// Copyright 2017 The Fuchsia Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#pragma once

#include <stddef.h>
#include <stdint.h>

#include <crypto/bytes.h>
#include <fbl/macros.h>
#include <zircon/types.h>
#include <crypto/secret.h>

// |crypto::Cipher| is used to encrypt and decrypt data.  Ciphers differ from AEADs in that they
// require block-aligned lengths and do not check data integrity.  This implementation can be used
// as either a stream cipher, or as a random access cipher if the cipher has a "tweaked codebook
// mode".  See the variants of |Init| and |Transform| for details.  A 64 bit nonce is used to seal
// plain texts, meaning a given key and IV can be used for at most 2^64 - 1 operations.
namespace crypto {

class Cipher final {
 public:
  // Algorithm enumerates the supported secret key ciphers.
  enum Algorithm {
    kUninitialized = 0,
    kAES256_XTS,  // A "tweaked cipher
  };

  // Indicates whether the objects turns plaintext into ciphertext or vice versa.
  enum Direction {
    kUnset = 0,
    kEncrypt,
    kDecrypt,
  };

  Cipher();
  ~Cipher();

  Direction direction() const { return direction_; }
  uint64_t alignment() const { return alignment_; }

  // Gets the number of bytes needed for the symmetric key used by the given |cipher|.
  static zx_status_t GetKeyLen(Algorithm cipher, size_t* out);

  // Gets the number of bytes needed for the initialization vector (IV) used by the given
  // |cipher|.
  static zx_status_t GetIVLen(Algorithm cipher, size_t* out);

  // Gets the cipher block size in bytes for  the given |cipher|.  Data passed to |Encrypt| or
  // |Decrypt| must be a multiple of this size.
  static zx_status_t GetBlockSize(Algorithm cipher, size_t* out);

  // Sets up the cipher to encrypt or decrypt data using the given |key| and |iv|,  based on the
  // given |direction|, either as:
  //   - A stream ciphers, using the first variant that omits the |alignment|.
  //   - As a random access cipher, using the second variant.  All offsets must be
  //   |alignment|-aligned, and |alignment| must be a power of 2.
  zx_status_t Init(Algorithm algo, Direction direction, const Secret& key, const Bytes& iv,
                   uint64_t alignment);

  // Sets up the cipher to encrypt data using the given |key| and |iv|, either as a stream cipher
  // or a random access cipher, as described above in |Init|.
  zx_status_t InitEncrypt(Algorithm algo, const Secret& key, const Bytes& iv) {
    return Init(algo, kEncrypt, key, iv, 0);
  }
  zx_status_t InitEncrypt(Algorithm algo, const Secret& key, const Bytes& iv, uint64_t alignment) {
    return Init(algo, kEncrypt, key, iv, alignment);
  }

  // Sets up the cipher to decrypt data using the given |key| and |iv|, either as a stream cipher
  // or a random access cipher, as described above in |Init|.
  zx_status_t InitDecrypt(Algorithm algo, const Secret& key, const Bytes& iv) {
    return Init(algo, kDecrypt, key, iv, 0);
  }
  zx_status_t InitDecrypt(Algorithm algo, const Secret& key, const Bytes& iv, uint64_t alignment) {
    return Init(algo, kDecrypt, key, iv, alignment);
  }

  // Encrypts or decrypts |length| bytes from |in| to |out|, based on the given |direction| and
  // the parameters set in |Init|:
  //  - Must have been configured with the same |direction|.
  //  - If |alignment| was non-zero, |offset| must be a multiple of it.
  // Finally, |length| must be a multiple of cipher blocks, and |out| must have room for |length|
  // bytes.  This method will fail if called 2^64 or more times with the same key and IV.
  zx_status_t Transform(const uint8_t* in, zx_off_t offset, size_t length, uint8_t* out,
                        Direction Direction);

  // Encrypts |len| bytes from |in| to |out|, as described above in |Transform|.
  zx_status_t Encrypt(const uint8_t* in, size_t length, uint8_t* out) {
    return Transform(in, 0, length, out, kEncrypt);
  }
  zx_status_t Encrypt(const uint8_t* in, zx_off_t offset, size_t length, uint8_t* out) {
    return Transform(in, offset, length, out, kEncrypt);
  }

  // Decrypts |len| bytes from |in| to |out|, as described above in |Transform|.
  zx_status_t Decrypt(const uint8_t* in, size_t length, uint8_t* out) {
    return Transform(in, 0, length, out, kDecrypt);
  }
  zx_status_t Decrypt(const uint8_t* in, zx_off_t offset, size_t length, uint8_t* out) {
    return Transform(in, offset, length, out, kDecrypt);
  }

  // Clears all state from this instance.
  void Reset();

 private:
  DISALLOW_COPY_ASSIGN_AND_MOVE(Cipher);

  // Opaque crypto implementation context.
  struct Context;

  // Opaque pointer to the crypto implementation context.
  fbl::unique_ptr<Context> ctx_;
  // Indicates which algorithm to use to transform data.
  Algorithm cipher_;
  // Indicates whether configured to encrypt or decrypt.
  Direction direction_;
  // Cipher block size.
  size_t block_size_;
  // Buffer holding initial vector.  The IV is expanded to be |zx_off_t|-aligned.
  fbl::unique_ptr<zx_off_t[]> iv_;
  // Original value of |iv_[0]|.  |Transform| will fail if |iv_[0]| wraps around to this value.
  zx_off_t iv0_;
  // If non-zero, indicates how many bytes to use a nonce for before incrementing.
  uint64_t alignment_;
};
}  // namespace crypto