/*

 * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Oracle designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Oracle in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

package com.sun.crypto.provider;

import java.util.Arrays;

import java.security.*;

import java.security.spec.AlgorithmParameterSpec;

import javax.crypto.*;

import javax.crypto.spec.SecretKeySpec;

import sun.security.internal.spec.TlsPrfParameterSpec;

/**

 * KeyGenerator implementation for the TLS PRF function.

 * <p>

 * This class duplicates the HMAC functionality (RFC 2104) with

 * performance optimizations (e.g. XOR'ing keys with padding doesn't

 * need to be redone for each HMAC operation).

 *

 * @author  Andreas Sterbenz

 * @since   1.6

 */

abstract class TlsPrfGenerator extends KeyGeneratorSpi {

    // magic constants and utility functions, also used by other files

    // in this package

    private final static byte[] B0 = new byte[0];

    final static byte[] LABEL_MASTER_SECRET = // "master secret"

        { 109, 97, 115, 116, 101, 114, 32, 115, 101, 99, 114, 101, 116 };

    final static byte[] LABEL_KEY_EXPANSION = // "key expansion"

        { 107, 101, 121, 32, 101, 120, 112, 97, 110, 115, 105, 111, 110 };

    final static byte[] LABEL_CLIENT_WRITE_KEY = // "client write key"

        { 99, 108, 105, 101, 110, 116, 32, 119, 114, 105, 116, 101, 32,

          107, 101, 121 };

    final static byte[] LABEL_SERVER_WRITE_KEY = // "server write key"

        { 115, 101, 114, 118, 101, 114, 32, 119, 114, 105, 116, 101, 32,

          107, 101, 121 };

    final static byte[] LABEL_IV_BLOCK = // "IV block"

        { 73, 86, 32, 98, 108, 111, 99, 107 };

    /*

     * TLS HMAC "inner" and "outer" padding.  This isn't a function

     * of the digest algorithm.

     */

    private static final byte[] HMAC_ipad64  = genPad((byte)0x36, 64);

    private static final byte[] HMAC_ipad128 = genPad((byte)0x36, 128);

    private static final byte[] HMAC_opad64  = genPad((byte)0x5c, 64);

    private static final byte[] HMAC_opad128 = genPad((byte)0x5c, 128);

    // SSL3 magic mix constants ("A", "BB", "CCC", ...)

    final static byte[][] SSL3_CONST = genConst();

    static byte[] genPad(byte b, int count) {

        byte[] padding = new byte[count];

        Arrays.fill(padding, b);

        return padding;

    }

    static byte[] concat(byte[] b1, byte[] b2) {

        int n1 = b1.length;

        int n2 = b2.length;

        byte[] b = new byte[n1 + n2];

        System.arraycopy(b1, 0, b, 0, n1);

        System.arraycopy(b2, 0, b, n1, n2);

        return b;

    }

    private static byte[][] genConst() {

        int n = 10;

        byte[][] arr = new byte[n][];

        for (int i = 0; i < n; i++) {

            byte[] b = new byte[i + 1];

            Arrays.fill(b, (byte)('A' + i));

            arr[i] = b;

        }

        return arr;

    }

    // PRF implementation

    private final static String MSG = "TlsPrfGenerator must be "

        + "initialized using a TlsPrfParameterSpec";

    private TlsPrfParameterSpec spec;

    public TlsPrfGenerator() {

    }

    protected void engineInit(SecureRandom random) {

        throw new InvalidParameterException(MSG);

    }

    protected void engineInit(AlgorithmParameterSpec params,

            SecureRandom random) throws InvalidAlgorithmParameterException {

        if (params instanceof TlsPrfParameterSpec == false) {

            throw new InvalidAlgorithmParameterException(MSG);

        }

        this.spec = (TlsPrfParameterSpec)params;

        SecretKey key = spec.getSecret();

        if ((key != null) && ("RAW".equals(key.getFormat()) == false)) {

            throw new InvalidAlgorithmParameterException(

                "Key encoding format must be RAW");

        }

    }

    protected void engineInit(int keysize, SecureRandom random) {

        throw new InvalidParameterException(MSG);

    }

    SecretKey engineGenerateKey0(boolean tls12) {

        if (spec == null) {

            throw new IllegalStateException(

                "TlsPrfGenerator must be initialized");

        }

        SecretKey key = spec.getSecret();

        byte[] secret = (key == null) ? null : key.getEncoded();

        try {

            byte[] labelBytes = spec.getLabel().getBytes("UTF8");

            int n = spec.getOutputLength();

            byte[] prfBytes = (tls12 ?

                doTLS12PRF(secret, labelBytes, spec.getSeed(), n,

                    spec.getPRFHashAlg(), spec.getPRFHashLength(),

                    spec.getPRFBlockSize()) :

                doTLS10PRF(secret, labelBytes, spec.getSeed(), n));

            return new SecretKeySpec(prfBytes, "TlsPrf");

        } catch (GeneralSecurityException e) {

            throw new ProviderException("Could not generate PRF", e);

        } catch (java.io.UnsupportedEncodingException e) {

            throw new ProviderException("Could not generate PRF", e);

        }

    }

    static byte[] doTLS12PRF(byte[] secret, byte[] labelBytes,

            byte[] seed, int outputLength,

            String prfHash, int prfHashLength, int prfBlockSize)

            throws NoSuchAlgorithmException, DigestException {

        if (prfHash == null) {

            throw new NoSuchAlgorithmException("Unspecified PRF algorithm");

        }

        MessageDigest prfMD = MessageDigest.getInstance(prfHash);

        return doTLS12PRF(secret, labelBytes, seed, outputLength,

            prfMD, prfHashLength, prfBlockSize);

    }

    static byte[] doTLS12PRF(byte[] secret, byte[] labelBytes,

            byte[] seed, int outputLength,

            MessageDigest mdPRF, int mdPRFLen, int mdPRFBlockSize)

            throws DigestException {

        if (secret == null) {

            secret = B0;

        }

        // If we have a long secret, digest it first.

        if (secret.length > mdPRFBlockSize) {

            secret = mdPRF.digest(secret);

        }

        byte[] output = new byte[outputLength];

        byte [] ipad;

        byte [] opad;

        switch (mdPRFBlockSize) {

        case 64:

            ipad = HMAC_ipad64.clone();

            opad = HMAC_opad64.clone();

            break;

        case 128:

            ipad = HMAC_ipad128.clone();

            opad = HMAC_opad128.clone();

            break;

        default:

            throw new DigestException("Unexpected block size.");

        }

        // P_HASH(Secret, label + seed)

        expand(mdPRF, mdPRFLen, secret, 0, secret.length, labelBytes,

            seed, output, ipad, opad);

        return output;

    }

    static byte[] doTLS10PRF(byte[] secret, byte[] labelBytes,

            byte[] seed, int outputLength) throws NoSuchAlgorithmException,

            DigestException {

        MessageDigest md5 = MessageDigest.getInstance("MD5");

        MessageDigest sha = MessageDigest.getInstance("SHA1");

        return doTLS10PRF(secret, labelBytes, seed, outputLength, md5, sha);

    }

    static byte[] doTLS10PRF(byte[] secret, byte[] labelBytes,

            byte[] seed, int outputLength, MessageDigest md5,

            MessageDigest sha) throws DigestException {

        /*

         * Split the secret into two halves S1 and S2 of same length.

         * S1 is taken from the first half of the secret, S2 from the

         * second half.

         * Their length is created by rounding up the length of the

         * overall secret divided by two; thus, if the original secret

         * is an odd number of bytes long, the last byte of S1 will be

         * the same as the first byte of S2.

         *

         * Note: Instead of creating S1 and S2, we determine the offset into

         * the overall secret where S2 starts.

         */

        if (secret == null) {

            secret = B0;

        }

        int off = secret.length >> 1;

        int seclen = off + (secret.length & 1);

        byte[] output = new byte[outputLength];

        // P_MD5(S1, label + seed)

        expand(md5, 16, secret, 0, seclen, labelBytes, seed, output,

            HMAC_ipad64.clone(), HMAC_opad64.clone());

        // P_SHA-1(S2, label + seed)

        expand(sha, 20, secret, off, seclen, labelBytes, seed, output,

            HMAC_ipad64.clone(), HMAC_opad64.clone());

        return output;

    }

    /*

     * @param digest the MessageDigest to produce the HMAC

     * @param hmacSize the HMAC size

     * @param secret the secret

     * @param secOff the offset into the secret

     * @param secLen the secret length

     * @param label the label

     * @param seed the seed

     * @param output the output array

     */

    private static void expand(MessageDigest digest, int hmacSize,

            byte[] secret, int secOff, int secLen, byte[] label, byte[] seed,

            byte[] output, byte[] pad1, byte[] pad2) throws DigestException {

        /*

         * modify the padding used, by XORing the key into our copy of that

         * padding.  That's to avoid doing that for each HMAC computation.

         */

        for (int i = 0; i < secLen; i++) {

            pad1[i] ^= secret[i + secOff];

            pad2[i] ^= secret[i + secOff];

        }

        byte[] tmp = new byte[hmacSize];

        byte[] aBytes = null;

        /*

         * compute:

         *

         *     P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +

         *                            HMAC_hash(secret, A(2) + seed) +

         *                            HMAC_hash(secret, A(3) + seed) + ...

         * A() is defined as:

         *

         *     A(0) = seed

         *     A(i) = HMAC_hash(secret, A(i-1))

         */

        int remaining = output.length;

        int ofs = 0;

        while (remaining > 0) {

            /*

             * compute A() ...

             */

            // inner digest

            digest.update(pad1);

            if (aBytes == null) {

                digest.update(label);

                digest.update(seed);

            } else {

                digest.update(aBytes);

            }

            digest.digest(tmp, 0, hmacSize);

            // outer digest

            digest.update(pad2);

            digest.update(tmp);

            if (aBytes == null) {

                aBytes = new byte[hmacSize];

            }

            digest.digest(aBytes, 0, hmacSize);

            /*

             * compute HMAC_hash() ...

             */

            // inner digest

            digest.update(pad1);

            digest.update(aBytes);

            digest.update(label);

            digest.update(seed);

            digest.digest(tmp, 0, hmacSize);

            // outer digest

            digest.update(pad2);

            digest.update(tmp);

            digest.digest(tmp, 0, hmacSize);

            int k = Math.min(hmacSize, remaining);

            for (int i = 0; i < k; i++) {

                output[ofs++] ^= tmp[i];

            }

            remaining -= k;

        }

    }

    /**

     * A KeyGenerator implementation that supports TLS 1.2.

     * <p>

     * TLS 1.2 uses a different hash algorithm than 1.0/1.1 for the PRF

     * calculations.  As of 2010, there is no PKCS11-level support for TLS

     * 1.2 PRF calculations, and no known OS's have an internal variant

     * we could use.  Therefore for TLS 1.2, we are updating JSSE to request

     * a different provider algorithm:  "SunTls12Prf".  If we reused the

     * name "SunTlsPrf", the PKCS11 provider would need be updated to

     * fail correctly when presented with the wrong version number

     * (via Provider.Service.supportsParameters()), and add the

     * appropriate supportsParamters() checks into KeyGenerators (not

     * currently there).

     */

    static public class V12 extends TlsPrfGenerator {

        protected SecretKey engineGenerateKey() {

            return engineGenerateKey0(true);

        }

    }

    /**

     * A KeyGenerator implementation that supports TLS 1.0/1.1.

     */

    static public class V10 extends TlsPrfGenerator {

        protected SecretKey engineGenerateKey() {

            return engineGenerateKey0(false);

        }

    }

}