Tag: cybersecurity

Why Would You Calculate SHA-256 Without Libraries?

Imagine you’re building a lightweight JavaScript application. You want to implement cryptographic hashing, but pulling in a bulky library like crypto-js or js-sha256 feels like overkill. Or maybe you’re just curious, eager to understand how hashing algorithms actually work by implementing them yourself. Either way, the ability to calculate a SHA-256 hash without relying on external libraries can be a game-changer.

Here are some reasons why writing your own implementation might be worth considering:

• Minimal dependencies: External libraries often add unnecessary bloat, especially for small projects.
• Deeper understanding: Building a hashing algorithm helps you grasp the underlying concepts of cryptography.
• Customization: You may need to tweak the hashing process for specific use cases, something that’s hard to do with pre-packaged libraries.

In this guide, I’ll walk you through the process of creating a pure JavaScript implementation of SHA-256. By the end, you’ll not only have a fully functional hashing function but also a solid understanding of how it works under the hood.

What Is SHA-256 and Why Does It Matter?

SHA-256 (Secure Hash Algorithm 256-bit) is a cornerstone of modern cryptography. It’s a one-way hashing function that takes an input (of any size) and produces a fixed-size, 256-bit (32-byte) hash value. Here’s why SHA-256 is so widely used:

• Password security: Hashing passwords before storing them prevents unauthorized access.
• Data integrity: Verifies that files or messages haven’t been tampered with.
• Blockchain technology: Powers cryptocurrencies by securing transaction data.

Its key properties include:

• Determinism: The same input always produces the same hash.
• Irreversibility: It’s computationally infeasible to reverse-engineer the input from the hash.
• Collision resistance: It’s exceedingly unlikely for two different inputs to produce the same hash.

These properties make SHA-256 an essential tool for securing sensitive data, authenticating digital signatures, and more.

Why Implement SHA-256 Manually?

While most developers rely on trusted libraries for cryptographic operations, there are several scenarios where implementing SHA-256 manually might be beneficial:

• Educational purposes: If you’re a student or enthusiast, implementing a hashing algorithm from scratch is an excellent way to learn about cryptography and understand the mathematical operations involved.
• Security audits: By writing your own implementation, you can ensure there are no hidden vulnerabilities or backdoors in the hash function.
• Lightweight applications: For small applications, avoiding dependencies on large libraries can improve performance and reduce complexity.
• Customization: You might need to modify the algorithm slightly to suit particular requirements, such as using specific padding schemes or integrating it into a proprietary system.

However, keep in mind that cryptographic algorithms are notoriously difficult to implement correctly, so unless you have a compelling reason, it’s often safer to rely on well-tested libraries.

How the SHA-256 Algorithm Works

The SHA-256 algorithm follows a precise sequence of steps. Here’s a simplified roadmap:

1. Initialization: Define initial hash values and constants.
2. Preprocessing: Pad the input to ensure its length is a multiple of 512 bits.
3. Block processing: Divide the padded input into 512-bit chunks and process each block through a series of bitwise and mathematical operations.
4. Output: Combine intermediate results to produce the final 256-bit hash.

Let’s break this down into manageable steps to build our implementation.

Implementing SHA-256 in JavaScript

To implement SHA-256, we’ll divide the code into logical sections: utility functions, constants, block processing, and the main hash function. Let’s get started.

Step 1: Utility Functions

First, we need helper functions to handle repetitive tasks like rotating bits, padding inputs, and converting strings to byte arrays:

function rotateRight(value, amount) {
  return (value >>> amount) | (value << (32 - amount));
}

function toUTF8Bytes(string) {
  const bytes = [];
  for (let i = 0; i < string.length; i++) {
    const codePoint = string.charCodeAt(i);
    if (codePoint < 0x80) {
      bytes.push(codePoint);
    } else if (codePoint < 0x800) {
      bytes.push(0xc0 | (codePoint >> 6));
      bytes.push(0x80 | (codePoint & 0x3f));
    } else if (codePoint < 0x10000) {
      bytes.push(0xe0 | (codePoint >> 12));
      bytes.push(0x80 | ((codePoint >> 6) & 0x3f));
      bytes.push(0x80 | (codePoint & 0x3f));
    }
  }
  return bytes;
}

function padTo512Bits(bytes) {
  const bitLength = bytes.length * 8;
  bytes.push(0x80);
  while ((bytes.length * 8) % 512 !== 448) {
    bytes.push(0x00);
  }
  for (let i = 7; i >= 0; i--) {
    bytes.push((bitLength >>> (i * 8)) & 0xff);
  }
  return bytes;
}

Step 2: Initialization Constants

SHA-256 uses a set of predefined constants derived from the fractional parts of the square roots of the first 64 prime numbers. These values are used throughout the algorithm:

const INITIAL_HASH = [
  0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
  0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
];

const K = [
  0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
  0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
  // ... (remaining 56 constants truncated for brevity)
  0xc67178f2
];

Step 3: Processing 512-Bit Blocks

Next, we process each 512-bit block using bitwise operations and modular arithmetic. The intermediate hash values are updated with each iteration:

function processBlock(chunk, hash) {
  const W = new Array(64).fill(0);

  for (let i = 0; i < 16; i++) {
    W[i] = (chunk[i * 4] << 24) | (chunk[i * 4 + 1] << 16) |
           (chunk[i * 4 + 2] << 8) | chunk[i * 4 + 3];
  }

  for (let i = 16; i < 64; i++) {
    const s0 = rotateRight(W[i - 15], 7) ^ rotateRight(W[i - 15], 18) ^ (W[i - 15] >>> 3);
    const s1 = rotateRight(W[i - 2], 17) ^ rotateRight(W[i - 2], 19) ^ (W[i - 2] >>> 10);
    W[i] = (W[i - 16] + s0 + W[i - 7] + s1) >>> 0;
  }

  let [a, b, c, d, e, f, g, h] = hash;

  for (let i = 0; i < 64; i++) {
    const S1 = rotateRight(e, 6) ^ rotateRight(e, 11) ^ rotateRight(e, 25);
    const ch = (e & f) ^ (~e & g);
    const temp1 = (h + S1 + ch + K[i] + W[i]) >>> 0;
    const S0 = rotateRight(a, 2) ^ rotateRight(a, 13) ^ rotateRight(a, 22);
    const maj = (a & b) ^ (a & c) ^ (b & c);
    const temp2 = (S0 + maj) >>> 0;

    h = g;
    g = f;
    f = e;
    e = (d + temp1) >>> 0;
    d = c;
    c = b;
    b = a;
    a = (temp1 + temp2) >>> 0;
  }

  hash[0] = (hash[0] + a) >>> 0;
  hash[1] = (hash[1] + b) >>> 0;
  hash[2] = (hash[2] + c) >>> 0;
  hash[3] = (hash[3] + d) >>> 0;
  hash[4] = (hash[4] + e) >>> 0;
  hash[5] = (hash[5] + f) >>> 0;
  hash[6] = (hash[6] + g) >>> 0;
  hash[7] = (hash[7] + h) >>> 0;
}

Step 4: Assembling the Final Function

Finally, we combine everything into a single function that calculates the SHA-256 hash:

function sha256(input) {
  const bytes = toUTF8Bytes(input);
  padTo512Bits(bytes);

  const hash = [...INITIAL_HASH];
  for (let i = 0; i < bytes.length; i += 64) {
    const chunk = bytes.slice(i, i + 64);
    processBlock(chunk, hash);
  }

  return hash.map(h => h.toString(16).padStart(8, '0')).join('');
}

console.log(sha256("Hello, World!")); // Example usage

Key Takeaways

• SHA-256 is a versatile cryptographic hash function used in password security, blockchain, and data integrity verification.
• Implementing SHA-256 in pure JavaScript eliminates dependency on external libraries and deepens your understanding of the algorithm.
• Follow the algorithm’s steps carefully, including padding, initialization, and block processing.
• Test your implementation with well-known inputs to ensure accuracy.
• Understanding cryptographic functions empowers you to write more secure and optimized applications.

Implementing SHA-256 manually is challenging but rewarding. By understanding its intricacies, you gain insight into cryptographic principles, preparing you for advanced topics like encryption, digital signatures, and secure communications.

📋 Disclosure: Some links in this article are affiliate links. If you purchase through these links, I earn a small commission at no extra cost to you. I only recommend products I have personally used or thoroughly evaluated.

📚 Related Articles

• Vibe Coding Is a Security Nightmare — Here’s How to Survive It
• Ultimate Guide to Secure Remote Access for Your Homelab
• Securing File Uploads in PHP: .htaccess Exploits and Best Practices