opaque

type AuthRequest struct {
	ClientKeyshare *PublicKey // client_keyshare[Npk]
	ClientNonce    []byte     // client_nonce[Nn]
}

type AuthResponse struct {
	ServerNonce    []byte     // server_nonce[Nn]
	ServerKeyshare *PublicKey // server_keyshare[Npk]
	ServerMAC      []byte     // server_mac[Nm]
}

type CleartextCredentials struct {
	ServerPublicKey []byte
	ServerIdentity  []byte
	ClientIdentity  []byte
}

type Client interface {
	// CreateRegistrationRequest computes blinded message and returns (RegistrationRequest, blind).
	// Returned blind is client private value to be use in FinalizeRegistrationRequest and it must not send to server.
	// Reference: https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-09.html#name-createregistrationrequest
	CreateRegistrationRequest(password []byte) (clRegState *ClientRegistrationState, regReq *RegistrationRequest, err error)
	// FinalizeRegistrationRequest generates RegistrationRecord to store on server side.
	// Reference: https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-09.html#name-finalizeregistrationrequest
	FinalizeRegistrationRequest(clRegState *ClientRegistrationState, clientIdentity, regRes []byte) (regRec *RegistrationRecord, exportKey []byte, err error)
	// ClientInit function begins the AKE protocol and produces the client's KE1 output for the server.
	// Reference: https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-09.html#name-clientinit
	ClientInit(password []byte) (clLoginState *ClientLoginState, ke1Message *KE1, err error)
	// The ClientFinish function completes the AKE protocol for the client and produces the client's KE3 output for the server, as well as the session_key and export_key outputs from the AKE.
	// Reference: https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-09.html#name-clientfinish
	ClientFinish(clLoginState *ClientLoginState, clientIdentity []byte, ke2 []byte) (ke3Message *KE3, sessionKey []byte, exportKey []byte, err error)
}

type ClientConfiguration struct {
	OpaqueSuite Suite  // Chosen Opaque Suite
	ServerID    []byte // Server Identity. Usually, domain name
}

type ClientLoginState struct {
	Blind        *eccgroup.Scalar
	ClientSecret *PrivateKey
	KE1          *KE1
	Password     []byte
}

type ClientRegistrationState struct {
	Blind    *eccgroup.Scalar
	Password []byte
}

type CredentialRequest struct {
	BlindedMessage *eccgroup.Element // blinded_message[Noe]
}

type CredentialResponse struct {
	EvaluatedMessage *eccgroup.Element // evaluated_message[Noe]
	MaskingNonce     []byte            // masking_nonce[Nn]
	MaskedResponse   []byte            // masked_response[Npk + Ne]
}

type Envelope struct {
	Nonce   []byte // nonce[Nn]
	AuthTag []byte // auth_tag[Nm]
}

type Identifier uint

type KE1 struct {
	CredentialRequest *CredentialRequest // credential_request[Noe]
	AuthRequest       *AuthRequest       // auth_request[Nn+Npk]
}

type KE2 struct {
	CredentialResponse *CredentialResponse // credential_response[Noe+Nn+Npk+Ne]
	AuthResponse       *AuthResponse       // auth_response[Nn+Npk+Nm]
}

type KE3 struct {
	ClientMAC []byte // client_mac[Nm]
}

type PrivateKey struct {
	// contains filtered or unexported fields
}

type PublicKey struct {
	// contains filtered or unexported fields
}

type RegistrationRecord struct {
	Envelope     *Envelope  // envelope[Ne]
	ClientPubKey *PublicKey // client_public_key[Npk]
	MaskingKey   []byte     // masking_key[Nh]

}

type RegistrationRequest struct {
	BlindedMessage *eccgroup.Element // blinded_message[Noe]
}

type RegistrationResponse struct {
	EvaluatedMessage *eccgroup.Element // evaluated_message[Noe]
	ServerPublicKey  *PublicKey        // server_public_key[Npk]
}

type Server interface {
	// CreateRegistrationResponse evaluates the RegistrationRequest and returns RegistrationResponse
	// Reference: https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-09.html#name-createregistrationresponse
	CreateRegistrationResponse(regReq []byte, credentialIdentifier, oprfSeed []byte) (*RegistrationResponse, error)
	// ServerInit function continues the AKE protocol by processing the client's KE1 message and producing the server's KE2 output.
	// Reference: https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-09.html#name-serverinit
	ServerInit(clRecord []byte, ke1Message []byte, credentialIdentifier []byte, clientIdentity []byte, oprfSeed []byte) (*ServerLoginState, *KE2, error)
	// The ServerFinish function completes the AKE protocol for the server, yielding the session_key.
	// Reference: https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-09.html#name-serverfinish
	ServerFinish(svLoginState *ServerLoginState, ke3Message []byte) ([]byte, error)
	// GenerateOprfSeed generates randomly secure oprf seed with suitable length
	GenerateOprfSeed() []byte
}

type ServerConfiguration struct {
	ServerID         []byte     // Server Identity. Usually, domain name
	ServerPrivateKey []byte     // Serialized server private key value
	OpaqueSuite      Identifier // Chosen Opaque Suite
}

type ServerLoginState struct {
	ExpectedClientMac []byte
	SessionKey        []byte
}

type Suite interface {
	// OPRF function returns the oprf suite used by opaque suite.
	OPRF() oprf.Suite
	// Group function returns the prime-order group used by opaque suite.
	Group() eccgroup.Group
	// Hash	function returns the hash interface used by opaque suite.
	Hash() hash.Hash
	// Expand function executes HKDF Expand according to opaque suite's hash algorithm.
	Expand(pseudorandomKey []byte, info []byte, length int) []byte
	// Extract function executes HKDF Extract according to opaque suite's hash algorithm.
	Extract(salt, secret []byte) []byte
	// MAC function executes Hmac according to opaque suite's hash algorithm.
	MAC(key, message []byte) ([]byte, error)
	// Stretch function performs key stretching according to opaque suite's ksf algorithm.
	Stretch(password []byte, length int) ([]byte, error)
	// Store implements opaque protocol's Envelope Creation step.
	// Reference: https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-09.html#name-envelope-creation.
	Store(randomizedPwd []byte, sPubKey *PublicKey, serverIdentity, clientIdentity []byte) (*Envelope, *PublicKey, []byte, []byte, error)
	// Recover implements opaque protocol's Envelope Recovery step.
	// Reference: https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-09.html#name-envelope-recovery.
	Recover(randomizedPwd []byte, sPubKey *PublicKey, envelope *Envelope, serverIdentity, clientIdentity []byte) (*PrivateKey, []byte, error)
	// GenerateOPRFSeed generates random Nh bytes to use as oprf seed.
	GenerateOprfSeed() []byte

	// Registration Functions
	//
	// CreateRegistrationRequest computes blinded message and returns (RegistrationRequest, blind).
	// Returned blind is client private value to be use in FinalizeRegistrationRequest and it must not send to server.
	// Reference: https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-09.html#name-createregistrationrequest
	CreateRegistrationRequest(password []byte) (*RegistrationRequest, *eccgroup.Scalar, error)
	// CreateRegistrationResponse evaluates the RegistrationRequest and returns RegistrationResponse
	// Reference: https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-09.html#name-createregistrationresponse
	CreateRegistrationResponse(regReq *RegistrationRequest, serverPubKey *PublicKey, credentialIdentifier, oprfSeed []byte) (*RegistrationResponse, error)
	// FinalizeRegistrationRequest generates RegistrationRecord to store on server side.
	// Reference: https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-09.html#name-finalizeregistrationrequest
	FinalizeRegistrationRequest(password, serverIdentity, clientIdentity []byte, blind *eccgroup.Scalar, regRes *RegistrationResponse) (*RegistrationRecord, []byte, error)

	// AKE Functions
	//
	// ClientInit function begins the AKE protocol and produces the client's KE1 output for the server.
	// Reference: https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-09.html#name-clientinit
	ClientInit(password []byte) (*ClientLoginState, *KE1, error)
	// ServerInit function continues the AKE protocol by processing the client's KE1 message and producing the server's KE2 output.
	// Reference: https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-09.html#name-serverinit
	ServerInit(serverPrivKey *PrivateKey, serverPubKey *PublicKey, record *RegistrationRecord, ke1 *KE1, credIdentifier, clientIdentity, serverIdentity, oprfSeed []byte) (*ServerLoginState, *KE2, error)
	// The ClientFinish function completes the AKE protocol for the client and produces the client's KE3 output for the server, as well as the session_key and export_key outputs from the AKE.
	// Reference: https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-09.html#name-clientfinish
	ClientFinish(state *ClientLoginState, clientIdentity, serverIdentity []byte, ke2 *KE2) (*KE3, []byte, []byte, error)
	// The ServerFinish function completes the AKE protocol for the server, yielding the session_key.
	// Reference: https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-09.html#name-serverfinish
	ServerFinish(state *ServerLoginState, ke3 *KE3) ([]byte, error)

	// Credential Retrieval Functions
	//
	// The CreateCredentialRequest is used by the client to initiate the credential retrieval process, and it produces a CredentialRequest message and OPRF state.
	// Reference: https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-09.html#name-createcredentialrequest.
	CreateCredentialRequest(password []byte, chosenBlind *eccgroup.Scalar) (*CredentialRequest, *eccgroup.Scalar, error)
	// The CreateCredentialResponse function is used by the server to process the client's CredentialRequest message and complete the credential retrieval process, producing a CredentialResponse.
	// Reference: https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-09.html#name-createcredentialresponse.
	CreateCredentialResponse(credReq *CredentialRequest, serverPubKey *PublicKey, record *RegistrationRecord, credIdentifier, oprfSeed, maskingNonce []byte) (*CredentialResponse, error)
	// The RecoverCredentials function is used by the client to process the server's CredentialResponse message and produce the client's private key, server public key, and the export_key.
	// Reference: https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-09.html#name-recovercredentials.
	RecoverCredentials(password []byte, blind *eccgroup.Scalar, credRes *CredentialResponse, serverIdentity, clientIdentity []byte) (*PrivateKey, *PublicKey, []byte, error)

	// Key Creation Functions
	//
	// DeriveKeyPair wraps the DeriveKeyPair functionality of the OPRF suite used by opaque suite.
	DeriveKeyPair(seed []byte) (*PrivateKey, error)
	// GenerateKeyPair wraps the GenerateKeyPair functionality of the OPRF suite used by opaque suite.
	GenerateKeyPair() (*PrivateKey, error)
	// DeriveAuthKeyPair implements the steps found at https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-09.html#name-key-creation.
	DeriveAuthKeyPair(seed []byte) (*PrivateKey, error)
	// GenerateAuthKeyPair implements the steps found at https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-09.html#name-key-creation.
	GenerateAuthKeyPair() (*PrivateKey, error)

	// AKE 3DH Functions
	//
	// The function AuthClientStart implements OPAQUE-3DH AuthClientStart function.
	// Reference: https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-09.html#name-3dh-client-functions.
	// Unlike draft implementation, this function returns client state instead of managing it internally.
	AuthClientStart(credentialReq *CredentialRequest, clientNonce []byte, clientSecret *PrivateKey) (*ClientLoginState, *KE1, error)
	// The function AuthClientFinalize implements OPAQUE-3DH AuthClientFinalize function.
	// Reference: https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-09.html#name-3dh-client-functions.
	AuthClientFinalize(state *ClientLoginState, clientIdentity, serverIdentity []byte, cPrivKey *PrivateKey, sPubKey *PublicKey, ke2 *KE2) (*KE3, []byte, error)
	// The function AuthServerRespond implements OPAQUE-3DH AuthServerRespond function.
	// Reference: https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-09.html#name-3dh-server-functions.
	// Unlike draft implementation, this function returns server state instead of managing it internally.
	AuthServerRespond(serverPrivKey *PrivateKey, serverIdentity, clientIdentity, serverNonce []byte, clientPubKey *PublicKey, ke1 *KE1, credentialRes *CredentialResponse, serverPrivateKeyshare *PrivateKey) (*ServerLoginState, *AuthResponse, error)
	// The function AuthServerFinalize implements OPAQUE-3DH AuthServerFinalize function.
	// Reference: https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-09.html#name-3dh-server-functions.
	AuthServerFinalize(state *ServerLoginState, ke3 *KE3) ([]byte, error)

	// Dynamic Length Functions
	//
	// Output length of the Hash function used by opaque suite. (in byte)
	Nh() int
	// Output length of the public key generated by GenerateAuthKeyPair or DeriveAuthKeyPair functions. (in byte)
	Npk() int
	// Output length of the private key generated by GenerateAuthKeyPair or DeriveAuthKeyPair functions. (in byte)
	Nsk() int
	// Output length of MAC function. (in byte)
	Nm() int
	// Output length of Extract function. (in byte)
	Nx() int
	// Output length of serialized group element of the OPRF suite used by opaque suite.
	// In other words, output length of the public key generated by GenerateKeyPair or DeriveKeyPair functions. (in byte)
	Noe() int
	// Output length of serialized group scalar of the OPRF suite used by opaque suite.
	// In other words, output length of the private key generated by GenerateKeyPair or DeriveKeyPair functions. (in byte)
	Nok() int
	// Nonce length used in opaque protocol. (in byte)
	Nn() int
	// Seed length used in opaque protocol. (in byte)
	Nseed() int
	// Length of Envelope struct. (in byte)
	Ne() int
}