/* Copyright (c) 2016, Google Inc.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */

#ifndef OPENSSL_HEADER_NEWHOPE_H
#define OPENSSL_HEADER_NEWHOPE_H

#include <openssl/base.h>
#include <openssl/sha.h>

#if defined(__cplusplus)
extern "C" {
#endif


/* Post-quantum key agreement, based upon the reference
 * implementation. Note: this implementation does not interoperate
 * with the reference implementation!
 *
 * Source: https://github.com/tpoeppelmann/newhope
 *
 * The authors' permission to use their code is gratefully acknowledged. */


/* NEWHOPE_POLY_new returns a new |NEWHOPE_POLY| object, or NULL on error. */
OPENSSL_EXPORT NEWHOPE_POLY *NEWHOPE_POLY_new(void);

/* NEWHOPE_POLY_free frees |p|. */
OPENSSL_EXPORT void NEWHOPE_POLY_free(NEWHOPE_POLY *p);

/* NEWHOPE_POLY_LENGTH is the size in bytes of the packed representation of a
 * polynomial, encoded with 14 bits per coefficient. */
#define NEWHOPE_POLY_LENGTH ((1024 * 14) / 8)

/* NEWHOPE_RECONCILIATION_LENGTH is the size in bytes of the packed
 * representation of the reconciliation data, encoded as 2 bits per
 * coefficient. */
#define NEWHOPE_RECONCILIATION_LENGTH ((1024 * 2) / 8)

/* NEWHOPE_OFFERMSG_LENGTH is the length of the offering party's message to the
 * accepting party. */
#define NEWHOPE_OFFERMSG_LENGTH (NEWHOPE_POLY_LENGTH + 32)

/* NEWHOPE_ACCEPTMSG_LENGTH is the length of the accepting party's message to
 * the offering party. */
#define NEWHOPE_ACCEPTMSG_LENGTH \
  (NEWHOPE_POLY_LENGTH + NEWHOPE_RECONCILIATION_LENGTH)

/* NEWHOPE_KEY_LENGTH is the size of the result of the key agreement. This
 * result is not exposed to callers: instead, it is whitened with SHA-256, whose
 * output happens to be the same size. */
#define NEWHOPE_KEY_LENGTH 32

/* NEWHOPE_offer initializes |out_msg| and |out_sk| for a new key
 * exchange. |msg| must have room for |NEWHOPE_OFFERMSG_LENGTH| bytes. Neither
 * output may be cached. */
OPENSSL_EXPORT void NEWHOPE_offer(uint8_t out_msg[NEWHOPE_OFFERMSG_LENGTH],
                                  NEWHOPE_POLY *out_sk);

/* NEWHOPE_accept completes a key exchange given an offer message |msg|. The
 * result of the key exchange is written to |out_key|, which must have space for
 * |SHA256_DIGEST_LENGTH| bytes. The message to be send to the offering party is
 * written to |out_msg|, which must have room for |NEWHOPE_ACCEPTMSG_LENGTH|
 * bytes. Returns 1 on success and 0 on error. */
OPENSSL_EXPORT int NEWHOPE_accept(uint8_t out_key[SHA256_DIGEST_LENGTH],
                                  uint8_t out_msg[NEWHOPE_ACCEPTMSG_LENGTH],
                                  const uint8_t msg[NEWHOPE_OFFERMSG_LENGTH],
                                  size_t msg_len);

/* NEWHOPE_finish completes a key exchange for the offering party, given an
 * accept message |msg| and the previously generated secret |sk|. The result of
 * the key exchange is written to |out_key|, which must have space for
 * |SHA256_DIGEST_LENGTH| bytes. Returns 1 on success and 0 on error. */
OPENSSL_EXPORT int NEWHOPE_finish(uint8_t out_key[SHA256_DIGEST_LENGTH],
                                  const NEWHOPE_POLY *sk,
                                  const uint8_t msg[NEWHOPE_ACCEPTMSG_LENGTH],
                                  size_t msg_len);


/* Lower-level functions. */

/* NEWHOPE_POLY_noise sets |r| to a random polynomial where the coefficients are
 * sampled from the noise distribution. */
OPENSSL_EXPORT void NEWHOPE_POLY_noise(NEWHOPE_POLY* r);

/* NEWHOPE_POLY_noise_ntt sets |r| to an output of NEWHOPE_POLY_noise, and then
 * applies NTT(r) in-place. */
OPENSSL_EXPORT void NEWHOPE_POLY_noise_ntt(NEWHOPE_POLY* r);

/* NEWHOPE_offer_computation is the work of |NEWHOPE_offer|, less the encoding
 * parts.  The inputs are the noise polynomials |s| and |e|, and random
 * polynomial |a|. The output is the polynomial |pk|. */
OPENSSL_EXPORT void NEWHOPE_offer_computation(
    NEWHOPE_POLY *out_pk,
    const NEWHOPE_POLY *s, const NEWHOPE_POLY *e, const NEWHOPE_POLY *a);

/* NEWHOPE_accept_computation is the work of |NEWHOPE_accept|, less the encoding
 * parts. The inputs from the peer are |pk| and |a|. The locally-generated
 * inputs are the noise polynomials |sp|, |ep|, and |epp|, and the random bytes
 * |rand|. The outputs are |out_bp| and |out_reconciliation|, and the result of
 * key agreement |key|. Returns 1 on success and 0 on failure. */
OPENSSL_EXPORT void NEWHOPE_accept_computation(
    uint8_t out_key[NEWHOPE_KEY_LENGTH], NEWHOPE_POLY *out_bp,
    NEWHOPE_POLY *out_reconciliation,
    const NEWHOPE_POLY *sp, const NEWHOPE_POLY *ep, const NEWHOPE_POLY *epp,
    const uint8_t rand[32],
    const NEWHOPE_POLY *pk, const NEWHOPE_POLY *a);

/* NEWHOPE_finish_computation is the work of |NEWHOPE_finish|, less the encoding
 * parts. Given the peer's |bp| and |reconciliation|, and locally-generated
 * noise |noise|, the result of the key agreement is written to out_key.
 * Returns 1 on success and 0 on failure. */
OPENSSL_EXPORT void NEWHOPE_finish_computation(
    uint8_t out_key[NEWHOPE_KEY_LENGTH], const NEWHOPE_POLY *noise,
    const NEWHOPE_POLY *bp, const NEWHOPE_POLY *reconciliation);

/* NEWHOPE_POLY_frombytes decodes |a| into |r|. */
OPENSSL_EXPORT void NEWHOPE_POLY_frombytes(
    NEWHOPE_POLY *r, const uint8_t a[NEWHOPE_POLY_LENGTH]);

/* NEWHOPE_POLY_tobytes packs the polynomial |p| into the compact representation
 * |r|. */
OPENSSL_EXPORT void NEWHOPE_POLY_tobytes(uint8_t r[NEWHOPE_POLY_LENGTH],
                                         const NEWHOPE_POLY* p);

/* NEWHOPE_offer_frommsg decodes an offer message |msg| into its constituent
 * polynomials |out_pk| and |a|. */
OPENSSL_EXPORT void NEWHOPE_offer_frommsg(
    NEWHOPE_POLY *out_pk, NEWHOPE_POLY *out_a,
    const uint8_t msg[NEWHOPE_OFFERMSG_LENGTH]);


#if defined(__cplusplus)
} /* extern "C" */
#endif

#endif /* OPENSSL_HEADER_NEWHOPE_H */