/*

 * Copyright (c) 2016 DeNA Co., Ltd., Kazuho Oku

 *

 * Permission is hereby granted, free of charge, to any person obtaining a copy

 * of this software and associated documentation files (the "Software"), to

 * deal in the Software without restriction, including without limitation the

 * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or

 * sell copies of the Software, and to permit persons to whom the Software is

 * furnished to do so, subject to the following conditions:

 *

 * The above copyright notice and this permission notice shall be included in

 * all copies or substantial portions of the Software.

 *

 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE

 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING

 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS

 * IN THE SOFTWARE.

 */

#include <stdlib.h>

#include "curve25519.h"

#include "picotls.h"

#include "picotls/minicrypto.h"

#define X25519_KEY_SIZE 32

struct st_x25519_key_exchange_t {

    ptls_key_exchange_context_t super;

    uint8_t priv[X25519_KEY_SIZE];

    uint8_t pub[X25519_KEY_SIZE];

};

static void x25519_create_keypair(uint8_t *priv, uint8_t *pub)

{

    ptls_minicrypto_random_bytes(priv, X25519_KEY_SIZE);

    cf_curve25519_mul_base(pub, priv);

}

static int x25519_derive_secret(ptls_iovec_t *secret, const uint8_t *clientpriv, const uint8_t *clientpub,

                                const uint8_t *serverpriv, const uint8_t *serverpub)

{

    if ((secret->base = malloc(X25519_KEY_SIZE)) == NULL)

        return PTLS_ERROR_NO_MEMORY;

    cf_curve25519_mul(secret->base, clientpriv != NULL ? clientpriv : serverpriv, clientpriv != NULL ? serverpub : clientpub);

    static const uint8_t zeros[X25519_KEY_SIZE] = {0};

    if (ptls_mem_equal(secret->base, zeros, sizeof(zeros))) {

        free(secret->base);

        secret->base = NULL;

        return PTLS_ERROR_INCOMPATIBLE_KEY;

    }

    secret->len = X25519_KEY_SIZE;

    return 0;

}

static int x25519_on_exchange(ptls_key_exchange_context_t **_ctx, int release, ptls_iovec_t *secret, ptls_iovec_t peerkey)

{

    struct st_x25519_key_exchange_t *ctx = (struct st_x25519_key_exchange_t *)*_ctx;

    int ret;

    if (secret == NULL) {

        ret = 0;

        goto Exit;

    }

    if (peerkey.len != X25519_KEY_SIZE) {

        ret = PTLS_ALERT_DECRYPT_ERROR;

        goto Exit;

    }

    ret = x25519_derive_secret(secret, ctx->priv, ctx->pub, NULL, peerkey.base);

Exit:

    if (release) {

        ptls_clear_memory(ctx->priv, sizeof(ctx->priv));

        free(ctx);

        *_ctx = NULL;

    }

    return ret;

}

static int x25519_create_key_exchange(ptls_key_exchange_algorithm_t *algo, ptls_key_exchange_context_t **_ctx)

{

    struct st_x25519_key_exchange_t *ctx;

    if ((ctx = (struct st_x25519_key_exchange_t *)malloc(sizeof(*ctx))) == NULL)

        return PTLS_ERROR_NO_MEMORY;

    ctx->super = (ptls_key_exchange_context_t){algo, ptls_iovec_init(ctx->pub, sizeof(ctx->pub)), x25519_on_exchange};

    x25519_create_keypair(ctx->priv, ctx->pub);

    *_ctx = &ctx->super;

    return 0;

}

static int x25519_key_exchange(ptls_key_exchange_algorithm_t *algo, ptls_iovec_t *pubkey, ptls_iovec_t *secret,

                               ptls_iovec_t peerkey)

{

    uint8_t priv[X25519_KEY_SIZE], *pub = NULL;

    int ret;

    if (peerkey.len != X25519_KEY_SIZE) {

        ret = PTLS_ALERT_DECRYPT_ERROR;

        goto Exit;

    }

    if ((pub = malloc(X25519_KEY_SIZE)) == NULL) {

        ret = PTLS_ERROR_NO_MEMORY;

        goto Exit;

    }

    x25519_create_keypair(priv, pub);

    if ((ret = x25519_derive_secret(secret, NULL, peerkey.base, priv, pub)) != 0)

        goto Exit;

    *pubkey = ptls_iovec_init(pub, X25519_KEY_SIZE);

    ret = 0;

Exit:

    ptls_clear_memory(priv, sizeof(priv));

    if (pub != NULL && ret != 0) {

        ptls_clear_memory(pub, X25519_KEY_SIZE);

        free(pub);

    }

    return ret;

}

ptls_key_exchange_algorithm_t ptls_minicrypto_x25519 = {

    .id = PTLS_GROUP_X25519, .name = PTLS_GROUP_NAME_X25519, .create = x25519_create_key_exchange, .exchange = x25519_key_exchange};