#if !BESTHTTP_DISABLE_ALTERNATE_SSL && (!UNITY_WEBGL || UNITY_EDITOR)
#pragma warning disable
using System;
using System.Text;

using BestHTTP.SecureProtocol.Org.BouncyCastle.Crypto.Parameters;
using BestHTTP.SecureProtocol.Org.BouncyCastle.Crypto.Utilities;
using BestHTTP.SecureProtocol.Org.BouncyCastle.Utilities;

namespace BestHTTP.SecureProtocol.Org.BouncyCastle.Crypto.Engines
{
    /// <summary>
    /// Implementation of Daniel J. Bernstein's Salsa20 stream cipher, Snuffle 2005
    /// </summary>
    [BestHTTP.PlatformSupport.IL2CPP.Il2CppSetOption(BestHTTP.PlatformSupport.IL2CPP.Option.NullChecks, false)]
    [BestHTTP.PlatformSupport.IL2CPP.Il2CppSetOption(BestHTTP.PlatformSupport.IL2CPP.Option.ArrayBoundsChecks, false)]
    [BestHTTP.PlatformSupport.IL2CPP.Il2CppSetOption(BestHTTP.PlatformSupport.IL2CPP.Option.DivideByZeroChecks, false)]
    [BestHTTP.PlatformSupport.IL2CPP.Il2CppEagerStaticClassConstructionAttribute]
    public class Salsa20Engine
		: IStreamCipher
	{
		public static readonly int DEFAULT_ROUNDS = 20;

		/** Constants */
		private const int StateSize = 16; // 16, 32 bit ints = 64 bytes

        private readonly static uint[] TAU_SIGMA = Pack.LE_To_UInt32(Strings.ToAsciiByteArray("expand 16-byte k" + "expand 32-byte k"), 0, 8);

        internal void PackTauOrSigma(int keyLength, uint[] state, int stateOffset)
        {
            int tsOff = (keyLength - 16) / 4;
            state[stateOffset] = TAU_SIGMA[tsOff];
            state[stateOffset + 1] = TAU_SIGMA[tsOff + 1];
            state[stateOffset + 2] = TAU_SIGMA[tsOff + 2];
            state[stateOffset + 3] = TAU_SIGMA[tsOff + 3];
        }

        [Obsolete]
        protected readonly static byte[]
			sigma = Strings.ToAsciiByteArray("expand 32-byte k"),
			tau = Strings.ToAsciiByteArray("expand 16-byte k");

		protected int rounds;

		/*
		 * variables to hold the state of the engine
		 * during encryption and decryption
		 */
		private int		 index = 0;
		internal uint[] engineState = new uint[StateSize]; // state
		internal uint[] x = new uint[StateSize]; // internal buffer
		private byte[]	 keyStream = new byte[StateSize * 4]; // expanded state, 64 bytes
		private bool	 initialised = false;

		/*
		 * internal counter
		 */
		private uint cW0, cW1, cW2;

		/// <summary>
		/// Creates a 20 round Salsa20 engine.
		/// </summary>
		public Salsa20Engine()
			: this(DEFAULT_ROUNDS)
		{
		}

		/// <summary>
		/// Creates a Salsa20 engine with a specific number of rounds.
		/// </summary>
		/// <param name="rounds">the number of rounds (must be an even number).</param>
		public Salsa20Engine(int rounds)
		{
			if (rounds <= 0 || (rounds & 1) != 0)
			{
				throw new ArgumentException("'rounds' must be a positive, even number");
			}

			this.rounds = rounds;
		}

        public virtual void Init(
			bool				forEncryption, 
			ICipherParameters	parameters)
		{
			/* 
			 * Salsa20 encryption and decryption is completely
			 * symmetrical, so the 'forEncryption' is 
			 * irrelevant. (Like 90% of stream ciphers)
			 */

			ParametersWithIV ivParams = parameters as ParametersWithIV;
			if (ivParams == null)
				throw new ArgumentException(AlgorithmName + " Init requires an IV", "parameters");

			byte[] iv = ivParams.GetIV();
			if (iv == null || iv.Length != NonceSize)
				throw new ArgumentException(AlgorithmName + " requires exactly " + NonceSize + " bytes of IV");

            ICipherParameters keyParam = ivParams.Parameters;
            if (keyParam == null)
            {
                if (!initialised)
                    throw new InvalidOperationException(AlgorithmName + " KeyParameter can not be null for first initialisation");

                SetKey(null, iv);
            }
            else if (keyParam is KeyParameter)
            {
                SetKey(((KeyParameter)keyParam).GetKey(), iv);
            }
            else
            {
                throw new ArgumentException(AlgorithmName + " Init parameters must contain a KeyParameter (or null for re-init)");
            }

            Reset();
			initialised = true;
		}

		protected virtual int NonceSize
		{
			get { return 8; }
		}

		public virtual string AlgorithmName
		{
			get
            { 
				string name = "Salsa20";
				if (rounds != DEFAULT_ROUNDS)
				{
					name += "/" + rounds;
				}
				return name;
			}
		}

        public virtual byte ReturnByte(
			byte input)
		{
			if (LimitExceeded())
			{
				throw new MaxBytesExceededException("2^70 byte limit per IV; Change IV");
			}

			if (index == 0)
			{
				GenerateKeyStream(keyStream);
				AdvanceCounter();
			}

			byte output = (byte)(keyStream[index] ^ input);
			index = (index + 1) & 63;

			return output;
		}

		protected virtual void AdvanceCounter()
		{
			if (++engineState[8] == 0)
			{
				++engineState[9];
			}
		}

        public unsafe virtual void ProcessBytes(
			byte[]	inBytes, 
			int		inOff, 
			int		len, 
			byte[]	outBytes, 
			int		outOff)
		{
			if (!initialised)
				throw new InvalidOperationException(AlgorithmName + " not initialised");

            Check.DataLength(inBytes, inOff, len, "input buffer too short");
            Check.OutputLength(outBytes, outOff, len, "output buffer too short");

            if (LimitExceeded((uint)len))
				throw new MaxBytesExceededException("2^70 byte limit per IV would be exceeded; Change IV");

            fixed (byte* pinBytes = inBytes, poutBytes = outBytes, pkeyStream = keyStream)
            {
                int ulongLen = len / sizeof(ulong);

                for (int i = 0; i < ulongLen; i++)
                {
                    if (index == 0)
                    {
                        GenerateKeyStream(keyStream);
                        AdvanceCounter();
                    }

                    ulong* pin = (ulong*)pinBytes;
                    ulong* pout = (ulong*)poutBytes;
                    ulong* pkey = (ulong*)pkeyStream;

                    pout[i + outOff] = pkey[index] ^ pin[i + inOff];
                    index = (index + 1) & ((64 / sizeof(ulong)) - 1);
                    //poutBytes[i + outOff] = (byte)(pkeyStream[index] ^ pinBytes[i + inOff]);
                    //index = (index + 1) & 63;
                }

                int remainingOffset = ulongLen * sizeof(ulong);
                index = (index * sizeof(ulong)) & 63;
                for (int i = remainingOffset; i < len; i++)
                {
                    if (index == 0)
                    {
                        GenerateKeyStream(keyStream);
                        AdvanceCounter();
                    }

                    poutBytes[i + outOff] = (byte)(pkeyStream[index] ^ pinBytes[i + inOff]);
                    index = (index + 1) & 63;
                }
            }
		}

        public virtual void Reset()
		{
			index = 0;
			ResetLimitCounter();
			ResetCounter();
		}

		protected virtual void ResetCounter()
		{
			engineState[8] = engineState[9] = 0;
		}

		protected virtual void SetKey(byte[] keyBytes, byte[] ivBytes)
		{
            if (keyBytes != null)
            {
                if ((keyBytes.Length != 16) && (keyBytes.Length != 32))
                    throw new ArgumentException(AlgorithmName + " requires 128 bit or 256 bit key");

                int tsOff = (keyBytes.Length - 16) / 4;
                engineState[0] = TAU_SIGMA[tsOff];
                engineState[5] = TAU_SIGMA[tsOff + 1];
                engineState[10] = TAU_SIGMA[tsOff + 2];
                engineState[15] = TAU_SIGMA[tsOff + 3];

                // Key
                Pack.LE_To_UInt32(keyBytes, 0, engineState, 1, 4);
                Pack.LE_To_UInt32(keyBytes, keyBytes.Length - 16, engineState, 11, 4);
            }

            // IV
            Pack.LE_To_UInt32(ivBytes, 0, engineState, 6, 2);
        }

        protected unsafe virtual void GenerateKeyStream(byte[] output)
		{
			SalsaCore(rounds, engineState, x);

            fixed (uint* ns = x)
            fixed (byte* bs = output)
            {
                int off = 0;
                uint* bsuint = (uint*)bs;
                for (int i = 0; i < 4; ++i)
                    bsuint[i] = ns[i];
            }
        }

		internal unsafe static void SalsaCore(int rounds, uint[] input, uint[] x)
		{
            fixed (uint* pinput = input, px = x)
            {
                uint x00 = pinput[0];
                uint x01 = pinput[1];
                uint x02 = pinput[2];
                uint x03 = pinput[3];
                uint x04 = pinput[4];
                uint x05 = pinput[5];
                uint x06 = pinput[6];
                uint x07 = pinput[7];
                uint x08 = pinput[8];
                uint x09 = pinput[9];
                uint x10 = pinput[10];
                uint x11 = pinput[11];
                uint x12 = pinput[12];
                uint x13 = pinput[13];
                uint x14 = pinput[14];
                uint x15 = pinput[15];

                for (int i = rounds; i > 0; i -= 2)
                {
                    // R(x, y) => (tempX << y) | (tempX >> (32 - y))
                    uint tempX = (x00 + x12);
                    x04 ^= (tempX << 7) | (tempX >> (32 - 7));

                    tempX = (x04 + x00);
                    x08 ^= (tempX << 9) | (tempX >> (32 - 9));

                    tempX = (x08 + x04);
                    x12 ^= (tempX << 13) | (tempX >> (32 - 13));

                    tempX = (x12 + x08);
                    x00 ^= (tempX << 18) | (tempX >> (32 - 18));

                    tempX = (x05 + x01);
                    x09 ^= (tempX << 7) | (tempX >> (32 - 7));

                    tempX = (x09 + x05);
                    x13 ^= (tempX << 9) | (tempX >> (32 - 9));

                    tempX = (x13 + x09);
                    x01 ^= (tempX << 13) | (tempX >> (32 - 13));

                    tempX = (x01 + x13);
                    x05 ^= (tempX << 18) | (tempX >> (32 - 18));

                    tempX = (x10 + x06);
                    x14 ^= (tempX << 7) | (tempX >> (32 - 7));

                    tempX = (x14 + x10);
                    x02 ^= (tempX << 9) | (tempX >> (32 - 9));

                    tempX = (x02 + x14);
                    x06 ^= (tempX << 13) | (tempX >> (32 - 13));

                    tempX = (x06 + x02);
                    x10 ^= (tempX << 18) | (tempX >> (32 - 18));

                    tempX = (x15 + x11);
                    x03 ^= (tempX << 7) | (tempX >> (32 - 7));

                    tempX = (x03 + x15);
                    x07 ^= (tempX << 9) | (tempX >> (32 - 9));

                    tempX = (x07 + x03);
                    x11 ^= (tempX << 13) | (tempX >> (32 - 13));

                    tempX = (x11 + x07);
                    x15 ^= (tempX << 18) | (tempX >> (32 - 18));


                    tempX = (x00 + x03);
                    x01 ^= (tempX << 7) | (tempX >> (32 - 7));

                    tempX = (x01 + x00);
                    x02 ^= (tempX << 9) | (tempX >> (32 - 9));

                    tempX = (x02 + x01);
                    x03 ^= (tempX << 13) | (tempX >> (32 - 13));

                    tempX = (x03 + x02);
                    x00 ^= (tempX << 18) | (tempX >> (32 - 18));

                    tempX = (x05 + x04);
                    x06 ^= (tempX << 7) | (tempX >> (32 - 7));

                    tempX = (x06 + x05);
                    x07 ^= (tempX << 9) | (tempX >> (32 - 9));

                    tempX = (x07 + x06);
                    x04 ^= (tempX << 13) | (tempX >> (32 - 13));

                    tempX = (x04 + x07);
                    x05 ^= (tempX << 18) | (tempX >> (32 - 18));

                    tempX = x10 + x09;
                    x11 ^= (tempX << 7) | (tempX >> (32 - 7));

                    tempX = x11 + x10;
                    x08 ^= (tempX << 9) | (tempX >> (32 - 9));

                    tempX = x11 + x10;
                    x09 ^= (tempX << 13) | (tempX >> (32 - 13));

                    tempX = x09 + x08;
                    x10 ^= (tempX << 18) | (tempX >> (32 - 18));

                    tempX = x15 + x14;
                    x12 ^= (tempX << 7) | (tempX >> (32 - 7));

                    tempX = x12 + x15;
                    x13 ^= (tempX << 9) | (tempX >> (32 - 9));

                    tempX = x13 + x12;
                    x14 ^= (tempX << 13) | (tempX >> (32 - 13));

                    tempX = x14 + x13;
                    x15 ^= (tempX << 18) | (tempX >> (32 - 18));
                }

                px[0] = x00 + pinput[0];
                px[1] = x01 + pinput[1];
                px[2] = x02 + pinput[2];
                px[3] = x03 + pinput[3];
                px[4] = x04 + pinput[4];
                px[5] = x05 + pinput[5];
                px[6] = x06 + pinput[6];
                px[7] = x07 + pinput[7];
                px[8] = x08 + pinput[8];
                px[9] = x09 + pinput[9];
                px[10] = x10 + pinput[10];
                px[11] = x11 + pinput[11];
                px[12] = x12 + pinput[12];
                px[13] = x13 + pinput[13];
                px[14] = x14 + pinput[14];
                px[15] = x15 + pinput[15];
            }
		}

		/**
		 * Rotate left
		 *
		 * @param   x   value to rotate
		 * @param   y   amount to rotate x
		 *
		 * @return  rotated x
		 */
		//internal static uint R(uint x, int y)
		//{
		//	return (x << y) | (x >> (32 - y));
		//}

		private void ResetLimitCounter()
		{
			cW0 = 0;
			cW1 = 0;
			cW2 = 0;
		}

		private bool LimitExceeded()
		{
			if (++cW0 == 0)
			{
				if (++cW1 == 0)
				{
					return (++cW2 & 0x20) != 0;          // 2^(32 + 32 + 6)
				}
			}

			return false;
		}

		/*
		 * this relies on the fact len will always be positive.
		 */
		private bool LimitExceeded(
			uint len)
		{
			uint old = cW0;
			cW0 += len;
			if (cW0 < old)
			{
				if (++cW1 == 0)
				{
					return (++cW2 & 0x20) != 0;          // 2^(32 + 32 + 6)
				}
			}

			return false;
		}
	}
}
#pragma warning restore
#endif