// Copyright 2020 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
////////////////////////////////////////////////////////////////////////////////

package subtle_test

import (
	"bytes"
	"encoding/hex"
	"testing"

	"github.com/google/tink/go/aead/subtle"
	subtleMac "github.com/google/tink/go/mac/subtle"
	"github.com/google/tink/go/subtle/random"
	"github.com/google/tink/go/tink"
)

func createAEADWithKeys(encryptionKey []byte, ivSize int, hashAlgo string, macKey []byte, tagSize int) (tink.AEAD, error) {
	ctr, err := subtle.NewAESCTR(encryptionKey, ivSize)
	if err != nil {
		return nil, err
	}

	mac, err := subtleMac.NewHMAC(hashAlgo, macKey, uint32(tagSize))
	if err != nil {
		return nil, err
	}

	cipher, err := subtle.NewEncryptThenAuthenticate(ctr, mac, tagSize)
	if err != nil {
		return nil, err
	}
	return cipher, nil
}

func createAEAD(keySize, ivSize int, hashAlgo string, macKeySize int, tagSize int) (tink.AEAD, error) {
	encryptionKey := random.GetRandomBytes(uint32(keySize))
	ctr, err := subtle.NewAESCTR(encryptionKey, ivSize)
	if err != nil {
		return nil, err
	}

	macKey := random.GetRandomBytes(uint32(macKeySize))
	mac, err := subtleMac.NewHMAC(hashAlgo, macKey, uint32(tagSize))
	if err != nil {
		return nil, err
	}

	cipher, err := subtle.NewEncryptThenAuthenticate(ctr, mac, tagSize)
	if err != nil {
		return nil, err
	}
	return cipher, nil
}

// Copied from
// https://tools.ietf.org/html/draft-mcgrew-aead-aes-cbc-hmac-sha2-05.
//
// We use CTR but the RFC uses CBC mode, so it's not possible to compare
// plaintexts. However, the tests are still valueable to ensure that we
// correcly compute HMAC over ciphertext and associatedData.
var rfcTestVectors = []struct {
	macKey         string
	encryptionKey  string
	ciphertext     string
	associatedData string
	hashAlgo       string
	ivSize         int
	tagSize        int
}{
	{
		macKey:        "000102030405060708090a0b0c0d0e0f",
		encryptionKey: "101112131415161718191a1b1c1d1e1f",
		ciphertext: "" +
			"1af38c2dc2b96ffdd86694092341bc04" +
			"c80edfa32ddf39d5ef00c0b468834279" +
			"a2e46a1b8049f792f76bfe54b903a9c9" +
			"a94ac9b47ad2655c5f10f9aef71427e2" +
			"fc6f9b3f399a221489f16362c7032336" +
			"09d45ac69864e3321cf82935ac4096c8" +
			"6e133314c54019e8ca7980dfa4b9cf1b" +
			"384c486f3a54c51078158ee5d79de59f" +
			"bd34d848b3d69550a67646344427ade5" +
			"4b8851ffb598f7f80074b9473c82e2db" +
			"652c3fa36b0a7c5b3219fab3a30bc1c4",
		associatedData: "" +
			"546865207365636f6e64207072696e63" +
			"69706c65206f66204175677573746520" +
			"4b6572636b686f666673",
		hashAlgo: "SHA256",
		ivSize:   16,
		tagSize:  16,
	},
	{
		macKey:        "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
		encryptionKey: "202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f",
		ciphertext: "" +
			"1af38c2dc2b96ffdd86694092341bc04" +
			"4affaaadb78c31c5da4b1b590d10ffbd" +
			"3dd8d5d302423526912da037ecbcc7bd" +
			"822c301dd67c373bccb584ad3e9279c2" +
			"e6d12a1374b77f077553df829410446b" +
			"36ebd97066296ae6427ea75c2e0846a1" +
			"1a09ccf5370dc80bfecbad28c73f09b3" +
			"a3b75e662a2594410ae496b2e2e6609e" +
			"31e6e02cc837f053d21f37ff4f51950b" +
			"be2638d09dd7a4930930806d0703b1f6" +
			"4dd3b4c088a7f45c216839645b2012bf" +
			"2e6269a8c56a816dbc1b267761955bc5",
		associatedData: "" +
			"546865207365636f6e64207072696e63" +
			"69706c65206f66204175677573746520" +
			"4b6572636b686f666673",
		hashAlgo: "SHA512",
		ivSize:   16,
		tagSize:  32,
	},
}

func hexDecode(t *testing.T, data string) []byte {
	t.Helper()
	decoded, err := hex.DecodeString(data)
	if err != nil {
		t.Fatal(err)
	}
	return decoded
}

func TestETARFCTestVectors(t *testing.T) {
	for _, v := range rfcTestVectors {
		macKey := hexDecode(t, v.macKey)
		encryptionKey := hexDecode(t, v.encryptionKey)
		ciphertext := hexDecode(t, v.ciphertext)
		associatedData := hexDecode(t, v.associatedData)

		cipher, err := createAEADWithKeys(encryptionKey, v.ivSize, v.hashAlgo, macKey, v.tagSize)
		if err != nil {
			t.Fatalf("failed to create AEAD from RFC test vector: %v", v)
		}

		if _, err := cipher.Decrypt(ciphertext, associatedData); err != nil {
			t.Errorf("decryption failed to RFC test vector: %v, error: %v", v, err)
		}
	}
}

func TestETAEncryptDecrypt(t *testing.T) {
	const keySize = 16
	const ivSize = 12
	const macKeySize = 16
	const tagSize = 16

	cipher, err := createAEAD(keySize, ivSize, "SHA1", macKeySize, tagSize)
	if err != nil {
		t.Fatalf("got: %v, want: success", err)
	}

	message := []byte("Some data to encrypt.")
	associatedData := []byte("Some data to authenticate.")

	ciphertext, err := cipher.Encrypt(message, associatedData)
	if err != nil {
		t.Fatalf("encryption failed, error: %v", err)
	}

	if len(ciphertext) != len(message)+ivSize+tagSize {
		t.Errorf("invalid ciphertext size, got: %d, want: %d", len(ciphertext), len(message)+ivSize+tagSize)
	}

	plaintext, err := cipher.Decrypt(ciphertext, associatedData)
	if err != nil {
		t.Fatalf("decryption failed, error: %v", err)
	}

	if !bytes.Equal(plaintext, message) {
		t.Errorf("invalid plaintext, got: %q, want: %q", plaintext, message)
	}
}

func TestETAWithAssociatedDataSlice(t *testing.T) {
	const keySize = 16
	const ivSize = 12
	const macKeySize = 16
	const tagSize = 16
	cipher, err := createAEAD(keySize, ivSize, "SHA1", macKeySize, tagSize)
	if err != nil {
		t.Fatalf("got: %v, want: success", err)
	}

	message := []byte("message")
	largeData := []byte("xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx")
	associatedData := largeData[:1]

	_, err = cipher.Encrypt(message, associatedData)
	if err != nil {
		t.Fatalf("encryption failed, error: %v", err)
	}

	wantLargeData := []byte("xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx")
	if !bytes.Equal(largeData, wantLargeData) {
		t.Errorf("largeData = %q, want: %q", largeData, wantLargeData)
	}
}

func TestETAEncryptDecryptRandomMessage(t *testing.T) {
	const keySize = 16
	const ivSize = 12
	const macKeySize = 16
	const tagSize = 16

	cipher, err := createAEAD(keySize, ivSize, "SHA1", macKeySize, tagSize)
	if err != nil {
		t.Fatalf("got: %v, want: success", err)
	}

	for i := 0; i < 256; i++ {
		message := random.GetRandomBytes(uint32(i))
		associatedData := random.GetRandomBytes(uint32(i))

		ciphertext, err := cipher.Encrypt(message, associatedData)
		if err != nil {
			t.Fatalf("encryption failed, error: %v", err)
		}

		if len(ciphertext) != len(message)+ivSize+tagSize {
			t.Errorf("invalid ciphertext size, got: %d, want: %d", len(ciphertext), len(message)+ivSize+tagSize)
		}

		plaintext, err := cipher.Decrypt(ciphertext, associatedData)
		if err != nil {
			t.Fatalf("decryption failed, error: %v", err)
		}

		if !bytes.Equal(plaintext, message) {
			t.Errorf("invalid plaintext, got: %q, want: %q", plaintext, message)
		}
	}
}

func TestETAMultipleEncrypt(t *testing.T) {
	const keySize = 16
	const ivSize = 12
	const macKeySize = 16
	const tagSize = 16

	cipher, err := createAEAD(keySize, ivSize, "SHA1", macKeySize, tagSize)
	if err != nil {
		t.Fatalf("got: %v, want: success", err)
	}

	message := []byte("Some data to encrypt.")
	associatedData := []byte("Some data to authenticate.")

	ciphertext1, err := cipher.Encrypt(message, associatedData)
	if err != nil {
		t.Fatalf("encryption failed, error: %v", err)
	}

	ciphertext2, err := cipher.Encrypt(message, associatedData)
	if err != nil {
		t.Fatalf("encryption failed, error: %v", err)
	}

	if bytes.Equal(ciphertext1, ciphertext2) {
		t.Error("ciphertexts must not be the same")
	}
}

func TestETAInvalidTagSize(t *testing.T) {
	const keySize = 16
	const ivSize = 12
	const macKeySize = 16
	const tagSize = 9 // Invalid!

	if _, err := createAEAD(keySize, ivSize, "SHA1", macKeySize, tagSize); err == nil {
		t.Error("got: success, want: error invalid tag size")
	}
}

func TestETADecryptModifiedCiphertext(t *testing.T) {
	const keySize = 16
	const ivSize = 12
	const macKeySize = 16
	const tagSize = 16

	cipher, err := createAEAD(keySize, ivSize, "SHA1", macKeySize, tagSize)
	if err != nil {
		t.Fatalf("got: %v, want: success", err)
	}

	message := []byte("Some data to encrypt.")
	associatedData := []byte("Some data to authenticate.")
	ciphertext, err := cipher.Encrypt(message, associatedData)
	if err != nil {
		t.Fatalf("encryption failed, error: %v", err)
	}

	// Modify the ciphertext and try to decrypt.
	modCiphertext := make([]byte, len(ciphertext))
	copy(modCiphertext, ciphertext)
	for i := 0; i < len(ciphertext)*8; i++ {
		// Save the byte to be modified.
		b := modCiphertext[i/8]
		modCiphertext[i/8] ^= (1 << uint(i%8))
		if bytes.Equal(ciphertext, modCiphertext) {
			t.Errorf("modCiphertext shouldn't be the same as ciphertext")
		}
		if _, err := cipher.Decrypt(modCiphertext, associatedData); err == nil {
			t.Errorf("successfully decrypted modified ciphertext (i = %d)", i)
		}
		// Restore the modified byte.
		modCiphertext[i/8] = b
	}

	// Modify the associated data.
	modAssociatedData := make([]byte, len(associatedData))
	copy(modAssociatedData, associatedData)
	for i := 0; i < len(associatedData)*8; i++ {
		// Save the byte to be modified.
		b := modAssociatedData[i/8]
		modAssociatedData[i/8] ^= (1 << uint(i%8))
		if bytes.Equal(associatedData, modAssociatedData) {
			t.Errorf("modAssociatedData shouldn't be the same as associatedData")
		}
		if _, err := cipher.Decrypt(ciphertext, modAssociatedData); err == nil {
			t.Errorf("successfully decrypted with modified associated data (i = %d)", i)
		}
		// Restore the modified byte.
		modAssociatedData[i/8] = b
	}

	// Truncate the ciphertext.
	truncatedCiphertext := make([]byte, len(ciphertext))
	copy(truncatedCiphertext, ciphertext)
	for i := 1; i <= len(ciphertext); i++ {
		truncatedCiphertext = truncatedCiphertext[:len(ciphertext)-i]
		if _, err := cipher.Decrypt(truncatedCiphertext, associatedData); err == nil {
			t.Errorf("successfully decrypted truncated ciphertext (i = %d)", i)
		}
	}
}

func TestETAEmptyParams(t *testing.T) {
	const keySize = 16
	const ivSize = 12
	const macKeySize = 16
	const tagSize = 16

	cipher, err := createAEAD(keySize, ivSize, "SHA1", macKeySize, tagSize)
	if err != nil {
		t.Fatalf("got: %v, want: success", err)
	}

	message := []byte("Some data to encrypt.")
	if _, err := cipher.Encrypt(message, []byte{}); err != nil {
		t.Errorf("encryption failed with empty associatedData")
	}
	if _, err := cipher.Encrypt([]byte{}, []byte{}); err != nil {
		t.Errorf("encryption failed with empty ciphertext and associatedData")
	}
}