/*
	Licensed to the Apache Software Foundation (ASF) under one
	or more contributor license agreements.  See the NOTICE file
	distributed with this work for additional information
	regarding copyright ownership.  The ASF licenses this file
	to you under the Apache License, Version 2.0 (the
	"License"); you may not use this file except in compliance
	with the License.  You may obtain a copy of the License at
	
	http://www.apache.org/licenses/LICENSE-2.0

	Unless required by applicable law or agreed to in writing,
	software distributed under the License is distributed on an
	"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
	KIND, either express or implied.  See the License for the
	specific language governing permissions and limitations
	under the License.
*/

//
//  mpin256.swift
//
//  Created by Michael Scott on 08/07/2015.
//  Copyright (c) 2015 Michael Scott. All rights reserved.
//

import Foundation
import amcl

public struct MPIN256
{
    static public let EFS=Int(CONFIG_BIG.MODBYTES)
    static public let EGS=Int(CONFIG_BIG.MODBYTES)
    static let INVALID_POINT:Int = -14
    static let BAD_PARAMS:Int = -11
    static let WRONG_ORDER:Int = -18
    static public let BAD_PIN:Int = -19
    static public let SHA256=32
    static public let SHA384=48
    static public let SHA512=64
    
    /* Configure your PIN here */
    
    static let MAXPIN:Int32 = 10000  // PIN less than this
    static let PBLEN:Int32 = 14      // Number of bits in PIN
    static let TS:Int = 10         // 10 for 4 digit PIN, 14 for 6-digit PIN - 2^TS/TS approx = sqrt(MAXPIN)
    static let TRAP:Int = 200      // 200 for 4 digit PIN, 2000 for 6-digit PIN  - approx 2*sqrt(MAXPIN)
   
    private static func mpin_hash(_ sha:Int,_ c: FP16,_ U: ECP) -> [UInt8]
    {
        var w=[UInt8](repeating: 0,count: EFS)
        var t=[UInt8](repeating: 0,count: 18*EFS)
        var h=[UInt8]()
        
        c.geta().geta().geta().getA().toBytes(&w); for i in 0 ..< EFS {t[i]=w[i]}
        c.geta().geta().geta().getB().toBytes(&w); for i in EFS ..< 2*EFS {t[i]=w[i-EFS]}
        c.geta().geta().getb().getA().toBytes(&w); for i in 2*EFS ..< 3*EFS {t[i]=w[i-2*EFS]}
        c.geta().geta().getb().getB().toBytes(&w); for i in 3*EFS ..< 4*EFS {t[i]=w[i-3*EFS]}

        c.geta().getb().geta().getA().toBytes(&w); for i in 4*EFS ..< 5*EFS {t[i]=w[i-4*EFS]}
        c.geta().getb().geta().getB().toBytes(&w); for i in 5*EFS ..< 6*EFS {t[i]=w[i-5*EFS]}
        c.geta().getb().getb().getA().toBytes(&w); for i in 6*EFS ..< 7*EFS {t[i]=w[i-6*EFS]}
        c.geta().getb().getb().getB().toBytes(&w); for i in 7*EFS ..< 8*EFS {t[i]=w[i-7*EFS]}

        c.getb().geta().geta().getA().toBytes(&w); for i in 8*EFS ..< 9*EFS {t[i]=w[i-8*EFS]}
        c.getb().geta().geta().getB().toBytes(&w); for i in 9*EFS ..< 10*EFS {t[i]=w[i-9*EFS]}
        c.getb().geta().getb().getA().toBytes(&w); for i in 10*EFS ..< 11*EFS {t[i]=w[i-10*EFS]}
        c.getb().geta().getb().getB().toBytes(&w); for i in 11*EFS ..< 12*EFS {t[i]=w[i-11*EFS]}

        c.getb().getb().geta().getA().toBytes(&w); for i in 12*EFS ..< 13*EFS {t[i]=w[i-12*EFS]}
        c.getb().getb().geta().getB().toBytes(&w); for i in 13*EFS ..< 14*EFS {t[i]=w[i-13*EFS]}
        c.getb().getb().getb().getA().toBytes(&w); for i in 14*EFS ..< 15*EFS {t[i]=w[i-14*EFS]}
        c.getb().getb().getb().getB().toBytes(&w); for i in 15*EFS ..< 16*EFS {t[i]=w[i-15*EFS]}


        U.getX().toBytes(&w); for i in 16*EFS ..< 17*EFS {t[i]=w[i-16*EFS]}
        U.getY().toBytes(&w); for i in 17*EFS ..< 18*EFS {t[i]=w[i-17*EFS]}
        
        if sha==SHA256
        {
            var H=HASH256()
            H.process_array(t)
            h=H.hash()
        }
        if sha==SHA384
        {
            var H=HASH384()
            H.process_array(t)
            h=H.hash()
        }
        if sha==SHA512
        {
            var H=HASH512()
            H.process_array(t)
            h=H.hash()
        }
        if h.isEmpty {return h}
        var R=[UInt8](repeating: 0,count: CONFIG_CURVE.AESKEY)
        for i in 0 ..< CONFIG_CURVE.AESKEY {R[i]=h[i]}
        return R
    }
    
    // Hash number (optional) and string to point on curve
    
    private static func hashit(_ sha:Int,_ n:Int32,_ ID:[UInt8]) -> [UInt8]
    {
        var R=[UInt8]()
        if sha==SHA256
        {
            var H=HASH256()
            if n != 0 {H.process_num(n)}
            H.process_array(ID)
            R=H.hash()
        }
        if sha==SHA384
        {
            var H=HASH384()
            if n != 0 {H.process_num(n)}
            H.process_array(ID)
            R=H.hash()
        }
        if sha==SHA512
        {
            var H=HASH512()
            if n != 0 {H.process_num(n)}
            H.process_array(ID)
            R=H.hash()
        }
        if R.isEmpty {return R}
        let RM=Int(CONFIG_BIG.MODBYTES)
        var W=[UInt8](repeating: 0,count: RM)
        if sha >= RM
        {
            for i in 0 ..< RM {W[i]=R[i]}
        }
        else
        {
            for i in 0 ..< sha {W[i+RM-sha]=R[i]}
        }
        return W
    }
    
    
    // return time in slots since epoch
    static public func today() -> Int32
    {
        let date=Date()
        return (Int32(date.timeIntervalSince1970/(60*1440)))
    }

    // these next two functions help to implement elligator squared - http://eprint.iacr.org/2014/043
    // maps a random u to a point on the curve
    static func map(_ u:BIG,_ cb:Int) -> ECP
    {
        var x=BIG(u)
        let p=BIG(ROM.Modulus)
        x.mod(p)
        var P=ECP(x,cb)
        while (true)
        {
            if !P.is_infinity() {break}
            x.inc(1);  x.norm()
            P=ECP(x,cb)
        }
        return P
    }

    // returns u derived from P. Random value in range 1 to return value should then be added to u
    static func unmap(_ u:inout BIG,_ P:ECP) -> Int
    {
        let s=P.getS()
        var r:Int32=0
        let x=P.getX()
        u.copy(x)
        var R=ECP()
        while (true)
        {
            u.dec(1); u.norm()
            r += 1
            R=ECP(u,s)
            if !R.is_infinity() {break}
        }
        return Int(r)
    }
    
    static public func HASH_ID(_ sha:Int,_ ID:[UInt8]) -> [UInt8]
    {
        return hashit(sha,0,ID)
    }
    
    // these next two functions implement elligator squared - http://eprint.iacr.org/2014/043
    // Elliptic curve point E in format (0x04,x,y} is converted to form {0x0-,u,v}
    // Note that u and v are indistinguisible from random strings
    static public func ENCODING(_ rng: inout RAND,_ E:inout [UInt8]) -> Int
    {
        var T=[UInt8](repeating: 0,count: EFS)
    
        for i in 0 ..< EFS {T[i]=E[i+1]}
        var u=BIG.fromBytes(T);
        for i in 0 ..< EFS {T[i]=E[i+EFS+1]}
        var v=BIG.fromBytes(T)
    
        var P=ECP(u,v);
        if P.is_infinity() {return INVALID_POINT}
    
        let p=BIG(ROM.Modulus)
        u=BIG.randomnum(p,&rng)
    
        var su=rng.getByte();
        su%=2
    
        let W=MPIN256.map(u,Int(su))
        P.sub(W);
        let sv=P.getS();
        let rn=MPIN256.unmap(&v,P)
        let m=rng.getByte();
        let incr=1+Int(m)%rn
        v.inc(incr)
        E[0]=(su+UInt8(2*sv))
        u.toBytes(&T)
        for i in 0 ..< EFS {E[i+1]=T[i]}
        v.toBytes(&T)
        for i in 0 ..< EFS {E[i+EFS+1]=T[i]}
    
        return 0;
    }

    static public func DECODING(_ D:inout [UInt8]) -> Int
    {
        var T=[UInt8](repeating: 0,count: EFS)
    
        if (D[0]&0x04) != 0 {return INVALID_POINT}
    
        for i in 0 ..< EFS {T[i]=D[i+1]}
        var u=BIG.fromBytes(T)
        for i in 0 ..< EFS {T[i]=D[i+EFS+1]}
        var v=BIG.fromBytes(T)
    
        let su=D[0]&1
        let sv=(D[0]>>1)&1
        let W=map(u,Int(su))
        var P=map(v,Int(sv))
        P.add(W)
        u=P.getX()
        v=P.getY()
        D[0]=0x04
        u.toBytes(&T);
        for i in 0 ..< EFS {D[i+1]=T[i]}
        v.toBytes(&T)
        for i in 0 ..< EFS {D[i+EFS+1]=T[i]}
    
        return 0
    }
    // R=R1+R2 in group G1
    static public func RECOMBINE_G1(_ R1:[UInt8],_ R2:[UInt8],_ R:inout [UInt8]) -> Int
    {
        var P=ECP.fromBytes(R1)
        let Q=ECP.fromBytes(R2)
    
        if P.is_infinity() || Q.is_infinity() {return INVALID_POINT}
    
        P.add(Q)
    
        P.toBytes(&R,false)
        return 0;
    }
    // W=W1+W2 in group G2
    static public func RECOMBINE_G2(_ W1:[UInt8],_ W2:[UInt8],_  W:inout [UInt8]) -> Int
    {
        var P=ECP8.fromBytes(W1)
        let Q=ECP8.fromBytes(W2)
    
        if P.is_infinity() || Q.is_infinity() {return INVALID_POINT}
    
        P.add(Q)
        
        P.toBytes(&W)
        return 0
    }
    // create random secret S
    static public func RANDOM_GENERATE(_ rng: inout RAND,_ S:inout [UInt8]) -> Int
    {
        let r=BIG(ROM.CURVE_Order)
        let s=BIG.randomnum(r,&rng)
        s.toBytes(&S);
        return 0;
    }

    // Extract PIN from TOKEN for identity CID
    static public func EXTRACT_PIN(_ sha:Int,_ CID:[UInt8],_ pin:Int32,_ TOKEN:inout [UInt8]) -> Int
    {
        return MPIN256.EXTRACT_FACTOR(sha,CID,pin%MAXPIN,PBLEN,&TOKEN)
    }

    // Extract factor from TOKEN for identity CID
    static public func EXTRACT_FACTOR(_ sha:Int,_ CID:[UInt8],_ factor:Int32,_ facbits:Int32,_ TOKEN:inout [UInt8]) -> Int
    {
        var P=ECP.fromBytes(TOKEN)
        if P.is_infinity() {return INVALID_POINT}
        let h=MPIN256.hashit(sha,0,CID)
        var R=ECP.mapit(h)

        R=R.pinmul(factor,facbits)
        P.sub(R)
    
        P.toBytes(&TOKEN,false)
    
        return 0
    }    

    // ERestore factor to TOKEN for identity CID
    static public func RESTORE_FACTOR(_ sha:Int,_ CID:[UInt8],_ factor:Int32,_ facbits:Int32,_ TOKEN:inout [UInt8]) -> Int
    {
        var P=ECP.fromBytes(TOKEN)
        if P.is_infinity() {return INVALID_POINT}
        let h=MPIN256.hashit(sha,0,CID)
        var R=ECP.mapit(h)

        R=R.pinmul(factor,facbits)
        P.add(R)
    
        P.toBytes(&TOKEN,false)
    
        return 0
    }    

    // Implement step 2 on client side of MPin protocol
    static public func CLIENT_2(_ X:[UInt8],_ Y:[UInt8],_ SEC:inout [UInt8]) -> Int
    {
        let r=BIG(ROM.CURVE_Order)
        var P=ECP.fromBytes(SEC)
        if P.is_infinity() {return INVALID_POINT}
    
        var px=BIG.fromBytes(X)
        let py=BIG.fromBytes(Y)
        px.add(py)
        px.mod(r)

        P=PAIR256.G1mul(P,px)
        P.neg()
        P.toBytes(&SEC,false);
        return 0
    }
    
    // Implement step 1 on client side of MPin protocol
    static public func CLIENT_1(_ sha:Int,_ date:Int32,_ CLIENT_ID:[UInt8],_ rng: inout RAND?,_ X:inout [UInt8],_ pin:Int32,_ TOKEN:[UInt8],_ SEC:inout [UInt8],_ xID:inout [UInt8]?,_ xCID:inout [UInt8]?,_ PERMIT:[UInt8]?) -> Int
    {
        let r=BIG(ROM.CURVE_Order)
        var x:BIG
        if rng != nil
        {
            x=BIG.randomnum(r,&rng!)
            x.toBytes(&X);
        }
        else
        {
            x=BIG.fromBytes(X);
        }

        var h=MPIN256.hashit(sha,0,CLIENT_ID)
        var P=ECP.mapit(h);
    
        var T=ECP.fromBytes(TOKEN);
        if T.is_infinity() {return INVALID_POINT}
    
        var W=P.pinmul(pin%MPIN256.MAXPIN,MPIN256.PBLEN)
        T.add(W)
        if date != 0
        {
            W=ECP.fromBytes(PERMIT!)
            if W.is_infinity() {return INVALID_POINT}
            T.add(W);
            h=MPIN256.hashit(sha,date,h)
            W=ECP.mapit(h);
            if xID != nil
            {
                P=PAIR256.G1mul(P,x)
                P.toBytes(&xID!,false)
                W=PAIR256.G1mul(W,x)
                P.add(W)
            }
            else
            {
                P.add(W);
                P=PAIR256.G1mul(P,x);
            }
            if xCID != nil {P.toBytes(&xCID!,false)}
        }
        else
        {
            if xID != nil
            {
                P=PAIR256.G1mul(P,x)
                P.toBytes(&xID!,false)
            }
        }
    
    
        T.toBytes(&SEC,false);
        return 0;
    }
    // Extract Server Secret SST=S*Q where Q is fixed generator in G2 and S is master secret
    static public func GET_SERVER_SECRET(_ S:[UInt8],_ SST:inout [UInt8]) -> Int
    {
        var Q=ECP8.generator();
    
        let s=BIG.fromBytes(S)
        Q=PAIR256.G2mul(Q,s)
        Q.toBytes(&SST)
        return 0
    }
 
    
    //W=x*H(G);
    //if RNG == NULL then X is passed in
    //if RNG != NULL the X is passed out
    //if type=0 W=x*G where G is point on the curve, else W=x*M(G), where M(G) is mapping of octet G to point on the curve
    
    static public func GET_G1_MULTIPLE(_ rng: inout RAND?,_ type:Int,_ X:inout [UInt8],_ G:[UInt8],_ W:inout [UInt8]) -> Int
    {
        var x:BIG
        let r=BIG(ROM.CURVE_Order)
        if rng != nil
        {
            x=BIG.randomnum(r,&rng!)
            x.toBytes(&X)
        }
        else
        {
            x=BIG.fromBytes(X);
        }
        var P:ECP
        if type==0
        {
            P=ECP.fromBytes(G)
            if P.is_infinity() {return INVALID_POINT}
        }
        else
            {P=ECP.mapit(G)}
    
        PAIR256.G1mul(P,x).toBytes(&W,false)
        return 0;
    }
    // Client secret CST=S*H(CID) where CID is client ID and S is master secret
    // CID is hashed externally
    static public func GET_CLIENT_SECRET(_ S:inout [UInt8],_ CID:[UInt8],_ CST:inout [UInt8]) -> Int
    {
        var RNG : RAND? = nil        
        return GET_G1_MULTIPLE(&RNG,1,&S,CID,&CST)
    }
    // Time Permit CTT=S*(date|H(CID)) where S is master secret
    static public func GET_CLIENT_PERMIT(_ sha:Int,_ date:Int32,_ S:[UInt8],_ CID:[UInt8],_ CTT:inout [UInt8]) -> Int
    {
        let h=MPIN256.hashit(sha,date,CID)
        let P=ECP.mapit(h)
    
        let s=BIG.fromBytes(S)
        PAIR256.G1mul(P,s).toBytes(&CTT,false)
        return 0;
    }
  
    // Outputs H(CID) and H(T|H(CID)) for time permits. If no time permits set HID=HTID
    static public func SERVER_1(_ sha:Int,_ date:Int32,_ CID:[UInt8],_ HID:inout [UInt8],_ HTID:inout [UInt8]?)
    {
        var h=MPIN256.hashit(sha,0,CID)
        var P=ECP.mapit(h)

        P.toBytes(&HID,false)
        if date != 0
        {
            h=hashit(sha,date,h)
            let R=ECP.mapit(h)
            P.add(R)
            P.toBytes(&HTID!,false)
        }
    }
    // Implement step 2 of MPin protocol on server side
    static public func SERVER_2(_ date:Int32,_ HID:[UInt8]?,_ HTID:[UInt8]?,_ Y:[UInt8],_ SST:[UInt8],_ xID:[UInt8]?,_ xCID:[UInt8]?,_ mSEC:[UInt8],_ E:inout [UInt8]?,_ F:inout [UInt8]?) -> Int
    { 
        let Q=ECP8.generator();
        let sQ=ECP8.fromBytes(SST)
        if sQ.is_infinity() {return INVALID_POINT}
        var R:ECP
        if date != 0
            {R=ECP.fromBytes(xCID!)}
        else
        {
            if xID==nil {return MPIN256.BAD_PARAMS}
            R=ECP.fromBytes(xID!)
        }
        if R.is_infinity() {return INVALID_POINT}
        let y=BIG.fromBytes(Y)
        var P:ECP
        if date != 0 {P=ECP.fromBytes(HTID!)}
        else
        {
            if HID==nil {return MPIN256.BAD_PARAMS}
            P=ECP.fromBytes(HID!)
        }
    
        if P.is_infinity() {return INVALID_POINT}
    
        P=PAIR256.G1mul(P,y)
        P.add(R); 
        R=ECP.fromBytes(mSEC)
        if R.is_infinity() {return MPIN256.INVALID_POINT}

    
        var g=PAIR256.ate2(Q,R,sQ,P)
        g=PAIR256.fexp(g)
    
        if !g.isunity()
        {
            if HID != nil && xID != nil && E != nil && F != nil
            {
                g.toBytes(&E!)
                if date != 0
                {
                    P=ECP.fromBytes(HID!)
                    if P.is_infinity() {return MPIN256.INVALID_POINT}
                    R=ECP.fromBytes(xID!)
                    if R.is_infinity() {return MPIN256.INVALID_POINT}
    
                    P=PAIR256.G1mul(P,y);
                    P.add(R); 
                }
                g=PAIR256.ate(Q,P);
                g=PAIR256.fexp(g);
                g.toBytes(&F!);
            }
            return MPIN256.BAD_PIN;
        }
    
        return 0
    }
    // Pollards kangaroos used to return PIN error
    static public func KANGAROO(_ E:[UInt8]?,_ F:[UInt8]?) -> Int
    {
        var ge=FP48.fromBytes(E!)
        var gf=FP48.fromBytes(F!)
        var distance=[Int]();
        var t=FP48(gf);
        var table=[FP48]()
        
        var s:Int=1
        for _ in 0 ..< Int(TS)
        {
            distance.append(s)
            table.append(FP48(t))
            s*=2
            t.usqr()
 
        }
        t.one()
        var dn:Int=0
        for _ in 0 ..< TRAP
        {
            var lsbs=BIG(t.geta().geta().geta().geta().getA())
            let i=Int(lsbs.lastbits(8))%TS
            t.mul(table[i])
            dn+=distance[i]
        }
        gf.copy(t); gf.conj()
        var steps=0; var dm:Int=0
        var res=0;
        while (dm-dn<Int(MAXPIN))
        {
            steps += 1;
            if steps>4*TRAP {break}
            var lsbs=BIG(ge.geta().geta().geta().geta().getA())
            let i=Int(lsbs.lastbits(8))%TS
            ge.mul(table[i])
            dm+=distance[i]
            if (ge.equals(t))
            {
                res=dm-dn;
                break;
            }
            if (ge.equals(gf))
            {
                res=dn-dm
                break
            }
    
        }
        if steps>4*TRAP || dm-dn>=Int(MAXPIN) {res=0 }    // Trap Failed  - probable invalid token
        return res
    }
    // Functions to support M-Pin Full
    
    static public func PRECOMPUTE(_ TOKEN:[UInt8],_ CID:[UInt8],_ G1:inout [UInt8],_ G2:inout [UInt8]) -> Int
    {
        let T=ECP.fromBytes(TOKEN);
        if T.is_infinity() {return INVALID_POINT}
    
        let P=ECP.mapit(CID)
    
        let Q=ECP8.generator();
    
        var g=PAIR256.ate(Q,T)
        g=PAIR256.fexp(g)
        g.toBytes(&G1)
    
        g=PAIR256.ate(Q,P)
        g=PAIR256.fexp(g)
        g.toBytes(&G2)
    
        return 0
    }
    
    static public func HASH_ALL(_ sha:Int,_ HID:[UInt8],_ xID:[UInt8]?,_ xCID:[UInt8]?,_ SEC:[UInt8],_ Y:[UInt8],_ R:[UInt8],_ W:[UInt8]  ) -> [UInt8]
    {
        var T=[UInt8](repeating: 0,count: 10*EFS+4)
        var tlen=0

        for i in 0 ..< HID.count  {T[i]=HID[i]}
        tlen+=HID.count
        if xCID != nil {
            for i in 0 ..< xCID!.count  {T[i+tlen]=xCID![i]}
            tlen+=xCID!.count
        } else {
            for i in 0 ..< xID!.count {T[i+tlen]=xID![i]}
            tlen+=xID!.count
        }
        for i in 0 ..< SEC.count {T[i+tlen]=SEC[i]}
        tlen+=SEC.count;
        for i in 0 ..< Y.count {T[i+tlen]=Y[i]}
        tlen+=Y.count;
        for i in 0 ..< R.count {T[i+tlen]=R[i]}
        tlen+=R.count;
        for i in 0 ..< W.count {T[i+tlen]=W[i]}
        tlen+=W.count;

        return hashit(sha,0,T);
    }

    // calculate common key on client side
    // wCID = w.(A+AT)
    static public func CLIENT_KEY(_ sha:Int,_ G1:[UInt8],_ G2:[UInt8],_ pin:Int32,_ R:[UInt8],_ X:[UInt8],_ H:[UInt8],_ wCID:[UInt8],_ CK:inout [UInt8]) -> Int
    {
        var g1=FP48.fromBytes(G1)
        var g2=FP48.fromBytes(G2)
        var z=BIG.fromBytes(R)
        let x=BIG.fromBytes(X)
        let h=BIG.fromBytes(H)
    
        var W=ECP.fromBytes(wCID)
        if W.is_infinity() {return INVALID_POINT}
    
        W=PAIR256.G1mul(W,x)
    
        let r=BIG(ROM.CURVE_Order)
    
        z.add(h)   // new
        z.mod(r)

        g2.pinpow(pin,PBLEN)
        g1.mul(g2)

        let c=g1.compow(z,r)

        let t=mpin_hash(sha,c,W)

        for i in 0 ..< CONFIG_CURVE.AESKEY {CK[i]=t[i]}
    
        return 0
    }
    // calculate common key on server side
    // Z=r.A - no time permits involved
    
    static public func SERVER_KEY(_ sha:Int,_ Z:[UInt8],_ SST:[UInt8],_ W:[UInt8],_ H:[UInt8],_ HID:[UInt8],_ xID:[UInt8],_ xCID:[UInt8]?,_ SK:inout [UInt8]) -> Int
    {
        let sQ=ECP8.fromBytes(SST)
        if sQ.is_infinity() {return INVALID_POINT}
        var R=ECP.fromBytes(Z)
        if R.is_infinity() {return INVALID_POINT}
        var A=ECP.fromBytes(HID)
        if A.is_infinity() {return INVALID_POINT}
    
        var U:ECP
        if xCID != nil
            {U=ECP.fromBytes(xCID!)}
        else
            {U=ECP.fromBytes(xID)}
        
        if U.is_infinity() {return INVALID_POINT}
    
        let w=BIG.fromBytes(W)
        let h=BIG.fromBytes(H)
        A=PAIR256.G1mul(A,h)
        R.add(A); //R.affine()

        U=PAIR256.G1mul(U,w)
        var g=PAIR256.ate(sQ,R)
        g=PAIR256.fexp(g)
    
        let c=g.trace()
        
        let t=mpin_hash(sha,c,U)
 
        for i in 0 ..< CONFIG_CURVE.AESKEY {SK[i]=t[i]}
    
        return 0
    }
    
    // return time since epoch
    static public func GET_TIME() -> Int32
    {
        let date=Date()
        return (Int32(date.timeIntervalSince1970))
    }

    // Generate Y = H(epoch, xCID/xID)
    static public func GET_Y(_ sha:Int,_ TimeValue:Int32,_ xCID:[UInt8],_ Y:inout [UInt8])
    {
        let h = MPIN256.hashit(sha,TimeValue,xCID)
        var y = BIG.fromBytes(h)
        let q=BIG(ROM.CURVE_Order)
        y.mod(q)
        y.toBytes(&Y)
    }
    // One pass MPIN Client
    static public func CLIENT(_ sha:Int,_ date:Int32,_ CLIENT_ID:[UInt8],_ RNG: inout RAND?,_ X:inout [UInt8],_ pin:Int32,_ TOKEN:[UInt8],_  SEC:inout [UInt8],_ xID:inout [UInt8]?,_ xCID:inout [UInt8]?,_ PERMIT:[UInt8]?,_ TimeValue:Int32,_ Y:inout [UInt8]) -> Int
    {
        var rtn=0
  
        rtn = MPIN256.CLIENT_1(sha,date,CLIENT_ID,&RNG,&X,pin,TOKEN,&SEC,&xID,&xCID,PERMIT!)

        if rtn != 0 {return rtn}
    
        if date==0 {MPIN256.GET_Y(sha,TimeValue,xID!,&Y)}
        else {MPIN256.GET_Y(sha,TimeValue,xCID!,&Y)}
    
        rtn = MPIN256.CLIENT_2(X,Y,&SEC)
        if (rtn != 0) {return rtn}
    
        return 0
    }
    // One pass MPIN Server
    static public func SERVER(_ sha:Int,_ date:Int32,_ HID:inout [UInt8],_ HTID:inout [UInt8]?,_ Y:inout [UInt8],_ SST:[UInt8],_ xID:[UInt8]?,_ xCID:[UInt8],_ SEC:[UInt8],_ E:inout [UInt8]?,_ F:inout [UInt8]?,_ CID:[UInt8],_ TimeValue:Int32) -> Int
    {
        var rtn=0
    
        var pID:[UInt8]
        if date == 0
            {pID = xID!}
        else
            {pID = xCID}
    
        SERVER_1(sha,date,CID,&HID,&HTID);
    
        GET_Y(sha,TimeValue,pID,&Y);
    
        rtn = SERVER_2(date,HID,HTID!,Y,SST,xID,xCID,SEC,&E,&F);
        if rtn != 0 {return rtn}
    
        return 0
    }
   
}