#
# Copyright 2018-2020 NXP
# SPDX-License-Identifier: Apache-2.0
#
#

"""License text"""

import binascii
import hashlib
import base64
import os
import logging
import ctypes
from . import sss_api as apis
from . import const

if True:  # pylint: disable=using-constant-test
    from sss import patch_cryptography
    patch_cryptography.patch()
    from cryptography.hazmat.primitives.asymmetric import ec, rsa
    from cryptography.hazmat.backends import openssl, default_backend
    from cryptography.hazmat.primitives import serialization
    from cryptography.hazmat.primitives.serialization import PublicFormat, PrivateFormat, \
        load_der_public_key
    from cryptography.hazmat.primitives.serialization import Encoding, NoEncryption
    from cryptography.hazmat.primitives.serialization import load_pem_private_key, \
        load_pem_public_key, load_der_private_key, load_der_public_key
    from cryptography.x509.base import load_pem_x509_certificate, \
        load_der_x509_certificate
    from cryptography.hazmat.primitives import hashes
    from cryptography.hazmat.primitives import asymmetric


log = logging.getLogger(__name__)

CRYPTO_ECC_CURVE_MAP = {
    # Mapping Crytography curve type with Plug&Trust Middleware curve type
    ec.SECP192R1: [apis.kSE05x_ECCurve_NIST_P192, 192],
    ec.SECP224R1: [apis.kSE05x_ECCurve_NIST_P224, 224],
    ec.SECP256R1: [apis.kSE05x_ECCurve_NIST_P256, 256],
    ec.SECP384R1: [apis.kSE05x_ECCurve_NIST_P384, 384],
    ec.SECP521R1: [apis.kSE05x_ECCurve_NIST_P521, 521],
}

# pylint: disable=no-member
if hasattr(ec, "BrainpoolP160R1"):
    CRYPTO_ECC_CURVE_MAP[ec.BrainpoolP160R1] = [apis.kSE05x_ECCurve_Brainpool160, 160]
if hasattr(ec, "BrainpoolP192R1"):
    CRYPTO_ECC_CURVE_MAP[ec.BrainpoolP192R1] = [apis.kSE05x_ECCurve_Brainpool192, 192]
if hasattr(ec, "BrainpoolP224R1"):
    CRYPTO_ECC_CURVE_MAP[ec.BrainpoolP224R1] = [apis.kSE05x_ECCurve_Brainpool224, 224]
if hasattr(ec, "BrainpoolP256R1"):
    CRYPTO_ECC_CURVE_MAP[ec.BrainpoolP256R1] = [apis.kSE05x_ECCurve_Brainpool256, 256]
if hasattr(ec, "BrainpoolP320R1"):
    CRYPTO_ECC_CURVE_MAP[ec.BrainpoolP320R1] = [apis.kSE05x_ECCurve_Brainpool320, 320]
if hasattr(ec, "BrainpoolP384R1"):
    CRYPTO_ECC_CURVE_MAP[ec.BrainpoolP384R1] = [apis.kSE05x_ECCurve_Brainpool384, 384]
if hasattr(ec, "BrainpoolP512R1"):
    CRYPTO_ECC_CURVE_MAP[ec.BrainpoolP512R1] = [apis.kSE05x_ECCurve_Brainpool512, 512]
if hasattr(ec, "SECP160K1"):
    CRYPTO_ECC_CURVE_MAP[ec.SECP160K1] = [apis.kSE05x_ECCurve_Secp160k1, 160]
if hasattr(ec, "SECP192K1"):
    CRYPTO_ECC_CURVE_MAP[ec.SECP192K1] = [apis.kSE05x_ECCurve_Secp192k1, 192]
if hasattr(ec, "SECP224K1"):
    CRYPTO_ECC_CURVE_MAP[ec.SECP224K1] = [apis.kSE05x_ECCurve_Secp224k1, 224]
if hasattr(ec, "SECP256K1"):
    CRYPTO_ECC_CURVE_MAP[ec.SECP256K1] = [apis.kSE05x_ECCurve_Secp256k1, 256]

# pylint: enable=no-member

HASH_MAP = {
    # Mapping Hash alogorithm of Middleware with Cryptography
    apis.kAlgorithm_SSS_SHA1: [hashes.SHA1(), hashlib.sha1()],
    apis.kAlgorithm_SSS_SHA224: [hashes.SHA224(), hashlib.sha224()],
    apis.kAlgorithm_SSS_SHA256: [hashes.SHA256(), hashlib.sha256()],
    apis.kAlgorithm_SSS_SHA384: [hashes.SHA384(), hashlib.sha384()],
    apis.kAlgorithm_SSS_SHA512: [hashes.SHA512(), hashlib.sha512()],
    apis.kAlgorithm_SSS_RSASSA_PKCS1_V1_5_SHA1: [hashes.SHA1(), hashlib.sha1()],
    apis.kAlgorithm_SSS_RSASSA_PKCS1_V1_5_SHA224: [hashes.SHA224(), hashlib.sha224()],
    apis.kAlgorithm_SSS_RSASSA_PKCS1_V1_5_SHA256: [hashes.SHA256(), hashlib.sha256()],
    apis.kAlgorithm_SSS_RSASSA_PKCS1_V1_5_SHA384: [hashes.SHA384(), hashlib.sha384()],
    apis.kAlgorithm_SSS_RSASSA_PKCS1_V1_5_SHA512: [hashes.SHA512(), hashlib.sha512()],
    apis.kAlgorithm_SSS_RSASSA_PKCS1_PSS_MGF1_SHA1: [hashes.SHA1(), hashlib.sha1()],
    apis.kAlgorithm_SSS_RSASSA_PKCS1_PSS_MGF1_SHA224: [hashes.SHA224(), hashlib.sha224()],
    apis.kAlgorithm_SSS_RSASSA_PKCS1_PSS_MGF1_SHA256: [hashes.SHA256(), hashlib.sha256()],
    apis.kAlgorithm_SSS_RSASSA_PKCS1_PSS_MGF1_SHA384: [hashes.SHA384(), hashlib.sha384()],
    apis.kAlgorithm_SSS_RSASSA_PKCS1_PSS_MGF1_SHA512: [hashes.SHA512(), hashlib.sha512()],
}


def get_session_pkl_path():
    """
    Get session pkl file path
    :return: Session pkl file path
    """
    work_space = os.getenv("WORKSPACE")
    if work_space:
        return "%s/~.ssscli_session.pkl" % (work_space,)
    home = os.path.expanduser("~")
    return "%s/~.ssscli_session.pkl" % (home,)


def get_host_session_pkl_path():
    """
    Get Host session pkl file path
    :return: Host session pkl file path
    """
    work_space = os.getenv("WORKSPACE")
    if work_space:
        return "%s/~.ssscli_host_session.pkl" % (work_space,)
    home = os.path.expanduser("~")
    return "%s/~.ssscli_host_session.pkl" % (home,)


def status_to_str(status):
    """
    Parse sss status to string format
    :param status: SSS status
    :return: Status as string
    """
    if status in const.STATUS2STR:
        return const.STATUS2STR[status]
    return 'Unknown Status "%s")' % (repr(status),)


def is_hex(key):
    """
    Check if the key is in he format or not
    :param key: Input key
    :return: True if key in hex format, else False
    """
    try:
        int(key, 16)
        return True
    except ValueError:
        return False


def key_der_to_list(key_data):
    """
    Read AES key from der format
    :param key_data: Input Key data
    :return: key as list
    """
    key_list = list()
    for i in key_data:
        key_list.append(ord(chr(i)))
    return key_list


def transform_key_to_list(key):
    """
    Convert key to list. Takes each 2 digit value and put it in list.
    :param key: Input key
    :return: Key as integer list format
    """
    key_int_list = list()
    for i in range(0, len(key), 2):
        key_int_list.append(int(key[i:i + 2], 16))
    return key_int_list


def transform_int_list_to_hex_str(key_list):
    """
    Convert key from integer list to hex string.
    :param key_list: Input key as integer list
    :return: Key as hex string format
    """
    key_hex_str = ""
    for key_item in key_list:
        hex_str_item = format(key_item, 'x')
        if len(hex_str_item) == 1:
            hex_str_item = "0" + hex_str_item
        key_hex_str += hex_str_item
    return key_hex_str


def to_cert_dat(key):
    """
    Convert input raw key to list
    :param key: Input raw key
    :return: Key as list format
    """
    cert_data = list()
    for i in key:
        cert_data.append(ord(i))
    return cert_data


def file_write(key, filename):
    """
    Store key into file
    :param key: Input key
    :param filename: File name to store key
    :return: None
    """
    f = open(filename, 'wb')
    if isinstance(key, str):
        f.write(str.encode(key))
    else:
        f.write(key)
    f.close()


def write_pkcs12_refkey(session, refkey_file, password, refpem_key, key_obj):  # pylint: disable=too-many-locals
    """
    Write PKCS12 key to file
    :param session: Instance of session
    :param refkey_file: File name to store reference key
    :param password: Password for encryption of ref key
    :param refpem_key: Input reference pem key
    :param key_obj: Key object handle of private key
    :return: Status
    """
    password_ctypes = ctypes.create_string_buffer(1024)
    password_ctypes.value = str.encode(password)
    refpem_key_ctypes = ctypes.create_string_buffer(4096)
    refpem_key_ctypes.value = str.encode(refpem_key)

    cert_bytes_ctypes = ctypes.create_string_buffer(100)
    cert_bytes_ctypes.value = str.encode("selfSignedCA")
    cert_subject_ctypes = ctypes.create_string_buffer(100)
    cert_subject_ctypes.value = str.encode("email:d:NXP")
    if refkey_file.endswith('.pfx') or refkey_file.endswith('.p12'):
        # write to pkcs12 format
        refkey_file_ctypes = ctypes.create_string_buffer(1024)
        refkey_file_ctypes.value = str.encode(refkey_file)
        status = apis.sss_util_openssl_write_pkcs12(ctypes.byref(session),
                                                    ctypes.byref(key_obj.ctx_ks.keystore),
                                                    ctypes.byref(key_obj.ctx_key.keyobject),
                                                    apis.String(refkey_file_ctypes),
                                                    apis.String(password_ctypes),
                                                    apis.String(refpem_key_ctypes),
                                                    len(refpem_key),
                                                    apis.String(cert_bytes_ctypes),
                                                    apis.String(cert_subject_ctypes))
    else:
        # write to pkcs12 format
        p12_refkey_file = refkey_file[:-4] + ".p12"
        p12_refkey_file_ctypes = ctypes.create_string_buffer(1024)
        p12_refkey_file_ctypes.value = str.encode(p12_refkey_file)
        status = apis.sss_util_openssl_write_pkcs12(ctypes.byref(session),
                                                    ctypes.byref(key_obj.ctx_ks.keystore),
                                                    ctypes.byref(key_obj.ctx_key.keyobject),
                                                    apis.String(p12_refkey_file_ctypes),
                                                    apis.String(password_ctypes),
                                                    apis.String(refpem_key_ctypes),
                                                    len(refpem_key),
                                                    apis.String(cert_bytes_ctypes),
                                                    apis.String(cert_subject_ctypes))
        if status != apis.kStatus_SSS_Success:
            log.error("pkcs12 refkey creation failed")
            return status

        pem_refkey = (ctypes.c_uint8 * 10400)(0)
        certificate = (ctypes.c_uint8 * 10400)(0)

        # extract ref pem key from pkcs12 file
        status = apis.sss_util_openssl_read_pkcs12(apis.String(p12_refkey_file_ctypes),
                                                   apis.String(password_ctypes),
                                                   pem_refkey,
                                                   certificate)

        if status != apis.kStatus_SSS_Success:
            log.error("pkcs12 refkey pem extraction failed")
            return status

        pem_refkey_list = list(pem_refkey)
        # Remove zero padding
        while pem_refkey_list[-1] == 0:
            pem_refkey_list = pem_refkey_list[:-1]

        pem = transform_int_list_to_hex_str(pem_refkey_list)
        extracted_ref_key = binascii.unhexlify(pem)

        # convert to DER
        if refkey_file.endswith('.der'):
            pemkey = load_pem_private_key(extracted_ref_key, None, default_backend())
            extracted_ref_key = pemkey.private_bytes(serialization.Encoding.DER,
                                                     serialization.PrivateFormat.TraditionalOpenSSL,
                                                     serialization.NoEncryption())
        # save pkcs12 extracted refkey
        f = open(refkey_file, 'wb')
        f.write(extracted_ref_key)
        f.close()

    return status


def write_refkey_to_file(session, refkey_file, password, key_pem, key_der, key_obj, encode_format):  # pylint: disable=too-many-arguments
    """
    Write reference key into file
    :param session: Instance of session
    :param refkey_file: File name to store reference key
    :param password: Password for encryption of pkcs12 reference key
    :param key_pem: Reference key in PEM format
    :param key_der: Reference key in DER format
    :param key_obj: Private key object handle
    :param encode_format: File format to store key
    :return: Status
    """
    if refkey_file.endswith('.pfx') or refkey_file.endswith('.p12') or encode_format == "PKCS12":
        status = write_pkcs12_refkey(session, refkey_file, password, bytes.decode(key_pem), key_obj)
    else:

        try:
            f = open(refkey_file, 'wb')
        except IOError as exc:
            log.error(exc)
            return apis.kStatus_SSS_Fail

        # Consider file extension for default
        if encode_format == "":
            if refkey_file.endswith('.pem'):
                f.write(key_pem)
            else:
                f.write(key_der)
        elif encode_format == "PEM":
            f.write(key_pem)
        elif encode_format == "DER":
            f.write(key_der)
        else:
            log.error("Unknown file format")
            f.close()
            return apis.kStatus_SSS_Fail
        f.close()
        status = apis.kStatus_SSS_Success

    return status


def generate_openssl_ecc_refkey(session, key_pub_raw, keyid_int,  # pylint: disable=too-many-locals, too-many-branches, too-many-arguments, too-many-statements
                                refkey_file, key_type,
                                ecc_curve, encode_format="",
                                password="nxp", key_obj=None):
    """
    Generate ecc reference key using openssl
    :param session: Instance of session
    :param key_pub_raw: Retrieved public key
    :param keyid_int: Key index
    :param refkey_file: File name to store reference key
    :param key_type: Key type for magic number
    :param ecc_curve: ECC curve type
    :param encode_format: Encode format to store file
    :param password: Password for encryption of pkcs12 reference key
    :param key_obj: Private key object handle
    :return: Status
    """
    # Dictionary used for ECC ref key creation
    # Maps MW curve type enum with cryptography curve type, public key header length,
    # Private key length and Private key length calculator index
    crypto_refpem_dict = {
        apis.kSE05x_ECCurve_NIST_P192: [ec.SECP192R1, 23, 6],
        apis.kSE05x_ECCurve_NIST_P224: [ec.SECP224R1, 20, 6],
        apis.kSE05x_ECCurve_NIST_P256: [ec.SECP256R1, 23, 6],
        apis.kSE05x_ECCurve_NIST_P384: [ec.SECP384R1, 20, 7],
        apis.kSE05x_ECCurve_NIST_P521: [ec.SECP521R1, 21, 7],
    }
    # pylint: disable=no-member
    if hasattr(ec, "BrainpoolP160R1"):
        crypto_refpem_dict[apis.kSE05x_ECCurve_Brainpool160] = [ec.BrainpoolP160R1, 24, 6]
    if hasattr(ec, "BrainpoolP192R1"):
        crypto_refpem_dict[apis.kSE05x_ECCurve_Brainpool192] = [ec.BrainpoolP192R1, 24, 6]
    if hasattr(ec, "BrainpoolP224R1"):
        crypto_refpem_dict[apis.kSE05x_ECCurve_Brainpool224] = [ec.BrainpoolP224R1, 24, 6]
    if hasattr(ec, "BrainpoolP256R1"):
        crypto_refpem_dict[apis.kSE05x_ECCurve_Brainpool256] = [ec.BrainpoolP256R1, 24, 6]
    if hasattr(ec, "BrainpoolP320R1"):
        crypto_refpem_dict[apis.kSE05x_ECCurve_Brainpool320] = [ec.BrainpoolP320R1, 24, 7]
    if hasattr(ec, "BrainpoolP384R1"):
        crypto_refpem_dict[apis.kSE05x_ECCurve_Brainpool384] = [ec.BrainpoolP384R1, 24, 7]
    if hasattr(ec, "BrainpoolP512R1"):
        crypto_refpem_dict[apis.kSE05x_ECCurve_Brainpool512] = [ec.BrainpoolP512R1, 25, 7]
    if hasattr(ec, "SECP160K1"):
        crypto_refpem_dict[apis.kSE05x_ECCurve_Secp160k1] = [ec.SECP160K1, 20, 6]
    if hasattr(ec, "SECP192K1"):
        crypto_refpem_dict[apis.kSE05x_ECCurve_Secp192k1] = [ec.SECP192K1, 20, 6]
    if hasattr(ec, "SECP224K1"):
        crypto_refpem_dict[apis.kSE05x_ECCurve_Secp224k1] = [ec.SECP224K1, 20, 6]
    if hasattr(ec, "SECP256K1"):
        crypto_refpem_dict[apis.kSE05x_ECCurve_Secp256k1] = [ec.SECP256K1, 20, 6]

    if hasattr(asymmetric, "x25519"):
        crypto_refpem_dict[apis.kSE05x_ECCurve_RESERVED_ID_ECC_MONT_DH_25519] = [asymmetric.x25519, 12, 15]
    else:
        log.warning("Python Cryptography module does not support MONT_DH_25519 curve.!! "
                    "Consider upgrading via \'pip3 install cryptography==2.6.1\' command.")

    if hasattr(asymmetric, "ed25519"):
        crypto_refpem_dict[apis.kSE05x_ECCurve_RESERVED_ID_ECC_ED_25519] = [asymmetric.ed25519, 12, 15]
    if hasattr(asymmetric, "x448"):
        crypto_refpem_dict[apis.kSE05x_ECCurve_RESERVED_ID_ECC_MONT_DH_448] = [asymmetric.x448, 12, 15]
    # pylint: enable=no-member

    # To support EAR_CH, setting NIST_P256 as default
    if ecc_curve == 0:
        ecc_curve = apis.kSE05x_ECCurve_NIST_P256

    curve_info = crypto_refpem_dict[ecc_curve]
    curve_type = curve_info[0]
    pub_key_header_length = curve_info[1]
    index_to_cal_length = curve_info[2]

    openssl_format_list = ['10', '00', '00', '00', '00', '00', '00', '00', '00', '00',
                           '00', '00', '00', '00', '00', '00', '00', '00', ]
    magic_data_list = ['a5', 'a6', 'b5', 'b6', 'a5', 'a6', 'b5', 'b6', key_type, '00']

    # Convert key id from int to hex list format
    keyid_str = format("%08x" % keyid_int)
    keyid_list = list()
    for j in range(0, len(keyid_str), 2):
        keyid_list.append(keyid_str[j:j + 2])

    # Convert public key from raw key to hex list format and trim header
    key_pub_list = list(key_pub_raw)
    key_pub_hex_list = []
    for key_pub_item in key_pub_list:
        key_pub_item = format(key_pub_item, 'x')
        if len(key_pub_item) == 1:
            key_pub_item = "0" + key_pub_item
        key_pub_hex_list.append(key_pub_item)
    key_pub_no_header_list = key_pub_hex_list[pub_key_header_length:]

    # Generate private key using openssl and convert it to hex list format
    if ecc_curve == apis.kSE05x_ECCurve_RESERVED_ID_ECC_MONT_DH_25519:
        key_openssl = asymmetric.x25519.X25519PrivateKey.generate()
        key_openssl_prv_bytes = key_openssl.private_bytes(
            Encoding.DER, PrivateFormat.PKCS8, NoEncryption())
    elif ecc_curve == apis.kSE05x_ECCurve_RESERVED_ID_ECC_ED_25519:
        key_openssl = asymmetric.ed25519.Ed25519PrivateKey.generate()
        key_openssl_prv_bytes = key_openssl.private_bytes(
            Encoding.DER, PrivateFormat.PKCS8, NoEncryption())
    elif ecc_curve == apis.kSE05x_ECCurve_RESERVED_ID_ECC_MONT_DH_448:
        key_openssl = asymmetric.x448.X448PrivateKey.generate()
        key_openssl_prv_bytes = key_openssl.private_bytes(
            Encoding.DER, PrivateFormat.PKCS8, NoEncryption())
    else:
        key_openssl = ec.generate_private_key(curve_type, default_backend())
        key_openssl_prv_bytes = key_openssl.private_bytes(
            Encoding.DER, PrivateFormat.TraditionalOpenSSL, NoEncryption())
    key_openssl_hex = binascii.hexlify(key_openssl_prv_bytes)
    key_openssl_list = list()
    for i in range(0, len(key_openssl_hex), 2):
        key_openssl_list.append(key_openssl_hex[i:i + 2])

    if ecc_curve not in [apis.kSE05x_ECCurve_RESERVED_ID_ECC_MONT_DH_25519,
                         apis.kSE05x_ECCurve_RESERVED_ID_ECC_ED_25519,
                         apis.kSE05x_ECCurve_RESERVED_ID_ECC_MONT_DH_448]:
        # Remove public key from generated ecc key
        private_key_length = len(key_openssl_list) - len(key_pub_no_header_list)
        key_openssl_prv_list = key_openssl_list[:private_key_length]
    else:
        key_openssl_prv_list = key_openssl_list

    key_openssl_prv_length = int(key_openssl_prv_list[index_to_cal_length], 16)
    openssl_format_length = key_openssl_prv_length - (len(openssl_format_list) +
                                                      len(keyid_list) + len(magic_data_list))
    if openssl_format_length >= 0:
        # Append zeros to openssl format to match length
        for i in range(openssl_format_length):
            openssl_format_list.append('00')
    else:
        for i in range((len(openssl_format_list) + len(keyid_list) +
                        len(magic_data_list)) - key_openssl_prv_length):
            openssl_format_list = openssl_format_list[:-1]
    index_to_cal_length += 1

    openssl_format_list.extend(keyid_list)
    openssl_format_list.extend(magic_data_list)
    # Update openssl generated private key with magic data
    for i in range(len(openssl_format_list)):  # pylint: disable=consider-using-enumerate
        key_openssl_prv_list[i + index_to_cal_length] = openssl_format_list[i]

    if ecc_curve not in [apis.kSE05x_ECCurve_RESERVED_ID_ECC_MONT_DH_25519,
                         apis.kSE05x_ECCurve_RESERVED_ID_ECC_ED_25519,
                         apis.kSE05x_ECCurve_RESERVED_ID_ECC_MONT_DH_448]:
        # Add public key
        key_openssl_prv_list.extend(key_pub_no_header_list)

    # Convert key from list to string
    key_der_hex = ""
    for key_openssl_prv_item in key_openssl_prv_list:
        if isinstance(key_openssl_prv_item, bytes):
            key_der_hex += bytes.decode(key_openssl_prv_item)
        else:
            key_der_hex += key_openssl_prv_item

    key_der = binascii.unhexlify(key_der_hex)
    key_pem_obj = openssl.backend.load_der_private_key(key_der, None)
    if ecc_curve in [apis.kSE05x_ECCurve_RESERVED_ID_ECC_MONT_DH_25519,
                     apis.kSE05x_ECCurve_RESERVED_ID_ECC_ED_25519,
                     apis.kSE05x_ECCurve_RESERVED_ID_ECC_MONT_DH_448]:
        key_pem = key_pem_obj.private_bytes(Encoding.PEM, PrivateFormat.PKCS8,
                                            NoEncryption())
    else:
        key_pem = key_pem_obj.private_bytes(Encoding.PEM, PrivateFormat.TraditionalOpenSSL,
                                            NoEncryption())
    status = write_refkey_to_file(session, refkey_file, password,
                                  key_pem, key_der, key_obj, encode_format)

    return status


def get_length(key_list):
    """
    Get length in the TLV
    :param key_list: Key to parse
    :return: Length in the TLV
    """
    # Find tag value
    if 2 == int(key_list[0], 16):  # pylint: disable=misplaced-comparison-constant
        # check MSB is zero, if yes then this byte indicates length
        # else this byte indicates number of bytes for length calculation
        if int(key_list[1], 16) & 0x80 == 0x00:
            length = int(key_list[1], 16)
            length += 2
        else:
            length_bytes = int(key_list[1], 16) & 0x7f  # Mask MSB
            length_header = 2 + length_bytes
            length = int(key_list[2], 16)
            for i in range(1, length_bytes):
                length = length * 0x100
                length = length | int(key_list[2 + i], 16)
            length += length_header
        return length
    return 0


def replace_bytes(list_dest, len_dest, dest_index, list_src, len_src):
    """
    Replace key values
    :param list_dest: Output list
    :param len_dest: Output length
    :param dest_index: Index to replace bytes
    :param list_src: Input list
    :param len_src: Input length
    :return: Output list
    """
    index = 0
    # if destination list length is bigger then copy source list and remove extra bytes
    if len_dest > len_src:
        for index in range(len_src):
            list_dest[dest_index + index] = list_src[index]
        del list_dest[dest_index + index + 1: dest_index + index + (len_dest - len_src) + 1]

    else:
        for index in range(len_dest):
            list_dest[dest_index + index] = list_src[index]
        for i in range(index + 1, len_src):
            list_dest.insert(dest_index + index + i, list_src[index + i])

    return list_dest


def generate_openssl_rsa_refkey(session, key_pub_raw,  # pylint: disable=too-many-locals, too-many-branches, too-many-arguments, too-many-statements
                                keyid_int, refkey_file,
                                key_size, encode_format="", password="nxp",
                                key_obj=None):
    """
    Generate rsa reference key using openssl
    :param session: Instance of session
    :param key_pub_raw: Retrieved public key
    :param keyid_int: Key index
    :param refkey_file: File name to store reference key
    :param key_size: RSA key size
    :param encode_format: Encode format to store file
    :param password: Password for encryption of pkcs12 reference key
    :param key_obj: Private key object handle
    :return: Status
    """
    # generate rsa key pair
    key_openssl = rsa.generate_private_key(public_exponent=65537, key_size=key_size,
                                           backend=default_backend())
    key_prv_bytes = key_openssl.private_bytes(encoding=Encoding.DER,
                                              format=serialization.PrivateFormat.TraditionalOpenSSL,
                                              encryption_algorithm=serialization.NoEncryption())
    key_openssl_hex = binascii.hexlify(key_prv_bytes)

    key_openssl_list = list()
    for k in range(0, len(key_openssl_hex), 2):
        key_openssl_list.append(key_openssl_hex[k:k + 2])

    # convert the retrieved public key to hex format
    key_pub_list = list(key_pub_raw)

    # trim the header of public key
    if key_size == 1024:
        key_pub_no_header_list = key_pub_list[25:]
    elif key_size in [2048, 3072, 4096]:
        key_pub_no_header_list = key_pub_list[28:]
    else:
        log.error("key size: %s is not supported. Should be one of 1024, 2048, 3072, 4096",
                  (str(key_size),))
        return apis.kStatus_SSS_Fail

    key_pub_str_list = list()
    for key_pub_no_header_item in key_pub_no_header_list:
        key_pub_no_header_item = format(key_pub_no_header_item, 'x')
        if len(key_pub_no_header_item) == 1:
            key_pub_no_header_item = "0" + key_pub_no_header_item
        key_pub_str_list.append(key_pub_no_header_item)

    openssl_index = 7

    # Public Key section
    retrieved_pub_len = get_length(key_pub_str_list)
    openssl_pub_len = get_length(key_openssl_list[openssl_index:])
    key_openssl_list = replace_bytes(key_openssl_list, openssl_pub_len, openssl_index,
                                     key_pub_str_list, retrieved_pub_len)
    openssl_index += retrieved_pub_len

    # publicExponent section
    openssl_index += get_length(key_openssl_list[openssl_index:])

    # Private key Exponent section
    openssl_index += get_length(key_openssl_list[openssl_index:])

    # prime1 section
    magic_prime1_data = ['02', '01', '01']
    openssl_prime1_len = get_length(key_openssl_list[openssl_index:])
    key_openssl_list = replace_bytes(key_openssl_list, openssl_prime1_len, openssl_index,
                                     magic_prime1_data, len(magic_prime1_data))
    openssl_index += len(magic_prime1_data)

    # convert keyID to hex format and add TLV
    keyid_str = format("%08x" % keyid_int)
    key_id_list = ['02']
    if len(keyid_str) < 31:
        key_id_len = int(len(keyid_str) / 2)
        key_id_len_hex = format("%x" % key_id_len)
        if len(key_id_len_hex) == 1:
            key_id_len_hex = "0" + key_id_len_hex
        key_id_list.append(key_id_len_hex)
    for i in range(0, len(keyid_str), 2):
        key_id_list.append(keyid_str[i:i + 2])

    # prime 2 section
    openssl_prime2_len = get_length(key_openssl_list[openssl_index:])
    key_openssl_list = replace_bytes(key_openssl_list, openssl_prime2_len,
                                     openssl_index, key_id_list, len(key_id_list))
    openssl_index += len(key_id_list)

    # exponent1 section
    openssl_index += get_length(key_openssl_list[openssl_index:])

    # exponent2 section
    openssl_index += get_length(key_openssl_list[openssl_index:])

    # coefficient section
    magic_mod_p = ['02', '04', 'a5', 'a6', 'b5', 'b6']
    openssl_coefficient_len = get_length(key_openssl_list[openssl_index:])
    key_openssl_list = replace_bytes(key_openssl_list, openssl_coefficient_len,
                                     openssl_index, magic_mod_p,
                                     len(magic_mod_p))

    # Recalculate total length of the key
    key_openssl_len = len(key_openssl_list) - 4
    key_openssl_len_str = format("%04x" % key_openssl_len)
    total_len_list = []
    for i in range(0, len(key_openssl_len_str), 2):
        total_len_list.append(key_openssl_len_str[i:i + 2])

    key_openssl_list[2] = total_len_list[0]
    key_openssl_list[3] = total_len_list[1]

    # convert key to der or pem format
    key_der_hex = ""
    for key_openssl_item in key_openssl_list:
        if isinstance(key_openssl_item, bytes):
            key_der_hex += bytes.decode(key_openssl_item)
        else:
            key_der_hex += key_openssl_item

    key_der = binascii.unhexlify(key_der_hex)
    key_pem_obj = openssl.backend.load_der_private_key(key_der, None)
    key_pem = key_pem_obj.private_bytes(Encoding.PEM,
                                        PrivateFormat.TraditionalOpenSSL,
                                        NoEncryption())
    status = write_refkey_to_file(session, refkey_file, password,
                                  key_pem, key_der, key_obj, encode_format)
    return status


def ecc_ex_curve_add_pub_key(prv_key_in):
    """
    Make key pair for ECC extra curves
    :param prv_key_in: Private key
    :return: Full key pair
    """
    # Generate public key from private
    pub_key = prv_key_in.public_key()
    pub_bytes = pub_key.public_bytes(Encoding.DER, PublicFormat.SubjectPublicKeyInfo)
    prv_key_der = prv_key_in.private_bytes(Encoding.DER, PrivateFormat.PKCS8, NoEncryption())

    # Convert keys to hex format
    prv_key_data_hex = binascii.hexlify(prv_key_der)
    pub_key_data_hex = binascii.hexlify(pub_bytes)
    # Private key header
    prv_key_header = prv_key_data_hex[:32]

    # Private key data
    prv_key_data = prv_key_data_hex[32:]

    # Convert header to list for manipulation
    prv_header_list = transform_key_to_list(prv_key_header)

    # Create public key header for key pair
    header = b'81' + str.encode(format((len(pub_bytes) - 12 + 1), 'x')) + b'00'

    pub_key_data = pub_key_data_hex[24:]

    # Update key pair length
    key_pair = prv_key_data + header + pub_key_data

    # Update Key pair header
    prv_header_list[1] = int(14 + (len(key_pair)/2))  # Update new length
    prv_header_list[4] = 0x01  # 0x01 Indicates key pair
    prv_header_list[13] = int(2 + (len(prv_key_data)/2))  # Update new length

    header_str = transform_int_list_to_hex_str(prv_header_list)

    return binascii.unhexlify(str.encode(header_str) + key_pair)


def from_file_dat(filename, key_part, encode_format=""):  # pylint: disable=too-many-branches, too-many-statements
    """
    Parse key from file to list format
    :param filename: Input file name
    :param key_part: Key type
    :param encode_format: Encode format. Eg: DER, PEM
    :return: Key as integer list, key length, key bit length and curve type
    """
    key_bit_len = 0
    curve_type = None
    with open(filename, 'rb') as key_in:
        key_data = key_in.read()

    if key_part == apis.kSSS_KeyPart_Public:
        # Consider file extension for default
        if encode_format == "":
            if filename.endswith('.pem'):
                key_pub = load_pem_public_key(key_data, backend=default_backend())
            else:
                key_pub = load_der_public_key(key_data, backend=default_backend())
        elif encode_format == "PEM":
            key_pub = load_pem_public_key(key_data, backend=default_backend())
        elif encode_format == "DER":
            key_pub = load_der_public_key(key_data, backend=default_backend())
        else:
            log.error("Unknown key file format")
            return None, 0, 0, None
        key_der = key_pub.public_bytes(Encoding.DER, PublicFormat.SubjectPublicKeyInfo)
        if hasattr(key_pub, 'curve'):
            curve_type = CRYPTO_ECC_CURVE_MAP[type(key_pub.curve)][0]
        else:
            if hasattr(openssl, 'ed25519'):
                if key_pub.__class__ is openssl.ed25519._Ed25519PublicKey:
                    curve_type = apis.kSE05x_ECCurve_RESERVED_ID_ECC_ED_25519
                    key_bit_len = 256
            if hasattr(openssl, 'x25519'):
                if key_pub.__class__ is openssl.x25519._X25519PublicKey:
                    curve_type = apis.kSE05x_ECCurve_RESERVED_ID_ECC_MONT_DH_25519
                    key_bit_len = 256
            if hasattr(openssl, 'x448'):
                if key_pub.__class__ is openssl.x448._X448PublicKey:
                    curve_type = apis.kSE05x_ECCurve_RESERVED_ID_ECC_MONT_DH_448
                    key_bit_len = 448

        if hasattr(key_pub, 'key_size'):
            key_bit_len = key_pub.key_size
        elif hasattr(key_pub, 'curve'):
            key_bit_len = CRYPTO_ECC_CURVE_MAP[type(key_pub.curve)][1]

    elif key_part == apis.kSSS_KeyPart_Pair:
        # Consider file extension for default
        if encode_format == "":
            if filename.endswith('.pem'):
                key_prv = load_pem_private_key(key_data, None, default_backend())
            else:
                key_prv = load_der_private_key(key_data, None, default_backend())
        elif encode_format == "PEM":
            key_prv = load_pem_private_key(key_data, None, default_backend())
        elif encode_format == "DER":
            key_prv = load_der_private_key(key_data, None, default_backend())
        else:
            log.error("Unknown key file format")
            return None, 0, 0, None
        key_der = key_prv.private_bytes(Encoding.DER, PrivateFormat.PKCS8, NoEncryption())
        if hasattr(key_prv, 'curve'):
            curve_type = CRYPTO_ECC_CURVE_MAP[type(key_prv.curve)][0]
        else:
            if hasattr(openssl, 'ed25519'):
                if key_prv.__class__ is openssl.ed25519._Ed25519PrivateKey:
                    curve_type = apis.kSE05x_ECCurve_RESERVED_ID_ECC_ED_25519
                    key_bit_len = 256
                    key_der = ecc_ex_curve_add_pub_key(key_prv)
            if hasattr(openssl, 'x25519'):
                if key_prv.__class__ is openssl.x25519._X25519PrivateKey:
                    curve_type = apis.kSE05x_ECCurve_RESERVED_ID_ECC_MONT_DH_25519
                    key_bit_len = 256
                    key_der = ecc_ex_curve_add_pub_key(key_prv)
            if hasattr(openssl, 'x448'):
                if key_prv.__class__ is openssl.x448._X448PrivateKey:
                    curve_type = apis.kSE05x_ECCurve_RESERVED_ID_ECC_MONT_DH_448
                    key_bit_len = 448
                    key_der = ecc_ex_curve_add_pub_key(key_prv)

        if hasattr(key_prv, 'key_size'):
            key_bit_len = key_prv.key_size
        elif hasattr(key_prv, 'curve'):
            key_bit_len = CRYPTO_ECC_CURVE_MAP[type(key_prv.curve)][1]

    elif key_part == apis.kSSS_KeyPart_Default:
        # Consider file extension for default
        if encode_format == "":
            if filename.endswith('.pem') or filename.endswith('.cer'):
                cert = load_pem_x509_certificate(key_data, default_backend())
            else:
                cert = load_der_x509_certificate(key_data, default_backend())
        elif encode_format == "PEM":
            cert = load_pem_x509_certificate(key_data, default_backend())
        elif encode_format == "DER":
            cert = load_der_x509_certificate(key_data, default_backend())
        else:
            log.error("Unknown key file format")
            return None, 0, 0, None
        key_der = cert.public_bytes(Encoding.DER)
    else:
        log.error("Un support key type")
        return None, 0, 0, None

    # Convert key to int list format
    key_hex = binascii.hexlify(key_der)
    key_int_list = transform_key_to_list(key_hex)
    key_len = len(key_int_list)

    return key_int_list, key_len, key_bit_len, curve_type


def hex_uid(uid_raw):
    """
    Convert key to Hex string
    :param uid_raw: Input UID
    :return: Hex string
    """
    uid_list = list(uid_raw)
    uid_hex_str = ""
    for uid_item in uid_list:
        uid_hex = format(uid_item, 'x')
        if len(uid_hex) == 1:
            uid_hex = "0" + uid_hex
        uid_hex_str += uid_hex
    return uid_hex_str


def save_to_file(key, filename, key_part, encode_format="", cypher_type = 0):
    """
    Store key in file
    :param key: Input key
    :param filename: File name to store key
    :param key_part: Key type
    :param encode_format: Encode format to store key. Eg: DER, PEM
    :param cypher_type: cipher type to save to file.
    :return: status
    """
    key_pem = None
    key_der = ""
    key_hex_str = ""
    for i in range(len(key)):  # pylint: disable=consider-using-enumerate
        key[i] = format(key[i], 'x')
        if len(key[i]) == 1:
            key[i] = "0" + key[i]
        key_hex_str += key[i]
    key_der_str = binascii.unhexlify(key_hex_str)

    if key_part == apis.kSSS_KeyPart_Default:
        certificate = load_der_x509_certificate(key_der_str, default_backend())
        key_pem = certificate.public_bytes(Encoding.PEM)
        key_der = certificate.public_bytes(Encoding.DER)

    elif key_part in [apis.kSSS_KeyPart_Pair, apis.kSSS_KeyPart_Public]:
        if cypher_type == apis.kSSS_CipherType_EC_TWISTED_ED:
            if not hasattr(asymmetric, 'ed25519'):
                log.warning("Python Cryptography module does not support ed25519 curve.!! "
                            "Consider upgrading via \'pip3 install cryptography==2.6.1\' command.")
                return apis.kStatus_SSS_Fail
            # Remove header
            key_der_str_no_header = key_der_str[12:]
            key_crypto = asymmetric.ed25519.Ed25519PublicKey.from_public_bytes(key_der_str_no_header)
            key_pem = key_crypto.public_bytes(Encoding.PEM, PublicFormat.SubjectPublicKeyInfo)
            key_der = key_crypto.public_bytes(Encoding.DER, PublicFormat.SubjectPublicKeyInfo)
        elif cypher_type == apis.kSSS_CipherType_EC_MONTGOMERY:
            if not hasattr(asymmetric, 'x25519') or not hasattr(asymmetric, 'x448'):
                log.warning("Python Cryptography module does not support montgomery curve.!! "
                            "Consider upgrading via \'pip3 install cryptography==2.6.1\' command.")
                return apis.kStatus_SSS_Fail
            # Remove header
            key_der_str_no_header = key_der_str[12:]
            if len(key_der_str_no_header) == 56:  # Mont_DH_448 key size is 56 bytes
                key_crypto = asymmetric.x448.X448PublicKey.from_public_bytes(key_der_str_no_header)
            else:
                key_crypto = asymmetric.x25519.X25519PublicKey.from_public_bytes(key_der_str_no_header)
            key_pem = key_crypto.public_bytes(Encoding.PEM, PublicFormat.SubjectPublicKeyInfo)
            key_der = key_crypto.public_bytes(Encoding.DER, PublicFormat.SubjectPublicKeyInfo)
        else:
            key_crypto = load_der_public_key(key_der_str, default_backend())
            key_pem = key_crypto.public_bytes(Encoding.PEM, PublicFormat.SubjectPublicKeyInfo)
            key_der = key_crypto.public_bytes(Encoding.DER, PublicFormat.SubjectPublicKeyInfo)

    elif key_part == apis.kSSS_KeyPart_NONE:
        key_pem = base64.b64encode(key_der_str)
        key_der = key_der_str

    if type(key_der) is str:
        key_der = str.encode(key_der)

    try:
        f = open(filename, 'wb')
    except IOError as exc:
        log.error(exc)
        return apis.kStatus_SSS_Fail

    # Consider file extension for default
    if encode_format == "":
        if filename.endswith('.pem') or filename.endswith('.cer'):
            log.debug("writing to file in pem format")
            f.write(key_pem)
        else:
            log.debug("writing to file in der format")
            f.write(key_der)
    elif encode_format == "PEM":
        log.debug("writing to file in pem format")
        f.write(key_pem)
    elif encode_format == "DER":
        log.debug("writing to file in der format")
        f.write(key_der)
    else:
        log.error("Unknown file format")
        f.close()
        return apis.kStatus_SSS_Fail
    f.close()
    return apis.kStatus_SSS_Success


def hash_convert(filename, encode_format="", hash_algo=apis.kAlgorithm_SSS_SHA256):
    """
    Convert hash data from file using algorithm
    :param filename: Input file
    :param encode_format: File format. Eg: DER, PEM
    :param hash_algo: Hash algorithm
    :return: Key as integer list and length
    """
    with open(filename, 'rb') as raw_data:
        data = raw_data.read()
    hash_value = hashes.Hash(HASH_MAP[hash_algo][0], default_backend())
    if not is_hex(data):
        # Consider file extension for default
        if encode_format == "":
            if filename.endswith('.pem') or filename.endswith('.cer'):
                cert = load_pem_x509_certificate(data, default_backend())
            else:
                cert = load_der_x509_certificate(data, default_backend())
        elif encode_format == "PEM":
            cert = load_pem_x509_certificate(data, default_backend())
        elif encode_format == "DER":
            cert = load_der_x509_certificate(data, default_backend())
        else:
            log.error("Unknown file format")
            return None, 0

        cert_der = cert.public_bytes(Encoding.DER)
        cert_hex = binascii.hexlify(cert_der)
    else:
        cert_hex = data
    hash_value.update(cert_hex)
    final_hash = hash_value.finalize()
    cert_hash_hex = binascii.hexlify(final_hash)
    key_int_list = transform_key_to_list(cert_hash_hex)
    hash_len = hash_value.algorithm.digest_size
    return key_int_list, hash_len


def load_certificate(filename, encode_format=""):
    """
    Convert Load certificate from file
    :param filename: Input file
    :param encode_format: File format. Eg: DER, PEM
    :return: Key as integer list and length
    """
    with open(filename, 'rb') as raw_data:
        data = raw_data.read()

    # Consider file extension for default
    if encode_format == "":
        if filename.endswith('.pem') or filename.endswith('.cer'):
            cert = load_pem_x509_certificate(data, default_backend())
        else:
            cert = load_der_x509_certificate(data, default_backend())
    elif encode_format == "PEM":
        cert = load_pem_x509_certificate(data, default_backend())
    elif encode_format == "DER":
        cert = load_der_x509_certificate(data, default_backend())
    else:
        log.error("Unknown file format")
        return None, 0
    cert_der = cert.public_bytes(Encoding.DER)
    cert_hex = binascii.hexlify(cert_der)
    key_int_list = transform_key_to_list(cert_hex)
    return key_int_list, len(key_int_list)


def hash_convert_raw(data, hash_algo=apis.kAlgorithm_SSS_SHA256):
    """
    Convert raw hash data using algorithm
    :param data: Input data
    :param hash_algo: Hash algorithm
    :return: Key in list format and length
    """
    hash_value = HASH_MAP[hash_algo][1]
    if isinstance(data, str):
        hash_value.update(str.encode(data))
    else:
        hash_value.update(data)
    key_hex = hash_value.hexdigest()
    key_int_list = transform_key_to_list(key_hex)
    hash_len = int(hash_value.digest_size)
    return key_int_list, hash_len


def parse_signature(signature_file, encode_format=""):
    """
    Parse signature from file
    :param signature_file: Input file
    :param encode_format: Stored encode format
    :return: Signature in list format and length
    """
    with open(signature_file, 'rb') as infile:
        sig = infile.read()
    if not is_hex(sig):
        if (signature_file[-4:] == '.pem' and encode_format == "") or encode_format == "PEM":
            sig_der = base64.b64decode(sig)
        else:
            sig_der = sig
        sig_hex = binascii.hexlify(sig_der)
    else:
        sig_hex = sig
    sig_int_list = transform_key_to_list(sig_hex)
    sig_len = len(sig_int_list)
    return sig_int_list, sig_len


def get_ecc_cypher_type(curve_type):
    """
    Return Cypher Type and Key length based on EC curve type
    :param curve_type: ECC Curve type
    :return: Cypher type and key length
    """
    ecc_curve_cypher_type_map = {
        # Mapping curve type with Cypher Type and Key length
        apis.kSE05x_ECCurve_NIST_P192: [apis.kSSS_CipherType_EC_NIST_P, 192],
        apis.kSE05x_ECCurve_NIST_P224: [apis.kSSS_CipherType_EC_NIST_P, 224],
        apis.kSE05x_ECCurve_NIST_P256: [apis.kSSS_CipherType_EC_NIST_P, 256],
        apis.kSE05x_ECCurve_NIST_P384: [apis.kSSS_CipherType_EC_NIST_P, 384],
        apis.kSE05x_ECCurve_NIST_P521: [apis.kSSS_CipherType_EC_NIST_P, 521],
        apis.kSE05x_ECCurve_Brainpool160: [apis.kSSS_CipherType_EC_BRAINPOOL, 160],
        apis.kSE05x_ECCurve_Brainpool192: [apis.kSSS_CipherType_EC_BRAINPOOL, 192],
        apis.kSE05x_ECCurve_Brainpool224: [apis.kSSS_CipherType_EC_BRAINPOOL, 224],
        apis.kSE05x_ECCurve_Brainpool256: [apis.kSSS_CipherType_EC_BRAINPOOL, 256],
        apis.kSE05x_ECCurve_Brainpool320: [apis.kSSS_CipherType_EC_BRAINPOOL, 320],
        apis.kSE05x_ECCurve_Brainpool384: [apis.kSSS_CipherType_EC_BRAINPOOL, 384],
        apis.kSE05x_ECCurve_Brainpool512: [apis.kSSS_CipherType_EC_BRAINPOOL, 512],
        apis.kSE05x_ECCurve_Secp160k1: [apis.kSSS_CipherType_EC_NIST_K, 160],
        apis.kSE05x_ECCurve_Secp192k1: [apis.kSSS_CipherType_EC_NIST_K, 192],
        apis.kSE05x_ECCurve_Secp224k1: [apis.kSSS_CipherType_EC_NIST_K, 224],
        apis.kSE05x_ECCurve_Secp256k1: [apis.kSSS_CipherType_EC_NIST_K, 256],
        apis.kSE05x_ECCurve_RESERVED_ID_ECC_ED_25519: [apis.kSSS_CipherType_EC_TWISTED_ED, 256],
        apis.kSE05x_ECCurve_RESERVED_ID_ECC_MONT_DH_25519: [apis.kSSS_CipherType_EC_MONTGOMERY, 256],
        apis.kSE05x_ECCurve_RESERVED_ID_ECC_MONT_DH_448: [apis.kSSS_CipherType_EC_MONTGOMERY, 448],
    }

    cypher_type = ecc_curve_cypher_type_map[curve_type][0]
    key_len = ecc_curve_cypher_type_map[curve_type][1]
    return cypher_type, key_len


def ecc_curve_type_from_key(key, key_part):
    """
    Returns curve type and key bit length for ecc key
    :param key: Input key
    :param key_part: Key type
    :return: Curve type and key bit length
    """
    key = binascii.unhexlify(key)
    curve_type = apis.kSE05x_ECCurve_NA
    key_bit_len = 0

    if key_part == apis.kSSS_KeyPart_Public:
        pub_key = load_der_public_key(key, default_backend())
        if hasattr(pub_key, 'curve'):
            curve_type = CRYPTO_ECC_CURVE_MAP[type(pub_key.curve)][0]
        if hasattr(pub_key, 'key_size'):
            key_bit_len = pub_key.key_size
        elif hasattr(pub_key, 'curve'):
            key_bit_len = CRYPTO_ECC_CURVE_MAP[type(pub_key.curve)][1]

    elif key_part == apis.kSSS_KeyPart_Pair:
        priv_key = load_der_private_key(key, None, default_backend())
        if hasattr(priv_key, 'curve'):
            curve_type = CRYPTO_ECC_CURVE_MAP[type(priv_key.curve)][0]
        if hasattr(priv_key, 'key_size'):
            key_bit_len = priv_key.key_size
        elif hasattr(priv_key, 'curve'):
            key_bit_len = CRYPTO_ECC_CURVE_MAP[type(priv_key.curve)][1]

    return curve_type, key_bit_len