/*
    Licensed to the Apache Software Foundation (ASF) under one
    or more contributor license agreements.  See the NOTICE file
    distributed with this work for additional information
    regarding copyright ownership.  The ASF licenses this file
    to you under the Apache License, Version 2.0 (the
    "License"); you may not use this file except in compliance
    with the License.  You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

    Unless required by applicable law or agreed to in writing,
    software distributed under the License is distributed on an
    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
    KIND, either express or implied.  See the License for the
    specific language governing permissions and limitations
    under the License.
*/

/* MPIN API Functions */

var MPIN256 = function(ctx) {
    "use strict";

    /**
      * Creates an instance of MPIN256
      *
      * @constructor
      * @this {MPIN256}
      */        
    var MPIN256 = {
        BAD_PARAMS: -11,
        INVALID_POINT: -14,
        WRONG_ORDER: -18,
        BAD_PIN: -19,
        /* configure PIN here */
        MAXPIN: 10000,
        /* max PIN */
        PBLEN: 14,
        /* MAXPIN length in bits */
        TS: 12,
        /* 10 for 4 digit PIN, 14 for 6-digit PIN - 2^TS/TS approx = sqrt(MAXPIN) */
        TRAP: 2000,
        /* 200 for 4 digit PIN, 2000 for 6-digit PIN  - approx 2*sqrt(MAXPIN) */
        EFS: ctx.BIG.MODBYTES,
        EGS: ctx.BIG.MODBYTES,

        SHA256: 32,
        SHA384: 48,
        SHA512: 64,

	/**
         * Get epoch time for day
         *
         * @this {MPIN256}
         * @return time in slots since epoch 
         */	
        today: function() {
            var now = new Date();
            return Math.floor(now.getTime() / (60000 * 1440)); // for daily tokens
        },

	/**
         * Convert byte array to string
         *
         * @this {MPIN256}
         * @param b byte array
         * @return s string
         */			
        bytestostring: function(b) {
            var s = "",
                len = b.length,
                ch, i;

            for (i = 0; i < len; i++) {
                ch = b[i];
                s += ((ch >>> 4) & 15).toString(16);
                s += (ch & 15).toString(16);

            }

            return s;
        },

	/**
         * Convert a string to byte array
         *
         * @this {MPIN256}
         * @param s string
         * @return b byte array
         */				
        stringtobytes: function(s) {
            var b = [],
                i;

            for (i = 0; i < s.length; i++) {
                b.push(s.charCodeAt(i));
            }

            return b;
        },

	/**
         * Convert byte arrays
         *
         * @this {MPIN256}
         * @param a byte array
         * @param b byte array
         * @return true if equal
         */				
        comparebytes: function(a, b) {
            if (a.length != b.length) {
                return false;
            }

            for (var i = 0; i < a.length; i++) {
                if (a[i] != b[i]) {
                    return false;
                }
            }

            return true;
        },

	/**
         * Hash values
         *
         * @this {MPIN256}
         * @param c FP8 instance
         * @param U ECP unstancebyte array
         * @return R hash value
         */						
        mpin_hash: function(sha, c, U) {
            var t = [],
                w = [],
                h = [],
                H, R, i;

            c.geta().geta().geta().getA().toBytes(w);
            for (i = 0; i < this.EFS; i++) {
                t[i] = w[i];
            }
            c.geta().geta().geta().getB().toBytes(w);
            for (i = this.EFS; i < 2 * this.EFS; i++) {
                t[i] = w[i - this.EFS];
            }
            c.geta().geta().getb().getA().toBytes(w);
            for (i = 2 * this.EFS; i < 3 * this.EFS; i++) {
                t[i] = w[i - 2 * this.EFS];
            }
            c.geta().geta().getb().getB().toBytes(w);
            for (i = 3 * this.EFS; i < 4 * this.EFS; i++) {
                t[i] = w[i - 3 * this.EFS];
            }

            c.geta().getb().geta().getA().toBytes(w);
            for (i = 4 * this.EFS; i < 5 * this.EFS; i++) {
                t[i] = w[i - 4 * this.EFS];
            }
            c.geta().getb().geta().getB().toBytes(w);
            for (i = 5 * this.EFS; i < 6 * this.EFS; i++) {
                t[i] = w[i - 5 * this.EFS];
            }
            c.geta().getb().getb().getA().toBytes(w);
            for (i = 6 * this.EFS; i < 7 * this.EFS; i++) {
                t[i] = w[i - 6 * this.EFS];
            }
            c.geta().getb().getb().getB().toBytes(w);
            for (i = 7 * this.EFS; i < 8 * this.EFS; i++) {
                t[i] = w[i - 7 * this.EFS];
            }

            c.getb().geta().geta().getA().toBytes(w);
            for (i = 8 * this.EFS; i < 9 * this.EFS; i++) {
                t[i] = w[i - 8 * this.EFS];
            }
            c.getb().geta().geta().getB().toBytes(w);
            for (i = 9 *this.EFS; i < 10 * this.EFS; i++) {
                t[i] = w[i - 9 * this.EFS];
            }
            c.getb().geta().getb().getA().toBytes(w);
            for (i = 10 * this.EFS; i < 11 * this.EFS; i++) {
                t[i] = w[i - 10 * this.EFS];
            }
            c.getb().geta().getb().getB().toBytes(w);
            for (i = 11 * this.EFS; i < 12 * this.EFS; i++) {
                t[i] = w[i - 11 * this.EFS];
            }

            c.getb().getb().geta().getA().toBytes(w);
            for (i = 12 * this.EFS; i < 13 * this.EFS; i++) {
                t[i] = w[i - 12 * this.EFS];
            }
            c.getb().getb().geta().getB().toBytes(w);
            for (i = 13 * this.EFS; i < 14 * this.EFS; i++) {
                t[i] = w[i - 13 * this.EFS];
            }
            c.getb().getb().getb().getA().toBytes(w);
            for (i = 14 * this.EFS; i < 15 * this.EFS; i++) {
                t[i] = w[i - 14 * this.EFS];
            }
            c.getb().getb().getb().getB().toBytes(w);
            for (i = 15 * this.EFS; i < 16 * this.EFS; i++) {
                t[i] = w[i - 15 * this.EFS];
            }


            U.getX().toBytes(w);
            for (i = 16 * this.EFS; i < 17 * this.EFS; i++) {
                t[i] = w[i - 16 * this.EFS];
            }
            U.getY().toBytes(w);
            for (i = 17 * this.EFS; i < 18 * this.EFS; i++) {
                t[i] = w[i - 17 * this.EFS];
            }

            if (sha == this.SHA256) {
                H = new ctx.HASH256();
            } else if (sha == this.SHA384) {
                H = new ctx.HASH384();
            } else if (sha == this.SHA512) {
                H = new ctx.HASH512();
            }

            H.process_array(t);
            h = H.hash();

            if (h.length == 0) {
                return null;
            }

            R = [];
            for (i = 0; i < ctx.ECP.AESKEY; i++) {
                R[i] = h[i];
            }

            return R;
        },

	/**
         * General purpose hash function
         *
         * @this {MPIN256}
         * @param sha is the hash type
         * @param n Integer
         * @param B byte array
         * @return R hash value
         */					
        hashit: function(sha, n, B) {
            var R = [],
                H, W, i, len;

            if (sha == this.SHA256) {
                H = new ctx.HASH256();
            } else if (sha == this.SHA384) {
                H = new ctx.HASH384();
            } else if (sha == this.SHA512) {
                H = new ctx.HASH512();
            }

            if (n > 0) {
                H.process_num(n);
            }
            H.process_array(B);
            R = H.hash();

            if (R.length == 0) {
                return null;
            }

            W = [];

            len = ctx.BIG.MODBYTES;

            if (sha >= len) {
                for (i = 0; i < len; i++) {
                    W[i] = R[i];
                }
            } else {
                for (i = 0; i < sha; i++) {
                    W[i + len - sha] = R[i];
                }

                for (i = 0; i < len - sha; i++) {
                    W[i] = 0;
                }
            }

            return W;
        },

	/**
         * maps a random u to a point on the curve 
         *
         * @this {MPIN256}
         * @param u BIG numberInteger
         * @param cb an integer representing the "sign" of y, in fact its least significant bit.
         * @return P ECP pointhash value
         */					
        map: function(u, cb) {
            var P = new ctx.ECP(),
                x = new ctx.BIG(u),
                p = new ctx.BIG(0);

            p.rcopy(ctx.ROM_FIELD.Modulus);
            x.mod(p);

            for (;;) {
                P.setxi(x, cb);
                if (!P.is_infinity()) {
                    break;
                }
                x.inc(1);
                x.norm();
            }

            return P;
        },

	/**
         * returns u derived from P. Random value in range 1 to return value should then be added to u 
         *
         * @this {MPIN256}
         * @param u BIG numberInteger
         * @param P ECP pointhash value
         * @return r Value that should be added to u to derive P 
         */						
        unmap: function(u, P) {
            var s = P.getS(),
                R = new ctx.ECP(),
                r = 0,
                x = P.getX();

            u.copy(x);

            for (;;) {
                u.dec(1);
                u.norm();
                r++;
                R.setxi(u, s); 
                if (!R.is_infinity()) {
                    break;
                }
            }

            return r;
        },

        /* these next two functions implement elligator squared - http://eprint.iacr.org/2014/043 */
        /* Elliptic curve point E in format (0x04,x,y} is converted to form {0x0-,u,v} */
        /* Note that u and v are indistinguishable from random strings */
        ENCODING: function(rng, E) {
            var T = [],
                i, rn, m, su, sv,
                u, v, P, p, W;

            for (i = 0; i < this.EFS; i++) {
                T[i] = E[i + 1];
            }
            u = ctx.BIG.fromBytes(T);
            for (i = 0; i < this.EFS; i++) {
                T[i] = E[i + this.EFS + 1];
            }
            v = ctx.BIG.fromBytes(T);

            P = new ctx.ECP(0);
            P.setxy(u, v);
            if (P.is_infinity()) {
                return this.INVALID_POINT;
            }

            p = new ctx.BIG(0);
            p.rcopy(ctx.ROM_FIELD.Modulus);
            u = ctx.BIG.randomnum(p, rng);

            su = rng.getByte();
            if (su < 0) {
                su = -su;
            }
            su %= 2;

            W = this.map(u, su);
            P.sub(W);
            sv = P.getS();
            rn = this.unmap(v, P);
            m = rng.getByte();
            if (m < 0) {
                m = -m;
            }
            m %= rn;
            v.inc(m + 1);
            E[0] = (su + 2 * sv);
            u.toBytes(T);
            for (i = 0; i < this.EFS; i++) {
                E[i + 1] = T[i];
            }
            v.toBytes(T);
            for (i = 0; i < this.EFS; i++) {
                E[i + this.EFS + 1] = T[i];
            }

            return 0;
        },

        DECODING: function(D) {
            var T = [],
                i, su, sv, u, v, W, P;

            if ((D[0] & 0x04) !== 0) {
                return this.INVALID_POINT;
            }

            for (i = 0; i < this.EFS; i++) {
                T[i] = D[i + 1];
            }
            u = ctx.BIG.fromBytes(T);
            for (i = 0; i < this.EFS; i++) {
                T[i] = D[i + this.EFS + 1];
            }
            v = ctx.BIG.fromBytes(T);

            su = D[0] & 1;
            sv = (D[0] >> 1) & 1;
            W = this.map(u, su);
            P = this.map(v, sv);
            P.add(W);
            u = P.getX();
            v = P.getY();
            D[0] = 0x04;
            u.toBytes(T);
            for (i = 0; i < this.EFS; i++) {
                D[i + 1] = T[i];
            }
            v.toBytes(T);
            for (i = 0; i < this.EFS; i++) {
                D[i + this.EFS + 1] = T[i];
            }

            return 0;
        },

	/**
         * Add two members from the group G1
         *
         * @this {MPIN256}
         * @param R1 Input member of G1
         * @param R2 Input member of G1
         * @param R Output member of G1. R=R1+R2
         * @return 0 or an error code
         */						
        RECOMBINE_G1: function(R1, R2, R) {
            var P = ctx.ECP.fromBytes(R1),
                Q = ctx.ECP.fromBytes(R2);

            if (P.is_infinity() || Q.is_infinity()) {
                return this.INVALID_POINT;
            }

            P.add(Q);

            P.toBytes(R,false);

            return 0;
        },

	/**
         * Add two members from the group G2
         *
         * @this {MPIN256}
         * @param W1 Input member of G2
         * @param W2 Input member of G2
         * @param W Output member of G2. W=W1+W2
         * @return 0 or an error code
         */						
        RECOMBINE_G2: function(W1, W2, W) {
            var P = ctx.ECP8.fromBytes(W1),
                Q = ctx.ECP8.fromBytes(W2);

            if (P.is_infinity() || Q.is_infinity()) {
                return this.INVALID_POINT;
            }

            P.add(Q);

            P.toBytes(W);

            return 0;
        },

	/**
         * Hash the identity
         *
         * @this {MPIN256}
         * @param sha is the hash type
         * @param ID Identity as byte array
         * @return hash value
         */					
        HASH_ID: function(sha, ID) {
            return this.hashit(sha, 0, ID);
        },

	/**
         * Create random secret
         *
         * @this {MPIN256}
         * @param rng cryptographically secure random number generator
         * @param S Random secret value
         * @return O for success or else error code
         */					
        RANDOM_GENERATE: function(rng, S) {
            var r = new ctx.BIG(0),
                s;

            r.rcopy(ctx.ROM_CURVE.CURVE_Order);

            s = ctx.BIG.randomnum(r, rng);
            s.toBytes(S);

            return 0;
        },

	/**
         * Extract a PIN number from a client secret
         *
         * @this {MPIN256}
         * @parameter sha hash type
         * @parameter CID Client identity
         * @parameter pin PIN value
         * @parameter TOKEN Client secret
         * @return token
         */					
        EXTRACT_PIN: function(sha, CID, pin, TOKEN) {
            return this.EXTRACT_FACTOR(sha,CID,pin%this.MAXPIN,this.PBLEN,TOKEN);
        },

	/**
         * Extract factor from TOKEN for identity CID 
         *
         * @this {MPIN256}
         * @parameter sha hash type
         * @parameter CID Client identity
         * @parameter factor Value to extract
         * @parameter facbits Number of bits in factor
         * @parameter TOKEN Token value
         * @return token
         */					
        EXTRACT_FACTOR: function(sha, CID, factor, facbits, TOKEN) {
            var P, R, h;

            P = ctx.ECP.fromBytes(TOKEN);

            if (P.is_infinity()) {
                return this.INVALID_POINT;
            }

            h = this.hashit(sha, 0, CID);
            R = ctx.ECP.mapit(h);

            R = R.pinmul(factor, facbits);
            P.sub(R);

            P.toBytes(TOKEN,false);

            return 0;
        },

	/**
         * Restore factor to TOKEN for identity CID 
         *
         * @this {MPIN256}
         * @parameter sha hash type
         * @parameter CID Client identity
         * @parameter factor Value to extract
         * @parameter facbits Number of bits in factor
         * @parameter TOKEN Token value
         * @return token
         */					
        RESTORE_FACTOR: function(sha, CID, factor, facbits, TOKEN) {
            var P, R, h;

            P = ctx.ECP.fromBytes(TOKEN);

            if (P.is_infinity()) {
                return this.INVALID_POINT;
            }

            h = this.hashit(sha, 0, CID),
            R = ctx.ECP.mapit(h);

            R = R.pinmul(factor, facbits);
            P.add(R);

            P.toBytes(TOKEN,false);

            return 0;
        },

	/**
         * Create a server secret in G2 from a master secret
         *
         * @this {MPIN256}
         * @param S Master secret
         * @param SST Server secret = s.Q where Q is a fixed generator of G2
         * @return O for success or else error code
         */					
        GET_SERVER_SECRET: function(S, SST) {
            var s,Q;

            Q = ctx.ECP8.generator();

            s = ctx.BIG.fromBytes(S);
            Q = ctx.PAIR256.G2mul(Q, s);
            Q.toBytes(SST);

            return 0;
        },

	/**
         * Find a random multiple of a point in G1
         *
         * @this {MPIN256}
         * @parameter rng cryptographically secure random number generator
	 * @param type determines type of action to be taken
	 * @param x an output internally randomly generated if R!=NULL, otherwise must be provided as an input
	 * @param G if type=0 a point in G1, else an octet to be mapped to G1
	 * @param W the output =x.G or x.M(G), where M(.) is a mapping
         * @return O for success or else error code
         */					
        GET_G1_MULTIPLE: function(rng, type, X, G, W) {
            var r = new ctx.BIG(0),
                x, P;

            r.rcopy(ctx.ROM_CURVE.CURVE_Order);

            if (rng != null) {
                x = ctx.BIG.randomnum(r, rng);
                x.toBytes(X);
            } else {
                x = ctx.BIG.fromBytes(X);
            }

            if (type == 0) {
                P = ctx.ECP.fromBytes(G);
                if (P.is_infinity()) {
                    return this.INVALID_POINT;
                }
            } else {
                P = ctx.ECP.mapit(G);
            }

            ctx.PAIR256.G1mul(P, x).toBytes(W,false);

            return 0;
        },


	/**
         * Create a client secret in G1 from a master secret and the client ID
         *
         * @this {MPIN256}
	 * @param S is an input master secret
	 * @param CID is the input client identity
	 * @param CST is the full client secret = s.H(ID)
         * @return O for success or else error code
         */					
        GET_CLIENT_SECRET: function(S, CID, CST) {
            return this.GET_G1_MULTIPLE(null, 1, S, CID, CST);
        },

	/**
         * Create a Time Permit in G1 from a master secret and the client ID
         *
         * @this {MPIN256}
  	 * @param sha is the hash type
	 * @param date is input date, in days since the epoch.
	 * @param S is an input master secret
	 * @param CID is the input client identity
	 * @param CTT is a Time Permit for the given date = s.H(d|H(ID))
         * @return O for success or else error code
         */					
        GET_CLIENT_PERMIT: function(sha, date, S, CID, CTT) {
            var h = this.hashit(sha, date, CID),
                P = ctx.ECP.mapit(h),
                s = ctx.BIG.fromBytes(S);

            P = ctx.PAIR256.G1mul(P, s);
            P.toBytes(CTT,false);

            return 0;
        },

	/**
         * Perform first pass of the client side of the 3-pass version of the M-Pin protocol
         *
         * @this {MPIN256}
 	 * @param sha is the hash type
	 * @param date is input date, in days since the epoch. Set to 0 if Time permits disabled
	 * @param CLIENT_ID is the input client identity
	 * @param rng is a pointer to a cryptographically secure random number generator
	 * @param X an output internally randomly generated if R!=NULL, otherwise must be provided as an input
	 * @param pin is the input PIN number
	 * @param TOKEN is the input M-Pin token (the client secret with PIN portion removed)
	 * @param SEC is output = CS+TP, where CS=is the reconstructed client secret, and TP is the time permit
	 * @param xID is output = x.H(ID)
	 * @param xCID is output = x.(H(ID)+H(d|H(ID)))
	 * @param PERMIT is the input time permit
         * @return O for success or else error code
         */					
        CLIENT_1: function(sha, date, CLIENT_ID, rng, X, pin, TOKEN, SEC, xID, xCID, PERMIT) {
            var r = new ctx.BIG(0),
                x, P, T, W, h;

            r.rcopy(ctx.ROM_CURVE.CURVE_Order);

            if (rng !== null) {
                x = ctx.BIG.randomnum(r, rng);
                x.toBytes(X);
            } else {
                x = ctx.BIG.fromBytes(X);
            }

            h = this.hashit(sha, 0, CLIENT_ID);
            P = ctx.ECP.mapit(h);
            T = ctx.ECP.fromBytes(TOKEN);
            if (T.is_infinity()) {
                return this.INVALID_POINT;
            }

            pin %= this.MAXPIN;
            W = P.pinmul(pin, this.PBLEN);
            T.add(W);

            if (date != 0) {
                W = ctx.ECP.fromBytes(PERMIT);

                if (W.is_infinity()) {
                    return this.INVALID_POINT;
                }

                T.add(W);
                h = this.hashit(sha, date, h);
                W = ctx.ECP.mapit(h);

                if (xID != null) {
                    P = ctx.PAIR256.G1mul(P, x);
                    P.toBytes(xID,false);
                    W = ctx.PAIR256.G1mul(W, x);
                    P.add(W);
                } else {
                    P.add(W);
                    P = ctx.PAIR256.G1mul(P, x);
                }

                if (xCID != null) {
                    P.toBytes(xCID,false);
                }
            } else {
                if (xID != null) {
                    P = ctx.PAIR256.G1mul(P, x);
                    P.toBytes(xID,false);
                }
            }

            T.toBytes(SEC,false);

            return 0;
        },

	/**
         * Perform second pass of the client side of the 3-pass version of the M-Pin protocol
         *
         * @this {MPIN256}
	 * @param X an input, a locally generated random number
	 * @param Y an input random challenge from the server
	 * @param SEC on output = -(x+y).V
         * @return O for success or else error code
         */					
        CLIENT_2: function(X, Y, SEC) {
            var r = new ctx.BIG(0),
                P, px, py;

            r.rcopy(ctx.ROM_CURVE.CURVE_Order);

            P = ctx.ECP.fromBytes(SEC);
            if (P.is_infinity()) {
                return this.INVALID_POINT;
            }

            px = ctx.BIG.fromBytes(X);
            py = ctx.BIG.fromBytes(Y);
            px.add(py);
            px.mod(r);

            P = ctx.PAIR256.G1mul(P, px);
            P.neg();
            P.toBytes(SEC,false);
 
            return 0;
        },

	/**
         * Perform first pass of the server side of the 3-pass version of the M-Pin protocol
         *
         * @this {MPIN256}
 	 * @param sha is the hash type
	 * @param date is input date, in days since the epoch. Set to 0 if Time permits disabled
	 * @param CID is the input claimed client identity
	 * @param HID is output H(ID), a hash of the client ID
	 * @param HTID is output H(ID)+H(d|H(ID))
         * @return O for success or else error code
         */
        SERVER_1: function(sha, date, CID, HID, HTID) {
            var h = this.hashit(sha, 0, CID),
                P = ctx.ECP.mapit(h),
                R;

            P.toBytes(HID,false);
            if (date !== 0) {
                h = this.hashit(sha, date, h);
                R = ctx.ECP.mapit(h);
                P.add(R);
                P.toBytes(HTID,false);
            }
        },

	/**
         * Perform third pass on the server side of the 3-pass version of the M-Pin protocol
         *
         * @this {MPIN256}
	 * @param date is input date, in days since the epoch. Set to 0 if Time permits disabled
	 * @param HID is input H(ID), a hash of the client ID
	 * @param HTID is input H(ID)+H(d|H(ID))
	 * @param Y is the input server's randomly generated challenge
	 * @param SST is the input server secret
	 * @param xID is input from the client = x.H(ID)
	 * @param xCID is input from the client= x.(H(ID)+H(d|H(ID)))
	 * @param mSEC is an input from the client
	 * @param E is an output to help the Kangaroos to find the PIN error, or NULL if not required
	 * @param F is an output to help the Kangaroos to find the PIN error, or NULL if not required
	 * @param Pa is the input public key from the client, z.Q or NULL if the client uses regular mpin
         * @return O for success or else error code
         */
        SERVER_2: function(date, HID, HTID, Y, SST, xID, xCID, mSEC, E, F, Pa) {
            var Q, sQ, R, y, P, g;

            if (typeof Pa === "undefined" || Pa == null) {
                Q = ctx.ECP8.generator();

            } else {
                Q = ctx.ECP8.fromBytes(Pa);
                if (Q.is_infinity()) {
                    return this.INVALID_POINT;
                }
            }

            sQ = ctx.ECP8.fromBytes(SST);
            if (sQ.is_infinity()) {
                return this.INVALID_POINT;
            }

            if (date !== 0) {
                R = ctx.ECP.fromBytes(xCID);
            } else {
                if (xID == null) {
                    return this.BAD_PARAMS;
                }
                R = ctx.ECP.fromBytes(xID);
            }

            if (R.is_infinity()) {
                return this.INVALID_POINT;
            }

            y = ctx.BIG.fromBytes(Y);

            if (date != 0) {
                P = ctx.ECP.fromBytes(HTID);
            } else {
                if (HID == null) {
                    return this.BAD_PARAMS;
                }
                P = ctx.ECP.fromBytes(HID);
            }

            if (P.is_infinity()) {
                return this.INVALID_POINT;
            }

            P = ctx.PAIR256.G1mul(P, y);
            P.add(R);
            R = ctx.ECP.fromBytes(mSEC);
            if (R.is_infinity()) {
                return this.INVALID_POINT;
            }

            g = ctx.PAIR256.ate2(Q, R, sQ, P);
            g = ctx.PAIR256.fexp(g);

            if (!g.isunity()) {
                if (HID != null && xID != null && E != null && F != null) {
                    g.toBytes(E);

                    if (date !== 0) {
                        P = ctx.ECP.fromBytes(HID);
                        if (P.is_infinity()) {
                            return this.INVALID_POINT;
                        }

                        R = ctx.ECP.fromBytes(xID);
                        if (R.is_infinity()) {
                            return this.INVALID_POINT;
                        }

                        P = ctx.PAIR256.G1mul(P, y);
                        P.add(R);
                    }
                    g = ctx.PAIR256.ate(Q, P);
                    g = ctx.PAIR256.fexp(g);

                    g.toBytes(F);
                }

                return this.BAD_PIN;
            }

            return 0;
        },

	/**
         * Use Kangaroos to find PIN error
         *
         * @this {MPIN256}
	 * @param E a member of the group GT
	 * @param F a member of the group GT =  E^e
	 * @return 0 if Kangaroos failed, or the PIN error e
         */
        KANGAROO: function(E, F) {
            var ge = ctx.FP48.fromBytes(E),
                gf = ctx.FP48.fromBytes(F),
                distance = [],
                t = new ctx.FP48(gf),
                table = [],
                i, j, m, s, dn, dm, res, steps;

            s = 1;
            for (m = 0; m < this.TS; m++) {
                distance[m] = s;
                table[m] = new ctx.FP48(t);
                s *= 2;
                t.usqr();
            }
            t.one();
            dn = 0;
            for (j = 0; j < this.TRAP; j++) {
                i = t.geta().geta().geta().geta().getA().lastbits(20) % this.TS;
                t.mul(table[i]);
                dn += distance[i];
            }
            gf.copy(t);
            gf.conj();
            steps = 0;
            dm = 0;
            res = 0;
            while (dm - dn < this.MAXPIN) {
                steps++;
                if (steps > 4 * this.TRAP) {
                    break;
                }
                i = ge.geta().geta().geta().geta().getA().lastbits(20) % this.TS;
                ge.mul(table[i]);
                dm += distance[i];
                if (ge.equals(t)) {
                    res = dm - dn;
                    break;
                }
                if (ge.equals(gf)) {
                    res = dn - dm;
                    break;
                }

            }
            if (steps > 4 * this.TRAP || dm - dn >= this.MAXPIN) {
                res = 0;
            } // Trap Failed  - probable invalid token

            return res;
        },

	/**
         * Time since epoch 
         *
         * @this {MPIN256}
	 * @return time since epoch 
         */
        GET_TIME: function() {
            var now = new Date();
            return Math.floor(now.getTime() / (1000));
        },

        /* y = H(time,xCID) */
        GET_Y: function(sha, TimeValue, xCID, Y) {
            var q = new ctx.BIG(0),
                h = this.hashit(sha, TimeValue, xCID),
                y = ctx.BIG.fromBytes(h);

            q.rcopy(ctx.ROM_CURVE.CURVE_Order);

            y.mod(q);
            y.toBytes(Y);

            return 0;
        },

	/**
         * Perform client side of the one-pass version of the M-Pin protocol
         *
         * @this {MPIN256}
 	 * @param sha is the hash type
	 * @param date is input date, in days since the epoch. Set to 0 if Time permits disabled
	 * @param CLIENT_ID is the input client identity
	 * @param rng is a pointer to a cryptographically secure random number generator
	 * @param X an output internally randomly generated if R!=NULL, otherwise must be provided as an input
	 * @param pin is the input PIN number
	 * @param TOKEN is the input M-Pin token (the client secret with PIN portion removed)
	 * @param SEC is output = -(x+y)(CS+TP), where CS is the reconstructed client secret, and TP is the time permit
	 * @param xID is output = x.H(ID)
	 * @param xCID is output = x.(H(ID)+H(d|H(ID)))
	 * @param PERMIT is the input time permit
	 * @param TimeValue is input epoch time in seconds - a timestamp
	 * @param Y is output H(t|U) or H(t|UT) if Time Permits enabled
	 * @param Message is the message to be signed
         * @return O for success or else error code
         */
        CLIENT: function(sha, date, CLIENT_ID, rng, X, pin, TOKEN, SEC, xID, xCID, PERMIT, TimeValue, Y, Message) {
            var rtn = 0,
                M = [],
                pID, i;

            if (date == 0) {
                pID = xID;
            } else {
                pID = xCID;
                xID = null;
            }

            rtn = this.CLIENT_1(sha, date, CLIENT_ID, rng, X, pin, TOKEN, SEC, xID, xCID, PERMIT);
            if (rtn != 0) {
                return rtn;
            }

            M = pID.slice();

            if (typeof Message !== "undefined" || Message != null) {
                for (i = 0; i < Message.length; i++) {
                    M.push(Message[i]);
                }
            }

            this.GET_Y(sha, TimeValue, M, Y);

            rtn = this.CLIENT_2(X, Y, SEC);
            if (rtn != 0) {
                return rtn;
            }

            return 0;
        },

	/**
         * Perform server side of the one-pass version of the M-Pin protocol
         *
         * @this {MPIN256}
 	 * @param sha is the hash type
	 * @param date is input date, in days since the epoch. Set to 0 if Time permits disabled
	 * @param HID is output H(ID), a hash of the client ID
	 * @param HTID is output H(ID)+H(d|H(ID))
	 * @param Y is output H(t|U) or H(t|UT) if Time Permits enabled
	 * @param SST is the input server secret
	 * @param xID is input from the client = x.H(ID)
	 * @param xCID is input from the client= x.(H(ID)+H(d|H(ID)))
	 * @param mSEC is an input from the client
	 * @param E is an output to help the Kangaroos to find the PIN error, or NULL if not required
	 * @param F is an output to help the Kangaroos to find the PIN error, or NULL if not required
	 * @param CID is the input claimed client identity
	 * @param TimeValue is input epoch time in seconds - a timestamp
	 * @param MESSAGE is the message to be signed
	 * @param Pa is input from the client z.Q or NULL if the key-escrow less scheme is not used
         * @return O for success or else error code
         */
        SERVER: function(sha, date, HID, HTID, Y, SST, xID, xCID, mSEC, E, F, CID, TimeValue, Message, Pa) {
            var rtn = 0,
                M = [],
                pID, i;

            if (date == 0) {
                pID = xID;
            } else {
                pID = xCID;
            }

            this.SERVER_1(sha, date, CID, HID, HTID);

            M = pID.slice();

            if (typeof Message !== "undefined" || Message != null) {
                for (i = 0; i < Message.length; i++) {
                    M.push(Message[i]);
                }
            }

            this.GET_Y(sha, TimeValue, M, Y);

            rtn = this.SERVER_2(date, HID, HTID, Y, SST, xID, xCID, mSEC, E, F, Pa);
            if (rtn != 0) {
                return rtn;
            }

            return 0;
        },

	/**
         * Precompute values for use by the client side of M-Pin Full
         *
         * @this {MPIN256}
	 * @param TOKEN is the input M-Pin token (the client secret with PIN portion removed)
	 * @param CID is the input client identity
	 * @param G1 precomputed output
	 * @param G2 precomputed output
         * @return O for success or else error code
         */
        PRECOMPUTE: function(TOKEN, CID, G1, G2) {
            var P, T, g, Q;

            T = ctx.ECP.fromBytes(TOKEN);
            if (T.is_infinity()) {
                return this.INVALID_POINT;
            }

            P = ctx.ECP.mapit(CID);
            Q = ctx.ECP8.generator();

            g = ctx.PAIR256.ate(Q, T);
            g = ctx.PAIR256.fexp(g);
            g.toBytes(G1);

            g = ctx.PAIR256.ate(Q, P);
            g = ctx.PAIR256.fexp(g);
            g.toBytes(G2);

            return 0;
        },

	/**
         * Hash the session transcript
         *
         * @this {MPIN256}
 	 * @param sha is the hash type
	 * @param HID is the hashed input client ID = H(ID)
	 * @param xID is the client output = x.H(ID)
	 * @param xCID is the client output = x.(H(ID)+H(T|H(ID)))
	 * @param SEC is the client part response
	 * @param Y is the server challenge
	 * @param R is the client part response
	 * @param W is the server part response
	 * @return H the output is the hash of all of the above that apply
         */
        HASH_ALL: function(sha, HID, xID, xCID, SEC, Y, R, W) {
            var tlen = 0,
                T = [],
                i;

            for (i = 0; i < HID.length; i++) {
                T[i] = HID[i];
            }
            tlen += HID.length;

            if (xCID != null) {
                for (i = 0; i < xCID.length; i++) {
                    T[i + tlen] = xCID[i];
                }
                tlen += xCID.length;
            } else {
                for (i = 0; i < xID.length; i++) {
                    T[i + tlen] = xID[i];
                }
                tlen += xID.length;
            }

            for (i = 0; i < SEC.length; i++) {
                T[i + tlen] = SEC[i];
            }
            tlen += SEC.length;

            for (i = 0; i < Y.length; i++) {
                T[i + tlen] = Y[i];
            }
            tlen += Y.length;

            for (i = 0; i < R.length; i++) {
                T[i + tlen] = R[i];
            }
            tlen += R.length;

            for (i = 0; i < W.length; i++) {
                T[i + tlen] = W[i];
            }
            tlen += W.length;

            return this.hashit(sha, 0, T);
        },

	/**
         * Calculate Key on Client side for M-Pin Full
         *
         * @this {MPIN256}
  	 * @param sha is the hash type
	 * @param G1 precomputed input
	 * @param G2 precomputed input
	 * @param pin is the input PIN number
	 * @param R is an input, a locally generated random number
	 * @param X is an input, a locally generated random number
	 * @param H is an input, hash of the protocol transcript
	 * @param wCID is the input Server-side Diffie-Hellman component
	 * @param CK is the output calculated shared key
	 * @return 0 or an error code
         */
        CLIENT_KEY: function(sha, G1, G2, pin, R, X, H, wCID, CK) {
            var t = [],
                g1 = ctx.FP48.fromBytes(G1),
                g2 = ctx.FP48.fromBytes(G2),
                z = ctx.BIG.fromBytes(R),
                x = ctx.BIG.fromBytes(X),
                h = ctx.BIG.fromBytes(H),
                W = ctx.ECP.fromBytes(wCID),
                r, c, i;

            if (W.is_infinity()) {
                return this.INVALID_POINT;
            }

            W = ctx.PAIR256.G1mul(W, x);

            r = new ctx.BIG(0);
            r.rcopy(ctx.ROM_CURVE.CURVE_Order);
            z.add(h);
            z.mod(r);

            g2.pinpow(pin, this.PBLEN);
            g1.mul(g2);

            c = g1.compow(z, r);

            t = this.mpin_hash(sha, c, W);

            for (i = 0; i < ctx.ECP.AESKEY; i++) {
                CK[i] = t[i];
            }

            return 0;
        },

	/**
         * Calculate Key on Server side for M-Pin Full
         *
         * @this {MPIN256}
 	 * @param h is the hash type
	 * @param Z is the input Client-side Diffie-Hellman component
	 * @param SST is the input server secret
	 * @param W is an input random number generated by the server
	 * @param H is an input, hash of the protocol transcript
	 * @param HID is the hashed input client ID = H(ID)
	 * @param xID is input from the client = x.H(ID)
	 * @param xCID is input from the client= x.(H(ID)+H(d|H(ID)))
	 * @param SK is the output calculated shared key
	 * @return 0 or an error code
         */
        SERVER_KEY: function(sha, Z, SST, W, H, HID, xID, xCID, SK) {
            var t = [],
                sQ, R, A, U, w, h, g, c, i;

            sQ = ctx.ECP8.fromBytes(SST);
            if (sQ.is_infinity()) {
                return this.INVALID_POINT;
            }

            R = ctx.ECP.fromBytes(Z);
            if (R.is_infinity()) {
                return this.INVALID_POINT;
            }

            A = ctx.ECP.fromBytes(HID);
            if (A.is_infinity()) {
                return this.INVALID_POINT;
            }

            if (xCID != null) {
                U = ctx.ECP.fromBytes(xCID);
            } else {
                U = ctx.ECP.fromBytes(xID);
            }

            if (U.is_infinity()) {
                return this.INVALID_POINT;
            }

            w = ctx.BIG.fromBytes(W);
            h = ctx.BIG.fromBytes(H);
            A = ctx.PAIR256.G1mul(A, h);
            R.add(A);

            U = ctx.PAIR256.G1mul(U, w);
            g = ctx.PAIR256.ate(sQ, R);
            g = ctx.PAIR256.fexp(g);

            c = g.trace();

            t = this.mpin_hash(sha, c, U);

            for (i = 0; i < ctx.ECP.AESKEY; i++) {
                SK[i] = t[i];
            }

            return 0;
        },

	/**
         * Generates a random public key for the client z.Q
         *
         * @this {MPIN256}
         * @param rng cryptographically secure random number generator
	 * @param Z an output internally randomly generated if R!=NULL, otherwise it must be provided as an input
	 * @param Pa the output public key for the client
	 * @return 0 or an error code
         */	
        GET_DVS_KEYPAIR: function(rng, Z, Pa) {
            var r = new ctx.BIG(0),
                z, Q;

            r.rcopy(ctx.ROM_CURVE.CURVE_Order);

            if (rng != null) {
                z = ctx.BIG.randomnum(r, rng);
                z.toBytes(Z);
            } else {
                z = ctx.BIG.fromBytes(Z);
            }
            z.invmodp(r);

            Q = ctx.ECP8.generator();

            Q = ctx.PAIR256.G2mul(Q, z);
            Q.toBytes(Pa);

            return 0;
        }
    };

    return MPIN256;
};

if (typeof module !== "undefined" && typeof module.exports !== "undefined") {
    module.exports = {
        MPIN256: MPIN256
    };
}