It's an unfortunate fact that, right now (2019), browsers don't expose standardized streaming hashing interfaces in SubtleCrypto
. The only way to hash a file, is to load it into an ArrayBuffer
in its entirety, which for large files, this could be prohibitvely costly memory-wise.
To get around it, I'm thinking of building a custom hash function using HMAC as its compression function, in a usual Merkal-Damgaard construct.
$ \text{compress}(IV, M) = \text{HMAC-SHA256}_{IV}(M)\\ IV_i = \text{compress}(IV_{i-1},M_i) \\ IV_0 = \text{00h}^\text{hashlen} \\ H(M_1|M_2|...|M_n) = IV_n $
The specific questions I have are:
Q1: Do I still need to include file length in the final block? I'm guessing no because the HMAC compression function already length-pad my message during processing.
Q2: What are the characteristics of such construct with regard to length-extension attack? I'm using SHA256 because it's standardized in Web Crypto, and it's length-extendable, so I wouldn't be bothering to defend against it in my HMAC-Hash construct.