//! Types and functions for onion service descriptor encryption.

use tor_hscrypto::{pk::HsBlindId, RevisionCounter, Subcredential};

use tor_llcrypto::cipher::aes::Aes256Ctr as Cipher;

use tor_llcrypto::d::Sha3_256 as Hash;

use tor_llcrypto::d::Shake256 as KDF;

use cipher::{KeyIvInit, StreamCipher};

use digest::{ExtendableOutput, FixedOutput, Update, XofReader};

#[cfg(any(test, feature = "hs-service"))]

use rand::{CryptoRng, Rng};

use tor_llcrypto::pk::curve25519::PublicKey;

use tor_llcrypto::pk::curve25519::StaticSecret;

use tor_llcrypto::util::ct::CtByteArray;

use zeroize::Zeroizing as Z;

/// Parameters for encrypting or decrypting part of an onion service descriptor.

///

/// The algorithm is as described in section `[HS-DESC-ENCRYPTION-KEYS]` of

/// rend-spec-v3.txt

pub(super) struct HsDescEncryption<'a> {

    /// First half of the "SECRET_DATA" field.

    ///

    /// (See rend-spec v3 2.5.1.1 and 2.5.2.1.)

    pub(super) blinded_id: &'a HsBlindId,

    /// Second half of the "SECRET_DATA" field.

    ///

    /// This is absent when handling the superencryption layer (2.5.1.1).

    /// For the encryption layer, it is `descriptor_cookie` (2.5.2.1)

    /// which is present when descriptor-encryption authentication via

    /// `KP_hsc_desc_enc` is in use.

    pub(super) desc_enc_nonce: Option<&'a HsDescEncNonce>,

    /// The "subcredential" of the onion service.

    pub(super) subcredential: &'a Subcredential,

    /// The current revision of the onion service descriptor being decrypted.

    pub(super) revision: RevisionCounter,

    /// A "personalization string".

    ///

    /// This is set to one of two constants depending on the layer being

    /// decrypted.

    pub(super) string_const: &'a [u8],

}

/// The length of a client ID.

pub(crate) const HS_DESC_CLIENT_ID_LEN: usize = 8;

/// The length of the `AuthClient` IV.

pub(crate) const HS_DESC_IV_LEN: usize = 16;

/// The length of an `N_hs_desc_enc` nonce (also known as a "descriptor cookie").

pub(crate) const HS_DESC_ENC_NONCE_LEN: usize = 16;

/// A value used in deriving the encryption key for the inner (encryption) layer

/// of onion service encryption.

///

/// This is  `N_hs_desc_enc` in the spec, where sometimes we also call it a

/// "descriptor cookie".

#[derive(derive_more::AsRef, derive_more::From)]

pub(super) struct HsDescEncNonce([u8; HS_DESC_ENC_NONCE_LEN]);

/// Length of our cryptographic salt.

const SALT_LEN: usize = 16;

/// Length of our ersatz MAC.

const MAC_LEN: usize = 32;

impl<'a> HsDescEncryption<'a> {

    /// Length of our MAC key.

    const MAC_KEY_LEN: usize = 32;

    /// Length of the cipher key that we use.

    const CIPHER_KEY_LEN: usize = 32;

    /// Length of our cipher's IV.

    const IV_LEN: usize = 16;

    /// Encrypt a given bytestring using these encryption parameters.

    #[cfg(any(test, feature = "hs-service"))]

    /// Decrypt a given bytestring that was first encrypted using these

    /// encryption parameters.

    /// Return the cryptographic objects that are used for en/decrypting and

    /// authenticating a HsDesc layer, given these parameters and a provided

    /// salt.

    ///

    /// Calculates `SECRET_KEY` and `SECRET_IV` (as `Cipher`) and `MAC_KEY` (as `Hash`)

    /// from rend-spec-v3 2.5.3 (`[HS-DESC-ENCRYPTION-KEYS]`).

    ///

    /// `Hash` is the required intermediate value in the calculation of `D_MAC`:

    /// It is in the state just after the `SALT` has been added;

    /// the ciphertext should be added, and then it should be finalized.

    /// Return a KDF that can yield the keys to be used for encryption with

    /// these key parameters.

    ///

    /// Calculates `keys` from rend-spec-v3 2.5.3 (`[HS-DESC-ENCRYPTION-KEYS]`)

    /// as required for the two instantiations of `HS-DESC-ENCRYPTION-KEYS` in

    /// 2.5.1.1 ("First layer encryption logic") and 2.5.2.1 ("Second layer

    /// encryption logic").

}

/// An error that occurs when decrypting an onion service descriptor.

///

/// This error is deliberately uninformative, to avoid side channels.

#[non_exhaustive]

#[derive(Clone, Debug, Default, thiserror::Error)]

#[error("Unable to decrypt onion service descriptor.")]

pub struct DecryptionError {}

/// Create the CLIENT-ID and COOKIE-KEY required for hidden service restricted discovery.

///

/// This is used by HS clients to decrypt the descriptor cookie from the onion service descriptor,

/// and by HS services to build the client-auth sections of descriptors.

///

/// Section 2.5.1.2. of rend-spec-v3 says:

/// ```text

///     SECRET_SEED = x25519(hs_y, client_X)

///                 = x25519(client_y, hs_X)

///     KEYS = KDF(N_hs_subcred | SECRET_SEED, 40)

///     CLIENT-ID = first 8 bytes of KEYS

///     COOKIE-KEY = last 32 bytes of KEYS

///

/// Where:

///     hs_{X,y} = K{P,S}_hss_desc_enc

///     client_{X,Y} = K{P,S}_hsc_desc_enc

/// ```

#[cfg(test)]

mod test {

    // @@ begin test lint list maintained by maint/add_warning @@

    #![allow(clippy::bool_assert_comparison)]

    #![allow(clippy::clone_on_copy)]

    #![allow(clippy::dbg_macro)]

    #![allow(clippy::mixed_attributes_style)]

    #![allow(clippy::print_stderr)]

    #![allow(clippy::print_stdout)]

    #![allow(clippy::single_char_pattern)]

    #![allow(clippy::unwrap_used)]

    #![allow(clippy::unchecked_duration_subtraction)]

    #![allow(clippy::useless_vec)]

    #![allow(clippy::needless_pass_by_value)]

    //! <!-- @@ end test lint list maintained by maint/add_warning @@ -->

    use super::*;

    use tor_basic_utils::test_rng::testing_rng;

    #[test]

    fn roundtrip_basics() {

        let blinded_id = [7; 32].into();

        let subcredential = [11; 32].into();

        let revision = 13.into();

        let string_const = "greetings puny humans";

        let params = HsDescEncryption {

            blinded_id: &blinded_id,

            desc_enc_nonce: None,

            subcredential: &subcredential,

            revision,

            string_const: string_const.as_bytes(),

        };

        let mut rng = testing_rng();

        let bigmsg: Vec<u8> = (1..123).cycle().take(1021).collect();

        for message in [&b""[..], &b"hello world"[..], &bigmsg[..]] {

            let mut encrypted = params.encrypt(&mut rng, message);

            assert_eq!(encrypted.len(), message.len() + 48);

            let decrypted = params.decrypt(&encrypted[..]).unwrap();

            assert_eq!(message, &decrypted);

            // Make sure we can't decrypt a partial input.

            let decryption_err = params.decrypt(&encrypted[..encrypted.len() - 1]);

            assert!(decryption_err.is_err());

            // Frob a point in the encrypted form and ensure we won't decrypt.

            encrypted[7] ^= 3;

            let decryption_err = params.decrypt(&encrypted[..]);

            assert!(decryption_err.is_err());

        }

    }

    #[test]

    fn too_short() {

        let blinded_id = [7; 32].into();

        let subcredential = [11; 32].into();

        let revision = 13.into();

        let string_const = "greetings puny humans";

        let params = HsDescEncryption {

            blinded_id: &blinded_id,

            desc_enc_nonce: None,

            subcredential: &subcredential,

            revision,

            string_const: string_const.as_bytes(),

        };

        assert!(params.decrypt(b"").is_err());

        assert!(params.decrypt(&[0_u8; 47]).is_err());

    }

}