<?php

if (class_exists('ParagonIE_Sodium_Crypto', false)) {

    return;

}

/**

 * Class ParagonIE_Sodium_Crypto

 *

 * ATTENTION!

 *

 * If you are using this library, you should be using

 * ParagonIE_Sodium_Compat in your code, not this class.

 */

abstract class ParagonIE_Sodium_Crypto

{

    const aead_chacha20poly1305_KEYBYTES = 32;

    const aead_chacha20poly1305_NSECBYTES = 0;

    const aead_chacha20poly1305_NPUBBYTES = 8;

    const aead_chacha20poly1305_ABYTES = 16;

    const aead_chacha20poly1305_IETF_KEYBYTES = 32;

    const aead_chacha20poly1305_IETF_NSECBYTES = 0;

    const aead_chacha20poly1305_IETF_NPUBBYTES = 12;

    const aead_chacha20poly1305_IETF_ABYTES = 16;

    const aead_xchacha20poly1305_IETF_KEYBYTES = 32;

    const aead_xchacha20poly1305_IETF_NSECBYTES = 0;

    const aead_xchacha20poly1305_IETF_NPUBBYTES = 24;

    const aead_xchacha20poly1305_IETF_ABYTES = 16;

    const box_curve25519xsalsa20poly1305_SEEDBYTES = 32;

    const box_curve25519xsalsa20poly1305_PUBLICKEYBYTES = 32;

    const box_curve25519xsalsa20poly1305_SECRETKEYBYTES = 32;

    const box_curve25519xsalsa20poly1305_BEFORENMBYTES = 32;

    const box_curve25519xsalsa20poly1305_NONCEBYTES = 24;

    const box_curve25519xsalsa20poly1305_MACBYTES = 16;

    const box_curve25519xsalsa20poly1305_BOXZEROBYTES = 16;

    const box_curve25519xsalsa20poly1305_ZEROBYTES = 32;

    const onetimeauth_poly1305_BYTES = 16;

    const onetimeauth_poly1305_KEYBYTES = 32;

    const secretbox_xsalsa20poly1305_KEYBYTES = 32;

    const secretbox_xsalsa20poly1305_NONCEBYTES = 24;

    const secretbox_xsalsa20poly1305_MACBYTES = 16;

    const secretbox_xsalsa20poly1305_BOXZEROBYTES = 16;

    const secretbox_xsalsa20poly1305_ZEROBYTES = 32;

    const secretbox_xchacha20poly1305_KEYBYTES = 32;

    const secretbox_xchacha20poly1305_NONCEBYTES = 24;

    const secretbox_xchacha20poly1305_MACBYTES = 16;

    const secretbox_xchacha20poly1305_BOXZEROBYTES = 16;

    const secretbox_xchacha20poly1305_ZEROBYTES = 32;

    const stream_salsa20_KEYBYTES = 32;

    /**

     * AEAD Decryption with ChaCha20-Poly1305

     *

     * @internal Do not use this directly. Use ParagonIE_Sodium_Compat.

     *

     * @param string $message

     * @param string $ad

     * @param string $nonce

     * @param string $key

     * @return string

     * @throws SodiumException

     * @throws TypeError

     */

    public static function aead_chacha20poly1305_decrypt(

        $message = '',

        $ad = '',

        $nonce = '',

        $key = ''

    ) {

        /** @var int $len - Length of message (ciphertext + MAC) */

        $len = ParagonIE_Sodium_Core_Util::strlen($message);

        /** @var int  $clen - Length of ciphertext */

        $clen = $len - self::aead_chacha20poly1305_ABYTES;

        /** @var int $adlen - Length of associated data */

        $adlen = ParagonIE_Sodium_Core_Util::strlen($ad);

        /** @var string $mac - Message authentication code */

        $mac = ParagonIE_Sodium_Core_Util::substr(

            $message,

            $clen,

            self::aead_chacha20poly1305_ABYTES

        );

        /** @var string $ciphertext - The encrypted message (sans MAC) */

        $ciphertext = ParagonIE_Sodium_Core_Util::substr($message, 0, $clen);

        /** @var string The first block of the chacha20 keystream, used as a poly1305 key */

        $block0 = ParagonIE_Sodium_Core_ChaCha20::stream(

            32,

            $nonce,

            $key

        );

        /* Recalculate the Poly1305 authentication tag (MAC): */

        $state = new ParagonIE_Sodium_Core_Poly1305_State($block0);

        try {

            ParagonIE_Sodium_Compat::memzero($block0);

        } catch (SodiumException $ex) {

            $block0 = null;

        }

        $state->update($ad);

        $state->update(ParagonIE_Sodium_Core_Util::store64_le($adlen));

        $state->update($ciphertext);

        $state->update(ParagonIE_Sodium_Core_Util::store64_le($clen));

        $computed_mac = $state->finish();

        /* Compare the given MAC with the recalculated MAC: */

        if (!ParagonIE_Sodium_Core_Util::verify_16($computed_mac, $mac)) {

            throw new SodiumException('Invalid MAC');

        }

        // Here, we know that the MAC is valid, so we decrypt and return the plaintext

        return ParagonIE_Sodium_Core_ChaCha20::streamXorIc(

            $ciphertext,

            $nonce,

            $key,

            ParagonIE_Sodium_Core_Util::store64_le(1)

        );

    }

    /**

     * AEAD Encryption with ChaCha20-Poly1305

     *

     * @internal Do not use this directly. Use ParagonIE_Sodium_Compat.

     *

     * @param string $message

     * @param string $ad

     * @param string $nonce

     * @param string $key

     * @return string

     * @throws SodiumException

     * @throws TypeError

     */

    public static function aead_chacha20poly1305_encrypt(

        $message = '',

        $ad = '',

        $nonce = '',

        $key = ''

    ) {

        /** @var int $len - Length of the plaintext message */

        $len = ParagonIE_Sodium_Core_Util::strlen($message);

        /** @var int $adlen - Length of the associated data */

        $adlen = ParagonIE_Sodium_Core_Util::strlen($ad);

        /** @var string The first block of the chacha20 keystream, used as a poly1305 key */

        $block0 = ParagonIE_Sodium_Core_ChaCha20::stream(

            32,

            $nonce,

            $key

        );

        $state = new ParagonIE_Sodium_Core_Poly1305_State($block0);

        try {

            ParagonIE_Sodium_Compat::memzero($block0);

        } catch (SodiumException $ex) {

            $block0 = null;

        }

        /** @var string $ciphertext - Raw encrypted data */

        $ciphertext = ParagonIE_Sodium_Core_ChaCha20::streamXorIc(

            $message,

            $nonce,

            $key,

            ParagonIE_Sodium_Core_Util::store64_le(1)

        );

        $state->update($ad);

        $state->update(ParagonIE_Sodium_Core_Util::store64_le($adlen));

        $state->update($ciphertext);

        $state->update(ParagonIE_Sodium_Core_Util::store64_le($len));

        return $ciphertext . $state->finish();

    }

    /**

     * AEAD Decryption with ChaCha20-Poly1305, IETF mode (96-bit nonce)

     *

     * @internal Do not use this directly. Use ParagonIE_Sodium_Compat.

     *

     * @param string $message

     * @param string $ad

     * @param string $nonce

     * @param string $key

     * @return string

     * @throws SodiumException

     * @throws TypeError

     */

    public static function aead_chacha20poly1305_ietf_decrypt(

        $message = '',

        $ad = '',

        $nonce = '',

        $key = ''

    ) {

        /** @var int $adlen - Length of associated data */

        $adlen = ParagonIE_Sodium_Core_Util::strlen($ad);

        /** @var int $len - Length of message (ciphertext + MAC) */

        $len = ParagonIE_Sodium_Core_Util::strlen($message);

        /** @var int  $clen - Length of ciphertext */

        $clen = $len - self::aead_chacha20poly1305_IETF_ABYTES;

        /** @var string The first block of the chacha20 keystream, used as a poly1305 key */

        $block0 = ParagonIE_Sodium_Core_ChaCha20::ietfStream(

            32,

            $nonce,

            $key

        );

        /** @var string $mac - Message authentication code */

        $mac = ParagonIE_Sodium_Core_Util::substr(

            $message,

            $len - self::aead_chacha20poly1305_IETF_ABYTES,

            self::aead_chacha20poly1305_IETF_ABYTES

        );

        /** @var string $ciphertext - The encrypted message (sans MAC) */

        $ciphertext = ParagonIE_Sodium_Core_Util::substr(

            $message,

            0,

            $len - self::aead_chacha20poly1305_IETF_ABYTES

        );

        /* Recalculate the Poly1305 authentication tag (MAC): */

        $state = new ParagonIE_Sodium_Core_Poly1305_State($block0);

        try {

            ParagonIE_Sodium_Compat::memzero($block0);

        } catch (SodiumException $ex) {

            $block0 = null;

        }

        $state->update($ad);

        $state->update(str_repeat("\x00", ((0x10 - $adlen) & 0xf)));

        $state->update($ciphertext);

        $state->update(str_repeat("\x00", (0x10 - $clen) & 0xf));

        $state->update(ParagonIE_Sodium_Core_Util::store64_le($adlen));

        $state->update(ParagonIE_Sodium_Core_Util::store64_le($clen));

        $computed_mac = $state->finish();

        /* Compare the given MAC with the recalculated MAC: */

        if (!ParagonIE_Sodium_Core_Util::verify_16($computed_mac, $mac)) {

            throw new SodiumException('Invalid MAC');

        }

        // Here, we know that the MAC is valid, so we decrypt and return the plaintext

        return ParagonIE_Sodium_Core_ChaCha20::ietfStreamXorIc(

            $ciphertext,

            $nonce,

            $key,

            ParagonIE_Sodium_Core_Util::store64_le(1)

        );

    }

    /**

     * AEAD Encryption with ChaCha20-Poly1305, IETF mode (96-bit nonce)

     *

     * @internal Do not use this directly. Use ParagonIE_Sodium_Compat.

     *

     * @param string $message

     * @param string $ad

     * @param string $nonce

     * @param string $key

     * @return string

     * @throws SodiumException

     * @throws TypeError

     */

    public static function aead_chacha20poly1305_ietf_encrypt(

        $message = '',

        $ad = '',

        $nonce = '',

        $key = ''

    ) {

        /** @var int $len - Length of the plaintext message */

        $len = ParagonIE_Sodium_Core_Util::strlen($message);

        /** @var int $adlen - Length of the associated data */

        $adlen = ParagonIE_Sodium_Core_Util::strlen($ad);

        /** @var string The first block of the chacha20 keystream, used as a poly1305 key */

        $block0 = ParagonIE_Sodium_Core_ChaCha20::ietfStream(

            32,

            $nonce,

            $key

        );

        $state = new ParagonIE_Sodium_Core_Poly1305_State($block0);

        try {

            ParagonIE_Sodium_Compat::memzero($block0);

        } catch (SodiumException $ex) {

            $block0 = null;

        }

        /** @var string $ciphertext - Raw encrypted data */

        $ciphertext = ParagonIE_Sodium_Core_ChaCha20::ietfStreamXorIc(

            $message,

            $nonce,

            $key,

            ParagonIE_Sodium_Core_Util::store64_le(1)

        );

        $state->update($ad);

        $state->update(str_repeat("\x00", ((0x10 - $adlen) & 0xf)));

        $state->update($ciphertext);

        $state->update(str_repeat("\x00", ((0x10 - $len) & 0xf)));

        $state->update(ParagonIE_Sodium_Core_Util::store64_le($adlen));

        $state->update(ParagonIE_Sodium_Core_Util::store64_le($len));

        return $ciphertext . $state->finish();

    }

    /**

     * AEAD Decryption with ChaCha20-Poly1305, IETF mode (96-bit nonce)

     *

     * @internal Do not use this directly. Use ParagonIE_Sodium_Compat.

     *

     * @param string $message

     * @param string $ad

     * @param string $nonce

     * @param string $key

     * @return string

     * @throws SodiumException

     * @throws TypeError

     */

    public static function aead_xchacha20poly1305_ietf_decrypt(

        $message = '',

        $ad = '',

        $nonce = '',

        $key = ''

    ) {

        $subkey = ParagonIE_Sodium_Core_HChaCha20::hChaCha20(

            ParagonIE_Sodium_Core_Util::substr($nonce, 0, 16),

            $key

        );

        $nonceLast = "\x00\x00\x00\x00" .

            ParagonIE_Sodium_Core_Util::substr($nonce, 16, 8);

        return self::aead_chacha20poly1305_ietf_decrypt($message, $ad, $nonceLast, $subkey);

    }

    /**

     * AEAD Encryption with ChaCha20-Poly1305, IETF mode (96-bit nonce)

     *

     * @internal Do not use this directly. Use ParagonIE_Sodium_Compat.

     *

     * @param string $message

     * @param string $ad

     * @param string $nonce

     * @param string $key

     * @return string

     * @throws SodiumException

     * @throws TypeError

     */

    public static function aead_xchacha20poly1305_ietf_encrypt(

        $message = '',

        $ad = '',

        $nonce = '',

        $key = ''

    ) {

        $subkey = ParagonIE_Sodium_Core_HChaCha20::hChaCha20(

            ParagonIE_Sodium_Core_Util::substr($nonce, 0, 16),

            $key

        );

        $nonceLast = "\x00\x00\x00\x00" .

            ParagonIE_Sodium_Core_Util::substr($nonce, 16, 8);

        return self::aead_chacha20poly1305_ietf_encrypt($message, $ad, $nonceLast, $subkey);

    }

    /**

     * HMAC-SHA-512-256 (a.k.a. the leftmost 256 bits of HMAC-SHA-512)

     *

     * @internal Do not use this directly. Use ParagonIE_Sodium_Compat.

     *

     * @param string $message

     * @param string $key

     * @return string

     * @throws TypeError

     */

    public static function auth($message, $key)

    {

        return ParagonIE_Sodium_Core_Util::substr(

            hash_hmac('sha512', $message, $key, true),

            0,

            32

        );

    }

    /**

     * HMAC-SHA-512-256 validation. Constant-time via hash_equals().

     *

     * @internal Do not use this directly. Use ParagonIE_Sodium_Compat.

     *

     * @param string $mac

     * @param string $message

     * @param string $key

     * @return bool

     * @throws SodiumException

     * @throws TypeError

     */

    public static function auth_verify($mac, $message, $key)

    {

        return ParagonIE_Sodium_Core_Util::hashEquals(

            $mac,

            self::auth($message, $key)

        );

    }

    /**

     * X25519 key exchange followed by XSalsa20Poly1305 symmetric encryption

     *

     * @internal Do not use this directly. Use ParagonIE_Sodium_Compat.

     *

     * @param string $plaintext

     * @param string $nonce

     * @param string $keypair

     * @return string

     * @throws SodiumException

     * @throws TypeError

     */

    public static function box($plaintext, $nonce, $keypair)

    {

        $c = self::secretbox(

            $plaintext,

            $nonce,

            self::box_beforenm(

                self::box_secretkey($keypair),

                self::box_publickey($keypair)

            )

        );

        return $c;

    }

    /**

     * X25519-XSalsa20-Poly1305 with one ephemeral X25519 keypair.

     *

     * @internal Do not use this directly. Use ParagonIE_Sodium_Compat.

     *