/* Microsoft Reference Implementation for TPM 2.0
 *
 *  The copyright in this software is being made available under the BSD License,
 *  included below. This software may be subject to other third party and
 *  contributor rights, including patent rights, and no such rights are granted
 *  under this license.
 *
 *  Copyright (c) Microsoft Corporation
 *
 *  All rights reserved.
 *
 *  BSD License
 *
 *  Redistribution and use in source and binary forms, with or without modification,
 *  are permitted provided that the following conditions are met:
 *
 *  Redistributions of source code must retain the above copyright notice, this list
 *  of conditions and the following disclaimer.
 *
 *  Redistributions in binary form must reproduce the above copyright notice, this
 *  list of conditions and the following disclaimer in the documentation and/or
 *  other materials provided with the distribution.
 *
 *  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS ""AS IS""
 *  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 *  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 *  DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
 *  ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 *  (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 *  LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
 *  ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 *  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */
//** Introduction
// This file contains constant definition shared by CryptUtil and the parts
// of the Crypto Engine.
//

#ifndef _CRYPT_RAND_H
#define _CRYPT_RAND_H

//** DRBG Structures and Defines

// Values and structures for the random number generator. These values are defined
// in this header file so that the size of the RNG state can be known to TPM.lib.
// This allows the allocation of some space in NV memory for the state to
// be stored on an orderly shutdown.

// The DRBG based on a symmetric block cipher is defined by three values,
// 1) the key size
// 2) the block size (the IV size)
// 3) the symmetric algorithm

#define DRBG_KEY_SIZE_BITS AES_MAX_KEY_SIZE_BITS
#define DRBG_IV_SIZE_BITS  (AES_MAX_BLOCK_SIZE * 8)
#define DRBG_ALGORITHM     TPM_ALG_AES

typedef tpmKeyScheduleAES DRBG_KEY_SCHEDULE;
#define DRBG_ENCRYPT_SETUP(key, keySizeInBits, schedule) \
  TpmCryptSetEncryptKeyAES(key, keySizeInBits, schedule)
#define DRBG_ENCRYPT(keySchedule, in, out) \
  TpmCryptEncryptAES(SWIZZLE(keySchedule, in, out))

#if((DRBG_KEY_SIZE_BITS % RADIX_BITS) != 0) || ((DRBG_IV_SIZE_BITS % RADIX_BITS) != 0)
#  error "Key size and IV for DRBG must be even multiples of the radix"
#endif
#if(DRBG_KEY_SIZE_BITS % DRBG_IV_SIZE_BITS) != 0
#  error "Key size for DRBG must be even multiple of the cypher block size"
#endif

// Derived values
#define DRBG_MAX_REQUESTS_PER_RESEED (1 << 48)
#define DRBG_MAX_REQEST_SIZE         (1 << 32)

#define pDRBG_KEY(seed) ((DRBG_KEY*)&(((BYTE*)(seed))[0]))
#define pDRBG_IV(seed)  ((DRBG_IV*)&(((BYTE*)(seed))[DRBG_KEY_SIZE_BYTES]))

#define DRBG_KEY_SIZE_WORDS (BITS_TO_CRYPT_WORDS(DRBG_KEY_SIZE_BITS))
#define DRBG_KEY_SIZE_BYTES (DRBG_KEY_SIZE_WORDS * RADIX_BYTES)

#define DRBG_IV_SIZE_WORDS (BITS_TO_CRYPT_WORDS(DRBG_IV_SIZE_BITS))
#define DRBG_IV_SIZE_BYTES (DRBG_IV_SIZE_WORDS * RADIX_BYTES)

#define DRBG_SEED_SIZE_WORDS (DRBG_KEY_SIZE_WORDS + DRBG_IV_SIZE_WORDS)
#define DRBG_SEED_SIZE_BYTES (DRBG_KEY_SIZE_BYTES + DRBG_IV_SIZE_BYTES)

typedef union
{
    BYTE          bytes[DRBG_KEY_SIZE_BYTES];
    crypt_uword_t words[DRBG_KEY_SIZE_WORDS];
} DRBG_KEY;

typedef union
{
    BYTE          bytes[DRBG_IV_SIZE_BYTES];
    crypt_uword_t words[DRBG_IV_SIZE_WORDS];
} DRBG_IV;

typedef union
{
    BYTE          bytes[DRBG_SEED_SIZE_BYTES];
    crypt_uword_t words[DRBG_SEED_SIZE_WORDS];
} DRBG_SEED;

#define CTR_DRBG_MAX_REQUESTS_PER_RESEED ((UINT64)1 << 20)
#define CTR_DRBG_MAX_BYTES_PER_REQUEST   (1 << 16)

#define CTR_DRBG_MIN_ENTROPY_INPUT_LENGTH    DRBG_SEED_SIZE_BYTES
#define CTR_DRBG_MAX_ENTROPY_INPUT_LENGTH    DRBG_SEED_SIZE_BYTES
#define CTR_DRBG_MAX_ADDITIONAL_INPUT_LENGTH DRBG_SEED_SIZE_BYTES

#define TESTING (1 << 0)
#define ENTROPY (1 << 1)
#define TESTED  (1 << 2)

#define IsTestStateSet(BIT)    ((g_cryptoSelfTestState.rng & BIT) != 0)
#define SetTestStateBit(BIT)   (g_cryptoSelfTestState.rng |= BIT)
#define ClearTestStateBit(BIT) (g_cryptoSelfTestState.rng &= ~BIT)

#define IsSelfTest()    IsTestStateSet(TESTING)
#define SetSelfTest()   SetTestStateBit(TESTING)
#define ClearSelfTest() ClearTestStateBit(TESTING)

#define IsEntropyBad()    IsTestStateSet(ENTROPY)
#define SetEntropyBad()   SetTestStateBit(ENTROPY)
#define ClearEntropyBad() ClearTestStateBit(ENTROPY)

#define IsDrbgTested()    IsTestStateSet(TESTED)
#define SetDrbgTested()   SetTestStateBit(TESTED)
#define ClearDrbgTested() ClearTestStateBit(TESTED)

typedef struct
{
    UINT64    reseedCounter;
    UINT32    magic;
    DRBG_SEED seed;          // contains the key and IV for the counter mode DRBG
    UINT32    lastValue[4];  // used when the TPM does continuous self-test
                             // for FIPS compliance of DRBG
} DRBG_STATE, *pDRBG_STATE;
#define DRBG_MAGIC ((UINT32)0x47425244)  // "DRBG" backwards so that it displays

typedef struct KDF_STATE
{
    UINT64       counter;
    UINT32       magic;
    UINT32       limit;
    TPM2B*       seed;
    const TPM2B* label;
    TPM2B*       context;
    TPM_ALG_ID   hash;
    TPM_ALG_ID   kdf;
    UINT16       digestSize;
    TPM2B_DIGEST residual;
} KDF_STATE, *pKDR_STATE;
#define KDF_MAGIC ((UINT32)0x4048444a)  // "KDF " backwards

// Make sure that any other structures added to this union start with a 64-bit
// counter and a 32-bit magic number
typedef union
{
    DRBG_STATE drbg;
    KDF_STATE  kdf;
} RAND_STATE;

// This is the state used when the library uses a random number generator.
// A special function is installed for the library to call. That function
// picks up the state from this location and uses it for the generation
// of the random number.
extern RAND_STATE* s_random;

// When instrumenting RSA key sieve
#if RSA_INSTRUMENT
#  define PRIME_INDEX(x)       ((x) == 512 ? 0 : (x) == 1024 ? 1 : 2)
#  define INSTRUMENT_SET(a, b) ((a) = (b))
#  define INSTRUMENT_ADD(a, b) (a) = (a) + (b)
#  define INSTRUMENT_INC(a)    (a) = (a) + 1

extern UINT32 PrimeIndex;
extern UINT32 failedAtIteration[10];
extern UINT32 PrimeCounts[3];
extern UINT32 MillerRabinTrials[3];
extern UINT32 totalFieldsSieved[3];
extern UINT32 bitsInFieldAfterSieve[3];
extern UINT32 emptyFieldsSieved[3];
extern UINT32 noPrimeFields[3];
extern UINT32 primesChecked[3];
extern UINT16 lastSievePrime;
#else
#  define INSTRUMENT_SET(a, b)
#  define INSTRUMENT_ADD(a, b)
#  define INSTRUMENT_INC(a)
#endif

#endif  // _CRYPT_RAND_H
