o j;@s ddlmZmZmZmZddlZddlmZm Z m Z m Z m Z m Z ddlmZmZmZmZmZmZmZmZmZddlmZddlmZmZmZmZmZm Z m!Z!m"Z"m#Z#dd l$m%Z%m&Z&m'Z'm(Z(dd l)m*Z*m+Z+m,Z,dd l-m.Z.m/Z/m0Z0m1Z1dd l2m3Z3gd Z4GdddeZ5GdddeZ6GdddeZdIddZ7ddZ8ddZ9ddZ:dJddZ;ddZdJd$d%Z?d&d'Z@d(d)ZAd*d+ZBd,d-ZCd.d/ZDd0d1ZEd2d3ZFd4d5ZGd6d7ZHd8d9ZId:d;ZJdKd=d>ZKd?d@ZLdAdBZMdCdDZNdEdFZOdKdGdHZPdS)L)unicode_literalsdivisionabsolute_importprint_functionN) Certificate DHParametersECDomainParametersPrivateKeyInfoPublicKeyAlgorithm PublicKeyInfo) _CertificateBase _fingerprint _parse_pkcs12_PrivateKeyBase_PublicKeyBase_unwrap_private_key_infoparse_certificate parse_private parse_public)pretty_message) buffer_from_bytesbuffer_pointerbytes_from_bufferderefis_nullnewnullunwrapwrite_to_buffer) libcryptoLibcryptoConstlibcrypto_version_infohandle_openssl_error)AsymmetricKeyErrorIncompleteAsymmetricKeyErrorSignatureError) type_namestr_clsbyte_cls int_types)constant_compare)rdsa_sign dsa_verify ecdsa_sign ecdsa_verify generate_pairload_certificate load_pkcs12load_private_keyload_public_key parse_pkcs12 PrivateKey PublicKeyrsa_oaep_decryptrsa_oaep_encryptrsa_pkcs1v15_decryptrsa_pkcs1v15_encryptrsa_pkcs1v15_signrsa_pkcs1v15_verify rsa_pss_signrsa_pss_verifyc@sDeZdZdZdZdZdZddZeddZ eddZ d d Z dS) r7zC Container for the OpenSSL representation of a private key NcC||_||_t|_dS)z :param evp_pkey: An OpenSSL EVP_PKEY value from loading/importing the key :param asn1: An asn1crypto.keys.PrivateKeyInfo object Nevp_pkeyasn1r!_libselfrCrDrH/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/oscrypto/_openssl/asymmetric.py__init__P  zPrivateKey.__init__c Cs|jdurbt|jt}t|}t|}t|j|}t|t||}t |}t dkrJ|j dkrJ| }d|dd<|}t||t|}ttt||} t| r\tdt| ||_|jS)z\ :return: A PublicKey object corresponding to this private key. N rsassa_pssrsa algorithmr) _public_keyr! i2d_PUBKEYrCrrrr$rr loadr#rPcopydumprlen d2i_PUBKEYrr8) rG buffer_size pubkey_bufferpubkey_pointer pubkey_length pubkey_datarD temp_asn1 temp_data pub_evp_pkeyrHrHrI public_key]s&      zPrivateKey.public_keycCs|jdur t|jt|_|jS)aY Creates a fingerprint that can be compared with a public key to see if the two form a pair. This fingerprint is not compatible with fingerprints generated by any other software. :return: A byte string that is a sha256 hash of selected components (based on the key type) N)rrDr4rGrHrHrI fingerprints zPrivateKey.fingerprintcC(|jr|j|jd|_d|_dSdSNrCrE EVP_PKEY_freerarHrHrI__del__  zPrivateKey.__del__) __name__ __module__ __qualname____doc__rCrQrErJpropertyr`rbrgrHrHrHrIr7Ds !  r7c@s(eZdZdZdZdZddZddZdS)r8zB Container for the OpenSSL representation of a public key NcCrA)z :param evp_pkey: An OpenSSL EVP_PKEY value from loading/importing the key :param asn1: An asn1crypto.keys.PublicKeyInfo object NrBrFrHrHrIrJrKzPublicKey.__init__cCrcrdrerarHrHrIrgrhzPublicKey.__del__)rirjrkrlrCrErJrgrHrHrHrIr8s  r8c@sTeZdZdZdZdZdZdZddZe ddZ e ddZ e d d Z d d Z dS) rzC Container for the OpenSSL representation of a certificate NcCrA)z :param x509: An OpenSSL X509 value from loading/importing the certificate :param asn1: An asn1crypto.x509.Certificate object N)x509rDr!rE)rGrnrDrHrHrIrJrKzCertificate.__init__cCs|jjS)z_ :return: The EVP_PKEY of the public key this certificate contains )r`rCrarHrHrIrCszCertificate.evp_pkeycCsX|js)|jr)tdkr|jjjdkrt|jj|_|jSt|j}t ||jj|_|jS)zh :return: The PublicKey object for the public key this certificate contains rLrN) rQrnr#rDr`rPr5r!X509_get_pubkeyr8)rGrCrHrHrIr`s  zCertificate.public_keycCs|jdured|_|jjtddgvre|jdj}|jdj}|dkr%t}n|dkr,t}n|dkr3t}n|d kr:t }nt t d |z||j |jd j |jd |d |_W|jStydY|jSw|jS)zT :return: A boolean - if the certificate is self-signed NFyesmaybesignature_algorithmrsassa_pkcs1v15rNdsaecdsaz Unable to verify the signature of the certificate since it uses the unsupported algorithm %s signature_valuetbs_certificateT) _self_signedrD self_signedsetsignature_algo hash_algor>r@r.r0OSErrorrr`nativerUr')rGr{r| verify_funcrHrHrIrys>      zCertificate.self_signedcCs>|jr |jd|_|jr|j|jd|_d|_dSdSrd)rQrgrnrE X509_freerarHrHrIrgs  zCertificate.__del__)rirjrkrlrnrQrxrErJrmrCr`ryrgrHrHrHrIrs    +rc Cs|tgdvrttdt||dkr'|tgdvr&ttdt|n=|dkrOtdkr=|dkr[szload_pkcs12..) rr)rr*rrr(rrr6rr) rrrkey_info cert_infoextra_certs_infokeycert extra_certsrHrHrIr3#s6        r3cCt||tjS)aF Encrypts a byte string using an RSA public key or certificate. Uses PKCS#1 v1.5 padding. :param certificate_or_public_key: A PublicKey or Certificate object :param data: A byte string, with a maximum length 11 bytes less than the key length (in bytes) :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the encrypted data )_encryptr"RSA_PKCS1_PADDINGcertificate_or_public_keyrrHrHrIr<`r<cCr)a Decrypts a byte string using an RSA private key. Uses PKCS#1 v1.5 padding. :param private_key: A PrivateKey object :param ciphertext: A byte string of the encrypted data :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the original plaintext )_decryptr"r private_key ciphertextrHrHrIr;xsr;cCr)aZ Encrypts a byte string using an RSA public key or certificate. Uses PKCS#1 OAEP padding with SHA1. :param certificate_or_public_key: A PublicKey or Certificate object :param data: A byte string, with a maximum length 41 bytes (or more) less than the key length (in bytes) :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the encrypted data )rr"RSA_PKCS1_OAEP_PADDINGrrHrHrIr:rr:cCr)a Decrypts a byte string using an RSA private key. Uses PKCS#1 OAEP padding with SHA1. :param private_key: A PrivateKey object :param ciphertext: A byte string of the encrypted data :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the original plaintext )rr"rrrHrHrIr9sr9cCstdkr t|St|S)z Handles the function name change from OpenSSL 1.1 -> 3.0 :param evp_pkey: The EVP_PKEY of the Certificte or PublicKey to get the size of :return: An int of the number of bytes necessary for the key rL)r#r! EVP_PKEY_sizeEVP_PKEY_get_size)rCrHrHrI_evp_pkey_get_sizes  rc Cst|ttfsttdt|t|tsttdt|d}z,t|j}t |}t |j}t t |||||}t|t||W|rLt |SS|rUt |ww)a% Encrypts plaintext using an RSA public key or certificate :param certificate_or_public_key: A PublicKey, Certificate or PrivateKey object :param data: The byte string to encrypt :param padding: The padding mode to use :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the encrypted data certificate_or_public_key must be an instance of the Certificate or PublicKey class, not %s < data must be a byte string, not %s N)rrr8rrr(r*rrCrr!EVP_PKEY_get1_RSARSA_public_encryptrVr$rr)rrpaddingrOrXrresrHrHrIrs.      rc Cst|tsttdt|t|tsttdt|d}z,t|j}t|}t |j}t t |||||}t |t||W|rJt |SS|rSt |ww)a Decrypts RSA ciphertext using a private key :param private_key: A PrivateKey object :param ciphertext: The ciphertext - a byte string :param padding: The padding mode to use :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the plaintext zY private_key must be an instance of the PrivateKey class, not %s zB ciphertext must be a byte string, not %s N)rr7rrr(r*rrCrr!rRSA_private_decryptrVr$rr)rrrrOrXrrrHrHrIrs.       rcC,|jdkrttd|jt||||S)a Verifies an RSASSA-PKCS-v1.5 signature. When the hash_algorithm is "raw", the operation is identical to RSA public key decryption. That is: the data is not hashed and no ASN.1 structure with an algorithm identifier of the hash algorithm is placed in the encrypted byte string. :param certificate_or_public_key: A Certificate or PublicKey instance to verify the signature with :param signature: A byte string of the signature to verify :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384", "sha512" or "raw" :raises: oscrypto.errors.SignatureError - when the signature is determined to be invalid ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library rOL The key specified is not an RSA public key, but %s rPrrupper_verifyr signaturerhash_algorithmrHrHrIr><s r>cCs<|j}|dkr|dkrttd|jt||||ddS)a Verifies an RSASSA-PSS signature. For the PSS padding the mask gen algorithm will be mgf1 using the same hash algorithm as the signature. The salt length with be the length of the hash algorithm, and the trailer field with be the standard 0xBC byte. :param certificate_or_public_key: A Certificate or PublicKey instance to verify the signature with :param signature: A byte string of the signature to verify :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384" or "sha512" :raises: oscrypto.errors.SignatureError - when the signature is determined to be invalid ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library rOrNrTrsa_pss_paddingr)rrrrcp_algrHrHrIr@dsr@cCr)a Verifies a DSA signature :param certificate_or_public_key: A Certificate or PublicKey instance to verify the signature with :param signature: A byte string of the signature to verify :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384" or "sha512" :raises: oscrypto.errors.SignatureError - when the signature is determined to be invalid ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library rtzK The key specified is not a DSA public key, but %s rrrHrHrIr. r.cCr)a Verifies an ECDSA signature :param certificate_or_public_key: A Certificate or PublicKey instance to verify the signature with :param signature: A byte string of the signature to verify :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384" or "sha512" :raises: oscrypto.errors.SignatureError - when the signature is determined to be invalid ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library rzK The key specified is not an EC public key, but %s rrrHrHrIr0rr0Fc Cst|ttfsttdt|t|tsttdt|t|ts,ttdt||j}|dkp6|dk}tgd}|rH|sH|tdgO}||vr`d}|rV|sV|d 7}t td |t ||sm|rmt td | |r|dkrt ||j d krt td |j t |d} zAt|j} t| rtdt|j} t| } tt ||| | tj} t| t| | } t|| stdW| rt| dSdS| rt| wwd}d} d}d}d}d}ztdkrt}nt}tjtj tj!tj"tj#tj$d|}tdkr|rI|rIt%t&||'}t|j} t| r$tdt|j} t| }tt |||| tj(}t|t)| |||tj*}n |rqt+||t,}t|t-||t |}t|t.||t ||j}n|dkrt%t&||'}t|}t/|}t0t,|t |}t|rtdt1|j}t|rtdt2|t |||}n|dkrt%t&||'}t|}t/|}t3t,|t |}t|rtdt4|j}t|rtdt5|t |||}n]t6td}t7|||t,|j}t|t8|}|r>t9|tj:dtj;tjt9|tj:tj=tj>Btj?dt,}t|t-||t |}t|t@||t |}|dkr]tdt|W|rutdkrptA|ntB|| r}t| |rtC||rtD||rtE||rtF|dSdS|rtdkrtA|ntB|| rt| |rtC||rtD||rtE||rtF|ww)aI Verifies an RSA, DSA or ECDSA signature :param certificate_or_public_key: A Certificate or PublicKey instance to verify the signature with :param signature: A byte string of the signature to verify :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384" or "sha512" :param rsa_pss_padding: If the certificate_or_public_key is an RSA key, this enables PSS padding :raises: oscrypto.errors.SignatureError - when the signature is determined to be invalid ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library rzA signature must be a byte string, not %s rrOrNmd5sha1sha224sha256sha384sha512raw5"md5", "sha1", "sha224", "sha256", "sha384", "sha512", "raw"B hash_algorithm must be one of %s, not %s o PSS padding can only be used with RSA keys - the key provided is a %s key data must be 11 bytes shorter than the key size when hash_algorithm is "raw" - key size is %s bytes, but data is %s bytes long NrzSignature is invalidr r rrtrEVP_PKEY_CTX **rMrr )Grrr8rrr(r*rPrzrrrrV byte_sizer!rrCrr$rrRSA_public_decryptr"rrr,r'rr#EVP_MD_CTX_createEVP_MD_CTX_newEVP_md5EVP_sha1 EVP_sha224 EVP_sha256 EVP_sha384 EVP_sha512getattrhashlibdigestRSA_NO_PADDINGRSA_verify_PKCS1_PSSEVP_MD_CTX_FLAG_PSS_MDLENEVP_DigestInit_exrEVP_DigestUpdateEVP_VerifyFinalr d2i_DSA_SIGEVP_PKEY_get1_DSA DSA_do_verify d2i_ECDSA_SIGEVP_PKEY_get1_EC_KEYECDSA_do_verifyrEVP_DigestVerifyInitrEVP_PKEY_CTX_ctrl EVP_PKEY_RSAEVP_PKEY_CTRL_RSA_PADDINGRSA_PKCS1_PSS_PADDINGEVP_PKEY_OP_SIGNEVP_PKEY_OP_VERIFYEVP_PKEY_CTRL_RSA_PSS_SALTLENEVP_DigestVerifyFinalEVP_MD_CTX_destroyEVP_MD_CTX_freer DSA_SIG_freerECDSA_SIG_free)rrrrrr cp_is_rsavalid_hash_algorithmsvalid_hash_algorithms_errorrOrXdecrypted_bufferdecrypted_lengthdecrypted_bytes evp_md_ctxrtdsa_sigr ecdsa_sigevp_mdrdecoded_bufferdecoded_lengthrsignature_buffersignature_pointerevp_pkey_ctx_pointer_pointerevp_pkey_ctx_pointerrHrHrIrs                                           rcC*|jdkrttd|jt|||S)a^ Generates an RSASSA-PKCS-v1.5 signature. When the hash_algorithm is "raw", the operation is identical to RSA private key encryption. That is: the data is not hashed and no ASN.1 structure with an algorithm identifier of the hash algorithm is placed in the encrypted byte string. :param private_key: The PrivateKey to generate the signature with :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384", "sha512" or "raw" :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the signature rOM The key specified is not an RSA private key, but %s rPrrr_signrrrrHrHrIr=s  r=cCs8|j}|dkr|dkrttd|t|||ddS)a. Generates an RSASSA-PSS signature. For the PSS padding the mask gen algorithm will be mgf1 using the same hash algorithm as the signature. The salt length with be the length of the hash algorithm, and the trailer field with be the standard 0xBC byte. :param private_key: The PrivateKey to generate the signature with :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384" or "sha512" :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the signature rOrNrCTrrD)rrrpkey_algrHrHrIr? sr?cCrB)aA Generates a DSA signature :param private_key: The PrivateKey to generate the signature with :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384" or "sha512" :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the signature rtzL The key specified is not a DSA private key, but %s rDrFrHrHrIr-/  r-cCrB)aD Generates an ECDSA signature :param private_key: The PrivateKey to generate the signature with :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384" or "sha512" :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the signature rzL The key specified is not an EC private key, but %s rDrFrHrHrIr/PrHr/c Cst|tsttdt|t|tsttdt||j}|dkp&|dk}tgd}|dkr:|s:|tdgO}||vrRd}|rH|sH|d7}ttd |t ||s_|r_ttd | |r|dkrt ||j d kryttd |j t |d }z5t |j}t|rtdt|j} t| } t t ||| |tj} t| t| | W|rt |SS|rt |wwd } d }d } d }d }d }ztdkrt } nt } t jt jt jt jt j t j!d|}tdkr|r5|r5t"t#||$}t |j}t|r tdt|j} t| }t %||||tj&}t|t| } t | || |tj'} t| nA|rrt|j} t| } t(t d} t )| |t*}t|t +| |t |}t|t ,| | | |j}t|t-| } n|dkrt"t#||$}t .|j} t| rtdt /|t || }t|rtdt 0|t*} t| } t1| }t 0||} t| n|dkrt"t#||$}t 2|j}t|rtdt 3|t ||}t|rtdt 4|t*} t| } t1| }t 4||} t| nrt|j} t| } t(t d| } t(t d}t 5| ||t*|j}t|t6|}|rZt 7|tj8dtj9tj:t*}t|tdkrZt 7|tj8tj;tj| | | }t|t-| } t| | W| rtdkrt ?| nt @| |rt || rt A| |rt B||rt C||rt D|SS| rtdkrt ?| nt @| |rt || rt A| |rt B||rt C||rt D|ww)a Generates an RSA, DSA or ECDSA signature :param private_key: The PrivateKey to generate the signature with :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384" or "sha512" :param rsa_pss_padding: If the private_key is an RSA key, this enables PSS padding :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the signature zO private_key must be an instance of PrivateKey, not %s rrOrNrrrrrrrrNrrrzunsigned int *rtrzsize_t *r r r )Err7rrr(r*rPrzrrrrVr r!rrCrr$rrRSA_private_encryptr"rrrr#rrrrrrrrrrrRSA_padding_add_PKCS1_PSSrrrrrr EVP_SignFinalrr  DSA_do_sign i2d_DSA_SIGrr# ECDSA_do_sign i2d_ECDSA_SIGEVP_DigestSignInitrr&r'r(r)r*r+r,EVP_DigestSignFinalr.r/rr0rr1)rrrrrG pkey_is_rsar3r4rOrXr>signature_lengthr8rtr9rr:r;r em_bufferrr?r@rArHrHrIrEqs                                                     rE)NNrd)F)Q __future__rrrrr_asn1rrrr r r r _asymmetricr rrrrrrrr_errorsr_ffirrrrrrrrr _libcryptor!r"r#r$errorsr%r&r'_typesr(r)r*r+utilr,__all__r7r8r1rr2rr4r5rr6r3r<r;r:r9rrrr>r@r.r0rr=r?r-r/rErHrHrHrIsV , ,  T lOC' 8F  =87('" "'&!!