/*

 * Copyright (c) 2005, 2019, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Oracle designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Oracle in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

package sun.security.mscapi;

import java.nio.ByteBuffer;

import java.security.*;

import java.security.interfaces.ECPublicKey;

import java.security.interfaces.RSAPublicKey;

import java.security.spec.AlgorithmParameterSpec;

import java.math.BigInteger;

import java.security.spec.MGF1ParameterSpec;

import java.security.spec.PSSParameterSpec;

import java.util.Locale;

import sun.security.rsa.RSAKeyFactory;

import sun.security.util.ECUtil;

import sun.security.util.KeyUtil;

/**

 * Signature implementation.

 *

 * Objects should be instantiated by calling Signature.getInstance() using the

 * following algorithm names:

 *

 *  . "NONEwithRSA"

 *  . "SHA1withRSA"

 *  . "SHA256withRSA"

 *  . "SHA384withRSA"

 *  . "SHA512withRSA"

 *  . "MD5withRSA"

 *  . "MD2withRSA"

 *  . "RSASSA-PSS"

 *  . "SHA1withECDSA"

 *  . "SHA224withECDSA"

 *  . "SHA256withECDSA"

 *  . "SHA384withECDSA"

 *  . "SHA512withECDSA"

 *

 * NOTE: RSA keys must be at least 512 bits long.

 *

 * NOTE: NONEwithRSA must be supplied with a pre-computed message digest.

 *       Only the following digest algorithms are supported: MD5, SHA-1,

 *       SHA-256, SHA-384, SHA-512 and a special-purpose digest

 *       algorithm which is a concatenation of SHA-1 and MD5 digests.

 *

 * @since   1.6

 * @author  Stanley Man-Kit Ho

 */

abstract class CSignature extends SignatureSpi {

    // private key algorithm name

    protected String keyAlgorithm;

    // message digest implementation we use

    protected MessageDigest messageDigest;

    // message digest name

    protected String messageDigestAlgorithm;

    // flag indicating whether the digest has been reset

    protected boolean needsReset;

    // the signing key

    protected CPrivateKey privateKey = null;

    // the verification key

    protected CPublicKey publicKey = null;

    /**

     * Constructs a new CSignature. Used by subclasses.

     */

    CSignature(String keyName, String digestName) {

        this.keyAlgorithm = keyName;

        if (digestName != null) {

            try {

                messageDigest = MessageDigest.getInstance(digestName);

                // Get the digest's canonical name

                messageDigestAlgorithm = messageDigest.getAlgorithm();

            } catch (NoSuchAlgorithmException e) {

                throw new ProviderException(e);

            }

        } else {

            messageDigest = null;

            messageDigestAlgorithm = null;

        }

        needsReset = false;

    }

    static class RSA extends CSignature {

        public RSA(String digestAlgorithm) {

            super("RSA", digestAlgorithm);

        }

        // initialize for signing. See JCA doc

        @Override

        protected void engineInitSign(PrivateKey key) throws InvalidKeyException {

            if ((key instanceof CPrivateKey) == false

                    || !key.getAlgorithm().equalsIgnoreCase("RSA")) {

                throw new InvalidKeyException("Key type not supported: "

                        + key.getClass() + " " + key.getAlgorithm());

            }

            privateKey = (CPrivateKey) key;

            // Check against the local and global values to make sure

            // the sizes are ok.  Round up to nearest byte.

            RSAKeyFactory.checkKeyLengths(((privateKey.length() + 7) & ~7),

                    null, CKeyPairGenerator.RSA.KEY_SIZE_MIN,

                    CKeyPairGenerator.RSA.KEY_SIZE_MAX);

            this.publicKey = null;

            resetDigest();

        }

        // initialize for signing. See JCA doc

        @Override

        protected void engineInitVerify(PublicKey key) throws InvalidKeyException {

            // This signature accepts only RSAPublicKey

            if ((key instanceof RSAPublicKey) == false) {

            }

            if ((key instanceof CPublicKey) == false) {

                // convert key to MSCAPI format

                java.security.interfaces.RSAPublicKey rsaKey =

                        (java.security.interfaces.RSAPublicKey) key;

                BigInteger modulus = rsaKey.getModulus();

                BigInteger exponent =  rsaKey.getPublicExponent();

                // Check against the local and global values to make sure

                // the sizes are ok.  Round up to the nearest byte.

                RSAKeyFactory.checkKeyLengths(((modulus.bitLength() + 7) & ~7),

                        exponent, -1, CKeyPairGenerator.RSA.KEY_SIZE_MAX);

                byte[] modulusBytes = modulus.toByteArray();

                byte[] exponentBytes = exponent.toByteArray();

                // Adjust key length due to sign bit

                int keyBitLength = (modulusBytes[0] == 0)

                        ? (modulusBytes.length - 1) * 8

                        : modulusBytes.length * 8;

                byte[] keyBlob = generatePublicKeyBlob(

                        keyBitLength, modulusBytes, exponentBytes);

                try {

                    publicKey = importPublicKey("RSA", keyBlob, keyBitLength);

                } catch (KeyStoreException e) {

                    throw new InvalidKeyException(e);

                }

            } else {

                publicKey = (CPublicKey) key;

            }

            this.privateKey = null;

            resetDigest();

        }

        /**

         * Returns the signature bytes of all the data

         * updated so far.

         * The format of the signature depends on the underlying

         * signature scheme.

         *

         * @return the signature bytes of the signing operation's result.

         *

         * @exception SignatureException if the engine is not

         * initialized properly or if this signature algorithm is unable to

         * process the input data provided.

         */

        @Override

        protected byte[] engineSign() throws SignatureException {

            byte[] hash = getDigestValue();

            if (privateKey.getHCryptKey() == 0) {

                return signCngHash(1, hash, hash.length,

                        0,

                        this instanceof NONEwithRSA ? null : messageDigestAlgorithm,

                        privateKey.getHCryptProvider(), 0);

            } else {

                // Omit the hash OID when generating a NONEwithRSA signature

                boolean noHashOID = this instanceof NONEwithRSA;

                // Sign hash using MS Crypto APIs

                byte[] result = signHash(noHashOID, hash, hash.length,

                        messageDigestAlgorithm, privateKey.getHCryptProvider(),

                        privateKey.getHCryptKey());

                // Convert signature array from little endian to big endian

                return convertEndianArray(result);

            }

        }

        /**

         * Verifies the passed-in signature.

         *

         * @param sigBytes the signature bytes to be verified.

         *

         * @return true if the signature was verified, false if not.

         *

         * @exception SignatureException if the engine is not

         * initialized properly, the passed-in signature is improperly

         * encoded or of the wrong type, if this signature algorithm is unable to

         * process the input data provided, etc.

         */

        @Override

        protected boolean engineVerify(byte[] sigBytes)

                throws SignatureException {

            byte[] hash = getDigestValue();

            if (publicKey.getHCryptKey() == 0) {

                return verifyCngSignedHash(

                        1, hash, hash.length,

                        sigBytes, sigBytes.length,

                        0,

                        messageDigestAlgorithm,

                        publicKey.getHCryptProvider(),

                        0);

            } else {

                return verifySignedHash(hash, hash.length,

                        messageDigestAlgorithm, convertEndianArray(sigBytes),

                        sigBytes.length, publicKey.getHCryptProvider(),

                        publicKey.getHCryptKey());

            }

        }

        /**

         * Generates a public-key BLOB from a key's components.

         */

        // used by CRSACipher

        static native byte[] generatePublicKeyBlob(

                int keyBitLength, byte[] modulus, byte[] publicExponent)

                throws InvalidKeyException;

    }

    // Nested class for NONEwithRSA signatures

    public static final class NONEwithRSA extends RSA {

        // the longest supported digest is 512 bits (SHA-512)

        private static final int RAW_RSA_MAX = 64;

        private final byte[] precomputedDigest;

        private int offset = 0;

        public NONEwithRSA() {

            super(null);

            precomputedDigest = new byte[RAW_RSA_MAX];

        }

        // Stores the precomputed message digest value.

        @Override

        protected void engineUpdate(byte b) throws SignatureException {

            if (offset >= precomputedDigest.length) {

                offset = RAW_RSA_MAX + 1;

                return;

            }

            precomputedDigest[offset++] = b;

        }

        // Stores the precomputed message digest value.

        @Override

        protected void engineUpdate(byte[] b, int off, int len)

                throws SignatureException {

            if (len > (precomputedDigest.length - offset)) {

                offset = RAW_RSA_MAX + 1;

                return;

            }

            System.arraycopy(b, off, precomputedDigest, offset, len);

            offset += len;

        }

        // Stores the precomputed message digest value.

        @Override

        protected void engineUpdate(ByteBuffer byteBuffer) {

            int len = byteBuffer.remaining();

            if (len <= 0) {

                return;

            }

            if (len > (precomputedDigest.length - offset)) {

                offset = RAW_RSA_MAX + 1;

                return;

            }

            byteBuffer.get(precomputedDigest, offset, len);

            offset += len;

        }

        @Override

        protected void resetDigest(){

            offset = 0;

        }

        // Returns the precomputed message digest value.

        @Override

        protected byte[] getDigestValue() throws SignatureException {

            if (offset > RAW_RSA_MAX) {

                throw new SignatureException("Message digest is too long");

            }

            // Determine the digest algorithm from the digest length

            if (offset == 20) {

                setDigestName("SHA1");

            } else if (offset == 36) {

                setDigestName("SHA1+MD5");

            } else if (offset == 32) {

                setDigestName("SHA-256");

            } else if (offset == 48) {

                setDigestName("SHA-384");

            } else if (offset == 64) {

                setDigestName("SHA-512");

            } else if (offset == 16) {

                setDigestName("MD5");

            } else {

                throw new SignatureException(

                    "Message digest length is not supported");

            }

            byte[] result = new byte[offset];

            System.arraycopy(precomputedDigest, 0, result, 0, offset);

            offset = 0;

            return result;

        }

    }

    public static final class SHA1withRSA extends RSA {

        public SHA1withRSA() {

            super("SHA1");

        }

    }

    public static final class SHA256withRSA extends RSA {

        public SHA256withRSA() {

            super("SHA-256");

        }

    }

    public static final class SHA384withRSA extends RSA {

        public SHA384withRSA() {

            super("SHA-384");

        }

    }

    public static final class SHA512withRSA extends RSA {

        public SHA512withRSA() {

            super("SHA-512");

        }

    }

    public static final class MD5withRSA extends RSA {

        public MD5withRSA() {

            super("MD5");

        }

    }

    public static final class MD2withRSA extends RSA {

        public MD2withRSA() {

            super("MD2");

        }

    }

    public static final class SHA1withECDSA extends ECDSA {

        public SHA1withECDSA() {

            super("SHA-1");

        }

    }

    public static final class SHA224withECDSA extends ECDSA {

        public SHA224withECDSA() {

            super("SHA-224");

        }

    }

    public static final class SHA256withECDSA extends ECDSA {

        public SHA256withECDSA() {

            super("SHA-256");

        }

    }

    public static final class SHA384withECDSA extends ECDSA {

        public SHA384withECDSA() {

            super("SHA-384");

        }

    }

    public static final class SHA512withECDSA extends ECDSA {

        public SHA512withECDSA() {

            super("SHA-512");

        }

    }

    static class ECDSA extends CSignature {

        public ECDSA(String messageDigestAlgorithm) {

            super("EC", messageDigestAlgorithm);

        }

        // initialize for signing. See JCA doc

        @Override

        protected void engineInitSign(PrivateKey key) throws InvalidKeyException {

            if ((key instanceof CPrivateKey) == false

                    || !key.getAlgorithm().equalsIgnoreCase("EC")) {

            }

            privateKey = (CPrivateKey) key;

            this.publicKey = null;

            resetDigest();

        }

        // initialize for signing. See JCA doc

        @Override

        protected void engineInitVerify(PublicKey key) throws InvalidKeyException {

            // This signature accepts only ECPublicKey

            if ((key instanceof ECPublicKey) == false) {

            }

            if ((key instanceof CPublicKey) == false) {

                try {

                    publicKey = importECPublicKey("EC",

                            CKey.generateECBlob(key),

                            KeyUtil.getKeySize(key));

                } catch (KeyStoreException e) {

                    throw new InvalidKeyException(e);

                }

            } else {

                publicKey = (CPublicKey) key;

            }

            this.privateKey = null;

            resetDigest();

        }

        @Override

        protected byte[] engineSign() throws SignatureException {

            byte[] hash = getDigestValue();

            byte[] raw = signCngHash(0, hash, hash.length,

                    0,

                    null,

                    privateKey.getHCryptProvider(), 0);

            return ECUtil.encodeSignature(raw);

        }

        @Override

        protected boolean engineVerify(byte[] sigBytes) throws SignatureException {

            byte[] hash = getDigestValue();

            sigBytes = ECUtil.decodeSignature(sigBytes);

            return verifyCngSignedHash(

                    0,