# SOS representation
#
# Initially, it was intended as "Simply, Octet String", but 
# it is actually "Strange" Octet String.
#

# Input is an integer
def sos_from_int(x):
    if x < 0:
        raise ValueError("Negative integer is not allowed in MPI")
    strange_nbits = x.bit_length()
    return strange_nbits.to_bytes(2, byteorder='big') \
        + x.to_bytes((strange_nbits+7)//8, byteorder='big')
    # NOTE: Nothing strange if it represents an integer

# Input can be representation of an EC point, scalar value, or opaque octets
def sos_from_octetstring(o_s):
    if len(o_s) == 0:
        return b'\x00\x00'

    strange_nbits = (len(o_s) - 1)* 8
    if o_s[0] == 0:
        strange_nbits += 8
    else:
        strange_nbits += o_s[0].bit_length()
    return strange_nbits.to_bytes(2, byteorder='big') + o_s

# The semantic of SOS is determined by its context,
# specifically, by the curve OID.
def dump_sos(sos):
    if len(sos) < 2:
        raise ValueError("Length of SOS must be >= 2")
    strange_nbits = (sos[0] << 8) + sos[1]
    nbytes = (strange_nbits+7)//8
    if len(sos) != nbytes + 2:
        raise ValueError("Malformed SOS")

    print("This SOS may represent an octet string:")
    print("\t" + sos[2:].hex())
    print("")
    print("This SOS may represent an integer:")
    print("\t" + int.from_bytes(sos[2:], byteorder='big'))
    print("")
    print("It is the curve OID which decides the interpretation.")
    print("The semantics is determined by the curve OID.")
    print("Currently, it is like:")
    print("\tNIST P-256: integer (or integer which encodes an EC point)")
    print("\tNIST P-384: Likewise")
    print("\tNIST P-521: Likewise")
    print("\tbrainpoolP256r1: Likewise")
    print("\tbrainpoolP512r1: Likewise")
    print("\tEd25519: octet string (of an EC point) for public key")
    print("\tEd25519: octet string (of an EC point) for signature R")
    print("\tEd25519: octet string for signature value S")
    print("\tEd25519: octet string (of opaque binary) for secret part")
    print("\tCurve25519: octet string (of an EC point) for public key")
    print("\tCurve25519: octet string (of an EC point) for ephemeral key")
    print("\tCurve25519: integer for secret part")
    print("In future, for newer curves, it's simply octet string of native representation:")
    print("\tX448: non-prefixed octet string (of an EC point) for public key")
    print("\tX448: non-prefixed octet string (of an EC point) for ephemeral key")
    print("\tX448: octet string (of opaque binary) for secret part")
    print("\tEd448: non-prefixed octet string (of an EC point) for public key")
    print("\tEd448: non-prefixed octet string (of an EC point) for signature R")
    print("\tEd448: octet string for signature value S")
    print("\tEd448: octet string (of opaque binary) for secret part")

# In the case of Ed25519, special care is needed to recover actual value.
# When the length of octet string for signature value S is less than 32,
# zero octet should be padded at the front to make 32-octet string.
# When the length of octet string for secret part is less than 32,
# zero octet should be padded at the front to make 32-octet string.

# In the case of Curve25519, while an EC point is represented in
# native representation (nearly), secret part is not (but big-endian integer)
# This is considered ugly.  This way should be avoided for newer curve(s).

# The intention of defining SOS is to clarify existing practice of Ed25519 key
# so that we can improve/avoid implementation issues in future.

mpint

      Represents multiple precision integers in two's complement format,
      stored as a string, 8 bits per byte, MSB first.  Negative numbers
      have the value 1 as the most significant bit of the first byte of
      the data partition.  If the most significant bit would be set for
      a positive number, the number MUST be preceded by a zero byte.
      Unnecessary leading bytes with the value 0 or 255 MUST NOT be
      included.  The value zero MUST be stored as a string with zero
      bytes of data.

      By convention, a number that is used in modular computations in
      Z_n SHOULD be represented in the range 0 <= x < n.