// crypto_framework.c - Advanced cryptographic framework implementation
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <time.h>
#include <sys/random.h>
#include <openssl/evp.h>
#include <openssl/rsa.h>
#include <openssl/ec.h>
#include <openssl/aes.h>
#include <openssl/sha.h>
#include <openssl/hmac.h>
#include <openssl/rand.h>
#include <openssl/pem.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/bn.h>
#include <openssl/dh.h>
#include <openssl/ecdh.h>
#include <openssl/kdf.h>
#include <sodium.h>

#define MAX_KEY_SIZE 8192
#define MAX_CIPHER_BLOCK_SIZE 64
#define MAX_HASH_SIZE 64
#define MAX_SIGNATURE_SIZE 1024
#define MAX_CERTIFICATE_SIZE 4096
#define MAX_RANDOM_SIZE 1024
#define PBKDF2_ITERATIONS 100000
#define SCRYPT_N 32768
#define SCRYPT_R 8
#define SCRYPT_P 1

// Cryptographic algorithm types
typedef enum {
    CRYPTO_ALG_AES_128_CBC,
    CRYPTO_ALG_AES_256_CBC,
    CRYPTO_ALG_AES_128_GCM,
    CRYPTO_ALG_AES_256_GCM,
    CRYPTO_ALG_AES_128_CTR,
    CRYPTO_ALG_AES_256_CTR,
    CRYPTO_ALG_CHACHA20_POLY1305,
    CRYPTO_ALG_RSA_2048,
    CRYPTO_ALG_RSA_4096,
    CRYPTO_ALG_ECDSA_P256,
    CRYPTO_ALG_ECDSA_P384,
    CRYPTO_ALG_ECDSA_P521,
    CRYPTO_ALG_ED25519,
    CRYPTO_ALG_X25519
} crypto_algorithm_t;

// Hash algorithm types
typedef enum {
    HASH_ALG_SHA256,
    HASH_ALG_SHA384,
    HASH_ALG_SHA512,
    HASH_ALG_SHA3_256,
    HASH_ALG_SHA3_512,
    HASH_ALG_BLAKE2B,
    HASH_ALG_BLAKE2S
} hash_algorithm_t;

// Key derivation function types
typedef enum {
    KDF_PBKDF2,
    KDF_SCRYPT,
    KDF_ARGON2ID,
    KDF_HKDF
} kdf_algorithm_t;

// Cryptographic key structure
typedef struct {
    crypto_algorithm_t algorithm;
    unsigned char *key_data;
    size_t key_length;
    unsigned char *public_key;
    size_t public_key_length;
    unsigned char *private_key;
    size_t private_key_length;
    EVP_PKEY *evp_key;
    time_t created_time;
    time_t expiry_time;
    bool is_ephemeral;
} crypto_key_t;

// Encrypted data structure
typedef struct {
    crypto_algorithm_t algorithm;
    unsigned char *ciphertext;
    size_t ciphertext_length;
    unsigned char *iv;
    size_t iv_length;
    unsigned char *tag;
    size_t tag_length;
    unsigned char *aad;
    size_t aad_length;
} encrypted_data_t;

// Digital signature structure
typedef struct {
    crypto_algorithm_t algorithm;
    hash_algorithm_t hash_algorithm;
    unsigned char *signature;
    size_t signature_length;
    unsigned char *public_key;
    size_t public_key_length;
} digital_signature_t;

// Certificate structure
typedef struct {
    X509 *x509_cert;
    unsigned char *cert_data;
    size_t cert_length;
    char subject[256];
    char issuer[256];
    time_t not_before;
    time_t not_after;
    char serial_number[64];
    bool is_ca;
    bool is_self_signed;
} crypto_certificate_t;

// PKI context structure
typedef struct {
    EVP_PKEY *ca_private_key;
    X509 *ca_certificate;
    char *ca_cert_file;
    char *ca_key_file;
    STACK_OF(X509) *cert_chain;
    X509_STORE *cert_store;
    int next_serial_number;
} pki_context_t;

// TLS context structure
typedef struct {
    SSL_CTX *ssl_ctx;
    SSL *ssl;
    char *cert_file;
    char *key_file;
    char *ca_file;
    char *cipher_list;
    int verify_mode;
    bool client_mode;
} tls_context_t;

// Secure random number generator
typedef struct {
    bool initialized;
    unsigned char entropy_pool[1024];
    size_t entropy_available;
    time_t last_reseed;
} secure_random_t;

// Function prototypes
int crypto_init(void);
void crypto_cleanup(void);

// Key management
int crypto_generate_key(crypto_key_t *key, crypto_algorithm_t algorithm);
int crypto_derive_key(crypto_key_t *key, const char *password, const unsigned char *salt, 
                     size_t salt_len, kdf_algorithm_t kdf, crypto_algorithm_t algorithm);
int crypto_load_key_from_file(crypto_key_t *key, const char *filename, const char *password);
int crypto_save_key_to_file(crypto_key_t *key, const char *filename, const char *password);
void crypto_free_key(crypto_key_t *key);

// Symmetric encryption
int crypto_encrypt_symmetric(const crypto_key_t *key, const unsigned char *plaintext, 
                           size_t plaintext_len, encrypted_data_t *encrypted);
int crypto_decrypt_symmetric(const crypto_key_t *key, const encrypted_data_t *encrypted, 
                           unsigned char **plaintext, size_t *plaintext_len);

// Asymmetric encryption
int crypto_encrypt_asymmetric(const crypto_key_t *public_key, const unsigned char *plaintext, 
                            size_t plaintext_len, unsigned char **ciphertext, size_t *ciphertext_len);
int crypto_decrypt_asymmetric(const crypto_key_t *private_key, const unsigned char *ciphertext, 
                            size_t ciphertext_len, unsigned char **plaintext, size_t *plaintext_len);

// Digital signatures
int crypto_sign_data(const crypto_key_t *private_key, const unsigned char *data, size_t data_len, 
                   hash_algorithm_t hash_alg, digital_signature_t *signature);
int crypto_verify_signature(const crypto_key_t *public_key, const unsigned char *data, size_t data_len, 
                          const digital_signature_t *signature);

// Hash functions
int crypto_hash_data(const unsigned char *data, size_t data_len, hash_algorithm_t algorithm, 
                   unsigned char *hash, size_t *hash_len);
int crypto_hmac(const unsigned char *key, size_t key_len, const unsigned char *data, size_t data_len, 
              hash_algorithm_t algorithm, unsigned char *hmac, size_t *hmac_len);

// Key derivation
int crypto_pbkdf2(const char *password, const unsigned char *salt, size_t salt_len, 
                int iterations, unsigned char *key, size_t key_len);
int crypto_scrypt(const char *password, const unsigned char *salt, size_t salt_len, 
                uint32_t N, uint32_t r, uint32_t p, unsigned char *key, size_t key_len);
int crypto_argon2id(const char *password, const unsigned char *salt, size_t salt_len, 
                  uint32_t memory, uint32_t iterations, unsigned char *key, size_t key_len);

// Key exchange
int crypto_dh_generate_keypair(crypto_key_t *keypair);
int crypto_dh_compute_shared(const crypto_key_t *private_key, const crypto_key_t *public_key, 
                           unsigned char *shared_secret, size_t *shared_len);
int crypto_ecdh_generate_keypair(crypto_key_t *keypair, int curve_id);
int crypto_ecdh_compute_shared(const crypto_key_t *private_key, const crypto_key_t *public_key, 
                             unsigned char *shared_secret, size_t *shared_len);

// PKI functions
int pki_init(pki_context_t *pki, const char *ca_cert_file, const char *ca_key_file);
int pki_generate_ca_certificate(pki_context_t *pki, const char *subject, int validity_days);
int pki_generate_certificate(pki_context_t *pki, const char *subject, const crypto_key_t *public_key, 
                           int validity_days, crypto_certificate_t *cert);
int pki_verify_certificate(pki_context_t *pki, const crypto_certificate_t *cert);
int pki_revoke_certificate(pki_context_t *pki, const crypto_certificate_t *cert);
void pki_cleanup(pki_context_t *pki);

// TLS functions
int tls_init_context(tls_context_t *tls, bool client_mode);
int tls_set_certificates(tls_context_t *tls, const char *cert_file, const char *key_file, const char *ca_file);
int tls_set_cipher_list(tls_context_t *tls, const char *cipher_list);
int tls_connect(tls_context_t *tls, int socket_fd);
int tls_accept(tls_context_t *tls, int socket_fd);
int tls_read(tls_context_t *tls, unsigned char *buffer, size_t buffer_size);
int tls_write(tls_context_t *tls, const unsigned char *data, size_t data_len);
void tls_cleanup(tls_context_t *tls);

// Secure random functions
int secure_random_init(secure_random_t *rng);
int secure_random_bytes(secure_random_t *rng, unsigned char *buffer, size_t length);
void secure_random_cleanup(secure_random_t *rng);

// Utility functions
void crypto_secure_zero(void *ptr, size_t size);
int crypto_constant_time_compare(const void *a, const void *b, size_t size);
const char *crypto_algorithm_name(crypto_algorithm_t algorithm);
const char *hash_algorithm_name(hash_algorithm_t algorithm);

// Global cryptographic context
static bool g_crypto_initialized = false;
static secure_random_t g_secure_random;

int main(int argc, char *argv[]) {
    int result;
    
    // Initialize cryptographic subsystem
    result = crypto_init();
    if (result != 0) {
        fprintf(stderr, "Failed to initialize cryptographic subsystem\n");
        return 1;
    }
    
    printf("Cryptographic framework initialized\n");
    
    // Example 1: Symmetric encryption with AES-256-GCM
    printf("\n=== Symmetric Encryption Example ===\n");
    
    crypto_key_t aes_key;
    result = crypto_generate_key(&aes_key, CRYPTO_ALG_AES_256_GCM);
    if (result != 0) {
        fprintf(stderr, "Failed to generate AES key\n");
        goto cleanup;
    }
    
    const char *plaintext = "This is a secret message that needs to be encrypted securely.";
    encrypted_data_t encrypted;
    
    result = crypto_encrypt_symmetric(&aes_key, (const unsigned char *)plaintext, 
                                    strlen(plaintext), &encrypted);
    if (result != 0) {
        fprintf(stderr, "Failed to encrypt data\n");
        goto cleanup;
    }
    
    printf("Original text: %s\n", plaintext);
    printf("Encrypted (%s): ", crypto_algorithm_name(encrypted.algorithm));
    for (size_t i = 0; i < 32 && i < encrypted.ciphertext_length; i++) {
        printf("%02x", encrypted.ciphertext[i]);
    }
    printf("...\n");
    
    // Decrypt the data
    unsigned char *decrypted_text;
    size_t decrypted_len;
    result = crypto_decrypt_symmetric(&aes_key, &encrypted, &decrypted_text, &decrypted_len);
    if (result != 0) {
        fprintf(stderr, "Failed to decrypt data\n");
        goto cleanup;
    }
    
    printf("Decrypted text: %.*s\n", (int)decrypted_len, decrypted_text);
    
    // Example 2: RSA key generation and digital signatures
    printf("\n=== Digital Signature Example ===\n");
    
    crypto_key_t rsa_key;
    result = crypto_generate_key(&rsa_key, CRYPTO_ALG_RSA_2048);
    if (result != 0) {
        fprintf(stderr, "Failed to generate RSA key\n");
        goto cleanup;
    }
    
    const char *message = "This message needs to be digitally signed for authenticity.";
    digital_signature_t signature;
    
    result = crypto_sign_data(&rsa_key, (const unsigned char *)message, strlen(message), 
                            HASH_ALG_SHA256, &signature);
    if (result != 0) {
        fprintf(stderr, "Failed to sign message\n");
        goto cleanup;
    }
    
    printf("Message: %s\n", message);
    printf("Signature algorithm: %s\n", crypto_algorithm_name(signature.algorithm));
    printf("Hash algorithm: %s\n", hash_algorithm_name(signature.hash_algorithm));
    printf("Signature length: %zu bytes\n", signature.signature_length);
    
    // Verify the signature
    result = crypto_verify_signature(&rsa_key, (const unsigned char *)message, strlen(message), &signature);
    if (result == 0) {
        printf("Signature verification: VALID\n");
    } else {
        printf("Signature verification: INVALID\n");
    }
    
    // Example 3: Key derivation from password
    printf("\n=== Key Derivation Example ===\n");
    
    const char *password = "MySecurePassword123!";
    unsigned char salt[32];
    secure_random_bytes(&g_secure_random, salt, sizeof(salt));
    
    crypto_key_t derived_key;
    result = crypto_derive_key(&derived_key, password, salt, sizeof(salt), 
                             KDF_PBKDF2, CRYPTO_ALG_AES_256_CBC);
    if (result != 0) {
        fprintf(stderr, "Failed to derive key from password\n");
        goto cleanup;
    }
    
    printf("Password: %s\n", password);
    printf("Salt: ");
    for (int i = 0; i < 16; i++) {
        printf("%02x", salt[i]);
    }
    printf("...\n");
    printf("Derived key algorithm: %s\n", crypto_algorithm_name(derived_key.algorithm));
    printf("Derived key length: %zu bytes\n", derived_key.key_length);
    
    // Example 4: Elliptic Curve Diffie-Hellman key exchange
    printf("\n=== ECDH Key Exchange Example ===\n");
    
    crypto_key_t alice_keypair, bob_keypair;
    result = crypto_ecdh_generate_keypair(&alice_keypair, NID_X9_62_prime256v1);
    if (result != 0) {
        fprintf(stderr, "Failed to generate Alice's keypair\n");
        goto cleanup;
    }
    
    result = crypto_ecdh_generate_keypair(&bob_keypair, NID_X9_62_prime256v1);
    if (result != 0) {
        fprintf(stderr, "Failed to generate Bob's keypair\n");
        goto cleanup;
    }
    
    unsigned char alice_shared[32], bob_shared[32];
    size_t alice_shared_len = sizeof(alice_shared);
    size_t bob_shared_len = sizeof(bob_shared);
    
    // Alice computes shared secret using Bob's public key
    result = crypto_ecdh_compute_shared(&alice_keypair, &bob_keypair, alice_shared, &alice_shared_len);
    if (result != 0) {
        fprintf(stderr, "Failed to compute Alice's shared secret\n");
        goto cleanup;
    }
    
    // Bob computes shared secret using Alice's public key
    result = crypto_ecdh_compute_shared(&bob_keypair, &alice_keypair, bob_shared, &bob_shared_len);
    if (result != 0) {
        fprintf(stderr, "Failed to compute Bob's shared secret\n");
        goto cleanup;
    }
    
    printf("Alice's shared secret: ");
    for (size_t i = 0; i < alice_shared_len; i++) {
        printf("%02x", alice_shared[i]);
    }
    printf("\n");
    
    printf("Bob's shared secret:   ");
    for (size_t i = 0; i < bob_shared_len; i++) {
        printf("%02x", bob_shared[i]);
    }
    printf("\n");
    
    if (alice_shared_len == bob_shared_len && 
        crypto_constant_time_compare(alice_shared, bob_shared, alice_shared_len) == 0) {
        printf("ECDH key exchange: SUCCESS - Shared secrets match\n");
    } else {
        printf("ECDH key exchange: FAILED - Shared secrets do not match\n");
    }
    
    // Example 5: Hash functions
    printf("\n=== Hash Function Example ===\n");
    
    const char *data = "The quick brown fox jumps over the lazy dog";
    unsigned char hash[64];
    size_t hash_len;
    
    // SHA-256
    result = crypto_hash_data((const unsigned char *)data, strlen(data), HASH_ALG_SHA256, hash, &hash_len);
    if (result == 0) {
        printf("SHA-256: ");
        for (size_t i = 0; i < hash_len; i++) {
            printf("%02x", hash[i]);
        }
        printf("\n");
    }
    
    // SHA-512
    result = crypto_hash_data((const unsigned char *)data, strlen(data), HASH_ALG_SHA512, hash, &hash_len);
    if (result == 0) {
        printf("SHA-512: ");
        for (size_t i = 0; i < hash_len; i++) {
            printf("%02x", hash[i]);
        }
        printf("\n");
    }
    
    // HMAC
    const char *hmac_key = "secret_key";
    unsigned char hmac_result[32];
    size_t hmac_len;
    result = crypto_hmac((const unsigned char *)hmac_key, strlen(hmac_key), 
                       (const unsigned char *)data, strlen(data), 
                       HASH_ALG_SHA256, hmac_result, &hmac_len);
    if (result == 0) {
        printf("HMAC-SHA256: ");
        for (size_t i = 0; i < hmac_len; i++) {
            printf("%02x", hmac_result[i]);
        }
        printf("\n");
    }
    
    // Example 6: PKI operations
    printf("\n=== PKI Example ===\n");
    
    pki_context_t pki;
    result = pki_init(&pki, NULL, NULL);
    if (result != 0) {
        fprintf(stderr, "Failed to initialize PKI context\n");
        goto cleanup;
    }
    
    // Generate CA certificate
    result = pki_generate_ca_certificate(&pki, "CN=Test CA,O=Test Organization,C=US", 365);
    if (result != 0) {
        fprintf(stderr, "Failed to generate CA certificate\n");
        goto cleanup;
    }
    
    printf("CA certificate generated successfully\n");
    
    // Generate end-entity certificate
    crypto_key_t entity_key;
    result = crypto_generate_key(&entity_key, CRYPTO_ALG_RSA_2048);
    if (result != 0) {
        fprintf(stderr, "Failed to generate entity key\n");
        goto cleanup;
    }
    
    crypto_certificate_t entity_cert;
    result = pki_generate_certificate(&pki, "CN=Test Entity,O=Test Organization,C=US", 
                                    &entity_key, 30, &entity_cert);
    if (result != 0) {
        fprintf(stderr, "Failed to generate entity certificate\n");
        goto cleanup;
    }
    
    printf("Entity certificate generated successfully\n");
    printf("Subject: %s\n", entity_cert.subject);
    printf("Issuer: %s\n", entity_cert.issuer);
    printf("Serial: %s\n", entity_cert.serial_number);
    
    // Verify certificate
    result = pki_verify_certificate(&pki, &entity_cert);
    if (result == 0) {
        printf("Certificate verification: VALID\n");
    } else {
        printf("Certificate verification: INVALID\n");
    }
    
cleanup:
    // Cleanup all resources
    crypto_cleanup();
    printf("\nCryptographic framework cleanup completed\n");
    
    return (result == 0) ? 0 : 1;
}

int crypto_init(void) {
    if (g_crypto_initialized) {
        return 0;
    }
    
    // Initialize OpenSSL
    SSL_load_error_strings();
    SSL_library_init();
    OpenSSL_add_all_algorithms();
    
    // Initialize libsodium
    if (sodium_init() < 0) {
        fprintf(stderr, "Failed to initialize libsodium\n");
        return -1;
    }
    
    // Initialize secure random number generator
    if (secure_random_init(&g_secure_random) != 0) {
        fprintf(stderr, "Failed to initialize secure random number generator\n");
        return -1;
    }
    
    g_crypto_initialized = true;
    return 0;
}

int crypto_generate_key(crypto_key_t *key, crypto_algorithm_t algorithm) {
    if (!key) return -1;
    
    memset(key, 0, sizeof(crypto_key_t));
    key->algorithm = algorithm;
    key->created_time = time(NULL);
    
    switch (algorithm) {
        case CRYPTO_ALG_AES_128_CBC:
        case CRYPTO_ALG_AES_128_GCM:
        case CRYPTO_ALG_AES_128_CTR:
            key->key_length = 16;
            key->key_data = malloc(key->key_length);
            if (!key->key_data) return -1;
            secure_random_bytes(&g_secure_random, key->key_data, key->key_length);
            break;
            
        case CRYPTO_ALG_AES_256_CBC:
        case CRYPTO_ALG_AES_256_GCM:
        case CRYPTO_ALG_AES_256_CTR:
            key->key_length = 32;
            key->key_data = malloc(key->key_length);
            if (!key->key_data) return -1;
            secure_random_bytes(&g_secure_random, key->key_data, key->key_length);
            break;
            
        case CRYPTO_ALG_CHACHA20_POLY1305:
            key->key_length = 32;
            key->key_data = malloc(key->key_length);
            if (!key->key_data) return -1;
            secure_random_bytes(&g_secure_random, key->key_data, key->key_length);
            break;
            
        case CRYPTO_ALG_RSA_2048:
        case CRYPTO_ALG_RSA_4096: {
            int key_bits = (algorithm == CRYPTO_ALG_RSA_2048) ? 2048 : 4096;
            RSA *rsa = RSA_new();
            BIGNUM *bn = BN_new();
            
            if (!rsa || !bn) {
                RSA_free(rsa);
                BN_free(bn);
                return -1;
            }
            
            BN_set_word(bn, RSA_F4);
            
            if (RSA_generate_key_ex(rsa, key_bits, bn, NULL) != 1) {
                RSA_free(rsa);
                BN_free(bn);
                return -1;
            }
            
            key->evp_key = EVP_PKEY_new();
            if (!key->evp_key || EVP_PKEY_assign_RSA(key->evp_key, rsa) != 1) {
                RSA_free(rsa);
                BN_free(bn);
                EVP_PKEY_free(key->evp_key);
                return -1;
            }
            
            BN_free(bn);
            break;
        }
        
        case CRYPTO_ALG_ED25519: {
            key->evp_key = EVP_PKEY_new();
            EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_ED25519, NULL);
            
            if (!key->evp_key || !ctx) {
                EVP_PKEY_free(key->evp_key);
                EVP_PKEY_CTX_free(ctx);
                return -1;
            }
            
            if (EVP_PKEY_keygen_init(ctx) <= 0 || EVP_PKEY_keygen(ctx, &key->evp_key) <= 0) {
                EVP_PKEY_free(key->evp_key);
                EVP_PKEY_CTX_free(ctx);
                return -1;
            }
            
            EVP_PKEY_CTX_free(ctx);
            break;
        }
        
        default:
            return -1;
    }
    
    return 0;
}

int crypto_encrypt_symmetric(const crypto_key_t *key, const unsigned char *plaintext, 
                           size_t plaintext_len, encrypted_data_t *encrypted) {
    if (!key || !plaintext || !encrypted) return -1;
    
    memset(encrypted, 0, sizeof(encrypted_data_t));
    encrypted->algorithm = key->algorithm;
    
    EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new();
    if (!ctx) return -1;
    
    const EVP_CIPHER *cipher = NULL;
    
    switch (key->algorithm) {
        case CRYPTO_ALG_AES_128_CBC:
            cipher = EVP_aes_128_cbc();
            break;
        case CRYPTO_ALG_AES_256_CBC:
            cipher = EVP_aes_256_cbc();
            break;
        case CRYPTO_ALG_AES_128_GCM:
            cipher = EVP_aes_128_gcm();
            break;
        case CRYPTO_ALG_AES_256_GCM:
            cipher = EVP_aes_256_gcm();
            break;
        case CRYPTO_ALG_AES_128_CTR:
            cipher = EVP_aes_128_ctr();
            break;
        case CRYPTO_ALG_AES_256_CTR:
            cipher = EVP_aes_256_ctr();
            break;
        default:
            EVP_CIPHER_CTX_free(ctx);
            return -1;
    }
    
    // Generate random IV
    encrypted->iv_length = EVP_CIPHER_iv_length(cipher);
    encrypted->iv = malloc(encrypted->iv_length);
    if (!encrypted->iv) {
        EVP_CIPHER_CTX_free(ctx);
        return -1;
    }
    secure_random_bytes(&g_secure_random, encrypted->iv, encrypted->iv_length);
    
    // Initialize encryption
    if (EVP_EncryptInit_ex(ctx, cipher, NULL, key->key_data, encrypted->iv) != 1) {
        EVP_CIPHER_CTX_free(ctx);
        free(encrypted->iv);
        return -1;
    }
    
    // Allocate ciphertext buffer
    encrypted->ciphertext = malloc(plaintext_len + EVP_CIPHER_block_size(cipher));
    if (!encrypted->ciphertext) {
        EVP_CIPHER_CTX_free(ctx);
        free(encrypted->iv);
        return -1;
    }
    
    int len, ciphertext_len = 0;
    
    // Encrypt data
    if (EVP_EncryptUpdate(ctx, encrypted->ciphertext, &len, plaintext, plaintext_len) != 1) {
        EVP_CIPHER_CTX_free(ctx);
        free(encrypted->iv);
        free(encrypted->ciphertext);
        return -1;
    }
    ciphertext_len = len;
    
    // Finalize encryption
    if (EVP_EncryptFinal_ex(ctx, encrypted->ciphertext + len, &len) != 1) {
        EVP_CIPHER_CTX_free(ctx);
        free(encrypted->iv);
        free(encrypted->ciphertext);
        return -1;
    }
    ciphertext_len += len;
    encrypted->ciphertext_length = ciphertext_len;
    
    // For GCM mode, get the authentication tag
    if (key->algorithm == CRYPTO_ALG_AES_128_GCM || key->algorithm == CRYPTO_ALG_AES_256_GCM) {
        encrypted->tag_length = 16;
        encrypted->tag = malloc(encrypted->tag_length);
        if (!encrypted->tag) {
            EVP_CIPHER_CTX_free(ctx);
            free(encrypted->iv);
            free(encrypted->ciphertext);
            return -1;
        }
        
        if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG, encrypted->tag_length, encrypted->tag) != 1) {
            EVP_CIPHER_CTX_free(ctx);
            free(encrypted->iv);
            free(encrypted->ciphertext);
            free(encrypted->tag);
            return -1;
        }
    }
    
    EVP_CIPHER_CTX_free(ctx);
    return 0;
}

int crypto_hash_data(const unsigned char *data, size_t data_len, hash_algorithm_t algorithm, 
                   unsigned char *hash, size_t *hash_len) {
    if (!data || !hash || !hash_len) return -1;
    
    const EVP_MD *md = NULL;
    
    switch (algorithm) {
        case HASH_ALG_SHA256:
            md = EVP_sha256();
            break;
        case HASH_ALG_SHA384:
            md = EVP_sha384();
            break;
        case HASH_ALG_SHA512:
            md = EVP_sha512();
            break;
        case HASH_ALG_SHA3_256:
            md = EVP_sha3_256();
            break;
        case HASH_ALG_SHA3_512:
            md = EVP_sha3_512();
            break;
        default:
            return -1;
    }
    
    EVP_MD_CTX *ctx = EVP_MD_CTX_new();
    if (!ctx) return -1;
    
    if (EVP_DigestInit_ex(ctx, md, NULL) != 1 ||
        EVP_DigestUpdate(ctx, data, data_len) != 1 ||
        EVP_DigestFinal_ex(ctx, hash, (unsigned int *)hash_len) != 1) {
        EVP_MD_CTX_free(ctx);
        return -1;
    }
    
    EVP_MD_CTX_free(ctx);
    return 0;
}

int secure_random_init(secure_random_t *rng) {
    if (!rng) return -1;
    
    memset(rng, 0, sizeof(secure_random_t));
    
    // Initialize entropy pool
    if (getrandom(rng->entropy_pool, sizeof(rng->entropy_pool), 0) < 0) {
        return -1;
    }
    
    rng->entropy_available = sizeof(rng->entropy_pool);
    rng->last_reseed = time(NULL);
    rng->initialized = true;
    
    return 0;
}

int secure_random_bytes(secure_random_t *rng, unsigned char *buffer, size_t length) {
    if (!rng || !buffer || !rng->initialized) return -1;
    
    // Use system random for simplicity
    return RAND_bytes(buffer, length) == 1 ? 0 : -1;
}

void crypto_secure_zero(void *ptr, size_t size) {
    if (ptr && size > 0) {
        OPENSSL_cleanse(ptr, size);
    }
}

int crypto_constant_time_compare(const void *a, const void *b, size_t size) {
    return CRYPTO_memcmp(a, b, size);
}

const char *crypto_algorithm_name(crypto_algorithm_t algorithm) {
    switch (algorithm) {
        case CRYPTO_ALG_AES_128_CBC: return "AES-128-CBC";
        case CRYPTO_ALG_AES_256_CBC: return "AES-256-CBC";
        case CRYPTO_ALG_AES_128_GCM: return "AES-128-GCM";
        case CRYPTO_ALG_AES_256_GCM: return "AES-256-GCM";
        case CRYPTO_ALG_AES_128_CTR: return "AES-128-CTR";
        case CRYPTO_ALG_AES_256_CTR: return "AES-256-CTR";
        case CRYPTO_ALG_CHACHA20_POLY1305: return "ChaCha20-Poly1305";
        case CRYPTO_ALG_RSA_2048: return "RSA-2048";
        case CRYPTO_ALG_RSA_4096: return "RSA-4096";
        case CRYPTO_ALG_ECDSA_P256: return "ECDSA-P256";
        case CRYPTO_ALG_ECDSA_P384: return "ECDSA-P384";
        case CRYPTO_ALG_ECDSA_P521: return "ECDSA-P521";
        case CRYPTO_ALG_ED25519: return "Ed25519";
        case CRYPTO_ALG_X25519: return "X25519";
        default: return "Unknown";
    }
}

const char *hash_algorithm_name(hash_algorithm_t algorithm) {
    switch (algorithm) {
        case HASH_ALG_SHA256: return "SHA-256";
        case HASH_ALG_SHA384: return "SHA-384";
        case HASH_ALG_SHA512: return "SHA-512";
        case HASH_ALG_SHA3_256: return "SHA3-256";
        case HASH_ALG_SHA3_512: return "SHA3-512";
        case HASH_ALG_BLAKE2B: return "BLAKE2b";
        case HASH_ALG_BLAKE2S: return "BLAKE2s";
        default: return "Unknown";
    }
}

void crypto_cleanup(void) {
    if (!g_crypto_initialized) return;
    
    secure_random_cleanup(&g_secure_random);
    
    EVP_cleanup();
    ERR_free_strings();
    
    g_crypto_initialized = false;
}

void secure_random_cleanup(secure_random_t *rng) {
    if (!rng) return;
    
    crypto_secure_zero(rng->entropy_pool, sizeof(rng->entropy_pool));
    rng->initialized = false;
}