/********************************************************************************/
/*										*/
/*			 	Ephemeral EC Keys    				*/
/*			     Written by Ken Goldman				*/
/*		       IBM Thomas J. Watson Research Center			*/
/*										*/
/*  Licenses and Notices							*/
/*										*/
/*  1. Copyright Licenses:							*/
/*										*/
/*  - Trusted Computing Group (TCG) grants to the user of the source code in	*/
/*    this specification (the "Source Code") a worldwide, irrevocable, 		*/
/*    nonexclusive, royalty free, copyright license to reproduce, create 	*/
/*    derivative works, distribute, display and perform the Source Code and	*/
/*    derivative works thereof, and to grant others the rights granted herein.	*/
/*										*/
/*  - The TCG grants to the user of the other parts of the specification 	*/
/*    (other than the Source Code) the rights to reproduce, distribute, 	*/
/*    display, and perform the specification solely for the purpose of 		*/
/*    developing products based on such documents.				*/
/*										*/
/*  2. Source Code Distribution Conditions:					*/
/*										*/
/*  - Redistributions of Source Code must retain the above copyright licenses, 	*/
/*    this list of conditions and the following disclaimers.			*/
/*										*/
/*  - Redistributions in binary form must reproduce the above copyright 	*/
/*    licenses, this list of conditions	and the following disclaimers in the 	*/
/*    documentation and/or other materials provided with the distribution.	*/
/*										*/
/*  3. Disclaimers:								*/
/*										*/
/*  - THE COPYRIGHT LICENSES SET FORTH ABOVE DO NOT REPRESENT ANY FORM OF	*/
/*  LICENSE OR WAIVER, EXPRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, WITH	*/
/*  RESPECT TO PATENT RIGHTS HELD BY TCG MEMBERS (OR OTHER THIRD PARTIES)	*/
/*  THAT MAY BE NECESSARY TO IMPLEMENT THIS SPECIFICATION OR OTHERWISE.		*/
/*  Contact TCG Administration (admin@trustedcomputinggroup.org) for 		*/
/*  information on specification licensing rights available through TCG 	*/
/*  membership agreements.							*/
/*										*/
/*  - THIS SPECIFICATION IS PROVIDED "AS IS" WITH NO EXPRESS OR IMPLIED 	*/
/*    WARRANTIES WHATSOEVER, INCLUDING ANY WARRANTY OF MERCHANTABILITY OR 	*/
/*    FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, COMPLETENESS, OR 		*/
/*    NONINFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS, OR ANY WARRANTY 		*/
/*    OTHERWISE ARISING OUT OF ANY PROPOSAL, SPECIFICATION OR SAMPLE.		*/
/*										*/
/*  - Without limitation, TCG and its members and licensors disclaim all 	*/
/*    liability, including liability for infringement of any proprietary 	*/
/*    rights, relating to use of information in this specification and to the	*/
/*    implementation of this specification, and TCG disclaims all liability for	*/
/*    cost of procurement of substitute goods or services, lost profits, loss 	*/
/*    of use, loss of data or any incidental, consequential, direct, indirect, 	*/
/*    or special damages, whether under contract, tort, warranty or otherwise, 	*/
/*    arising in any way out of use or reliance upon this specification or any 	*/
/*    information herein.							*/
/*										*/
/*  (c) Copyright IBM Corp. and others, 2016 - 2023				*/
/*										*/
/********************************************************************************/

#include "Tpm.h"
#include "Commit_fp.h"
#include "TpmMath_Util_fp.h"

#if CC_Commit  // Conditional expansion of this file

/*(See part 3 specification)
// This command performs the point multiply operations for anonymous signing
// scheme.
*/
//  Return Type: TPM_RC
//      TPM_RC_ATTRIBUTES       'keyHandle' references a restricted key that is not a
//                              signing key
//      TPM_RC_ECC_POINT        either 'P1' or the point derived from 's2' is not on
//                              the curve of 'keyHandle'
//      TPM_RC_HASH             invalid name algorithm in 'keyHandle'
//      TPM_RC_KEY              'keyHandle' does not reference an ECC key
//      TPM_RC_SCHEME           the scheme of 'keyHandle' is not an anonymous scheme
//      TPM_RC_NO_RESULT        'K', 'L' or 'E' was a point at infinity; or
//                              failed to generate "r" value
//      TPM_RC_SIZE             's2' is empty but 'y2' is not or 's2' provided but
//                              'y2' is not
TPM_RC
TPM2_Commit(Commit_In*  in,  // IN: input parameter list
	    Commit_Out* out  // OUT: output parameter list
	    )
{
    OBJECT*             eccKey;
    TPMS_ECC_POINT      P2;
    TPMS_ECC_POINT*     pP2 = NULL;
    TPMS_ECC_POINT*     pP1 = NULL;
    TPM2B_ECC_PARAMETER r;
    TPM2B_ECC_PARAMETER p;
    TPM_RC              result;
    TPMS_ECC_PARMS*     parms;
    // Input Validation

    if(RuntimeProfileRequiresAttributeFlags(&g_RuntimeProfile,	// libtpms added begin
					    RUNTIME_ATTRIBUTE_NO_ECC_KEY_DERIVATION))
	return TPM_RC_TYPE;					// libtpms added end

    eccKey = HandleToObject(in->signHandle);
    parms  = &eccKey->publicArea.parameters.eccDetail;

    // Input key must be an ECC key
    if(eccKey->publicArea.type != TPM_ALG_ECC)
	return TPM_RCS_KEY + RC_Commit_signHandle;

    // This command may only be used with a sign-only key using an anonymous
    // scheme.
    // NOTE: a sign + decrypt key has no scheme so it will not be an anonymous one
    // and an unrestricted sign key might no have a signing scheme but it can't
    // be use in Commit()
    if(!CryptIsSchemeAnonymous(parms->scheme.scheme))
	return TPM_RCS_SCHEME + RC_Commit_signHandle;

    // Make sure that both parts of P2 are present if either is present
    if((in->s2.t.size == 0) != (in->y2.t.size == 0))
	return TPM_RCS_SIZE + RC_Commit_y2;

    // Get prime modulus for the curve. This is needed later but getting this now
    // allows confirmation that the curve exists.
    if(!TpmMath_IntTo2B(ExtEcc_CurveGetPrime(parms->curveID), &p.b, 0))
	return TPM_RCS_KEY + RC_Commit_signHandle;

    // Get the random value that will be used in the point multiplications
    // Note: this does not commit the count.
    if(!CryptGenerateR(&r, NULL, parms->curveID, &eccKey->name))
	return TPM_RC_NO_RESULT;

    // Set up P2 if s2 and Y2 are provided
    if(in->s2.t.size != 0)
	{
	    TPM2B_DIGEST x2;

	    pP2 = &P2;

	    // copy y2 for P2
	    P2.y = in->y2;

	    // Compute x2  HnameAlg(s2) mod p
	    //      do the hash operation on s2 with the size of curve 'p'
	    x2.t.size = CryptHashBlock(eccKey->publicArea.nameAlg,
				       in->s2.t.size,
				       in->s2.t.buffer,
				       sizeof(x2.t.buffer),
				       x2.t.buffer);

	    // If there were error returns in the hash routine, indicate a problem
	    // with the hash algorithm selection
	    if(x2.t.size == 0)
		return TPM_RCS_HASH + RC_Commit_signHandle;
	    // The size of the remainder will be same as the size of p. DivideB() will
	    // pad the results (leading zeros) if necessary to make the size the same
	    P2.x.t.size = p.t.size;
	    //  set p2.x = hash(s2) mod p
	    if(DivideB(&x2.b, &p.b, NULL, &P2.x.b) != TPM_RC_SUCCESS)
		return TPM_RC_NO_RESULT;

	    if(!CryptEccIsPointOnCurve(parms->curveID, pP2))
		return TPM_RCS_ECC_POINT + RC_Commit_s2;

	    if(eccKey->attributes.publicOnly == SET)
		return TPM_RCS_KEY + RC_Commit_signHandle;
	}
    // If there is a P1, make sure that it is on the curve
    // NOTE: an "empty" point has two UINT16 values which are the size values
    // for each of the coordinates.
    if(in->P1.size > 4)
	{
	    pP1 = &in->P1.point;
	    if(!CryptEccIsPointOnCurve(parms->curveID, pP1))
		return TPM_RCS_ECC_POINT + RC_Commit_P1;
	}

    // Pass the parameters to CryptCommit.
    // The work is not done in-line because it does several point multiplies
    // with the same curve.  It saves work by not having to reload the curve
    // parameters multiple times.
    result = CryptEccCommitCompute(&out->K.point,
				   &out->L.point,
				   &out->E.point,
				   parms->curveID,
				   pP1,
				   pP2,
				   &eccKey->sensitive.sensitive.ecc,
				   &r);
    if(result != TPM_RC_SUCCESS)
	return result;

    // The commit computation was successful so complete the commit by setting
    // the bit
    out->counter = CryptCommit();

    return TPM_RC_SUCCESS;
}

#endif  // CC_Commit

#include "Tpm.h"
#include "EC_Ephemeral_fp.h"
#if CC_EC_Ephemeral  // Conditional expansion of this file
TPM_RC
TPM2_EC_Ephemeral(
		  EC_Ephemeral_In     *in,            // IN: input parameter list
		  EC_Ephemeral_Out    *out            // OUT: output parameter list
		  )
{
    TPM2B_ECC_PARAMETER      r;
    TPM_RC                   result;

    if(RuntimeProfileRequiresAttributeFlags(&g_RuntimeProfile,	// libtpms added begin
					    RUNTIME_ATTRIBUTE_NO_ECC_KEY_DERIVATION))
	return TPM_RC_TYPE;					// libtpms added end

    //
    do
	{
	    // Get the random value that will be used in the point multiplications
	    // Note: this does not commit the count.
	    if(!CryptGenerateR(&r, NULL, in->curveID, NULL))
		return TPM_RC_NO_RESULT;
	    // do a point multiply
	    result = CryptEccPointMultiply(&out->Q.point, in->curveID, NULL, &r,
					   NULL, NULL);
	    // commit the count value if either the r value results in the point at
	    // infinity or if the value is good. The commit on the r value for infinity
	    // is so that the r value will be skipped.
	    if((result == TPM_RC_SUCCESS) || (result == TPM_RC_NO_RESULT))
		out->counter = CryptCommit();
	} while(result == TPM_RC_NO_RESULT);
    return TPM_RC_SUCCESS;
}
#endif // CC_EC_Ephemeral
