import UIKit

class ViewController: UIViewController {

    let tag = "com.michaelborgmann.keys"

    let access: SecAccessControl
    let attributes: [String : Any]

    required init?(coder: NSCoder) {
        access = SecAccessControlCreateWithFlags(kCFAllocatorDefault,
                                                 kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
                                                 [.privateKeyUsage, .biometryCurrentSet],
                                                 nil)!   // Ignore error

        attributes = [
            kSecAttrKeyType as String: kSecAttrKeyTypeEC,
            kSecAttrKeySizeInBits as String: 256,
            kSecAttrTokenID as String: kSecAttrTokenIDSecureEnclave,
            kSecPrivateKeyAttrs as String: [
                kSecAttrIsPermanent as String: true,
                kSecAttrApplicationTag as String: tag,
                kSecAttrAccessControl as String: access
            ]
        ]

        super.init(coder: coder)
    }

    override func viewDidLoad() {
        super.viewDidLoad()

        let keyPair = try! createKeyPair()
        let message = "secret message".data(using: .utf8)?.base64EncodedData()

        let encrypted = encrypt(message!, key: keyPair.public)

        let decrypted = decrypt(encrypted!, key: keyPair.private)

        let decode = Data(base64Encoded: decrypted!)
        let string = String(data: decode!, encoding: .utf8)

        print(string)
    }


}

extension ViewController {

    private func createKeyPair() throws -> (`public`: SecKey, `private`: SecKey) {
        var error: Unmanaged<CFError>?
        guard let privateKey = SecKeyCreateRandomKey(attributes as CFDictionary, &error) else {
            throw error!.takeRetainedValue() as Error
        }

        guard let publicKey = SecKeyCopyPublicKey(privateKey) else {
            throw error!.takeRetainedValue() as Error
        }

        return (public: publicKey, private: privateKey)
    }

    private func encrypt(_ digest: Data, key: SecKey) -> Data? {
        let algorithm = SecKeyAlgorithm.eciesEncryptionStandardX963SHA256AESGCM
        return SecKeyCreateEncryptedData(key, algorithm, digest as CFData, nil) as! Data
    }

    private func decrypt(_ digest: Data, key: SecKey) -> Data?{
        let algorithm = SecKeyAlgorithm.eciesEncryptionStandardX963SHA256AESGCM
        return SecKeyCreateDecryptedData(key, algorithm, digest as CFData, nil) as! Data
    }

}