/*

 * Copyright (c) 2017 Thomas Pornin <pornin@bolet.org>

 *

 * Permission is hereby granted, free of charge, to any person obtaining 

 * a copy of this software and associated documentation files (the

 * "Software"), to deal in the Software without restriction, including

 * without limitation the rights to use, copy, modify, merge, publish,

 * distribute, sublicense, and/or sell copies of the Software, and to

 * permit persons to whom the Software is furnished to do so, subject to

 * the following conditions:

 *

 * The above copyright notice and this permission notice shall be 

 * included in all copies or substantial portions of the Software.

 *

 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 

 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF

 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 

 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS

 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN

 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN

 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

 * SOFTWARE.

 */

#include "inner.h"

/*

 * Implementation Notes

 * ====================

 *

 * The combined CTR + CBC-MAC functions can only handle full blocks,

 * so some buffering is necessary.

 *

 *  - 'ptr' contains a value from 0 to 15, which is the number of bytes

 *    accumulated in buf[] that still needs to be processed with the

 *    current CBC-MAC computation.

 *

 *  - When processing the message itself, CTR encryption/decryption is

 *    also done at the same time. The first 'ptr' bytes of buf[] then

 *    contains the plaintext bytes, while the last '16 - ptr' bytes of

 *    buf[] are the remnants of the stream block, to be used against

 *    the next input bytes, when available. When 'ptr' is 0, the

 *    contents of buf[] are to be ignored.

 *

 *  - The current counter and running CBC-MAC values are kept in 'ctr'

 *    and 'cbcmac', respectively.

 */

/* see bearssl_block.h */

void

br_ccm_init(br_ccm_context *ctx, const br_block_ctrcbc_class **bctx)

{

  ctx->bctx = bctx;

}

/* see bearssl_block.h */

int

br_ccm_reset(br_ccm_context *ctx, const void *nonce, size_t nonce_len,

  uint64_t aad_len, uint64_t data_len, size_t tag_len)

{

  unsigned char tmp[16];

  unsigned u, q;

  if (nonce_len < 7 || nonce_len > 13) {

    return 0;

  }

  if (tag_len < 4 || tag_len > 16 || (tag_len & 1) != 0) {

    return 0;

  }

  q = 15 - (unsigned)nonce_len;

  ctx->tag_len = tag_len;

  /*

   * Block B0, to start CBC-MAC.

   */

  tmp[0] = (aad_len > 0 ? 0x40 : 0x00)

    | (((unsigned)tag_len - 2) << 2)

    | (q - 1);

  memcpy(tmp + 1, nonce, nonce_len);

  for (u = 0; u < q; u ++) {

    tmp[15 - u] = (unsigned char)data_len;

    data_len >>= 8;

  }

  if (data_len != 0) {

    /*

     * If the data length was not entirely consumed in the

     * loop above, then it exceeds the maximum limit of

     * q bytes (when encoded).

     */

    return 0;

  }

  /*

   * Start CBC-MAC.

   */

  memset(ctx->cbcmac, 0, sizeof ctx->cbcmac);

  (*ctx->bctx)->mac(ctx->bctx, ctx->cbcmac, tmp, sizeof tmp);

  /*

   * Assemble AAD length header.

   */

  if ((aad_len >> 32) != 0) {

    ctx->buf[0] = 0xFF;

    ctx->buf[1] = 0xFF;

    br_enc64be(ctx->buf + 2, aad_len);

    ctx->ptr = 10;

  } else if (aad_len >= 0xFF00) {

    ctx->buf[0] = 0xFF;

    ctx->buf[1] = 0xFE;

    br_enc32be(ctx->buf + 2, (uint32_t)aad_len);

    ctx->ptr = 6;

  } else if (aad_len > 0) {

    br_enc16be(ctx->buf, (unsigned)aad_len);

    ctx->ptr = 2;

  } else {

    ctx->ptr = 0;

  }

  /*

   * Make initial counter value and compute tag mask.

   */

  ctx->ctr[0] = q - 1;

  memcpy(ctx->ctr + 1, nonce, nonce_len);

  memset(ctx->ctr + 1 + nonce_len, 0, q);

  memset(ctx->tagmask, 0, sizeof ctx->tagmask);

  (*ctx->bctx)->ctr(ctx->bctx, ctx->ctr,

    ctx->tagmask, sizeof ctx->tagmask);

  return 1;

}

/* see bearssl_block.h */

void

br_ccm_aad_inject(br_ccm_context *ctx, const void *data, size_t len)

{

  const unsigned char *dbuf;

  size_t ptr;

  dbuf = data;

  /*

   * Complete partial block, if needed.

   */

  ptr = ctx->ptr;

  if (ptr != 0) {

    size_t clen;

    clen = (sizeof ctx->buf) - ptr;

    if (clen > len) {

      memcpy(ctx->buf + ptr, dbuf, len);

      ctx->ptr = ptr + len;

      return;

    }

    memcpy(ctx->buf + ptr, dbuf, clen);

    dbuf += clen;

    len -= clen;

    (*ctx->bctx)->mac(ctx->bctx, ctx->cbcmac,

      ctx->buf, sizeof ctx->buf);

  }

  /*

   * Process complete blocks.

   */

  ptr = len & 15;

  len -= ptr;

  (*ctx->bctx)->mac(ctx->bctx, ctx->cbcmac, dbuf, len);

  dbuf += len;

  /*

   * Copy last partial block in the context buffer.

   */

  memcpy(ctx->buf, dbuf, ptr);

  ctx->ptr = ptr;

}

/* see bearssl_block.h */

void

br_ccm_flip(br_ccm_context *ctx)

{

  size_t ptr;

  /*

   * Complete AAD partial block with zeros, if necessary.

   */

  ptr = ctx->ptr;

  if (ptr != 0) {

    memset(ctx->buf + ptr, 0, (sizeof ctx->buf) - ptr);

    (*ctx->bctx)->mac(ctx->bctx, ctx->cbcmac,

      ctx->buf, sizeof ctx->buf);

    ctx->ptr = 0;

  }

  /*

   * Counter was already set by br_ccm_reset().

   */

}

/* see bearssl_block.h */

void

br_ccm_run(br_ccm_context *ctx, int encrypt, void *data, size_t len)

{

  unsigned char *dbuf;

  size_t ptr;

  dbuf = data;

  /*

   * Complete a partial block, if any: ctx->buf[] contains

   * ctx->ptr plaintext bytes (already reported), and the other

   * bytes are CTR stream output.

   */

  ptr = ctx->ptr;

  if (ptr != 0) {

    size_t clen;

    size_t u;

    clen = (sizeof ctx->buf) - ptr;

    if (clen > len) {

      clen = len;

    }

    if (encrypt) {

      for (u = 0; u < clen; u ++) {

        unsigned w, x;

        w = ctx->buf[ptr + u];

        x = dbuf[u];

        ctx->buf[ptr + u] = x;

        dbuf[u] = w ^ x;

      }

    } else {

      for (u = 0; u < clen; u ++) {

        unsigned w;

        w = ctx->buf[ptr + u] ^ dbuf[u];

        dbuf[u] = w;

        ctx->buf[ptr + u] = w;

      }

    }

    dbuf += clen;

    len -= clen;

    ptr += clen;

    if (ptr < sizeof ctx->buf) {

      ctx->ptr = ptr;

      return;

    }

    (*ctx->bctx)->mac(ctx->bctx,

      ctx->cbcmac, ctx->buf, sizeof ctx->buf);

  }

  /*

   * Process all complete blocks. Note that the ctrcbc API is for

   * encrypt-then-MAC (CBC-MAC is computed over the encrypted

   * blocks) while CCM uses MAC-and-encrypt (CBC-MAC is computed

   * over the plaintext blocks). Therefore, we need to use the

   * _decryption_ function for encryption, and the encryption

   * function for decryption (this works because CTR encryption

   * and decryption are identical, so the choice really is about

   * computing the CBC-MAC before or after XORing with the CTR

   * stream).

   */

  ptr = len & 15;

  len -= ptr;

  if (encrypt) {

    (*ctx->bctx)->decrypt(ctx->bctx, ctx->ctr, ctx->cbcmac,

      dbuf, len);

  } else {

    (*ctx->bctx)->encrypt(ctx->bctx, ctx->ctr, ctx->cbcmac,

      dbuf, len);

  }

  dbuf += len;

  /*

   * If there is some remaining data, then we need to compute an

   * extra block of CTR stream.

   */

  if (ptr != 0) {

    size_t u;

    memset(ctx->buf, 0, sizeof ctx->buf);

    (*ctx->bctx)->ctr(ctx->bctx, ctx->ctr,

      ctx->buf, sizeof ctx->buf);

    if (encrypt) {

      for (u = 0; u < ptr; u ++) {

        unsigned w, x;

        w = ctx->buf[u];

        x = dbuf[u];

        ctx->buf[u] = x;

        dbuf[u] = w ^ x;

      }

    } else {

      for (u = 0; u < ptr; u ++) {

        unsigned w;

        w = ctx->buf[u] ^ dbuf[u];

        dbuf[u] = w;

        ctx->buf[u] = w;

      }

    }

  }

  ctx->ptr = ptr;

}

/* see bearssl_block.h */

size_t

br_ccm_get_tag(br_ccm_context *ctx, void *tag)

{

  size_t ptr;

  size_t u;

  /*

   * If there is some buffered data, then we need to pad it with

   * zeros and finish up CBC-MAC.

   */

  ptr = ctx->ptr;

  if (ptr != 0) {

    memset(ctx->buf + ptr, 0, (sizeof ctx->buf) - ptr);

    (*ctx->bctx)->mac(ctx->bctx, ctx->cbcmac,

      ctx->buf, sizeof ctx->buf);

  }

  /*

   * XOR the tag mask into the CBC-MAC output.

   */

  for (u = 0; u < ctx->tag_len; u ++) {

    ctx->cbcmac[u] ^= ctx->tagmask[u];

  }

  memcpy(tag, ctx->cbcmac, ctx->tag_len);

  return ctx->tag_len;

}

/* see bearssl_block.h */

uint32_t

br_ccm_check_tag(br_ccm_context *ctx, const void *tag)

{

  unsigned char tmp[16];

  size_t u, tag_len;

  uint32_t z;

  tag_len = br_ccm_get_tag(ctx, tmp);

  z = 0;

  for (u = 0; u < tag_len; u ++) {

    z |= tmp[u] ^ ((const unsigned char *)tag)[u];

  }

  return EQ0(z);

}