/*
 * Copyright (c) 2023, [MTG AG](https://www.mtg.de).
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without modification,
 * are permitted provided that the following conditions are met:
 *
 * 1.  Redistributions of source code must retain the above copyright notice,
 *     this list of conditions and the following disclaimer.
 *
 * 2.  Redistributions in binary form must reproduce the above copyright notice,
 *     this list of conditions and the following disclaimer in the documentation
 *     and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "config.h"

#if defined(ENABLE_CRYPTO_REFRESH)

#include "v2_seipd.h"
#include "logging.h"
#include "crypto/hkdf.hpp"

seipd_v2_aead_fields_t
seipd_v2_key_and_nonce_derivation(pgp_seipdv2_hdr_t &hdr, uint8_t *sesskey)
{
    auto hkdf = rnp::Hkdf::create(PGP_HASH_SHA256);

    size_t   sesskey_len = pgp_key_size(hdr.cipher_alg);
    uint32_t nonce_size = 0;
    uint32_t key_size = pgp_key_size(hdr.cipher_alg);

    switch (hdr.aead_alg) {
    case PGP_AEAD_EAX:
        nonce_size = 16;
        break;
    case PGP_AEAD_OCB:
        nonce_size = 15;
        break;
    case PGP_AEAD_NONE:
    case PGP_AEAD_UNKNOWN:
        RNP_LOG("only EAX and OCB is supported for v2 SEIPD packets");
        throw rnp::rnp_exception(RNP_ERROR_NOT_SUPPORTED);
    }
    const uint8_t info[5] = {
      static_cast<uint8_t>(PGP_PKT_SE_IP_DATA | PGP_PTAG_ALWAYS_SET | PGP_PTAG_NEW_FORMAT),
      static_cast<uint8_t>(hdr.version),
      static_cast<uint8_t>(hdr.cipher_alg),
      static_cast<uint8_t>(hdr.aead_alg),
      hdr.chunk_size_octet};
    uint32_t             out_size = key_size + nonce_size - 8;
    std::vector<uint8_t> hkdf_out(out_size);
    hkdf->extract_expand(hdr.salt,
                         sizeof(hdr.salt),
                         sesskey,
                         sesskey_len,
                         info,
                         sizeof(info),
                         hkdf_out.data(),
                         hkdf_out.size());

    seipd_v2_aead_fields_t result;
    result.key = std::vector<uint8_t>(hkdf_out.data(), hkdf_out.data() + key_size);
    result.nonce =
      std::vector<uint8_t>(hkdf_out.data() + key_size, hkdf_out.data() + hkdf_out.size());
    for (uint32_t i = 0; i < 8; i++) {
        // fill up the nonce with zero octets
        result.nonce.push_back(0);
    }
    return result;
}

#endif