/*
 *
 *    Copyright (c) 2013-2017 Nest Labs, Inc.
 *    All rights reserved.
 *
 *    Licensed under the Apache License, Version 2.0 (the "License");
 *    you may not use this file except in compliance with the License.
 *    You may obtain a copy of the License at
 *
 *        http://www.apache.org/licenses/LICENSE-2.0
 *
 *    Unless required by applicable law or agreed to in writing, software
 *    distributed under the License is distributed on an "AS IS" BASIS,
 *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *    See the License for the specific language governing permissions and
 *    limitations under the License.
 */

/**
 *    @file
 *      Implementation of WeaveCASEEngine class.
 *
 */

#ifndef __STDC_LIMIT_MACROS
#define __STDC_LIMIT_MACROS
#endif
#include <stdint.h>

#include <Weave/Core/WeaveCore.h>
#include "WeaveCASE.h"
#include <Weave/Core/WeaveTLV.h>
#include <Weave/Profiles/WeaveProfiles.h>
#include <Weave/Support/ASN1.h>
#include <Weave/Support/logging/WeaveLogging.h>
#include <Weave/Profiles/security/WeaveSecurity.h>
#include <Weave/Profiles/security/WeaveCert.h>
#include <Weave/Profiles/security/WeaveSig.h>
#include <Weave/Profiles/security/WeavePrivateKey.h>
#include <Weave/Support/crypto/WeaveCrypto.h>
#include <Weave/Support/crypto/HashAlgos.h>
#include <Weave/Support/crypto/EllipticCurve.h>
#include <Weave/Support/CodeUtils.h>
#include <Weave/Support/WeaveFaultInjection.h>


namespace nl {
namespace Weave {
namespace Profiles {
namespace Security {
namespace CASE {

using namespace nl::Weave::Crypto;
using namespace nl::Weave::Encoding;
using namespace nl::Weave::TLV;
using namespace nl::Weave::ASN1;

#undef CASE_PRINT_CRYPTO_DATA
#ifdef CASE_PRINT_CRYPTO_DATA
static void PrintHex(const uint8_t *data, uint16_t len)
{
    for (uint16_t i = 0; i < len; i++)
        printf("%02X", data[i]);
}
#endif

void WeaveCASEEngine::Init()
{
    memset(this, 0, sizeof(*this));
}

void WeaveCASEEngine::Shutdown()
{
    ClearSecretData((uint8_t *)this, sizeof(*this));
}

void WeaveCASEEngine::Reset()
{
    WeaveCASEAuthDelegate *savedAuthDelegate = AuthDelegate;
    ClearSecretData((uint8_t *)this, sizeof(*this));
    AuthDelegate = savedAuthDelegate;
}

void WeaveCASEEngine::SetAlternateConfigs(BeginSessionRequestMessage& req)
{
    uint32_t altConfig = (req.ProtocolConfig == kCASEConfig_Config1) ? kCASEConfig_Config2 : kCASEConfig_Config1;
    if (IsAllowedConfig(altConfig))
    {
        req.AlternateConfigs[0] = altConfig;
        req.AlternateConfigCount = 1;
    }
}

void WeaveCASEEngine::SetAlternateCurves(BeginSessionRequestMessage& req)
{
    req.AlternateCurveCount = 0;

#if WEAVE_CONFIG_SUPPORT_ELLIPTIC_CURVE_SECP256R1
    if ((mAllowedCurves & kWeaveCurveSet_prime256v1) != 0)
        req.AlternateCurveIds[req.AlternateCurveCount++] = kWeaveCurveId_prime256v1;
#endif // WEAVE_CONFIG_SUPPORT_ELLIPTIC_CURVE_SECP256R1

#if WEAVE_CONFIG_SUPPORT_ELLIPTIC_CURVE_SECP224R1
    if ((mAllowedCurves & kWeaveCurveSet_secp224r1) != 0)
        req.AlternateCurveIds[req.AlternateCurveCount++] = kWeaveCurveId_secp224r1;
#endif // WEAVE_CONFIG_SUPPORT_ELLIPTIC_CURVE_SECP224R1

#if WEAVE_CONFIG_SUPPORT_ELLIPTIC_CURVE_SECP192R1
    if ((mAllowedCurves & kWeaveCurveSet_prime192v1) != 0)
        req.AlternateCurveIds[req.AlternateCurveCount++] = kWeaveCurveId_prime192v1;
#endif // WEAVE_CONFIG_SUPPORT_ELLIPTIC_CURVE_SECP192R1

#if WEAVE_CONFIG_SUPPORT_ELLIPTIC_CURVE_SECP160R1
    if ((mAllowedCurves & kWeaveCurveSet_secp160r1) != 0)
        req.AlternateCurveIds[req.AlternateCurveCount++] = kWeaveCurveId_secp160r1;
#endif // WEAVE_CONFIG_SUPPORT_ELLIPTIC_CURVE_SECP160R1
}

WEAVE_ERROR WeaveCASEEngine::GenerateBeginSessionRequest(BeginSessionRequestMessage& req, PacketBuffer *msgBuf)
{
    WEAVE_ERROR err;

    // Verify there isn't a begin session already outstanding.
    VerifyOrExit(State == kState_Idle, err = WEAVE_ERROR_INCORRECT_STATE);

    // Verify the auth delegate has been set.
    VerifyOrExit(AuthDelegate != NULL, err = WEAVE_ERROR_NO_CASE_AUTH_DELEGATE);

    WeaveLogDetail(SecurityManager, "CASE:GenerateBeginSessionRequest");

    // If a protocol config wasn't specified, choose a default one.
    if (req.ProtocolConfig == CASE::kCASEConfig_NotSpecified)
        req.ProtocolConfig = IsConfig2Allowed() ? kCASEConfig_Config2 : kCASEConfig_Config1;

    // Verify the proposed config is supported.
    VerifyOrExit(IsAllowedConfig(req.ProtocolConfig), err = WEAVE_ERROR_UNSUPPORTED_CASE_CONFIGURATION);

    // If a ECDH curve wasn't specified, choose a default one.
    if (req.CurveId == kWeaveCurveId_NotSpecified)
        req.CurveId = WEAVE_CONFIG_DEFAULT_CASE_CURVE_ID;

    // Verify the proposed ECDH curve is supported.
    VerifyOrExit(IsAllowedCurve(req.CurveId), err = WEAVE_ERROR_UNSUPPORTED_ELLIPTIC_CURVE);

    // Verify the requested key type.
    VerifyOrExit(WeaveKeyId::IsSessionKey(req.SessionKeyId), err = WEAVE_ERROR_WRONG_KEY_TYPE);

    // Verify the requested encryption type.
    VerifyOrExit(req.EncryptionType == kWeaveEncryptionType_AES128CTRSHA1,
            err = WEAVE_ERROR_UNSUPPORTED_ENCRYPTION_TYPE);

    SetIsInitiator(true);

    // Remember various parameters of the session so that we can use them when the responder responds.
    SetSelectedConfig(req.ProtocolConfig);
    mCurveId = req.CurveId;
    SetPerformingKeyConfirm(req.PerformKeyConfirm);
    SessionKeyId = req.SessionKeyId;
    EncryptionType = req.EncryptionType;

    // Since the message contains a number of variable length fields with corresponding length values,
    // we start encoding in the middle of the message, and then go back and fill in the head when we know
    // the final lengths.
    msgBuf->SetDataLength(req.HeadLength());

    // Generate an ephemeral public/private key. Store the public key directly into the message and store
    // the private key in a state variable.
    err = AppendNewECDHKey(req, msgBuf);
    SuccessOrExit(err);

    // Append the local node's certificate information.
    err = AppendCertInfo(req, msgBuf);
    SuccessOrExit(err);

    // Append the initiator's payload, if specified.
    err = AppendPayload(req, msgBuf);
    SuccessOrExit(err);

    // Now encode the head of the message.
    err = req.EncodeHead(msgBuf);
    SuccessOrExit(err);

    // Sign the message using the supplied private key and append the signature to the buffer.
    // Save the message hash for later use in deriving the session keys.
    err = AppendSignature(req, msgBuf, mSecureState.BeforeKeyGen.RequestMsgHash);
    SuccessOrExit(err);

    State = kState_BeginRequestGenerated;

exit:
    return err;
}

WEAVE_ERROR WeaveCASEEngine::ProcessBeginSessionRequest(PacketBuffer *msgBuf, BeginSessionRequestMessage& req, ReconfigureMessage& reconf)
{
    WEAVE_ERROR err;
    bool reconfigRequired = false;

    // Verify there isn't a begin session already outstanding.
    VerifyOrExit(State == kState_Idle, err = WEAVE_ERROR_INCORRECT_STATE);

    WeaveLogDetail(SecurityManager, "CASE:ProcessBeginSessionRequest");

    // Record that we are acting as the responder.
    SetIsInitiator(false);

    // Decode the head of the message.
    err = req.DecodeHead(msgBuf);
    SuccessOrExit(err);

    // Verify the protocol parameters proposed by the peer (protocol config and ECDH curve id).  If the proposed
    // values are not acceptable, but an alternative set are, setup the ReconfigureMessage with the alternatives
    // and return WEAVE_ERROR_CASE_RECONFIG_REQUIRED.
    reconf.ProtocolConfig = req.ProtocolConfig;
    reconf.CurveId = req.CurveId;
    err = VerifyProposedConfig(req, reconf.ProtocolConfig);
    if (err == WEAVE_ERROR_CASE_RECONFIG_REQUIRED)
        reconfigRequired = true;
    else
        SuccessOrExit(err);
    err = VerifyProposedCurve(req, reconf.CurveId);
    if (err == WEAVE_ERROR_CASE_RECONFIG_REQUIRED)
        reconfigRequired = true;
    else
        SuccessOrExit(err);
    if (reconfigRequired)
        ExitNow(err = WEAVE_ERROR_CASE_RECONFIG_REQUIRED);

    // Remember various parameters of the session so that we can use them when we respond.
    SetSelectedConfig(req.ProtocolConfig);
    mCurveId = req.CurveId;
    SetPerformingKeyConfirm(req.PerformKeyConfirm);
    SessionKeyId = req.SessionKeyId;
    EncryptionType = req.EncryptionType;

    // Verify the message signature.
    err = VerifySignature(req, msgBuf, mSecureState.BeforeKeyGen.RequestMsgHash);
    SuccessOrExit(err);

    // Verify the requested key type.
    VerifyOrExit(WeaveKeyId::IsSessionKey(req.SessionKeyId), err = WEAVE_ERROR_WRONG_KEY_TYPE);

    // Verify the requested encryption type.
    VerifyOrExit(req.EncryptionType == kWeaveEncryptionType_AES128CTRSHA1,
                 err = WEAVE_ERROR_UNSUPPORTED_ENCRYPTION_TYPE);

    State = kState_BeginRequestProcessed;

exit:
    if (err != WEAVE_NO_ERROR)
        State = kState_Failed;
    return err;
}

WEAVE_ERROR WeaveCASEEngine::GenerateBeginSessionResponse(BeginSessionResponseMessage& resp, PacketBuffer *msgBuf,
                                                          BeginSessionRequestMessage& req)
{
    WEAVE_ERROR err;
    uint8_t respMsgHash[kMaxHashLength];

    // Verify the correct state.
    VerifyOrExit(State == kState_BeginRequestProcessed, err = WEAVE_ERROR_INCORRECT_STATE);

    WeaveLogDetail(SecurityManager, "CASE:GenerateBeginSessionResponse");

    // If the initiator requested key confirmation, then we must do it.
    // If the initiator DIDN'T requested key confirmation, but local policy requires it, the we force the use
    // of key confirmation.
    if (req.PerformKeyConfirm || resp.PerformKeyConfirm || ResponderRequiresKeyConfirm())
        SetPerformingKeyConfirm(true);

    // If performing key confirmation, signal so in the response and set the appropriate key confirmation
    // hash length based on the selected config.
    if (PerformingKeyConfirm())
    {
        resp.PerformKeyConfirm = true;
        resp.KeyConfirmHashLength = ConfigHashLength();
    }

    // Since the message contains variable length fields with corresponding length values, start encoding the tail
    // of the message, and then go back and fill in the head when we know the final lengths.
    msgBuf->SetDataLength(resp.HeadLength());

    // Generate an ephemeral public/private key. Append the public key to the message and store the private key
    // in a state variable.
    err = AppendNewECDHKey(resp, msgBuf);
    SuccessOrExit(err);

    // Append the local node's certificate information.
    err = AppendCertInfo(resp, msgBuf);
    SuccessOrExit(err);

    // Append the responder's payload, if specified.
    err = AppendPayload(resp, msgBuf);
    SuccessOrExit(err);

    // Now encode the head of the message.
    err = resp.EncodeHead(msgBuf);
    SuccessOrExit(err);

    // Sign the message using the supplied private key and append the signature to the buffer.
    err = AppendSignature(resp, msgBuf, respMsgHash);
    SuccessOrExit(err);

    {
        uint8_t responderKeyConfirmHash[kMaxHashLength];

        // Derive the session keys from the initiator's public key and our private key.
        err = DeriveSessionKeys(req.ECDHPublicKey, respMsgHash, responderKeyConfirmHash);
        SuccessOrExit(err);

        // If performing key confirmation...
        if (PerformingKeyConfirm())
        {
            // Append the responder hash to the BeginSessionResponse message.  The initiator will use this to
            // confirm that we have the correct session keys.
            VerifyOrExit(msgBuf->AvailableDataLength() >= resp.KeyConfirmHashLength, err = WEAVE_ERROR_BUFFER_TOO_SMALL);
            uint16_t msgLen = msgBuf->DataLength();
            memcpy(msgBuf->Start() + msgLen, responderKeyConfirmHash, resp.KeyConfirmHashLength);
            msgBuf->SetDataLength(msgLen + resp.KeyConfirmHashLength);

            State = kState_BeginResponseGenerated;
        }
        else
            State = kState_Complete;
    }

exit:
    if (err != WEAVE_NO_ERROR)
        State = kState_Failed;
    return err;
}

WEAVE_ERROR WeaveCASEEngine::ProcessBeginSessionResponse(PacketBuffer *msgBuf, BeginSessionResponseMessage& resp)
{
    WEAVE_ERROR err;
    uint8_t respMsgHash[kMaxHashLength];

    VerifyOrExit(State == kState_BeginRequestGenerated, err = WEAVE_ERROR_INCORRECT_STATE);

    WeaveLogDetail(SecurityManager, "CASE:ProcessBeginSessionResponse");

    // Decode the head of the message.
    err = resp.DecodeHead(msgBuf);
    SuccessOrExit(err);

    // Verify the message signature.
    err = VerifySignature(resp, msgBuf, respMsgHash);
    SuccessOrExit(err);

    // If we asked for key confirmation, verify the responder responded appropriately.
    VerifyOrExit(!PerformingKeyConfirm() || resp.PerformKeyConfirm, err = WEAVE_ERROR_INVALID_CASE_PARAMETER);

    // If the responder asked for key confirmation, we have to do it.
    if (resp.PerformKeyConfirm)
        SetPerformingKeyConfirm(true);

    {
        uint8_t responderKeyConfirmHash[kMaxHashLength];

        // Derive the session keys from the responder's public key and our private key.
        err = DeriveSessionKeys(resp.ECDHPublicKey, respMsgHash, responderKeyConfirmHash);
        SuccessOrExit(err);

        // If performing key confirmation...
        if (PerformingKeyConfirm())
        {
            uint8_t expectedKeyConfirmHashLen = ConfigHashLength();

            // Check the expected responder hash against the value in the response message.
            // Fail if they do not match.

            WEAVE_FAULT_INJECT(nl::Weave::FaultInjection::kFault_CASEKeyConfirm, ExitNow(err = WEAVE_ERROR_KEY_CONFIRMATION_FAILED));

            VerifyOrExit(resp.KeyConfirmHashLength == expectedKeyConfirmHashLen &&
                         ConstantTimeCompare(resp.KeyConfirmHash, responderKeyConfirmHash, expectedKeyConfirmHashLen),
                         err = WEAVE_ERROR_KEY_CONFIRMATION_FAILED);

            State = kState_BeginResponseProcessed;
        }

        else
            State = kState_Complete;
    }

exit:
    if (err != WEAVE_NO_ERROR)
        State = kState_Failed;
    return err;
}

WEAVE_ERROR WeaveCASEEngine::GenerateInitiatorKeyConfirm(PacketBuffer *msgBuf)
{
    WEAVE_ERROR err = WEAVE_NO_ERROR;
    uint8_t keyConfirmHashLen = ConfigHashLength();

    VerifyOrExit(State == kState_BeginResponseProcessed && PerformingKeyConfirm(), err = WEAVE_ERROR_INCORRECT_STATE);

    memcpy(msgBuf->Start(), mSecureState.AfterKeyGen.InitiatorKeyConfirmHash, keyConfirmHashLen);
    msgBuf->SetDataLength(keyConfirmHashLen);

    State = kState_Complete;

exit:
    if (err != WEAVE_NO_ERROR)
        State = kState_Failed;
    return err;
}

WEAVE_ERROR WeaveCASEEngine::ProcessInitiatorKeyConfirm(PacketBuffer *msgBuf)
{
    WEAVE_ERROR err = WEAVE_NO_ERROR;
    uint8_t expectedKeyConfirmHashLen = ConfigHashLength();

    WeaveLogDetail(SecurityManager, "CASE:ProcessInitiatorKeyConfirm");

    VerifyOrExit(State == kState_BeginResponseGenerated && PerformingKeyConfirm(), err = WEAVE_ERROR_INCORRECT_STATE);

    WEAVE_FAULT_INJECT(nl::Weave::FaultInjection::kFault_CASEKeyConfirm, ExitNow(err = WEAVE_ERROR_KEY_CONFIRMATION_FAILED));

    VerifyOrExit(msgBuf->DataLength() == expectedKeyConfirmHashLen &&
                 ConstantTimeCompare(msgBuf->Start(), mSecureState.AfterKeyGen.InitiatorKeyConfirmHash, expectedKeyConfirmHashLen),
                 err = WEAVE_ERROR_KEY_CONFIRMATION_FAILED);

    State = kState_Complete;

exit:
    if (err != WEAVE_NO_ERROR)
        State = kState_Failed;
    return err;
}

WEAVE_ERROR WeaveCASEEngine::ProcessReconfigure(PacketBuffer *msgBuf, ReconfigureMessage& reconf)
{
    WEAVE_ERROR err = WEAVE_NO_ERROR;

    WeaveLogDetail(SecurityManager, "CASE:ProcessReconfigure");

    // Decode the Reconfigure message.
    err = ReconfigureMessage::Decode(msgBuf, reconf);
    SuccessOrExit(err);

    // Fail if the peer has sent more than one Reconfigure message.
    VerifyOrExit(!HasReconfigured(), err = WEAVE_ERROR_TOO_MANY_CASE_RECONFIGURATIONS);
    SetHasReconfigured(true);

    // Verify that the peer's proposed config is allowed.
    VerifyOrExit(IsAllowedConfig(reconf.ProtocolConfig), err = WEAVE_ERROR_UNSUPPORTED_CASE_CONFIGURATION);

    // Verify that the peer's proposed ECDH curve is allowed.
    VerifyOrExit(IsAllowedCurve(reconf.CurveId), err = WEAVE_ERROR_UNSUPPORTED_ELLIPTIC_CURVE);

    // Go back to Idle state so that the engine can be re-used to initiate a new CASE exchange.
    State = kState_Idle;

exit:
    return err;
}

WEAVE_ERROR WeaveCASEEngine::GetSessionKey(const WeaveEncryptionKey *& encKey)
{
    WEAVE_ERROR err = WEAVE_NO_ERROR;

    VerifyOrExit(kState_Complete, err = WEAVE_ERROR_INCORRECT_STATE);

    encKey = &mSecureState.AfterKeyGen.EncryptionKey;

exit:
    return err;
}

WEAVE_ERROR WeaveCASEEngine::VerifyProposedConfig(BeginSessionRequestMessage& req, uint32_t& selectedAltConfig)
{
    WEAVE_ERROR err = WEAVE_ERROR_UNSUPPORTED_CASE_CONFIGURATION;

    WeaveLogDetail(SecurityManager, "CASE:VerifyProposedConfig");

    // If Config2 is allowed, use it if it is the proposed config.
    // If Config2 is NOT the proposed config, but is in the peer's list
    // of alternates, force a reconfig selecting Config2.
    if (IsConfig2Allowed())
    {
        if (req.ProtocolConfig == kCASEConfig_Config2)
            ExitNow(err = WEAVE_NO_ERROR);
        if (req.IsAltConfig(kCASEConfig_Config2))
        {
            selectedAltConfig = kCASEConfig_Config2;
            ExitNow(err = WEAVE_ERROR_CASE_RECONFIG_REQUIRED);
        }
    }

    // If Config1 is allowed, use it if it is the proposed config.
    // If Config1 is NOT the proposed config, but is in the peer's list
    // of alternates, force a reconfig selecting Config1.
    if (IsConfig1Allowed())
    {
        if (req.ProtocolConfig == kCASEConfig_Config1)
            ExitNow(err = WEAVE_NO_ERROR);

        // If Config1 is in the peer's list of alternates, force a reconfig selecting Config1.
        if (req.IsAltConfig(kCASEConfig_Config1))
        {
            selectedAltConfig = kCASEConfig_Config1;
            ExitNow(err = WEAVE_ERROR_CASE_RECONFIG_REQUIRED);
        }
    }

exit:
    return err;
}

WEAVE_ERROR WeaveCASEEngine::VerifyProposedCurve(BeginSessionRequestMessage& req, uint32_t& selectedAltCurve)
{
    WEAVE_ERROR err = WEAVE_NO_ERROR;

    WeaveLogDetail(SecurityManager, "CASE:VerifyProposedCurve");

    // If the requested elliptic curve is not allowed, select an allowed alternate, if available.
    if (!IsAllowedCurve(req.CurveId))
    {
        uint8_t i = 0;
        for (; i < req.AlternateCurveCount; i++)
            if (IsAllowedCurve(req.AlternateCurveIds[i]))
                break;

        VerifyOrExit(i < req.AlternateCurveCount, err = WEAVE_ERROR_UNSUPPORTED_ELLIPTIC_CURVE);

        selectedAltCurve = req.AlternateCurveIds[i];
        ExitNow(err = WEAVE_ERROR_CASE_RECONFIG_REQUIRED);
    }

exit:
    return err;
}

WEAVE_ERROR WeaveCASEEngine::AppendNewECDHKey(BeginSessionMessageBase& msg, PacketBuffer *msgBuf)
{
    WEAVE_ERROR err;
    EncodedECPrivateKey privKey;
    uint16_t msgLen = msgBuf->DataLength();

    WeaveLogDetail(SecurityManager, "CASE:AppendNewECDHKey");

    // Generate an ephemeral public/private key. Store the public key directly into the message and store
    // the private key in the provided object.
    msg.ECDHPublicKey.ECPoint = msgBuf->Start() + msgLen;
    msg.ECDHPublicKey.ECPointLen = msgBuf->AvailableDataLength(); // GenerateECDHKey() will update with final length.
    privKey.PrivKey = mSecureState.BeforeKeyGen.ECDHPrivateKey;
    privKey.PrivKeyLen = sizeof(mSecureState.BeforeKeyGen.ECDHPrivateKey);
    err = GenerateECDHKey(WeaveCurveIdToOID(msg.CurveId), msg.ECDHPublicKey, privKey);
    SuccessOrExit(err);

#if WEAVE_CONFIG_SECURITY_TEST_MODE

    // If enabled, override the generated key with a known key pair to allow man-in-the-middle session key recovery for
    // testing purposes.
    // NOTE: We still do the work of generating a proper key pair in this case so that the execution time
    // remains largely the same.
    if (UseKnownECDHKey())
    {
        // Private key is 1.
        privKey.PrivKey[0] = 0x01;
        privKey.PrivKeyLen = 1;

        // Public key is generator.
        msg.ECDHPublicKey.ECPointLen = msgBuf->AvailableDataLength();
        err = GetCurveG(WeaveCurveIdToOID(msg.CurveId), msg.ECDHPublicKey);
        SuccessOrExit(err);

        WeaveLogError(SecurityManager, "WARNING: Using well-known ECDH key in CASE ***** SESSION IS NOT SECURE *****");
    }

#endif // WEAVE_CONFIG_SECURITY_TEST_MODE

    mSecureState.BeforeKeyGen.ECDHPrivateKeyLength = privKey.PrivKeyLen;

    msgBuf->SetDataLength(msgLen + msg.ECDHPublicKey.ECPointLen);

exit:
    return err;
}

WEAVE_ERROR WeaveCASEEngine::AppendCertInfo(BeginSessionMessageBase& msg, PacketBuffer *msgBuf)
{
    WEAVE_ERROR err;
    uint16_t msgLen = msgBuf->DataLength();

    WeaveLogDetail(SecurityManager, "CASE:AppendCertInfo");

    // Using the auth delegate, generate the certificate information for the local node and append it to the message.
    err = AuthDelegate->GetNodeCertInfo(IsInitiator(), msgBuf->Start() + msgLen, msgBuf->AvailableDataLength(), msg.CertInfoLength);
    SuccessOrExit(err);
    msgBuf->SetDataLength(msgLen + msg.CertInfoLength);

exit:
    return err;
}

WEAVE_ERROR WeaveCASEEngine::AppendPayload(BeginSessionMessageBase& msg, PacketBuffer *msgBuf)
{
    WEAVE_ERROR err = WEAVE_NO_ERROR;
    uint16_t msgLen = msgBuf->DataLength();

    WeaveLogDetail(SecurityManager, "CASE:AppendPayload");

    err = AuthDelegate->GetNodePayload(IsInitiator(), msgBuf->Start() + msgLen, msgBuf->AvailableDataLength(), msg.PayloadLength);
    SuccessOrExit(err);

    msgBuf->SetDataLength(msgLen + msg.PayloadLength);

exit:
    return err;
}

// Generate a signature for an encoded CASE message (in the supplied buffer) and append it to the message.
WEAVE_ERROR WeaveCASEEngine::AppendSignature(BeginSessionMessageBase& msg, PacketBuffer *msgBuf, uint8_t *msgHash)
{
    WEAVE_ERROR err;
    uint32_t privKeyCurveId;
    EncodedECPublicKey pubKey;
    EncodedECPrivateKey privKey;
    EncodedECDSASignature ecdsaSig;
    uint8_t ecdsaRBuf[EncodedECDSASignature::kMaxValueLength];
    uint8_t ecdsaSBuf[EncodedECDSASignature::kMaxValueLength];
    uint8_t *msgStart = msgBuf->Start();
    uint16_t signedDataLen = msgBuf->DataLength();
    const uint8_t *signingKey;
    uint16_t signingKeyLen;

    WeaveLogDetail(SecurityManager, "CASE:AppendSignature");

    // Generate a hash of the signed portion of the message.
    GenerateHash(msgStart, signedDataLen, msgHash);

    WeaveLogDetail(SecurityManager, "CASE:GetNodePrivateKey");

    // Get the private key to sign the message.
    err = AuthDelegate->GetNodePrivateKey(IsInitiator(), signingKey, signingKeyLen);
    SuccessOrExit(err);

    // Decode the supplied private key.
    err = DecodeWeaveECPrivateKey(signingKey, signingKeyLen, privKeyCurveId, pubKey, privKey);
    SuccessOrExit(err);

    // Use temporary buffers to hold the generated signature value until we write it to the end of the message.
    ecdsaSig.R = ecdsaRBuf;
    ecdsaSig.RLen = sizeof(ecdsaRBuf);
    ecdsaSig.S = ecdsaSBuf;
    ecdsaSig.SLen = sizeof(ecdsaSBuf);

    WeaveLogDetail(SecurityManager, "CASE:GenerateECDSASignature");

    // Generate the signature for the message based on its hash.
    err = GenerateECDSASignature(WeaveCurveIdToOID(privKeyCurveId), msgHash, ConfigHashLength(), privKey, ecdsaSig);
    SuccessOrExit(err);

    err = AuthDelegate->ReleaseNodePrivateKey(signingKey);
    SuccessOrExit(err);

    // Append a CASE signature object to the end of the message buffer.
    {
        TLVWriter writer;
        writer.Init(msgBuf);
        writer.ImplicitProfileId = kWeaveProfile_Security;

        WeaveLogDetail(SecurityManager, "CASE:EncodeWeaveECDSASignature");

        err = EncodeWeaveECDSASignature(writer, ecdsaSig, ProfileTag(kWeaveProfile_Security, kTag_WeaveCASESignature));
        SuccessOrExit(err);

        err = writer.Finalize();
        SuccessOrExit(err);

        msg.Signature = msgStart + signedDataLen;
        msg.SignatureLength = writer.GetLengthWritten();
    }

exit:
    return err;
}

// Verify a CASE message signature (for the message in the supplied buffer) against a given public key.
// Returns a hash of the signed portion of the message in the supplied bufer.
WEAVE_ERROR WeaveCASEEngine::VerifySignature(BeginSessionMessageBase& msg, PacketBuffer *msgBuf, uint8_t *msgHash)
{
    WEAVE_ERROR err, validRes;
    WeaveCertificateSet certSet;
    ValidationContext certValidContext;
    WeaveDN peerCertDN;
    CertificateKeyId peerCertSubjectKeyId;
    WeaveCertificateData *peerCert = NULL;
    EncodedECDSASignature ecdsaSig;
    TLVReader reader;
    uint16_t signedDataLen;
    uint8_t *msgStart = msgBuf->Start();
    bool callEndCertValidation = false;

    WeaveLogDetail(SecurityManager, "CASE:VerifySignature");

    // Invoke the auth delegate to prepare the certificate set and the validation context.
    // This will load the trust anchors into the certificate set and establish the
    // desired validation criteria for the peer's entity certificate.
    err = AuthDelegate->BeginCertValidation(IsInitiator(), certSet, certValidContext);
    SuccessOrExit(err);
    callEndCertValidation = true;

    // If the cert type property has been set, set it as the required certificate type in the
    // validation context such that the cert type is enforced during the call to FindValidCert().
    certValidContext.RequiredCertType = mCertType;

    WeaveLogDetail(SecurityManager, "CASE:DecodeCertificateInfo");

    // Decode the certificate information supplied by the peer.
    certValidContext.RequiredKeyUsages |= kKeyUsageFlag_DigitalSignature;
    validRes = DecodeCertificateInfo(msg, certSet, peerCertDN, peerCertSubjectKeyId);

    // If decoding was successful, search the certificate set for the peer's certificate and
    // validate that it is trusted and suitable for CASE authentication.
    if (validRes == WEAVE_NO_ERROR)
    {
        WeaveLogDetail(SecurityManager, "CASE:ValidateCert");
        validRes = certSet.FindValidCert(peerCertDN, peerCertSubjectKeyId, certValidContext, peerCert);
    }

    // If a valid certificate was found for the peer...
    if (validRes == WEAVE_NO_ERROR)
    {
        // Update the cert type property with the type of the peer's certificate.
        mCertType = peerCert->CertType;
    }

    // Tell the auth delegate about the results of basic certificate validation and let it weigh in
    // on the process.  Note that this may alter the validation result (validRes) either from successful
    // to unsuccessful, or in rare cases, from unsuccessful to successful.
    err = AuthDelegate->HandleCertValidationResult(IsInitiator(), validRes, peerCert, msg.PeerNodeId, certSet, certValidContext);
    SuccessOrExit(err);

    // Check that validation succeeded.
    VerifyOrExit((validRes != WEAVE_ERROR_UNSUPPORTED_ELLIPTIC_CURVE &&
                  validRes != WEAVE_ERROR_UNSUPPORTED_SIGNATURE_TYPE),
                  err = WEAVE_ERROR_UNSUPPORTED_CERT_FORMAT);
    VerifyOrExit(validRes == WEAVE_NO_ERROR, err = validRes);
    VerifyOrExit(peerCert != NULL, err = WEAVE_ERROR_INCORRECT_STATE);

    // Decode the CASE signature from the end of the message.
    reader.Init(msg.Signature, msg.SignatureLength);
    reader.ImplicitProfileId = kWeaveProfile_Security;
    err = reader.Next(kTLVType_Structure, ProfileTag(kWeaveProfile_Security, kTag_WeaveCASESignature));
    SuccessOrExit(err);
    WeaveLogDetail(SecurityManager, "CASE:DecodeWeaveECDSASignature");
    err = DecodeWeaveECDSASignature(reader, ecdsaSig);
    SuccessOrExit(err);
    err = reader.VerifyEndOfContainer();
    SuccessOrExit(err);

    // Compute the length of the signed portion of the message.
    signedDataLen = msg.Signature - msgStart;

    // Generate a hash of the signed portion of the message.
    GenerateHash(msgStart, signedDataLen, msgHash);

    // Verify the message signature against the computed message hash and the
    // the public key from the peer's certificate.
    WeaveLogDetail(SecurityManager, "CASE:VerifyECDSASignature");
    err = VerifyECDSASignature(WeaveCurveIdToOID(peerCert->PubKeyCurveId), msgHash, ConfigHashLength(),
                               ecdsaSig, peerCert->PublicKey.EC);
    SuccessOrExit(err);

exit:
    if (callEndCertValidation)
    {
        WEAVE_ERROR endErr = AuthDelegate->EndCertValidation(certSet, certValidContext);
        if (err == WEAVE_NO_ERROR)
            err = endErr;
    }
    certSet.Release();
    return err;
}

WEAVE_ERROR WeaveCASEEngine::DecodeCertificateInfo(BeginSessionMessageBase& msg, WeaveCertificateSet& certSet,
                                                   WeaveDN& entityCertDN, CertificateKeyId& entityCertSubjectKeyId)
{
    WEAVE_ERROR err;
    TLVReader reader;
    WeaveCertificateData *entityCert = NULL;

    // Begin decoding the certificate information structure.
    reader.Init(msg.CertInfo, msg.CertInfoLength);
    reader.ImplicitProfileId = kWeaveProfile_Security;
    err = reader.Next(kTLVType_Structure, ProfileTag(kWeaveProfile_Security, kTag_WeaveCASECertificateInformation));
    SuccessOrExit(err);

    {
        TLVType containerType;

        err = reader.EnterContainer(containerType);
        SuccessOrExit(err);

        err = reader.Next();

        // Look for the element representing the certificate of the authenticating entity (i.e. the peer). If found...
        if (err == WEAVE_NO_ERROR && reader.GetTag() == ContextTag(kTag_CASECertificateInfo_EntityCertificate))
        {
            // Load the authenticating entity's certificate into the certificate set.
            err = certSet.LoadCert(reader, kDecodeFlag_GenerateTBSHash, entityCert);
            SuccessOrExit(err);

            entityCertDN = entityCert->SubjectDN;
            entityCertSubjectKeyId = entityCert->SubjectKeyId;

            err = reader.Next();
        }

        // Look for the EntityCertificateRef element and fail if found.
        // NOTE: This version of the code does not support the use of certificate reference to identify the certificate.
        if (err == WEAVE_NO_ERROR && reader.GetTag() == ContextTag(kTag_CASECertificateInfo_EntityCertificateRef))
        {
            ExitNow(err = WEAVE_ERROR_UNSUPPORTED_CERT_FORMAT); // TODO: use better error
        }

        // Look for the RelatedCertificates element. If found, load the contained certificates into the certificate set.
        if (err == WEAVE_NO_ERROR && reader.GetTag() == ContextTag(kTag_CASECertificateInfo_RelatedCertificates))
        {
            err = certSet.LoadCerts(reader, kDecodeFlag_GenerateTBSHash);
            SuccessOrExit(err);

            err = reader.Next();
        }

        // Skip the TrustAnchors element if present.  This represents information an initiator provides to the
        // responder about what certificates it trusts, allowing the responder to select an appropriate entity
        // certificate to respond with. This code assumes that the local node only has a single entity certificate,
        // and thus its that or nothing.
        if (err == WEAVE_NO_ERROR && reader.GetTag() == ContextTag(kTag_CASECertificateInfo_TrustAnchors))
        {
            err = reader.Next();
        }

        if (err == WEAVE_NO_ERROR)
            ExitNow(err = WEAVE_ERROR_UNEXPECTED_TLV_ELEMENT);
        if (err != WEAVE_END_OF_TLV)
            ExitNow();

        err = reader.ExitContainer(containerType);
        SuccessOrExit(err);
    }

    err = reader.VerifyEndOfContainer();
    SuccessOrExit(err);

    // Verify that the peer included its entity certificate.
    VerifyOrExit(entityCert != NULL, err = WEAVE_ERROR_INVALID_ARGUMENT);

exit:
    return err;
}

WEAVE_ERROR WeaveCASEEngine::DeriveSessionKeys(EncodedECPublicKey& pubKey, const uint8_t *respMsgHash,
                                               uint8_t *responderKeyConfirmHash)
{
    WEAVE_ERROR err;
    uint8_t hashLen = ConfigHashLength();
#if WEAVE_CONFIG_SUPPORT_CASE_CONFIG1
    HKDFSHA1Or256 hkdf(IsUsingConfig1());
#else
    HKDFSHA256 hkdf;
#endif

    WeaveLogDetail(SecurityManager, "CASE:DeriveSessionKeys");

    // Only AES128CTRSHA1 keys supported for now.
    VerifyOrExit(EncryptionType == kWeaveEncryptionType_AES128CTRSHA1, err = WEAVE_ERROR_UNSUPPORTED_ENCRYPTION_TYPE);

    // Prepare a salt value to be used in the generation of the master key. The salt value
    // is composed from the hashes of the signed portions of the CASE request and response
    // messages.  Thus the salt incorporates the entity certificates for both parties plus
    // their ephemeral DH public keys.
    {
        uint8_t keySalt[2 * kMaxHashLength];

        memcpy(keySalt, mSecureState.BeforeKeyGen.RequestMsgHash, hashLen);
        memcpy(keySalt + hashLen, respMsgHash, hashLen);

#ifdef CASE_PRINT_CRYPTO_DATA
        printf("Salt: "); PrintHex(keySalt, 2 * hashLen); printf("\n");
#endif

        hkdf.BeginExtractKey(keySalt, 2 * hashLen);
    }

    // Generate a master key from which the session keys will be derived...
    {
        EncodedECPrivateKey privKey;
        uint8_t sharedSecretBuf[kMaxECDHSharedSecretSize];
        uint16_t sharedSecretLen;
        OID curveOID;

        // Compute the Diffie-Hellman shared secret from the peer's public key and our private key.
        privKey.PrivKey = mSecureState.BeforeKeyGen.ECDHPrivateKey;
        privKey.PrivKeyLen = mSecureState.BeforeKeyGen.ECDHPrivateKeyLength;
        curveOID = WeaveCurveIdToOID(mCurveId);
        err = ECDHComputeSharedSecret(curveOID, pubKey, privKey, sharedSecretBuf, sizeof(sharedSecretBuf), sharedSecretLen);
        SuccessOrExit(err);

        ClearSecretData(mSecureState.BeforeKeyGen.ECDHPrivateKey, sizeof(mSecureState.BeforeKeyGen.ECDHPrivateKey));

#ifdef CASE_PRINT_CRYPTO_DATA
        printf("Key Material: "); PrintHex(sharedSecretBuf, sharedSecretLen); printf("\n");
#endif

        // Perform HKDF-based key extraction to produce a master pseudo-random key from the
        // ECDH shared secret.
        hkdf.AddKeyMaterial(sharedSecretBuf, sharedSecretLen);
        err = hkdf.FinishExtractKey();
        ClearSecretData(sharedSecretBuf, sizeof(sharedSecretBuf));
        SuccessOrExit(err);
    }

    // Derive the session keys from the master key...
    {
        uint8_t sessionKeyData[WeaveEncryptionKey_AES128CTRSHA1::KeySize + kMaxHashLength];
        uint16_t keyLen;

        // If performing key confirmation, arrange to generate enough key data for the session
        // keys (data encryption and integrity) as well as a key to be used in key confirmation.
        if (PerformingKeyConfirm())
            keyLen = WeaveEncryptionKey_AES128CTRSHA1::KeySize + hashLen;
        else
            keyLen = WeaveEncryptionKey_AES128CTRSHA1::KeySize;

        // Perform HKDF-based key expansion to produce the desired key data.
        err = hkdf.ExpandKey(NULL, 0, keyLen, sessionKeyData);
        SuccessOrExit(err);

#ifdef CASE_PRINT_CRYPTO_DATA
        printf("Session Key Data: "); PrintHex(sessionKeyData, keyLen); printf("\n");
#endif

        // Copy the generated key data to the appropriate destinations.
        memcpy(mSecureState.AfterKeyGen.EncryptionKey.AES128CTRSHA1.DataKey,
               sessionKeyData,
               WeaveEncryptionKey_AES128CTRSHA1::DataKeySize);
        memcpy(mSecureState.AfterKeyGen.EncryptionKey.AES128CTRSHA1.IntegrityKey,
               sessionKeyData + WeaveEncryptionKey_AES128CTRSHA1::DataKeySize,
               WeaveEncryptionKey_AES128CTRSHA1::IntegrityKeySize);

        // If performing key confirmation...
        if (PerformingKeyConfirm())
        {
            // Use the key confirmation key to generate key confirmation hashes. Store the initiator hash
            // (the single hash) in state data for later use.  Return the responder hash (the double hash)
            // to the caller.
            uint8_t *keyConfirmKey = sessionKeyData + WeaveEncryptionKey_AES128CTRSHA1::KeySize;
            GenerateKeyConfirmHashes(keyConfirmKey, mSecureState.AfterKeyGen.InitiatorKeyConfirmHash,
                                     responderKeyConfirmHash);
        }

        ClearSecretData(sessionKeyData, sizeof(sessionKeyData));
    }

exit:
    return err;
}

void WeaveCASEEngine::GenerateHash(const uint8_t *inData, uint16_t inDataLen, uint8_t *hash)
{
    if (IsUsingConfig1())
    {
        SHA1 sha;
        sha.Begin();
        sha.AddData(inData, inDataLen);
        sha.Finish(hash);
    }
    else
    {
        SHA256 sha;
        sha.Begin();
        sha.AddData(inData, inDataLen);
        sha.Finish(hash);
    }
}

void WeaveCASEEngine::GenerateKeyConfirmHashes(const uint8_t *keyConfirmKey, uint8_t *singleHash, uint8_t *doubleHash)
{
    uint8_t hashLen = ConfigHashLength();

    // Generate a single hash of the key confirmation key.
    GenerateHash(keyConfirmKey, hashLen, singleHash);

    // Generate a double hash of the key confirmation key.
    GenerateHash(singleHash, hashLen, doubleHash);
}

uint32_t WeaveCASEEngine::SelectedConfig() const
{
    if (IsUsingConfig1())
        return kCASEConfig_Config1;
    else
        return kCASEConfig_Config2;
}

bool WeaveCASEEngine::IsAllowedConfig(uint32_t config) const
{
    return (config == kCASEConfig_Config1 && IsConfig1Allowed()) ||
           (config == kCASEConfig_Config2 && IsConfig2Allowed());
}


} // namespace CASE
} // namespace Security
} // namespace Profiles
} // namespace Weave
} // namespace nl