + " " +
"COLLAPSED=" + collapsed + ">" + ptext + "</" + tag_pt + ">");
}
// for getTagAttr("<FOO ATTR=val>","ATTR"), return "val"
function getTagAttr(opentag,attr) {
var loff=0;
if((loff=opentag.indexOf(attr + "=" ))!=-1) {
if((t=opentag.indexOf(" ",loff+attr.length+1))!=-1) {
return(opentag.substring(loff+attr.length+1,t));
} else {
return(opentag.substring(loff+attr.length+1,opentag.length-1));
}
}
return(null);
}
function encryptBlock(data,key) {
var tagend=0, ptend=0, lock=null, ctext;
var collapsed = "1";
if((tagend=data.indexOf(">"))==-1) {
crypt_debug("no > in " + data);
return(false);
}
if((ptend=data.lastIndexOf("</"))==-1) {
crypt_debug(" no </ in " + data);
return(false);
}
lock=getTagAttr(data.substring(0,tagend+1),"LOCK");
if(lock===null) { lock="default"; }
collapsed=getTagAttr(data.substring(0,tagend+1),"COLLAPSED");
if(collapsed===null || collapsed=="null") { collapsed="1"; }
if(key===false) {
key=getEncryptionKeyForLock(lock);
if(key===false) { return(false); }
}
if(!(ctext=encryptTextString(data.substring(tagend+1,ptend),key))) {
return(false);
}
return("<ENCRYPTED LOCK=" + lock + " " +
"COLLAPSED=" + collapsed + ">" + ctext + "</ENCRYPTED>");
}
/* encrypt the string in text with ascii key in akey
modified from Encrypt_Text to expect ascii key and take input params
and to return base64 encoded
*/
function encryptTextString(ptext,akey) {
var v, i, ret, key;
var prefix = "##### Encrypted: decrypt with ";
prefix+="http://www.fourmilab.ch/javascrypt/\n";
suffix = "##### End encrypted message\n";
if (akey.length === 0) {
alert("Please specify a key with which to encrypt the message.");
return;
}
if (ptext.length === 0) {
alert("No plain text to encrypt!");
return;
}
ret="";
key=setKeyFromAscii(akey);
// addEntroptyTime eventually results in setting of global entropyData
// which is used by keyFromEntropy
addEntropyTime();
prng = new AESprng(keyFromEntropy());
var plaintext = encode_utf8(ptext);
// Compute MD5 sum of message text and add to header
md5_init();
for (i = 0; i < plaintext.length; i++) {
md5_update(plaintext.charCodeAt(i));
}
md5_finish();
var header = "";
for (i = 0; i < digestBits.length; i++) {
header += String.fromCharCode(digestBits[i]);
}
// Add message length in bytes to header
i = plaintext.length;
header += String.fromCharCode(i >>> 24);
header += String.fromCharCode(i >>> 16);
header += String.fromCharCode(i >>> 8);
header += String.fromCharCode(i & 0xFF);
/* The format of the actual message passed to rijndaelEncrypt
is:
Bytes Content
0-15 MD5 signature of plaintext
16-19 Length of plaintext, big-endian order
20-end Plaintext
Note that this message will be padded with zero bytes
to an integral number of AES blocks (blockSizeInBits / 8).
This does not include the initial vector for CBC
encryption, which is added internally by rijndaelEncrypt.
*/
var ct = rijndaelEncrypt(header + plaintext, key, "CBC");
delete prng;
return(prefix + armour_base64(ct) + suffix);
}
function decryptTextString(ctext,akey) {
key=setKeyFromAscii(akey);
var ct=[];
// remove line breaks
ct=disarm_base64(ctext);
var result=rijndaelDecrypt(ct,key,"CBC");
var header=result.slice(0,20);
result=result.slice(20);
var dl=(header[16]<<24)|(header[17]<<16)|(header[18]<<8)|header[19];
if((dl<0)||(dl>result.length)) {
// alert("Message (length "+result.length+") != expected (" + dl + ")");
dl=result.length;
}
var i,plaintext="";
md5_init();
for(i=0;i<dl;i++) {
plaintext+=String.fromCharCode(result[i]);
md5_update(result[i]);
}
md5_finish();
successful = true;
for(i=0;i<digestBits.length;i++) {
if(digestBits[i]!=header[i]) {
crypt_debug("Invalid decryption key.");
return(false);
}
}
return(decode_utf8(plaintext));
}
// BEGIN: javascript/aes.js
// Rijndael parameters -- Valid values are 128, 192, or 256
var keySizeInBits = 256;
var blockSizeInBits = 128;
//
// Note: in the following code the two dimensional arrays are indexed as
// you would probably expect, as array[row][column]. The state arrays
// are 2d arrays of the form state[4][Nb].
// The number of rounds for the cipher, indexed by [Nk][Nb]
var roundsArray = [ undefined, undefined, undefined, undefined,[ undefined, undefined, undefined, undefined,10, undefined, 12, undefined, 14], undefined,
[ undefined, undefined, undefined, undefined, 12, undefined, 12, undefined, 14], undefined,
[ undefined, undefined, undefined, undefined, 14, undefined, 14, undefined, 14] ];
// The number of bytes to shift by in shiftRow, indexed by [Nb][row]
var shiftOffsets = [ undefined, undefined, undefined, undefined,[ undefined,1, 2, 3], undefined,[ undefined,1, 2, 3], undefined,[ undefined,1, 3, 4] ];
// The round constants used in subkey expansion
var Rcon = [
0x01, 0x02, 0x04, 0x08, 0x10, 0x20,
0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8,
0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc,
0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4,
0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91 ];
// Precomputed lookup table for the SBox
var SBox = [
99, 124, 119, 123, 242, 107, 111, 197, 48, 1, 103, 43, 254, 215, 171,
118, 202, 130, 201, 125, 250, 89, 71, 240, 173, 212, 162, 175, 156, 164,
114, 192, 183, 253, 147, 38, 54, 63, 247, 204, 52, 165, 229, 241, 113,
216, 49, 21, 4, 199, 35, 195, 24, 150, 5, 154, 7, 18, 128, 226,
235, 39, 178, 117, 9, 131, 44, 26, 27, 110, 90, 160, 82, 59, 214,
179, 41, 227, 47, 132, 83, 209, 0, 237, 32, 252, 177, 91, 106, 203,
190, 57, 74, 76, 88, 207, 208, 239, 170, 251, 67, 77, 51, 133, 69,
249, 2, 127, 80, 60, 159, 168, 81, 163, 64, 143, 146, 157, 56, 245,
188, 182, 218, 33, 16, 255, 243, 210, 205, 12, 19, 236, 95, 151, 68,
23, 196, 167, 126, 61, 100, 93, 25, 115, 96, 129, 79, 220, 34, 42,
144, 136, 70, 238, 184, 20, 222, 94, 11, 219, 224, 50, 58, 10, 73,
6, 36, 92, 194, 211, 172, 98, 145, 149, 228, 121, 231, 200, 55, 109,
141, 213, 78, 169, 108, 86, 244, 234, 101, 122, 174, 8, 186, 120, 37,
46, 28, 166, 180, 198, 232, 221, 116, 31, 75, 189, 139, 138, 112, 62,
181, 102, 72, 3, 246, 14, 97, 53, 87, 185, 134, 193, 29, 158, 225,
248, 152, 17, 105, 217, 142, 148, 155, 30, 135, 233, 206, 85, 40, 223,
140, 161, 137, 13, 191, 230, 66, 104, 65, 153, 45, 15, 176, 84, 187,
22 ];
// Precomputed lookup table for the inverse SBox
var SBoxInverse = [
82, 9, 106, 213, 48, 54, 165, 56, 191, 64, 163, 158, 129, 243, 215,
251, 124, 227, 57, 130, 155, 47, 255, 135, 52, 142, 67, 68, 196, 222,
233, 203, 84, 123, 148, 50, 166, 194, 35, 61, 238, 76, 149, 11, 66,
250, 195, 78, 8, 46, 161, 102, 40, 217, 36, 178, 118, 91, 162, 73,
109, 139, 209, 37, 114, 248, 246, 100, 134, 104, 152, 22, 212, 164, 92,
204, 93, 101, 182, 146, 108, 112, 72, 80, 253, 237, 185, 218, 94, 21,
70, 87, 167, 141, 157, 132, 144, 216, 171, 0, 140, 188, 211, 10, 247,
228, 88, 5, 184, 179, 69, 6, 208, 44, 30, 143, 202, 63, 15, 2,
193, 175, 189, 3, 1, 19, 138, 107, 58, 145, 17, 65, 79, 103, 220,
234, 151, 242, 207, 206, 240, 180, 230, 115, 150, 172, 116, 34, 231, 173,
53, 133, 226, 249, 55, 232, 28, 117, 223, 110, 71, 241, 26, 113, 29,
41, 197, 137, 111, 183, 98, 14, 170, 24, 190, 27, 252, 86, 62, 75,
198, 210, 121, 32, 154, 219, 192, 254, 120, 205, 90, 244, 31, 221, 168,
51, 136, 7, 199, 49, 177, 18, 16, 89, 39, 128, 236, 95, 96, 81,
127, 169, 25, 181, 74, 13, 45, 229, 122, 159, 147, 201, 156, 239, 160,
224, 59, 77, 174, 42, 245, 176, 200, 235, 187, 60, 131, 83, 153, 97,
23, 43, 4, 126, 186, 119, 214, 38, 225, 105, 20, 99, 85, 33, 12,
125 ];
// This method circularly shifts the array left by the number of elements
// given in its parameter. It returns the resulting array and is used for
// the ShiftRow step. Note that shift() and push() could be used for a more
// elegant solution, but they require IE5.5+, so I chose to do it manually.
function cyclicShiftLeft(theArray, positions) {
var temp = theArray.slice(0, positions);
theArray = theArray.slice(positions).concat(temp);
return theArray;
}
// Cipher parameters ... do not change these
var Nk = keySizeInBits / 32;
var Nb = blockSizeInBits / 32;
var Nr = roundsArray[Nk][Nb];
// Multiplies the element "poly" of GF(2^8) by x. See the Rijndael spec.
function xtime(poly) {
poly <<= 1;
return ((poly & 0x100) ? (poly ^ 0x11B) : (poly));
}
// Multiplies the two elements of GF(2^8) together and returns the result.
// See the Rijndael spec, but should be straightforward: for each power of
// the indeterminant that has a 1 coefficient in x, add y times that power
// to the result. x and y should be bytes representing elements of GF(2^8)
function mult_GF256(x, y) {
var bit, result = 0;
for (bit = 1; bit < 256; bit *= 2, y = xtime(y)) {
if (x & bit) { result ^= y; }
}
return result;
}
// Performs the substitution step of the cipher. State is the 2d array of
// state information (see spec) and direction is string indicating whether
// we are performing the forward substitution ("encrypt") or inverse
// substitution (anything else)
function byteSub(state, direction) {
var S;
if (direction == "encrypt") { S = SBox; } // Point S to the SBox we're using
else { S = SBoxInverse; }
for (var i = 0; i < 4; i++) { // Substitute for every byte in state
for (var j = 0; j < Nb; j++) { state[i][j] = S[state[i][j]]; }
}
}
// Performs the row shifting step of the cipher.
function shiftRow(state, direction) {
for (var i=1; i<4; i++) { // Row 0 never shifts
if (direction == "encrypt") {
state[i] = cyclicShiftLeft(state[i], shiftOffsets[Nb][i]);
} else {
state[i] = cyclicShiftLeft(state[i], Nb - shiftOffsets[Nb][i]);
}
}
}
// Performs the column mixing step of the cipher. Most of these steps can
// be combined into table lookups on 32bit values (at least for encryption)
// to greatly increase the speed.
function mixColumn(state, direction) {
var b = []; // Result of matrix multiplications
var i = 0;
for (var j = 0; j < Nb; j++) { // Go through each column...
for (i = 0; i < 4; i++) { // and for each row in the column...
if (direction == "encrypt") {
b[i] = mult_GF256(state[i][j], 2) ^ // perform mixing
mult_GF256(state[(i+1)%4][j], 3) ^
state[(i+2)%4][j] ^
state[(i+3)%4][j];
} else {
b[i] = mult_GF256(state[i][j], 0xE) ^
mult_GF256(state[(i+1)%4][j], 0xB) ^
mult_GF256(state[(i+2)%4][j], 0xD) ^
mult_GF256(state[(i+3)%4][j], 9);
}
}
for (i = 0; i < 4; i++) { // Place result back into column
state[i][j] = b[i];
}
}
}
// Adds the current round key to the state information. Straightforward.
function addRoundKey(state, roundKey) {
for (var j = 0; j < Nb; j++) { // Step through columns...
state[0][j] ^= (roundKey[j] & 0xFF); // and XOR
state[1][j] ^= ((roundKey[j]>>8) & 0xFF);
state[2][j] ^= ((roundKey[j]>>16) & 0xFF);
state[3][j] ^= ((roundKey[j]>>24) & 0xFF);
}
}
// This function creates the expanded key from the input (128/192/256-bit)
// key. The parameter key is an array of bytes holding the value of the key.
// The returned value is an array whose elements are the 32-bit words that
// make up the expanded key.
function keyExpansion(key) {
var expandedKey = [];
var temp;
// in case the key size or parameters were changed...
Nk = keySizeInBits / 32;
Nb = blockSizeInBits / 32;
Nr = roundsArray[Nk][Nb];
for (var j=0; j < Nk; j++) { // Fill in input key first
expandedKey[j] =
(key[4*j]) | (key[4*j+1]<<8) | (key[4*j+2]<<16) | (key[4*j+3]<<24);
}
// Now walk down the rest of the array filling in expanded key bytes as
// per Rijndael's spec
for (j = Nk; j < Nb * (Nr + 1); j++) { // For each word of expanded key
temp = expandedKey[j - 1];
if (j % Nk === 0) {
temp = ( (SBox[(temp>>8) & 0xFF]) |
(SBox[(temp>>16) & 0xFF]<<8) |
(SBox[(temp>>24) & 0xFF]<<16) |
(SBox[temp & 0xFF]<<24) ) ^ Rcon[Math.floor(j / Nk) - 1];
} else if (Nk > 6 && j % Nk == 4) {
temp = (SBox[(temp>>24) & 0xFF]<<24) |
(SBox[(temp>>16) & 0xFF]<<16) |
(SBox[(temp>>8) & 0xFF]<<8) |
(SBox[temp & 0xFF]);
}
expandedKey[j] = expandedKey[j-Nk] ^ temp;
}
return expandedKey;
}
// Rijndael's round functions...
function jcRound(state, roundKey) {
byteSub(state, "encrypt");
shiftRow(state, "encrypt");
mixColumn(state, "encrypt");
addRoundKey(state, roundKey);
}
function inverseRound(state, roundKey) {
addRoundKey(state, roundKey);
mixColumn(state, "decrypt");
shiftRow(state, "decrypt");
byteSub(state, "decrypt");
}
function finalRound(state, roundKey) {
byteSub(state, "encrypt");
shiftRow(state, "encrypt");
addRoundKey(state, roundKey);
}
function inverseFinalRound(state, roundKey){
addRoundKey(state, roundKey);
shiftRow(state, "decrypt");
byteSub(state, "decrypt");
}
// encrypt is the basic encryption function. It takes parameters
// block, an array of bytes representing a plaintext block, and expandedKey,
// an array of words representing the expanded key previously returned by
// keyExpansion(). The ciphertext block is returned as an array of bytes.
function encrypt(block, expandedKey) {
var i;
if (!block || block.length*8 != blockSizeInBits) { return; }
if (!expandedKey) { return; }
block = packBytes(block);
addRoundKey(block, expandedKey);
for (i=1; i<Nr; i++) { jcRound(block, expandedKey.slice(Nb*i, Nb*(i+1))); }
finalRound(block, expandedKey.slice(Nb*Nr));
return unpackBytes(block);
}
// decrypt is the basic decryption function. It takes parameters
// block, an array of bytes representing a ciphertext block, and expandedKey,
// an array of words representing the expanded key previously returned by
// keyExpansion(). The decrypted block is returned as an array of bytes.
function decrypt(block, expandedKey) {
var i;
if (!block || block.length*8 != blockSizeInBits) { return; }
if (!expandedKey) { return; }
block = packBytes(block);
inverseFinalRound(block, expandedKey.slice(Nb*Nr));
for (i = Nr - 1; i>0; i--) {
inverseRound(block, expandedKey.slice(Nb*i, Nb*(i+1)));
}
addRoundKey(block, expandedKey);
return unpackBytes(block);
}
/* !NEEDED
// This method takes a byte array (byteArray) and converts it to a string by
// applying String.fromCharCode() to each value and concatenating the result.
// The resulting string is returned. Note that this function SKIPS zero bytes
// under the assumption that they are padding added in formatPlaintext().
// Obviously, do not invoke this method on raw data that can contain zero
// bytes. It is really only appropriate for printable ASCII/Latin-1
// values. Roll your own function for more robust functionality :)
function byteArrayToString(byteArray) {
var result = "";
for(var i=0; i<byteArray.length; i++)
if (byteArray[i] != 0)
result += String.fromCharCode(byteArray[i]);
return result;
}
*/
// This function takes an array of bytes (byteArray) and converts them
// to a hexadecimal string. Array element 0 is found at the beginning of
// the resulting string, high nibble first. Consecutive elements follow
// similarly, for example [16, 255] --> "10ff". The function returns a
// string.
function byteArrayToHex(byteArray) {
var result = "";
if (!byteArray) { return; }
for (var i=0; i<byteArray.length; i++) {
result += ((byteArray[i]<16) ? "0" : "") + byteArray[i].toString(16);
}
return result;
}
// This function converts a string containing hexadecimal digits to an
// array of bytes. The resulting byte array is filled in the order the
// values occur in the string, for example "10FF" --> [16, 255]. This
// function returns an array.
function hexToByteArray(hexString) {
var byteArray = [];
if (hexString.length % 2) { return; } // must have even length
if (hexString.indexOf("0x") === 0 || hexString.indexOf("0X") === 0) {
hexString = hexString.substring(2);
}
for (var i = 0; i<hexString.length; i += 2) {
byteArray[Math.floor(i/2)] = parseInt(hexString.slice(i, i+2), 16);
}
return byteArray;
}
// This function packs an array of bytes into the four row form defined by
// Rijndael. It assumes the length of the array of bytes is divisible by
// four. Bytes are filled in according to the Rijndael spec (starting with
// column 0, row 0 to 3). This function returns a 2d array.
function packBytes(octets) {
var state = [];
if (!octets || octets.length % 4) { return; }
state[0] = []; state[1] = [];
state[2] = []; state[3] = [];
for (var j=0; j<octets.length; j+= 4) {
state[0][j/4] = octets[j];
state[1][j/4] = octets[j+1];
state[2][j/4] = octets[j+2];
state[3][j/4] = octets[j+3];
}
return state;
}
// This function unpacks an array of bytes from the four row format preferred
// by Rijndael into a single 1d array of bytes. It assumes the input "packed"
// is a packed array. Bytes are filled in according to the Rijndael spec.
// This function returns a 1d array of bytes.
function unpackBytes(packed) {
var result = [];
for (var j=0; j<packed[0].length; j++) {
result[result.length] = packed[0][j];
result[result.length] = packed[1][j];
result[result.length] = packed[2][j];
result[result.length] = packed[3][j];
}
return result;
}
// This function takes a prospective plaintext (string or array of bytes)
// and pads it with pseudorandom bytes if its length is not a multiple of the block
// size. If plaintext is a string, it is converted to an array of bytes
// in the process. The type checking can be made much nicer using the
// instanceof operator, but this operator is not available until IE5.0 so I
// chose to use the heuristic below.
function formatPlaintext(plaintext) {
var bpb = blockSizeInBits / 8; // bytes per block
var i;
// if primitive string or String instance
if ((!((typeof plaintext == "object") &&
((typeof (plaintext[0])) == "number"))) &&
((typeof plaintext == "string") || plaintext.indexOf)) {
plaintext = plaintext.split("");
// Unicode issues here (ignoring high byte)
for (i=0; i<plaintext.length; i++) {
plaintext[i] = plaintext[i].charCodeAt(0) & 0xFF;
}
}
i = plaintext.length % bpb;
if (i > 0) {
plaintext = plaintext.concat(getRandomBytes(bpb - i));
}
return plaintext;
}
// Returns an array containing "howMany" random bytes.
function getRandomBytes(howMany) {
var i, bytes = [];
for (i = 0; i < howMany; i++) {
bytes[i] = prng.nextInt(255);
}
return bytes;
}
// rijndaelEncrypt(plaintext, key, mode)
// Encrypts the plaintext using the given key and in the given mode.
// The parameter "plaintext" can either be a string or an array of bytes.
// The parameter "key" must be an array of key bytes. If you have a hex
// string representing the key, invoke hexToByteArray() on it to convert it
// to an array of bytes. The third parameter "mode" is a string indicating
// the encryption mode to use, either "ECB" or "CBC". If the parameter is
// omitted, ECB is assumed.
//
// An array of bytes representing the cihpertext is returned. To convert
// this array to hex, invoke byteArrayToHex() on it.
function rijndaelEncrypt(plaintext, key, mode) {
var expandedKey, i, aBlock;
var bpb = blockSizeInBits / 8; // bytes per block
var ct; // ciphertext
if (!plaintext || !key) { return; }
if (key.length*8 != keySizeInBits) { return; }
if (mode == "CBC") {
ct = getRandomBytes(bpb); // get IV
//dump("IV", byteArrayToHex(ct));
} else {
mode = "ECB";
ct = [];
}
// convert plaintext to byte array and pad with zeros if necessary.
plaintext = formatPlaintext(plaintext);
expandedKey = keyExpansion(key);
for (var block = 0; block < plaintext.length / bpb; block++) {
aBlock = plaintext.slice(block * bpb, (block + 1) * bpb);
if (mode == "CBC") {
for (i = 0; i < bpb; i++) {
aBlock[i] ^= ct[(block * bpb) + i];
}
}
ct = ct.concat(encrypt(aBlock, expandedKey));
}
return ct;
}
// rijndaelDecrypt(ciphertext, key, mode)
// Decrypts the using the given key and mode. The parameter "ciphertext"
// must be an array of bytes. The parameter "key" must be an array of key
// bytes. If you have a hex string representing the ciphertext or key,
// invoke hexToByteArray() on it to convert it to an array of bytes. The
// parameter "mode" is a string, either "CBC" or "ECB".
//
// An array of bytes representing the plaintext is returned. To convert
// this array to a hex string, invoke byteArrayToHex() on it. To convert it
// to a string of characters, you can use byteArrayToString().
function rijndaelDecrypt(ciphertext, key, mode) {
var expandedKey;
var bpb = blockSizeInBits / 8; // bytes per block
var pt = []; // plaintext array
var aBlock; // a decrypted block
var block; // current block number
if (!ciphertext || !key || typeof ciphertext == "string") { return; }
if (key.length*8 != keySizeInBits) { return; }
if (!mode) { mode = "ECB"; } // assume ECB if mode omitted
expandedKey = keyExpansion(key);