val tls_tagLen: h:tls_alg{h<>NULL} -> Tot UInt32.t
let tls_tagLen = function
  | Hash a  -> Hacl.Hash.Definitions.hash_len a
  | MD5SHA1 -> Hacl.Hash.Definitions.hash_len MD5 `FStar.UInt32.add` Hacl.Hash.Definitions.hash_len SHA1
val tls_tagLen: h:tls_alg{h<>NULL} -> Tot UInt32.t
let tls_tagLen =
function
| Hash a -> Hacl.Hash.Definitions.hash_len a
| MD5SHA1 ->
  (Hacl.Hash.Definitions.hash_len MD5) `FStar.UInt32.add` (Hacl.Hash.Definitions.hash_len SHA1)
Hashing.Spec.fst.checked
Spec.Hash.Definitions.fst.checked Spec.Agile.HMAC.fsti.checked prims.fst.checked Hacl.Hash.Definitions.fst.checked FStar.UInt8.fsti.checked FStar.UInt32.fsti.checked FStar.Seq.fst.checked FStar.Pervasives.fsti.checked FStar.Bytes.fsti.checked EverCrypt.HMAC.fsti.checked EverCrypt.Hash.fsti.checked Declassify.fsti.checked
Hashing.Spec.fst
Hashing.Spec.tls_alg Prims.b2t Prims.op_disEquality Hashing.Spec.NULL Hashing.Spec.alg Hacl.Hash.Definitions.hash_len FStar.UInt32.add Spec.Hash.Definitions.MD5 Spec.Hash.Definitions.SHA1 FStar.UInt32.t
﻿(** hash algorithms and providers

 * provides bytes-friendly API before idealization
 * no dependency on TLS: could go to EverCrypt or SecureAPI.

*)
module Hashing.Spec

include EverCrypt.Hash
include Spec.Hash.Definitions

open FStar.Bytes

open Declassify

#set-options "--max_fuel 0 --max_ifuel 0 --z3rlimit 10"

let alg = a:alg { is_md a }

let hash_len (a:alg)
  : n:UInt32.t{UInt32.v n == hash_length a}
  = Hacl.Hash.Definitions.hash_len a

type tag (a:alg) = Bytes.lbytes (hash_length a)

let max_hash_length = 64
let max_hash_len = 64ul
type anyTag = lbytes max_hash_length

let max_block_length = 128
let max_block_len = 128ul

private let lemma_tagLen (a:alg)
  : Lemma (hash_length a <= max_hash_length)
  [SMTPat (hash_length a)]
  = ()

private let lemma_blockLength (a:alg)
  : Lemma (block_length a <= max_block_length)
  [SMTPat (block_length a)]
  = ()

let macable a = b:bytes {length b + block_length a < pow2 32}
// 32-bit implementation restriction

// Adapting EverCrypt's HMAC specification to TLS. In contrast with
// RFC 2104 (which take any key length), in TLS, the HMAC key has the
// same length as the hash [TLS1.3, 4.4.3]

type hkey (a:alg) = b:bytes{
  // 18-09-12 this usage restriction is dubious, but always met in
  // miTLS; it avoids a null-pointer case in the wrapper below.
  length b > 0 /\
  Spec.Agile.HMAC.keysized a (length b)}

val hmac:
  a:alg ->
  k:hkey a ->
  text:macable a ->
  GTot (t:tag a{
    let text = Bytes.reveal text in
    (Seq.length text + block_length a) `less_than_max_input_length` a /\
    Bytes.reveal t = Spec.Agile.HMAC.hmac a (Bytes.reveal k) text})

let hmac a k text =
  let k = Bytes.reveal k in
  let text = Bytes.reveal text in
  assert_norm (pow2 32 < pow2 61);
  assert_norm (pow2 61 < pow2 125);
  //assert (Seq.length text + block_length a <= max_input_length a);
  let t: bytes_hash a = Spec.Agile.HMAC.hmac a k text in
  Bytes.hide t

//18-08-31 review
// The hash of the empty string, used in KS
#set-options "--admit_smt_queries true" //17-05-08 TODO size of bytes constants.
let emptyHash : a:alg -> Tot (tag a) =
  function
  | MD5 -> bytes_of_hex "d41d8cd98f00b204e9800998ecf8427e"
  | SHA1 -> bytes_of_hex "da39a3ee5e6b4b0d3255bfef95601890afd80709"
  | SHA2_224 -> bytes_of_hex "2bc9476102bb288234c415a2b01f828ea62ac5b3e42f"
  | SHA2_256 -> bytes_of_hex "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
  | SHA2_384 -> bytes_of_hex "38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b"
  | SHA2_512 -> bytes_of_hex "cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e"
#reset-options

// A "placeholder" hash whose bytes are all 0, used for key-derivation in Handshake.Secret
let zeroHash (a:alg): Tot (tag a) = Bytes.create (Hacl.Hash.Definitions.hash_len a) 0uy


// TLS-specific hash and MAC algorithms (review)
type tls_alg =
  | NULL
  | MD5SHA1
  | Hash of alg
val tls_tagLen: h:tls_alg{h<>NULL} -> Tot UInt32.t
h: Hashing.Spec.tls_alg{h <> Hashing.Spec.NULL} -> FStar.UInt32.t