// Copyright lowRISC contributors (OpenTitan project).
// Licensed under the Apache License, Version 2.0, see LICENSE for details.
// SPDX-License-Identifier: Apache-2.0

use anyhow::{bail, ensure, Result};
use std::convert::TryInto;

/// PRESENT block cipher.
///
/// Based on version 1.2 of the following Python implementation
/// <https://github.com/doegox/python-cryptoplus>
pub struct Present {
    round_keys: Vec<u64>,
}

impl Present {
    pub fn try_new_rounds(key: Vec<u8>, rounds: usize) -> Result<Present> {
        ensure!(
            (1..=254).contains(&rounds),
            "unsupported number of rounds {}",
            rounds
        );

        let round_keys = match key.len() {
            10 => generate_round_keys_80(key, rounds),
            16 => generate_round_keys_128(key, rounds),
            _ => bail!("key length must be 80 or 128 bits"),
        };

        Ok(Present { round_keys })
    }

    /// Create a new instance of the PRESENT cipher.
    ///
    /// Valid key lengths are 80 and 128 bits. All other key lengths will return an error.
    pub fn try_new(key: Vec<u8>) -> Result<Present> {
        Self::try_new_rounds(key, 32)
    }

    /// Create a new 128-bit PRESENT cipher instance.
    pub fn new_128(key: &[u8; 16]) -> Present {
        Self::try_new(key.to_vec()).unwrap()
    }

    /// Create a new 80-bit PRESENT cipher instance.
    pub fn new_80(key: &[u8; 10]) -> Present {
        Self::try_new(key.to_vec()).unwrap()
    }

    /// Encrypt a 64-bit block.
    pub fn encrypt_block(&self, block: u64) -> u64 {
        let mut state = block;
        state ^= self.round_keys[0];
        for round_key in &self.round_keys[1..] {
            state = s_box_layer(state);
            state = p_box_layer(state);
            state ^= round_key;
        }
        state
    }

    /// Decrypt a 64-bit block.
    pub fn decrypt_block(&self, block: u64) -> u64 {
        let mut state = block;
        for round_key in self.round_keys[1..].iter().rev() {
            state ^= round_key;
            state = p_box_layer_dec(state);
            state = s_box_layer_dec(state);
        }
        state ^ self.round_keys[0]
    }
}

const S_BOX: [u8; 16] = [
    0x0c, 0x05, 0x06, 0x0b, 0x09, 0x00, 0x0a, 0x0d, 0x03, 0x0e, 0x0f, 0x08, 0x04, 0x07, 0x01, 0x02,
];

const S_BOX_INV: [u8; 16] = [
    0x05, 0x0e, 0x0f, 0x08, 0x0c, 0x01, 0x02, 0x0d, 0x0b, 0x04, 0x06, 0x03, 0x00, 0x07, 0x09, 0x0a,
];

const P_BOX: [u8; 64] = [
    0x00, 0x10, 0x20, 0x30, 0x01, 0x11, 0x21, 0x31, 0x02, 0x12, 0x22, 0x32, 0x03, 0x13, 0x23, 0x33,
    0x04, 0x14, 0x24, 0x34, 0x05, 0x15, 0x25, 0x35, 0x06, 0x16, 0x26, 0x36, 0x07, 0x17, 0x27, 0x37,
    0x08, 0x18, 0x28, 0x38, 0x09, 0x19, 0x29, 0x39, 0x0a, 0x1a, 0x2a, 0x3a, 0x0b, 0x1b, 0x2b, 0x3b,
    0x0c, 0x1c, 0x2c, 0x3c, 0x0d, 0x1d, 0x2d, 0x3d, 0x0e, 0x1e, 0x2e, 0x3e, 0x0f, 0x1f, 0x2f, 0x3f,
];

const P_BOX_INV: [u8; 64] = [
    0x00, 0x04, 0x08, 0x0c, 0x10, 0x14, 0x18, 0x1c, 0x20, 0x24, 0x28, 0x2c, 0x30, 0x34, 0x38, 0x3c,
    0x01, 0x05, 0x09, 0x0d, 0x11, 0x15, 0x19, 0x1d, 0x21, 0x25, 0x29, 0x2d, 0x31, 0x35, 0x39, 0x3d,
    0x02, 0x06, 0x0a, 0x0e, 0x12, 0x16, 0x1a, 0x1e, 0x22, 0x26, 0x2a, 0x2e, 0x32, 0x36, 0x3a, 0x3e,
    0x03, 0x07, 0x0b, 0x0f, 0x13, 0x17, 0x1b, 0x1f, 0x23, 0x27, 0x2b, 0x2f, 0x33, 0x37, 0x3b, 0x3f,
];

/// Generate the round_keys for an 80-bit key.
fn generate_round_keys_80(key: Vec<u8>, rounds: usize) -> Vec<u64> {
    // Pad out key so it fits in a u128 later.
    let mut orig_key = key;
    let mut key = vec![0u8; 6];
    key.append(&mut orig_key);

    // Convert key into a u128 for easier bit manipulation.
    let key: &[u8; 16] = key.as_slice().try_into().unwrap();
    let mut key = u128::from_le_bytes(*key);

    let mut round_keys = Vec::new();
    for i in 1..rounds + 1 {
        // rawKey[0:64]
        let round_key = (key >> 16) as u64;

        // 1. Rotate bits
        // rawKey[19:len(rawKey)]+rawKey[0:19]
        key = (key & 0x7ffff) << 61 | key >> 19;

        // 2. SBox
        // rawKey[76:80] = S(rawKey[76:80])
        key = (S_BOX[(key >> 76) as usize] as u128) << 76 | (key & !0u128 >> (128 - 76));

        // 3. Salt
        // rawKey[15:20] ^ i
        key ^= (i as u128) << 15;

        round_keys.push(round_key);
    }

    round_keys
}

/// Generate the round_keys for a 128-bit key.
fn generate_round_keys_128(key: Vec<u8>, rounds: usize) -> Vec<u64> {
    let mut round_keys = Vec::new();

    // Convert key into a u128 for easier bit manipulation.
    let key: &[u8; 16] = key.as_slice().try_into().unwrap();
    let mut key = u128::from_le_bytes(*key);
    for i in 1..rounds + 1 {
        // rawKey[0:64]
        let round_key = (key >> 64) as u64;

        // 1. Rotate bits
        key = key.rotate_left(61);

        // 2. SBox
        key = (S_BOX[(key >> 124) as usize] as u128) << 124
            | (S_BOX[((key >> 120) & 0xF) as usize] as u128) << 120
            | (key & (!0u128 >> 8));

        // 3. Salt
        // rawKey[62:67] ^ i
        key ^= (i as u128) << 62;

        round_keys.push(round_key);
    }

    round_keys
}

/// SBox funciton for encryption.
fn s_box_layer(state: u64) -> u64 {
    let mut output: u64 = 0;
    for i in (0..64).step_by(4) {
        output |= (S_BOX[((state >> i) & 0x0f) as usize] as u64) << i;
    }
    output
}

/// SBox inverse function for decryption.
fn s_box_layer_dec(state: u64) -> u64 {
    let mut output: u64 = 0;
    for i in (0..64).step_by(4) {
        output |= (S_BOX_INV[((state >> i) & 0x0f) as usize] as u64) << i;
    }
    output
}

/// PBox function for encryption.
fn p_box_layer(state: u64) -> u64 {
    let mut output: u64 = 0;
    for (i, v) in P_BOX.iter().enumerate() {
        output |= ((state >> i) & 0x01) << v;
    }
    output
}

/// PBox inverse function for decryption.
fn p_box_layer_dec(state: u64) -> u64 {
    let mut output: u64 = 0;
    for (i, v) in P_BOX_INV.iter().enumerate() {
        output |= ((state >> i) & 0x01) << v;
    }
    output
}

#[cfg(test)]
mod test {
    use super::*;

    #[rustfmt::skip]
    const ROUND_KEYS_80: [u64; 32] = [
        0x0000000000000000, 0xc000000000000000, 0x5000180000000001, 0x60000a0003000001,
        0xb0000c0001400062, 0x900016000180002a, 0x0001920002c00033, 0xa000a0003240005b,
        0xd000d4001400064c, 0x30017a001a800284, 0xe01926002f400355, 0xf00a1c0324c005ed,
        0x800d5e014380649e, 0x4017b001abc02876, 0x71926802f600357f, 0x10a1ce324d005ec7,
        0x20d5e21439c649a8, 0xc17b041abc428730, 0xc926b82f60835781, 0x6a1cd924d705ec19,
        0xbd5e0d439b249aea, 0x07b077abc1a8736e, 0x426ba0f60ef5783e, 0x41cda84d741ec1d5,
        0xf5e0e839b509ae8f, 0x2b075ebc1d0736ad, 0x86ba2560ebd783ad, 0x8cdab0d744ac1d77,
        0x1e0eb19b561ae89b, 0xd075c3c1d6336acd, 0x8ba27a0eb8783ac9, 0x6dab31744f41d700,
    ];

    #[rustfmt::skip]
    const ROUND_KEYS_128: [u64; 32] = [
        0x0000000000000000, 0xcc00000000000000, 0xc300000000000000, 0x5b30000000000000,
        0x580c000000000001, 0x656cc00000000001, 0x6e60300000000001, 0xb595b30000000001,
        0xbeb980c000000002, 0x96d656cc00000002, 0x9ffae60300000002, 0x065b595b30000002,
        0x0f7feb980c000003, 0xac196d656cc00003, 0xa33dffae60300003, 0xd6b065b595b30003,
        0xdf8cf7feb980c004, 0x3b5ac196d656cc04, 0x387e33dffae60304, 0xeced6b065b595b34,
        0xe3e1f8cf7feb9809, 0x6bb3b5ac196d6569, 0xbb8f87e33dffae65, 0x80aeced6b065b590,
        0xc1ee3e1f8cf7febf, 0x2602bb3b5ac196d0, 0xcb07b8f87e33dffc, 0x34980aeced6b065d,
        0x8b2c1ee3e1f8cf78, 0x54d2602bb3b5ac1e, 0x4a2cb07b8f87e33a, 0x97534980aeced6b7,
    ];

    #[test]
    fn test_generate_80() {
        let key = vec![0u8; 10];
        let round_keys = generate_round_keys_80(key, 32);
        assert_eq!(round_keys, ROUND_KEYS_80);
    }

    #[test]
    fn test_generate_128() {
        let key = vec![0u8; 16];
        let round_keys = generate_round_keys_128(key, 32);
        assert_eq!(round_keys, ROUND_KEYS_128);
    }

    #[test]
    fn test_enc_80() -> Result<()> {
        let cipher = Present::try_new(vec![0; 10])?;
        assert_eq!(cipher.encrypt_block(0), 0x5579c1387b228445);
        Ok(())
    }

    #[test]
    fn test_dec_80() -> Result<()> {
        let cipher = Present::try_new(vec![0; 10])?;
        assert_eq!(cipher.decrypt_block(0x5579c1387b228445), 0);
        Ok(())
    }

    #[test]
    fn test_enc_128() -> Result<()> {
        let cipher = Present::try_new(vec![0; 16])?;
        assert_eq!(cipher.encrypt_block(0), 0x96db702a2e6900af);
        assert_eq!(cipher.encrypt_block(!0), 0x3c6019e5e5edd563);
        let cipher = Present::try_new(vec![0xff; 16])?;
        assert_eq!(cipher.encrypt_block(0), 0x13238c710272a5d8);
        assert_eq!(cipher.encrypt_block(!0), 0x628d9fbd4218e5b4);
        Ok(())
    }

    #[test]
    fn test_dec_128() -> Result<()> {
        let cipher = Present::try_new(vec![0; 16])?;
        assert_eq!(cipher.decrypt_block(0x96db702a2e6900af), 0);
        assert_eq!(cipher.decrypt_block(0x3c6019e5e5edd563), !0);
        let cipher = Present::try_new(vec![0xff; 16])?;
        assert_eq!(cipher.decrypt_block(0x13238c710272a5d8), 0);
        assert_eq!(cipher.decrypt_block(0x628d9fbd4218e5b4), !0);
        Ok(())
    }
}