/*!
 * chachapoly.js - chacha20/poly1305 for bcoin
 * Copyright (c) 2016, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcoin
 */

'use strict';

var assert = require('assert');
var native = require('../utils/native');

var BIG_ENDIAN = new Int8Array(new Int16Array([1]).buffer)[0] === 0;

/**
 * ChaCha20 (used for bip151)
 * @see https://tools.ietf.org/html/rfc7539#section-2
 * @exports ChaCha20
 * @constructor
 */

function ChaCha20() {
  if (!(this instanceof ChaCha20))
    return new ChaCha20();

  this.state = new Uint32Array(16);
  this.stream = new Uint32Array(16);
  this.bytes = new Uint8Array(this.stream.buffer);

  if (BIG_ENDIAN)
    this.bytes = new Buffer(64);

  this.pos = 0;
  this.ivSize = 0;
}

/**
 * Initialize chacha20 with a key, iv, and counter.
 * @param {Buffer} key
 * @param {Buffer} iv
 * @param {Number} counter
 */

ChaCha20.prototype.init = function init(key, iv, counter) {
  if (key)
    this.initKey(key);

  if (iv)
    this.initIV(iv, counter);
};

/**
 * Set key.
 * @param {Buffer} key
 */

ChaCha20.prototype.initKey = function initKey(key) {
  this.state[0] = 0x61707865;
  this.state[1] = 0x3320646e;
  this.state[2] = 0x79622d32;
  this.state[3] = 0x6b206574;

  this.state[4] = key.readUInt32LE(0, true);
  this.state[5] = key.readUInt32LE(4, true);
  this.state[6] = key.readUInt32LE(8, true);
  this.state[7] = key.readUInt32LE(12, true);
  this.state[8] = key.readUInt32LE(16, true);
  this.state[9] = key.readUInt32LE(20, true);
  this.state[10] = key.readUInt32LE(24, true);
  this.state[11] = key.readUInt32LE(28, true);

  this.state[12] = 0;

  this.pos = 0xffffffff;
};

/**
 * Set IV and counter.
 * @param {Buffer} iv
 * @param {Number} counter
 */

ChaCha20.prototype.initIV = function initIV(iv, counter) {
  if (iv.length === 8) {
    this.state[13] = 0;
    this.state[14] = iv.readUInt32LE(0, true);
    this.state[15] = iv.readUInt32LE(4, true);
  } else if (iv.length === 12) {
    this.state[13] = iv.readUInt32LE(0, true);
    this.state[14] = iv.readUInt32LE(4, true);
    this.state[15] = iv.readUInt32LE(8, true);
  } else {
    assert(false, 'Bad iv size.');
  }

  this.ivSize = iv.length * 8;

  this.setCounter(counter);
};

/**
 * Encrypt/decrypt data.
 * @param {Buffer} data - Will be mutated.
 */

ChaCha20.prototype.encrypt = function encrypt(data) {
  var i, j;

  for (i = 0; i < data.length; i++) {
    if (this.pos >= 64) {
      for (j = 0; j < 16; j++)
        this.stream[j] = this.state[j];

      for (j = 0; j < 10; j++) {
        qround(this.stream, 0, 4, 8, 12);
        qround(this.stream, 1, 5, 9, 13);
        qround(this.stream, 2, 6, 10, 14);
        qround(this.stream, 3, 7, 11, 15);
        qround(this.stream, 0, 5, 10, 15);
        qround(this.stream, 1, 6, 11, 12);
        qround(this.stream, 2, 7, 8, 13);
        qround(this.stream, 3, 4, 9, 14);
      }

      for (j = 0; j < 16; j++) {
        this.stream[j] += this.state[j];
        if (BIG_ENDIAN)
          this.bytes.writeUInt32LE(this.stream[j], j * 4, true);
      }

      this.state[12]++;

      if (this.state[12] === 0) {
        assert(this.ivSize === 64, 'Counter overflow.');
        this.state[13]++;
        assert(this.state[13] !== 0, 'Counter overflow.');
      }

      this.pos = 0;
    }

    data[i] ^= this.bytes[this.pos++];
  }

  return data;
};

/**
 * Artificially set the counter.
 * @param {Number} counter
 */

ChaCha20.prototype.setCounter = function setCounter(counter) {
  var lo, hi;

  if (!counter)
    counter = 0;

  lo = counter % 0x100000000;
  hi = (counter - lo) / 0x100000000;

  this.state[12] = lo;

  if (this.ivSize === 64)
    this.state[13] = hi;
};

/**
 * Get the counter as a uint64.
 * @returns {Number}
 */

ChaCha20.prototype.getCounter = function getCounter() {
  var lo = this.state[12];
  var hi = this.state[13];
  if (this.ivSize === 64)
    return hi * 0x100000000 + lo;
  return lo;
};

if (native)
  ChaCha20 = native.ChaCha20;

/*
 * Helpers
 */

function qround(x, a, b, c, d) {
  x[a] += x[b];
  x[d] = rotl32(x[d] ^ x[a], 16);

  x[c] += x[d];
  x[b] = rotl32(x[b] ^ x[c], 12);

  x[a] += x[b];
  x[d] = rotl32(x[d] ^ x[a], 8);

  x[c] += x[d];
  x[b] = rotl32(x[b] ^ x[c], 7);
}

function rotl32(w, b) {
  return (w << b) | (w >>> (32 - b));
}

/**
 * Poly1305 (used for bip151)
 * @see https://github.com/floodyberry/poly1305-donna
 * @see https://tools.ietf.org/html/rfc7539#section-2.5
 * @exports Poly1305
 * @constructor
 */

function Poly1305() {
  if (!(this instanceof Poly1305))
    return new Poly1305();

  this.r = new Uint16Array(10);
  this.h = new Uint16Array(10);
  this.pad = new Uint16Array(8);
  this.fin = 0;
  this.leftover = 0;
  this.buffer = new Buffer(16);
}

/**
 * Initialize poly1305 with a key.
 * @param {Buffer} key
 */

Poly1305.prototype.init = function init(key) {
  var t0, t1, t2, t3, t4, t5, t6, t7, i;

  // r &= 0xffffffc0ffffffc0ffffffc0fffffff
  t0 = key.readUInt16LE(0, true);
  t1 = key.readUInt16LE(2, true);
  t2 = key.readUInt16LE(4, true);
  t3 = key.readUInt16LE(6, true);
  t4 = key.readUInt16LE(8, true);
  t5 = key.readUInt16LE(10, true);
  t6 = key.readUInt16LE(12, true);
  t7 = key.readUInt16LE(14, true);

  this.r[0] = t0 & 0x1fff;
  this.r[1] = ((t0 >>> 13) | (t1 << 3)) & 0x1fff;
  this.r[2] = ((t1 >>> 10) | (t2 << 6)) & 0x1f03;
  this.r[3] = ((t2 >>> 7) | (t3 << 9)) & 0x1fff;
  this.r[4] = ((t3 >>> 4) | (t4 << 12)) & 0x00ff;
  this.r[5] = (t4 >>> 1) & 0x1ffe;
  this.r[6] = ((t4 >>> 14) | (t5 << 2)) & 0x1fff;
  this.r[7] = ((t5 >>> 11) | (t6 << 5)) & 0x1f81;
  this.r[8] = ((t6 >>> 8) | (t7 << 8)) & 0x1fff;
  this.r[9] = (t7 >>> 5) & 0x007f;

  // h = 0
  for (i = 0; i < 10; i++)
    this.h[i] = 0;

  // save pad for later
  for (i = 0; i < 8; i++)
    this.pad[i] = key.readUInt16LE(16 + (2 * i), true);

  this.leftover = 0;
  this.fin = 0;
};

/**
 * Process 16 byte blocks.
 * @param {Buffer} data - Blocks.
 * @param {Number} bytes - Size.
 * @param {Number} m - Offset pointer.
 */

Poly1305.prototype.blocks = function blocks(data, bytes, m) {
  var hibit = this.fin ? 0 : (1 << 11); // 1 << 128
  var d = new Uint32Array(10);
  var i, j, t0, t1, t2, t3, t4, t5, t6, t7, c;

  while (bytes >= 16) {
    // h += m[i]
    t0 = data.readUInt16LE(m + 0, true);
    t1 = data.readUInt16LE(m + 2, true);
    t2 = data.readUInt16LE(m + 4, true);
    t3 = data.readUInt16LE(m + 6, true);
    t4 = data.readUInt16LE(m + 8, true);
    t5 = data.readUInt16LE(m + 10, true);
    t6 = data.readUInt16LE(m + 12, true);
    t7 = data.readUInt16LE(m + 14, true);

    this.h[0] += t0 & 0x1fff;
    this.h[1] += ((t0 >>> 13) | (t1 << 3)) & 0x1fff;
    this.h[2] += ((t1 >>> 10) | (t2 << 6)) & 0x1fff;
    this.h[3] += ((t2 >>> 7) | (t3 << 9)) & 0x1fff;
    this.h[4] += ((t3 >>> 4) | (t4 << 12)) & 0x1fff;
    this.h[5] += ((t4 >>> 1)) & 0x1fff;
    this.h[6] += ((t4 >>> 14) | (t5 << 2)) & 0x1fff;
    this.h[7] += ((t5 >>> 11) | (t6 << 5)) & 0x1fff;
    this.h[8] += ((t6 >>> 8) | (t7 << 8)) & 0x1fff;
    this.h[9] += ((t7 >>> 5)) | hibit;

    // h *= r, (partial) h %= p
    for (i = 0, c = 0; i < 10; i++) {
      d[i] = c;
      for (j = 0; j < 10; j++) {
        d[i] += this.h[j] * (j <= i
          ? this.r[i - j]
          : 5 * this.r[i + 10 - j]);
        // Sum(h[i] * r[i] * 5) will overflow slightly
        // above 6 products with an unclamped r, so
        // carry at 5
        if (j === 4) {
          c = d[i] >>> 13;
          d[i] &= 0x1fff;
        }
      }
      c += d[i] >>> 13;
      d[i] &= 0x1fff;
    }
    c = (c << 2) + c; // c *= 5
    c += d[0];
    d[0] = (c & 0x1fff);
    c = c >>> 13;
    d[1] += c;

    for (i = 0; i < 10; i++)
      this.h[i] = d[i];

    m += 16;
    bytes -= 16;
  }
};

/**
 * Update the MAC with data (will be
 * processed as 16 byte blocks).
 * @param {Buffer} data
 */

Poly1305.prototype.update = function update(data) {
  var bytes = data.length;
  var m = 0;
  var i, want;

  // handle leftover
  if (this.leftover) {
    want = 16 - this.leftover;
    if (want > bytes)
      want = bytes;
    for (i = 0; i < want; i++)
      this.buffer[this.leftover + i] = data[m + i];
    bytes -= want;
    m += want;
    this.leftover += want;
    if (this.leftover < 16)
      return;
    this.blocks(this.buffer, 16, 0);
    this.leftover = 0;
  }

  // process full blocks
  if (bytes >= 16) {
    want = bytes & ~(16 - 1);
    this.blocks(data, want, m);
    m += want;
    bytes -= want;
  }

  // store leftover
  if (bytes) {
    for (i = 0; i < bytes; i++)
      this.buffer[this.leftover + i] = data[m + i];
    this.leftover += bytes;
  }
};

/**
 * Finalize and return a 16-byte MAC.
 * @returns {Buffer}
 */

Poly1305.prototype.finish = function finish() {
  var mac = new Buffer(16);
  var g = new Uint16Array(10);
  var c, mask, f, i;

  // process the remaining block
  if (this.leftover) {
    i = this.leftover;
    this.buffer[i++] = 1;
    for (; i < 16; i++)
      this.buffer[i] = 0;
    this.fin = 1;
    this.blocks(this.buffer, 16, 0);
  }

  // fully carry h
  c = this.h[1] >>> 13;
  this.h[1] &= 0x1fff;
  for (i = 2; i < 10; i++) {
    this.h[i] += c;
    c = this.h[i] >>> 13;
    this.h[i] &= 0x1fff;
  }
  this.h[0] += c * 5;
  c = this.h[0] >>> 13;
  this.h[0] &= 0x1fff;
  this.h[1] += c;
  c = this.h[1] >>> 13;
  this.h[1] &= 0x1fff;
  this.h[2] += c;

  // compute h + -p
  g[0] = this.h[0] + 5;
  c = g[0] >>> 13;
  g[0] &= 0x1fff;
  for (i = 1; i < 10; i++) {
    g[i] = this.h[i] + c;
    c = g[i] >>> 13;
    g[i] &= 0x1fff;
  }

  // select h if h < p, or h + -p if h >= p
  mask = (c ^ 1) - 1;
  for (i = 0; i < 10; i++)
    g[i] &= mask;
  mask = ~mask;
  for (i = 0; i < 10; i++)
    this.h[i] = (this.h[i] & mask) | g[i];

  // h = h % (2^128)
  this.h[0] = ((this.h[0]) | (this.h[1] << 13)) & 0xffff;
  this.h[1] = ((this.h[1] >>> 3) | (this.h[2] << 10)) & 0xffff;
  this.h[2] = ((this.h[2] >>> 6) | (this.h[3] << 7)) & 0xffff;
  this.h[3] = ((this.h[3] >>> 9) | (this.h[4] << 4)) & 0xffff;
  this.h[4] = ((this.h[4] >>> 12)
    | (this.h[5] << 1) | (this.h[6] << 14)) & 0xffff;
  this.h[5] = ((this.h[6] >>> 2) | (this.h[7] << 11)) & 0xffff;
  this.h[6] = ((this.h[7] >>> 5) | (this.h[8] << 8)) & 0xffff;
  this.h[7] = ((this.h[8] >>> 8) | (this.h[9] << 5)) & 0xffff;

  // mac = (h + pad) % (2^128)
  f = this.h[0] + this.pad[0];
  this.h[0] = f;
  for (i = 1; i < 8; i++) {
    f = this.h[i] + this.pad[i] + (f >>> 16);
    this.h[i] = f;
  }

  for (i = 0; i < 8; i++)
    mac.writeUInt16LE(this.h[i], i * 2, true);

  // zero out the state
  for (i = 0; i < 10; i++)
    this.h[i] = 0;
  for (i = 0; i < 10; i++)
    this.r[i] = 0;
  for (i = 0; i < 8; i++)
    this.pad[i] = 0;

  return mac;
};

/**
 * Return a MAC for a message and key.
 * @param {Buffer} msg
 * @param {Buffer} key
 * @returns {Buffer} MAC
 */

Poly1305.auth = function auth(msg, key) {
  var poly = new Poly1305();
  poly.init(key);
  poly.update(msg);
  return poly.finish();
};

/**
 * Compare two MACs in constant time.
 * @param {Buffer} mac1
 * @param {Buffer} mac2
 * @returns {Boolean}
 */

Poly1305.verify = function verify(mac1, mac2) {
  var dif = 0;
  var i;

  // Compare in constant time.
  for (i = 0; i < 16; i++)
    dif |= mac1[i] ^ mac2[i];

  dif = (dif - 1) >>> 31;

  return (dif & 1) !== 0;
};

if (native)
  Poly1305 = native.Poly1305;

/**
 * AEAD (used for bip151)
 * @exports AEAD
 * @see https://github.com/openssh/openssh-portable
 * @see https://tools.ietf.org/html/rfc7539#section-2.8
 * @constructor
 */

function AEAD() {
  if (!(this instanceof AEAD))
    return new AEAD();

  this.chacha20 = new ChaCha20();
  this.poly1305 = new Poly1305();
  this.aadLen = 0;
  this.cipherLen = 0;
  this.polyKey = null;
}

/**
 * Initialize the AEAD with a key and iv.
 * @param {Buffer} key
 * @param {Buffer} iv - IV / packet sequence number.
 */

AEAD.prototype.init = function init(key, iv) {
  var polyKey = new Buffer(32);
  polyKey.fill(0);

  this.chacha20.init(key, iv);
  this.chacha20.encrypt(polyKey);
  this.poly1305.init(polyKey);

  // We need to encrypt a full block
  // to get the cipher in the correct state.
  this.chacha20.encrypt(new Buffer(32));

  // Counter should be one.
  assert(this.chacha20.getCounter() === 1);

  // Expose for debugging.
  this.polyKey = polyKey;

  this.aadLen = 0;
  this.cipherLen = 0;
};

/**
 * Update the aad (will be finalized
 * on an encrypt/decrypt call).
 * @param {Buffer} aad
 */

AEAD.prototype.aad = function _aad(aad) {
  assert(this.cipherLen === 0, 'Cannot update aad.');
  this.poly1305.update(aad);
  this.aadLen += aad.length;
};

/**
 * Encrypt a piece of data.
 * @param {Buffer} data
 */

AEAD.prototype.encrypt = function encrypt(data) {
  if (this.cipherLen === 0)
    this.pad16(this.aadLen);

  this.chacha20.encrypt(data);
  this.poly1305.update(data);
  this.cipherLen += data.length;

  return data;
};

/**
 * Decrypt a piece of data.
 * @param {Buffer} data
 */

AEAD.prototype.decrypt = function decrypt(data) {
  if (this.cipherLen === 0)
    this.pad16(this.aadLen);

  this.cipherLen += data.length;
  this.poly1305.update(data);
  this.chacha20.encrypt(data);

  return data;
};

/**
 * Authenticate data without decrypting.
 * @param {Buffer} data
 */

AEAD.prototype.auth = function auth(data) {
  if (this.cipherLen === 0)
    this.pad16(this.aadLen);

  this.cipherLen += data.length;
  this.poly1305.update(data);

  return data;
};

/**
 * Finalize the aead and generate a MAC.
 * @returns {Buffer} MAC
 */

AEAD.prototype.finish = function finish() {
  var len = new Buffer(16);
  var lo, hi;

  // The RFC says these are supposed to be
  // uint32le, but their own fucking test
  // cases fail unless they are uint64le's.
  lo = this.aadLen % 0x100000000;
  hi = (this.aadLen - lo) / 0x100000000;
  len.writeUInt32LE(lo, 0, true);
  len.writeUInt32LE(hi, 4, true);

  lo = this.cipherLen % 0x100000000;
  hi = (this.cipherLen - lo) / 0x100000000;
  len.writeUInt32LE(lo, 8, true);
  len.writeUInt32LE(hi, 12, true);

  if (this.cipherLen === 0)
    this.pad16(this.aadLen);

  this.pad16(this.cipherLen);
  this.poly1305.update(len);

  return this.poly1305.finish();
};

/**
 * Pad a chunk before updating mac.
 * @private
 * @param {Number} size
 */

AEAD.prototype.pad16 = function pad16(size) {
  var pad;

  size %= 16;

  if (size === 0)
    return;

  pad = new Buffer(16 - size);
  pad.fill(0);

  this.poly1305.update(pad);
};

/*
 * Expose
 */

exports.ChaCha20 = ChaCha20;
exports.Poly1305 = Poly1305;
exports.AEAD = AEAD;