/*
 * Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */
/* clang-format off */

/* clang-format on */

/*
 * RSA low level APIs are deprecated for public use, but still ok for
 * internal use.
 */
#include "internal/deprecated.h"
#include "internal/nelem.h"
#include <openssl/crypto.h>
#include <openssl/evp.h>
#include <openssl/core_dispatch.h>
#include <openssl/core_names.h>
#include <openssl/rsa.h>
#include <openssl/params.h>
#include <openssl/err.h>
#include <openssl/proverr.h>
#include "crypto/rsa.h"
#include "internal/cryptlib.h"
#include "prov/provider_ctx.h"
#include "prov/providercommon.h"
#include "prov/implementations.h"
#include "prov/securitycheck.h"

static OSSL_FUNC_kem_newctx_fn rsakem_newctx;
static OSSL_FUNC_kem_encapsulate_init_fn rsakem_encapsulate_init;
static OSSL_FUNC_kem_encapsulate_fn rsakem_generate;
static OSSL_FUNC_kem_decapsulate_init_fn rsakem_decapsulate_init;
static OSSL_FUNC_kem_decapsulate_fn rsakem_recover;
static OSSL_FUNC_kem_freectx_fn rsakem_freectx;
static OSSL_FUNC_kem_dupctx_fn rsakem_dupctx;
static OSSL_FUNC_kem_get_ctx_params_fn rsakem_get_ctx_params;
static OSSL_FUNC_kem_gettable_ctx_params_fn rsakem_gettable_ctx_params;
static OSSL_FUNC_kem_set_ctx_params_fn rsakem_set_ctx_params;
static OSSL_FUNC_kem_settable_ctx_params_fn rsakem_settable_ctx_params;

/*
 * Only the KEM for RSASVE as defined in SP800-56b r2 is implemented
 * currently.
 */
#define KEM_OP_UNDEFINED -1
#define KEM_OP_RSASVE 0

/*
 * What's passed as an actual key is defined by the KEYMGMT interface.
 * We happen to know that our KEYMGMT simply passes RSA structures, so
 * we use that here too.
 */
typedef struct {
    OSSL_LIB_CTX *libctx;
    RSA *rsa;
    int op;
    OSSL_FIPS_IND_DECLARE
} PROV_RSA_CTX;

static const OSSL_ITEM rsakem_opname_id_map[] = {
    { KEM_OP_RSASVE, OSSL_KEM_PARAM_OPERATION_RSASVE },
};

static int name2id(const char *name, const OSSL_ITEM *map, size_t sz)
{
    size_t i;

    if (name == NULL)
        return -1;

    for (i = 0; i < sz; ++i) {
        if (OPENSSL_strcasecmp(map[i].ptr, name) == 0)
            return map[i].id;
    }
    return -1;
}

static int rsakem_opname2id(const char *name)
{
    return name2id(name, rsakem_opname_id_map, OSSL_NELEM(rsakem_opname_id_map));
}

static void *rsakem_newctx(void *provctx)
{
    PROV_RSA_CTX *prsactx;

    if (!ossl_prov_is_running())
        return NULL;

    prsactx = OPENSSL_zalloc(sizeof(PROV_RSA_CTX));
    if (prsactx == NULL)
        return NULL;
    prsactx->libctx = PROV_LIBCTX_OF(provctx);
    prsactx->op = KEM_OP_RSASVE;
    OSSL_FIPS_IND_INIT(prsactx)

    return prsactx;
}

static void rsakem_freectx(void *vprsactx)
{
    PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx;

    RSA_free(prsactx->rsa);
    OPENSSL_free(prsactx);
}

static void *rsakem_dupctx(void *vprsactx)
{
    PROV_RSA_CTX *srcctx = (PROV_RSA_CTX *)vprsactx;
    PROV_RSA_CTX *dstctx;

    if (!ossl_prov_is_running())
        return NULL;

    dstctx = OPENSSL_zalloc(sizeof(*srcctx));
    if (dstctx == NULL)
        return NULL;

    *dstctx = *srcctx;
    if (dstctx->rsa != NULL && !RSA_up_ref(dstctx->rsa)) {
        OPENSSL_free(dstctx);
        return NULL;
    }
    return dstctx;
}

static int rsakem_init(void *vprsactx, void *vrsa,
    const OSSL_PARAM params[], int operation,
    const char *desc)
{
    PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx;
    const BIGNUM *e = NULL;
    int protect = 0;

    if (!ossl_prov_is_running())
        return 0;

    if (prsactx == NULL || vrsa == NULL)
        return 0;

    if (!ossl_rsa_key_op_get_protect(vrsa, operation, &protect))
        return 0;
    if (!RSA_up_ref(vrsa))
        return 0;
    RSA_free(prsactx->rsa);
    prsactx->rsa = vrsa;

    /*
     * Reject the trivial public exponent e <= 1. The FIPS module enforces the
     * full SP 800-56B §6.4.1.1 constraints via ossl_fips_ind_rsa_key_check()
     * below; non-FIPS callers wanting the complete §6.4.2 vetting can use
     * EVP_PKEY_public_check().
     */
    RSA_get0_key(prsactx->rsa, NULL, &e, NULL);
    if (e == NULL || BN_cmp(e, BN_value_one()) <= 0) {
        ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY);
        return 0;
    }

    OSSL_FIPS_IND_SET_APPROVED(prsactx)
    if (!rsakem_set_ctx_params(prsactx, params))
        return 0;
#ifdef FIPS_MODULE
    if (!ossl_fips_ind_rsa_key_check(OSSL_FIPS_IND_GET(prsactx),
            OSSL_FIPS_IND_SETTABLE0, prsactx->libctx,
            prsactx->rsa, desc, protect))
        return 0;
#endif
    return 1;
}

static int rsakem_encapsulate_init(void *vprsactx, void *vrsa,
    const OSSL_PARAM params[])
{
    return rsakem_init(vprsactx, vrsa, params, EVP_PKEY_OP_ENCAPSULATE,
        "RSA Encapsulate Init");
}

static int rsakem_decapsulate_init(void *vprsactx, void *vrsa,
    const OSSL_PARAM params[])
{
    return rsakem_init(vprsactx, vrsa, params, EVP_PKEY_OP_DECAPSULATE,
        "RSA Decapsulate Init");
}

/* clang-format off */
/* Machine generated by util/perl/OpenSSL/paramnames.pm */
#ifndef rsakem_get_ctx_params_list
static const OSSL_PARAM rsakem_get_ctx_params_list[] = {
# if defined(FIPS_MODULE)
    OSSL_PARAM_int(OSSL_KEM_PARAM_FIPS_APPROVED_INDICATOR, NULL),
# endif
    OSSL_PARAM_END
};
#endif

#ifndef rsakem_get_ctx_params_st
struct rsakem_get_ctx_params_st {
# if defined(FIPS_MODULE)
    OSSL_PARAM *ind;
# else
    int dummy; /* unused */
# endif
};
#endif

#ifndef rsakem_get_ctx_params_decoder
static int rsakem_get_ctx_params_decoder
    (const OSSL_PARAM *p, struct rsakem_get_ctx_params_st *r)
{
    const char *s;

    memset(r, 0, sizeof(*r));
    if (p != NULL)
        for (; (s = p->key) != NULL; p++)
# if defined(FIPS_MODULE)
            if (ossl_likely(strcmp("fips-indicator", s + 0) == 0)) {
                /* OSSL_KEM_PARAM_FIPS_APPROVED_INDICATOR */
                if (ossl_unlikely(r->ind != NULL)) {
                    ERR_raise_data(ERR_LIB_PROV, PROV_R_REPEATED_PARAMETER,
                                   "param %s is repeated", s);
                    return 0;
                }
                r->ind = (OSSL_PARAM *)p;
            }
# else
            ;
# endif
    return 1;
}
#endif
/* End of machine generated */
/* clang-format on */

static int rsakem_get_ctx_params(void *vprsactx, OSSL_PARAM *params)
{
    PROV_RSA_CTX *ctx = (PROV_RSA_CTX *)vprsactx;
    struct rsakem_get_ctx_params_st p;

    if (ctx == NULL || !rsakem_get_ctx_params_decoder(params, &p))
        return 0;

    if (!OSSL_FIPS_IND_GET_CTX_FROM_PARAM(ctx, p.ind))
        return 0;
    return 1;
}

static const OSSL_PARAM *rsakem_gettable_ctx_params(ossl_unused void *vprsactx,
    ossl_unused void *provctx)
{
    return rsakem_get_ctx_params_list;
}

/* clang-format off */
/* Machine generated by util/perl/OpenSSL/paramnames.pm */
#ifndef rsakem_set_ctx_params_list
static const OSSL_PARAM rsakem_set_ctx_params_list[] = {
    OSSL_PARAM_utf8_string(OSSL_KEM_PARAM_OPERATION, NULL, 0),
# if defined(FIPS_MODULE)
    OSSL_PARAM_int(OSSL_KEM_PARAM_FIPS_KEY_CHECK, NULL),
# endif
    OSSL_PARAM_END
};
#endif

#ifndef rsakem_set_ctx_params_st
struct rsakem_set_ctx_params_st {
# if defined(FIPS_MODULE)
    OSSL_PARAM *ind_k;
# endif
    OSSL_PARAM *op;
};
#endif

#ifndef rsakem_set_ctx_params_decoder
static int rsakem_set_ctx_params_decoder
    (const OSSL_PARAM *p, struct rsakem_set_ctx_params_st *r)
{
    const char *s;

    memset(r, 0, sizeof(*r));
    if (p != NULL)
        for (; (s = p->key) != NULL; p++)
            switch(s[0]) {
            default:
                break;
            case 'k':
# if defined(FIPS_MODULE)
                if (ossl_likely(strcmp("ey-check", s + 1) == 0)) {
                    /* OSSL_KEM_PARAM_FIPS_KEY_CHECK */
                    if (ossl_unlikely(r->ind_k != NULL)) {
                        ERR_raise_data(ERR_LIB_PROV, PROV_R_REPEATED_PARAMETER,
                                       "param %s is repeated", s);
                        return 0;
                    }
                    r->ind_k = (OSSL_PARAM *)p;
                }
# endif
                break;
            case 'o':
                if (ossl_likely(strcmp("peration", s + 1) == 0)) {
                    /* OSSL_KEM_PARAM_OPERATION */
                    if (ossl_unlikely(r->op != NULL)) {
                        ERR_raise_data(ERR_LIB_PROV, PROV_R_REPEATED_PARAMETER,
                                       "param %s is repeated", s);
                        return 0;
                    }
                    r->op = (OSSL_PARAM *)p;
                }
            }
    return 1;
}
#endif
/* End of machine generated */
/* clang-format on */

static int rsakem_set_ctx_params(void *vprsactx, const OSSL_PARAM params[])
{
    PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx;
    struct rsakem_set_ctx_params_st p;
    int op;

    if (prsactx == NULL || !rsakem_set_ctx_params_decoder(params, &p))
        return 0;

    if (!OSSL_FIPS_IND_SET_CTX_FROM_PARAM(prsactx, OSSL_FIPS_IND_SETTABLE0,
            p.ind_k))
        return 0;

    if (p.op != NULL) {
        if (p.op->data_type != OSSL_PARAM_UTF8_STRING)
            return 0;
        op = rsakem_opname2id(p.op->data);
        if (op < 0)
            return 0;
        prsactx->op = op;
    }
    return 1;
}

static const OSSL_PARAM *rsakem_settable_ctx_params(ossl_unused void *vprsactx,
    ossl_unused void *provctx)
{
    return rsakem_set_ctx_params_list;
}

/*
 * NIST.SP.800-56Br2
 * 7.2.1.2 RSASVE Generate Operation (RSASVE.GENERATE).
 *
 * Generate a random in the range 1 < z < (n – 1)
 */
static int rsasve_gen_rand_bytes(RSA *rsa_pub,
    unsigned char *out, int outlen)
{
    int ret = 0;
    BN_CTX *bnctx;
    BIGNUM *z, *nminus3;

    bnctx = BN_CTX_secure_new_ex(ossl_rsa_get0_libctx(rsa_pub));
    if (bnctx == NULL)
        return 0;

    /*
     * Generate a random in the range 1 < z < (n – 1).
     * Since BN_priv_rand_range_ex() returns a value in range 0 <= r < max
     * We can achieve this by adding 2.. but then we need to subtract 3 from
     * the upper bound i.e: 2 + (0 <= r < (n - 3))
     */
    BN_CTX_start(bnctx);
    nminus3 = BN_CTX_get(bnctx);
    z = BN_CTX_get(bnctx);
    ret = (z != NULL
        && (BN_copy(nminus3, RSA_get0_n(rsa_pub)) != NULL)
        && BN_sub_word(nminus3, 3)
        && BN_priv_rand_range_ex(z, nminus3, 0, bnctx)
        && BN_add_word(z, 2)
        && (BN_bn2binpad(z, out, outlen) == outlen));
    BN_CTX_end(bnctx);
    BN_CTX_free(bnctx);
    return ret;
}

/*
 * NIST.SP.800-56Br2
 * 7.2.1.2 RSASVE Generate Operation (RSASVE.GENERATE).
 */
static int rsasve_generate(PROV_RSA_CTX *prsactx,
    unsigned char *out, size_t *outlen,
    unsigned char *secret, size_t *secretlen)
{
    int ret;
    size_t nlen;

    /* Step (1): nlen = Ceil(len(n)/8) */
    nlen = RSA_size(prsactx->rsa);

    if (out == NULL) {
        if (nlen == 0) {
            ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY);
            return 0;
        }
        if (outlen == NULL && secretlen == NULL)
            return 0;
        if (outlen != NULL)
            *outlen = nlen;
        if (secretlen != NULL)
            *secretlen = nlen;
        return 1;
    }

    /*
     * If outlen is specified, then it must report the length
     * of the out buffer on input so that we can confirm
     * its size is sufficient for encapsulation
     */
    if (outlen != NULL && *outlen < nlen) {
        ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_OUTPUT_LENGTH);
        return 0;
    }

    /*
     * Step (2): Generate a random byte string z of nlen bytes where
     *            1 < z < n - 1
     */
    if (!rsasve_gen_rand_bytes(prsactx->rsa, secret, (int)nlen))
        return 0;

    /* Step(3): out = RSAEP((n,e), z) */
    ret = RSA_public_encrypt((int)nlen, secret, out, prsactx->rsa,
        RSA_NO_PADDING);
    if (ret <= 0 || ret != (int)nlen) {
        OPENSSL_cleanse(secret, nlen);
        return 0;
    }

    if (outlen != NULL)
        *outlen = nlen;
    if (secretlen != NULL)
        *secretlen = nlen;

    return 1;
}

/**
 * rsasve_recover - Recovers a secret value from ciphertext using an RSA
 * private key.  Once, recovered, the secret value is considered to be a
 * shared secret.  Algorithm is performed as per NIST SP 800-56B Rev 2
 * 7.2.1.3 RSASVE Recovery Operation (RSASVE.RECOVER).
 *
 * This function performs RSA decryption using the private key from the
 * provided RSA context (`prsactx`). It takes the input ciphertext, decrypts
 * it, and writes the decrypted message to the output buffer.
 *
 * @prsactx:      The RSA context containing the private key.
 * @out:          The output buffer to store the decrypted message.
 * @outlen:       On input, the size of the output buffer. On successful
 *                completion, the actual length of the decrypted message.
 * @in:           The input buffer containing the ciphertext to be decrypted.
 * @inlen:        The length of the input ciphertext in bytes.
 *
 * Returns 1 on success, or 0 on error. In case of error, appropriate
 * error messages are raised using the ERR_raise function.
 */
static int rsasve_recover(PROV_RSA_CTX *prsactx,
    unsigned char *out, size_t *outlen,
    const unsigned char *in, size_t inlen)
{
    size_t nlen;
    int ret;

    /* Step (1): get the byte length of n */
    nlen = RSA_size(prsactx->rsa);

    if (out == NULL) {
        if (nlen == 0) {
            ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY);
            return 0;
        }
        *outlen = nlen;
        return 1;
    }

    /*
     * Step (2): check the input ciphertext 'inlen' matches the nlen
     * and that outlen is at least nlen bytes
     */
    if (inlen != nlen) {
        ERR_raise(ERR_LIB_PROV, PROV_R_BAD_LENGTH);
        return 0;
    }

    /*
     * If outlen is specified, then it must report the length
     * of the out buffer, so that we can confirm that it is of
     * sufficient size to hold the output of decapsulation
     */
    if (outlen != NULL && *outlen < nlen) {
        ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_OUTPUT_LENGTH);
        return 0;
    }

#ifndef FIPS_MODULE
    /*
     * Reject clearly degenerate ciphertexts, c in {0, 1, n-1}.
     *
     * SP 800-56B Rev 2, 7.1.2.1 requires RSADP to enforce 1 < c < n-1.  In a
     * FIPS build that bound is applied by the RSADP primitive itself (see
     * crypto/rsa/rsa_ossl.c, guarded by FIPS_MODULE), where it is also needed
     * for KTS-OAEP; the primitive does not apply it in a non-FIPS build, so
     * enforce it here for RSASVE.  Raise the same errors as the primitive so
     * the behaviour matches in both builds; keep the two sites in step.
     */
    {
        const BIGNUM *n = RSA_get0_n(prsactx->rsa);
        BIGNUM *c = BN_new();
        BIGNUM *nminus1 = BN_new();
        int reason = 0;

        if (n == NULL || c == NULL || nminus1 == NULL
            || BN_bin2bn(in, (int)inlen, c) == NULL
            || BN_copy(nminus1, n) == NULL
            || !BN_sub_word(nminus1, 1)) {
            BN_free(c);
            BN_free(nminus1);
            return 0;
        }
        if (BN_ucmp(c, BN_value_one()) <= 0)
            reason = RSA_R_DATA_TOO_SMALL;
        else if (BN_ucmp(c, nminus1) >= 0)
            reason = RSA_R_DATA_TOO_LARGE_FOR_MODULUS;
        BN_free(c);
        BN_free(nminus1);
        if (reason != 0) {
            ERR_raise(ERR_LIB_RSA, reason);
            return 0;
        }
    }
#endif

    /* Step (3): out = RSADP((n,d), in) */
    ret = RSA_private_decrypt((int)inlen, in, out, prsactx->rsa, RSA_NO_PADDING);
    if (ret > 0 && outlen != NULL)
        *outlen = ret;
    return ret > 0;
}

static int rsakem_generate(void *vprsactx, unsigned char *out, size_t *outlen,
    unsigned char *secret, size_t *secretlen)
{
    PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx;

    if (!ossl_prov_is_running())
        return 0;

    switch (prsactx->op) {
    case KEM_OP_RSASVE:
        return rsasve_generate(prsactx, out, outlen, secret, secretlen);
    default:
        return -2;
    }
}

static int rsakem_recover(void *vprsactx, unsigned char *out, size_t *outlen,
    const unsigned char *in, size_t inlen)
{
    PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx;

    if (!ossl_prov_is_running())
        return 0;

    switch (prsactx->op) {
    case KEM_OP_RSASVE:
        return rsasve_recover(prsactx, out, outlen, in, inlen);
    default:
        return -2;
    }
}

const OSSL_DISPATCH ossl_rsa_asym_kem_functions[] = {
    { OSSL_FUNC_KEM_NEWCTX, (void (*)(void))rsakem_newctx },
    { OSSL_FUNC_KEM_ENCAPSULATE_INIT,
        (void (*)(void))rsakem_encapsulate_init },
    { OSSL_FUNC_KEM_ENCAPSULATE, (void (*)(void))rsakem_generate },
    { OSSL_FUNC_KEM_DECAPSULATE_INIT,
        (void (*)(void))rsakem_decapsulate_init },
    { OSSL_FUNC_KEM_DECAPSULATE, (void (*)(void))rsakem_recover },
    { OSSL_FUNC_KEM_FREECTX, (void (*)(void))rsakem_freectx },
    { OSSL_FUNC_KEM_DUPCTX, (void (*)(void))rsakem_dupctx },
    { OSSL_FUNC_KEM_GET_CTX_PARAMS,
        (void (*)(void))rsakem_get_ctx_params },
    { OSSL_FUNC_KEM_GETTABLE_CTX_PARAMS,
        (void (*)(void))rsakem_gettable_ctx_params },
    { OSSL_FUNC_KEM_SET_CTX_PARAMS,
        (void (*)(void))rsakem_set_ctx_params },
    { OSSL_FUNC_KEM_SETTABLE_CTX_PARAMS,
        (void (*)(void))rsakem_settable_ctx_params },
    OSSL_DISPATCH_END
};
