/* UMac32.java --
   Copyright (C) 2001, 2002, 2003, 2006 Free Software Foundation, Inc.

This file is a part of GNU Classpath.

GNU Classpath is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or (at
your option) any later version.

GNU Classpath is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
General Public License for more details.

You should have received a copy of the GNU General Public License
along with GNU Classpath; if not, write to the Free Software
Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301
USA

Linking this library statically or dynamically with other modules is
making a combined work based on this library.  Thus, the terms and
conditions of the GNU General Public License cover the whole
combination.

As a special exception, the copyright holders of this library give you
permission to link this library with independent modules to produce an
executable, regardless of the license terms of these independent
modules, and to copy and distribute the resulting executable under
terms of your choice, provided that you also meet, for each linked
independent module, the terms and conditions of the license of that
module.  An independent module is a module which is not derived from
or based on this library.  If you modify this library, you may extend
this exception to your version of the library, but you are not
obligated to do so.  If you do not wish to do so, delete this
exception statement from your version.  */


package gnu.javax.crypto.mac;

import gnu.java.security.Registry;
import gnu.java.security.prng.IRandom;
import gnu.java.security.prng.LimitReachedException;
import gnu.java.security.util.Util;
import gnu.javax.crypto.cipher.CipherFactory;
import gnu.javax.crypto.cipher.IBlockCipher;
import gnu.javax.crypto.prng.UMacGenerator;

import java.io.UnsupportedEncodingException;
import java.math.BigInteger;
import java.security.InvalidKeyException;
import java.util.HashMap;
import java.util.Map;

/**
 * The implementation of the <i>UMAC</i> (Universal Message Authentication
 * Code).
 * <p>
 * The <i>UMAC</i> algorithms described are <i>parameterized</i>. This means
 * that various low-level choices, like the endian convention and the underlying
 * cryptographic primitive, have not been fixed. One must choose values for
 * these parameters before the authentication tag generated by <i>UMAC</i> (for
 * a given message, key, and nonce) becomes fully-defined. In this document we
 * provide two collections of parameter settings, and have named the sets
 * <i>UMAC16</i> and <i>UMAC32</i>. The parameter sets have been chosen based
 * on experimentation and provide good performance on a wide variety of
 * processors. <i>UMAC16</i> is designed to excel on processors which provide
 * small-scale SIMD parallelism of the type found in Intel's MMX and Motorola's
 * AltiVec instruction sets, while <i>UMAC32</i> is designed to do well on
 * processors with good 32- and 64- bit support. <i>UMAC32</i> may take
 * advantage of SIMD parallelism in future processors.
 * <p>
 * <i>UMAC</i> has been designed to allow implementations which accommodate
 * <i>on-line</i> authentication. This means that pieces of the message may be
 * presented to <i>UMAC</i> at different times (but in correct order) and an
 * on-line implementation will be able to process the message correctly without
 * the need to buffer more than a few dozen bytes of the message. For
 * simplicity, the algorithms in this specification are presented as if the
 * entire message being authenticated were available at once.
 * <p>
 * To authenticate a message, <code>Msg</code>, one first applies the
 * universal hash function, resulting in a string which is typically much
 * shorter than the original message. The pseudorandom function is applied to a
 * nonce, and the result is used in the manner of a Vernam cipher: the
 * authentication tag is the xor of the output from the hash function and the
 * output from the pseudorandom function. Thus, an authentication tag is
 * generated as
 * <pre>
 *     AuthTag = f(Nonce) xor h(Msg)
 * </pre>
 * <p>
 * Here <code>f</code> is the pseudorandom function shared between the sender
 * and the receiver, and h is a universal hash function shared by the sender and
 * the receiver. In <i>UMAC</i>, a shared key is used to key the pseudorandom
 * function <code>f</code>, and then <code>f</code> is used for both tag
 * generation and internally to generate all of the bits needed by the universal
 * hash function.
 * <p>
 * The universal hash function that we use is called <code>UHASH</code>. It
 * combines several software-optimized algorithms into a multi-layered
 * structure. The algorithm is moderately complex. Some of this complexity comes
 * from extensive speed optimizations.
 * <p>
 * For the pseudorandom function we use the block cipher of the <i>Advanced
 * Encryption Standard</i> (AES).
 * <p>
 * The UMAC32 parameters, considered in this implementation are:
 * <pre>
 *                                    UMAC32
 *                                    ------
 *         WORD-LEN                        4
 *         UMAC-OUTPUT-LEN                 8
 *         L1-KEY-LEN                   1024
 *         UMAC-KEY-LEN                   16
 *         ENDIAN-FAVORITE               BIG *
 *         L1-OPERATIONS-SIGN       UNSIGNED
 * </pre>
 * <p>
 * Please note that this UMAC32 differs from the one described in the paper by
 * the <i>ENDIAN-FAVORITE</i> value.
 * <p>
 * References:
 * <ol>
 * <li><a href="http://www.ietf.org/internet-drafts/draft-krovetz-umac-01.txt">
 * UMAC</a>: Message Authentication Code using Universal Hashing.<br>
 * T. Krovetz, J. Black, S. Halevi, A. Hevia, H. Krawczyk, and P. Rogaway.</li>
 * </ol>
 */
public class UMac32
    extends BaseMac
{
  /**
   * Property name of the user-supplied <i>Nonce</i>. The value associated to
   * this property name is taken to be a byte array.
   */
  public static final String NONCE_MATERIAL = "gnu.crypto.umac.nonce.material";
  /** Known test vector. */
  // private static final String TV1 = "3E5A0E09198B0F94";
  // private static final String TV1 = "5FD764A6D3A9FD9D";
  // private static final String TV1 = "48658DE1D9A70304";
  private static final String TV1 = "455ED214A6909F20";
  private static final BigInteger MAX_NONCE_ITERATIONS = BigInteger.ONE.shiftLeft(16 * 8);
  // UMAC32 parameters
  static final int OUTPUT_LEN = 8;
  static final int L1_KEY_LEN = 1024;
  static final int KEY_LEN = 16;
  /** caches the result of the correctness test, once executed. */
  private static Boolean valid;
  private byte[] nonce;
  private UHash32 uhash32;
  private BigInteger nonceReuseCount;
  /** The authentication key for this instance. */
  private transient byte[] K;

  /** Trivial 0-arguments constructor. */
  public UMac32()
  {
    super("umac32");
  }

  /**
   * Private constructor for cloning purposes.
   *
   * @param that the instance to clone.
   */
  private UMac32(UMac32 that)
  {
    this();

    if (that.K != null)
      this.K = (byte[]) that.K.clone();
    if (that.nonce != null)
      this.nonce = (byte[]) that.nonce.clone();
    if (that.uhash32 != null)
      this.uhash32 = (UHash32) that.uhash32.clone();
    this.nonceReuseCount = that.nonceReuseCount;
  }

  public Object clone()
  {
    return new UMac32(this);
  }

  public int macSize()
  {
    return OUTPUT_LEN;
  }

  /**
   * Initialising a <i>UMAC</i> instance consists of defining values for the
   * following parameters:
   * <ol>
   * <li>Key Material: as the value of the attribute entry keyed by
   * {@link #MAC_KEY_MATERIAL}. The value is taken to be a byte array
   * containing the user-specified key material. The length of this array,
   * if/when defined SHOULD be exactly equal to {@link #KEY_LEN}.</li>
   * <li>Nonce Material: as the value of the attribute entry keyed by
   * {@link #NONCE_MATERIAL}. The value is taken to be a byte array containing
   * the user-specified nonce material. The length of this array, if/when
   * defined SHOULD be (a) greater than zero, and (b) less or equal to 16 (the
   * size of the AES block).</li>
   * </ol>
   * <p>
   * For convenience, this implementation accepts that not both parameters be
   * always specified.
   * <ul>
   * <li>If the <i>Key Material</i> is specified, but the <i>Nonce Material</i>
   * is not, then this implementation, re-uses the previously set <i>Nonce
   * Material</i> after (a) converting the bytes to an unsigned integer, (b)
   * incrementing the number by one, and (c) converting it back to 16 bytes.</li>
   * <li>If the <i>Nonce Material</i> is specified, but the <i>Key Material</i>
   * is not, then this implementation re-uses the previously set <i>Key Material</i>.
   * </li>
   * </ul>
   * <p>
   * This method throws an exception if no <i>Key Material</i> is specified in
   * the input map, and there is no previously set/defined <i>Key Material</i>
   * (from an earlier invocation of this method). If a <i>Key Material</i> can
   * be used, but no <i>Nonce Material</i> is defined or previously
   * set/defined, then a default value of all-zeroes shall be used.
   *
   * @param attributes one or both of required parameters.
   * @throws InvalidKeyException the key material specified is not of the
   *           correct length.
   */
  public void init(Map attributes) throws InvalidKeyException,
      IllegalStateException
  {
    byte[] key = (byte[]) attributes.get(MAC_KEY_MATERIAL);
    byte[] n = (byte[]) attributes.get(NONCE_MATERIAL);
    boolean newKey = (key != null);
    boolean newNonce = (n != null);
    if (newKey)
      {
        if (key.length != KEY_LEN)
          throw new InvalidKeyException("Key length: "
                                        + String.valueOf(key.length));
        K = key;
      }
    else
      {
        if (K == null)
          throw new InvalidKeyException("Null Key");
      }
    if (newNonce)
      {
        if (n.length < 1 || n.length > 16)
          throw new IllegalArgumentException("Invalid Nonce length: "
                                             + String.valueOf(n.length));
        if (n.length < 16) // pad with zeroes
          {
            byte[] newN = new byte[16];
            System.arraycopy(n, 0, newN, 0, n.length);
            nonce = newN;
          }
        else
          nonce = n;

        nonceReuseCount = BigInteger.ZERO;
      }
    else if (nonce == null) // use all-0 nonce if 1st time
      {
        nonce = new byte[16];
        nonceReuseCount = BigInteger.ZERO;
      }
    else if (! newKey) // increment nonce if still below max count
      {
        nonceReuseCount = nonceReuseCount.add(BigInteger.ONE);
        if (nonceReuseCount.compareTo(MAX_NONCE_ITERATIONS) >= 0)
          {
            // limit reached. we SHOULD have a key
            throw new InvalidKeyException("Null Key and unusable old Nonce");
          }
        BigInteger N = new BigInteger(1, nonce);
        N = N.add(BigInteger.ONE).mod(MAX_NONCE_ITERATIONS);
        n = N.toByteArray();
        if (n.length == 16)
          nonce = n;
        else if (n.length < 16)
          {
            nonce = new byte[16];
            System.arraycopy(n, 0, nonce, 16 - n.length, n.length);
          }
        else
          {
            nonce = new byte[16];
            System.arraycopy(n, n.length - 16, nonce, 0, 16);
          }
      }
    else // do nothing, re-use old nonce value
      nonceReuseCount = BigInteger.ZERO;

    if (uhash32 == null)
      uhash32 = new UHash32();

    Map map = new HashMap();
    map.put(MAC_KEY_MATERIAL, K);
    uhash32.init(map);
  }

  public void update(byte b)
  {
    uhash32.update(b);
  }

  public void update(byte[] b, int offset, int len)
  {
    uhash32.update(b, offset, len);
  }

  public byte[] digest()
  {
    byte[] result = uhash32.digest();
    byte[] pad = pdf(); // pdf(K, nonce);
    for (int i = 0; i < OUTPUT_LEN; i++)
      result[i] = (byte)(result[i] ^ pad[i]);

    return result;
  }

  public void reset()
  {
    if (uhash32 != null)
      uhash32.reset();
  }

  public boolean selfTest()
  {
    if (valid == null)
      {
        byte[] key;
        try
          {
            key = "abcdefghijklmnop".getBytes("ASCII");
          }
        catch (UnsupportedEncodingException x)
          {
            throw new RuntimeException("ASCII not supported");
          }
        byte[] nonce = new byte[] { 0, 1, 2, 3, 4, 5, 6, 7 };
        UMac32 mac = new UMac32();
        Map attributes = new HashMap();
        attributes.put(MAC_KEY_MATERIAL, key);
        attributes.put(NONCE_MATERIAL, nonce);
        try
          {
            mac.init(attributes);
          }
        catch (InvalidKeyException x)
          {
            x.printStackTrace(System.err);
            return false;
          }
        byte[] data = new byte[128];
        data[0] = (byte) 0x80;
        mac.update(data, 0, 128);
        byte[] result = mac.digest();
        valid = Boolean.valueOf(TV1.equals(Util.toString(result)));
      }
    return valid.booleanValue();
  }

  /**
   * @return byte array of length 8 (or OUTPUT_LEN) bytes.
   */
  private byte[] pdf()
  {
    // Make Nonce 16 bytes by prepending zeroes. done (see init())
    // one AES invocation is enough for more than one PDF invocation
    // number of index bits needed = 1
    // Extract index bits and zero low bits of Nonce
    BigInteger Nonce = new BigInteger(1, nonce);
    int nlowbitsnum = Nonce.testBit(0) ? 1 : 0;
    Nonce = Nonce.clearBit(0);
    // Generate subkey, AES and extract indexed substring
    IRandom kdf = new UMacGenerator();
    Map map = new HashMap();
    map.put(IBlockCipher.KEY_MATERIAL, K);
    map.put(UMacGenerator.INDEX, Integer.valueOf(128));
    kdf.init(map);
    byte[] Kp = new byte[KEY_LEN];
    try
      {
        kdf.nextBytes(Kp, 0, KEY_LEN);
      }
    catch (IllegalStateException x)
      {
        x.printStackTrace(System.err);
        throw new RuntimeException(String.valueOf(x));
      }
    catch (LimitReachedException x)
      {
        x.printStackTrace(System.err);
        throw new RuntimeException(String.valueOf(x));
      }
    IBlockCipher aes = CipherFactory.getInstance(Registry.AES_CIPHER);
    map.put(IBlockCipher.KEY_MATERIAL, Kp);
    try
      {
        aes.init(map);
      }
    catch (InvalidKeyException x)
      {
        x.printStackTrace(System.err);
        throw new RuntimeException(String.valueOf(x));
      }
    catch (IllegalStateException x)
      {
        x.printStackTrace(System.err);
        throw new RuntimeException(String.valueOf(x));
      }
    byte[] T = new byte[16];
    aes.encryptBlock(nonce, 0, T, 0);
    byte[] result = new byte[OUTPUT_LEN];
    System.arraycopy(T, nlowbitsnum, result, 0, OUTPUT_LEN);
    return result;
  }
}