import Foundation

/// Minimal DES / Triple-DES (EDE) in CBC mode — **encryption only**.
///
/// This exists for exactly one reason: the PKCS#12 the enrollment profile carries must be readable by
/// `SecItemImport`, the legacy CDSA-backed importer that macOS's configuration-profile certificate
/// payload plugin uses (`nm -u /usr/libexec/mdmclient` lists `_SecItemImport`, not `SecPKCS12Import`).
/// That importer understands only the RFC 7292 v1 PBE algorithms, and of those only
/// `pbeWithSHAAnd3-KeyTripleDES-CBC` can also be read back by a stock OpenSSL 3 (RC4/RC2 need the
/// legacy provider, which would make our own interop test unrunnable). swift-crypto exposes no 3DES,
/// so it is here. See `PKCS12.swift` for the full rationale and docs/MACOS_VM_MDM_DEBUG_LOG.md run 22.
///
/// Not for general use: 3DES is obsolete and this is a textbook, non-constant-time implementation.
/// It is acceptable here only because the PKCS#12 password travels in cleartext in the very same
/// `.mobileconfig` (the `Password` key), so this encryption layer carries no confidentiality at all —
/// it is a format requirement, not a security control.
enum TripleDES {
    enum TripleDESError: Error, CustomStringConvertible {
        case badKeyLength(Int)
        case badIVLength(Int)
        var description: String {
            switch self {
            case .badKeyLength(let n): return "3DES needs a 24-byte key, got \(n)"
            case .badIVLength(let n): return "3DES-CBC needs an 8-byte IV, got \(n)"
            }
        }
    }

    /// 3DES-EDE-CBC encrypt with PKCS#7 padding. `key` is 24 bytes (K1‖K2‖K3), `iv` is 8 bytes.
    static func encryptCBC(_ plaintext: [UInt8], key: [UInt8], iv: [UInt8]) throws -> [UInt8] {
        guard key.count == 24 else { throw TripleDESError.badKeyLength(key.count) }
        guard iv.count == 8 else { throw TripleDESError.badIVLength(iv.count) }
        let k1 = keySchedule(load64(key, at: 0))
        let k2 = Array(keySchedule(load64(key, at: 8)).reversed())  // middle block runs decrypt
        let k3 = keySchedule(load64(key, at: 16))

        // PKCS#7: always pad, 1...8 bytes, so the length is unambiguous.
        var padded = plaintext
        let pad = 8 - (plaintext.count % 8)
        padded.append(contentsOf: [UInt8](repeating: UInt8(pad), count: pad))

        var out = [UInt8]()
        out.reserveCapacity(padded.count)
        var previous = load64(iv, at: 0)
        for offset in stride(from: 0, to: padded.count, by: 8) {
            let block = load64(padded, at: offset) ^ previous
            let cipher = desBlock(desBlock(desBlock(block, k1), k2), k3)
            out.append(contentsOf: store64(cipher))
            previous = cipher
        }
        return out
    }

    /// Single-block raw DES encryption. Exposed only so tests can pin the FIPS known-answer vectors.
    static func encryptBlockForTesting(_ block: UInt64, key: UInt64) -> UInt64 {
        desBlock(block, keySchedule(key))
    }

    // MARK: - Core

    private static func desBlock(_ block: UInt64, _ subkeys: [UInt64]) -> UInt64 {
        let v = permute(block, Tables.ip, inputBits: 64)
        var left = UInt32(truncatingIfNeeded: v >> 32)
        var right = UInt32(truncatingIfNeeded: v)
        for subkey in subkeys {
            let previousRight = right
            right = left ^ feistel(right, subkey)
            left = previousRight
        }
        // The halves are swapped once more going into the final permutation (R16‖L16).
        return permute((UInt64(right) << 32) | UInt64(left), Tables.fp, inputBits: 64)
    }

    private static func keySchedule(_ key64: UInt64) -> [UInt64] {
        let cd = permute(key64, Tables.pc1, inputBits: 64)  // 56 bits
        var c = UInt32(truncatingIfNeeded: cd >> 28) & 0x0FFF_FFFF
        var d = UInt32(truncatingIfNeeded: cd) & 0x0FFF_FFFF
        var subkeys = [UInt64]()
        subkeys.reserveCapacity(16)
        for round in 0..<16 {
            let shift = UInt32(Tables.shifts[round])
            c = ((c << shift) | (c >> (28 - shift))) & 0x0FFF_FFFF
            d = ((d << shift) | (d >> (28 - shift))) & 0x0FFF_FFFF
            subkeys.append(permute((UInt64(c) << 28) | UInt64(d), Tables.pc2, inputBits: 56))
        }
        return subkeys
    }

    private static func feistel(_ right: UInt32, _ subkey: UInt64) -> UInt32 {
        let expanded = permute(UInt64(right), Tables.e, inputBits: 32) ^ subkey  // 48 bits
        var substituted: UInt64 = 0
        for box in 0..<8 {
            let six = UInt8((expanded >> UInt64(42 - 6 * box)) & 0x3F)
            let row = Int(((six >> 5) << 1) | (six & 1))
            let column = Int((six >> 1) & 0x0F)
            substituted = (substituted << 4) | UInt64(Tables.s[box][row * 16 + column])
        }
        return UInt32(truncatingIfNeeded: permute(substituted, Tables.p, inputBits: 32))
    }

    /// Apply a 1-based DES bit-permutation table. Bit 1 is the most significant of `inputBits`.
    private static func permute(_ value: UInt64, _ table: [UInt8], inputBits: Int) -> UInt64 {
        var out: UInt64 = 0
        for (index, position) in table.enumerated() {
            let bit = (value >> UInt64(inputBits - Int(position))) & 1
            out |= bit << UInt64(table.count - 1 - index)
        }
        return out
    }

    private static func load64(_ bytes: [UInt8], at offset: Int) -> UInt64 {
        var v: UInt64 = 0
        for i in 0..<8 { v = (v << 8) | UInt64(bytes[offset + i]) }
        return v
    }

    private static func store64(_ value: UInt64) -> [UInt8] {
        (0..<8).map { UInt8(truncatingIfNeeded: value >> UInt64(56 - 8 * $0)) }
    }

    // MARK: - FIPS 46-3 tables

    private enum Tables {
        static let ip: [UInt8] = [
            58, 50, 42, 34, 26, 18, 10, 2, 60, 52, 44, 36, 28, 20, 12, 4,
            62, 54, 46, 38, 30, 22, 14, 6, 64, 56, 48, 40, 32, 24, 16, 8,
            57, 49, 41, 33, 25, 17, 9, 1, 59, 51, 43, 35, 27, 19, 11, 3,
            61, 53, 45, 37, 29, 21, 13, 5, 63, 55, 47, 39, 31, 23, 15, 7,
        ]
        static let fp: [UInt8] = [
            40, 8, 48, 16, 56, 24, 64, 32, 39, 7, 47, 15, 55, 23, 63, 31,
            38, 6, 46, 14, 54, 22, 62, 30, 37, 5, 45, 13, 53, 21, 61, 29,
            36, 4, 44, 12, 52, 20, 60, 28, 35, 3, 43, 11, 51, 19, 59, 27,
            34, 2, 42, 10, 50, 18, 58, 26, 33, 1, 41, 9, 49, 17, 57, 25,
        ]
        static let e: [UInt8] = [
            32, 1, 2, 3, 4, 5, 4, 5, 6, 7, 8, 9, 8, 9, 10, 11, 12, 13,
            12, 13, 14, 15, 16, 17, 16, 17, 18, 19, 20, 21, 20, 21, 22, 23, 24, 25,
            24, 25, 26, 27, 28, 29, 28, 29, 30, 31, 32, 1,
        ]
        static let p: [UInt8] = [
            16, 7, 20, 21, 29, 12, 28, 17, 1, 15, 23, 26, 5, 18, 31, 10,
            2, 8, 24, 14, 32, 27, 3, 9, 19, 13, 30, 6, 22, 11, 4, 25,
        ]
        static let pc1: [UInt8] = [
            57, 49, 41, 33, 25, 17, 9, 1, 58, 50, 42, 34, 26, 18,
            10, 2, 59, 51, 43, 35, 27, 19, 11, 3, 60, 52, 44, 36,
            63, 55, 47, 39, 31, 23, 15, 7, 62, 54, 46, 38, 30, 22,
            14, 6, 61, 53, 45, 37, 29, 21, 13, 5, 28, 20, 12, 4,
        ]
        static let pc2: [UInt8] = [
            14, 17, 11, 24, 1, 5, 3, 28, 15, 6, 21, 10,
            23, 19, 12, 4, 26, 8, 16, 7, 27, 20, 13, 2,
            41, 52, 31, 37, 47, 55, 30, 40, 51, 45, 33, 48,
            44, 49, 39, 56, 34, 53, 46, 42, 50, 36, 29, 32,
        ]
        static let shifts: [UInt8] = [1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1]
        static let s: [[UInt8]] = [
            [
                14, 4, 13, 1, 2, 15, 11, 8, 3, 10, 6, 12, 5, 9, 0, 7,
                0, 15, 7, 4, 14, 2, 13, 1, 10, 6, 12, 11, 9, 5, 3, 8,
                4, 1, 14, 8, 13, 6, 2, 11, 15, 12, 9, 7, 3, 10, 5, 0,
                15, 12, 8, 2, 4, 9, 1, 7, 5, 11, 3, 14, 10, 0, 6, 13,
            ],
            [
                15, 1, 8, 14, 6, 11, 3, 4, 9, 7, 2, 13, 12, 0, 5, 10,
                3, 13, 4, 7, 15, 2, 8, 14, 12, 0, 1, 10, 6, 9, 11, 5,
                0, 14, 7, 11, 10, 4, 13, 1, 5, 8, 12, 6, 9, 3, 2, 15,
                13, 8, 10, 1, 3, 15, 4, 2, 11, 6, 7, 12, 0, 5, 14, 9,
            ],
            [
                10, 0, 9, 14, 6, 3, 15, 5, 1, 13, 12, 7, 11, 4, 2, 8,
                13, 7, 0, 9, 3, 4, 6, 10, 2, 8, 5, 14, 12, 11, 15, 1,
                13, 6, 4, 9, 8, 15, 3, 0, 11, 1, 2, 12, 5, 10, 14, 7,
                1, 10, 13, 0, 6, 9, 8, 7, 4, 15, 14, 3, 11, 5, 2, 12,
            ],
            [
                7, 13, 14, 3, 0, 6, 9, 10, 1, 2, 8, 5, 11, 12, 4, 15,
                13, 8, 11, 5, 6, 15, 0, 3, 4, 7, 2, 12, 1, 10, 14, 9,
                10, 6, 9, 0, 12, 11, 7, 13, 15, 1, 3, 14, 5, 2, 8, 4,
                3, 15, 0, 6, 10, 1, 13, 8, 9, 4, 5, 11, 12, 7, 2, 14,
            ],
            [
                2, 12, 4, 1, 7, 10, 11, 6, 8, 5, 3, 15, 13, 0, 14, 9,
                14, 11, 2, 12, 4, 7, 13, 1, 5, 0, 15, 10, 3, 9, 8, 6,
                4, 2, 1, 11, 10, 13, 7, 8, 15, 9, 12, 5, 6, 3, 0, 14,
                11, 8, 12, 7, 1, 14, 2, 13, 6, 15, 0, 9, 10, 4, 5, 3,
            ],
            [
                12, 1, 10, 15, 9, 2, 6, 8, 0, 13, 3, 4, 14, 7, 5, 11,
                10, 15, 4, 2, 7, 12, 9, 5, 6, 1, 13, 14, 0, 11, 3, 8,
                9, 14, 15, 5, 2, 8, 12, 3, 7, 0, 4, 10, 1, 13, 11, 6,
                4, 3, 2, 12, 9, 5, 15, 10, 11, 14, 1, 7, 6, 0, 8, 13,
            ],
            [
                4, 11, 2, 14, 15, 0, 8, 13, 3, 12, 9, 7, 5, 10, 6, 1,
                13, 0, 11, 7, 4, 9, 1, 10, 14, 3, 5, 12, 2, 15, 8, 6,
                1, 4, 11, 13, 12, 3, 7, 14, 10, 15, 6, 8, 0, 5, 9, 2,
                6, 11, 13, 8, 1, 4, 10, 7, 9, 5, 0, 15, 14, 2, 3, 12,
            ],
            [
                13, 2, 8, 4, 6, 15, 11, 1, 10, 9, 3, 14, 5, 0, 12, 7,
                1, 15, 13, 8, 10, 3, 7, 4, 12, 5, 6, 11, 0, 14, 9, 2,
                7, 11, 4, 1, 9, 12, 14, 2, 0, 6, 10, 13, 15, 3, 5, 8,
                2, 1, 14, 7, 4, 10, 8, 13, 15, 12, 9, 0, 3, 5, 6, 11,
            ],
        ]
    }
}
