/********************************************************************************/
/*										*/
/*			     TSS Library Independent Crypto Support		*/
/*			     Written by Ken Goldman				*/
/*		       IBM Thomas J. Watson Research Center			*/
/*	      $Id: tsscrypto.c 838 2016-11-22 22:44:57Z kgoldman $		*/
/*										*/
/* (c) Copyright IBM Corporation 2015.						*/
/*										*/
/* All rights reserved.								*/
/* 										*/
/* Redistribution and use in source and binary forms, with or without		*/
/* modification, are permitted provided that the following conditions are	*/
/* met:										*/
/* 										*/
/* Redistributions of source code must retain the above copyright notice,	*/
/* this list of conditions and the following disclaimer.			*/
/* 										*/
/* Redistributions in binary form must reproduce the above copyright		*/
/* notice, this list of conditions and the following disclaimer in the		*/
/* documentation and/or other materials provided with the distribution.		*/
/* 										*/
/* Neither the names of the IBM Corporation nor the names of its		*/
/* contributors may be used to endorse or promote products derived from		*/
/* this software without specific prior written permission.			*/
/* 										*/
/* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS		*/
/* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT		*/
/* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR	*/
/* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT		*/
/* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,	*/
/* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT		*/
/* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,	*/
/* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY	*/
/* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT		*/
/* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE	*/
/* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.		*/
/********************************************************************************/

#include <string.h>
#include <stdio.h>

#ifdef TPM_POSIX
#include <netinet/in.h>
#endif
#ifdef TPM_WINDOWS
#include <winsock2.h>
#endif

#include <openssl/err.h>
#include <openssl/evp.h>
#include <openssl/hmac.h>
#include <openssl/aes.h>
#include <openssl/rsa.h>
#include <openssl/rand.h>
#include <openssl/engine.h>

#include <tss2/tssresponsecode.h>
#include <tss2/tssutils.h>
#include <tss2/tssprint.h>
#include <tss2/tsserror.h>

#include <tss2/tsscryptoh.h>
#include <tss2/tsscrypto.h>

extern int tssVverbose;
extern int tssVerbose;

/* local prototypes */

static TPM_RC TSS_MGF1(unsigned char       	*mask,
		       uint32_t            	maskLen,
		       const unsigned char 	*mgfSeed,
		       uint16_t			mgfSeedlen,
		       TPMI_ALG_HASH 		halg);

/* TSS_HMAC_Generate() can be called directly to HMAC a list of streams.
   
   The ... arguments are a message list of the form
   int length, unsigned char *buffer
   terminated by a 0 length
*/

/* On call, digest->hashAlg is the desired hash algorithm */

TPM_RC TSS_HMAC_Generate(TPMT_HA *digest,		/* largest size of a digest */
			 const TPM2B_KEY *hmacKey,
			 ...)
{
    TPM_RC		rc = 0;
    va_list		ap;
    
    va_start(ap, hmacKey);
    rc = TSS_HMAC_Generate_valist(digest, hmacKey, ap);
    va_end(ap);
    return rc;
}

/* TSS_HMAC_Verify() can be called directly to check the HMAC of a list of streams.
   
   The ... arguments are a list of the form
   int length, unsigned char *buffer
   terminated by a 0 length

*/

TPM_RC TSS_HMAC_Verify(TPMT_HA *expect,
		       const TPM2B_KEY *hmacKey,
		       uint32_t sizeInBytes,
		       ...)
{
    TPM_RC		rc = 0;
    int			irc;
    va_list		ap;
    TPMT_HA 		actual;

    actual.hashAlg = expect->hashAlg;	/* algorithm for the HMAC calculation */
    va_start(ap, sizeInBytes);
    if (rc == 0) {
	rc = TSS_HMAC_Generate_valist(&actual, hmacKey, ap);
    }
    if (rc == 0) {
	irc = memcmp((uint8_t *)&expect->digest, &actual.digest, sizeInBytes);
	if (irc != 0) {
	    TSS_PrintAll("TSS_HMAC_Verify: calculated HMAC",
			 (uint8_t *)&actual.digest, sizeInBytes);
	    rc = TSS_RC_HMAC_VERIFY;
	}
    }
    va_end(ap);
    return rc;
}

/* TSS_KDFA() 11.4.9	Key Derivation Function

   As defined in SP800-108, the inner loop for building the key stream is:

   K(i) = HMAC (KI , [i]2 || Label || 00 || Context || [L]2) 
*/

TPM_RC TSS_KDFA(uint8_t		*keyStream,    	/* OUT: key buffer */
		TPM_ALG_ID	hashAlg,       	/* IN: hash algorithm used in HMAC */
		const TPM2B	*key,           /* IN: HMAC key */
		const char	*label,		/* IN: KDFa label, NUL terminated */
		const TPM2B	*contextU,      /* IN: context U */
		const TPM2B	*contextV,      /* IN: context V */
		uint32_t	sizeInBits)    	/* IN: size of generated key in bits */

{
    TPM_RC	rc = 0;
    uint32_t 	bytes = ((sizeInBits + 7) / 8);	/* bytes left to produce */
    uint8_t	*stream;
    uint32_t 	sizeInBitsNbo = htonl(sizeInBits);	/* KDFa L2 */
    uint16_t    bytesThisPass;			/* in one HMAC operation */
    uint32_t	counter;    			/* counter value */
    uint32_t 	counterNbo;			/* counter in big endian */
    TPMT_HA 	hmac;				/* hmac result for this pass */
    

    if (rc == 0) {
	hmac.hashAlg = hashAlg;			/* for TSS_HMAC_Generate() */
	bytesThisPass = TSS_GetDigestSize(hashAlg);	/* start with hashAlg sized chunks */
	if (bytesThisPass == 0) {
	    if (tssVerbose) printf("TSS_KDFA: KDFa failed\n");
	    rc = TSS_RC_KDFA_FAILED;
	}
    }
    /* Generate required bytes */
    for (stream = keyStream, counter = 1 ;	/* beginning of stream, KDFa counter starts at 1 */
	 (rc == 0) && bytes > 0 ;				/* bytes left to produce */
	 stream += bytesThisPass, bytes -= bytesThisPass, counter++) {

	/* last pass, can be less than hashAlg sized chunks */
	if (bytes < bytesThisPass) {
	    bytesThisPass = bytes;
	}
	counterNbo = htonl(counter);	/* counter for this pass in BE format */
	    
	rc = TSS_HMAC_Generate(&hmac,				/* largest size of an HMAC */
			       (const TPM2B_KEY *)key,		/* FIXME */
			       sizeof(UINT32), &counterNbo,	/* KDFa i2 counter */
			       strlen(label) + 1, label,	/* KDFa label, use NUL as the KDFa
								   00 byte */
			       contextU->size, contextU->buffer,	/* KDFa Context */
			       contextV->size, contextV->buffer,	/* KDFa Context */
			       sizeof(UINT32), &sizeInBitsNbo,		/* KDFa L2 */
			       0, NULL);
	memcpy(stream, &hmac.digest.tssmax, bytesThisPass);
    }
    return rc;
}

/* TSS_KDFE() 11.4.9.3	Key Derivation Function for ECDH

   Digest = Hash(counter || Z || Use || PartyUInfo || PartyVInfo || bits )

   where

   counter is initialized to 1 and incremented for each iteration
   
   Z is the X-coordinate of the product of a public (TPM) ECC key and 
   a different private ECC key
   
   Use is a NULL-terminated string that indicates the use of the key 
   ("DUPLICATE", "IDENTITY", "SECRET", etc)
   
   PartyUInfo is the X-coordinate of the public point of an ephemeral key
   
   PartyVInfo is the X-coordinate of the public point of the TPM key
   
   bits is a 32-bit value indicating the number of bits to be returned
*/

TPM_RC TSS_KDFE(uint8_t		*keyStream,    	/* OUT: key buffer */
		TPM_ALG_ID	hashAlg,       	/* IN: hash algorithm used */
		const TPM2B	*key,           /* IN: Z  */
		const char	*label,		/* IN: KDFe label, NUL terminated */
		const TPM2B	*contextU,      /* IN: context U */
		const TPM2B	*contextV,      /* IN: context V */
		uint32_t	sizeInBits)    	/* IN: size of generated key in bits */

{
    TPM_RC	rc = 0;
    uint32_t 	bytes = ((sizeInBits + 7) / 8);	/* bytes left to produce */
    uint8_t	*stream;
    uint16_t    bytesThisPass;			/* in one Hash operation */
    uint32_t	counter;    			/* counter value */
    uint32_t 	counterNbo;			/* counter in big endian */
    TPMT_HA 	digest;				/* result for this pass */
    
    if (rc == 0) {
	digest.hashAlg = hashAlg;			/* for TSS_Hash_Generate() */
	bytesThisPass = TSS_GetDigestSize(hashAlg);	/* start with hashAlg sized chunks */
	if (bytesThisPass == 0) {
	    if (tssVerbose) printf("TSS_KDFE: KDFe failed\n");
	    rc = TSS_RC_KDFE_FAILED;
	}
    }
    /* Generate required bytes */
    for (stream = keyStream, counter = 1 ;	/* beginning of stream, KDFe counter starts at 1 */
	 (rc == 0) && bytes > 0 ;				/* bytes left to produce */
	 stream += bytesThisPass, bytes -= bytesThisPass, counter++) {
	/* last pass, can be less than hashAlg sized chunks */
	if (bytes < bytesThisPass) {
	    bytesThisPass = bytes;
	}
	counterNbo = htonl(counter);	/* counter for this pass in BE format */
	    
	rc = TSS_Hash_Generate(&digest,				/* largest size of a digest */
			       sizeof(UINT32), &counterNbo,	/* KDFe i2 counter */
			       key->size, key->buffer,		/* FIXME */
			       strlen(label) + 1, label,	/* KDFe label, use NUL as the KDFe
								   00 byte */
			       contextU->size, contextU->buffer,	/* KDFe Context */
			       contextV->size, contextV->buffer,	/* KDFe Context */
			       0, NULL);
	memcpy(stream, &digest.digest.tssmax, bytesThisPass);
    }
    return rc;
}

/* On call, digest->hashAlg is the desired hash algorithm

   ... is a list of int length, unsigned char *buffer pairs.

   length 0 is ignored, buffer NULL terminates list.
*/

TPM_RC TSS_Hash_Generate(TPMT_HA *digest,		/* largest size of a digest */
			 ...)
{
    TPM_RC	rc = 0;
    va_list	ap;
    va_start(ap, digest);
    rc = TSS_Hash_Generate_valist(digest, ap);
    va_end(ap);
    return rc;
}

/* TSS_GetDigestSize() returns the digest size in bytes based on the hash algorithm.

   Returns 0 for an unknown algorithm.
*/

uint16_t TSS_GetDigestSize(TPM_ALG_ID hashAlg)
{
    uint16_t size;
    
    switch (hashAlg) {
      case TPM_ALG_SHA1:
	size = SHA1_DIGEST_SIZE;
	break;
      case TPM_ALG_SHA256:
	size = SHA256_DIGEST_SIZE;
	break;
      case TPM_ALG_SHA384:
	size = SHA384_DIGEST_SIZE;
	break;
#if 0
      case TPM_ALG_SHA512:
	size = SHA512_DIGEST_SIZE;
	break;
      case TPM_ALG_SM3_256:
	size = SM3_256_DIGEST_SIZE;
	break;
#endif
      default:
	size = 0;
    }
    return size;
}

uint16_t TSS_GetDigestBlockSize(TPM_ALG_ID hashAlg)
{
    uint16_t size;
    
    switch (hashAlg) {
      case TPM_ALG_SHA1:
	size = SHA1_BLOCK_SIZE;
	break;
      case TPM_ALG_SHA256:
	size = SHA256_BLOCK_SIZE;
	break;
      case TPM_ALG_SHA384:
	size = SHA384_BLOCK_SIZE;
	break;
#if 0
      case TPM_ALG_SHA512:
	size = SHA512_BLOCK_SIZE;
	break;
      case TPM_ALG_SM3_256:
	size = SM3_256_BLOCK_SIZE;
	break;
#endif
      default:
	size = 0;
    }
    return size;
}


/* TPM_MGF1() generates an MGF1 'array' of length 'arrayLen' from 'seed' of length 'seedlen'

   The openSSL DLL doesn't export MGF1 in Windows or Linux 1.0.0, so this version is created from
   scratch.
   
   Algorithm and comments (not the code) from:

   PKCS #1: RSA Cryptography Specifications Version 2.1 B.2.1 MGF1

   Prototype designed to be compatible with openSSL

   MGF1 is a Mask Generation Function based on a hash function.
   
   MGF1 (mgfSeed, maskLen)

   Options:     

   Hash hash function (hLen denotes the length in octets of the hash 
   function output)

   Input:
   
   mgfSeed         seed from which mask is generated, an octet string
   maskLen         intended length in octets of the mask, at most 2^32(hLen)

   Output:      
   mask            mask, an octet string of length l; or "mask too long"

   Error:          "mask too long'
*/

static TPM_RC TSS_MGF1(unsigned char       	*mask,
		       uint32_t            	maskLen,
		       const unsigned char 	*mgfSeed,
		       uint16_t			mgfSeedlen,
		       TPMI_ALG_HASH 		halg)
{
    TPM_RC 		rc = 0;
    unsigned char       counter[4];     /* 4 octets */
    uint32_t	        count;          /* counter as an integral type */
    uint32_t		outLen;
    TPMT_HA 		digest;
    uint16_t 		digestSize = TSS_GetDigestSize(halg);
    
    digest.hashAlg = halg;
    
#if 0
    if (rc == 0) {
        /* this is possible with arrayLen on a 64 bit architecture, comment to quiet beam */
        if ((maskLen / TPM_DIGEST_SIZE) > 0xffffffff) {        /* constant condition */
            if (tssVerbose)
		printf("TSS_MGF1: Error (fatal), Output length too large for 32 bit counter\n");
            rc = TPM_FAIL;              /* should never occur */
        }
    }
#endif
    /* 1.If l > 2^32(hLen), output "mask too long" and stop. */
    /* NOTE Checked by caller */
    /* 2. Let T be the empty octet string. */
    /* 3. For counter from 0 to [masklen/hLen] - 1, do the following: */
    for (count = 0, outLen = 0 ; (rc == 0) && (outLen < maskLen) ; count++) {
	/* a. Convert counter to an octet string C of length 4 octets - see Section 4.1 */
	/* C = I2OSP(counter, 4) NOTE Basically big endian */
        uint32_t count_n = htonl(count);
	memcpy(counter, &count_n, 4);
	/* b.Concatenate the hash of the seed mgfSeed and C to the octet string T: */
	/* T = T || Hash (mgfSeed || C) */
	/* If the entire digest is needed for the mask */
	if ((outLen + digestSize) < maskLen) {
	    rc = TSS_Hash_Generate(&digest,
				   mgfSeedlen, mgfSeed,
				   4, counter,
				   0, NULL);
	    memcpy(mask + outLen, &digest.digest, digestSize);
	    outLen += digestSize;
	}
	/* if the mask is not modulo TPM_DIGEST_SIZE, only part of the final digest is needed */
	else {
	    /* hash to a temporary digest variable */
	    rc = TSS_Hash_Generate(&digest,
				   mgfSeedlen, mgfSeed,
				   4, counter,
				   0, NULL);
	    /* copy what's needed */
	    memcpy(mask + outLen, &digest.digest, maskLen - outLen);
	    outLen = maskLen;           /* outLen = outLen + maskLen - outLen */
	}
    }
    /* 4.Output the leading l octets of T as the octet string mask. */
    return rc;
}

/*
  OAEP Padding 
*/

/* TSS_RSA_padding_add_PKCS1_OAEP() is a variation of the the openSSL function

   int RSA_padding_add_PKCS1_OAEP(unsigned char *to, int tlen,
   unsigned char *f, int fl, unsigned char *p, int pl);

   It is used because the openssl function is hard coded to SHA1.

   This function was independently written from the PKCS1 specification "9.1.1.1 Encoding
   Operation" and PKCS#1 v2.2, intended to be unencumbered by any license.


   | <-			  emLen					   -> |
   
                         |  lHash |    PS     | 01 |  Message	      |

                            SHA                       flen

                         |  db                                        |
			 |  dbMask                                    |
        |  seed          |

	   SHA
	   
        |  seedMask      | 
   | 00 |  maskSeed      |   maskedDB                                 |
*/

TPM_RC TSS_RSA_padding_add_PKCS1_OAEP(unsigned char *em, uint32_t emLen,
				      const unsigned char *from, uint32_t fLen,
				      const unsigned char *p,
				      int plen,
				      TPMI_ALG_HASH halg)	
{	
    TPM_RC		rc = 0;
    TPMT_HA 		lHash;
    unsigned char 	*db;
    
    unsigned char *dbMask = NULL;			/* freed @1 */
    unsigned char *seed = NULL;				/* freed @2 */
    unsigned char *maskedDb;
    unsigned char *seedMask;
    unsigned char *maskedSeed;

    uint16_t hlen = TSS_GetDigestSize(halg);
    
    /* 1.a. If the length of L is greater than the input limitation for */
    /* the hash function (2^61-1 octets for SHA-1) then output "parameter */
    /* string too long" and stop. */
    if (rc == 0) {
	if (plen > 0xffff) {
	    if (tssVerbose) printf("TSS_RSA_padding_add_PKCS1_OAEP: Error, "
				   "label %u too long\n", plen);
	    rc = TSS_RC_RSA_PADDING;
	}	    
    }
    /* 1.b. If ||M|| > emLen-2hLen-1 then output "message too long" and stop. */
    if (rc == 0) {
	if (emLen < ((2 * hlen) + 2 + fLen)) {
	    if (tssVerbose) printf("TSS_RSA_padding_add_PKCS1_OAEP: Error, "
				   "message length %u too large for encoded length %u\n",
				   fLen, emLen);
	    rc = TSS_RC_RSA_PADDING;
	}
    }
    /* 2.a. Let lHash = Hash(L), an octet string of length hLen. */
    if (rc == 0) {
	lHash.hashAlg = halg;
	rc = TSS_Hash_Generate(&lHash,
			       plen, p,
			       0, NULL);
    }
    if (rc == 0) {
	/* 2.b. Generate an octet string PS consisting of emLen-||M||-2hLen-2 zero octets. The
	   length of PS may be 0. */
	/* 2.c. Concatenate lHash, PS, a single octet of 0x01 the message M, to form a data block DB
	   as: DB = lHash || PS || 01 || M */
	/* NOTE Since db is eventually maskedDb, part of em, create directly in em */
	db = em + hlen + 1;
	memcpy(db, &lHash.digest, hlen);			/* lHash */
	/* PSlen = emlen - flen - (2 * hlen) - 2 */
	memset(db + hlen, 0,					/* PS */
	       emLen - fLen - (2 * hlen) - 2);
	/* position of 0x01 in db is
	   hlen + PSlen =
	   hlen + emlen - flen - (2 * hlen) - 2 = 
	   emlen - hlen - flen - 2 */
	db[emLen - fLen - hlen - 2] = 0x01;
	memcpy(db + emLen - fLen - hlen - 1, from, fLen);	/* M */
    }
    /* 2.d. Generate a random octet string seed of length hLen. */
    if (rc == 0) {
	rc = TSS_Malloc(&seed, hlen);
    }
    if (rc == 0) {
	rc = TSS_RandBytes(seed, hlen);
    }
    if (rc == 0) {
	rc = TSS_Malloc(&dbMask, emLen - hlen - 1);
    }
    if (rc == 0) {
	/* 2.e. Let dbMask = MGF(seed, emLen-hLen-1). */
	rc = TSS_MGF1(dbMask, emLen - hlen -1,	/* dbLen */
		      seed, hlen,
		      halg);
    }
    if (rc == 0) {
	/* 2.f. Let maskedDB = DB xor dbMask. */
	/* NOTE Since maskedDB is eventually em, XOR directly to em */
	maskedDb = em + hlen + 1;
	TSS_XOR(maskedDb, db, dbMask, emLen - hlen -1);
	/* 2.g. Let seedMask = MGF(maskedDB, hLen). */
	/* NOTE Since seedMask is eventually em, create directly to em */
	seedMask = em + 1;
	rc = TSS_MGF1(seedMask, hlen,
		      maskedDb, emLen - hlen - 1,
		      halg);
    }
    if (rc == 0) {
	/* 2.h. Let maskedSeed = seed xor seedMask. */
	/* NOTE Since maskedSeed is eventually em, create directly to em */
	maskedSeed = em + 1;
	TSS_XOR(maskedSeed, seed, seedMask, hlen);
	/* 2.i. 0x00, maskedSeed, and maskedDb to form EM */
	/* NOTE Created directly in em */
    }
    free(dbMask);		/* @1 */
    free(seed);			/* @2 */
    return rc;
}

/* TPM_XOR XOR's 'in1' and 'in2' of 'length', putting the result in 'out'

 */

void TSS_XOR(unsigned char *out,
	     const unsigned char *in1,
	     const unsigned char *in2,
	     size_t length)
{
    size_t i;
    
    for (i = 0 ; i < length ; i++) {
	out[i] = in1[i] ^ in2[i];
    }
    return;
}

/*
  AES
*/

#define TSS_AES_KEY_BITS 128

uint16_t TSS_Sym_GetBlockSize(TPM_ALG_ID	symmetricAlg, 
			      uint16_t		keySizeInBits)
{
    keySizeInBits = keySizeInBits;
    
    switch (symmetricAlg) {
#ifdef TPM_ALG_AES
      case TPM_ALG_AES:
#endif
#ifdef TPM_ALG_SM4 /* Both AES and SM4 use the same block size */
      case TPM_ALG_SM4:
#endif
	return  16;
      default:
	return 0;
    }
    return 0;
}