{% extends "base.html" %}
{% block my_first_block %}
<h1>Press F12 to open the console before proceeding</h1>
  <select name="groups" size="8" id="groups">
    <option selected="selected" value="special">special</option>
    <option value="modp768">modp768</option>
    <option value="modp1024">modp1024</option>
    <option value="modp1536">modp1536</option>
    <option value="modp2048">modp2048</option>
    <option value="modp3072">modp3072</option>
    <option value="modp4096">modp4096</option>
    <option value="modp6144">modp6144</option>
    <option value="modp8192">modp8192</option>
  </select>
  <br>
  <input type="submit" id="press" value="Send Group">
  <br>
  <p>Input number of trustees (4 by default)</p>
  <input type="text" id="field1" name="trustees" disabled=True>
  <input type="submit" id="to_press" disabled=True value="Generate keys">
  <br>
  <p>Input number of voters (4 by default)</p>
  <input type="text" id="field2" name="voters" disabled=True>
  <input type="submit" id="to_press2" disabled=True value="Send the votes">
  <br>
  <input type="submit" id="to_press3" disabled=True value="Compute decryption factors">
  <br>
  <input type="submit" id="to_press4" disabled=True value="Get results">
  <br>
  <input type="submit" id="again" disabled=True value="Try again?">
  <p id="feed"></p>
  <p id="feed2"></p>
  <p id="feed3"></p>
  <p id="feed4"></p>
{% endblock %}
{% block script_block %}
<script>
    var root = window.location.href;
    root = root.slice(0, root.lastIndexOf("/"));
    root = root.slice(0, root.lastIndexOf("/"));
    root = root.slice(0, root.lastIndexOf("/"));
    time = verificatum.util.time_ms;
    //$(to_press).attr("disabled",true);
    var uuid;
    var p, g, q, g_2, y, y_2;
    var pk=[];
    var sk=[];
    var zkp = [];
    var election;
    var keyHolders = 4;
    var voters = 4;
    var confirmations = 0;
    var randomSource = new verificatum.crypto.RandomDevice();
    var global_to_hash;
    
    /*
    Choose the group and send your choice to the server
    The server answers with p, q and g
    */
    $(document).ready(function(){
        $("#press").click(function(){
            $(press).attr("disabled",true);
            var initReq = $.ajax( {method: "GET",
                                    url: "/crypto/elgamal/zkp2?params="+$("#groups").val() ,
                                    async: false,
                                });
            initReq.done(function(data, status){
                // Received the ID of the operation
                data = JSON.parse(data);
                uuid = data['uuid'];
                p = new verificatum.arithm.LargeInteger(data['public_key']['p']);
                g = new verificatum.arithm.LargeInteger(data['public_key']['g']);
                q = new verificatum.arithm.LargeInteger(data['public_key']['q']);
                global_to_hash = compute_hashing_string(data);
                g_2 = new verificatum.arithm.FixModPow(g,p,120,q);
                $(to_press).attr("disabled",false);
                console.log("");
                console.log("You chose group: "+$("#groups").val());
            });
            $(to_press).attr("disabled",false);
            $(field1).attr("disabled",false);
        });
    });
    
    /*
    Simulate *keyHolders* trustees and generate a private subkey pair for each
    Send the subkeys to the server which computes the elections public key
    */
    $(document).ready(function(){
        $("#to_press").click(function(){
            keyHolders = parseInt($("#field1").val());
            if(isNaN(keyHolders)){
                console.log("Invalid input, setting trustees number to 4");
                keyHolders = 4;
            }
            $(to_press).attr("disabled",true);
            $(field1).attr("disabled",true);
            console.log("");
            key_time=0;
            for(i=0;i<keyHolders;i++){
                var start = time();
                //Generate secret and public subkey
                sk[i] = new verificatum.arithm.LargeInteger(q.length*28,randomSource); //q.length gives the number of 28-bit pieces in the Verificatum writing of the big integer
                sk[i] = sk[i].mod(q);
                pk[i] = g_2.modPow(sk[i],p);
                //Generate ZKP 
                var w = new verificatum.arithm.LargeInteger(q.length*28,randomSource);
                var s = g_2.modPow(w,p);
                var hashed_challenge = verificatum.crypto.sha256.hash(toUTF8Array(pk[i].toHexString()+","+noZeros(s.toHexString())+global_to_hash));
                var e = new verificatum.arithm.LargeInteger(hashed_challenge);
                var f = w.modAdd(sk[i].modMul(e,q),q);
                //Only store challenge (e) and response (f)
                zkp[i] = {
                    'e' : e.toHexString(),
                    'f' : f.toHexString()
                }
                var stop = time();
                key_time+=(stop-start);
                //Send the public subkey and its generation ZKP to the server 
                var req = $.ajax( {method: "POST",
                                url: "/crypto/elgamal/zkp2" ,
                                data:  {'uuid' : uuid,
                                        'keyHolder' : i,
                                        'pubk' : pk[i].toHexString(),
                                        'zkp' : JSON.stringify(zkp[i])} ,
                                async: false, //pk FALSE???
                        });
                req.done(function(data, status){
                    console.log(data);
                });
            }
            $("#feed").text("The mean key generation time is: "+(key_time/(keyHolders)).toFixed(2)+"ms");
            var keyReq = $.ajax( {method: "GET",
                                    url: "/crypto/elgamal/zkp2?uuid="+uuid ,
                                    async: false,
                                });
            keyReq.done(function(data, status){
                //Update the election parameters with the overall public key
                console.log("Public key received");
                election = JSON.parse(data);
                global_to_hash = compute_hashing_string(election);
                y = new verificatum.arithm.LargeInteger(election['public_key']['y']);
                y_2 = new verificatum.arithm.FixModPow(y,p,120,q);
            });
            $(field2).attr("disabled",false);
            $(to_press2).attr("disabled",false);
        });
    });
    
    /*
    See click_function
    */
    $(document).ready(function(){
        $("#to_press2").click(click_function);
    });
    
    /*
    Compute the decryption factor from the alpha of the homomorphic ballot and send it to the server for each trustee
    */
    $(document).ready(function(){
        $("#to_press3").click(function(){
            $(to_press3).attr("disabled",true);
            var cipherReq = $.ajax( {method: "GET",
                                    url: "/crypto/elgamal/zkp2?uuid="+uuid+"&final=True" ,
                                    async: false,
                                });
            cipherReq.done(function(data, status){
                ballot = JSON.parse(data);
                console.log("");
                var Aux=[];
                var dec_time=0;
                for(counter=0;counter<keyHolders;counter++){
                    var alpha = [];
                    var zkp = [];
                    var start = time();
                    for(answerNb=0;answerNb<ballot.length;answerNb++){
                        if(counter==0){
                            Aux[answerNb] = new verificatum.arithm.LargeInteger(ballot[answerNb]["alpha"]);
                        }
                        alpha[answerNb] = Aux[answerNb].modPow(sk[counter],p).toHexString();
                        var w = new verificatum.arithm.LargeInteger(q.length*28,randomSource);
                        var A = g_2.modPow(w);
                        var B = Aux[answerNb].modPow(w,p);
                        string_to_hash = noZeros(A.toHexString())+","+noZeros(B.toHexString())+global_to_hash;
                        var hashed_challenge = verificatum.crypto.sha256.hash(toUTF8Array(string_to_hash));
                        var e = new verificatum.arithm.LargeInteger(hashed_challenge);
                        var f = w.modAdd(sk[counter].modMul(e,q),q);
                        zkp.push({
                            'challenge' : e.toHexString(),
                            'response' : f.toHexString()
                        })
                    }
                    var stop = time();
                    dec_time+=(stop-start);
                    var finalPost = $.ajax( {method: "POST",
                                            url: "/crypto/elgamal/zkp2" ,
                                            data:  {'uuid' : uuid,
                                                    'keyHolder' : counter,
                                                    'alpha' : JSON.stringify(alpha),
                                                    'zkp' : JSON.stringify(zkp)} ,
                                            async: false,
                                    });
                    finalPost.done(function(data, status){
                        console.log(data);
                    });
                }
                $("#feed3").text("The mean decryption factor computation time is: "+(dec_time/(keyHolders)).toFixed(2)+"ms");
            });
            $(to_press4).attr("disabled",false);
        });
    });
    
    /*
    Ask the server for the results of the election and receive them as an array
    */
    $(document).ready(function(){
        $("#to_press4").click(function(){
            $(to_press4).attr("disabled",true);
            var computeReq = $.ajax( {method: "GET",
                                    url: "/crypto/elgamal/zkp2?uuid="+uuid+"&compute=True" ,
                                    async: false,
                                });
            computeReq.done(function(data, status){
                answers = election["questions"][0]["answers"];
                console.log("");
                console.log("RESULTS")
                for(t=0;t<answers.length;t++){
                    votes=JSON.parse(data);
                    console.log(answers[t]["prenom"]+","+answers[t]["nom"]+": "+votes[t]);
                }
            });
            $(again).attr("disabled",false);
        });
    });
    $(document).ready(function(){
        $("#again").click(function(){
			window.location.href = root+"/crypto/elgamal/zkp2";
		});
    });

    /*
    Simulate *voters* voters and for each one of them encrypt a random vote and generate the corresponding ZKPs
    */
    function click_function(){
        $(field2).attr("disabled",true);
        $(to_press2).attr("disabled",true);
        console.log("");
        voters = parseInt($("#field2").val());
            if(isNaN(voters)){
                console.log("Invalid input, setting voters number to 4");
                voters = 4;
            }
        var mean_precomp_time = 0;
        var mean_enc_time = 0;
        var mean_dis_time = 0;
        var mean_conj_time = 0;
        for(ha=0;ha<voters;ha++){
            var vote = Math.floor(Math.random()*election["questions"][0]["answers"].length).toString();
            console.log("Voter number "+ha+" voted for: "+vote)
            times=encrypt_and_send([vote]);
            mean_precomp_time+=times[0];
            mean_enc_time+=times[1];
            mean_dis_time+=times[2];
            mean_conj_time+=times[3];
        }
        $("#feed2").text("The mean precomputation time is: "+(mean_precomp_time/(voters)).toFixed(2)+"ms, "+"The mean encryption time is: "+(mean_enc_time/(voters)).toFixed(2)+"ms, "+"The mean disjunctive proof time is: "+(mean_dis_time/(voters)).toFixed(2)+"ms, "+"The mean conjunctive proof time is: "+(mean_conj_time/(voters)).toFixed(2)+"ms");
        // Check every half second if all the votes have been received
        var intervalCheck = setInterval(function(){
            if(confirmations==voters){
                clearInterval(intervalCheck);
                $(to_press3).attr("disabled",false);
            }
        },500)
    }
    
    function encrypt_and_send(answer_indexes){
        //We consider only one question for the moment
        var question = election['questions'][0];
        var answers = question['answers'];
        //var pk = election['public_key'];
        
        var choices = []
        var individual_proofs = []
        var overall_proof = null
        var randomness = []

        for(i=0;i<answers.length;i++){
            choices.push(null);
            individual_proofs.push(null);
            randomness.push(null);
        }

        var plaintexts = generate_plaintexts(pk,p,g);
        
        // keep track of number of options selected.
        var num_selected_answers = 0;

        // homomorphic sum of all
        var homomorphic_sum = {
            'alpha': new verificatum.arithm.LargeInteger("1"),
            'beta': new verificatum.arithm.LargeInteger("1")
        };
        var randomness_sum = new verificatum.arithm.LargeInteger("0");

        // min and max for number of answers, useful later
        var min_answers = 0;
        if(question['min']!= undefined){
            min_answers = question['min']; 
        }
        var max_answers = question['max'];
        /*
        var precomp_g = 2*answers.length + (max_answers - min_answers);
        var precomp_y = 3*answers.length + (max_answers - min_answers+1);
        */
        var precomp = answers.length + (4 - min_answers+1);
        var prestart = time();
        g_3 = new verificatum.arithm.FixModPow(g,p,precomp,q);
        y_3 = new verificatum.arithm.FixModPow(y,p,precomp,q);
        var prestop = time();
        var enc_time = 0;
        var dis_time = 0;
        for(answer_num=0;answer_num<answers.length;answer_num++){
            var plaintext_index = 0
            // assuming a list of answers
            if(answer_indexes.indexOf(answer_num.toString())>-1){
                plaintext_index = 1;
                num_selected_answers += 1;
            }
            randomness[answer_num] = random_mpz_lt(q);
            
            var start1 = time();
            choices[answer_num] = encrypt_with_r(pk, p, g_3, y_3, plaintexts[plaintext_index], randomness[answer_num]);
            var stop1 = time();
            enc_time+=(stop1-start1);

            var start2 = time();
            individual_proofs[answer_num] = generate_disjunctive_encryption_proof(p, g_3, q, y_3,
                                                                                choices[answer_num],
                                                                                plaintexts, plaintext_index,
                                                                                randomness[answer_num],
                                                                                election);
            var stop2 = time();
            dis_time+=(stop2-start2);
            
            if(max_answers!=null){
                homomorphic_sum['alpha'] = choices[answer_num]['alpha'].modMul(homomorphic_sum['alpha'], p);
                homomorphic_sum['beta'] = choices[answer_num]['beta'].modMul(homomorphic_sum['beta'], p);
                randomness_sum = randomness_sum.modAdd(randomness[answer_num], q);
            }
        }
        
        
        if(num_selected_answers < min_answers){
            throw Error("Need to select at least" + min_answers  +" answer(s)") 
        }
            
        if(num_selected_answers > max_answers){
            throw Error("Need to select at most" + max_answers  +" answer(s)") 
        }
            
        if(max_answers!=null){
            sum_plaintexts = generate_plaintexts(pk, p, g, min_answers, max_answers)
            //need to subtract the min from the offset
            
            var start3 = time();
            overall_proof = generate_disjunctive_encryption_proof(p, g_3, q, y_3,
                                                                homomorphic_sum,
                                                                sum_plaintexts,
                                                                num_selected_answers - min_answers,
                                                                randomness_sum,
                                                                election);
            var stop3 = time();
        }
        else{
            // approval voting
            overall_proof = null
        }
        
        
        var ciphertexts = [];
        for(i=0;i<answers.length;i++){
            ciphertexts.push(JSON.stringify([noZeros(choices[i]["alpha"].toHexString()),noZeros(choices[i]["beta"].toHexString())]));
        }
        
        stop2 = verificatum.util.time_ms();
        console.log("");
        // Send vote and ZKPs 
        $.post("/crypto/elgamal/zkp2" ,
                {'uuid' : uuid,
                'ciphertexts' : JSON.stringify(ciphertexts),
                'proofs' : JSON.stringify(individual_proofs),
                'overall' : JSON.stringify(overall_proof)} ,
                function(data, status){
                    confirmations++;
                    console.log(data);
                });
        return [(prestop-prestart),enc_time,dis_time,(stop3-start3)];
    }
    
    function generate_plaintexts(pk, p, g, min=0, max=1){
        /**
        * Generates a list of all the plaintexts between min and max
        * @param pk: public key
        * @param p: modulus
        * @param g: generator
        * @param min: first plaintext
        * @param max: last plaintext
        * @return: list with all the plaintexts
        */
        var plaintexts = [];
        var running_product = new verificatum.arithm.LargeInteger("1");

        //run the product up to the min
        for(i=0;i<=max;i++){
            // if we're in the range, add it to the array
            if(i >= min){
                plaintexts.push(running_product)
                }
            // next value in running product
            running_product = running_product.modMul(g,p)
        }
        return plaintexts;
    }

    function random_mpz_lt(maxi){
        /**
        * Generates random element smaller than maxi
        * @param maxi: maximum value for random element
        * @return: random mpz() element
        */
        len = maxi.length*4;
        var byteArray = new Uint8Array(len);
        window.crypto.getRandomValues(byteArray);
        var bytes = [];
        for (var i = 0; i < len; i++) {
            bytes[i] = byteArray[i];
        }
        bytes_large = new verificatum.arithm.LargeInteger(bytes);
        return bytes_large.mod(maxi);
    }

    function encrypt_with_r(pk, p, g, y, plaintext, r){
        /**
        * Encrypt plaintext with given randomness
        * @param pk: public key
        * @param p: modulus
        * @param g: generator
        * @param y: g^x
        * @param plaintext: plaintext to encrypt
        * @param r: randomness to use in the encryption
        * @return: El Gamal ciphertext (alpha,beta)
        */
        alpha = g.modPow(r,p);
        betaAux = y.modPow(r,p);
        beta = plaintext.modMul(betaAux,p);
        ciphertext = {
            'alpha': alpha,
            'beta': beta
        }
        return ciphertext;
    }

    function generate_disjunctive_encryption_proof(p, g, q, y, choice, plaintexts, real_index, randomness, election){
        /**
        * Generate conjunctive proofs
        * @param p: modulus
        * @param g: generator
        * @param q: generator
        * @param y: g^x
        * @param choice: ciphertext
        * @param plaintexts: list of all the plaintexts
        * @param real_index: real choice
        * @param randomness: randomness used for encryption
        * @return: list of proofs for all the plaintexts
        */
        // note how the interface is as such so that the result does not reveal which is the real proof.

        var proofs=[];
        for(p_num=0;p_num<plaintexts.length;p_num++){
            proofs.push(null);
            if(p_num != real_index){
                proofs[p_num] = simulate_encryption_proof(p, g, q, y, real_index, p_num, choice, randomness);
            }
        }
        // do the real proof
        var real_proof = generate_encryption_proof(p, g, q, y, real_index, randomness, choice, proofs);

        // set the real proof
        proofs[real_index] = real_proof;
        
        for(var i=0;i<proofs.length;i++){
            proofs[i]={"challenge":proofs[i].challenge, "response":proofs[i].response}
        }
        
        return proofs;
    }

    function simulate_encryption_proof(p, g, q, y, real_index, p_num, choice, randomness, challenge=null){
        /**
        * Simulate ZKP
        * @param p: modulus
        * @param g: generator
        * @param q: generator
        * @param y: g^x
        * @param real_index: real choice
        * @param p_num: message to simulate
        * @param choice: ciphertext
        * @param randomness: real randomness used for the encryption
        * @param challenge: if not None use this challenge
        * @return: Simulated proof of knowledge for plaintext
        */
        // generate a random challenge if not provided
        if(challenge==null){
            challenge = random_mpz_lt(q);
        }

        // compute beta/plaintext, the completion of the DH tuple
        // beta_over_plaintext = choice['beta'].modMul(plaintext.modInv(p),p);
        
        p_num_large = new verificatum.arithm.LargeInteger([p_num]);
        real_index_large = new verificatum.arithm.LargeInteger([real_index]);
        
        // random response, does not even need to depend on the challenge
        response = random_mpz_lt(q);

        // now we compute the commitment
        
        B1 = y.modPow(response.modSub(randomness.modMul(challenge,q),q) ,p)
        B2 = g.modPow(challenge.modMul(p_num_large.modSub(real_index_large,q),q),p);
        B = B1.modMul(B2,p);
        
        proof = {
            'commitment': noZeros(B.toHexString()),
            'challenge': challenge.toHexString(),
            'response': response.toHexString(),
        }
        return proof;
    }

    function generate_encryption_proof(p, g, q, y, real_index, randomness, choice, proofs){
        /**
        * Make real proof for the real message
        * @param p: modulus
        * @param g: generator
        * @param q: generator
        * @param y: g^x
        * @param real_index: index of the real message
        * @param randomness: randomness used in the encryption
        * @param choice: ciphertext
        * @param proofs: simulated proofs
        * @return: the real proof for the real message
        */
        // random W
        w = random_mpz_lt(q);        
        
        // compute the commitment B=y^w
        B = y.modPow(w,p);
        
        
        proofs[real_index] = {
            'commitment': noZeros(B.toHexString()),
            'challenge': null,
            'response': null
        }

        disjunctive_challenge = hashChallenge(proofs,choice)

        // now we must subtract all of the other challenges from this challenge.
        real_challenge = disjunctive_challenge;
        for(p_num2=0;p_num2<proofs.length;p_num2++){
            if (p_num2 != real_index){
                aux_challenge = new verificatum.arithm.LargeInteger(proofs[p_num2]['challenge'])
                real_challenge = real_challenge.modSub(aux_challenge,q);
            }
        }

        challenge = real_challenge.mod(q);

        // Compute response = w + randomness * challenge
        var response = w.modAdd(randomness.modMul(challenge,q),q);
        
        proof = {
            'commitment': noZeros(B.toHexString()),
            'challenge': challenge.toHexString(),
            'response': response.toHexString(),
        }
        
        return proof
    }

    function hashChallenge(proofs,choice){
        /**
        * Generate hash from paramters
        * @param proofs: list of proofs
        * @param choice: ciphertext
        * @return: hash over the proofs and ciphertext
        */
        // electionHash = election_hash(election)
        commitments=[];
        for(count=0;count<proofs.length;count++){
            commitments.push(proofs[count]["commitment"]);
        }
        array_to_hash = [];
        for(count=0;count<commitments.length;count++){
            array_to_hash.push(noZeros(commitments[count]));
        }
        string_to_hash = array_to_hash.toString();
        string_to_hash = "alpha:" + noZeros(choice["alpha"].toHexString()) + ";beta:" + noZeros(choice["beta"].toHexString()) + ";commitments:" + string_to_hash + global_to_hash;
        
        hashed_string = verificatum.crypto.sha256.hash(toUTF8Array(string_to_hash));
        return new verificatum.arithm.LargeInteger(hashed_string);
    }
    
    function compute_hashing_string(election){
        /**
        * Computes a string that must be included inside each challenge Hash
        * @param election: the election parameters
        * @return: string to hash
        */
        var string_to_hash = "";
        string_to_hash += "g,"
        string_to_hash += election.public_key.g;
        string_to_hash += ",p,"
        string_to_hash += election.public_key.p;
        string_to_hash += ",q,"
        string_to_hash += election.public_key.q;
        if (election.public_key.y != " "){
            string_to_hash += ",y,";
            string_to_hash += election.public_key.y;
        }
        string_to_hash += ",cast_url,";
        string_to_hash += election.cast_url;
        string_to_hash += ",description,";
        string_to_hash += election.description;
        string_to_hash += ",name,";
        string_to_hash += election.name;
        string_to_hash += ",voting_starts_at,";
        string_to_hash += election.voting_starts_at;
        string_to_hash += ",voting_ends_at,";
        string_to_hash += election.voting_ends_at;
        string_to_hash += ",uuid,";
        string_to_hash += election.uuid;
        return string_to_hash;
    }
    
    function noZeros(myStr){
        /**
        * Removes the preceding zero of the hex string if existent
        * @param myStr: hex string
        * @return hex string without preceeding 0
        */
        if(myStr[0]=="0") return myStr.substring(1);
        return myStr;
    }
    
    function toUTF8Array(str) {
        /**
        * Encodes string to UTF8 (https://gist.github.com/joni/3760795/7d9d0c5f87b4ff849a404b9317a98d1e637bd568)
        * @param str string to encode
        * @return  UTF8 encoded string
        */
        var utf8 = [];
        for (var i=0; i < str.length; i++) {
            var charcode = str.charCodeAt(i);
            if (charcode < 0x80) utf8.push(charcode);
            else if (charcode < 0x800) {
                utf8.push(0xc0 | (charcode >> 6), 
                        0x80 | (charcode & 0x3f));
            }
            else if (charcode < 0xd800 || charcode >= 0xe000) {
                utf8.push(0xe0 | (charcode >> 12), 
                        0x80 | ((charcode>>6) & 0x3f), 
                        0x80 | (charcode & 0x3f));
            }
            // surrogate pair
            else {
                i++;
                charcode = ((charcode&0x3ff)<<10)|(str.charCodeAt(i)&0x3ff)
                utf8.push(0xf0 | (charcode >>18), 
                        0x80 | ((charcode>>12) & 0x3f), 
                        0x80 | ((charcode>>6) & 0x3f), 
                        0x80 | (charcode & 0x3f));
            }
        }
        return utf8;
    }
</script>
{% endblock %}