class Net::SSH::Transport::Kex::Curve25519Sha256

def self.binary_string(string)
  string.dup.force_encoding('BINARY')
end

def self.ensure_supported!
  unless OpenSSL::PKey.respond_to?(:generate_key) && OpenSSL::PKey.respond_to?(:new_raw_public_key)
    raise UnsupportedError, "OpenSSL::PKey raw public key APIs are unavailable"
  end
  key = generate_x25519_key
  public_key = new_raw_public_key(key.raw_public_key)
  validate_key_bytes!(key.derive(public_key), "shared secret", KEY_BYTES)
rescue OpenSSL::PKey::PKeyError => e
  raise UnsupportedError, e.message
end

def self.generate_x25519_key
  OpenSSL::PKey.generate_key(ALGORITHM)
end

def self.new_raw_public_key(key)
  validate_key_bytes!(key, "public key", KEY_BYTES)
  OpenSSL::PKey.new_raw_public_key(ALGORITHM, binary_string(key))
end

def self.validate_key_bytes!(key, label, expected_bytes)
  raise ArgumentError, "invalid X25519 #{label}" unless key.respond_to?(:bytesize) && key.bytesize == expected_bytes
end

def compute_shared_secret(server_ecdh_pubkey)
  pk = self.class.new_raw_public_key(server_ecdh_pubkey)
  OpenSSL::BN.new(ecdh.derive(pk), 2)
end

def digester
  OpenSSL::Digest::SHA256
end

def ecdh_public_key_bytes
  ecdh.raw_public_key
end

def generate_key
  self.class.generate_x25519_key
end