udif.h

Go to the documentation of this file.

/* 2025-2026 Quantum Resistant Cryptographic Solutions Corporation
 * All Rights Reserved.
 *
 * NOTICE:
 * This software and all accompanying materials are the exclusive property of
 * Quantum Resistant Cryptographic Solutions Corporation (QRCS). The intellectual
 * and technical concepts contained herein are proprietary to QRCS and are
 * protected under applicable Canadian, U.S., and international copyright,
 * patent, and trade secret laws.
 *
 * CRYPTOGRAPHIC ALGORITHMS AND IMPLEMENTATIONS:
 * - This software includes implementations of cryptographic primitives and
 *   algorithms that are standardized or in the public domain, such as AES
 *   and SHA-3, which are not proprietary to QRCS.
 * - This software also includes cryptographic primitives, constructions, and
 *   algorithms designed by QRCS, including but not limited to RCS, SCB, CSX, QMAC, and
 *   related components, which are proprietary to QRCS.
 * - All source code, implementations, protocol compositions, optimizations,
 *   parameter selections, and engineering work contained in this software are
 *   original works of QRCS and are protected under this license.
 *
 * LICENSE AND USE RESTRICTIONS:
 * - This software is licensed under the Quantum Resistant Cryptographic Solutions
 *   Public Research and Evaluation License (QRCS-PREL), 2025-2026.
 * - Permission is granted solely for non-commercial evaluation, academic research,
 *   cryptographic analysis, interoperability testing, and feasibility assessment.
 * - Commercial use, production deployment, commercial redistribution, or
 *   integration into products or services is strictly prohibited without a
 *   separate written license agreement executed with QRCS.
 * - Licensing and authorized distribution are solely at the discretion of QRCS.
 *
 * EXPERIMENTAL CRYPTOGRAPHY NOTICE:
 * Portions of this software may include experimental, novel, or evolving
 * cryptographic designs. Use of this software is entirely at the user's risk.
 *
 * DISCLAIMER:
 * THIS SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS
 * FOR A PARTICULAR PURPOSE, SECURITY, OR NON-INFRINGEMENT. QRCS DISCLAIMS ALL
 * LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL DAMAGES
 * ARISING FROM THE USE OR MISUSE OF THIS SOFTWARE.
 *
 * FULL LICENSE:
 * This software is subject to the Quantum Resistant Cryptographic Solutions
 * Public Research and Evaluation License (QRCS-PREL), 2025-2026. The complete license terms
 * are provided in the accompanying LICENSE file or at https://www.qrcscorp.ca.
 *
 * Written by: John G. Underhill
 * Contact: contact@qrcscorp.ca
 */
 
#ifndef UDIF_H
#define UDIF_H
 
#include "udifcommon.h"
#include "sha3.h"
#include "socketbase.h"
 
#define UDIF_CONFIG_DILITHIUM_KYBER
//#define UDIF_CONFIG_SPHINCS_MCELIECE
 
#if defined(UDIF_CONFIG_DILITHIUM_KYBER)
#   include "dilithium.h"
#   include "kyber.h"
#elif defined(UDIF_CONFIG_SPHINCS_MCELIECE)
#   include "mceliece.h"
#   include "sphincsplus.h"
#else
#   error Invalid parameter set!
#endif

 
 /* Function Mapping Macros */

#define UDIF_USE_RCS_ENCRYPTION
 
#if defined(UDIF_USE_RCS_ENCRYPTION)
#   include "rcs.h"
#   define udif_cipher_state qsc_rcs_state
#   define udif_cipher_dispose qsc_rcs_dispose
#   define udif_cipher_initialize qsc_rcs_initialize
#   define udif_cipher_keyparams qsc_rcs_keyparams
#   define udif_cipher_set_associated qsc_rcs_set_associated
#   define udif_cipher_transform qsc_rcs_transform
#else
#   include "aes.h"
#   define udif_cipher_state qsc_aes_gcm256_state
#   define udif_cipher_dispose qsc_aes_gcm256_dispose
#   define udif_cipher_initialize qsc_aes_gcm256_initialize
#   define udif_cipher_keyparams qsc_aes_keyparams
#   define udif_cipher_set_associated qsc_aes_gcm256_set_associated
#   define udif_cipher_transform qsc_aes_gcm256_transform
#endif

#if defined(UDIF_CONFIG_SPHINCS_MCELIECE)
#   define udif_cipher_generate_keypair qsc_mceliece_generate_keypair
#   define udif_cipher_decapsulate qsc_mceliece_decapsulate
#   define udif_cipher_encapsulate qsc_mceliece_encapsulate
#   define udif_signature_generate_keypair qsc_sphincsplus_generate_keypair
#   define udif_signature_sign qsc_sphincsplus_sign
#   define udif_signature_verify qsc_sphincsplus_verify
#elif defined(UDIF_CONFIG_DILITHIUM_KYBER)
#   define udif_cipher_generate_keypair qsc_kyber_generate_keypair
#   define udif_cipher_decapsulate qsc_kyber_decapsulate
#   define udif_cipher_encapsulate qsc_kyber_encapsulate
#   define udif_signature_generate_keypair qsc_dilithium_generate_keypair
#   define udif_signature_sign qsc_dilithium_sign
#   define udif_signature_verify qsc_dilithium_verify
#else
#   error Invalid parameter set!
#endif
 
/* ### Modifiable Constants: These constants can be enabled to turn on protocol features ### */

//#define UDIF_NETWORK_PROTOCOL_IPV6
 
/* ### End of Modifiable Constants ### */
 
#if defined(UDIF_CONFIG_DILITHIUM_KYBER)
#   define UDIF_ASYMMETRIC_CIPHERTEXT_SIZE (QSC_KYBER_CIPHERTEXT_SIZE)

#   define UDIF_ASYMMETRIC_PRIVATE_KEY_SIZE (QSC_KYBER_PRIVATEKEY_SIZE)

#   define UDIF_ASYMMETRIC_PUBLIC_KEY_SIZE (QSC_KYBER_PUBLICKEY_SIZE)

#   define UDIF_ASYMMETRIC_SIGNATURE_SIZE (QSC_DILITHIUM_SIGNATURE_SIZE)

#   define UDIF_ASYMMETRIC_SIGNING_KEY_SIZE (QSC_DILITHIUM_PRIVATEKEY_SIZE)

#   define UDIF_ASYMMETRIC_VERIFICATION_KEY_SIZE (QSC_DILITHIUM_PUBLICKEY_SIZE)
 
#   if defined(QSC_DILITHIUM_S1P44) && defined(QSC_KYBER_S1K2P512)
#       define UDIF_PARAMATERS_DILITHIUM_KYBER_D1K1
#       define UDIF_SUITE_ID 1U
#   elif defined(QSC_DILITHIUM_S3P65) && defined(QSC_KYBER_S3K3P768)
#       define UDIF_PARAMATERS_DILITHIUM_KYBER_D3K3
#       define UDIF_SUITE_ID 2U
#   elif defined(QSC_DILITHIUM_S5P87) && defined(QSC_KYBER_S5K4P1024)
#       define UDIF_PARAMATERS_DILITHIUM_KYBER_D5K5
#       define UDIF_SUITE_ID 3U
#   elif defined(QSC_DILITHIUM_S5P87) && defined(QSC_KYBER_S6K5P1280)
#       define UDIF_PARAMATERS_DILITHIUM_KYBER_D5K6
#       define UDIF_SUITE_ID 4U
#   else
        /* The library signature scheme and asymmetric cipher parameter sets
        must be synchronized to a common security level; s1, s3, s5, s5+ */
#       error the library parameter sets are mismatched!
#   endif
 
#elif defined(UDIF_CONFIG_SPHINCS_MCELIECE)
#   define UDIF_ASYMMETRIC_CIPHERTEXT_SIZE (QSC_MCELIECE_CIPHERTEXT_SIZE)
#   define UDIF_ASYMMETRIC_PRIVATE_KEY_SIZE (QSC_MCELIECE_PRIVATEKEY_SIZE)
#   define UDIF_ASYMMETRIC_PUBLIC_KEY_SIZE (QSC_MCELIECE_PUBLICKEY_SIZE)
#   define UDIF_ASYMMETRIC_SIGNATURE_SIZE (QSC_SPHINCSPLUS_SIGNATURE_SIZE)
#   define UDIF_ASYMMETRIC_SIGNING_KEY_SIZE (QSC_SPHINCSPLUS_PRIVATEKEY_SIZE)
#   define UDIF_ASYMMETRIC_VERIFICATION_KEY_SIZE (QSC_SPHINCSPLUS_PUBLICKEY_SIZE)
 
#   if defined(QSC_MCELIECE_S1N3488T64)&& defined(QSC_SPHINCSPLUS_S1S128SHAKERS)
#       define UDIF_PARAMATERS_SPHINCSPLUS_S1S128SHAKERS
#       define UDIF_SUITE_ID 5U
#   elif defined(QSC_MCELIECE_S3N4608T96) && defined(QSC_SPHINCSPLUS_S3S192SHAKERS)
#       define UDIF_PARAMATERS_SPHINCSPLUS_S3S192SHAKERS
#       define UDIF_SUITE_ID 6U
#   elif defined(QSC_MCELIECE_S5N6688T128) && defined(QSC_SPHINCSPLUS_S5S256SHAKERS)
#       define UDIF_PARAMATERS_SPHINCSPLUS_S5S256SHAKERS
#       define UDIF_SUITE_ID 7U
#   elif defined(QSC_MCELIECE_S6N6960T119) && defined(QSC_SPHINCSPLUS_S5S256SHAKERS)
#       define UDIF_PARAMATERS_SPHINCSPLUS_S6S256SHAKERS
#       define UDIF_SUITE_ID 8U
#   elif defined(QSC_MCELIECE_S7N8192T128) && defined(QSC_SPHINCSPLUS_S5S256SHAKERS)
#       define UDIF_PARAMATERS_SPHINCSPLUS_S7S256SHAKERS
#       define UDIF_SUITE_ID 9U
#   else
        /* The library signature scheme and asymmetric cipher parameter sets
        must be synchronized to a common security level; s1, s3, s5 or s6.
        Check the QSC library common.h file for cipher and signature security level alignment. */
#       error Invalid parameter sets, check the QSC library settings
#   endif
#endif
 

#define UDIF_CAPABILITY_BITMAP_SIZE 8U

#define UDIF_CAPABILITY_MASK_SIZE 8U

#define UDIF_CAPABILITY_TOKEN_MAX_SIZE 2048U

#define UDIF_CLAIM_ANCHOR_SIZE 32U

#define UDIF_CRYPTO_HASH_SIZE 32U

#define UDIF_CRYPTO_KEY_SIZE 32U

#if defined(UDIF_USE_RCS_ENCRYPTION)
#   define UDIF_CRYPTO_MAC_SIZE 32U
#else
#   define UDIF_CRYPTO_MAC_SIZE 16U
#endif

#if defined(UDIF_USE_RCS_ENCRYPTION)
#   define UDIF_CRYPTO_NONCE_SIZE 32U
#else
#   define UDIF_CRYPTO_NONCE_SIZE 16U
#endif

#define UDIF_IDENTITY_ID_SIZE 32U

#define UDIF_ISSUER_DOMAIN_CODE_SIZE 8U

#define UDIF_NAMESPACE_CODE_SIZE 8U

#define UDIF_PERMISSION_MASK_SIZE 8U

#define UDIF_POLICY_HASH_SIZE 32U

#define UDIF_POLICY_VERB_SIZE 4U

#define UDIF_PROTOCOL_SET_SIZE 41U

#define UDIF_ROLE_SIZE 1U

#define UDIF_CERT_SERIAL_SIZE 16U

#define UDIF_OBJECT_SERIAL_SIZE 32U

#define UDIF_QUERY_ID_SIZE 16U

#define UDIF_TX_ID_SIZE UDIF_CRYPTO_HASH_SIZE

#define UDIF_SERIAL_NUMBER_SIZE UDIF_CERT_SERIAL_SIZE

#define UDIF_REGISTRY_LEAF_FLAGS_SIZE 4U

#define UDIF_REGISTRY_LEAF_ENCODED_SIZE (UDIF_CRYPTO_HASH_SIZE + \
    UDIF_CRYPTO_HASH_SIZE + \
    UDIF_OBJECT_SERIAL_SIZE + \
    UDIF_REGISTRY_LEAF_FLAGS_SIZE + \
    UDIF_VALID_TIME_SIZE)

#define UDIF_SIGNED_HASH_SIZE (UDIF_ASYMMETRIC_SIGNATURE_SIZE + UDIF_CRYPTO_HASH_SIZE)

#define UDIF_SUITEID_SIZE 1U

#define UDIF_TIME_WINDOW_SECONDS 60U

#define UDIF_VALID_TIME_SIZE 8U

#define UDIF_VALID_TIME_STRUCTURE_SIZE 16U
 
/* Policy Macros */

#define UDIF_POLICY_NONE (UINT64_C(0))

#define UDIF_POLICY_DEFAULT_DENY (UINT64_C(1) << 0)

#define UDIF_POLICY_REQUIRE_SUITE_MATCH (UINT64_C(1) << 1)

#define UDIF_POLICY_REQUIRE_CANONICAL_ENCODING (UINT64_C(1) << 2)

#define UDIF_POLICY_REQUIRE_PARENT_SIGNATURE (UINT64_C(1) << 3)

#define UDIF_POLICY_REQUIRE_REVOCATION_CHECK (UINT64_C(1) << 4)

#define UDIF_POLICY_REQUIRE_CAPABILITY_INTERSECT (UINT64_C(1) << 5)

#define UDIF_POLICY_REQUIRE_POLICY_EPOCH_MATCH (UINT64_C(1) << 6)

#define UDIF_POLICY_REQUIRE_MEMBERSHIP_LOG (UINT64_C(1) << 7)

#define UDIF_POLICY_REQUIRE_TRANSACTION_LOG (UINT64_C(1) << 8)

#define UDIF_POLICY_REQUIRE_REGISTRY_COMMIT (UINT64_C(1) << 9)

#define UDIF_POLICY_REQUIRE_ANCHORING (UINT64_C(1) << 10)

#define UDIF_POLICY_REQUIRE_ANCHOR_SEQUENCE (UINT64_C(1) << 11)

#define UDIF_POLICY_REQUIRE_MINIMAL_DISCLOSURE (UINT64_C(1) << 12)

#define UDIF_POLICY_REQUIRE_AUDIT_COUNTERS (UINT64_C(1) << 13)

#define UDIF_POLICY_REQUIRE_TIME_WINDOW (UINT64_C(1) << 14)

#define UDIF_POLICY_REQUIRE_SEQUENCE_CHECK (UINT64_C(1) << 15)

#define UDIF_POLICY_REQUIRE_EPOCH_CHECK (UINT64_C(1) << 16)

#define UDIF_POLICY_REQUIRE_AEAD_AAD_HEADER (UINT64_C(1) << 17)

#define UDIF_POLICY_REQUIRE_RATCHET_REKEY (UINT64_C(1) << 18)

#define UDIF_POLICY_FORBID_RUNTIME_NEGOTIATION (UINT64_C(1) << 19)

#define UDIF_POLICY_FORBID_ADMIN_OBJECT_OWNERSHIP (UINT64_C(1) << 20)

#define UDIF_POLICY_FORBID_CLIENT_ADMIN (UINT64_C(1) << 21)

#define UDIF_POLICY_FORBID_CLIENT_LATERAL_QUERY (UINT64_C(1) << 22)

#define UDIF_POLICY_FORBID_IMPLICIT_TREATY_RIGHTS (UINT64_C(1) << 23)

#define UDIF_POLICY_REQUIRE_TREATY_SCOPE_CHECK (UINT64_C(1) << 24)

#define UDIF_POLICY_ALLOW_TREATY_NEGOTIATION (UINT64_C(1) << 25)

#define UDIF_POLICY_ALLOW_TREATY_QUERY_ORIGIN (UINT64_C(1) << 26)

#define UDIF_POLICY_ALLOW_TREATY_QUERY_EXEC (UINT64_C(1) << 27)

#define UDIF_POLICY_ALLOW_TELEMETRY_EXPORT (UINT64_C(1) << 28)

#define UDIF_POLICY_ALLOW_ERROR_REPORTING (UINT64_C(1) << 29)

#define UDIF_POLICY_ALLOW_PROFILE_HOOKS (UINT64_C(1) << 30)

#define UDIF_POLICY_REQUIRE_PROFILE_HOOK_AUDIT (UINT64_C(1) << 31)

#define UDIF_POLICY_RESERVED_CORE_MASK (UINT64_C(0x0000FFFF00000000))

#define UDIF_POLICY_RESERVED_PROFILE_MASK (UINT64_C(0xFFFF000000000000))

#define UDIF_POLICY_BASELINE_SECURITY_MASK \
    (UDIF_POLICY_DEFAULT_DENY | \
     UDIF_POLICY_REQUIRE_SUITE_MATCH | \
     UDIF_POLICY_REQUIRE_CANONICAL_ENCODING | \
     UDIF_POLICY_REQUIRE_PARENT_SIGNATURE | \
     UDIF_POLICY_REQUIRE_REVOCATION_CHECK | \
     UDIF_POLICY_REQUIRE_CAPABILITY_INTERSECT | \
     UDIF_POLICY_REQUIRE_POLICY_EPOCH_MATCH | \
     UDIF_POLICY_REQUIRE_MINIMAL_DISCLOSURE | \
     UDIF_POLICY_FORBID_RUNTIME_NEGOTIATION)

#define UDIF_POLICY_TRANSPORT_SECURITY_MASK \
    (UDIF_POLICY_REQUIRE_TIME_WINDOW | \
     UDIF_POLICY_REQUIRE_SEQUENCE_CHECK | \
     UDIF_POLICY_REQUIRE_EPOCH_CHECK | \
     UDIF_POLICY_REQUIRE_AEAD_AAD_HEADER)

#define UDIF_POLICY_LOGGING_MASK \
    (UDIF_POLICY_REQUIRE_MEMBERSHIP_LOG | \
     UDIF_POLICY_REQUIRE_TRANSACTION_LOG | \
     UDIF_POLICY_REQUIRE_REGISTRY_COMMIT | \
     UDIF_POLICY_REQUIRE_ANCHORING | \
     UDIF_POLICY_REQUIRE_ANCHOR_SEQUENCE | \
     UDIF_POLICY_REQUIRE_AUDIT_COUNTERS)

#define UDIF_POLICY_ADMIN_SEPARATION_MASK \
    (UDIF_POLICY_FORBID_ADMIN_OBJECT_OWNERSHIP | \
     UDIF_POLICY_FORBID_CLIENT_ADMIN | \
     UDIF_POLICY_FORBID_CLIENT_LATERAL_QUERY)

#define UDIF_POLICY_TREATY_BASE_MASK \
    (UDIF_POLICY_FORBID_IMPLICIT_TREATY_RIGHTS | \
     UDIF_POLICY_REQUIRE_TREATY_SCOPE_CHECK)

#define UDIF_POLICY_TREATY_ENABLE_MASK \
    (UDIF_POLICY_ALLOW_TREATY_NEGOTIATION | \
     UDIF_POLICY_ALLOW_TREATY_QUERY_ORIGIN | \
     UDIF_POLICY_ALLOW_TREATY_QUERY_EXEC)

#define UDIF_POLICY_PROFILE_HOOK_MASK \
    (UDIF_POLICY_ALLOW_PROFILE_HOOKS | \
     UDIF_POLICY_REQUIRE_PROFILE_HOOK_AUDIT)

#define UDIF_POLICY_DEFINED_CORE_MASK \
    (UDIF_POLICY_BASELINE_SECURITY_MASK | \
     UDIF_POLICY_TRANSPORT_SECURITY_MASK | \
     UDIF_POLICY_LOGGING_MASK | \
     UDIF_POLICY_ADMIN_SEPARATION_MASK | \
     UDIF_POLICY_TREATY_BASE_MASK | \
     UDIF_POLICY_TREATY_ENABLE_MASK | \
     UDIF_POLICY_ALLOW_TELEMETRY_EXPORT | \
     UDIF_POLICY_ALLOW_ERROR_REPORTING | \
     UDIF_POLICY_PROFILE_HOOK_MASK | \
     UDIF_POLICY_REQUIRE_RATCHET_REKEY)

#define UDIF_ROOT_POLICY_DEFAULT \
    (UDIF_POLICY_BASELINE_SECURITY_MASK | \
     UDIF_POLICY_LOGGING_MASK | \
     UDIF_POLICY_ADMIN_SEPARATION_MASK | \
     UDIF_POLICY_TREATY_BASE_MASK | \
     UDIF_POLICY_ALLOW_TELEMETRY_EXPORT | \
     UDIF_POLICY_ALLOW_ERROR_REPORTING)

#define UDIF_BC_POLICY_DEFAULT \
    (UDIF_POLICY_BASELINE_SECURITY_MASK | \
     UDIF_POLICY_TRANSPORT_SECURITY_MASK | \
     UDIF_POLICY_REQUIRE_RATCHET_REKEY | \
     UDIF_POLICY_REQUIRE_MEMBERSHIP_LOG | \
     UDIF_POLICY_REQUIRE_ANCHORING | \
     UDIF_POLICY_REQUIRE_ANCHOR_SEQUENCE | \
     UDIF_POLICY_REQUIRE_AUDIT_COUNTERS | \
     UDIF_POLICY_ADMIN_SEPARATION_MASK | \
     UDIF_POLICY_TREATY_BASE_MASK | \
     UDIF_POLICY_ALLOW_TELEMETRY_EXPORT | \
     UDIF_POLICY_ALLOW_ERROR_REPORTING)

#define UDIF_GC_POLICY_DEFAULT \
    (UDIF_POLICY_BASELINE_SECURITY_MASK | \
     UDIF_POLICY_TRANSPORT_SECURITY_MASK | \
     UDIF_POLICY_REQUIRE_MEMBERSHIP_LOG | \
     UDIF_POLICY_REQUIRE_TRANSACTION_LOG | \
     UDIF_POLICY_REQUIRE_REGISTRY_COMMIT | \
     UDIF_POLICY_REQUIRE_ANCHORING | \
     UDIF_POLICY_REQUIRE_ANCHOR_SEQUENCE | \
     UDIF_POLICY_REQUIRE_AUDIT_COUNTERS | \
     UDIF_POLICY_FORBID_ADMIN_OBJECT_OWNERSHIP | \
     UDIF_POLICY_FORBID_IMPLICIT_TREATY_RIGHTS | \
     UDIF_POLICY_REQUIRE_TREATY_SCOPE_CHECK | \
     UDIF_POLICY_ALLOW_TELEMETRY_EXPORT | \
     UDIF_POLICY_ALLOW_ERROR_REPORTING)

#define UDIF_CLIENT_POLICY_DEFAULT \
    (UDIF_POLICY_BASELINE_SECURITY_MASK | \
     UDIF_POLICY_TRANSPORT_SECURITY_MASK | \
     UDIF_POLICY_REQUIRE_TRANSACTION_LOG | \
     UDIF_POLICY_REQUIRE_REGISTRY_COMMIT | \
     UDIF_POLICY_FORBID_CLIENT_ADMIN | \
     UDIF_POLICY_FORBID_CLIENT_LATERAL_QUERY | \
     UDIF_POLICY_ALLOW_ERROR_REPORTING)
 
/* UDIF Enumerations */

typedef enum udif_claim_type
{
    udif_claim_unknown = 0U,                  
    udif_claim_commodity_id = 1U,                
    udif_claim_biometric_hash = 2U,                
    udif_claim_institution_id = 3U,                
    udif_claim_public_key = 4U,                    
    udif_claim_age_over = 5U,                    
    udif_claim_citizenship = 6U,              
    udif_claim_residency = 7U,                  
    udif_claim_membership_id = 8U,              
    udif_claim_contact_email = 9U,              
    udif_claim_contact_phone = 10U,             
    udif_claim_address = 11U,                 
    udif_claim_custom = 12U                        
} udif_claim_type;

typedef enum udif_configuration_sets
{
    udif_configuration_set_none = 0x00U,                                     
    udif_configuration_set_dilithium1_kyber1_rcs256_shake256 = 0x01U,           
    udif_configuration_set_dilithium3_kyber3_rcs256_shake256 = 0x02U,           
    udif_configuration_set_dilithium5_kyber5_rcs256_shake256 = 0x03U,           
    udif_configuration_set_dilithium5_kyber6_rcs512_shake256 = 0x04U,           
    udif_configuration_set_sphincsplus1_mceliece1_rcs256_shake256 = 0x05U,     
    udif_configuration_set_sphincsplus3_mceliece3_rcs256_shake256 = 0x06U,     
    udif_configuration_set_sphincsplus5_mceliece5_rcs256_shake256 = 0x07U,     
    udif_configuration_set_sphincsplus5_mceliece6_rcs256_shake256 = 0x08U,     
    udif_configuration_set_sphincsplus5_mceliece7_rcs256_shake256 = 0x09U,     
} udif_configuration_sets;
 
#if defined(UDIF_PARAMATERS_DILITHIUM_KYBER_D1K1)
static const char UDIF_CONFIG_STRING[UDIF_PROTOCOL_SET_SIZE] = "dilithium-s1_kyber-s1_rcs-256_sha3-256";
static const udif_configuration_sets UDIF_CONFIGURATION_SET = udif_configuration_set_dilithium1_kyber1_rcs256_shake256;
#elif defined(UDIF_PARAMATERS_DILITHIUM_KYBER_D3K3)
static const char UDIF_CONFIG_STRING[UDIF_PROTOCOL_SET_SIZE] = "dilithium-s3_kyber-s3_rcs-256_sha3-256";
static const udif_configuration_sets UDIF_CONFIGURATION_SET = udif_configuration_set_dilithium3_kyber3_rcs256_shake256;
#elif defined(UDIF_PARAMATERS_DILITHIUM_KYBER_D5K5)
static const char UDIF_CONFIG_STRING[UDIF_PROTOCOL_SET_SIZE] = "dilithium-s5_kyber-s5_rcs-256_sha3-256";
static const udif_configuration_sets UDIF_CONFIGURATION_SET = udif_configuration_set_dilithium5_kyber5_rcs256_shake256;
#elif defined(UDIF_PARAMATERS_DILITHIUM_KYBER_D5K6)
static const char UDIF_CONFIG_STRING[UDIF_PROTOCOL_SET_SIZE] = "dilithium-s5_kyber-s6_rcs-512_sha3-512";
static const udif_configuration_sets UDIF_CONFIGURATION_SET = udif_configuration_set_dilithium5_kyber6_rcs512_shake256;
#elif defined(UDIF_PARAMATERS_SPHINCSPLUS_S1S128SHAKERS)
static const char UDIF_CONFIG_STRING[UDIF_PROTOCOL_SET_SIZE] = "sphincs-s1_mceliece-s1_rcs-256_sha3-256";
static const udif_configuration_sets UDIF_CONFIGURATION_SET = udif_configuration_set_sphincsplus1_mceliece1_rcs256_shake256;
#elif defined(UDIF_PARAMATERS_SPHINCSPLUS_S3S192SHAKERS)
static const char UDIF_CONFIG_STRING[UDIF_PROTOCOL_SET_SIZE] = "sphincs-s3_mceliece-s3_rcs-256_sha3-256";
static const udif_configuration_sets UDIF_CONFIGURATION_SET = udif_configuration_set_sphincsplus3_mceliece3_rcs256_shake256;
#elif defined(UDIF_PARAMATERS_SPHINCSPLUS_S5S256SHAKERS)
static const char UDIF_CONFIG_STRING[UDIF_PROTOCOL_SET_SIZE] = "sphincs-s5_mceliece-s5_rcs-256_sha3-256";
static const udif_configuration_sets UDIF_CONFIGURATION_SET = udif_configuration_set_sphincsplus5_mceliece5_rcs256_shake256;
#elif defined(UDIF_PARAMATERS_SPHINCSPLUS_S6S256SHAKERS)
static const char UDIF_CONFIG_STRING[UDIF_PROTOCOL_SET_SIZE] = "sphincs-s5_mceliece-s6_rcs-256_sha3-256";
static const udif_configuration_sets UDIF_CONFIGURATION_SET = udif_configuration_set_sphincsplus5_mceliece6_rcs256_shake256;
#elif defined(UDIF_PARAMATERS_SPHINCSPLUS_S7S256SHAKERS)
static const char UDIF_CONFIG_STRING[UDIF_PROTOCOL_SET_SIZE] = "sphincs-s5_mceliece-s7_rcs-256_sha3-256";
static const udif_configuration_sets UDIF_CONFIGURATION_SET = udif_configuration_set_sphincsplus5_mceliece7_rcs256_shake256;
#else
#   error Invalid parameter set!
#endif

typedef enum udif_errors
{
    udif_error_none = 0U,                        
    udif_error_invalid_input = 1U,              
    udif_error_invalid_state = 2U,              
    udif_error_auth_failure = 3U,                
    udif_error_certificate_expired = 4U,      
    udif_error_certificate_revoked = 5U,      
    udif_error_capability_revoked = 6U,            
    udif_error_invalid_sequence = 7U,            
    udif_error_time_window = 8U,              
    udif_error_epoch_mismatch = 9U,                
    udif_error_suite_mismatch = 10U,           
    udif_error_decode_failure = 11U,           
    udif_error_encode_failure = 12U,           
    udif_error_signature_invalid = 13U,         
    udif_error_mac_invalid = 14U,             
    udif_error_not_authorized = 15U,           
    udif_error_object_not_found = 16U,           
    udif_error_registry_full = 17U,             
    udif_error_logging_failure = 18U,         
    udif_error_anchor_invalid = 19U,           
    udif_error_treaty_invalid = 20U,           
    udif_error_invalid_request = 21U,         
    udif_error_internal = 22U,                   
    udif_error_file_create_failed = 23U,       
    udif_error_file_not_found = 24U,           
    udif_error_invalid_parameter = 25U          
} udif_errors;

typedef enum udif_error_capability
{
    udif_ecap_none = 0U,                      
    udif_ecap_denied = 1U,                      
    udif_ecap_mask_empty = 2U,                  
    udif_ecap_mask_conflict = 3U             
} udif_error_capability;

typedef enum udif_error_claims
{
    udif_ecl_none = 0U,                            
    udif_ecl_type_unknown = 1U,                    
    udif_ecl_encoding_bad = 2U,                    
    udif_ecl_canonical_fail = 3U,                
    udif_ecl_anchor_bad = 4U,                    
    udif_ecl_value_invalid = 5U                   
} udif_error_claims;

typedef enum udif_error_encoding
{
    udif_eenc_none = 0U,                      
    udif_eenc_overflow = 1U,                  
    udif_eenc_underflow = 2U,                    
    udif_eenc_format = 3U,                      
    udif_eenc_unsupported = 4U                 
} udif_error_encoding;

typedef enum udif_error_identity
{
    udif_eid_none = 0U,                            
    udif_eid_namespace_bad = 1U,              
    udif_eid_issuer_bad = 2U,                    
    udif_eid_subject_bad = 3U,                  
    udif_eid_mask_invalid = 4U,                    
    udif_eid_anchor_mismatch = 5U,              
    udif_eid_sig_invalid = 6U,                  
    udif_eid_expired = 7U,                      
    udif_eid_future = 8U                     
} udif_error_identity;

typedef enum udif_error_policy
{
    udif_epol_none = 0U,                      
    udif_epol_not_found = 1U,                    
    udif_epol_hash_mismatch = 2U,                
    udif_epol_indeterminate = 3U             
} udif_error_policy;

typedef enum udif_logging_event_codes
{
    udif_event_enroll = 1U,                        
    udif_event_suspend = 2U,                  
    udif_event_resume = 3U,                        
    udif_event_revoke = 4U,                        
    udif_event_capability_grant = 5U,           
    udif_event_capability_revoke = 6U,          
    udif_event_registry_commit = 7U,          
    udif_event_branch_create = 8U,              
    udif_event_branch_suspend = 9U,                
    udif_event_branch_revoke = 10U,             
    udif_event_object_create = 11U,             
    udif_event_object_transfer = 12U,         
    udif_event_object_update = 13U,             
    udif_event_object_destroy = 14U                
} udif_logging_event_codes;

typedef enum udif_permission_class
{
    udif_perm_read_claims = 0U,                    
    udif_perm_write_claims = 1U,              
    udif_perm_read_certs = 2U,                  
    udif_perm_write_certs = 3U,                    
    udif_perm_manage_policy = 4U,                
    udif_perm_manage_caps = 5U,                    
    udif_perm_delegate = 6U,                  
    udif_perm_export_identity = 7U,                
    udif_perm_import_identity = 8U             
} udif_permission_class;

typedef enum udif_policy_decision
{
    udif_policy_permit = 0U,                  
    udif_policy_deny = 1U,                      
    udif_policy_indeterminate = 2U,                
    udif_policy_not_applicable = 3U               
} udif_policy_decision;

typedef enum udif_roles
{
    udif_role_none = 0U,                      
    udif_role_root = 1U,                      
    udif_role_ugc = 2U,                            
    udif_role_ubc = 3U,                            
    udif_role_uor = 4U,                            
    udif_role_client = 5U,                      
    udif_role_audit = 6U,                        
    udif_role_revoked = 7U,                        
    udif_role_any = 8U,                            
} udif_roles;

typedef enum udif_time_validation
{
    udif_time_valid = 0U,                        
    udif_time_future = 1U,                      
    udif_time_expired = 2U,                        
    udif_time_skew_exceeds = 3U                   
} udif_time_validation;

typedef enum udif_token_type
{
    udif_token_none = 0U,                        
    udif_token_capability = 1U,                    
    udif_token_attestation = 2U,              
    udif_token_session = 3U                       
} udif_token_type;

typedef enum udif_status
{
    udif_status_success = 0U,                    
    udif_status_invalid_argument = 1U,          
    udif_status_not_found = 2U,                    
    udif_status_already_exists = 3U,          
    udif_status_out_of_memory = 4U,                
    udif_status_buffer_too_small = 5U,          
    udif_status_not_supported = 6U,                
    udif_status_internal_error = 7U               
} udif_status;

typedef enum udif_verify_policy
{
    udif_verify_strict = 0U,                  
    udif_verify_lenient = 1U                 
} udif_verify_policy;

typedef enum udif_version_sets
{
    udif_version_set_none = 0x00U,             
    udif_version_set_one_zero = 0x01U,         
} udif_version_sets;


#define UDIF_VERSION_STRING "UDIF:1.0a"

#define UDIF_SUITE_STRING "UDIF:RCS256-KMAC256-MLKEM5-MLDSA5"
 
/* Domain Separation Labels */

#define UDIF_LABEL_MAX_SIZE 64U
 
/* Domain separation label constants */
#define UDIF_LABEL_OBJ_DIGEST    "UDIF:OBJ-DIGEST:V1"
#define UDIF_LABEL_REGROOT       "UDIF:REGROOT:V1"
#define UDIF_LABEL_TXID          "UDIF:TXID:V1"
#define UDIF_LABEL_ANCHOR        "UDIF:ANCHOR:V1"
#define UDIF_LABEL_CAP_DIGEST    "UDIF:CAP-DIGEST:V1"
#define UDIF_LABEL_SESS_KDF      "UDIF:SESS-KDF:V1"
#define UDIF_LABEL_RATCHET       "UDIF:RATCHET:V1"
#define UDIF_LABEL_CERT_DIGEST   "UDIF:CERT-DIGEST:V1"
#define UDIF_LABEL_ROOT_DIGEST   "UDIF:ROOT-DIGEST:V1"

 
/* Role/Designation Strings */


#define UDIF_ERROR_STRING_DEPTH 27U

#define UDIF_ERROR_STRING_SIZE 128U
 
/* Protocol errors*/
 
static const char UDIF_ERROR_STRINGS[UDIF_ERROR_STRING_DEPTH][UDIF_ERROR_STRING_SIZE] =
{
    "No error condition",
    "Invalid input parameter",
    "Invalid function state",
    "Authentication failed",
    "The certificate expired",
    "The certificate has been revoked",
    "The capability has been revoked",
    "Invalid sequence number",
    "The time window has been exceeded",
    "Epoch time mismatch",
    "Protocol suite mismatch",
    "Decoding failure",
    "Encoding failure",
    "Invalid signature",
    "Invalid MAC",
    "Not authorized",
    "Object not found",
    "Registry full",
    "Log operation failed",
    "Invalid anchor record",
    "Invalid treaty",
    "Invalid request",
    "Internal error",
    "File creation failed",
    "File not found",
    "Invalid parameter",
    "Unknown error type"
};
 
/* Certificate errors */
static const char UDIF_CERTIFICATE_ERROR_STRINGS[][UDIF_ERROR_STRING_SIZE] =
{
    "No error",
    "Unknown certificate type",
    "Bad or unknown serial number",
    "Invalid certificate chain",
    "Signature invalid",
    "Certificate expired",
    "Certificate not yet valid",
    "Policy hash mismatch",
    "Certificate revoked"
};
 
/* Claims errors */
static const char UDIF_CLAIMS_ERROR_STRINGS[][UDIF_ERROR_STRING_SIZE] =
{
    "No error",
    "Unknown claim type",
    "Invalid encoding",
    "Canonicalization failed",
    "Anchor mismatch",
    "Invalid claim value"
};
 
/* Encoding errors */
static const char UDIF_ENCODING_ERROR_STRINGS[][UDIF_ERROR_STRING_SIZE] =
{
    "No error",
    "Buffer overflow",
    "Buffer underflow",
    "Bad format/version",
    "Unsupported encoding"
};
 
/* Identity errors */
static const char UDIF_IDENTITY_ERROR_STRINGS[][UDIF_ERROR_STRING_SIZE] =
{
    "No error",
    "Invalid namespace code",
    "Invalid issuer domain code",
    "Invalid subject identifier",
    "Capability/permission mask invalid",
    "Claim anchor mismatch",
    "Signature verification failed",
    "Identity expired",
    "Identity not yet valid"
};
 
/* Policy errors */
static const char UDIF_POLICY_ERROR_STRINGS[][UDIF_ERROR_STRING_SIZE] =
{
    "No error",
    "Policy not found",
    "Policy hash mismatch",
    "Policy evaluation indeterminate"
};
 
#define UDIF_ROLE_STRING_SIZE 32U
 
static const char UDIF_ROLE_STRINGS[][UDIF_ROLE_STRING_SIZE] =
{
    "udif_role_none",
    "udif_role_ugc",
    "udif_role_ubc",
    "udif_role_uor",
    "udif_role_client",
    "udif_role_audit",
    "udif_role_revoked",
    "udif_role_any"
};

 
/* UDIF Structures */

UDIF_EXPORT_API typedef struct udif_capability_mask
{
    uint8_t bits[UDIF_CAPABILITY_MASK_SIZE];               
} udif_capability_mask;

UDIF_EXPORT_API typedef struct udif_claim
{
    udif_claim_type type;                                    
    const uint8_t* value;                                  
    uint32_t length;                                      
} udif_claim;

UDIF_EXPORT_API typedef struct udif_claim_anchor
{
    uint8_t bytes[UDIF_CLAIM_ANCHOR_SIZE];
} udif_claim_anchor;

UDIF_EXPORT_API typedef struct udif_claim_set
{
    const udif_claim* items;                                
    uint32_t count;                                            
    udif_claim_anchor anchor;                               
} udif_claim_set;

UDIF_EXPORT_API typedef struct udif_encoded_blob
{
    uint8_t* bytes;                                         
    uint32_t size;                                          
    uint32_t length;                                        
} udif_encoded_blob;

UDIF_EXPORT_API typedef struct udif_identity_id
{
    uint8_t bytes[UDIF_IDENTITY_ID_SIZE];                 
} udif_identity_id;

UDIF_EXPORT_API typedef struct udif_issuer_domain_code
{
    uint8_t bytes[UDIF_ISSUER_DOMAIN_CODE_SIZE];           
} udif_issuer_domain_code;

UDIF_EXPORT_API typedef struct udif_kem_keypair
{
    uint8_t pubkey[UDIF_ASYMMETRIC_PUBLIC_KEY_SIZE];       
    uint8_t prikey[UDIF_ASYMMETRIC_PRIVATE_KEY_SIZE];     
} udif_kem_keypair;

UDIF_EXPORT_API typedef struct udif_namespace_code
{
    uint8_t bytes[UDIF_NAMESPACE_CODE_SIZE];               
} udif_namespace_code;

UDIF_EXPORT_API typedef struct udif_permission_mask
{
    uint8_t bits[UDIF_PERMISSION_MASK_SIZE];               
} udif_permission_mask;

UDIF_EXPORT_API typedef struct udif_policy_hash
{
    uint8_t bytes[UDIF_POLICY_HASH_SIZE];                 
} udif_policy_hash;

UDIF_EXPORT_API typedef struct udif_signature_keypair
{
    uint8_t sigkey[UDIF_ASYMMETRIC_SIGNING_KEY_SIZE];     
    uint8_t verkey[UDIF_ASYMMETRIC_VERIFICATION_KEY_SIZE];   
} udif_signature_keypair;

UDIF_EXPORT_API typedef struct udif_time_window
{
    uint64_t before;                                      
    uint64_t after;                                            
} udif_time_window;

UDIF_EXPORT_API typedef struct udif_token_header
{
    udif_token_type ttype;                                  
    udif_namespace_code nspace;                                
    udif_issuer_domain_code issuer;                         
    udif_time_window validity;                              
} udif_token_header;

UDIF_EXPORT_API typedef struct udif_token
{
    uint8_t signature[UDIF_ASYMMETRIC_SIGNATURE_SIZE];       
    uint8_t payload[UDIF_CAPABILITY_TOKEN_MAX_SIZE];       
    uint8_t chash[UDIF_CRYPTO_HASH_SIZE];                 
    udif_token_header head;                                 
    udif_identity_id subject;                               
    udif_capability_mask caps;                              
    udif_permission_mask perms;                             
    uint32_t paylen;                                      
} udif_token;

UDIF_EXPORT_API typedef struct udif_valid_time
{
    uint64_t from;                                          
    uint64_t to;                                          
} udif_valid_time;

UDIF_EXPORT_API typedef struct udif_identity_record
{
    udif_namespace_code nspace;                                
    udif_issuer_domain_code issuer;                         
    udif_identity_id subject;                                
    udif_time_window validity;                              
    udif_permission_mask perms;                             
    udif_capability_mask caps;                              
    udif_policy_hash policy;                              
    udif_claim_anchor anchor;                                
    uint8_t signature[UDIF_ASYMMETRIC_SIGNATURE_SIZE];       
    uint8_t verkey[UDIF_ASYMMETRIC_VERIFICATION_KEY_SIZE];   
    uint8_t chash[UDIF_CRYPTO_HASH_SIZE];                 
} udif_identity_record;

UDIF_EXPORT_API bool udif_suite_is_valid(uint8_t suiteid);

UDIF_EXPORT_API const char* udif_error_to_string(udif_errors error);

UDIF_EXPORT_API const char* udif_role_to_string(udif_roles role);
 
#endif