public byte[] unwrap(byte[] incoming,int start,int len) throws SaslException {
  if (len == 0) {
    return EMPTY_BYTE_ARRAY;
  }
  byte[] mac=new byte[10];
  byte[] msg=new byte[len - 16];
  byte[] msgType=new byte[2];
  byte[] seqNum=new byte[4];
  System.arraycopy(incoming,start,msg,0,msg.length);
  System.arraycopy(incoming,start + msg.length,mac,0,10);
  System.arraycopy(incoming,start + msg.length + 10,msgType,0,2);
  System.arraycopy(incoming,start + msg.length + 12,seqNum,0,4);
  byte[] expectedMac=getHMAC(peerKi,seqNum,msg,0,msg.length);
  if (logger.isLoggable(Level.FINEST)) {
    traceOutput(DI_CLASS_NAME,"unwrap","DIGEST18:incoming: ",msg);
    traceOutput(DI_CLASS_NAME,"unwrap","DIGEST19:MAC: ",mac);
    traceOutput(DI_CLASS_NAME,"unwrap","DIGEST20:messageType: ",msgType);
    traceOutput(DI_CLASS_NAME,"unwrap","DIGEST21:sequenceNum: ",seqNum);
    traceOutput(DI_CLASS_NAME,"unwrap","DIGEST22:expectedMAC: ",expectedMac);
  }
  if (!Arrays.equals(mac,expectedMac)) {
    logger.log(Level.INFO,"DIGEST23:Unmatched MACs");
    return EMPTY_BYTE_ARRAY;
  }
  if (peerSeqNum != networkByteOrderToInt(seqNum,0,4)) {
    throw new SaslException("DIGEST-MD5: Out of order " + "sequencing of messages from server. Got: " + networkByteOrderToInt(seqNum,0,4) + " Expected: "+ peerSeqNum);
  }
  if (!Arrays.equals(messageType,msgType)) {
    throw new SaslException("DIGEST-MD5: invalid message type: " + networkByteOrderToInt(msgType,0,2));
  }
  peerSeqNum++;
  return msg;
}

public byte [ ] unwrap ( byte [ ] incoming , int start , int len ) throws SaslException { if ( len == 0 ) { return EMPTY_BYTE_ARRAY ; } byte [ ] mac = new byte [ 10 ] ; byte [ ] msg = new byte [ len - 16 ] ; byte [ ] msgType = new byte [ 2 ] ; byte [ ] seqNum = new byte [ 4 ] ; System . arraycopy ( incoming , start , msg , 0 , msg . length ) ; System . arraycopy ( incoming , start + msg . length , mac , 0 , 10 ) ; System . arraycopy ( incoming , start + msg . length + 10 , msgType , 0 , 2 ) ; System . arraycopy ( incoming , start + msg . length + 12 , seqNum , 0 , 4 ) ; byte [ ] expectedMac = getHMAC ( peerKi , seqNum , msg , 0 , msg . length ) ; if ( logger . isLoggable ( Level . FINEST ) ) { traceOutput ( DI_CLASS_NAME , "unwrap" , "DIGEST18:incoming: " , msg ) ; traceOutput ( DI_CLASS_NAME , "unwrap" , "DIGEST19:MAC: " , mac ) ; traceOutput ( DI_CLASS_NAME , "unwrap" , "DIGEST20:messageType: " , msgType ) ; traceOutput ( DI_CLASS_NAME , "unwrap" , "DIGEST21:sequenceNum: " , seqNum ) ; traceOutput ( DI_CLASS_NAME , "unwrap" , "DIGEST22:expectedMAC: " , expectedMac ) ; } if ( ! Arrays . equals ( mac , expectedMac ) ) { logger . log ( Level . INFO , "DIGEST23:Unmatched MACs" ) ; return EMPTY_BYTE_ARRAY ; } if ( peerSeqNum != networkByteOrderToInt ( seqNum , 0 , 4 ) ) { throw new SaslException ( "DIGEST-MD5: Out of order " + "sequencing of messages from server. Got: " + networkByteOrderToInt ( seqNum , 0 , 4 ) + " Expected: " + peerSeqNum ) ; } if ( ! Arrays . equals ( messageType , msgType ) ) { throw new SaslException ( "DIGEST-MD5: invalid message type: " + networkByteOrderToInt ( msgType , 0 , 2 ) ) ; } peerSeqNum ++ ; return msg ; }
return verified message without mac - only if the received mac and re - generated mac are the same .
