o j@sLddlmZmZmZmZddlmZddlZddlZddl Z ddl m Z m Z mZmZmZmZmZmZmZddlmZmZmZmZmZmZmZmZmZddlm Z ddl!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)d d l*m+Z+m,Z,m-Z-m.Z.d d l/m0Z0m1Z1m2Z2d d l3m4Z4dd l5m6Z6m7Z7m8Z8ddl9m:Z:m;Z;mZ>m?Z?m@Z@mAZAgdZBGdddeZCGdddeZDGdddeZ dIddZEddZFddZGddZHdJdd ZId!d"ZJd#d$ZKdJd%d&ZLdJd'd(ZMd)d*ZNd+d,ZOd-d.ZPd/d0ZQd1d2ZRd3d4ZSd5d6ZTd7d8ZUd9d:ZVd;d<ZWd=d>ZXd?d@ZYdAdBZZdCdDZ[dEdFZ\dGdHZ]dS)K)unicode_literalsdivisionabsolute_importprint_function) b32encodeN) CertificateECDomainParametersIntegerKeyExchangeAlgorithmNullPrivateKeyInfoPublicKeyAlgorithm PublicKeyInfo RSAPublicKey) _CertificateBase _fingerprint _parse_pkcs12_PrivateKeyBase_PublicKeyBase_unwrap_private_key_infoparse_certificate parse_private parse_public)pretty_message)newunwrapbytes_from_bufferbuffer_from_bytesderefnullis_null pointer_set)Security SecurityConsthandle_sec_errorosx_version_info)CoreFoundation CFHelpershandle_cf_error) rand_bytes)AsymmetricKeyErrorIncompleteAsymmetricKeyErrorSignatureError)add_pss_paddingverify_pss_padding"remove_pkcs1v15_encryption_padding) type_namestr_clsbyte_cls int_types)rdsa_sign dsa_verify ecdsa_sign ecdsa_verify generate_pairload_certificate load_pkcs12load_private_keyload_public_key parse_pkcs12 PrivateKey PublicKeyrsa_oaep_decryptrsa_oaep_encryptrsa_pkcs1v15_decryptrsa_pkcs1v15_encryptrsa_pkcs1v15_signrsa_pkcs1v15_verify rsa_pss_signrsa_pss_verifyc@sDeZdZdZdZdZdZddZeddZ eddZ d d Z dS) r@zM Container for the OS crypto library representation of a private key NcC||_||_t|_dS)z :param sec_key_ref: A Security framework SecKeyRef value from loading/importing the key :param asn1: An asn1crypto.keys.PrivateKeyInfo object N sec_key_refasn1r(_libselfrLrMrQ/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/oscrypto/_mac/asymmetric.py__init__M  zPrivateKey.__init__c CsT|jdurd}zttd}t|jddt|}t|t|}t |}t |}|j dkrKt tdtdt|djd|djdd d }nE|j d kru|d d }t td |dtt|dj|djj|djd }n|j dkrt tdtd|jdd|djdd }W|rt|n |rt|wwt||_|jS)z\ :return: A PublicKey object corresponding to this private key. N CFDataRef *rrsa) algorithm parameters private_keymoduluspublic_exponent)rZr[)rW public_keydsaprivate_key_algorithmrXgpecnamed)namevaluer\) _public_keyrr(r$ SecItemExportrLr r&rr)cf_data_to_bytesrrWrrr rparsedcopyr pownativer curve CFRelease _load_key)rPcf_data_privatecf_data_private_pointerresultprivate_key_byteskey public_asn1paramsrQrQrRr\[sj             zPrivateKey.public_keycCs|jdur t|jt|_|jS)aY Creates a fingerprint that can be compared with a public key to see if the two form a pair. This fingerprint is not compatible with fingerprints generated by any other software. :return: A byte string that is a sha256 hash of selected components (based on the key type) N)rrMr=rPrQrQrR fingerprints zPrivateKey.fingerprintcC(|jr|j|jd|_d|_dSdSNrLrNrmrvrQrQrR__del__  zPrivateKey.__del__) __name__ __module__ __qualname____doc__rLrerNrSpropertyr\rwr{rQrQrQrRr@As A  r@c@s(eZdZdZdZdZddZddZdS)rAzL Container for the OS crypto library representation of a public key NcCrJ)z :param sec_key_ref: A Security framework SecKeyRef value from loading/importing the key :param asn1: An asn1crypto.keys.PublicKeyInfo object NrKrOrQrQrRrSrTzPublicKey.__init__cCrxryrzrvrQrQrRr{r|zPublicKey.__del__)r}r~rrrLrNrSr{rQrQrQrRrAs  rAc@sPeZdZdZdZdZdZddZeddZ eddZ ed d Z d d Z dS) rzM Container for the OS crypto library representation of a certificate NcCs||_||_dS)z :param sec_certificate_ref: A Security framework SecCertificateRef value from loading/importing the certificate :param asn1: An asn1crypto.x509.Certificate object N)sec_certificate_refrM)rPrrMrQrQrRrSs zCertificate.__init__cCs|jjS)zF :return: The SecKeyRef of the public key )r\rLrvrQrQrRrLszCertificate.sec_key_refcCs|jsD|jrD|jjdkr#|j}d|dddd<t|}|j}n|j}ttd}t||}t |t |}t ||jdd|_|jS)zh :return: The PublicKey object for the public key this certificate contains rsassa_pssrVtbs_certificatesubject_public_key_inforW SecKeyRef *) rerrMsignature_algori _load_x509rr$SecCertificateCopyPublicKeyr&rrA)rPrM temp_cert sec_cert_refsec_public_key_ref_pointerressec_public_key_refrQrQrRr\s     zCertificate.public_keycCs|jdured|_|jjtddgvre|jdj}|jdj}|dkr%t}n|dkr,t}n|dkr3t}n|d kr:t }nt t d |z||j |jd j |jd |d |_W|jStydY|jSw|jS)zT :return: A boolean - if the certificate is self-signed NFyesmaybesignature_algorithmrsassa_pkcs1v15rr]ecdsaz Unable to verify the signature of the certificate since it uses the unsupported algorithm %s signature_valuerT) _self_signedrM self_signedsetr hash_algorGrIr7r9OSErrorrr\rkdumpr.)rPrr verify_funcrQrQrRrs>      zCertificate.self_signedcCs6|jr |jd|_|jrt|jd|_dSdSry)rer{rr(rmrvrQrQrRr{;s   zCertificate.__del__) r}r~rrrrerrSrrLr\rr{rQrQrQrRrs    +rc Cs|tgdvrttdt||dkr'|tgdvr&ttdt|n*|dkr<|tdgvr;ttdt|n|d krQ|tgd vrQttd t|d }d }d }d }d }d }d } d } d } z;tjtjtjd |} |d kr}dddd |} n|} tt d}tt d}t d}d}t d|}|dd }t |d dd}t} tj| |d}tt d}t |||dt|}t|t|} tt d}t |t|}t|t|} t | | | dtjtjtjBtjtjtjB| || }t|t|}t|}ttd}t |ddt|}t|t|}t !|}ttd}t |ddt|}t|t|}t !|}t "|}t|t "|}t|W|rZt#||rbt#||rjt#||rrt#||rzt#||rt#|| rt $| t#| | rt%&| | rt#| nO|rt#||rt#||rt#||rt#||rt#||rt#|| rt $| t#| | rt%&| | rt#| wwt'|t(|fS)a Generates a public/private key pair :param algorithm: The key algorithm - "rsa", "dsa" or "ec" :param bit_size: An integer - used for "rsa" and "dsa". For "rsa" the value maye be 1024, 2048, 3072 or 4096. For "dsa" the value may be 1024. :param curve: A unicode string - used for "ec" keys. Valid values include "secp256r1", "secp384r1" and "secp521r1". :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A 2-element tuple of (PublicKey, PrivateKey). The contents of each key may be saved by calling .asn1.dump(). )rVr]razM algorithm must be one of "rsa", "dsa", "ec", not %s rV)ii zX bit_size must be one of 1024, 2048, 3072, 4096, not %s r]rz? bit_size must be 1024, not %s ra secp256r1 secp384r1 secp521r1zd curve must be one of "secp256r1", "secp384r1", "secp521r1", not %s N)r]rarVi rTemporary oscrypto key utf-8SecKeychainRef *FSecAccessRef *rrU))r ValueErrorrreprr%CSSM_ALGID_DSACSSM_ALGID_ECDSACSSM_ALGID_RSArr$r)cf_string_from_unicoder+rdecodetempfilemkdtempospathjoinencodeSecKeychainCreater r&rSecAccessCreateSecKeyCreatePairCSSM_KEYUSE_VERIFYCSSM_KEYATTR_EXTRACTABLECSSM_KEYATTR_PERMANENTCSSM_KEYUSE_SIGNr(rfrgSecKeychainItemDeletermSecKeychainDeleteshutilrmtreer>r=)rWbit_sizerlcf_dictpublic_key_refprivate_key_refcf_data_publicro cf_stringsec_access_refsec_keychain_reftemp_diralg_idkey_sizeprivate_key_pointerpublic_key_pointerpassphrase_len rand_data passphrase temp_filename temp_pathsec_keychain_ref_pointerrqsec_access_ref_pointercf_data_public_pointerpublic_key_bytesrprrrQrQrRr:Es                                      r:c Cst|tsttdt||dkrtd|dkrtd|ddkr(tdd }d }d }d }d }d }d }d }zttd } ttd } t d }d } t d | } | d d } t | d d  d}t }tj||d}ttd}t|| | dt|}t|t|}ttd}t|t|}t|t|}t|tj|ddtjtjBdtjtjB|| | }t|t| }t| }ttd}t|ddt|}t|t|}t|}t |}t|t |}t|t!"|dW|rt#||rt#||r t#||rt#||rt#||r*t$|t#||r2t%&||r;t#|SS|rDt#||rLt#||rTt#||r\t#||rdt#||rqt$|t#||ryt%&||rt#|ww)a` Generates DH parameters for use with Diffie-Hellman key exchange. Returns a structure in the format of DHParameter defined in PKCS#3, which is also used by the OpenSSL dhparam tool. THIS CAN BE VERY TIME CONSUMING! :param bit_size: The integer bit size of the parameters to generate. Must be between 512 and 4096, and divisible by 64. Recommended secure value as of early 2016 is 2048, with an absolute minimum of 1024. :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: An asn1crypto.algos.DHParameters object. Use oscrypto.asymmetric.dump_dh_parameters() to save to disk for usage with web servers. z= bit_size must be an integer, not %s z-bit_size must be greater than or equal to 512rz+bit_size must be less than or equal to 4096@rz!bit_size must be a multiple of 64NrrrrrrFrrUrX)' isinstancer5 TypeErrorrr2rrr$r)rr+rrrrrrrrrr r&rrrr% CSSM_ALGID_DHrrr(rfrgrr loadrmrrr)rrrrrorrrrrrrrrrrrrqrrprrrQrQrRgenerate_dh_parameterss                                  rcCt|tr |}t |St|trt|}t |St|tr?t|d}t|}Wdt |S1s6wYt |Sttdt |)a Loads an x509 certificate into a Certificate object :param source: A byte string of file contents, a unicode string filename or an asn1crypto.x509.Certificate object :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A Certificate object rbNz source must be a byte string, unicode string or asn1crypto.x509.Certificate object, not %s ) rAsn1Certificater4rr3openreadrrr2r)source certificatefrQrQrRr;s"      r;c CsT|}d}zt|}ttj|}t||W|r t|SS|r)t|ww)z Loads an ASN.1 object of an x509 certificate into a Certificate object :param certificate: An asn1crypto.x509.Certificate object :return: A Certificate object N) rr)cf_data_from_bytesr$SecCertificateCreateWithDatar(kCFAllocatorDefaultrrm)rr cf_sourcerLrQrQrRrs     rcCst|tr |}t |S|dur't|tr|d}t|ts'ttdt|t|trFt|d }| }Wdn1s@wYnt|tsTttdt|t ||}t |S)a Loads a private key into a PrivateKey object :param source: A byte string of file contents, a unicode string filename or an asn1crypto.keys.PrivateKeyInfo object :param password: A byte or unicode string to decrypt the private key file. Unicode strings will be encoded using UTF-8. Not used is the source is a PrivateKeyInfo object. :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type oscrypto.errors.AsymmetricKeyError - when the private key is incompatible with the OS crypto library OSError - when an error is returned by the OS crypto library :return: A PrivateKey object NrzP password must be a byte string, not %s rz source must be a byte string, unicode string or asn1crypto.keys.PrivateKeyInfo object, not %s ) rr r3rr4rrr2rrrrn)rpasswordprivate_objectrrQrQrRr=s.         r=cCr)a3 Loads a public key into a PublicKey object :param source: A byte string of file contents, a unicode string filename or an asn1crypto.keys.PublicKeyInfo object :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type oscrypto.errors.AsymmetricKeyError - when the public key is incompatible with the OS crypto library OSError - when an error is returned by the OS crypto library :return: A PublicKey object rNz source must be a byte string, unicode string or asn1crypto.keys.PublicKeyInfo object, not %s ) rrr4rr3rrrrr2rn)rr\rrQrQrRr>s"      r>c Cs|jdkr!|j\}}|dkrtd|tgdvr ttdn"|jdkr3|jdkr3ttd|j|jdkrC|jd urCttd t|t rd|jd kr\| }d |d d <| }n| }t j }n t| }t j}d }d }d }zt|}ttd} t| t jttd} t| |ttd} ttjg}ttd} t| } d| _d| _t| _t| _t| _t| _ t| _!|| _"t#|t| | d| t| }t$|t| }t%|}|dkrt&|d}t'||t j krt(||W|rt)||rt)||r t)|SS|t jkr3t*||W|r!t)||r)t)||r2t)|SSW|rszload_pkcs12..) rr3rr4rrr2rrr?rnr) rrrkey_info cert_infoextra_certs_inforscert extra_certsrQrQrRr<s6        r<cCst|ttfsttdt|t|tsttdt||j}t|}t t d|}t |j t j|t|||}t|t|t|S)aF Encrypts a byte string using an RSA public key or certificate. Uses PKCS#1 v1.5 padding. :param certificate_or_public_key: A PublicKey or Certificate object :param data: A byte string, with a maximum length 11 bytes less than the key length (in bytes) :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the encrypted data certificate_or_public_key must be an instance of the Certificate or PublicKey class, not %s < data must be a byte string, not %s size_t *)rrrArrr2r4 byte_sizerrr$ SecKeyEncryptrLr%kSecPaddingPKCS1lenr&rr)certificate_or_public_keyr  key_lengthbuffer output_lengthrqrQrQrRrEs.  rEcCst|tsttdt|t|tsttdt||j}t|}tt d|}t dkr1t j }nt j }t |j||t|||}t|t|t|}t dkrUt||}|S)a Decrypts a byte string using an RSA private key. Uses PKCS#1 v1.5 padding. :param private_key: A PrivateKey object :param ciphertext: A byte string of the encrypted data :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the original plaintext zV private_key must an instance of the PrivateKey class, not %s rr)r)rr@rrr2r4rrrr$r'r%kSecPaddingNoner SecKeyDecryptrLrr&rrr1)rY ciphertextrrrpaddingrqoutputrQrQrRrD&s:    rDcCt||tjS)aZ Encrypts a byte string using an RSA public key or certificate. Uses PKCS#1 OAEP padding with SHA1. :param certificate_or_public_key: A PublicKey or Certificate object :param data: A byte string, with a maximum length 41 bytes (or more) less than the key length (in bytes) :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the encrypted data )_encryptr$kSecPaddingOAEPKey)rr rQrQrRrCdsrCcCr%)a Decrypts a byte string using an RSA private key. Uses PKCS#1 OAEP padding with SHA1. :param private_key: A PrivateKey object :param ciphertext: A byte string of the encrypted data :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the original plaintext )_decryptr$r')rYr"rQrQrRrB|srBc Cst|ttfsttdt|t|tsttdt||s$tdd}d}zPt |}t t d}t |j|}t||rMt |t j||t|t |t j||t|t ||}t|t|W|rpt ||rxt |SS|rt ||rt |ww)a> Encrypts plaintext using an RSA public key or certificate :param certificate_or_public_key: A Certificate or PublicKey object :param data: The plaintext - a byte string :param padding: The padding mode to use, specified as a kSecPadding*Key value :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the ciphertext rrpadding must be specifiedN CFErrorRef *)rrrArrr2r4rr)rrr(r$SecEncryptTransformCreaterLr*SecTransformSetAttributekSecPaddingKeykSecTransformInputAttributeNameSecTransformExecutergrm)rr r#cf_data sec_transform error_pointerr"rQrQrRr&sd         r&c Cs t|tsttdt|t|tsttdt||s"tdd}d}zNt|}t t d}t |j |}t|t |t j||t|t |t j||t|t ||}t|t|W|rlt ||rtt |SS|r|t ||rt |ww)a Decrypts RSA ciphertext using a private key :param private_key: A PrivateKey object :param ciphertext: The ciphertext - a byte string :param padding: The padding mode to use, specified as a kSecPadding*Key value :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the plaintext Y private_key must be an instance of the PrivateKey class, not %s zB ciphertext must be a byte string, not %s r)Nr*)rr@rrr2r4rr)rrr(r$SecDecryptTransformCreaterLr*r,r-r.r/rgrm)rYr"r#r0r1r2 plaintextrQrQrRr(sb          r(cC |jdkr tdt||||S)a Verifies an RSASSA-PKCS-v1.5 signature. When the hash_algorithm is "raw", the operation is identical to RSA public key decryption. That is: the data is not hashed and no ASN.1 structure with an algorithm identifier of the hash algorithm is placed in the encrypted byte string. :param certificate_or_public_key: A Certificate or PublicKey instance to verify the signature with :param signature: A byte string of the signature to verify :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384", "sha512" or "raw" :raises: oscrypto.errors.SignatureError - when the signature is determined to be invalid ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library rV*The key specified is not an RSA public keyrWr_verifyr signaturer hash_algorithmrQrQrRrG9s rGc Cst|ttfsttdt|t|tsttdt||j}|dkr-|dkr-tddddd d d  |d }|j }t |}t t d |}t |jtj|t|||} t| t|t|} t|||j|| sltddS)a Verifies an RSASSA-PSS signature. For the PSS padding the mask gen algorithm will be mgf1 using the same hash algorithm as the signature. The salt length with be the length of the hash algorithm, and the trailer field with be the standard 0xBC byte. :param certificate_or_public_key: A Certificate or PublicKey instance to verify the signature with :param signature: A byte string of the signature to verify :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384" or "sha512" :raises: oscrypto.errors.SignatureError - when the signature is determined to be invalid ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library rrrVrr7 0rsha1sha224sha256sha384sha512rrSignature is invalidN)rrrArrr2r4rWrgetrrrr$rrLr%r rr&rrr0rr.) rr;r r<cp_algo hash_lengthrrrrqr5rQrQrRrI[sJ  rIcCr6)a Verifies a DSA signature :param certificate_or_public_key: A Certificate or PublicKey instance to verify the signature with :param signature: A byte string of the signature to verify :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384" or "sha512" :raises: oscrypto.errors.SignatureError - when the signature is determined to be invalid ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library r]z)The key specified is not a DSA public keyr8r:rQrQrRr7 r7cCr6)a Verifies an ECDSA signature :param certificate_or_public_key: A Certificate or PublicKey instance to verify the signature with :param signature: A byte string of the signature to verify :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384" or "sha512" :raises: oscrypto.errors.SignatureError - when the signature is determined to be invalid ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library raz)The key specified is not an EC public keyr8r:rQrQrRr9rKr9c Cst|ttfsttdt|t|tsttdt|t|ts,ttdt|tgd}|jdkr>|tdgO}||vrWd}|jdkrM|d7}t td |t ||jdkr|dkrt ||j d krtt td |j t |t |jtj|t ||t |}|tjks|tjkrtd t|d Sd }d }d } d } zttd} t|}t |j|| } t| t jt jt jt jt jt jd|} t | t j | | t| |tgdvrddddd|} t!| } t | t j"| | t| |jdkr t | t j#t j$| t| t|}t | t j%|| t| t &| | }t'| s6t(| }t'|s6td t)t*|}|sDtd W| rMt+| |rUt+||r]t+|| rgt+| d Sd S| rqt+| |ryt+||rt+|| rt+| ww)a Verifies an RSA, DSA or ECDSA signature :param certificate_or_public_key: A Certificate or PublicKey instance to verify the signature with :param signature: A byte string of the signature to verify :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384" or "sha512" :raises: oscrypto.errors.SignatureError - when the signature is determined to be invalid ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library rzA signature must be a byte string, not %s rmd5rBrCrDrErFrVraw5"md5", "sha1", "sha224", "sha256", "sha384", "sha512", "raw"B hash_algorithm must be one of %s, not %s z data must be 11 bytes shorter than the key size when hash_algorithm is "raw" - key size is %s bytes, but data is %s bytes long rGNr*rCrDrErFrrr),rrrArrr2r4rrWrrrrr$SecKeyRawVerifyrLr%rerrSecVerifyFailed errSSLCryptor.r&rr(r)rSecVerifyTransformCreater* kSecDigestMD5kSecDigestSHA1kSecDigestSHA2r,kSecDigestTypeAttributecf_number_from_integerkSecDigestLengthAttributer-kSecPaddingPKCS1Keyr.r/r!rboolCFBooleanGetValuerm)rr;r r<valid_hash_algorithmsvalid_hash_algorithms_errorrq cf_signaturer0cf_hash_lengthr1r2 hash_constantrJrerrorrQrQrRr9s                        r9cC|jdkr tdt|||S)a^ Generates an RSASSA-PKCS-v1.5 signature. When the hash_algorithm is "raw", the operation is identical to RSA private key encryption. That is: the data is not hashed and no ASN.1 structure with an algorithm identifier of the hash algorithm is placed in the encrypted byte string. :param private_key: The PrivateKey to generate the signature with :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384", "sha512" or "raw" :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the signature rV+The key specified is not an RSA private keyrWr_signrYr r<rQrQrRrFs  rFc Cst|tsttdt|t|tsttdt||j}|dkr+|dkr+tddddd d d |d }t |||j |}|j }t |}t td |}t|jtj|t|||} t| t|t|S)a6 Generates an RSASSA-PSS signature. For the PSS padding the mask gen algorithm will be mgf1 using the same hash algorithm as the signature. The salt length with be the length of the hash algorithm, and the trailer field with be the standard 0xBC byte. :param private_key: The PrivateKey to generate the signature with :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384" or "sha512" :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the signature r3rrVrrir=r>r?r@rrArr)rr@rrr2r4rWrrHr/rrrrr$r!rLr%r rr&rr) rYr r<pk_algorJ encoded_datarrrrqrQrQrRrHsF   rHcCrh)aI Generates a DSA signature :param private_key: The PrivateKey to generate the signature with :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384" or "sha512" :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the signature r]z*The key specified is not a DSA private keyrjrlrQrQrRr6  r6cCrh)aL Generates an ECDSA signature :param private_key: The PrivateKey to generate the signature with :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384" or "sha512" :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the signature raz*The key specified is not an EC private keyrjrlrQrQrRr8ror8c Cst|tsttdt|t|tsttdt|tgd}|jdkr.|tdgO}||vrGd}|jdkr=|d7}ttd|t ||jdkr|dkrt ||j d krdttd |j t ||j }t |}t td |}t|jtj|t |||}t|t|t|Sd } d } d } d } zt td } t|j| } t| tjtjtjtjtjtjd|}t| tj|| t| |tgdvrddddd|}t|} t| tj | | t| |jdkrt| tj!tj"| t| t#|} t| tj$| | t| t%| | } t| t&| W| r t'| | r(t'| | r0t'| | r9t'| SS| rBt'| | rJt'| | rRt'| | r[t'| ww)aX Generates an RSA, DSA or ECDSA signature :param private_key: The PrivateKey to generate the signature with :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384" or "sha512" :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the signature zO private_key must be an instance of PrivateKey, not %s rrLrVrNrOrPrQrRz data must be 11 bytes shorter than the key size when hash_algorithm is "raw" - key size is %s bytes, but data is %s bytes long rNr*rSrTrrr)(rr@rrr2r4rrWrrrrrrr$ SecKeyRawSignrLr%rr&rrr(SecSignTransformCreater*rYrZr[r,r\r)r]r^r-r_rr.r/rgrm)rYr r<rbrcrrrrqrdr0rer1r2rfrJrQrQrRrk6s                      rk)NNry)^ __future__rrrrbase64rrrr_asn1rrr r r r r rrr _asymmetricrrrrrrrrr_errorsr_ffirrrrrr r!r" _securityr$r%r&r'_core_foundationr(r)r*utilr+errorsr,r-r._pkcs1r/r0r1_typesr2r3r4r5__all__r@rAr:rr;rr=r>rnr?r<rErDrCrBr&r(rGrIr7r9r9rFrHr6r8rkrQrQrQrRs^ ,, ( u o5' 8( | =6>TR"I5"H