3
kZ4 @ s d dl Z d dlZd dlZddlmZmZ ddlmZ ddlm Z m
Z
m Z m Z m
Z
mZmZmZ yd dlmZ d dlmZmZmZ d dlmZmZmZmZm Z m Z m Z m Z d d l m!Z!m"Z" d d
l#m$Z$m%Z% d d l&m'Z' d d l(m)Z) d
Z*W n e+k
r dZ*Y nX e,ddddddddddg
Z-dd Z.G dd d e/Z0G d d d e0Z1G d d d e0Z2e*rG d!d" d"e0Z3G d#d$ d$e0Z4G d%d& d&e3Z5dS )' N )constant_time_compare string_types)InvalidKeyError)base64url_decodebase64url_encodeder_to_raw_signature force_bytes
force_unicodefrom_base64url_uintraw_to_der_signatureto_base64url_uint)hashes)load_pem_private_keyload_pem_public_keyload_ssh_public_key)
RSAPrivateKey RSAPublicKeyRSAPrivateNumbersRSAPublicNumbersrsa_recover_prime_factors rsa_crt_dmp1 rsa_crt_dmq1 rsa_crt_iqmp)EllipticCurvePrivateKeyEllipticCurvePublicKey)ecpadding)default_backend)InvalidSignatureTFRS256RS384RS512ES256ES384ES521ES512PS256PS384PS512c C s t ttjttjttjd} tr| jttjttjttjttjttjttjttjt t jt t jt t jd
| S )zE
Returns the algorithms that are implemented by the library.
)ZnoneZHS256ZHS384ZHS512)
r r! r" r# r$ r% r& r' r( r) )
NoneAlgorithm
HMACAlgorithmSHA256SHA384SHA512
has_cryptoupdate RSAAlgorithm ECAlgorithmRSAPSSAlgorithm)Zdefault_algorithms r4 /usr/lib/python3.6/algorithms.pyget_default_algorithms& s" r6 c @ s@ e Zd ZdZdd Zdd Zdd Zedd Zed
d Z d S )
AlgorithmzH
The interface for an algorithm used to sign and verify tokens.
c C s t dS )z
Performs necessary validation and conversions on the key and returns
the key value in the proper format for sign() and verify().
N)NotImplementedError)selfkeyr4 r4 r5 prepare_keyF s zAlgorithm.prepare_keyc C s t dS )zn
Returns a digital signature for the specified message
using the specified key value.
N)r8 )r9 msgr: r4 r4 r5 signM s zAlgorithm.signc C s t dS )zz
Verifies that the specified digital signature is valid
for the specified message and key values.
N)r8 )r9 r< r: sigr4 r4 r5 verifyT s zAlgorithm.verifyc C s t dS )z7
Serializes a given RSA key into a JWK
N)r8 )key_objr4 r4 r5 to_jwk[ s zAlgorithm.to_jwkc C s t dS )zb
Deserializes a given RSA key from JWK back into a PublicKey or PrivateKey object
N)r8 )jwkr4 r4 r5 from_jwkb s zAlgorithm.from_jwkN)
__name__
__module__ __qualname____doc__r; r= r? staticmethodrA rC r4 r4 r4 r5 r7 B s r7 c @ s( e Zd ZdZdd Zdd Zdd ZdS ) r* zZ
Placeholder for use when no signing or verification
operations are required.
c C s |dkr d }|d k r t d|S )N z*When alg = "none", key value must be None.)r )r9 r: r4 r4 r5 r; o s
zNoneAlgorithm.prepare_keyc C s dS )N r4 )r9 r< r: r4 r4 r5 r= x s zNoneAlgorithm.signc C s dS )NFr4 )r9 r< r: r> r4 r4 r5 r? { s zNoneAlgorithm.verifyN)rD rE rF rG r; r= r? r4 r4 r4 r5 r* j s r* c @ sZ e Zd ZdZejZejZej Z
dd Z dd Z e
dd Ze
dd Zd
d Zd d
ZdS )r+ zf
Performs signing and verification operations using HMAC
and the specified hash function.
c C s
|| _ d S )N)hash_alg)r9 rK r4 r4 r5 __init__ s zHMACAlgorithm.__init__c s6 t ddddg}t fdd|D r2td S )Ns -----BEGIN PUBLIC KEY-----s -----BEGIN CERTIFICATE-----s -----BEGIN RSA PUBLIC KEY-----s ssh-rsac s g | ] }| kqS r4 r4 ).0Z string_value)r: r4 r5
s z-HMACAlgorithm.prepare_key..zdThe specified key is an asymmetric key or x509 certificate and should not be used as an HMAC secret.)r anyr )r9 r: Zinvalid_stringsr4 )r: r5 r; s zHMACAlgorithm.prepare_keyc C s t jttt| ddS )Noct)kkty)jsondumpsr
r r )r@ r4 r4 r5 rA s zHMACAlgorithm.to_jwkc C s, t j| }|jddkr tdt|d S )NrR rP zNot an HMAC keyrQ )rS loadsgetr r )rB objr4 r4 r5 rC s
zHMACAlgorithm.from_jwkc C s t j||| jj S )N)hmacnewrK Zdigest)r9 r< r: r4 r4 r5 r= s zHMACAlgorithm.signc C s t || j||S )N)r r= )r9 r< r: r> r4 r4 r5 r? s zHMACAlgorithm.verifyN)rD rE rF rG hashlibZsha256r, Zsha384r- Zsha512r. rL r; rH rA rC r= r? r4 r4 r4 r5 r+ s r+ c @ sZ e Zd ZdZejZejZejZdd Zdd Z e
dd Z e
dd Z d
d Z
d d
ZdS )r1 z~
Performs signing and verification operations using
RSASSA-PKCS-v1_5 and the specified hash function.
c C s
|| _ d S )N)rK )r9 rK r4 r4 r5 rL s zRSAAlgorithm.__init__c C s t |tst |tr|S t |tr~t|}y.|jdrFt|t d}nt|d t d}W q t k
rz t
|t d}Y qX nt d|S )Ns ssh-rsa)backend)passwordr[ z Expecting a PEM-formatted key.)
isinstancer r r r
startswithr r r
ValueErrorr TypeError)r9 r: r4 r4 r5 r; s
zRSAAlgorithm.prepare_keyc C s d }t | dd r| j }ddgtt|jjtt|jjtt|jtt|jtt|j tt|j
tt|j tt|j d
}nBt | dd r| j }ddgtt|jtt|jd}nt
dtj|S )Nprivate_numbersRSAr= )
rR key_opsnedpqdpdqqir? )rR rc rd re zNot a public or private key)getattrra r
r
public_numbersrd re rf rg rh dmp1dmq1iqmpr rS rT )r@ rW numbersr4 r4 r5 rA s* zRSAAlgorithm.to_jwkc s yt j| W n tk
r* tdY nX jddkrBtdd koXd koXd krfd krltd d
d d d
dg} fdd|D }t|}|rt| rtdtt d t d }|rt t d t d
t d t d t d
t d |d}nHt d }t
|j ||j \}}t |||t
||t||t|||d}|jt S d krd krtt d t d }|jt S tdd S )NzKey is not valid JSONrR rb zNot an RSA keyrf re rd Zothz5Unsupported RSA private key: > 2 primes not supportedrg rh ri rj rk c s g | ] }| kqS r4 r4 )rM Zprop)rW r4 r5 rN s z)RSAAlgorithm.from_jwk..z@RSA key must include all parameters if any are present besides d)rf rg rh rn ro rp rm zNot a public or private key)rS rU r_ r rV rO allr r r r rd re r r r Z private_keyr Z
public_key) rB Z other_propsZ props_foundZany_props_foundrm rq rf rg rh r4 )rW r5 rC sT
zRSAAlgorithm.from_jwkc C s |j |tj | j S )N)r= r PKCS1v15rK )r9 r< r: r4 r4 r5 r= 8 s zRSAAlgorithm.signc C s6 y |j ||tj | j dS tk
r0 dS X d S )NTF)r? r rs rK r )r9 r< r: r> r4 r4 r5 r? ; s
zRSAAlgorithm.verifyN)rD rE rF rG r r, r- r. rL r; rH rA rC r= r? r4 r4 r4 r5 r1 s $ ?r1 c @ sB e Zd ZdZejZejZejZdd Zdd Z dd Z
dd Z d
S ) r2 zr
Performs signing and verification operations using
ECDSA and the specified hash function
c C s
|| _ d S )N)rK )r9 rK r4 r4 r5 rL K s zECAlgorithm.__init__c C s t |tst |tr|S t |tr~t|}y,|jdrFt|t d}nt|t d}W q t k
rz t
|d t d}Y qX nt d|S )Ns ecdsa-sha2-)r[ )r\ r[ z Expecting a PEM-formatted key.) r] r r r r r^ r r r r_ r r` )r9 r: r4 r4 r5 r; N s
zECAlgorithm.prepare_keyc C s" |j |tj| j }t||jS )N)r= r ECDSArK r curve)r9 r< r: der_sigr4 r4 r5 r= f s zECAlgorithm.signc C s\ yt ||j}W n tk
r$ dS X y |j||tj| j dS tk
rV dS X d S )NFT)r ru r_ r? r rt rK r )r9 r< r: r> rv r4 r4 r5 r? k s zECAlgorithm.verifyN) rD rE rF rG r r, r- r. rL r; r= r? r4 r4 r4 r5 r2 B s r2 c @ s e Zd ZdZdd Zdd ZdS )r3 zA
Performs a signature using RSASSA-PSS with MGF1
c C s* |j |tjtj| j | jjd| j S )N)mgf salt_length)r= r PSSMGF1rK digest_size)r9 r< r: r4 r4 r5 r= | s
zRSAPSSAlgorithm.signc
C sJ y0|j ||tjtj| j | jjd| j dS tk
rD dS X d S )N)rw rx TF)r? r ry rz rK r{ r )r9 r< r: r> r4 r4 r5 r? s
zRSAPSSAlgorithm.verifyN)rD rE rF rG r= r? r4 r4 r4 r5 r3 w s
r3 )6rZ rX rS compatr r
exceptionsr Zutilsr r r r r
r r r
Z cryptography.hazmat.primitivesr Z,cryptography.hazmat.primitives.serializationr r r Z-cryptography.hazmat.primitives.asymmetric.rsar r r r r r r r Z,cryptography.hazmat.primitives.asymmetric.ecr r Z)cryptography.hazmat.primitives.asymmetricr r Z cryptography.hazmat.backendsr Zcryptography.exceptionsr r/ ImportErrorsetZrequires_cryptographyr6 objectr7 r* r+ r1 r2 r3 r4 r4 r4 r5 s6 ( (
(4 5