/* Copyright 2020 NXP
 *
 * SPDX-License-Identifier: Apache-2.0
 */

/* ************************************************************************** */
/* Includes                                                                   */
/* ************************************************************************** */

#include <ex_sss.h>
#include <ex_sss_auth.h>
#include <ex_sss_boot.h>
#include <fsl_sss_se05x_apis.h>
#include <nxEnsure.h>
#include <nxLog_App.h>
#include <se05x_APDU_apis.h>
#include <se05x_ReadWithAttestation.h>
#include <se05x_enums.h>

/* ************************************************************************** */
/* Local Defines                                                              */
/* ************************************************************************** */
#define EC_KEY_BIT_LEN 256

#if (SSS_HAVE_SE05X_AUTH_USERID) || (SSS_HAVE_SE05X_AUTH_USERID_PLATFSCP03) //UserID Session
#define EX_LOCAL_OBJ_AUTH_ID EX_SSS_AUTH_SE05X_UserID_AUTH_ID
#elif (SSS_HAVE_SE05X_AUTH_NONE) || (SSS_HAVE_SE05X_AUTH_PLATFSCP03) //No auth
#define EX_LOCAL_OBJ_AUTH_ID EX_SSS_AUTH_SE05X_NONE_AUTH_ID
#elif (SSS_HAVE_SE05X_AUTH_AESKEY) || (SSS_HAVE_SE05X_AUTH_AESKEY_PLATFSCP03) //AESKey
#define EX_LOCAL_OBJ_AUTH_ID EX_SSS_AUTH_SE05X_APPLETSCP_AUTH_ID
#elif (SSS_HAVE_SE05X_AUTH_ECKEY) || (SSS_HAVE_SE05X_AUTH_ECKEY_PLATFSCP03) //ECKey session
#define EX_LOCAL_OBJ_AUTH_ID EX_SSS_AUTH_SE05X_ECKEY_ECDSA_AUTH_ID
#endif

#define AUTHENTICATION_OBJ_ATTR_POLICYLEN_OFFSET  14
#define KEYOBJ_VERSION_LENGTH  4

/* ************************************************************************** */
/* Structures and Typedefs                                                    */
/* ************************************************************************** */


typedef struct authObj_attributes
{
    uint16_t auth_attempts_cntr;
    uint16_t max_auth_attempts_cntr;
} authObj_attributes_t;

typedef struct non_authObj_attributes
{
    uint16_t min_tagLen_for_AEAD;
    uint16_t rfu;
} non_authObj_attributes_t;

typedef  union attr {
    authObj_attributes_t authObjAttr;
    non_authObj_attributes_t nonAuthObjAttr;
} attr_u;

typedef struct ObjAttr {
    uint32_t object_id;
    SE05x_SecObjTyp_t object_type;
    SE05x_SetIndicator_t auth_attr;
    attr_u attr;
    uint32_t auth_obj_id_owner;
    SE05x_Origin_t object_origin;
    uint32_t object_version;
} ObjAttr_t;

/* ************************************************************************** */
/* Global Variables                                                           */
/* ************************************************************************** */

static ex_sss_boot_ctx_t gex_sss_attst_read_boot_ctx;

/* ************************************************************************** */
/* Static function declarations                                               */
/* ************************************************************************** */

/* ************************************************************************** */
/* Private Functions                                                          */
/* ************************************************************************** */
static sss_status_t create_attestation_key(ex_sss_boot_ctx_t *pCtx, size_t keyBitLen);
static sss_status_t create_object_to_attest(ex_sss_boot_ctx_t *pCtx);
static void log_attribute_type(const SE05x_SecObjTyp_t type);
static void log_attribute_auth(const SE05x_SetIndicator_t auth);
static void log_attribute_access_rule(uint32_t ar_header);
static void log_attribute_origin(const SE05x_Origin_t origin);
sss_status_t read_large_object_with_attestation(ex_sss_boot_ctx_t *pCtx,
    sss_se05x_key_store_t *keyStore,
    sss_se05x_object_t *keyObject,
    uint8_t *key,
    size_t *keylen,
    size_t *pKeyBitLen,
    sss_se05x_object_t *keyObject_attst,
    sss_algorithm_t algorithm_attst,
    uint8_t *random_attst,
    size_t randomLen_attst,
    sss_se05x_attst_data_t *attst_data);
static sss_status_t create_host_public_key(
    ex_sss_boot_ctx_t *pCtx, uint32_t keyId, size_t keyBitLen, sss_object_t *verification_object);
static void clean_attestation_objects(ex_sss_boot_ctx_t *pCtx, uint32_t attestation_key_id, uint32_t keyid_to_attest);
/* ************************************************************************** */
/* Public Functions                                                           */
/* ************************************************************************** */

#define EX_SSS_BOOT_PCONTEXT (&gex_sss_attst_read_boot_ctx)
#define EX_SSS_BOOT_DO_ERASE 1
#define EX_SSS_BOOT_EXPOSE_ARGC_ARGV 0

#include <ex_sss_main_inc.h>

sss_status_t ex_sss_entry(ex_sss_boot_ctx_t *pCtx)
{
    LOG_I("Running example se05x_ReadWithAttestation");

    sss_status_t status = kStatus_SSS_Success;
    uint8_t obj[2500]   = {0};
    size_t objByteLen   = sizeof(obj);
    size_t objBitLen    = objByteLen * 8;
    sss_object_t sss_object_to_attest;
    sss_object_t sss_attestation_object;
    sss_algorithm_t algorithm = kAlgorithm_SSS_ECDSA_SHA256;
    uint32_t auth_obj         = 0;

    /* Variables for verification */
    sss_object_t verification_object = {0};
    uint8_t plainData[2500]          = {0};
    size_t plainDataLen              = sizeof(plainData);
    uint8_t digest[64]               = {0};
    size_t digestLen                 = sizeof(digest);
    sss_digest_t digest_ctx;
    sss_algorithm_t digest_algorithm = kAlgorithm_SSS_SHA256;
    sss_asymmetric_t verify_ctx;
    uint8_t datai  = 0;
    uint8_t *att   = NULL;
    uint8_t i = 0;
    size_t attr_Len = 0;
    uint8_t attr_Cnt = 0;
    //uint8_t attr_policyLen =0;

    /* doc:start:read-w-attestation */
    /* Prepare/init attestation data structure */

    sss_se05x_attst_comp_data_t comp_data[2] = {0};
    sss_se05x_attst_data_t att_data          = {.valid_number = 2};
    /* Random data from the host to check if SE
     * answers to current attestation request and
     * not an older response is used */

    /* clang-format off */
    uint8_t freshness[16] = { 0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c,0x0d,0x0e,0x0f };
    /* doc:end:read-w-attestation */
    /* Generate Random Attestation key
     * We use NIST-P 256 in this example
     */
    status = create_attestation_key(pCtx, EC_KEY_BIT_LEN);
    ENSURE_OR_GO_CLEANUP(status == kStatus_SSS_Success);

    status = create_host_public_key(
        pCtx, ATTESTATION_KEY_ID, EC_KEY_BIT_LEN, &verification_object);
    ENSURE_OR_GO_CLEANUP(status == kStatus_SSS_Success);

    /* Import any object into the SE which will be
     * read with attestation. In this example, we are
     * importing a binary objecct
     */
    status = create_object_to_attest(pCtx);
    ENSURE_OR_GO_CLEANUP(status == kStatus_SSS_Success);

    /* Initialize Attesttation Object */
    status = sss_key_object_init(&sss_attestation_object, &pCtx->ks);
    ENSURE_OR_GO_CLEANUP(status == kStatus_SSS_Success);

    status =
        sss_key_object_get_handle(&sss_attestation_object, ATTESTATION_KEY_ID);
    ENSURE_OR_GO_CLEANUP(status == kStatus_SSS_Success);

    /* Initialize object to attest */
    status = sss_key_object_init(&sss_object_to_attest, &pCtx->ks);
    ENSURE_OR_GO_CLEANUP(status == kStatus_SSS_Success);

    status = sss_key_object_get_handle(&sss_object_to_attest, OBJECT_KEY_ID);
    ENSURE_OR_GO_CLEANUP(status == kStatus_SSS_Success);

    /* doc:start:read-w-attestation */
    memcpy(&att_data.data, &comp_data[0], sizeof(comp_data));
    att_data.data[0].attributeLen = sizeof(att_data.data[0].attribute);
    att_data.data[0].outrandomLen = sizeof(att_data.data[0].outrandom);
    att_data.data[0].chipIdLen = sizeof(att_data.data[0].attribute);
    att_data.data[0].signatureLen = sizeof(att_data.data[0].signature);
    att_data.data[1].attributeLen = sizeof(att_data.data[1].attribute);
    att_data.data[1].outrandomLen = sizeof(att_data.data[1].outrandom);
    att_data.data[1].chipIdLen = sizeof(att_data.data[1].attribute);
    att_data.data[1].signatureLen = sizeof(att_data.data[1].signature);

    /* clang-format on */

    /* Execute attested read
     * We use attestation object to attest (sign) all read data + object attributes
     * Returns object attributes and signature in att_data
     */

    status = sss_se05x_key_store_get_key_attst((sss_se05x_key_store_t *)&pCtx->ks,
        (sss_se05x_object_t *)&sss_object_to_attest,
        obj,
        &objByteLen,
        &objBitLen,
        (sss_se05x_object_t *)&sss_attestation_object,
        algorithm,
        freshness,
        sizeof(freshness),
        &att_data);
    ENSURE_OR_GO_CLEANUP(status == kStatus_SSS_Success);

    /* Perform verification operation here on the following data
     *      (key + offset) +
     *      att_data->data[0].attribute +
     *      att_data->data[0].timestamp +
     *      att_data->data[0].outrandom +
     *      att_data->data[0].chipId
     * with signature
     *      att_data->data[0].signature
     *
     * We perform signature verification on host.
     * First we digest the data then pass it to verify API
     */

    memcpy(plainData, obj, objByteLen);
    memcpy(plainData + objByteLen, att_data.data[0].attribute, att_data.data[0].attributeLen);
    memcpy(plainData + objByteLen + att_data.data[0].attributeLen,
        &(att_data.data[0].timeStamp),
        att_data.data[0].timeStampLen);
    memcpy(plainData + objByteLen + att_data.data[0].attributeLen + att_data.data[0].timeStampLen,
        att_data.data[0].outrandom,
        att_data.data[0].outrandomLen);
    memcpy(plainData + objByteLen + att_data.data[0].attributeLen + att_data.data[0].timeStampLen +
               att_data.data[0].outrandomLen,
        att_data.data[0].chipId,
        att_data.data[0].chipIdLen);
    plainDataLen = objByteLen + att_data.data[0].attributeLen + att_data.data[0].timeStampLen +
                   att_data.data[0].outrandomLen + att_data.data[0].chipIdLen;

    status = sss_digest_context_init(&digest_ctx, &pCtx->host_session, digest_algorithm, kMode_SSS_Digest);
    ENSURE_OR_GO_CLEANUP(status == kStatus_SSS_Success);

    status = sss_digest_one_go(&digest_ctx, plainData, plainDataLen, digest, &digestLen);
    ENSURE_OR_GO_CLEANUP(status == kStatus_SSS_Success);

    sss_digest_context_free(&digest_ctx);

    /* Verify signature */
    sss_asymmetric_context_init(&verify_ctx, &pCtx->host_session, &verification_object, algorithm, kMode_SSS_Verify);

    status = sss_asymmetric_verify_digest(
        &verify_ctx, digest, digestLen, att_data.data[0].signature, att_data.data[0].signatureLen);

    sss_asymmetric_context_free(&verify_ctx);

    ENSURE_OR_GO_CLEANUP(status == kStatus_SSS_Success);
    /* doc:end:read-w-attestation */

    /* Only look at first part of attested data
     * object-type-dependend further parts contain same policy data */
    LOG_MAU8_D("Key att content", obj, objByteLen);
    LOG_MAU8_I("Key att data", (uint8_t *)att_data.data[datai].attribute, att_data.data[datai].attributeLen);

    att = (uint8_t *)att_data.data[datai].attribute;
    ObjAttr_t attrib = { 0 };
    attr_Len = att_data.data[datai].attributeLen;


    attrib.object_id                 = (uint32_t)att[attr_Cnt] << 24 | att[attr_Cnt + 1] << 16 | \
                                   att[attr_Cnt + 2] << 8 | att[attr_Cnt + 3] << 0;
    attr_Cnt += 4;
    attrib.object_type               = att[attr_Cnt++];
    attrib.auth_attr               = att[attr_Cnt++];

    LOG_I("Object Id 0x%04X", attrib.object_id);
    LOG_I("Object Type  0x%X", attrib.object_type);
    /* Log object type */
    log_attribute_type(attrib.object_type);
    LOG_I("Object Auth Attribute  0x%X", attrib.auth_attr);
    /* Log Object Auth Attribute */
    log_attribute_auth(attrib.auth_attr);

    i = AUTHENTICATION_OBJ_ATTR_POLICYLEN_OFFSET;
    //attr_policyLen = att[i];

    /* Check for existing policies and loop over them to log */
    while (att[i] >= 4) {
        uint8_t ar_length = att[i++];
        if ((ar_length < 4) | (ar_length > 40))
            LOG_E("Access rule header invalid length 0X%02X", ar_length);

        auth_obj = (uint32_t)att[i] << 24 | att[i + 1] << 16 | att[i + 2] << 8 | att[i + 3];
        LOG_I("Auth Object:");
        if (auth_obj == 0) {
            LOG_I("\tNo authentication required");
        }
        else {
            LOG_I("\tAuthentication required");
            LOG_I("\t0x%08X", auth_obj);
        }

        i += 4;

        uint32_t ar_header = (uint32_t)att[i] << 24 | att[i + 1] << 16 | att[i + 2] << 8 | att[i + 3];
        i += 4;

        /* Log Access Rules (Policies) associated with the object */
        log_attribute_access_rule(ar_header);

        /* Print AR extension for POLICY_OBJ_REQUIRE_PCR_VALUE */
        if (ar_length > 4) {
            if (ar_header & POLICY_OBJ_REQUIRE_PCR_VALUE) {
                LOG_MAU8_I("AR Extension: ", att + i + 4, ar_length - 4);
                i += ar_length;
            }
        }
    }

    /* Parse origin flag */
    attrib.object_origin = att[i++];

    if (i == attr_Len)
    {   /*Data is retrieved for Se050*/
        attrib.attr.authObjAttr.auth_attempts_cntr = (uint16_t)att[attr_Cnt] << 8 | att[attr_Cnt + 1];
        attr_Cnt += 2;
        attrib.auth_obj_id_owner = (uint32_t)att[attr_Cnt] << 24 | att[attr_Cnt + 1] << 16 | \
            att[attr_Cnt + 2] << 8 | att[attr_Cnt + 3] << 0;
        attr_Cnt += 4;
        attrib.attr.authObjAttr.max_auth_attempts_cntr = (uint16_t)att[attr_Cnt] << 8 |\
                                                          att[attr_Cnt + 1];
        attr_Cnt += 2;
        if (attr_Cnt == AUTHENTICATION_OBJ_ATTR_POLICYLEN_OFFSET)
        {
            //origin needs to be filled and printed
            log_attribute_origin(attrib.object_origin);
            status = kStatus_SSS_Success;
        }
    }
    else
    {
        attrib.object_version = att[i] << 24 | att[i + 1] << 16 | att[i + 2] << 8 | att[i + 3];
        i += KEYOBJ_VERSION_LENGTH;
        if (i == attr_Len)
        {   /*Data is retrieved for Se051*/
            if (attrib.auth_attr == kSE05x_SetIndicator_NOT_SET || attrib.auth_attr == kSE05x_SetIndicator_SET)
            {
                if (attrib.auth_attr == kSE05x_SetIndicator_NOT_SET)
                {
                    attrib.attr.nonAuthObjAttr.min_tagLen_for_AEAD = (uint16_t)att[attr_Cnt] << 8 | att[attr_Cnt + 1];
                    attr_Cnt += 2;
                    attrib.auth_obj_id_owner = (uint32_t)att[attr_Cnt] << 24 | att[attr_Cnt + 1] << 16 | \
                        att[attr_Cnt + 2] << 8 | att[attr_Cnt + 3] << 0;
                    attr_Cnt += 4;
                    attrib.attr.nonAuthObjAttr.rfu = (uint16_t)att[attr_Cnt] << 8 | \
                        att[attr_Cnt + 1];

                    /* Log min tagLen for AEAD obj*/
                    LOG_I("tagLen for AEAD:0x%02X", attrib.attr.nonAuthObjAttr.min_tagLen_for_AEAD);
                    /* Log RFU bytes*/
                    LOG_I("RFU bytes:0x%02X", attrib.attr.nonAuthObjAttr.rfu);

                }
                else if (attrib.auth_attr == kSE05x_SetIndicator_SET)
                {
                    attrib.attr.authObjAttr.auth_attempts_cntr = (uint16_t)att[attr_Cnt] << 8 | att[attr_Cnt + 1];
                    attr_Cnt += 2;
                    attrib.auth_obj_id_owner = (uint32_t)att[attr_Cnt] << 24 | att[attr_Cnt + 1] << 16 | \
                        att[attr_Cnt + 2] << 8 | att[attr_Cnt + 3] << 0;
                    attr_Cnt += 4;
                    attrib.attr.authObjAttr.max_auth_attempts_cntr = (uint16_t)att[attr_Cnt] << 8 | \
                        att[attr_Cnt + 1];
                    /* Log Auth attempts cntr*/
                    LOG_I("Auth attempts cntr:0x%02X", attrib.attr.authObjAttr.auth_attempts_cntr);
                    /* Log Max auth attempts cntr*/
                    LOG_I("Max auth attempts cntr:0x%02X", attrib.attr.authObjAttr.max_auth_attempts_cntr);
                }
                attr_Cnt += 2;
                if (attr_Cnt == AUTHENTICATION_OBJ_ATTR_POLICYLEN_OFFSET)
                {
                    /* Log object id owner*/
                    LOG_I("Owner:0x%04X", attrib.auth_obj_id_owner);
                    /* Log object origin*/
                    LOG_I("Object origin : 0x%X", attrib.object_origin);
                    log_attribute_origin(attrib.object_origin);
                    /* Log object version*/
                    LOG_I("Object Version : 0x%04X", attrib.object_version);
                    status = kStatus_SSS_Success;
                }

            }
            else
            {
                status = kStatus_SSS_Fail;
            }
        }
        else
        {
            status = kStatus_SSS_Fail;
        }
    }

    if (kStatus_SSS_Success == status) {
        LOG_I("se05x_ReadWithAttestation Example Success !!!");
    }
    else {
        LOG_E("se05x_ReadWithAttestation Example Failed !!!");
    }
cleanup:
    clean_attestation_objects(pCtx, ATTESTATION_KEY_ID, OBJECT_KEY_ID);
    sss_key_object_free(&verification_object);
    return status;
}

static sss_status_t create_attestation_key(ex_sss_boot_ctx_t *pCtx, size_t keyBitLen)
{
    sss_status_t status          = kStatus_SSS_Fail;
    size_t keylen                = keyBitLen / 8;
    uint32_t keyId               = ATTESTATION_KEY_ID;
    sss_object_t key_attst       = {0};
    sss_cipher_type_t cipherType = kSSS_CipherType_EC_NIST_P;

    const sss_policy_u key_pol     = {.type = KPolicy_Asym_Key,
        .auth_obj_id                    = EX_LOCAL_OBJ_AUTH_ID,
        .policy                         = {.asymmkey = {
                       .can_Sign          = 1,
                       .can_Verify        = 1,
                       .can_Encrypt       = 1,
                       .can_Decrypt       = 1,
                       .can_KD            = 1,
                       .can_Wrap          = 1,
                       .can_Write         = 1,
                       .can_Gen           = 1,
                       .can_Import_Export = 1,
                       .can_KA            = 1,
                       .can_Read          = 1,
                       .can_Attest        = 1,
                   }}};
    const sss_policy_u common      = {.type = KPolicy_Common,
        .auth_obj_id                   = EX_LOCAL_OBJ_AUTH_ID,
        .policy                        = {.common = {
                       .can_Delete = 1,
                   }}};
    sss_policy_t policy_for_ec_key = {.nPolicies = 2, .policies = {&key_pol, &common}};

    status = sss_key_object_init(&key_attst, &pCtx->ks);
    ENSURE_OR_GO_CLEANUP(status == kStatus_SSS_Success);

    /* Generate asymmetric key */
    status = sss_key_object_allocate_handle(
        &key_attst, keyId, kSSS_KeyPart_Pair, cipherType, keylen, kKeyObject_Mode_Persistent);
    ENSURE_OR_GO_CLEANUP(status == kStatus_SSS_Success);

    status = sss_key_store_generate_key(&pCtx->ks, &key_attst, keyBitLen, &policy_for_ec_key);
    ENSURE_OR_GO_CLEANUP(status == kStatus_SSS_Success);

cleanup:
    return status;
}

static sss_status_t create_host_public_key(
    ex_sss_boot_ctx_t *pCtx, uint32_t keyId, size_t keyBitLen, sss_object_t *verification_object)
{
    sss_status_t status          = kStatus_SSS_Fail;
    sss_object_t attestation_key = {0};
    uint8_t public_key[100]      = {0};
    size_t public_key_len        = sizeof(public_key);

    status = sss_key_object_init(&attestation_key, &pCtx->ks);
    ENSURE_OR_GO_CLEANUP(status == kStatus_SSS_Success);

    status = sss_key_object_get_handle(&attestation_key, keyId);
    ENSURE_OR_GO_CLEANUP(status == kStatus_SSS_Success);

    status = sss_key_store_get_key(&pCtx->ks, &attestation_key, public_key, &public_key_len, &keyBitLen);
    ENSURE_OR_GO_CLEANUP(status == kStatus_SSS_Success);

    status = sss_key_object_init(verification_object, &pCtx->host_ks);
    ENSURE_OR_GO_CLEANUP(status == kStatus_SSS_Success);

    status = sss_key_object_allocate_handle(verification_object,
        __LINE__,
        kSSS_KeyPart_Public,
        attestation_key.cipherType,
        public_key_len,
        kKeyObject_Mode_Persistent);
    ENSURE_OR_GO_CLEANUP(status == kStatus_SSS_Success);

    status = sss_key_store_set_key(&pCtx->host_ks, verification_object, public_key, public_key_len, keyBitLen, NULL, 0);

cleanup:
    return status;
}

static sss_status_t create_object_to_attest(ex_sss_boot_ctx_t *pCtx)
{
    sss_status_t status           = kStatus_SSS_Fail;
    sss_object_t object_to_attest = {0};
    sss_key_part_t key_part       = kSSS_KeyPart_Default;
    sss_cipher_type_t cipherType  = kSSS_CipherType_Binary;
    uint8_t data[]                = OBJECT_TO_ATTEST;
    size_t dataLen                = sizeof(data);
    uint32_t keyId                = OBJECT_KEY_ID;

    const sss_policy_u obj_pol      = {.type = KPolicy_File,
        .auth_obj_id                    = EX_LOCAL_OBJ_AUTH_ID,
        .policy                         = {.file = {
                       .can_Write = 1,
                       .can_Read  = 1,
                   }}};
    const sss_policy_u common       = {.type = KPolicy_Common,
        .auth_obj_id                   = EX_LOCAL_OBJ_AUTH_ID,
        .policy                        = {.common = {
                       .can_Delete = 1,
                   }}};
    sss_policy_t policy_for_bin_obj = {.nPolicies = 2, .policies = {&obj_pol, &common}};

    status = sss_key_object_init(&object_to_attest, &pCtx->ks);
    ENSURE_OR_GO_CLEANUP(status == kStatus_SSS_Success);

    /* Generate asymmetric key */
    status = sss_key_object_allocate_handle(
        &object_to_attest, keyId, key_part, cipherType, dataLen, kKeyObject_Mode_Persistent);
    ENSURE_OR_GO_CLEANUP(status == kStatus_SSS_Success);

    status = sss_key_store_set_key(
        &pCtx->ks, &object_to_attest, data, dataLen, dataLen, &policy_for_bin_obj, sizeof(policy_for_bin_obj));

cleanup:
    return status;
}

static void log_attribute_type(const SE05x_SecObjTyp_t type)
{
    LOG_I("Type:");
    switch (type) {
    case kSE05x_SecObjTyp_EC_KEY_PAIR:
        LOG_I("\tEC_KEY_PAIR");
        break;
    case kSE05x_SecObjTyp_EC_PRIV_KEY:
        LOG_I("\tEC_PRIV_KEY");
        break;
    case kSE05x_SecObjTyp_EC_PUB_KEY:
        LOG_I("\tEC_PUB_KEY");
        break;
    case kSE05x_SecObjTyp_RSA_KEY_PAIR:
        LOG_I("\tRSA_KEY_PAIR");
        break;
    case kSE05x_SecObjTyp_RSA_KEY_PAIR_CRT:
        LOG_I("\tRSA_KEY_PAIR_CRT");
        break;
    case kSE05x_SecObjTyp_RSA_PRIV_KEY:
        LOG_I("\tRSA_PRIV_KEY");
        break;
    case kSE05x_SecObjTyp_RSA_PRIV_KEY_CRT:
        LOG_I("\tRSA_PRIV_KEY_CRT");
        break;
    case kSE05x_SecObjTyp_RSA_PUB_KEY:
        LOG_I("\tRSA_PUB_KEY");
        break;
    case kSE05x_SecObjTyp_AES_KEY:
        LOG_I("\tAES_KEY");
        break;
    case kSE05x_SecObjTyp_DES_KEY:
        LOG_I("\tDES_KEY");
        break;
    case kSE05x_SecObjTyp_BINARY_FILE:
        LOG_I("\tBINARY_FILE");
        break;
    case kSE05x_SecObjTyp_UserID:
        LOG_I("\tUserID");
        break;
    case kSE05x_SecObjTyp_COUNTER:
        LOG_I("\tCOUNTER");
        break;
    case kSE05x_SecObjTyp_PCR:
        LOG_I("\tPCR_KEY_PAIR");
        break;
    case kSE05x_SecObjTyp_CURVE:
        LOG_I("\tCURVE");
        break;
    case kSE05x_SecObjTyp_HMAC_KEY:
        LOG_I("\tHMAC_KEY");
        break;
    default:
        LOG_E("Unknown secure object type\n");
    }
}

static void log_attribute_auth(const SE05x_SetIndicator_t auth)
{
    LOG_I("Auth:");
    switch (auth) {
    case kSE05x_SetIndicator_NOT_SET:
        LOG_I("\tNot Set");
        break;
    case kSE05x_SetIndicator_SET:
        LOG_I("\tSet");
        break;
    default:
        LOG_E("not allwed set indicator in object attribute\n");
    }
}

static void log_attribute_origin(const SE05x_Origin_t origin)
{
    LOG_I("Origin:");
    switch (origin) {
    case kSE05x_Origin_INTERNAL:
        LOG_I("\tINTERNAL");
        break;
    case kSE05x_Origin_EXTERNAL:
        LOG_I("\tEXTERNAL");
        break;
    case kSE05x_Origin_PROVISIONED:
        LOG_I("\tPROVISIONED");
        break;
    case kSE05x_Origin_NA:
    default:
        LOG_E("\tORIGIN INVALID");
    }
}

static void log_attribute_access_rule(uint32_t ar_header)
{
    LOG_I("Policies:");
    if (ar_header & POLICY_OBJ_FORBID_ALL) {
        LOG_I("\tPOLICY_OBJ_FORBID_ALL");
    };
    if (ar_header & POLICY_OBJ_ALLOW_SIGN) {
        LOG_I("\tPOLICY_OBJ_ALLOW_SIGN");
    };
    if (ar_header & POLICY_OBJ_ALLOW_VERIFY) {
        LOG_I("\tPOLICY_OBJ_ALLOW_VERIFY");
    };
    if (ar_header & POLICY_OBJ_ALLOW_KA) {
        LOG_I("\tPOLICY_OBJ_ALLOW_KA");
    };
    if (ar_header & POLICY_OBJ_ALLOW_ENC) {
        LOG_I("\tPOLICY_OBJ_ALLOW_ENC");
    };
    if (ar_header & POLICY_OBJ_ALLOW_DEC) {
        LOG_I("\tPOLICY_OBJ_ALLOW_DEC");
    };
    if (ar_header & POLICY_OBJ_ALLOW_KDF) {
        LOG_I("\tPOLICY_OBJ_ALLOW_KDF");
    };
    if (ar_header & POLICY_OBJ_ALLOW_WRAP) {
        LOG_I("\tPOLICY_OBJ_ALLOW_WRAP");
    };
    if (ar_header & POLICY_OBJ_ALLOW_READ) {
        LOG_I("\tPOLICY_OBJ_ALLOW_READ");
    };
    if (ar_header & POLICY_OBJ_ALLOW_WRITE) {
        LOG_I("\tPOLICY_OBJ_ALLOW_WRITE");
    };
    if (ar_header & POLICY_OBJ_ALLOW_GEN) {
        LOG_I("\tPOLICY_OBJ_ALLOW_GEN");
    };
    if (ar_header & POLICY_OBJ_ALLOW_DELETE) {
        LOG_I("\tPOLICY_OBJ_ALLOW_DELETE");
    };
    if (ar_header & POLICY_OBJ_REQUIRE_SM) {
        LOG_I("\tPOLICY_OBJ_REQUIRE_SM");
    };
    if (ar_header & POLICY_OBJ_REQUIRE_PCR_VALUE) {
        LOG_I("\tPOLICY_OBJ_REQUIRE_PCR_VALUE");
    };
    if (ar_header & POLICY_OBJ_ALLOW_ATTESTATION) {
        LOG_I("\tPOLICY_OBJ_ALLOW_ATTESTATION");
    };
    if (ar_header & POLICY_OBJ_ALLOW_DESFIRE_AUTHENTICATION) {
        LOG_I("\tPOLICY_OBJ_ALLOW_DESFIRE_AUTHENTICATION");
    };
    if (ar_header & POLICY_OBJ_ALLOW_DESFIRE_DUMP_SESSION_KEYS) {
        LOG_I("\tPOLICY_OBJ_ALLOW_DESFIRE_DUMP_SESSION_KEYS");
    };
    if (ar_header & POLICY_OBJ_ALLOW_IMPORT_EXPORT) {
        LOG_I("\tOLICY_OBJ_ALLOW_IMPORT_EXPORT");
    };
}

static void clean_attestation_objects(ex_sss_boot_ctx_t *pCtx, uint32_t attestation_key_id, uint32_t keyid_to_attest)
{
    sss_status_t status           = kStatus_SSS_Fail;
    sss_object_t object_to_delete = {0};
    status                        = sss_key_object_init(&object_to_delete, &pCtx->ks);
    ENSURE_OR_GO_EXIT(status == kStatus_SSS_Success);
    /* Delete attestation object */
    status = sss_key_object_get_handle(&object_to_delete, attestation_key_id);
    ENSURE_OR_GO_EXIT(status == kStatus_SSS_Success);
    status = sss_key_store_erase_key(&pCtx->ks, &object_to_delete);
    ENSURE_OR_GO_EXIT(status == kStatus_SSS_Success);
    /* Delete object to attest */
    status = sss_key_object_get_handle(&object_to_delete, keyid_to_attest);
    ENSURE_OR_GO_EXIT(status == kStatus_SSS_Success);
    status = sss_key_store_erase_key(&pCtx->ks, &object_to_delete);

exit:
    return;
}

/* doc:start:read-large-binary-obj-w-attestation */
sss_status_t read_large_object_with_attestation(ex_sss_boot_ctx_t *pCtx,
    sss_se05x_key_store_t *keyStore,
    sss_se05x_object_t *keyObject,
    uint8_t *key,
    size_t *keylen,
    size_t *pKeyBitLen,
    sss_se05x_object_t *keyObject_attst,
    sss_algorithm_t algorithm_attst,
    uint8_t *random_attst,
    size_t randomLen_attst,
    sss_se05x_attst_data_t *attst_data)
{
    smStatus_t status       = SM_NOT_OK;
    sss_status_t sss_status = kStatus_SSS_Fail;
    uint16_t rem_data       = 0;
    uint16_t offset         = 0;
    uint16_t size           = 0;
    size_t max_buffer       = 0;
    size_t signatureLen     = 0;
    uint32_t attestID;
    SE05x_AttestationAlgo_t attestAlgo = kSE05x_AttestationAlgo_EC_SHA_256;
    attestID                           = keyObject_attst->keyId;
    /* Variables for verification */
    sss_object_t verification_object = {0};
    uint8_t plainData[2500]          = {0};
    size_t plainDataLen              = sizeof(plainData);
    uint8_t digest[64]               = {0};
    size_t digestLen                 = sizeof(digest);
    sss_digest_t digest_ctx;
    sss_algorithm_t algorithm        = kAlgorithm_SSS_ECDSA_SHA256;
    sss_algorithm_t digest_algorithm = kAlgorithm_SSS_SHA256;
    sss_asymmetric_t verify_ctx;

    if (kStatus_SSS_Success != create_host_public_key(pCtx, attestID, EC_KEY_BIT_LEN, &verification_object)) {
        goto cleanup;
    }

    status = Se05x_API_ReadSize(&keyStore->session->s_ctx, keyObject->keyId, &size);
    ENSURE_OR_GO_CLEANUP(status == SM_OK);

    if (*keylen < size) {
        LOG_E("Insufficient buffer ");
        goto cleanup;
    }

    rem_data = size;
    *keylen  = size;
    while (rem_data > 0) {
        uint16_t chunk = (rem_data > BINARY_WRITE_MAX_LEN) ? BINARY_WRITE_MAX_LEN : rem_data;
        rem_data       = rem_data - chunk;
        max_buffer     = chunk;

        signatureLen                     = attst_data->data[0].signatureLen;
        attst_data->data[0].timeStampLen = sizeof(SE05x_TimeStamp_t);
        status                           = Se05x_API_ReadObject_W_Attst(&keyStore->session->s_ctx,
            keyObject->keyId,
            offset,
            chunk,
            attestID,
            attestAlgo,
            random_attst,
            randomLen_attst,
            (key + offset),
            &max_buffer,
            attst_data->data[0].attribute,
            &(attst_data->data[0].attributeLen),
            &(attst_data->data[0].timeStamp),
            attst_data->data[0].outrandom,
            &(attst_data->data[0].outrandomLen),
            attst_data->data[0].chipId,
            &(attst_data->data[0].chipIdLen),
            attst_data->data[0].signature,
            &signatureLen);

        attst_data->data[0].signatureLen -= signatureLen;
        attst_data->valid_number = 1;

        ENSURE_OR_GO_CLEANUP(status == SM_OK);

        /* Perform verification operation here on the following data
         *      (key + offset) +
         *      attst_data->data[0].attribute +
         *      attst_data->data[0].timestamp +
         *      attst_data->data[0].outrandom +
         *      attst_data->data[0].chipId
         * with signature
         *      attst_data->data[0].signature
         *
         * We perform signature verification on host.
         * First we digest the data then pass it to verify API
         */

        memcpy(plainData, (key + offset), max_buffer);
        memcpy(plainData + max_buffer, attst_data->data[0].attribute, attst_data->data[0].attributeLen);
        memcpy(plainData + max_buffer + attst_data->data[0].attributeLen,
            &(attst_data->data[0].timeStamp),
            attst_data->data[0].timeStampLen);
        memcpy(plainData + max_buffer + attst_data->data[0].attributeLen + attst_data->data[0].timeStampLen,
            attst_data->data[0].outrandom,
            attst_data->data[0].outrandomLen);
        memcpy(plainData + max_buffer + attst_data->data[0].attributeLen + attst_data->data[0].timeStampLen +
                   attst_data->data[0].outrandomLen,
            attst_data->data[0].chipId,
            attst_data->data[0].chipIdLen);
        plainDataLen = max_buffer + attst_data->data[0].attributeLen + attst_data->data[0].timeStampLen +
                       attst_data->data[0].outrandomLen + attst_data->data[0].chipIdLen;

        sss_status = sss_digest_context_init(&digest_ctx, &pCtx->host_session, digest_algorithm, kMode_SSS_Digest);
        ENSURE_OR_GO_CLEANUP(sss_status == kStatus_SSS_Success);

        sss_status = sss_digest_one_go(&digest_ctx, plainData, plainDataLen, digest, &digestLen);
        ENSURE_OR_GO_CLEANUP(sss_status == kStatus_SSS_Success);

        sss_digest_context_free(&digest_ctx);

        /* Verify signature */
        sss_asymmetric_context_init(
            &verify_ctx, &pCtx->host_session, &verification_object, algorithm, kMode_SSS_Verify);

        sss_status =
            sss_asymmetric_verify_digest(&verify_ctx, digest, digestLen, attst_data->data[0].signature, signatureLen);

        sss_asymmetric_context_free(&verify_ctx);

        ENSURE_OR_GO_CLEANUP(sss_status == kStatus_SSS_Success);

        offset = offset + chunk;
    }

cleanup:
    return sss_status;
}
/* doc:end:read-large-binary-obj-w-attestation */