if(isset($_POST["gen_key"])){

	if($privkey = openssl_get_privatekey(file_get_contents("tools/privkey.ec.pem"), $_ENV["PRIVKEY_PASSPHRASE"])){

		$token = hash_pbkdf2("sha512", $_SESSION["password"], $_SESSION["pretoken"], 1000, 64, true);
		$success = openssl_sign($_SESSION["username"].$token, $signature, $privkey, openssl_get_md_methods()[14]);
		openssl_free_key($privkey);
		if($success){
			$pubkey = openssl_get_publickey(file_get_contents("tools/pubkey.ec.pem"));
			$success = openssl_verify($_SESSION["username"].$token, $signature, $pubkey, openssl_get_md_methods()[14]);
			openssl_free_key($pubkey);
			if($success==1){
				$user_credential_data = $_SESSION["username"]."\0".$signature;
				if(isset($_POST["passphrase"]) && ($_POST["passphrase"] != "")){
					$encrypted_prefix = "\xec";
					$salt = random_bytes(16);
					$pbkdf2_output = openssl_pbkdf2($_POST["passphrase"], $salt, 48, 100, "sha256");
					$pbkdf2_arr = unpack('C*', $pbkdf2_output);
					$encrypt_key = implode(array_map("chr", array_slice($pbkdf2_arr, 0, -16)));
					$iv = implode(array_map("chr", array_slice($pbkdf2_arr, -16)));
					error_log("keylen: ".strlen($encrypt_key).", ivlen: ".strlen($iv));
					$encrypt_out = openssl_encrypt($user_credential_data, "aes-256-gcm", $encrypt_key, $options=OPENSSL_RAW_DATA, $iv, $tag);
					if($encrypt_out !== false){
						$user_credential_data = $encrypted_prefix . $salt . $encrypt_out . $tag;
					}
					else { error_log("OpenSSL encryption error, aborting key encryption"); }

				}
				$d_out = "TInyAuthKF".$user_credential_data;
				$binname = tempnam("/tmp", "kfbin_");
				$tifname = tempnam("/tmp", "kfti_");
				error_log("File Names: ".$binname.", ".$tifname);
				$tf = fopen($binname, "wb");
				fwrite($tf, $d_out);
				fclose($tf);
				$cmd = "tools/convbin -i ".$binname." -j bin -o ".$tifname." -k 8xv -n TIAuthKF";
				shell_exec($cmd);
				header('Content-Type: application/octetstream; name="TInyAuthKF.8xv"');
				header('Content-Type: application/octet-stream; name="TInyAuthKF.8xv"');
				header('Content-Disposition: attachment; filename="TInyAuthKF.8xv"');
				echo file_get_contents($tifname);
				unlink($binname);
				unlink($tifname);
				exit();
			}
			else { $errors[] = "Signature not valid."; }
		}
		else { $errors[] = "Error generating downloadable keyfile."; }
	}
	else { $errors[] = "Error loading server private key."; }
}