/*

 * Copyright (c) 2016, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Oracle designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Oracle in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

package sun.security.provider;

import javax.crypto.Cipher;

import javax.crypto.NoSuchPaddingException;

import javax.crypto.spec.SecretKeySpec;

import java.security.*;

import java.util.Arrays;

import java.util.Locale;

public class CtrDrbg extends AbstractDrbg {

    private static final int AES_LIMIT;

    static {

        try {

            AES_LIMIT = Cipher.getMaxAllowedKeyLength("AES");

        } catch (Exception e) {

            // should not happen

            throw new AssertionError("Cannot detect AES", e);

        }

    }

    private Cipher cipher;

    private String cipherAlg;

    private String keyAlg;

    private int ctrLen;

    private int blockLen;

    private int keyLen;

    private int seedLen;

    private byte[] v;

    private byte[] k;

    public CtrDrbg(SecureRandomParameters params) {

        mechName = "CTR_DRBG";

        configure(params);

    }

    private static int alg2strength(String algorithm) {

        switch (algorithm.toUpperCase(Locale.ROOT)) {

            case "AES-128":

                return 128;

            case "AES-192":

                return 192;

            case "AES-256":

                return 256;

            default:

                throw new IllegalArgumentException(algorithm +

                        " not supported in CTR_DBRG");

        }

    }

    @Override

    protected void chooseAlgorithmAndStrength() {

        if (requestedAlgorithm != null) {

            algorithm = requestedAlgorithm.toUpperCase(Locale.ROOT);

            int supportedStrength = alg2strength(algorithm);

            if (requestedInstantiationSecurityStrength >= 0) {

                int tryStrength = getStandardStrength(

                        requestedInstantiationSecurityStrength);

                if (tryStrength > supportedStrength) {

                    throw new IllegalArgumentException(algorithm +

                            " does not support strength " +

                            requestedInstantiationSecurityStrength);

                }

                this.securityStrength = tryStrength;

            } else {

                this.securityStrength = (DEFAULT_STRENGTH > supportedStrength) ?

                        supportedStrength : DEFAULT_STRENGTH;

            }

        } else {

            int tryStrength = (requestedInstantiationSecurityStrength < 0) ?

                    DEFAULT_STRENGTH : requestedInstantiationSecurityStrength;

            tryStrength = getStandardStrength(tryStrength);

            // Default algorithm, use AES-128 if AES-256 is not available.

            // Remember to sync with "securerandom.drbg.config" in java.security

            if (tryStrength <= 128 && AES_LIMIT < 256) {

                algorithm = "AES-128";

            } else if (AES_LIMIT >= 256) {

                algorithm = "AES-256";

            } else {

                throw new IllegalArgumentException("unsupported strength " +

                        requestedInstantiationSecurityStrength);

            }

            this.securityStrength = tryStrength;

        }

        switch (algorithm.toUpperCase(Locale.ROOT)) {

            case "AES-128":

            case "AES-192":

            case "AES-256":

                this.keyAlg = "AES";

                this.cipherAlg = "AES/ECB/NoPadding";

                switch (algorithm) {

                    case "AES-128":

                        this.keyLen = 128 / 8;

                        break;

                    case "AES-192":

                        this.keyLen = 192 / 8;

                        if (AES_LIMIT < 192) {

                            throw new IllegalArgumentException(algorithm +

                                " not available (because policy) in CTR_DBRG");

                        }

                        break;

                    case "AES-256":

                        this.keyLen = 256 / 8;

                        if (AES_LIMIT < 256) {

                            throw new IllegalArgumentException(algorithm +

                                " not available (because policy) in CTR_DBRG");

                        }

                        break;

                    default:

                        throw new IllegalArgumentException(algorithm +

                            " not supported in CTR_DBRG");

                }

                this.blockLen = 128 / 8;

                break;

            default:

                throw new IllegalArgumentException(algorithm +

                        " not supported in CTR_DBRG");

        }

        this.seedLen = this.blockLen + this.keyLen;

        this.ctrLen = this.blockLen;    // TODO

        if (usedf) {

            this.minLength = this.securityStrength / 8;

        } else {

            this.minLength = this.maxLength =

                    this.maxPersonalizationStringLength =

                            this.maxAdditionalInputLength = seedLen;

        }

    }

    /**

     * This call, used by the constructors, instantiates the digest.

     */

    @Override

    protected void initEngine() {

        try {

            /*

             * Use the local SunJCE implementation to avoid native

             * performance overhead.

             */

            cipher = Cipher.getInstance(cipherAlg, "SunJCE");

        } catch (NoSuchProviderException | NoSuchAlgorithmException

                | NoSuchPaddingException e) {

            // Fallback to any available.

            try {

                cipher = Cipher.getInstance(cipherAlg);

            } catch (NoSuchAlgorithmException | NoSuchPaddingException exc) {

                throw new InternalError(

                    "internal error: " + cipherAlg + " not available.", exc);

            }

        }

    }

    private void status() {

        if (debug != null) {

            debug.println(this, "Key = " + hex(k));

            debug.println(this, "V   = " + hex(v));

            debug.println(this, "reseed counter = " + reseedCounter);

        }

    }

    // 800-90Ar1 10.2.1.2. CTR_DRBG_Update

    private void update(byte[] input) {

        if (input.length != seedLen) {

            // Should not happen

            throw new IllegalArgumentException("input length not seedLen: "

                    + input.length);

        }

        try {

            int m = (seedLen + blockLen - 1) / blockLen;

            byte[] temp = new byte[m * blockLen];

            // Step 1. temp = Null.

            // Step 2. Loop

            for (int i = 0; i < m; i++) {

                // Step 2.1. Increment

                addOne(v, ctrLen);

                // Step 2.2. Block_Encrypt

                cipher.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(k, keyAlg));

                // Step 2.3. Encrypt into right position, no need to cat

                cipher.doFinal(v, 0, blockLen, temp, i * blockLen);

            }

            // Step 3. Truncate

            temp = Arrays.copyOf(temp, seedLen);

            // Step 4: Add

            for (int i = 0; i < seedLen; i++) {

                temp[i] ^= input[i];

            }

            // Step 5: leftmost

            k = Arrays.copyOf(temp, keyLen);

            // Step 6: rightmost

            v = Arrays.copyOfRange(temp, seedLen - blockLen, seedLen);

            // Step 7. Return

        } catch (GeneralSecurityException e) {

            throw new InternalError(e);

        }

    }

    @Override

    protected void instantiateAlgorithm(byte[] ei) {

        if (debug != null) {

            debug.println(this, "instantiate");

        }

        byte[] more;

        if (usedf) {

            // 800-90Ar1 10.2.1.3.2 Step 1-2. cat bytes

            if (personalizationString == null) {

                more = nonce;

            } else {

                if (nonce.length + personalizationString.length < 0) {

                    // Length must be represented as a 32 bit integer in df()

                    throw new IllegalArgumentException(

                            "nonce plus personalization string is too long");

                }

                more = Arrays.copyOf(

                        nonce, nonce.length + personalizationString.length);

                System.arraycopy(personalizationString, 0, more, nonce.length,

                        personalizationString.length);

            }

        } else {

            // 800-90Ar1 10.2.1.3.1

            // Step 1-2, no need to expand personalizationString, we only XOR

            // with shorter length

            more = personalizationString;

        }

        reseedAlgorithm(ei, more);

    }

    /**

     * Block_cipher_df in 10.3.2

     *

     * @param input the input string

     * @return the output block (always of seedLen)

     */

    private byte[] df(byte[] input) {

        // 800-90Ar1 10.3.2

        // 2. L = len (input_string)/8

        int l = input.length;

        // 3. N = number_of_bits_to_return/8

        int n = seedLen;

        // 4. S = L || N || input_string || 0x80

        byte[] ln = new byte[8];

        ln[0] = (byte)(l >> 24);

        ln[1] = (byte)(l >> 16);

        ln[2] = (byte)(l >> 8);

        ln[3] = (byte)(l);

        ln[4] = (byte)(n >> 24);

        ln[5] = (byte)(n >> 16);

        ln[6] = (byte)(n >> 8);

        ln[7] = (byte)(n);

        // 5. Zero padding of S

        // Not necessary, see bcc

        // 8. K = leftmost (0x00010203...1D1E1F, keylen).

        byte[] k = new byte[keyLen];

        for (int i = 0; i < k.length; i++) {

            k[i] = (byte)i;

        }

        // 6. temp = the Null String

        byte[] temp = new byte[seedLen];

        // 7. i = 0

        for (int i = 0; i * blockLen < temp.length; i++) {

            // 9.1 IV = i || 0^(outlen - len (i)). outLen is blockLen

            byte[] iv = new byte[blockLen];

            iv[0] = (byte)(i >> 24);

            iv[1] = (byte)(i >> 16);

            iv[2] = (byte)(i >> 8);

            iv[3] = (byte)(i);

            int tailLen = temp.length - blockLen*i;

            if (tailLen > blockLen) {

                tailLen = blockLen;

            }

            // 9.2 temp = temp || BCC (K, (IV || S)).

            System.arraycopy(bcc(k, iv, ln, input, new byte[]{(byte)0x80}),

                    0, temp, blockLen*i, tailLen);

        }

        // 10. K = leftmost(temp, keylen)

        k = Arrays.copyOf(temp, keyLen);

        // 11. x = select(temp, keylen+1, keylen+outlen)

        byte[] x = Arrays.copyOfRange(temp, keyLen, temp.length);

        // 12. temp = the Null string

        // No need to clean up, temp will be overwritten

        for (int i = 0; i * blockLen < seedLen; i++) {

            try {

                cipher.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(k, keyAlg));

                int tailLen = temp.length - blockLen*i;

                // 14. requested_bits = leftmost(temp, nuumber_of_bits_to_return)

                if (tailLen > blockLen) {

                    tailLen = blockLen;

                }

                x = cipher.doFinal(x);

                System.arraycopy(x, 0, temp, blockLen * i, tailLen);

            } catch (GeneralSecurityException e) {

                throw new InternalError(e);

            }

        }

        // 15. Return

        return temp;

    }

    /**

     * Block_Encrypt in 10.3.3

     *

     * @param k the key

     * @param data after concatenated, the data to be operated upon. This is

     *             a series of byte[], each with an arbitrary length. Note

     *             that the full length is not necessarily a multiple of

     *             outlen. XOR with zero is no-op.

     * @return the result

     */

    private byte[] bcc(byte[] k, byte[]... data) {

        byte[] chain = new byte[blockLen];

        int n1 = 0; // index in data

        int n2 = 0; // index in data[n1]

        // pack blockLen of bytes into chain from data[][], again and again

        while (n1 < data.length) {

            int j;

            out: for (j = 0; j < blockLen; j++) {

                while (n2 >= data[n1].length) {

                    n1++;

                    if (n1 >= data.length) {

                        break out;

                    }

                    n2 = 0;

                }

                chain[j] ^= data[n1][n2];

                n2++;

            }

            if (j == 0) { // all data happens to be consumed in the last loop

                break;

            }

            try {

                cipher.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(k, keyAlg));

                chain = cipher.doFinal(chain);

            } catch (GeneralSecurityException e) {

                throw new InternalError(e);

            }

        }

        return chain;

    }

    @Override

    protected synchronized void reseedAlgorithm(

            byte[] ei,

            byte[] additionalInput) {

        if (usedf) {

            // 800-90Ar1 10.2.1.3.2 Instantiate.

            // 800-90Ar1 10.2.1.4.2 Reseed.

            // Step 1: cat bytes

            if (additionalInput != null) {

                if (ei.length + additionalInput.length < 0) {

                    // Length must be represented as a 32 bit integer in df()

                    throw new IllegalArgumentException(

                            "entropy plus additional input is too long");

                }

                byte[] temp = Arrays.copyOf(

                        ei, ei.length + additionalInput.length);

                System.arraycopy(additionalInput, 0, temp, ei.length,

                        additionalInput.length);

                ei = temp;

            }

            // Step 2. df (seed_material, seedlen).

            ei = df(ei);

        } else {

            // 800-90Ar1 10.2.1.3.1 Instantiate

            // 800-90Ar1 10.2.1.4.1 Reseed

            // Step 1-2. Needless

            // Step 3. seed_material = entropy_input XOR more

            if (additionalInput != null) {

                // additionalInput.length <= seedLen

                for (int i = 0; i < additionalInput.length; i++) {

                    ei[i] ^= additionalInput[i];

                }

            }

        }

        if (v == null) {

            // 800-90Ar1 10.2.1.3.2 Instantiate. Step 3-4

            // 800-90Ar1 10.2.1.3.1 Instantiate. Step 4-5

            k = new byte[keyLen];

            v = new byte[blockLen];

        }

        //status();

        // 800-90Ar1 10.2.1.3.1 Instantiate. Step 6

        // 800-90Ar1 10.2.1.3.2 Instantiate. Step 5

        // 800-90Ar1 10.2.1.4.1 Reseed. Step 4

        // 800-90Ar1 10.2.1.4.2 Reseed. Step 3

        update(ei);

        // 800-90Ar1 10.2.1.3.1 Instantiate. Step 7

        // 800-90Ar1 10.2.1.3.2 Instantiate. Step 6

        // 800-90Ar1 10.2.1.4.1 Reseed. Step 5

        // 800-90Ar1 10.2.1.4.2 Reseed. Step 4

        reseedCounter = 1;

        //status();

        // Whatever step. Return

    }

    /**

     * Add one to data, only touch the last len bytes.

     */

    private static void addOne(byte[] data, int len) {

        for (int i = 0; i < len; i++) {

            data[data.length - 1 - i]++;

            if (data[data.length - 1 - i] != 0) {

                break;

            }

        }

    }

    @Override

    public synchronized void generateAlgorithm(

            byte[] result, byte[] additionalInput) {

        if (debug != null) {

            debug.println(this, "generateAlgorithm");

        }

        // 800-90Ar1 10.2.1.5.1 Generate

        // 800-90Ar1 10.2.1.5.2 Generate

        // Step 1: Check reseed_counter. Will not fail. Already checked in

        // AbstractDrbg#engineNextBytes.

        if (additionalInput != null) {

            if (usedf) {

                // 10.2.1.5.2 Step 2.1

                additionalInput = df(additionalInput);

            } else {

                // 10.2.1.5.1 Step 2.1-2.2

                additionalInput = Arrays.copyOf(additionalInput, seedLen);

            }

            // 10.2.1.5.1 Step 2.3

            // 10.2.1.5.2 Step 2.2

            update(additionalInput);

        } else {

            // 10.2.1.5.1 Step 2 Else

            // 10.2.1.5.2 Step 2 Else

            additionalInput = new byte[seedLen];

        }

        // Step 3. temp = Null

        int pos = 0;

        int len = result.length;

        // Step 4. Loop

        while (len > 0) {

            // Step 4.1. Increment

            addOne(v, ctrLen);

            try {

                // Step 4.2. Encrypt

                cipher.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(k, keyAlg));

                byte[] out = cipher.doFinal(v);

                // Step 4.3 and 5. Cat bytes and leftmost

                System.arraycopy(out, 0, result, pos,

                        (len > blockLen) ? blockLen : len);

            } catch (GeneralSecurityException e) {

                throw new InternalError(e);

            }

            len -= blockLen;

            if (len <= 0) {

                // shortcut, so that pos needn't be updated

                break;

            }

            pos += blockLen;

        }

        // Step 6. Update

        update(additionalInput);

        // Step 7. reseed_counter++