// Copyright (c) 2016-present The Bitcoin Core developers

// Distributed under the MIT software license, see the accompanying

// file COPYING or http://www.opensource.org/licenses/mit-license.php.

#include <crypto/aes.h>

#include <support/allocators/secure.h>

#include <cstring>

extern "C" {

#include <crypto/ctaes/ctaes.c>

}

AES256Encrypt::AES256Encrypt(const unsigned char key[32])

{

    ctx = allocator.allocate(1);

    AES256_init(ctx, key);

}

AES256Encrypt::~AES256Encrypt()

{

    allocator.deallocate(ctx, 1);

}

void AES256Encrypt::Encrypt(unsigned char ciphertext[16], const unsigned char plaintext[16]) const

{

    AES256_encrypt(ctx, 1, ciphertext, plaintext);

}

AES256Decrypt::AES256Decrypt(const unsigned char key[32])

{

    ctx = allocator.allocate(1);

    AES256_init(ctx, key);

}

AES256Decrypt::~AES256Decrypt()

{

    allocator.deallocate(ctx, 1);

}

void AES256Decrypt::Decrypt(unsigned char plaintext[16], const unsigned char ciphertext[16]) const

{

    AES256_decrypt(ctx, 1, plaintext, ciphertext);

}

template <typename T>

static int CBCEncrypt(const T& enc, const unsigned char iv[AES_BLOCKSIZE], const unsigned char* data, int size, bool pad, unsigned char* out)

{

    int written = 0;

    int padsize = size % AES_BLOCKSIZE;

    unsigned char mixed[AES_BLOCKSIZE];

    if (!data || !size || !out)

  Branch (54:9): [True: 27.6k, False: 30.7k]
  Branch (54:18): [True: 166, False: 30.5k]
  Branch (54:27): [True: 0, False: 30.5k]

        return 0;

    if (!pad && padsize != 0)

  Branch (57:9): [True: 1.67k, False: 28.8k]
  Branch (57:17): [True: 1.42k, False: 247]

        return 0;

    memcpy(mixed, iv, AES_BLOCKSIZE);

    // Write all but the last block

    while (written + AES_BLOCKSIZE <= size) {

  Branch (63:12): [True: 88.0k, False: 29.1k]

        for (int i = 0; i != AES_BLOCKSIZE; i++)

  Branch (64:25): [True: 1.40M, False: 88.0k]

            mixed[i] ^= *data++;

        enc.Encrypt(out + written, mixed);

        memcpy(mixed, out + written, AES_BLOCKSIZE);

        written += AES_BLOCKSIZE;

    }

    if (pad) {

  Branch (70:9): [True: 28.8k, False: 247]

        // For all that remains, pad each byte with the value of the remaining

        // space. If there is none, pad by a full block.

        for (int i = 0; i != padsize; i++)

  Branch (73:25): [True: 76.4k, False: 28.8k]

            mixed[i] ^= *data++;

        for (int i = padsize; i != AES_BLOCKSIZE; i++)

  Branch (75:31): [True: 385k, False: 28.8k]

            mixed[i] ^= AES_BLOCKSIZE - padsize;

        enc.Encrypt(out + written, mixed);

        written += AES_BLOCKSIZE;

    }

    return written;

}

template <typename T>

static int CBCDecrypt(const T& dec, const unsigned char iv[AES_BLOCKSIZE], const unsigned char* data, int size, bool pad, unsigned char* out)

{

    int written = 0;

    bool fail = false;

    const unsigned char* prev = iv;

    if (!data || !size || !out)

  Branch (90:9): [True: 733, False: 80.5k]
  Branch (90:18): [True: 28.8k, False: 51.7k]
  Branch (90:27): [True: 0, False: 51.7k]

        return 0;

    if (size % AES_BLOCKSIZE != 0)

  Branch (93:9): [True: 1.03k, False: 50.7k]

        return 0;

    // Decrypt all data. Padding will be checked in the output.

    while (written != size) {

  Branch (97:12): [True: 198k, False: 50.7k]

        dec.Decrypt(out, data + written);

        for (int i = 0; i != AES_BLOCKSIZE; i++)

  Branch (99:25): [True: 3.17M, False: 198k]

            *out++ ^= prev[i];

        prev = data + written;

        written += AES_BLOCKSIZE;

    }

    // When decrypting padding, attempt to run in constant-time

    if (pad) {

  Branch (106:9): [True: 50.4k, False: 247]

        // If used, padding size is the value of the last decrypted byte. For

        // it to be valid, It must be between 1 and AES_BLOCKSIZE.

        unsigned char padsize = *--out;

        fail = !padsize | (padsize > AES_BLOCKSIZE);

        // If not well-formed, treat it as though there's no padding.

        padsize *= !fail;

        // All padding must equal the last byte otherwise it's not well-formed

        for (int i = AES_BLOCKSIZE; i != 0; i--)

  Branch (116:37): [True: 807k, False: 50.4k]

            fail |= ((i > AES_BLOCKSIZE - padsize) & (*out-- != padsize));

        written -= padsize;

    }

    return written * !fail;

}

AES256CBCEncrypt::AES256CBCEncrypt(const unsigned char key[AES256_KEYSIZE], const unsigned char ivIn[AES_BLOCKSIZE], bool padIn)

    : enc(key), pad(padIn)

{

    iv = allocator.allocate(AES_BLOCKSIZE);

    memcpy(iv, ivIn, AES_BLOCKSIZE);

}

int AES256CBCEncrypt::Encrypt(const unsigned char* data, int size, unsigned char* out) const

{

    return CBCEncrypt(enc, iv, data, size, pad, out);

}

AES256CBCEncrypt::~AES256CBCEncrypt()

{

    allocator.deallocate(iv, AES_BLOCKSIZE);

}

AES256CBCDecrypt::AES256CBCDecrypt(const unsigned char key[AES256_KEYSIZE], const unsigned char ivIn[AES_BLOCKSIZE], bool padIn)

    : dec(key), pad(padIn)

{

    iv = allocator.allocate(AES_BLOCKSIZE);

    memcpy(iv, ivIn, AES_BLOCKSIZE);

}

int AES256CBCDecrypt::Decrypt(const unsigned char* data, int size, unsigned char* out) const

{

    return CBCDecrypt(dec, iv, data, size, pad, out);

}

AES256CBCDecrypt::~AES256CBCDecrypt()

{

    allocator.deallocate(iv, AES_BLOCKSIZE);

}