module ECDSA

# File lib/ecdsa.rb, line 22
def self.bit_length(integer)
  length = 0
  while integer > 0
    length += 1
    integer >>= 1
  end
  length
end

# File lib/ecdsa.rb, line 12
def self.byte_length(integer)
  length = 0
  while integer > 0
    length += 1
    integer >>= 8
  end
  length
end

# File lib/ecdsa/verify.rb, line 29
def self.check_signature!(public_key, digest, signature)
  group = public_key.group
  field = group.field

  # Step 1: r and s must be in the field and non-zero
  raise InvalidSignatureError, 'Invalid signature: r is not in the field.' if !field.include?(signature.r)
  raise InvalidSignatureError, 'Invalid signature: s is not in the field.' if !field.include?(signature.s)
  raise InvalidSignatureError, 'Invalid signature: r is zero.' if signature.r.zero?
  raise InvalidSignatureError, 'Invalid signature: s is zero.' if signature.s.zero?

  # Step 2 was already performed when the digest of the message was computed.

  # Step 3: Convert octet string to number and take leftmost bits.
  e = normalize_digest(digest, group.bit_length)

  # Step 4
  point_field = PrimeField.new(group.order)
  s_inverted = point_field.inverse(signature.s)
  u1 = point_field.mod(e * s_inverted)
  u2 = point_field.mod(signature.r * s_inverted)

  # Step 5
  r = group.generator.multiply_by_scalar(u1).add_to_point public_key.multiply_by_scalar(u2)
  raise InvalidSignatureError, 'Invalid signature: r is infinity in step 5.' if r.infinity?

  # Steps 6 and 7
  v = point_field.mod r.x

  # Step 8
  raise InvalidSignatureError, 'Invalid signature: v does not equal r.' if v != signature.r

  true
end

# File lib/ecdsa.rb, line 32
def self.normalize_digest(digest, bit_length)
  if digest.is_a?(String)
    digest = digest.dup.force_encoding('BINARY')
    digest_bit_length = digest.size * 8
    num = Format::IntegerOctetString.decode(digest)

    if digest_bit_length <= bit_length
      num
    else
      num >> (digest_bit_length - bit_length)
    end
  elsif digest.is_a?(Integer)
    digest
  else
    raise ArgumentError, 'Digest must be a string or integer.'
  end
end

# File lib/ecdsa/recover_public_key.rb, line 22
def self.recover_public_key(group, digest, signature)
  return enum_for(:recover_public_key, group, digest, signature) if !block_given?

  digest = normalize_digest(digest, group.bit_length)

  each_possible_temporary_public_key(group, digest, signature) do |point|
    yield calculate_public_key(group, digest, signature, point)
  end

  nil
end

# File lib/ecdsa/sign.rb, line 25
def self.sign(group, private_key, digest, temporary_key)
  # Second part of step 1: Select ephemeral elliptic curve key pair
  # temporary_key was already selected for us by the caller
  r_point = group.new_point temporary_key

  # Steps 2 and 3
  point_field = PrimeField.new(group.order)
  r = point_field.mod(r_point.x)
  return nil if r.zero?

  # Step 4, calculating the hash, was already performed by the caller.

  # Step 5
  e = normalize_digest(digest, group.bit_length)

  # Step 6
  s = point_field.mod(point_field.inverse(temporary_key) * (e + r * private_key))
  return nil if s.zero?

  Signature.new r, s
end

# File lib/ecdsa/verify.rb, line 14
def self.valid_signature?(public_key, digest, signature)
  check_signature! public_key, digest, signature
rescue InvalidSignatureError
  false
end

# File lib/ecdsa/recover_public_key.rb, line 51
def self.calculate_public_key(group, digest, signature, temporary_public_key)
  point_field = PrimeField.new(group.order)

  # public key = (tempPubKey * s - G * e) / r
  rs = temporary_public_key.multiply_by_scalar(signature.s)
  ge = group.generator.multiply_by_scalar(digest)
  r_inv = point_field.inverse(signature.r)

  rs.add_to_point(ge.negate).multiply_by_scalar(r_inv)
end

# File lib/ecdsa/recover_public_key.rb, line 36
def self.each_possible_temporary_public_key(group, digest, signature)
  # Instead of using the cofactor as the iteration limit as specified in SEC1,
  # we just iterate until x is too large to fit in the underlying field.
  # That way we don't have to know the cofactor of the group.
  signature.r.step(group.field.prime - 1, group.order) do |x|
    group.solve_for_y(x).each do |y|
      point = group.new_point [x, y]
      yield point if point.multiply_by_scalar(group.order).infinity?
    end
  end
end