// Encrypt the given payload. Based on the key encryption algorithm,
// this will either use RSA-PKCS1v1.5 or RSA-OAEP (with SHA-1 or SHA-256).
func (ctx rsaEncrypterVerifier) encrypt(cek []byte, alg KeyAlgorithm) ([]byte, error) {
	switch alg {
	case RSA1_5:
		return rsa.EncryptPKCS1v15(randReader, ctx.publicKey, cek)
	case RSA_OAEP:
		return rsa.EncryptOAEP(sha1.New(), randReader, ctx.publicKey, cek, []byte{})
	case RSA_OAEP_256:
		return rsa.EncryptOAEP(sha256.New(), randReader, ctx.publicKey, cek, []byte{})
	}

	return nil, ErrUnsupportedAlgorithm
}

func (enc *CryptorOAEP) EncryptOAEP(plaintextBytes []byte, label []byte) ([]byte, error) {
	if enc.RsaPublicKey == nil {
		err := errors.New("402: RSA Public Key Not Set")
		return []byte{}, err
	}
	return rsa.EncryptOAEP(enc.Hash, rand.Reader, enc.RsaPublicKey, plaintextBytes, label)
}

func (s secret) MarshalJSON() ([]byte, error) {
	m, err := rsa.EncryptOAEP(crypto.SHA512.New(), rand.Reader, key.Public().(*rsa.PublicKey), []byte(s), nil)
	if err != nil {
		return nil, err
	}
	return json.Marshal(base64.StdEncoding.EncodeToString(m))
}

func (s *SignedMessage) Encrypt(publicKey *rsa.PublicKey) (encrypted *EncryptedMessage, err error) {
	encrypted = new(EncryptedMessage)
	hash := sha256.New()

	//Join message and signature
	var buf bytes.Buffer
	enc := gob.NewEncoder(&buf)
	err = enc.Encode(s)
	if err != nil {
		return nil, err
	}

	//Split messages to parts acceptable by encrypter
	k := (publicKey.N.BitLen() + 7) / 8
	maxSize := k - 2*hash.Size() - 2 //from rsa.go
	toEncrypt := splitMsg(buf.Bytes(), maxSize)

	//encrypt
	parts := make([][]byte, len(toEncrypt))
	for i, part := range toEncrypt {
		parts[i], err = rsa.EncryptOAEP(hash, rand.Reader, publicKey, part, nil)
		if err != nil {
			return nil, err
		}
	}

	encrypted.Msg = parts
	return encrypted, nil
}

// Encrypt encrypts a given plaintext using the provided public key.
// The encryption process uses random data. Therefore, this function is not deterministic.
func Encrypt(publicKey *rsa.PublicKey, plaintext []byte) (EncryptedMessage, error) {
	if publicKey == nil {
		return EncryptedMessage{}, errors.New("public key must not be nil")
	}

	aesKey, err := generateSymmetricKey()
	if err != nil {
		return EncryptedMessage{}, err
	}

	ciphertext, err := symmetricEncrypt(aesKey, plaintext)
	if err != nil {
		return EncryptedMessage{}, err
	}

	encryptedKey, err := rsa.EncryptOAEP(sha256.New(), rand.Reader, publicKey, aesKey, nil)
	if err != nil {
		return EncryptedMessage{}, err
	}

	return EncryptedMessage{
		Ciphertext:   ciphertext,
		EncryptedKey: encryptedKey,
	}, nil
}

func TestPad(t *testing.T) {
	private, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil || private == nil {
		t.Fatal("Can't gen private key %s\n", err)
	}
	public := &private.PublicKey
	var a [9]byte
	copy(a[0:8], "IDENTITY")

	seed := []byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16}
	encrypted_secret, err := rsa.EncryptOAEP(sha1.New(), rand.Reader,
		public, seed, a[0:9])
	if err != nil {
		t.Fatal("Can't encrypt ", err)
	}
	fmt.Printf("encrypted_secret: %x\n", encrypted_secret)
	decrypted_secret, err := rsa.DecryptOAEP(sha1.New(), rand.Reader,
		private, encrypted_secret, a[0:9])
	if err != nil {
		t.Fatal("Can't decrypt ", err)
	}
	fmt.Printf("decrypted_secret: %x\n", decrypted_secret)
	var N *big.Int
	var D *big.Int
	var x *big.Int
	var z *big.Int
	N = public.N
	D = private.D
	x = new(big.Int)
	z = new(big.Int)
	x.SetBytes(encrypted_secret)
	z = z.Exp(x, D, N)
	decrypted_pad := z.Bytes()
	fmt.Printf("decrypted_pad   : %x\n", decrypted_pad)
}

func (t *rsaTransformer) Encrypt(value []byte) ([]byte, error) {
	encrypted, err := rsa.EncryptOAEP(sha512.New(), rand.Reader, &t.rsaPrivateKey.PublicKey, value, nil)
	if err != nil {
		return nil, err
	}
	return []byte(EncodeToString(encrypted)), nil
}

// returns a base64 encoded ciphertext.
// OAEP can only encrypt plaintexts that are smaller than the key length; for
// a 1024-bit key, about 117 bytes. So instead, this function:
// * generates a random 32-byte symmetric key (randKey)
// * encrypts the plaintext with AES256 using that random symmetric key -> cipherText
// * encrypts the random symmetric key with the ssh PublicKey -> cipherKey
// * returns the base64-encoded marshalled JSON for the ciphertext and key
func CredulousEncode(plaintext string, pubkey ssh.PublicKey) (ciphertext string, err error) {
	rsaKey := sshPubkeyToRsaPubkey(pubkey)
	randKey := make([]byte, 32)
	_, err = rand.Read(randKey)
	if err != nil {
		return "", err
	}

	encoded, err := encodeAES(randKey, plaintext)
	if err != nil {
		return "", err
	}

	out, err := rsa.EncryptOAEP(sha1.New(), rand.Reader, &rsaKey, []byte(randKey), []byte("Credulous"))
	if err != nil {
		return "", err
	}
	cipherKey := base64.StdEncoding.EncodeToString(out)

	cipherStruct := AESEncryption{
		EncodedKey: cipherKey,
		Ciphertext: encoded,
	}

	tmp, err := json.Marshal(cipherStruct)
	if err != nil {
		return "", err
	}

	ciphertext = base64.StdEncoding.EncodeToString(tmp)

	return ciphertext, nil
}

// Create an AES IV and key and an 8-byte salt, then encrypt these and
// the proposed protocol version using the server's comms public key.
func ClientEncryptHello(version1 uint32, ck *rsa.PublicKey, rng *xr.PRNG) (
	cOneShot *AesSession, ciphertext []byte, err error) {

	if rng == nil {
		rng = xr.MakeSystemRNG()
	}
	vBytes := make([]byte, 4)
	vBytes[0] = byte(version1)
	vBytes[1] = byte(version1 >> 8)
	vBytes[2] = byte(version1 >> 16)
	vBytes[3] = byte(version1 >> 24)

	// Generate 32-byte AES key, and 8-byte salt for the Hello
	salty := make([]byte, 2*aes.BlockSize+8+20)
	rng.NextBytes(salty)

	key1 := salty[:2*aes.BlockSize]
	// salt1 := salty[2*aes.BlockSize : 2*aes.BlockSize+8]
	oaep1 := salty[2*aes.BlockSize+8:]
	oaepSalt := bytes.NewBuffer(oaep1)

	sha := sha1.New()
	data := salty[:2*aes.BlockSize+8] // contains key1,salt1
	data = append(data, vBytes...)    // ... plus preferred protocol version

	ciphertext, err = rsa.EncryptOAEP(sha, oaepSalt, ck, data, nil)
	if err == nil {
		cOneShot, err = NewAesSession(key1, rng)
	}
	return
}

// Encrypts a symmetric key to this identity
func (this *PublicIdentity) Encrypt(key *SymmetricKey) (ek *EncryptedKey) {
	out, err := rsa.EncryptOAEP(sha256.New224(), rand.Reader, this.key, key.key, nil)
	if err != nil {
		panic(err)
	}
	return &EncryptedKey{impl: out}
}

func main() {
	privateKey, err := rsa.GenerateKey(rand.Reader, 512)
	if err != nil {
		fmt.Printf("rsa.GenerateKey: %v\n", err)
	}

	message := "Hello World!"
	messageBytes := bytes.NewBufferString(message)
	sha1 := sha1.New()

	encrypted, err := rsa.EncryptOAEP(sha1, rand.Reader, &privateKey.PublicKey, messageBytes.Bytes(), nil)
	if err != nil {
		fmt.Printf("EncryptOAEP: %s\n", err)
	}

	decrypted, err := rsa.DecryptOAEP(sha1, rand.Reader, privateKey, encrypted, nil)
	if err != nil {
		fmt.Printf("decrypt: %s\n", err)
	}

	decryptedString := bytes.NewBuffer(decrypted).String()
	fmt.Printf("message: %v\n", message)
	fmt.Printf("encrypted: %v\n", encrypted)
	fmt.Printf("decryptedString: %v\n", decryptedString)
}

// Encrypts a message with the given public key using RSA-OAEP and the sha1 hash function.
func RSAEncrypt(pub *rsa.PublicKey, msg []byte) []byte {
	b, err := rsa.EncryptOAEP(sha1.New(), rand.Reader, pub, msg, nil)
	if err != nil {
		panic(err)
	}
	return b
}

func (ct *CryptoTool) Enc(in []byte) []byte {
	out, err := rsa.EncryptOAEP(ct.sha1, rand.Reader, ct.publicKey, in, nil)
	if err != nil {
		log.Fatalln("EncryptOAEP fail", err)
	}
	return out
}

func encryptWithAPIPublicKey(publicKey *rsa.PublicKey, message []byte) []byte {
	encryptedMessage, err := rsa.EncryptOAEP(sha1.New(), rand.Reader, publicKey, message, nil)
	if err != nil {
		return nil
	}

	return encryptedMessage
}

// encrypts a given message with a provided RSA public key.
// the label must be the same for the encryption and decryption for it to work.
func encryptRSA(pub *rsa.PublicKey, message []byte) []byte {
	label := make([]byte, 10)
	encMessage, err := rsa.EncryptOAEP(sha512.New(), rand.Reader, pub, message, label)
	fmt.Println(encMessage)
	if err != nil {
		fmt.Println("encryption failed!: ", err)
	}
	return encMessage
}

// EncryptKey encrypts a 16-byte key with the RSA or EC key of the record.
func (pr PasswordRecord) EncryptKey(in []byte) (out []byte, err error) {
	if pr.Type == RSARecord {
		return rsa.EncryptOAEP(sha1.New(), rand.Reader, &pr.RSAKey.RSAPublic, in, nil)
	} else if pr.Type == ECCRecord {
		return ecdh.Encrypt(pr.ECKey.ECPublic, in)
	} else {
		return nil, errors.New("Invalid function for record type")
	}
}

// Encrypt encrypts the message with RSAES-OAEP, checking to ensure that it is
// not longer than the maximum allowed message length. It uses SHA256
// as the underlying hash algorithm.
func Encrypt(pub *rsa.PublicKey, pt []byte) (ct []byte, err error) {
	if len(pt) > MaxMessageLength(pub) {
		err = fmt.Errorf("message is too long")
		return
	}

	hash := sha256.New()
	ct, err = rsa.EncryptOAEP(hash, rand.Reader, pub, pt, defaultLabel)
	return
}

//Encrypt Encrypt the given message with the given public key.
func Encrypt(content []byte, publickey *rsa.PublicKey) ([]byte, error) {
	md5hash := md5.New()
	label := []byte("")

	encryptedmsg, err := rsa.EncryptOAEP(md5hash, rand.Reader, publickey, content, label)
	if err != nil {
		return nil, err
	}
	return encryptedmsg, nil
}

//OAEP Encrypt
func Encrypt_oaep(public_key *rsa.PublicKey, plain_text, label []byte) (encrypted []byte) {
	var err error
	var md5_hash hash.Hash

	md5_hash = md5.New()

	if encrypted, err = rsa.EncryptOAEP(md5_hash, rand.Reader, public_key, plain_text, label); err != nil {
		log.Fatal(err)
	}
	return
}

func (rk *rsaPublicKey) Encrypt(msg []byte) ([]byte, error) {
	// FIXME: If msg is too long for keysize, EncryptOAEP returns an error
	// Do we want to return a Keyczar error here, either by checking
	// ourselves for this case or by wrapping the returned error?
	s, err := rsa.EncryptOAEP(sha1.New(), rand.Reader, &rk.key, msg, nil)
	if err != nil {
		return nil, err
	}
	h := append(makeHeader(rk), s...)
	return h, nil
}