/*
 * Copyright(C) 2020 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package com.android.javacard.seprovider;

import javacard.framework.ISO7816;
import javacard.framework.ISOException;
import javacard.framework.JCSystem;
import javacard.framework.Util;
import javacard.security.AESKey;
import javacard.security.CryptoException;
import javacard.security.DESKey;
import javacard.security.ECPrivateKey;
import javacard.security.ECPublicKey;
import javacard.security.HMACKey;
import javacard.security.Key;
import javacard.security.KeyAgreement;
import javacard.security.KeyBuilder;
import javacard.security.KeyPair;
import javacard.security.MessageDigest;
import javacard.security.RSAPrivateKey;
import javacard.security.RandomData;
import javacard.security.Signature;
import javacardx.crypto.AEADCipher;
import javacardx.crypto.Cipher;
import org.globalplatform.upgrade.Element;
import org.globalplatform.upgrade.UpgradeManager;

/**
 * This class implements KMSEProvider and provides all the necessary crypto operations required to
 * support the KeyMint specification. This class supports AES, 3DES, HMAC, RSA, ECDSA, ECDH
 * algorithms additionally it also supports ECDSA_NO_DIGEST, RSA_NO_DIGEST and RSA_OAEP_MGF1_SHA1
 * and RSA_OAEP_MGF1_SHA256 algorithms. This class follows the pattern of Init-Update-Final for the
 * crypto operations.
 */
public class KMAndroidSEProvider implements KMSEProvider {

  // The tag length for AES GCM algorithm.
  public static final byte AES_GCM_TAG_LENGTH = 16;
  // The nonce length for AES GCM algorithm.
  public static final byte AES_GCM_NONCE_LENGTH = 12;
  // AES keysize offsets in aesKeys[] for 128 and 256 sizes respectively.
  public static final byte KEYSIZE_128_OFFSET = 0x00;
  public static final byte KEYSIZE_256_OFFSET = 0x01;
  // The size of the temporary buffer.
  public static final short TMP_ARRAY_SIZE = 300;
  // The length of the rsa key in bytes.
  private static final short RSA_KEY_SIZE = 256;
  // Below are the flag to denote device reset events
  public static final byte POWER_RESET_FALSE = (byte) 0xAA;
  public static final byte POWER_RESET_TRUE = (byte) 0x00;
  // The computed HMAC key size.
  private static final byte COMPUTED_HMAC_KEY_SIZE = 32;
  // The constant 'L' as defiend in
  // https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-108.pdf, page 12.
  private static byte[] CMAC_KDF_CONSTANT_L;
  // Constant to represent 0.
  private static byte[] CMAC_KDF_CONSTANT_ZERO;
  // KeyAgreement instance.
  private static KeyAgreement keyAgreement;

  // AESKey
  private AESKey aesKeys[];
  // DES3Key
  private DESKey triDesKey;
  // HMACKey
  private HMACKey hmacKey;
  // RSA Key Pair
  private KeyPair rsaKeyPair;
  // EC Key Pair.
  private KeyPair ecKeyPair;
  // Temporary array.
  public byte[] tmpArray;
  // This is used for internal encryption/decryption operations.
  private static AEADCipher aesGcmCipher;
  // Instance of Signature algorithm used in KDF.
  private Signature kdf;
  // Flag used to denote the power reset event.
  public static byte[] resetFlag;
  // Instance of HMAC Signature algorithm.
  private Signature hmacSignature;
  // For ImportwrappedKey operations.
  private KMRsaOAEPEncoding rsaOaepDecipher;
  // Instance of pool manager.
  private KMPoolManager poolMgr;
  // Instance of KMOperationImpl used only to encrypt/decrypt the KeyBlobs.
  private KMOperationImpl globalOperation;
  // Entropy
  private RandomData rng;
  // Singleton instance.
  private static KMAndroidSEProvider androidSEProvider = null;

  public static KMAndroidSEProvider getInstance() {
    return androidSEProvider;
  }

  public KMAndroidSEProvider() {
    initStatics();
    // Re-usable AES,DES and HMAC keys in persisted memory.
    aesKeys = new AESKey[2];
    aesKeys[KEYSIZE_128_OFFSET] =
        (AESKey)
            KeyBuilder.buildKey(
                KeyBuilder.TYPE_AES_TRANSIENT_RESET, KeyBuilder.LENGTH_AES_128, false);
    aesKeys[KEYSIZE_256_OFFSET] =
        (AESKey)
            KeyBuilder.buildKey(
                KeyBuilder.TYPE_AES_TRANSIENT_RESET, KeyBuilder.LENGTH_AES_256, false);
    triDesKey =
        (DESKey)
            KeyBuilder.buildKey(
                KeyBuilder.TYPE_DES_TRANSIENT_RESET, KeyBuilder.LENGTH_DES3_3KEY, false);
    hmacKey =
        (HMACKey) KeyBuilder.buildKey(KeyBuilder.TYPE_HMAC_TRANSIENT_RESET, (short) 512, false);
    rsaKeyPair = new KeyPair(KeyPair.ALG_RSA, KeyBuilder.LENGTH_RSA_2048);
    ecKeyPair = new KeyPair(KeyPair.ALG_EC_FP, KeyBuilder.LENGTH_EC_FP_256);
    keyAgreement = KeyAgreement.getInstance(KeyAgreement.ALG_EC_SVDP_DH_PLAIN, false);
    poolMgr = KMPoolManager.getInstance();
    poolMgr.initECKey(ecKeyPair);
    // RsaOAEP Decipher
    rsaOaepDecipher = new KMRsaOAEPEncoding(KMRsaOAEPEncoding.ALG_RSA_PKCS1_OAEP_SHA256_MGF1_SHA1);

    kdf = Signature.getInstance(Signature.ALG_AES_CMAC_128, false);
    hmacSignature = Signature.getInstance(Signature.ALG_HMAC_SHA_256, false);

    globalOperation = new KMOperationImpl();

    // Temporary transient array created to use locally inside functions.
    tmpArray = JCSystem.makeTransientByteArray(TMP_ARRAY_SIZE, JCSystem.CLEAR_ON_DESELECT);
    Util.arrayFillNonAtomic(tmpArray, (short) 0, TMP_ARRAY_SIZE, (byte) 0);
    // Random number generator initialisation.
    rng = RandomData.getInstance(RandomData.ALG_KEYGENERATION);
    androidSEProvider = this;
    resetFlag = JCSystem.makeTransientByteArray((short) 1, JCSystem.CLEAR_ON_RESET);
    resetFlag[0] = (byte) POWER_RESET_FALSE;
  }

  void initStatics() {
    CMAC_KDF_CONSTANT_L = new byte[] {0x00, 0x00, 0x01, 0x00};
    CMAC_KDF_CONSTANT_ZERO = new byte[] {0x00};
  }

  public void clean() {
    Util.arrayFillNonAtomic(tmpArray, (short) 0, TMP_ARRAY_SIZE, (byte) 0);
  }

  public AESKey createAESKey(short keysize) {
    try {
      if (keysize > TMP_ARRAY_SIZE) {
        KMException.throwIt(KMError.INVALID_INPUT_LENGTH);
      }
      newRandomNumber(tmpArray, (short) 0, (short) (keysize / 8));
      return createAESKey(tmpArray, (short) 0, (short) (keysize / 8));
    } finally {
      clean();
    }
  }

  public AESKey createAESKey(byte[] buf, short startOff, short length) {
    AESKey key = null;
    short keysize = (short) (length * 8);
    if (keysize == 128) {
      key = (AESKey) aesKeys[KEYSIZE_128_OFFSET];
      key.setKey(buf, (short) startOff);
    } else if (keysize == 256) {
      key = (AESKey) aesKeys[KEYSIZE_256_OFFSET];
      key.setKey(buf, (short) startOff);
    } else {
      KMException.throwIt(KMError.INVALID_INPUT_LENGTH);
    }
    return key;
  }

  public DESKey createTDESKey() {
    try {
      newRandomNumber(tmpArray, (short) 0, (short) (KeyBuilder.LENGTH_DES3_3KEY / 8));
      return createTDESKey(tmpArray, (short) 0, (short) (KeyBuilder.LENGTH_DES3_3KEY / 8));
    } finally {
      clean();
    }
  }

  public DESKey createTDESKey(byte[] secretBuffer, short secretOff, short secretLength) {
    triDesKey.setKey(secretBuffer, secretOff);
    return triDesKey;
  }

  public HMACKey createHMACKey(short keysize) {
    // As per the KeyMint2.0 specification
    // The minimum supported HMAC key size is 64 bits
    // The maximum supported HMAC key size is 512 bits
    // The keysize should be a multiple of 8.
    if ((keysize % 8 != 0) || !(keysize >= 64 && keysize <= 512)) {
      CryptoException.throwIt(CryptoException.ILLEGAL_VALUE);
    }
    try {
      newRandomNumber(tmpArray, (short) 0, (short) (keysize / 8));
      return createHMACKey(tmpArray, (short) 0, (short) (keysize / 8));
    } finally {
      clean();
    }
  }

  public HMACKey createHMACKey(byte[] secretBuffer, short secretOff, short secretLength) {
    hmacKey.setKey(secretBuffer, secretOff, secretLength);
    return hmacKey;
  }

  public KeyPair createRsaKeyPair() {
    rsaKeyPair.genKeyPair();
    return rsaKeyPair;
  }

  public RSAPrivateKey createRsaKey(
      byte[] modBuffer,
      short modOff,
      short modLength,
      byte[] privBuffer,
      short privOff,
      short privLength) {
    RSAPrivateKey privKey = (RSAPrivateKey) rsaKeyPair.getPrivate();
    privKey.setExponent(privBuffer, privOff, privLength);
    privKey.setModulus(modBuffer, modOff, modLength);
    return privKey;
  }

  public KeyPair createECKeyPair() {
    ecKeyPair.genKeyPair();
    return ecKeyPair;
  }

  public ECPrivateKey createEcKey(byte[] privBuffer, short privOff, short privLength) {
    ECPrivateKey privKey = (ECPrivateKey) ecKeyPair.getPrivate();
    privKey.setS(privBuffer, privOff, privLength);
    return privKey;
  }

  @Override
  public short createSymmetricKey(byte alg, short keysize, byte[] buf, short startOff) {
    switch (alg) {
      case KMType.AES:
        AESKey aesKey = createAESKey(keysize);
        return aesKey.getKey(buf, startOff);
      case KMType.DES:
        DESKey desKey = createTDESKey();
        return desKey.getKey(buf, startOff);
      case KMType.HMAC:
        HMACKey hmacKey = createHMACKey(keysize);
        return hmacKey.getKey(buf, startOff);
      default:
        CryptoException.throwIt(CryptoException.NO_SUCH_ALGORITHM);
        break;
    }
    return 0;
  }

  @Override
  public void createAsymmetricKey(
      byte alg,
      byte[] privKeyBuf,
      short privKeyStart,
      short privKeyLength,
      byte[] pubModBuf,
      short pubModStart,
      short pubModLength,
      short[] lengths) {
    switch (alg) {
      case KMType.RSA:
        if (RSA_KEY_SIZE != privKeyLength || RSA_KEY_SIZE != pubModLength) {
          CryptoException.throwIt(CryptoException.ILLEGAL_VALUE);
        }
        KeyPair rsaKey = createRsaKeyPair();
        RSAPrivateKey privKey = (RSAPrivateKey) rsaKey.getPrivate();
        // Copy exponent.
        Util.arrayFillNonAtomic(tmpArray, (short) 0, RSA_KEY_SIZE, (byte) 0);
        lengths[0] = privKey.getExponent(tmpArray, (short) 0);
        if (lengths[0] > privKeyLength) {
          CryptoException.throwIt(CryptoException.ILLEGAL_VALUE);
        }
        Util.arrayFillNonAtomic(privKeyBuf, privKeyStart, privKeyLength, (byte) 0);
        Util.arrayCopyNonAtomic(
            tmpArray,
            (short) 0,
            privKeyBuf,
            (short) (privKeyStart + privKeyLength - lengths[0]),
            lengths[0]);
        // Copy modulus
        Util.arrayFillNonAtomic(tmpArray, (short) 0, RSA_KEY_SIZE, (byte) 0);
        lengths[1] = privKey.getModulus(tmpArray, (short) 0);
        if (lengths[1] > pubModLength) {
          CryptoException.throwIt(CryptoException.ILLEGAL_VALUE);
        }
        Util.arrayFillNonAtomic(pubModBuf, pubModStart, pubModLength, (byte) 0);
        Util.arrayCopyNonAtomic(
            tmpArray,
            (short) 0,
            pubModBuf,
            (short) (pubModStart + pubModLength - lengths[1]),
            lengths[1]);
        break;
      case KMType.EC:
        KeyPair ecKey = createECKeyPair();
        ECPublicKey ecPubKey = (ECPublicKey) ecKey.getPublic();
        ECPrivateKey ecPrivKey = (ECPrivateKey) ecKey.getPrivate();
        lengths[0] = ecPrivKey.getS(privKeyBuf, privKeyStart);
        lengths[1] = ecPubKey.getW(pubModBuf, pubModStart);
        if (lengths[0] > privKeyLength || lengths[1] > pubModLength) {
          CryptoException.throwIt(CryptoException.ILLEGAL_VALUE);
        }
        break;
      default:
        CryptoException.throwIt(CryptoException.NO_SUCH_ALGORITHM);
        break;
    }
  }

  @Override
  public boolean importSymmetricKey(
      byte alg, short keysize, byte[] buf, short startOff, short length) {
    switch (alg) {
      case KMType.AES:
        createAESKey(buf, startOff, length);
        break;
      case KMType.DES:
        createTDESKey(buf, startOff, length);
        break;
      case KMType.HMAC:
        createHMACKey(buf, startOff, length);
        break;
      default:
        CryptoException.throwIt(CryptoException.NO_SUCH_ALGORITHM);
        break;
    }
    return true;
  }

  @Override
  public boolean importAsymmetricKey(
      byte alg,
      byte[] privKeyBuf,
      short privKeyStart,
      short privKeyLength,
      byte[] pubModBuf,
      short pubModStart,
      short pubModLength) {
    switch (alg) {
      case KMType.RSA:
        createRsaKey(pubModBuf, pubModStart, pubModLength, privKeyBuf, privKeyStart, privKeyLength);
        break;
      case KMType.EC:
        createEcKey(privKeyBuf, privKeyStart, privKeyLength);
        break;
      default:
        CryptoException.throwIt(CryptoException.NO_SUCH_ALGORITHM);
        break;
    }
    return true;
  }

  @Override
  public void getTrueRandomNumber(byte[] buf, short start, short length) {
    newRandomNumber(buf, start, length);
  }

  @Override
  public void newRandomNumber(byte[] num, short startOff, short length) {
    rng.nextBytes(num, startOff, length);
  }

  @Override
  public void addRngEntropy(byte[] num, short offset, short length) {
    rng.setSeed(num, offset, length);
  }

  public short aesGCMEncrypt(
      AESKey key,
      byte[] secret,
      short secretStart,
      short secretLen,
      byte[] encSecret,
      short encSecretStart,
      byte[] nonce,
      short nonceStart,
      short nonceLen,
      byte[] authData,
      short authDataStart,
      short authDataLen,
      byte[] authTag,
      short authTagStart,
      short authTagLen) {
    if (authTagLen != AES_GCM_TAG_LENGTH) {
      CryptoException.throwIt(CryptoException.ILLEGAL_VALUE);
    }
    if (nonceLen != AES_GCM_NONCE_LENGTH) {
      CryptoException.throwIt(CryptoException.ILLEGAL_VALUE);
    }
    if (aesGcmCipher == null) {
      aesGcmCipher = (AEADCipher) Cipher.getInstance(AEADCipher.ALG_AES_GCM, false);
    }
    aesGcmCipher.init(key, Cipher.MODE_ENCRYPT, nonce, nonceStart, nonceLen);
    if (authDataLen != 0) {
      aesGcmCipher.updateAAD(authData, authDataStart, authDataLen);
    }
    short ciphLen = aesGcmCipher.doFinal(secret, secretStart, secretLen, encSecret, encSecretStart);
    aesGcmCipher.retrieveTag(authTag, authTagStart, authTagLen);
    return ciphLen;
  }

  @Override
  public short aesGCMEncrypt(
      byte[] aesKey,
      short aesKeyStart,
      short aesKeyLen,
      byte[] secret,
      short secretStart,
      short secretLen,
      byte[] encSecret,
      short encSecretStart,
      byte[] nonce,
      short nonceStart,
      short nonceLen,
      byte[] authData,
      short authDataStart,
      short authDataLen,
      byte[] authTag,
      short authTagStart,
      short authTagLen) {

    AESKey key = createAESKey(aesKey, aesKeyStart, aesKeyLen);
    return aesGCMEncrypt(
        key,
        secret,
        secretStart,
        secretLen,
        encSecret,
        encSecretStart,
        nonce,
        nonceStart,
        nonceLen,
        authData,
        authDataStart,
        authDataLen,
        authTag,
        authTagStart,
        authTagLen);
  }

  @Override
  public boolean aesGCMDecrypt(
      byte[] aesKey,
      short aesKeyStart,
      short aesKeyLen,
      byte[] encSecret,
      short encSecretStart,
      short encSecretLen,
      byte[] secret,
      short secretStart,
      byte[] nonce,
      short nonceStart,
      short nonceLen,
      byte[] authData,
      short authDataStart,
      short authDataLen,
      byte[] authTag,
      short authTagStart,
      short authTagLen) {
    if (aesGcmCipher == null) {
      aesGcmCipher = (AEADCipher) Cipher.getInstance(AEADCipher.ALG_AES_GCM, false);
    }
    boolean verification = false;
    AESKey key = createAESKey(aesKey, aesKeyStart, aesKeyLen);
    aesGcmCipher.init(key, Cipher.MODE_DECRYPT, nonce, nonceStart, nonceLen);
    if (authDataLen != 0) {
      aesGcmCipher.updateAAD(authData, authDataStart, authDataLen);
    }
    // encrypt the secret
    aesGcmCipher.doFinal(encSecret, encSecretStart, encSecretLen, secret, secretStart);
    verification =
        aesGcmCipher.verifyTag(
            authTag, authTagStart, (short) authTagLen, (short) AES_GCM_TAG_LENGTH);
    return verification;
  }

  public HMACKey cmacKdf(
      KMKey preSharedKey,
      byte[] label,
      short labelStart,
      short labelLen,
      byte[] context,
      short contextStart,
      short contextLength) {
    // Note: the variables i and L correspond to i and L in the standard.  See page 12 of
    // http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-108.pdf.
    try {
      // This is hardcoded to requirement - 32 byte output with two concatenated
      // 16 bytes K1 and K2.
      final byte n = 2; // hardcoded

      // [i] counter - 32 bits
      short iBufLen = 4;
      short keyOutLen = n * 16;
      // Convert Hmackey to AES Key as the algorithm is ALG_AES_CMAC_128.
      KMHmacKey hmacKey = ((KMHmacKey) preSharedKey);
      hmacKey.hmacKey.getKey(tmpArray, (short) 0);
      aesKeys[KEYSIZE_256_OFFSET].setKey(tmpArray, (short) 0);
      // Initialize the key derivation function.
      kdf.init(aesKeys[KEYSIZE_256_OFFSET], Signature.MODE_SIGN);
      // Clear the tmpArray buffer.
      Util.arrayFillNonAtomic(tmpArray, (short) 0, (short) 256, (byte) 0);

      Util.arrayFillNonAtomic(tmpArray, (short) 0, iBufLen, (byte) 0);
      Util.arrayFillNonAtomic(tmpArray, (short) iBufLen, keyOutLen, (byte) 0);

      byte i = 1;
      short pos = 0;
      while (i <= n) {
        tmpArray[3] = i;
        // 4 bytes of iBuf with counter in it
        kdf.update(tmpArray, (short) 0, (short) iBufLen);
        kdf.update(label, labelStart, (short) labelLen); // label
        kdf.update(
            CMAC_KDF_CONSTANT_ZERO,
            (short) 0,
            (short) CMAC_KDF_CONSTANT_ZERO.length); // 1 byte of 0x00
        kdf.update(context, contextStart, contextLength); // context
        // 4 bytes of L - signature of 16 bytes
        pos =
            kdf.sign(
                CMAC_KDF_CONSTANT_L,
                (short) 0,
                (short) CMAC_KDF_CONSTANT_L.length,
                tmpArray,
                (short) (iBufLen + pos));
        i++;
      }
      return createHMACKey(tmpArray, (short) iBufLen, (short) keyOutLen);
    } finally {
      clean();
    }
  }

  public short hmacSign(
      HMACKey key, byte[] data, short dataStart, short dataLength, byte[] mac, short macStart) {
    hmacSignature.init(key, Signature.MODE_SIGN);
    return hmacSignature.sign(data, dataStart, dataLength, mac, macStart);
  }

  @Override
  public short hmacSign(
      byte[] keyBuf,
      short keyStart,
      short keyLength,
      byte[] data,
      short dataStart,
      short dataLength,
      byte[] mac,
      short macStart) {
    HMACKey key = createHMACKey(keyBuf, keyStart, keyLength);
    return hmacSign(key, data, dataStart, dataLength, mac, macStart);
  }

  @Override
  public short hmacSign(
      Object key, byte[] data, short dataStart, short dataLength, byte[] mac, short macStart) {
    if (!(key instanceof KMHmacKey)) {
      KMException.throwIt(KMError.INVALID_ARGUMENT);
    }
    KMHmacKey hmacKey = (KMHmacKey) key;
    return hmacSign(hmacKey.hmacKey, data, dataStart, dataLength, mac, macStart);
  }

  @Override
  public short hmacKDF(
      KMKey masterkey,
      byte[] data,
      short dataStart,
      short dataLength,
      byte[] signature,
      short signatureStart) {
    try {
      KMAESKey aesKey = (KMAESKey) masterkey;
      short keyLen = (short) (aesKey.aesKey.getSize() / 8);
      aesKey.aesKey.getKey(tmpArray, (short) 0);
      return hmacSign(
          tmpArray, (short) 0, keyLen, data, dataStart, dataLength, signature, signatureStart);
    } finally {
      clean();
    }
  }

  @Override
  public boolean hmacVerify(
      KMKey key,
      byte[] data,
      short dataStart,
      short dataLength,
      byte[] mac,
      short macStart,
      short macLength) {
    KMHmacKey hmacKey = (KMHmacKey) key;
    hmacSignature.init(hmacKey.hmacKey, Signature.MODE_VERIFY);
    return hmacSignature.verify(data, dataStart, dataLength, mac, macStart, macLength);
  }

  @Override
  public short rsaDecipherOAEP256(
      byte[] secret,
      short secretStart,
      short secretLength,
      byte[] modBuffer,
      short modOff,
      short modLength,
      byte[] inputDataBuf,
      short inputDataStart,
      short inputDataLength,
      byte[] outputDataBuf,
      short outputDataStart) {
    RSAPrivateKey key = (RSAPrivateKey) rsaKeyPair.getPrivate();
    key.setExponent(secret, (short) secretStart, (short) secretLength);
    key.setModulus(modBuffer, (short) modOff, (short) modLength);
    rsaOaepDecipher.init(key, Cipher.MODE_DECRYPT);
    return rsaOaepDecipher.doFinal(
        inputDataBuf,
        (short) inputDataStart,
        (short) inputDataLength,
        outputDataBuf,
        (short) outputDataStart);
  }

  private byte mapSignature256Alg(byte alg, byte padding, byte digest) {
    switch (alg) {
      case KMType.RSA:
        switch (padding) {
          case KMType.RSA_PKCS1_1_5_SIGN:
            {
              if (digest == KMType.DIGEST_NONE) {
                return KMRsa2048NoDigestSignature.ALG_RSA_PKCS1_NODIGEST;
              } else {
                return Signature.ALG_RSA_SHA_256_PKCS1;
              }
            }
          case KMType.RSA_PSS:
            return Signature.ALG_RSA_SHA_256_PKCS1_PSS;
          case KMType.PADDING_NONE:
            return KMRsa2048NoDigestSignature.ALG_RSA_SIGN_NOPAD;
        }
        break;
      case KMType.EC:
        if (digest == KMType.DIGEST_NONE) {
          return KMEcdsa256NoDigestSignature.ALG_ECDSA_NODIGEST;
        } else {
          return Signature.ALG_ECDSA_SHA_256;
        }
      case KMType.HMAC:
        return Signature.ALG_HMAC_SHA_256;
    }
    return -1;
  }

  private byte mapCipherAlg(byte alg, byte padding, byte blockmode, byte digest) {
    switch (alg) {
      case KMType.AES:
        switch (blockmode) {
          case KMType.ECB:
            return Cipher.ALG_AES_BLOCK_128_ECB_NOPAD;
          case KMType.CBC:
            return Cipher.ALG_AES_BLOCK_128_CBC_NOPAD;
          case KMType.CTR:
            return Cipher.ALG_AES_CTR;
          case KMType.GCM:
            return AEADCipher.ALG_AES_GCM;
        }
        break;
      case KMType.DES:
        switch (blockmode) {
          case KMType.ECB:
            return Cipher.ALG_DES_ECB_NOPAD;
          case KMType.CBC:
            return Cipher.ALG_DES_CBC_NOPAD;
        }
        break;
      case KMType.RSA:
        switch (padding) {
          case KMType.PADDING_NONE:
            return Cipher.ALG_RSA_NOPAD;
          case KMType.RSA_PKCS1_1_5_ENCRYPT:
            return Cipher.ALG_RSA_PKCS1;
          case KMType.RSA_OAEP:
            {
              if (digest == KMType.SHA1) {
                /* MGF Digest is SHA1 */
                return KMRsaOAEPEncoding.ALG_RSA_PKCS1_OAEP_SHA256_MGF1_SHA1;
              } else if (digest == KMType.SHA2_256) {
                /* MGF Digest is SHA256 */
                return KMRsaOAEPEncoding.ALG_RSA_PKCS1_OAEP_SHA256_MGF1_SHA256;
              } else {
                KMException.throwIt(KMError.UNSUPPORTED_ALGORITHM);
              }
            }
        }
        break;
    }
    return -1;
  }

  public KMOperation createSymmetricCipher(
      short alg,
      short purpose,
      short macLength,
      short blockMode,
      short padding,
      byte[] secret,
      short secretStart,
      short secretLength,
      byte[] ivBuffer,
      short ivStart,
      short ivLength,
      boolean isRkp) {

    short cipherAlg = mapCipherAlg((byte) alg, (byte) padding, (byte) blockMode, (byte) 0);
    KMOperation operation = null;
    if (isRkp) {
      operation = poolMgr.getRKpOperation(purpose, cipherAlg, alg, padding, blockMode, macLength);
    } else {
      operation =
          poolMgr.getOperationImpl(
              purpose, cipherAlg, alg, padding, blockMode, macLength, secretLength, false);
    }
    // Get the KeyObject from the operation and update the key with the secret key material.
    KMKeyObject keyObj = operation.getKeyObject();
    Key key = (Key) keyObj.keyObjectInst;
    switch (secretLength) {
      case 32:
      case 16:
        ((AESKey) key).setKey(secret, secretStart);
        break;
      case 24:
        ((DESKey) key).setKey(secret, secretStart);
        break;
      default:
        CryptoException.throwIt(CryptoException.ILLEGAL_VALUE);
        break;
    }
    ((KMOperationImpl) operation).init(key, KMType.INVALID_VALUE, ivBuffer, ivStart, ivLength);
    return operation;
  }

  public KMOperation createHmacSignerVerifier(
      short purpose,
      short digest,
      byte[] secret,
      short secretStart,
      short secretLength,
      boolean isRkp) {
    KMOperation operation = null;
    if (digest != KMType.SHA2_256) {
      CryptoException.throwIt(CryptoException.ILLEGAL_VALUE);
    }
    if (isRkp) {
      operation =
          poolMgr.getRKpOperation(
              purpose,
              Signature.ALG_HMAC_SHA_256,
              KMType.HMAC,
              KMType.INVALID_VALUE,
              KMType.INVALID_VALUE,
              KMType.INVALID_VALUE);
    } else {
      operation =
          poolMgr.getOperationImpl(
              purpose,
              Signature.ALG_HMAC_SHA_256,
              KMType.HMAC,
              KMType.INVALID_VALUE,
              KMType.INVALID_VALUE,
              KMType.INVALID_VALUE,
              (short) 0,
              false);
    }
    // Get the KeyObject from the operation and update the key with the secret key material.
    KMKeyObject keyObj = operation.getKeyObject();
    HMACKey key = (HMACKey) keyObj.keyObjectInst;
    key.setKey(secret, secretStart, secretLength);
    ((KMOperationImpl) operation).init(key, digest, null, (short) 0, (short) 0);
    return operation;
  }

  private KMOperation createHmacSignerVerifier(
      short purpose, short digest, HMACKey hmacKey, boolean isTrustedConf) {
    if (digest != KMType.SHA2_256) {
      CryptoException.throwIt(CryptoException.ILLEGAL_VALUE);
    }
    KMOperation operation =
        poolMgr.getOperationImpl(
            purpose,
            Signature.ALG_HMAC_SHA_256,
            KMType.HMAC,
            KMType.INVALID_VALUE,
            KMType.INVALID_VALUE,
            KMType.INVALID_VALUE,
            (short) 0,
            isTrustedConf);
    // Get the KeyObject from the operation and update the key with the secret key material.
    KMKeyObject keyObj = operation.getKeyObject();
    HMACKey key = (HMACKey) keyObj.keyObjectInst;
    short len = hmacKey.getKey(tmpArray, (short) 0);
    key.setKey(tmpArray, (short) 0, len);
    ((KMOperationImpl) operation).init(key, digest, null, (short) 0, (short) 0);
    return operation;
  }

  @Override
  public KMOperation getRkpOperation(
      byte purpose,
      byte alg,
      byte digest,
      byte padding,
      byte blockMode,
      KMKey keyPair,
      byte[] ivBuf,
      short ivStart,
      short ivLength,
      short macLength) {
    KMOperation opr = null;
    switch (alg) {
      case KMType.EC:
        // get EC private key buffer
        ECPrivateKey ecPrivKey =
            (ECPrivateKey) ((KMECDeviceUniqueKeyPair) keyPair).ecKeyPair.getPrivate();
        short ecPrivKeyLen = ecPrivKey.getS(tmpArray, (short) 0);
        opr = createEcSigner(digest, tmpArray, (short) 0, ecPrivKeyLen, true /* isRKP */);
        break;
      default:
        CryptoException.throwIt(CryptoException.NO_SUCH_ALGORITHM);
        break;
    }
    return opr;
  }

  @Override
  public KMOperation initSymmetricOperation(
      byte purpose,
      byte alg,
      byte digest,
      byte padding,
      byte blockMode,
      byte[] keyBuf,
      short keyStart,
      short keyLength,
      byte[] ivBuf,
      short ivStart,
      short ivLength,
      short macLength) {
    KMOperation opr = null;
    switch (alg) {
      case KMType.AES:
      case KMType.DES:
        // Convert macLength to bytes
        macLength = (short) (macLength / 8);
        opr =
            createSymmetricCipher(
                alg,
                purpose,
                macLength,
                blockMode,
                padding,
                keyBuf,
                keyStart,
                keyLength,
                ivBuf,
                ivStart,
                ivLength,
                false /* isRKP */);
        break;
      case KMType.HMAC:
        opr =
            createHmacSignerVerifier(
                purpose, digest, keyBuf, keyStart, keyLength, false /* isRKP */);
        break;
      default:
        CryptoException.throwIt(CryptoException.NO_SUCH_ALGORITHM);
        break;
    }
    return opr;
  }

  @Override
  public KMOperation initSymmetricOperation(
      byte purpose,
      byte alg,
      byte digest,
      byte padding,
      byte blockMode,
      Object key,
      byte interfaceType,
      byte[] ivBuf,
      short ivStart,
      short ivLength,
      short macLength,
      boolean oneShot) {
    short keyLen = 0;
    globalOperation.setPurpose(purpose);
    globalOperation.setAlgorithmType(alg);
    globalOperation.setPaddingAlgorithm(padding);
    globalOperation.setBlockMode(blockMode);
    try {
      switch (interfaceType) {
        case KMDataStoreConstants.INTERFACE_TYPE_MASTER_KEY:
          KMAESKey aesKey = (KMAESKey) key;
          keyLen = (short) (aesKey.aesKey.getSize() / 8);
          aesKey.aesKey.getKey(tmpArray, (short) 0);
          break;

        default:
          KMException.throwIt(KMError.INVALID_ARGUMENT);
      }

      switch (alg) {
        case KMType.HMAC:
          HMACKey hmackey = createHMACKey(tmpArray, (short) 0, keyLen);
          globalOperation.setSignature(hmacSignature);
          globalOperation.init(hmackey, digest, null, (short) 0, (short) 0);
          break;

        default:
          KMException.throwIt(KMError.INVALID_ARGUMENT);
      }
    } finally {
      clean();
    }
    return globalOperation;
  }

  @Override
  public KMOperation initTrustedConfirmationSymmetricOperation(KMKey computedHmacKey) {
    KMHmacKey key = (KMHmacKey) computedHmacKey;
    return createHmacSignerVerifier(KMType.VERIFY, KMType.SHA2_256, key.hmacKey, true);
  }

  public KMOperation createRsaSigner(
      short digest,
      short padding,
      byte[] secret,
      short secretStart,
      short secretLength,
      byte[] modBuffer,
      short modOff,
      short modLength) {
    byte alg = mapSignature256Alg(KMType.RSA, (byte) padding, (byte) digest);
    KMOperation operation =
        poolMgr.getOperationImpl(
            KMType.SIGN,
            alg,
            KMType.RSA,
            padding,
            KMType.INVALID_VALUE,
            KMType.INVALID_VALUE,
            secretLength,
            false);
    // Get the KeyObject from the operation and update the key with the secret key material.
    KMKeyObject keyObj = operation.getKeyObject();
    RSAPrivateKey key = (RSAPrivateKey) ((KeyPair) (keyObj.keyObjectInst)).getPrivate();
    key.setExponent(secret, secretStart, secretLength);
    key.setModulus(modBuffer, modOff, modLength);
    ((KMOperationImpl) operation).init(key, digest, null, (short) 0, (short) 0);
    return operation;
  }

  public KMOperation createRsaDecipher(
      short padding,
      short mgfDigest,
      byte[] secret,
      short secretStart,
      short secretLength,
      byte[] modBuffer,
      short modOff,
      short modLength) {
    byte cipherAlg = mapCipherAlg(KMType.RSA, (byte) padding, (byte) 0, (byte) mgfDigest);
    KMOperation operation =
        poolMgr.getOperationImpl(
            KMType.DECRYPT,
            cipherAlg,
            KMType.RSA,
            padding,
            KMType.INVALID_VALUE,
            KMType.INVALID_VALUE,
            secretLength,
            false);
    // Get the KeyObject from the operation and update the key with the secret key material.
    KMKeyObject keyObj = operation.getKeyObject();
    RSAPrivateKey key = (RSAPrivateKey) ((KeyPair) (keyObj.keyObjectInst)).getPrivate();
    key.setExponent(secret, secretStart, secretLength);
    key.setModulus(modBuffer, modOff, modLength);
    ((KMOperationImpl) operation).init(key, KMType.INVALID_VALUE, null, (short) 0, (short) 0);
    return operation;
  }

  public KMOperation createEcSigner(
      short digest, byte[] secret, short secretStart, short secretLength, boolean isRkp) {
    KMOperation operation = null;
    byte alg = mapSignature256Alg(KMType.EC, (byte) 0, (byte) digest);
    if (isRkp) {
      operation =
          poolMgr.getRKpOperation(
              KMType.SIGN,
              Signature.ALG_ECDSA_SHA_256,
              KMType.EC,
              KMType.INVALID_VALUE,
              KMType.INVALID_VALUE,
              KMType.INVALID_VALUE);
    } else {
      operation =
          poolMgr.getOperationImpl(
              KMType.SIGN,
              alg,
              KMType.EC,
              KMType.INVALID_VALUE,
              KMType.INVALID_VALUE,
              KMType.INVALID_VALUE,
              secretLength,
              false);
    }
    KMKeyObject keyObj = operation.getKeyObject();
    ECPrivateKey key = (ECPrivateKey) ((KeyPair) (keyObj.keyObjectInst)).getPrivate();
    key.setS(secret, secretStart, secretLength);
    ((KMOperationImpl) operation).init(key, digest, null, (short) 0, (short) 0);
    return operation;
  }

  public KMOperation createKeyAgreement(byte[] secret, short secretStart, short secretLength) {
    KMOperation operation =
        poolMgr.getOperationImpl(
            KMType.AGREE_KEY,
            KeyAgreement.ALG_EC_SVDP_DH_PLAIN,
            KMType.EC,
            KMType.INVALID_VALUE,
            KMType.INVALID_VALUE,
            KMType.INVALID_VALUE,
            (short) 0,
            false);
    KMKeyObject keyObj = operation.getKeyObject();
    ECPrivateKey key = (ECPrivateKey) ((KeyPair) (keyObj.keyObjectInst)).getPrivate();
    key.setS(secret, secretStart, secretLength);
    ((KMOperationImpl) operation).init(key, KMType.INVALID_VALUE, null, (short) 0, (short) 0);
    return operation;
  }

  @Override
  public KMOperation initAsymmetricOperation(
      byte purpose,
      byte alg,
      byte padding,
      byte digest,
      byte mgfDigest,
      byte[] privKeyBuf,
      short privKeyStart,
      short privKeyLength,
      byte[] pubModBuf,
      short pubModStart,
      short pubModLength) {
    KMOperation opr = null;
    if (alg == KMType.RSA) {
      switch (purpose) {
        case KMType.SIGN:
          opr =
              createRsaSigner(
                  digest,
                  padding,
                  privKeyBuf,
                  privKeyStart,
                  privKeyLength,
                  pubModBuf,
                  pubModStart,
                  pubModLength);
          break;
        case KMType.DECRYPT:
          opr =
              createRsaDecipher(
                  padding,
                  mgfDigest,
                  privKeyBuf,
                  privKeyStart,
                  privKeyLength,
                  pubModBuf,
                  pubModStart,
                  pubModLength);
          break;
        default:
          KMException.throwIt(KMError.UNSUPPORTED_PURPOSE);
          break;
      }
    } else if (alg == KMType.EC) {
      switch (purpose) {
        case KMType.SIGN:
          opr = createEcSigner(digest, privKeyBuf, privKeyStart, privKeyLength, false);
          break;

        case KMType.AGREE_KEY:
          opr = createKeyAgreement(privKeyBuf, privKeyStart, privKeyLength);
          break;
        default:
          KMException.throwIt(KMError.UNSUPPORTED_PURPOSE);
          break;
      }
    } else {
      CryptoException.throwIt(CryptoException.NO_SUCH_ALGORITHM);
    }
    return opr;
  }

  @Override
  public short cmacKDF(
      KMKey pSharedKey,
      byte[] label,
      short labelStart,
      short labelLen,
      byte[] context,
      short contextStart,
      short contextLength,
      byte[] keyBuf,
      short keyStart) {
    HMACKey key =
        cmacKdf(pSharedKey, label, labelStart, labelLen, context, contextStart, contextLength);
    return key.getKey(keyBuf, keyStart);
  }

  @Override
  public boolean isUpgrading() {
    return UpgradeManager.isUpgrading();
  }

  @Override
  public KMKey createMasterKey(KMKey masterKey, short keySizeBits) {
    try {
      if (masterKey == null) {
        AESKey key = (AESKey) KeyBuilder.buildKey(KeyBuilder.TYPE_AES, keySizeBits, false);
        masterKey = new KMAESKey(key);
      }
      short keyLen = (short) (keySizeBits / 8);
      Util.arrayFillNonAtomic(tmpArray, (short) 0, keyLen, (byte) 0);
      getTrueRandomNumber(tmpArray, (short) 0, keyLen);
      ((KMAESKey) masterKey).aesKey.setKey(tmpArray, (short) 0);
      return (KMKey) masterKey;
    } finally {
      clean();
    }
  }

  @Override
  public KMKey createPreSharedKey(KMKey preSharedKey, byte[] keyData, short offset, short length) {
    short lengthInBits = (short) (length * 8);
    if ((lengthInBits % 8 != 0) || !(lengthInBits >= 64 && lengthInBits <= 512)) {
      CryptoException.throwIt(CryptoException.ILLEGAL_VALUE);
    }
    if (preSharedKey == null) {
      HMACKey key = (HMACKey) KeyBuilder.buildKey(KeyBuilder.TYPE_HMAC, lengthInBits, false);
      preSharedKey = new KMHmacKey(key);
    }
    ((KMHmacKey) preSharedKey).hmacKey.setKey(keyData, offset, length);
    return (KMKey) preSharedKey;
  }

  @Override
  public KMKey createComputedHmacKey(
      KMKey computedHmacKey, byte[] keyData, short offset, short length) {
    if (length != COMPUTED_HMAC_KEY_SIZE) {
      CryptoException.throwIt(CryptoException.ILLEGAL_VALUE);
    }
    if (computedHmacKey == null) {
      HMACKey key =
          (HMACKey) KeyBuilder.buildKey(KeyBuilder.TYPE_HMAC, (short) (length * 8), false);
      computedHmacKey = new KMHmacKey(key);
    }
    ((KMHmacKey) computedHmacKey).hmacKey.setKey(keyData, offset, length);
    return (KMKey) computedHmacKey;
  }

  @Override
  public short ecSign256(
      byte[] secret,
      short secretStart,
      short secretLength,
      byte[] inputDataBuf,
      short inputDataStart,
      short inputDataLength,
      byte[] outputDataBuf,
      short outputDataStart) {

    ECPrivateKey key = (ECPrivateKey) ecKeyPair.getPrivate();
    key.setS(secret, secretStart, secretLength);

    Signature.OneShot signer = null;
    try {

      signer =
          Signature.OneShot.open(
              MessageDigest.ALG_SHA_256, Signature.SIG_CIPHER_ECDSA, Cipher.PAD_NULL);
      signer.init(key, Signature.MODE_SIGN);
      return signer.sign(
          inputDataBuf, inputDataStart, inputDataLength, outputDataBuf, outputDataStart);
    } finally {
      if (signer != null) {
        signer.close();
      }
    }
  }

  @Override
  public short rsaSign256Pkcs1(
      byte[] secret,
      short secretStart,
      short secretLength,
      byte[] modBuf,
      short modStart,
      short modLength,
      byte[] inputDataBuf,
      short inputDataStart,
      short inputDataLength,
      byte[] outputDataBuf,
      short outputDataStart) {

    Signature.OneShot signer = null;
    try {

      signer =
          Signature.OneShot.open(
              MessageDigest.ALG_SHA_256, Signature.SIG_CIPHER_RSA, Cipher.PAD_PKCS1);

      RSAPrivateKey key = (RSAPrivateKey) rsaKeyPair.getPrivate();
      key.setExponent(secret, secretStart, secretLength);
      key.setModulus(modBuf, modStart, modLength);

      signer.init(key, Signature.MODE_SIGN);
      return signer.sign(
          inputDataBuf, inputDataStart, inputDataLength, outputDataBuf, outputDataStart);
    } finally {
      if (signer != null) {
        signer.close();
      }
    }
  }

  @Override
  public boolean isAttestationKeyProvisioned() {
    return false;
  }

  @Override
  public short getAttestationKeyAlgorithm() {
    return KMType.INVALID_VALUE;
  }

  @Override
  public short hkdf(
      byte[] ikm,
      short ikmOff,
      short ikmLen,
      byte[] salt,
      short saltOff,
      short saltLen,
      byte[] info,
      short infoOff,
      short infoLen,
      byte[] out,
      short outOff,
      short outLen) {
    // HMAC_extract
    hkdfExtract(ikm, ikmOff, ikmLen, salt, saltOff, saltLen, tmpArray, (short) 0);
    // HMAC_expand
    return hkdfExpand(tmpArray, (short) 0, (short) 32, info, infoOff, infoLen, out, outOff, outLen);
  }

  private short hkdfExtract(
      byte[] ikm,
      short ikmOff,
      short ikmLen,
      byte[] salt,
      short saltOff,
      short saltLen,
      byte[] out,
      short off) {
    // https://tools.ietf.org/html/rfc5869#section-2.2
    HMACKey hmacKey = createHMACKey(salt, saltOff, saltLen);
    hmacSignature.init(hmacKey, Signature.MODE_SIGN);
    return hmacSignature.sign(ikm, ikmOff, ikmLen, out, off);
  }

  private short hkdfExpand(
      byte[] prk,
      short prkOff,
      short prkLen,
      byte[] info,
      short infoOff,
      short infoLen,
      byte[] out,
      short outOff,
      short outLen) {
    // https://tools.ietf.org/html/rfc5869#section-2.3
    short digestLen = (short) 32; // SHA256 digest length.
    // Calculate no of iterations N.
    short n = (short) ((short) (outLen + digestLen - 1) / digestLen);
    if (n > 255) {
      CryptoException.throwIt(CryptoException.ILLEGAL_VALUE);
    }
    HMACKey hmacKey = createHMACKey(prk, prkOff, prkLen);
    Util.arrayFill(tmpArray, (short) 0, (short) 33, (byte) 0);
    short bytesCopied = 0;
    short len = 0;
    for (short i = 0; i < n; i++) {
      tmpArray[0]++;
      hmacSignature.init(hmacKey, Signature.MODE_SIGN);
      if (i != 0) {
        hmacSignature.update(tmpArray, (short) 1, (short) 32);
      }
      hmacSignature.update(info, infoOff, infoLen);
      len = hmacSignature.sign(tmpArray, (short) 0, (short) 1, tmpArray, (short) 1);
      if ((short) (bytesCopied + len) > outLen) {
        len = (short) (outLen - bytesCopied);
      }
      Util.arrayCopyNonAtomic(tmpArray, (short) 1, out, (short) (outOff + bytesCopied), len);
      bytesCopied += len;
    }
    return outLen;
  }

  @Override
  public short ecdhKeyAgreement(
      byte[] privKey,
      short privKeyOff,
      short privKeyLen,
      byte[] publicKey,
      short publicKeyOff,
      short publicKeyLen,
      byte[] secret,
      short secretOff) {
    keyAgreement.init(createEcKey(privKey, privKeyOff, privKeyLen));
    return keyAgreement.generateSecret(publicKey, publicKeyOff, publicKeyLen, secret, secretOff);
  }

  @Override
  public boolean ecVerify256(
      byte[] pubKey,
      short pubKeyOffset,
      short pubKeyLen,
      byte[] inputDataBuf,
      short inputDataStart,
      short inputDataLength,
      byte[] signatureDataBuf,
      short signatureDataStart,
      short signatureDataLen) {
    Signature.OneShot signer = null;
    try {
      signer =
          Signature.OneShot.open(
              MessageDigest.ALG_SHA_256, Signature.SIG_CIPHER_ECDSA, Cipher.PAD_NULL);
      ECPublicKey key = (ECPublicKey) ecKeyPair.getPublic();
      key.setW(pubKey, pubKeyOffset, pubKeyLen);
      signer.init(key, Signature.MODE_VERIFY);
      return signer.verify(
          inputDataBuf,
          inputDataStart,
          inputDataLength,
          signatureDataBuf,
          signatureDataStart,
          (short) (signatureDataBuf[(short) (signatureDataStart + 1)] + 2));
    } finally {
      if (signer != null) {
        signer.close();
      }
    }
  }

  @Override
  public short signWithDeviceUniqueKey(
      KMKey ecPrivKey,
      byte[] inputDataBuf,
      short inputDataStart,
      short inputDataLength,
      byte[] outputDataBuf,
      short outputDataStart) {
    Signature.OneShot signer = null;
    try {
      signer =
          Signature.OneShot.open(
              MessageDigest.ALG_SHA_256, Signature.SIG_CIPHER_ECDSA, Cipher.PAD_NULL);
      signer.init(
          ((KMECDeviceUniqueKeyPair) ecPrivKey).ecKeyPair.getPrivate(), Signature.MODE_SIGN);
      return signer.sign(
          inputDataBuf, inputDataStart, inputDataLength, outputDataBuf, outputDataStart);
    } finally {
      if (signer != null) {
        signer.close();
      }
    }
  }

  @Override
  public KMKey createRkpDeviceUniqueKeyPair(
      KMKey key,
      byte[] pubKey,
      short pubKeyOff,
      short pubKeyLen,
      byte[] privKey,
      short privKeyOff,
      short privKeyLen) {
    if (key == null) {
      KeyPair ecKeyPair = new KeyPair(KeyPair.ALG_EC_FP, KeyBuilder.LENGTH_EC_FP_256);
      poolMgr.initECKey(ecKeyPair);
      key = new KMECDeviceUniqueKeyPair(ecKeyPair);
    }
    ECPrivateKey ecKeyPair = (ECPrivateKey) ((KMECDeviceUniqueKeyPair) key).ecKeyPair.getPrivate();
    ECPublicKey ecPublicKey = (ECPublicKey) ((KMECDeviceUniqueKeyPair) key).ecKeyPair.getPublic();
    ecKeyPair.setS(privKey, privKeyOff, privKeyLen);
    ecPublicKey.setW(pubKey, pubKeyOff, pubKeyLen);
    return (KMKey) key;
  }

  @Override
  public KMKey createRkpMacKey(KMKey rkpMacKey, byte[] keyData, short offset, short length) {
    if (rkpMacKey == null) {
      HMACKey key =
          (HMACKey) KeyBuilder.buildKey(KeyBuilder.TYPE_HMAC, (short) (length * 8), false);
      rkpMacKey = new KMHmacKey(key);
    }
    ((KMHmacKey) rkpMacKey).hmacKey.setKey(keyData, offset, length);
    return rkpMacKey;
  }

  @Override
  public short messageDigest256(
      byte[] inBuff, short inOffset, short inLength, byte[] outBuff, short outOffset) {
    MessageDigest.OneShot mDigest = null;
    short len = 0;
    try {
      mDigest = MessageDigest.OneShot.open(MessageDigest.ALG_SHA_256);
      len = mDigest.doFinal(inBuff, inOffset, inLength, outBuff, outOffset);
    } finally {
      if (mDigest != null) {
        mDigest.close();
        mDigest = null;
      }
    }
    return len;
  }

  public boolean isPowerReset() {
    boolean flag = false;
    if (resetFlag[0] == POWER_RESET_TRUE) {
      resetFlag[0] = POWER_RESET_FALSE;
      flag = true;
      if (poolMgr != null) {
        poolMgr.powerReset();
      }
    }
    return flag;
  }

  @Override
  public void onSave(Element element, byte interfaceType, Object object) {
    element.write(interfaceType);
    if (object == null) {
      element.write(null);
      return;
    }
    switch (interfaceType) {
      case KMDataStoreConstants.INTERFACE_TYPE_MASTER_KEY:
        KMAESKey.onSave(element, (KMAESKey) object);
        break;
      case KMDataStoreConstants.INTERFACE_TYPE_PRE_SHARED_KEY:
        KMHmacKey.onSave(element, (KMHmacKey) object);
        break;
      case KMDataStoreConstants.INTERFACE_TYPE_DEVICE_UNIQUE_KEY_PAIR:
        KMECDeviceUniqueKeyPair.onSave(element, (KMECDeviceUniqueKeyPair) object);
        break;
      case KMDataStoreConstants.INTERFACE_TYPE_RKP_MAC_KEY:
        KMHmacKey.onSave(element, (KMHmacKey) object);
        break;
      default:
        ISOException.throwIt(ISO7816.SW_CONDITIONS_NOT_SATISFIED);
    }
  }

  @Override
  public Object onRestore(Element element) {
    if (element == null) {
      return null;
    }
    byte interfaceType = element.readByte();
    switch (interfaceType) {
      case KMDataStoreConstants.INTERFACE_TYPE_COMPUTED_HMAC_KEY:
        return KMHmacKey.onRestore((HMACKey) element.readObject());
      case KMDataStoreConstants.INTERFACE_TYPE_MASTER_KEY:
        return KMAESKey.onRestore((AESKey) element.readObject());
      case KMDataStoreConstants.INTERFACE_TYPE_PRE_SHARED_KEY:
        return KMHmacKey.onRestore((HMACKey) element.readObject());
      case KMDataStoreConstants.INTERFACE_TYPE_DEVICE_UNIQUE_KEY_PAIR:
        return KMECDeviceUniqueKeyPair.onRestore((KeyPair) element.readObject());
      case KMDataStoreConstants.INTERFACE_TYPE_RKP_MAC_KEY:
        return KMHmacKey.onRestore((HMACKey) element.readObject());
      default:
        ISOException.throwIt(ISO7816.SW_CONDITIONS_NOT_SATISFIED);
    }
    return null;
  }

  @Override
  public short getBackupPrimitiveByteCount(byte interfaceType) {
    short primitiveCount = 1; // interface type
    switch (interfaceType) {
      case KMDataStoreConstants.INTERFACE_TYPE_MASTER_KEY:
        primitiveCount += KMAESKey.getBackupPrimitiveByteCount();
        break;
      case KMDataStoreConstants.INTERFACE_TYPE_PRE_SHARED_KEY:
        primitiveCount += KMHmacKey.getBackupPrimitiveByteCount();
        break;
      case KMDataStoreConstants.INTERFACE_TYPE_DEVICE_UNIQUE_KEY_PAIR:
        primitiveCount += KMECDeviceUniqueKeyPair.getBackupPrimitiveByteCount();
        break;
      case KMDataStoreConstants.INTERFACE_TYPE_RKP_MAC_KEY:
        primitiveCount += KMHmacKey.getBackupPrimitiveByteCount();
        break;
      default:
        ISOException.throwIt(ISO7816.SW_CONDITIONS_NOT_SATISFIED);
    }
    return primitiveCount;
  }

  @Override
  public short getBackupObjectCount(byte interfaceType) {
    switch (interfaceType) {
      case KMDataStoreConstants.INTERFACE_TYPE_MASTER_KEY:
        return KMAESKey.getBackupObjectCount();
      case KMDataStoreConstants.INTERFACE_TYPE_PRE_SHARED_KEY:
        return KMHmacKey.getBackupObjectCount();
      case KMDataStoreConstants.INTERFACE_TYPE_DEVICE_UNIQUE_KEY_PAIR:
        return KMECDeviceUniqueKeyPair.getBackupObjectCount();
      case KMDataStoreConstants.INTERFACE_TYPE_RKP_MAC_KEY:
        return KMHmacKey.getBackupObjectCount();
      default:
        ISOException.throwIt(ISO7816.SW_CONDITIONS_NOT_SATISFIED);
    }
    return 0;
  }

  @Override
  public boolean isBootSignalEventSupported() {
    return false;
  }

  @Override
  public boolean isDeviceRebooted() {
    return false;
  }

  @Override
  public void clearDeviceBooted(boolean resetBootFlag) {
    // To be filled
  }
}