(* Test vectors taken from GNUnet:
   https://git.gnunet.org/gnunet/gnunet/file/src/cli/util/crypto-test-vectors.json.html *)

let encode = B32.encode
let decode s = B32.decode s |> Result.get_ok

let () =
  (* hash *)
  let input = "91JPRV3F5GG4EKJNDSJQ8" in
  let expected =
    "D0R24RZ1TPASVQ2NY56CT8AJDYZE9ZGDB0GVZ05E9D4YGZQW2RC5YFPQ0Q86EPW836DY7VYQTNFFJT3ZR2K508F4JVS5JNJKYN2MMFR"
  in
  let output =
    input |> decode |> Hash.H64.hash |> Hash.H64.to_octets |> encode
  in
  assert (output = expected);

  ()

let () =
  (* eddsa_key_derivation *)
  let pub = "3M9KK1WSNM1RTY5P72HKFA264V4B7MVHVJ08Y90CV06DYHV8XPP0" in
  let priv = "8QC2VNF8443S5KPNKMB4XMV58BTHWAKZ7SVW5WG3KRB37567XS90" in
  let pub' =
    let open Crypto in
    priv
    |> decode
    |> EddsaPrivateKey.of_octets
    |> Result.get_ok
    |> EddsaPrivateKey.pub_of_priv
    |> EddsaPublicKey.to_octets
    |> encode
  in
  assert (pub = pub');

  ()

let () =
  (* eddsa_signing *)
  let priv = "5077XJR9AMH4T97ACKFBVBJD0KFENHPV66B2Y1JBSKXBJKNZJ4E0" in
  let pub = "6E2F03JJ8AEDANTTZZ4SBZDFEEZSF8A9DVGTS6VFBCVZQYQ46RRG" in
  let data = "00000300000000000000" in
  let sig_ =
    "XCNJGJ96WPDH60YVMH6C74NGQSGJE3BC1TYMGX6BHY5DMZZZKTB373QTXJ507K5EBSG9YS2EYKHCX3ATRQ6P5MY9MXC4ZB1XSZ2X23G"
  in
  let open Crypto in
  let msg = decode data in
  let eddsa_priv =
    priv |> decode |> EddsaPrivateKey.of_octets |> Result.get_ok
  in
  let sig_' =
    EddsaSignature.sign ~key:eddsa_priv msg
    |> EddsaSignature.to_octets
    |> encode
  in
  assert (sig_ = sig_');
  let eddsa_pub = pub |> decode |> EddsaPublicKey.of_octets |> Result.get_ok in
  let eddsa_sig = sig_ |> decode |> EddsaSignature.of_octets |> Result.get_ok in
  let () =
    EddsaSignature.verify ~key:eddsa_pub eddsa_sig ~msg |> Result.get_ok
  in

  ()

let () =
  (* kdf *)
  let salt = "94KPT83PCNS7J83KC5P78Y8" in
  let ikm = "94KPT83MD1JJ0WV5CDS6AX10D5Q70XBM41NPAY90DNGQ8SBJD5GPR" in
  let ctx =
    "94KPT83141HPYVKMCNW78833D1TPWTSC41GPRWVF41NPWVVQDRG62WS04XMPWSKF4WG6JVH0EHM6A82J8S1G"
  in
  let out_len = 64 in
  let out =
    "GTMR4QT05Z9WF5HKVG0WK9RPXGHSMHJNW377G9GJXCA8B0FEKPF4D27RJMSJZYWSQNTBJ5EYVV7ZW18B48Z0JVJJ80RHB706Y96Q358"
  in

  let xts = salt |> decode in
  let ikm = ikm |> decode in
  let ctx = ctx |> decode in
  let okm = Fdh_rsa.Kdf.kdf ~xts ~ikm ~ctx ~len:out_len in
  let okm = okm |> encode in
  assert (okm = out);

  ()

let () =
  (* rsa_blind_signing *)
  (* rsa_private_key data is given in gcrypt sexpr format.. *)
  let message_hash =
    "XKQMJ4CNTXBFE1V2WR6JS063J7PZQE4XMB5JH3RS5X0THQ1JQSQ69Y7KDBC9TYRJEZH48MEPY2SF4QHQ4VHXC0YQX5935MQEGP0AX6R"
  in
  let rsa_public_key =
    "040000YRN1NVJ68RS6RJF52PGRCQG19ZKWQPSTJX2G7ZDCKSZFE2VW3HHA81YF5C639JHJF5TX8YTEE2FW2WQCG1PTKNBSPPJEJGA032CN3E8QZ27VWY0K6JFT8ZSYWRH2SKDMXW56A4QKY46JJBWJ6T0ZRVBW6S1HTHXVE2RW8MXRW5T801077MDY13N5F8Z1JZVKBJ06TK3S0YPEDBXK0VEHRHEQJ5X5XYKR4KQTFAZNBMKXY8836VCHBXTK4YNX6AJ1CK29SMJH3Z3QRM16A2TNQGFR0HSMV446BF7FMT2E379ZAT5ST4G3BM2NWZYW545S2SW5MG5S6M88XZZ7SKFD48YVXNZ205GGSEYJPVBMR76WG4ZG30WBCPC1N54XE12RMAG81D8C09WG22PKGGDHYXX68N04002"
  in
  let blinding_key_secret =
    "3SWF49XZPHQMENTSBZQR7Z0B8ZSZ2JRARE79Q4VXZMQ7W6QABXMG"
  in
  let blinded_message =
    "3KHKZJZ30ABB4E56MA2V0EQWGCWH0QQG9P2ZHYHR186C5HZXJMM4N9WXAQTKS94QSV9Y17GGNXN5MB1PZZFG7Q0FY88QPKKRG4MYCPSMTZK5W59R0MJVNJ4P4AQM96TDG5W7RV8GSNR1QQZ1GNHW3CX6D6ZRTMXB2NKB5SSYTDJS79F5ZFBRZ4HVED9JBBPWSR79KVV5QQ4APBGHBCKGMF9NJJS53A1BVYHDEVYAGFYF2SNEP827ZP50FKJ5GKGV8NQ15ESEZ69AT7GJG0T3TZVENY2YN9CVR98W3BKEZ53J7VTANARG8SJS8AMJQ7S23P5HRJ7XE9KTNRNXKH49MXV9JHHYE5535N7AGWEKR47SBCGNF44Z7XJ9RV5BQV12ZRJKN4HBZQHDNCMH3QKX9Z6G64"
  in
  let open Crypto in
  let pub = rsa_public_key |> RsaPublicKey.of_b32 |> Result.get_ok in
  assert (RsaPublicKey.to_b32 pub = rsa_public_key);
  let bks = blinding_key_secret |> decode in
  let msg = decode message_hash in
  let bmsg = Fdh_rsa.blind_msg pub ~bks msg in
  assert (encode bmsg = blinded_message);

  ()

let () = Mirage_crypto_rng_unix.use_default ()

let () =
  let open Crypto in
  let priv, pub = RsaPrivateKey.generate ~bits:2048 () in
  let bks = "deadbeaf" in
  let msg = "uhuh." in
  let bmsg = Fdh_rsa.blind_msg pub ~bks msg in
  let bsig = Fdh_rsa.sign ~key:priv bmsg in
  let sig_ = Fdh_rsa.unblind_sig pub ~bks bsig in
  let res = Fdh_rsa.verify ~key:pub sig_ ~msg in
  assert (Result.is_ok res);

  ()

(* denomination-hash test value from taler-wallet-core/src/withdraw.test.ts *)
let test1 =
  ( "040000XT67C8KBD6B75TTQ3SK8FWXMNQW4372T3BDDGPAMB9RFCA03638W8T3F71WFEFK9NP32VKYVNFXPYRWQ1N1HDKV5J0DFEKHBPJCYSWCBJDRNWD7G8BN8PT97FA9AMV75MYEK4X54D1HGJ207JSVJBGFCATSPNTEYNHEQF1F220W00TBZR1HNPDQFD56FG0DJQ9KGHM8EC33H6AY9YN9CNX5R3Z4TZ4Q23W47SBHB13H6W74FQJG1F50X38VRSC4SR8RWBAFB7S4K8D2H4NMRFSQT892A3T0BTBW7HM5C0H2CK6FRKG31F7W9WP1S29013K5CXYE55CT8TH6N8J9B780R42Y5S3ZB6J6E9H76XBPSGH4TGYSR2VZRB98J417KCQMZKX1BB67E7W5KVE37TC9SJ904002",
    "Q21FQSSG4FXNT96Z14CHXM8N1RZAG9GPHAV8PRWS0PZAAVWH7PBW6R97M2CH19KKP65NNSWXY7B6S53PT3CBM342E357ZXDDJ8RDVW8"
  )

let test2 =
  ( "040000Y63CF78QFPKRY77BRK9P557Q1GQWX3NCZ3HSYSK0Z7TT0KGRA7N4SKBKEHSTVHX1Z9DNXMJR4EXSY1TXCKV0GJ3T3YYC6Z0JNMJFVYQAV4FX5J90NZH1N33MZTV8HS9SMNAA9S6K73G4P99GYBB01B0P6M1KXZ5JRDR7VWBR3MEJHHGJ6QBMCJR3NWJRE3WJW9PRY8QPQ2S7KFWTWRESH2DBXCXWBD2SRN6P9YX8GRAEMFEGXC9V5GVJTEMH6ZDGNXFPWZE3JVJ2Q4N9GDYKBCHZCJ7M7M2RJ9ZV4Y64NAN9BT6XDC68215GKKRHTW1BBF1MYY6AR3JCTT9HYAM923RMVQR3TAEB7SDX8J76XRZWYH3AGJCZAQGMN5C8SSH9AHQ9RNQJQ15CN45R37X4YNFJV904002",
    "447WA23SCBATMABHA0793F92MYTBYVPYMMQHCPKMKVY5P7RZRFMQ6VRW0Y8HRA7177GTBT0TBT08R21DZD129AJ995H9G09XBFE55G8"
  )

let () =
  let f (rsa_pub, h_pub) =
    let open Crypto in
    assert (
      rsa_pub
      |> RsaPublicKey.of_b32
      |> Result.get_ok
      |> RsaPublicKey.to_octets
      = (rsa_pub |> B32.decode |> Result.get_ok));

    let h_pub' =
      DenominationHash.to_b32
        (DenominationHash.hash_of_rsa
           (Result.get_ok @@ RsaPublicKey.of_b32 rsa_pub))
    in
    assert (h_pub' = h_pub);

    ()
  in

  f test1; f test2