o j@sddlmZmZmZmZddlZddlZddlZddlZddl m Z m Z m Z mZmZmZmZmZmZmZmZmZmZmZmZddlmZmZmZmZmZm Z m!Z!m"Z"m#Z#ddl$m%Z%ddl&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6ddl7m8Z8dd l9m:Z:dd l;mZ>dd l?m@Z@mAZAmBZBmCZCdd lDmEZEmFZFmGZGmHZHmIZImJZJdd lKmLZLeMZNeNdeNdfZOe8ZPePdkrddlQmRZRmSZSmTZTmUZUmVZVddlWmXZYmZZ[m\Z\m]Z^m_Z`nddlambZbmcZcmTZTmdZdmeZegdZfgdZgGdddZhGdddeheZiGdddeheZjGdddeheZ dyddZkdd Zldzd!d"Zmd#d$Zndyd%d&Zod'd(Zpd)d*Zqd+d,Zrd-d.Zsd/d0Ztd1d2Zud3d4Zvd5d6Zwd7d8Zxd9d:Zyd{dd?Z{dzd@dAZ|dBdCZ}dzdDdEZ~dzdFdGZdHdIZdJdKZdLdMZdNdOZ_d|dQdRZd|dSdTZd|dUdVZdWdXZdYdZZd[d\Zd]d^Z]d|d_d`Zd|dadbZd|dcddZd|dedfZd|dgdhZd|didjZd|dkdlZd|dmdnZd|dodpZdqdrZdsdtZdudvZdwdxZdS)})unicode_literalsdivisionabsolute_importprint_functionN) Certificate DHParameters DSAParams DSASignatureECDomainParameters ECPrivateKeyIntegerint_from_bytes int_to_bytesPrivateKeyAlgorithmPrivateKeyInfoPublicKeyAlgorithm PublicKeyInfo RSAPrivateKey RSAPublicKey) _CertificateBase _fingerprint _parse_pkcs12_PrivateKeyBase_PublicKeyBase_unwrap_private_key_infoparse_certificate parse_private parse_public)pretty_message)buffer_from_bytesbuffer_from_unicode byte_arraybytes_from_buffercastderefnativenewnull pointer_setsizeofstruct struct_bytesstruct_from_bufferunwrapwrite_to_buffer)backend) fill_width)AsymmetricKeyErrorIncompleteAsymmetricKeyErrorSignatureError) type_namestr_clsbyte_cls int_types)add_pkcs1v15_signature_paddingadd_pss_paddingraw_rsa_private_cryptraw_rsa_public_crypt!remove_pkcs1v15_signature_paddingverify_pss_padding)constant_compare winlegacy)advapi32 Advapi32Const handle_erroropen_context_handleclose_context_handle)ec_generate_pairec_compute_public_key_pointec_public_key_info ecdsa_sign ecdsa_verify)bcrypt BcryptConstrDopen_alg_handleclose_alg_handle)rdsa_sign dsa_verifyrJrK generate_pairload_certificate load_pkcs12load_private_keyload_public_key parse_pkcs12 PrivateKey PublicKeyrsa_oaep_decryptrsa_oaep_encryptrsa_pkcs1v15_decryptrsa_pkcs1v15_encryptrsa_pkcs1v15_signrsa_pkcs1v15_verify rsa_pss_signrsa_pss_verify(r %)+/5;=CGIOSYaegkmqiii iiiii%i3i7i9i=iKiQi[i]iaigioiui{iiiiiiiiiiiiiiiiiiiiii i ii#i-i3i9i;iAiKiQiWiYi_ieiiikiwiiiiiiiiiiiiiiiiiiiiiiiii)i+i5i7i;i=iGiUiYi[i_imiqisiwiiiiiiiiiiiiiiiiiiii iiii%i'i-i?iCiEiIiOiUi]iciiiiiiiiiiiiiiiiiiiiii i iiiii'i)i/iQiWi]ieiwiiiiiiiiiiiiiiiiiiiiii iiii#i+i/i=iAiGiIiMiSiUi[ieiyiiiiiiiiiiiiiiiiiii iii'i7iEiKiOiQiUiWiaimisiyiiiiiiiiiiiiiiiiiiii!i#i'i)i3i?iAiQiSiYi]i_iiiqiiiiiiiiiiiiiiiii i i i# i% i+ i/ i5 iC iI iM iO iU iY i_ ik iq iw i i i i i i i i i i i i i i i i i i! i1 i9 i= iI iW ia ic ig io iu i{ i i i i i i i i i i i i i i i i i i i i i i i i i# i) i- i? iG iQ iW i] ie io i{ i i i i i i i i i i i i i i i i i i i% i/ i1 iA i[ i_ ia im is iw i i i i i i i i i i i i i i i i i i i i i i! i+ i- i= i? iO iU ii iy i i i i i i i i i i i i i i i i i i i i i iii!i'i/i5i;iKiWiYi]ikiqiui}iiiiiiiiiiiiiiii i ii%i)i1iCiGiMiOiSiYi[igikiiiiiiiiiiiiiiiiiiii!i%i+i9i=i?iQiiisiyi{iiiiiiiiiiiiiiiiii ii'i-i9iEiGiYi_iciiioiiiiiiiiiiiiiiiii iii#i)i+i1i7iAiGiSi_iqisiyi}iiiiiiiiiiiiii ii'i-i7iCiEiIiOiWi]igiiimi{iiiiiiiiiiiiiiiiiiii!i/i3i;iEiMiYikioiqiuiiiiiiiiiiiii iiii%i)i+i7i=iAiCiIi_ieigiki}iiiiiiiiiiiiiii iiiiii%i3i9i=iEiOiUiiimioiuiiiiiiiiiiiiiiiiiii ii#i'i3iAi]iciwi{iiiiiiiiiiiiiiiiiiii5i7i;iCiIiMiUigiqiwi}iiiiiiiiiiiiiiiiiiiiii1i3iEiIiQi[iyiiiiiiiiiiiiiiiiiii!i#i-i/i5i?iMiQiiiki{i}iiiiiiiiiiiiiiiiii#i%i/i1i7i;iAiGiOiUiYieikisiiiiiiiiiiiii iii'i+i-i3i=iEiKiOiUisiiiiiiiiiiiii ii!i#i5i9i?iAiKiSi]iciiiqiui{i}iiiiiiiiiiiiiiiiii iii%i+i/i=iIiMiOimiqiiiiiiiiiiiiiiiii iii9iIiKiQigiui{iiiiiiiiiiiiiiii i i i' i) i- i3 iG iM iQ i_ ic ie ii iw i} i i i i i i i i i i i i i i !i!i5!iA!iI!iO!iY!i[!i_!is!i}!i!i!i!i!i!i!i!i!i!i!i!i!i!i!i!i!i"i "i"i"i!"i%"i+"i1"i9"iK"iO"ic"ig"is"iu"i"i"i"i"i"i"i"i"i"i"i"i"i"i"i#i #i #i'#i)#i/#i3#i5#iE#iQ#iS#iY#ic#ik#i#i#i#i#i#i#i#i#i#i#i#i#i#i#i#i$i $i$i$i)$i=$iA$iC$iM$i_$ig$ik$iy$i}$i$i$i$i$i$i$i$i$i$i$i$i$i$i$i$i$i$i%i%i%i%i'%i1%i=%iC%iK%iO%is%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i&i &i&i&i'&i)&i5&i;&i?&iK&iS&iY&ie&ii&io&i{&i&i&i&i&i&i&i&i&i&i&i&i&i&i&i'i'i5'i7'iM'iS'iU'i_'ik'im'is'iw'i'i'i'i'i'i'i'i'i'i'i'i'i'i(i(i (i(i(i(i!(i1(i=(i?(iI(iQ(i[(i](ia(ig(iu(i(i(i(i(i(i(i(i(i(i(i(i(i)i)i)i!)i#)i?)iG)i])ie)ii)io)iu)i)i)i)i)i)i)i)i)i)i)i)i)i)i)i)i*i*i*i%*i/*iO*iU*i_*ie*ik*im*is*i*i*i*i*i*i*i*i*i*i*i*i*i*i*i+i'+i1+i3+i=+i?+iK+iO+iU+ii+im+io+i{+i+i+i+i+i+i+i+i+i+i+i+i+i+i ,i,i,i#,i/,i5,i9,iA,iW,iY,ii,iw,i,i,i,i,i,i,i,i,i,i,i,i,i,i,i,i-i-i-i;-iC-iI-iM-ia-ie-iq-i-i-i-i-i-i-i-i-i-i-i.i.i.i .i.i.i%.i-.i3.i7.i9.i?.iW.i[.io.iy.i.i.i.i.i.i.i.i.i.i.i.i.i.i.i.i/i /i /i/i'/i)/iA/iE/iK/iM/iQ/iW/io/iu/i}/i/i/i/i/i/i/i/i/i/i/i/i/i/i/i0i 0i#0i)0i70i;0iU0iY0i[0ig0iq0iy0i}0i0i0i0i0i0i0i0i0i0i0i0i0i0i0i0i0i1i 1i1i!1i'1i-1i91iC1iE1iK1i]1ia1ig1im1is1i1i1i1i1i1i1i1i1i1i1i1i1i1i 2i2i2i2i)2i52iY2i]2ic2ik2io2iu2iw2i{2i2i2i2i2i2i2i2i2i2i2i2i2i2i2i2i3i%3i+3i/3i53iA3iG3i[3i_3ig3ik3is3iy3i3i3i3i3i3i3i3i3i3i3i3i3i4i4i4i4i4i74iE4iU4iW4ic4ii4im4i4i4i4i4i4i4i4i4i4i4i4i4i4i 5i5i5i-5i35i;5iA5iQ5ie5io5iq5iw5i{5i}5i5i5i5i5i5i5i5i5i5i5i5i5i5i5i6i6i6i#6i16i56i76i;6iM6iO6iS6iY6ia6ik6im6i6i6i6i6i6i6i6i6i6i6i6i7i7i7i7i?7iE7iI7iO7i]7ia7iu7i7i7i7i7i7i7i7i7i7i7i7i8i 8i!8i38i58iA8iG8iK8iS8iW8i_8ie8io8iq8i}8i8i8i8i8i8i8i8i8i8i8i8i8i8i9i9i#9i%9i)9i/9i=9iA9iM9i[9ik9iy9i}9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i9i:i:i:i:i':i+:i1:iK:iQ:i[:ic:ig:im:iy:i:i:i:i:i:i:i:i:i:i:i:i;i;i;i!;i#;i-;i9;iE;iS;iY;i_;iq;i{;i;i;i;i;i;i;i;i;i;i;i;i;i;i;i;i;i;i<i <i<i<i<i)<i5<iC<iO<iS<i[<ie<ik<iq<i<i<i<i<i<i<i<i<i<i<i<i<i=i =i=i=i=i!=i-=i3=i7=i?=iC=io=is=iu=iy=i{=i=i=i=i=i=i=i=i=i=i=i=i=i>i >i>i>i>i#>i)>i/>i3>iA>iW>ic>ie>iw>i>i>i>i>i>i>i>i>i>i>i>i>i>i>i>i ?i ?i7?i;?i=?iA?iY?i_?ie?ig?iy?i}?i?i?i?i?i?i?i?i?i?i?i?i@i!@i%@i+@i1@i?@iC@iE@i]@ia@ig@im@i@i@i@i@i@i@i@i@i@i@i@i@i Ai AiAiAi!Ai3Ai5Ai;Ai?AiYAieAikAiwAi{AiAiAiAiAiAiAiAiAiAiAiBiBiBiBi#Bi)Bi/BiCBiSBiUBi[BiaBisBi}BiBiBiBiBiBiBiBiBiBiBiBiBiBiCiCiCi%Ci'Ci3Ci7Ci9CiOCiWCiiCiCiCiCiCiCiCiCiCiCiCiCiCiCiCiCiCi Di DiDi#Di)Di;Di?DiEDiKDiQDiSDiYDieDioDiDiDiDiDiDiDiDiDiDiDiDiDiDiEiEiEi+Ei1EiAEiIEiSEiUEiaEiwEi}EiEiEiEiEiEiEiEc@s,eZdZdZdZdZdZddZddZdS)_WinKeyNcCs(||_||_tdkrt|_dSt|_dS)z :param key_handle: A CNG BCRYPT_KEY_HANDLE value (Vista and newer) or an HCRYPTKEY (XP and 2003) from loading/importing the key :param asn1: An asn1crypto object for the concrete type rAN) key_handleasn1_backendrB_librLselfrrr/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/oscrypto/_win/asymmetric.py__init__s    z_WinKey.__init__cCsb|jrtdkr|j|j}n|j|j}t|d|_|jr,tdkr,t|jd|_d|_dS)NrA)rrrCryptDestroyKeyBCryptDestroyKeyrDcontext_handlerF)rresrrr__del__s  z_WinKey.__del__) __name__ __module__ __qualname__rr ex_key_handlerrrrrrrrvs rc@s4eZdZdZdZddZeddZeddZdS) rXzM Container for the OS crypto library representation of a private key NcCt|||dS)z :param key_handle: A CNG BCRYPT_KEY_HANDLE value (Vista and newer) or an HCRYPTKEY (XP and 2003) from loading/importing the key :param asn1: An asn1crypto.keys.PrivateKeyInfo object Nrrrrrrr zPrivateKey.__init__cCstdkrn|jdkrt|j}tdt||j|_|jS|jdkrL|jdd}tt d|dt t |dj |jd j j |d j d }t||_|jS|jd j }tt d d it|d|ddd }t||_|jSt|j|j|j\}}t||_|jS)z\ :return: A PublicKey object corresponding to this private key. rAecNdsaprivate_key_algorithm parameters algorithmrg private_keypr public_keyrrsamoduluspublic_exponentrr)rr(_pure_python_ec_compute_public_key_pointrrYrIcurve _public_keyrrr powr&parsedrVr_bcrypt_key_handle_to_asn1bit_sizer)r pub_pointparamspub_asn1r_rrrrsF  %      zPrivateKey.public_keycCs|jdur t|jt|_|jS)aY Creates a fingerprint that can be compared with a public key to see if the two form a pair. This fingerprint is not compatible with fingerprints generated by any other software. :return: A byte string that is a sha256 hash of selected components (based on the key type) N)rrrUrrrr fingerprints zPrivateKey.fingerprint) rrr__doc__rrpropertyrrrrrrrXs 0rXc@seZdZdZddZdS)rYzL Container for the OS crypto library representation of a public key cCr)z :param key_handle: A CNG BCRYPT_KEY_HANDLE value (Vista and newer) or an HCRYPTKEY (XP and 2003) from loading/importing the key :param asn1: An asn1crypto.keys.PublicKeyInfo object NrrrrrrrzPublicKey.__init__N)rrrrrrrrrrYs rYc@s8eZdZdZdZdZddZeddZeddZ dS) rzM Container for the OS crypto library representation of a certificate NcCr)z :param key_handle: A CNG BCRYPT_KEY_HANDLE value (Vista and newer) or an HCRYPTKEY (XP and 2003) from loading/importing the certificate :param asn1: An asn1crypto.x509.Certificate object NrrrrrrrzCertificate.__init__cCs$|jdurt|jdd|_|jS)zh :return: The PublicKey object for the public key this certificate contains Ntbs_certificatesubject_public_key_info)rrVrrrrrrs zCertificate.public_keycCs|jdurdd|_|jjtddgvrd|jdj}|jdj}|dkr%t}n|dkr,t}n|dkr3t}n|d kr:t }nt t d |z|||jd j |jd  |d |_W|jStycY|jSw|jS)zT :return: A boolean - if the certificate is self-signed NFyesmaybesignature_algorithmrsassa_pkcs1v15 rsassa_pssrecdsaz Unable to verify the signature of the certificate since it uses the unsupported algorithm %s signature_valuerT) _self_signedr self_signedsetsignature_algo hash_algor_rarQrKOSErrorrr&dumpr4)rrr verify_funcrrrr*s>      zCertificate.self_signed) rrrrrrrrrrrrrrr s  rcCs|tgdvrttdt||dkr'|tgdvr&ttdt|nA|dkrStdks3tdkrA|d kr@ttd t|n'|tgd vrRttd t|n|d krh|tgdvrhttdt|tdkr|d krt|\}}td|td|fSt ||St |||S)aB Generates a public/private key pair :param algorithm: The key algorithm - "rsa", "dsa" or "ec" :param bit_size: An integer - used for "rsa" and "dsa". For "rsa" the value maye be 1024, 2048, 3072 or 4096. For "dsa" the value may be 1024, plus 2048 or 3072 if on Windows 8 or newer. :param curve: A unicode string - used for "ec" keys. Valid values include "secp256r1", "secp384r1" and "secp521r1". :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A 2-element tuple of (PublicKey, PrivateKey). The contents of each key may be saved by calling .asn1.dump(). )rrrzM algorithm must be one of "rsa", "dsa", "ec", not %s r) zX bit_size must be one of 1024, 2048, 3072, 4096, not %s rrrArzG bit_size must be 1024, not %s )rrrzZ bit_size must be one of 1024, 2048, 3072, not %s r secp256r1 secp384r1 secp521r1zd curve must be one of "secp256r1", "secp384r1", "secp521r1", not %s N) r ValueErrorrrepr_win_version_infor_pure_python_ec_generate_pairrYrX_advapi32_generate_pair_bcrypt_generate_pair)rrrpub_info priv_inforrrrRWsL   rRcCsD|dkrd}nd}ttd}t|ttjdt|}t|t|}t|}t|ttjd||}t|t t||}t |} t t| } t ||| d} |dkr_t || | \} } | | fSttd}t|ttjdt|}t|t|}t|}t|ttjd||}t|t ||| d}t||| \} } | | fS)ao Accepts an key handle and exports it to ASN.1 :param algorithm: The key algorithm - "rsa" or "dsa" :param bit_size: An integer - only used when algorithm is "rsa" :param key_handle: The handle to export :return: A 2-element tuple of asn1crypto.keys.PrivateKeyInfo and asn1crypto.keys.PublicKeyInfo r RSABLOBHEADER DSSBLOBHEADERDWORD *rN)r'rBCryptExportKeyr(rCPRIVATEKEYBLOBrDr%r r-r.r*r# _advapi32_interpret_rsa_key_blob PUBLICKEYBLOB _advapi32_interpret_dsa_key_blob)rrr struct_typeout_lenr buffer_lengthbuffer_blob_struct_pointer blob_struct struct_size private_blob public_info private_infopublic_out_lenpublic_buffer_length public_buffer public_blobrrr_advapi32_key_handle_to_asn1sn    rc Cs|dkr tj}tj}ntj}tj}d}d}zAt|dd}ttd}|d>tjB}t ||||}t |t |}t |||\} } t | t| fW|rNt||rVt|SS|r]t||ret|ww)a Generates a public/private key pair using CryptoAPI :param algorithm: The key algorithm - "rsa" or "dsa" :param bit_size: An integer - used for "rsa" and "dsa". For "rsa" the value maye be 1024, 2048, 3072 or 4096. For "dsa" the value may be 1024. :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A 2-element tuple of (PublicKey, PrivateKey). The contents of each key may be saved by calling .asn1.dump(). rNF verify_only HCRYPTKEY *)rCMS_ENH_RSA_AES_PROV CALG_RSA_SIGNMS_ENH_DSS_DH_PROV CALG_DSS_SIGNrEr'rBCRYPT_EXPORTABLE CryptGenKeyrDr.rrVrUrFr) rrprovider algorithm_idrrkey_handle_pointerflagsrrrrrrrs4    rc Cs,|dkr d}tj}tj}n|dkr!|dkrd}nd}tj}tj}nd}tj}tj}ttd}t |t |t d |d }t |t |}t |} t |t || ||d }t |tt|| } t| } tt| } t| || d } |dkrztd | | }n|dkr|dkrtd d | | }ntd d | | }ntd | | }ttd}t |t |t d |d }t |t |}t |}t |t ||||d }t |tt||}t|}tt|} t||| d }|dkrtd||}||fS|dkr |dkrtdd ||}||fStdd ||}||fStd||}||fS)au Accepts an key handle and exports it to ASN.1 :param algorithm: The key algorithm - "rsa", "dsa" or "ec" :param bit_size: An integer - only used when algorithm is "dsa" :param key_handle: The handle to export :return: A 2-element tuple of asn1crypto.keys.PrivateKeyInfo and asn1crypto.keys.PublicKeyInfo rBCRYPT_RSAKEY_BLOBrrBCRYPT_DSA_KEY_BLOB_V2BCRYPT_DSA_KEY_BLOBBCRYPT_ECCKEY_BLOBULONG *rNprivaterr@public)rMBCRYPT_RSAFULLPRIVATE_BLOBBCRYPT_RSAPUBLIC_BLOBBCRYPT_DSA_PRIVATE_BLOBBCRYPT_DSA_PUBLIC_BLOBBCRYPT_ECCPRIVATE_BLOBBCRYPT_ECCPUBLIC_BLOBr'rLBCryptExportKeyr(rDr%r r-r.r*r#_bcrypt_interpret_rsa_key_blob_bcrypt_interpret_dsa_key_blob_bcrypt_interpret_ec_key_blob)rrrrprivate_blob_typepublic_blob_typeprivate_out_lenrprivate_buffer_lengthprivate_bufferprivate_blob_struct_pointerprivate_blob_structrrrrrrpublic_blob_struct_pointerpublic_blob_structrrrrrr3s          rc Cs|dkrtj}n|dkrtj}ntjtjtjd|}dddd|}d}z4t|}ttd}t |||d }t |t |}t |d }t |t |||\}} W|rYt|n |rbt|wwt|t| fS) aL Generates a public/private key pair using CNG :param algorithm: The key algorithm - "rsa", "dsa" or "ec" :param bit_size: An integer - used for "rsa" and "dsa". For "rsa" the value maye be 1024, 2048, 3072 or 4096. For "dsa" the value may be 1024, plus 2048 or 3072 if on Windows 8 or newer. :param curve: A unicode string - used for "ec" keys. Valid values include "secp256r1", "secp384r1" and "secp521r1". :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A 2-element tuple of (PublicKey, PrivateKey). The contents of each key may be saved by calling .asn1.dump(). rrrirNBCRYPT_KEY_HANDLE *r)rMBCRYPT_RSA_ALGORITHMBCRYPT_DSA_ALGORITHMBCRYPT_ECDSA_P256_ALGORITHMBCRYPT_ECDSA_P384_ALGORITHMBCRYPT_ECDSA_P521_ALGORITHMrNr'rLBCryptGenerateKeyPairrDr.BCryptFinalizeKeyPairrrrVrU) rrr alg_constantr alg_handlerrrrrrrrsB    rc Cstt|tsttdt||dkrtd|dkrtd|ddkr(tdd }d }z|d }td kr>ttj }t |} tdkrIt |}nt |||d}t|t|}t|}|d dkrdq>|d krp|ddkroq>n|dkr|d}|dkr|dkrq>d} tD] } || dkrd } nq| st||r|d } t|| rt||dW|rt|SSq?|rt|ww)a` Generates DH parameters for use with Diffie-Hellman key exchange. Returns a structure in the format of DHParameter defined in PKCS#3, which is also used by the OpenSSL dhparam tool. THIS CAN BE VERY TIME CONSUMING! :param bit_size: The integer bit size of the parameters to generate. Must be between 512 and 4096, and divisible by 64. Recommended secure value as of early 2016 is 2048, with an absolute minimum of 1024. :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: An asn1crypto.algos.DHParameters object. Use oscrypto.asymmetric.dump_dh_parameters() to save to disk for usage with web servers. z= bit_size must be an integer, not %s iz-bit_size must be greater than or equal to 512rz+bit_size must be less than or equal to 4096@rz!bit_size must be a multiple of 64NrwinTrArerc rbrdF)rr) isinstancer8 TypeErrorrr5rrrNrMBCRYPT_RNG_ALGORITHMr osurandomrLBCryptGenRandomrDr#r _SMALL_PRIMES _is_primerrO) rr8r byte_sizebufferrbrrrem divisibleprimeqrrrgenerate_dh_parameterssh          & rMcCsd}|d}|ddkr|d7}|d}|ddks |dkr!d}n|dkr(d}n|dkr/d}n |d kr6d }n|d krAsn1Certificater7rr6openreadr?rr5 _load_keyr)source certificatefrrrrSs      rScCs |}t|tr |dd}|j}d}|dkr4|j\}}|dkr%ttd|tgdvr3ttdn8|d krl|jdurCttd |j d kr\t d ksPt d kr\ttd|j |j |j dkrl|jdkrlttdt d kr|dkry|d|St |||St||||S)a Loads a certificate, public key or private key into a Certificate, PublicKey or PrivateKey object :param key_object: An asn1crypto.x509.Certificate, asn1crypto.keys.PublicKeyInfo or asn1crypto.keys.PrivateKeyInfo object :param container: The class of the object to hold the key_handle :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type oscrypto.errors.AsymmetricKeyError - when the key is incompatible with the OS crypto library OSError - when an error is returned by the OS crypto library :return: A PrivateKey, PublicKey or Certificate object, based on container rrNrrzR Windows only supports EC keys using named curves rz Windows only supports EC keys using the named curves secp256r1, secp384r1 and secp521r1 rz The DSA key does not contain the necessary p, q and g parameters and can not be used rrrAz Windows XP, 2003, Vista, 7 and Server 2008 only support DSA keys based on SHA1 (1024 bits or less) - this key is based on %s and is %s bits rsha1a Windows only supports 2048 bit DSA keys based on SHA2 - this key is 2048 bits and based on SHA1, a non-standard combination that is usually generated by old versions of OpenSSL )r>rrrr2rrrr3rrrupper_advapi32_load_key_bcrypt_load_key) key_object containerkey_infoalgo curve_name curve_typerrrr sH        rcCs:t|trdnd}|j}|dkrd}|dks|dkrtj}ntj}d}d}zbt||dkd}t|||}t|} t t d} t || t |t d| } t| t| }|||} || _|dkrt|||d d } t| }t t d}t ||t | t d|} t| t|| _| WSty|rt ||rt|w) ah Loads a certificate, public key or private key into a Certificate, PublicKey or PrivateKey object via CryptoAPI :param key_object: An asn1crypto.x509.Certificate, asn1crypto.keys.PublicKeyInfo or asn1crypto.keys.PrivateKeyInfo object :param key_info: An asn1crypto.keys.PublicKeyInfo or asn1crypto.keys.PrivateKeyInfo object :param container: The class of the object to hold the key_handle :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type oscrypto.errors.AsymmetricKeyError - when the key is incompatible with the OS crypto library OSError - when an error is returned by the OS crypto library :return: A PrivateKey, PublicKey or Certificate object, based on container rrrrNrrrF)signing)r>rrrCr r rE_advapi32_create_blobr r'rBCryptImportKeylenr(rDr.rr ExceptionrrF)rrrr~rrrrrerrroutputex_blob ex_bufferex_key_handle_pointerrrrr[s`       rTcCs<|dkrtj}ntj}|dkrd}|rtj}n tj}nd}tj}ttd}t|}||_ tj |_ d|_ ||_ tt|} t| } || _|j} | d} | d} |dkr ttd }t|}| |_|dkr|d j}tj|_|d j|_t|d jd | dddd}n|dj}tj|_|d j|_t|d jd | dddd}|t|djd | dddd7}|t|djd | dddd7}|t|djd | dddd7}|t|djd | dddd7}|t|djd | dddd7}|t|djd | dddd7}|| _nttd}t|}| |_|dkr6tj|_|ddj}t|d jjd | dddd}ntj|_|ddj}t|djjd ddddd}|| _t|dd | dddd}|t|dd ddddd7}|t|dd | dddd7}||7}ttd }t|}d!|_|t|7}t| |S)"a Generates a blob for importing a key to CryptoAPI :param key_info: An asn1crypto.keys.PublicKeyInfo or asn1crypto.keys.PrivateKeyInfo object :param key_type: A unicode string of "public" or "private" :param algo: A unicode string of "rsa" or "dsa" :param signing: If the key handle is for signing - may only be False for rsa keys :return: A byte string of a blob to pass to advapi32.CryptImportKey() rrrr BLOBHEADERrr:r  RSAPUBKEYrrrF)signedwidthNrXrr]r^r_r`rar\ DSSPUBKEYrrrrqrrLrDSSSEEDl)rCrrr  CALG_RSA_KEYXr r+rBr.bTypeCUR_BLOB_VERSIONbVersionreservedaiKeyAlgpublickeystrucrbitlenrRSA1rr&rdrRSA2rcDSS1DSS2 dsspubkeycounterr,)rr~rr blob_typerrblob_header_pointer blob_headerrrrrfrgpubkey_pointerpubkeyparsed_key_info blob_datarkey_datadssseed_pointerdssseedrrrrs|         """"""  "      rc+ Csld}d}t|tr dnd}|j}|dkrd}z|dkr!|jdn|}tjtjtjtjtj d|} t | }|dkr|dkrNtj } tj } |d j } d } d }n=tj} tj} |d j } t| d j}t| d j}t| dj}t| dj}t| dj}t| dj}t|} t|}t| dj}t| dj}ttd}t|}| |_|j|_t||_t||_| |_||_t|||}|dkr|||7}|t|| 7}|t||7}|t|| 7}|t|t|7}n|dkr|dkrtj} |d j j}|dd}ntj } t!|d j}t|d j j}|dd}t|}t|dj}t|dj}t|dj} |jdkrAt| }!nd}!t"t|t|t|}"t||"}t||"}t||"}t| |!} d}#d|!}$|jdkr|dkrxtj#} ntj$} ttd }t|}| |_%|"|_&tj'|_(tj)|_*|!|_+|!|_,t-|#|_.t|}||$| |||7}|dkr|t||!7}n|dkrtj/} ntj0} ttd!}t|}| |_%|"|_&t-|#|_.t-|$|_1t-| |_2t||||}|dkr|t||!7}n|dkr|dkrtj3} |d 4\}%}&n"tj5} |d j d }|r%|4\}%}&nd }%d }&t|d j d j}ttd"}t|}tj6tj7tj8tj9tj:tj;d#||f} d$d%d&d'|}"t|%}'t|&}(t|'|"}'t|(|"}(| |_%|"|_&t||'|(}|dkr|t||"7}t| |)|t|tj?}*t@|*t|)}|||W|rtA|SS|rtA|ww))a Loads a certificate, public key or private key into a Certificate, PublicKey or PrivateKey object via CNG :param key_object: An asn1crypto.x509.Certificate, asn1crypto.keys.PublicKeyInfo or asn1crypto.keys.PrivateKeyInfo object :param key_info: An asn1crypto.keys.PublicKeyInfo or asn1crypto.keys.PrivateKeyInfo object :param container: The class of the object to hold the key_handle :param curve_name: None or a unicode string of the curve name for an EC key :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type oscrypto.errors.AsymmetricKeyError - when the key is incompatible with the OS crypto library OSError - when an error is returned by the OS crypto library :return: A PrivateKey, PublicKey or Certificate object, based on container Nrrrrrr@)rrrrrrrrr]r^r_r`rar\rrrrrrrrrrLrrqsrrr))rr)rr)rr)rr)rr)rr 0Brr/)Br>rrrrMr0r1r2r3r4rNrBCRYPT_RSAPUBLIC_MAGICrrBCRYPT_RSAFULLPRIVATE_MAGICrr&rr+rLr.Magicr BitLengthrzr{r|r}r,r1rrrmaxBCRYPT_DSA_PUBLIC_MAGIC_V2BCRYPT_DSA_PRIVATE_MAGIC_V2rrDSA_HASH_ALGORITHM_SHA256 hashAlgorithm DSA_FIPS186_3standardVersionrrr"CountBCRYPT_DSA_PUBLIC_MAGICBCRYPT_DSA_PRIVATE_MAGICSeedrLr  to_coordsrrrrrrrr'BCryptImportKeyPairr(BCRYPT_NO_KEY_VALIDATIONrDrO)+rrrrr8rr~r alg_selectorr7rr parsed_key prime1_size prime2_sizer]r^r_r`rar\rrrrrerr private_bytes public_bytesrrrLq_len key_widthcountseedrWrwx_bytesy_bytesrrrrrrsF                                       rcCst|tr|}nN|dur$t|tr|d}t|ts$ttdt|t|trCt|d }| }Wdn1s=wYnt|tsQttdt|t ||}t |t S)a Loads a private key into a PrivateKey object :param source: A byte string of file contents, a unicode string filename or an asn1crypto.keys.PrivateKeyInfo object :param password: A byte or unicode string to decrypt the private key file. Unicode strings will be encoded using UTF-8. Not used is the source is a PrivateKeyInfo object. :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type oscrypto.errors.AsymmetricKeyError - when the private key is incompatible with the OS crypto library OSError - when an error is returned by the OS crypto library :return: A PrivateKey object Nutf-8zP password must be a byte string, not %s rHz source must be a byte string, unicode string or asn1crypto.keys.PrivateKeyInfo object, not %s ) r>rr6encoder7r?rr5rrrrrX)rpasswordprivate_objectrrrrrUs,          rUcCst|tr|}n4t|trt|}n*t|tr3t|d}t|}Wdn1s-wYn ttdt |t |t S)a3 Loads a public key into a PublicKey object :param source: A byte string of file contents, a unicode string filename or an asn1crypto.keys.PublicKeyInfo object :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type oscrypto.errors.AsymmetricKeyError - when the public key is incompatible with the OS crypto library OSError - when an error is returned by the OS crypto library :return: A PublicKey object rHNz source must be a byte string, unicode string or asn1crypto.keys.PublicKeyInfo object, not %s ) r>rr7rr6rrr?rr5rrY)rrrrrrrV9s      rVcCs t||tS)a Parses a PKCS#12 ANS.1 DER-encoded structure and extracts certs and keys :param data: A byte string of a DER-encoded PKCS#12 file :param password: A byte string of the password to any encrypted data :raises: ValueError - when any of the parameters are of the wrong type or value OSError - when an error is returned by one of the OS decryption functions :return: A three-element tuple of: 1. An asn1crypto.keys.PrivateKeyInfo object 2. An asn1crypto.x509.Certificate object 3. A list of zero or more asn1crypto.x509.Certificate objects that are "extra" certificates, possibly intermediates from the cert chain )rrU)datarrrrrWas rWc Cs|durt|tr|d}t|tsttdt|t|tr;t|d }|}Wdn1s5wYnt|tsIttdt|t ||\}}}d}d}|r\t |t }|rdt |j t }dd|D}|||fS)a Loads a .p12 or .pfx file into a PrivateKey object and one or more Certificates objects :param source: A byte string of file contents or a unicode string filename :param password: A byte or unicode string to decrypt the PKCS12 file. Unicode strings will be encoded using UTF-8. :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type oscrypto.errors.AsymmetricKeyError - when a contained key is incompatible with the OS crypto library OSError - when an error is returned by the OS crypto library :return: A three-element tuple containing (PrivateKey, Certificate, [Certificate, ...]) NrzH password must be a byte string, not %s rHzR source must be a byte string or a unicode string, not %s cSsg|]}t|jtqSr)rrr).0inforrr szload_pkcs12..)r>r6rr7r?rr5rrrWrrXrr) rrrr cert_infoextra_certs_infokeycert extra_certsrrrrTzs6          rTcC |jdkr tdt||||S)a Verifies an RSASSA-PKCS-v1.5 signature. When the hash_algorithm is "raw", the operation is identical to RSA public key decryption. That is: the data is not hashed and no ASN.1 structure with an algorithm identifier of the hash algorithm is placed in the encrypted byte string. :param certificate_or_public_key: A Certificate or PublicKey instance to verify the signature with :param signature: A byte string of the signature to verify :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha256", "sha384", "sha512" or "raw" :raises: oscrypto.errors.SignatureError - when the signature is determined to be invalid ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library r*The key specified is not an RSA public keyrr_verifycertificate_or_public_key signaturerhash_algorithmrrrr_s r_cCs0|j}|dkr|dkrtdt||||ddS)a Verifies an RSASSA-PSS signature. For the PSS padding the mask gen algorithm will be mgf1 using the same hash algorithm as the signature. The salt length with be the length of the hash algorithm, and the trailer field with be the standard 0xBC byte. :param certificate_or_public_key: A Certificate or PublicKey instance to verify the signature with :param signature: A byte string of the signature to verify :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha256", "sha384" or "sha512" :raises: oscrypto.errors.SignatureError - when the signature is determined to be invalid ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library rrrTrsa_pss_paddingr)rrrrcp_algrrrrasracCr)a Verifies a DSA signature :param certificate_or_public_key: A Certificate or PublicKey instance to verify the signature with :param signature: A byte string of the signature to verify :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha256", "sha384" or "sha512" :raises: oscrypto.errors.SignatureError - when the signature is determined to be invalid ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library rz)The key specified is not a DSA public keyrrrrrrQ rQcCr)a Verifies an ECDSA signature :param certificate_or_public_key: A Certificate or PublicKey instance to verify the signature with :param signature: A byte string of the signature to verify :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha256", "sha384" or "sha512" :raises: oscrypto.errors.SignatureError - when the signature is determined to be invalid ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library rz)The key specified is not an EC public keyrrrrrrK r rKFc CsNt|ttfsttdt|t|tsttdt|t|ts,ttdt||j}|dkp6|dk}tgd}|rH|sH|tdgO}||vr`d}|rV|sV|d 7}t td |t ||so|d urot td | |dkrt ||j d krt td|j t |tdkr|jdkrt||||St|||||St|||||S)a( Verifies an RSA, DSA or ECDSA signature :param certificate_or_public_key: A Certificate or PublicKey instance to verify the signature with :param signature: A byte string of the signature to verify :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha256", "sha384", "sha512" or "raw" :param rsa_pss_padding: If PSS padding should be used for RSA keys :raises: oscrypto.errors.SignatureError - when the signature is determined to be invalid ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library certificate_or_public_key must be an instance of the Certificate or PublicKey class, not %s zA signature must be a byte string, not %s < data must be a byte string, not %s rrmd5rsha256sha384sha512raw+"md5", "sha1", "sha256", "sha384", "sha512", "raw"B hash_algorithm must be one of %s, not %s Fu PSS padding may only be used with RSA keys - signing via a %s key was requested rez data must be 11 bytes shorter than the key size when hash_algorithm is "raw" - key size is %s bytes, but data is %s bytes long rAr)r>rrYr?rr5r7rrrrrrrFr_pure_python_ecdsa_verify_advapi32_verify_bcrypt_verify) rrrrr r  cp_is_rsavalid_hash_algorithmsvalid_hash_algorithms_errorrrrr5 s\     rc Cs|j}|dkp |dk}|r1|r1dddddd|d }t||}|j} t||| ||s/td d S|rY|d krYt||} zt|j| } t| |sKt Wd St yXtd wd } zt j t j t j t jt jd |} ttd}t|j| td |}t|t|} t| |t|d }t||dkrzt|}t|d}||d |d |}Wnt ttfytd w|d d d}t| |t||jtd }t|W| rt | d Sd S| rt | ww)a6 Verifies an RSA, DSA or ECDSA signature via CryptoAPI :param certificate_or_public_key: A Certificate or PublicKey instance to verify the signature with :param signature: A byte string of the signature to verify :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha256", "sha384", "sha512" or "raw" :param rsa_pss_padding: If PSS padding should be used for RSA keys :raises: oscrypto.errors.SignatureError - when the signature is determined to be invalid ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library rrrqrrr9rsha224rrrrSignature is invalidNrr HCRYPTHASH *rrrX)!rgetr<rr>r4r=rFr?rrCCALG_MD5 CALG_SHA1 CALG_SHA_256 CALG_SHA_384 CALG_SHA_512r'rBCryptCreateHashrr(rDr. CryptHashDatarr loadto_p1363 OverflowErrorr?CryptVerifySignatureWrCryptDestroyHash)rrrrr r algo_is_rsa hash_lengthdecrypted_signaturekey_sizepadded_plaintext plaintext hash_handlealg_idhash_handle_pointerrhalf_lenreversed_signaturerrrr s          rc Csn|dkr|}ntjtjtjtjtjd|}tt||}t }d}|j } | dkp.| dk} | rw|rPtj }t t d} t| } t|} tt d| | _t|| _n tj}t t d} t| } |dkret | _n t|} tt d| | _tt d | }nz t|}Wntttfytd wt |j||t||t||}|tjk}|p|tjk}|rtd t |d S) a0 Verifies an RSA, DSA or ECDSA signature via CNG :param certificate_or_public_key: A Certificate or PublicKey instance to verify the signature with :param signature: A byte string of the signature to verify :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha256", "sha384", "sha512" or "raw" :param rsa_pss_padding: If PSS padding should be used for RSA keys :raises: oscrypto.errors.SignatureError - when the signature is determined to be invalid ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library rrrrrBCRYPT_PSS_PADDING_INFO wchar_t *BCRYPT_PKCS1_PADDING_INFOvoid *r"N)!rMBCRYPT_MD5_ALGORITHMBCRYPT_SHA1_ALGORITHMBCRYPT_SHA256_ALGORITHMBCRYPT_SHA384_ALGORITHMBCRYPT_SHA512_ALGORITHMgetattrhashlibdigestr(rBCRYPT_PAD_PSSr+rLr.r!r$pszAlgIdrcbSaltBCRYPT_PAD_PKCS1r r,r-rr.r?r4BCryptVerifySignaturerSTATUS_INVALID_SIGNATURESTATUS_INVALID_PARAMETERrD)rrrrr rG hash_constant padding_inforr rpadding_info_struct_pointerpadding_info_struct hash_bufferrfailurerrrr sd      rcC|jdkr tdt|||S)aL Generates an RSASSA-PKCS-v1.5 signature. When the hash_algorithm is "raw", the operation is identical to RSA private key encryption. That is: the data is not hashed and no ASN.1 structure with an algorithm identifier of the hash algorithm is placed in the encrypted byte string. :param private_key: The PrivateKey to generate the signature with :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha256", "sha384", "sha512" or "raw" :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the signature r+The key specified is not an RSA private keyrr_signrrrrrrr^^ s  r^cCs.|j}|dkr|dkrtdt|||ddS)a$ Generates an RSASSA-PSS signature. For the PSS padding the mask gen algorithm will be mgf1 using the same hash algorithm as the signature. The salt length with be the length of the hash algorithm, and the trailer field with be the standard 0xBC byte. :param private_key: The PrivateKey to generate the signature with :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha256", "sha384" or "sha512" :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the signature rrrVTr rW)rrrpkey_algrrrr` sr`cCrU)a7 Generates a DSA signature :param private_key: The PrivateKey to generate the signature with :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha256", "sha384" or "sha512" :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the signature rz*The key specified is not a DSA private keyrWrYrrrrP   rPcCrU)a: Generates an ECDSA signature :param private_key: The PrivateKey to generate the signature with :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha256", "sha384" or "sha512" :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the signature rz*The key specified is not an EC private keyrWrYrrrrJ r[rJcCs.t|tsttdt|t|tsttdt||j}|dkp&|dk}tgd}|jdkr;|s;|tdgO}||vrSd}|rI|sI|d7}ttd |t ||sb|d urbttd | |dkrzt ||j d krzttd |j t |t dkr|jdkrt|||St||||St||||S)a Generates an RSA, DSA or ECDSA signature :param private_key: The PrivateKey to generate the signature with :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha256", "sha384", "sha512" or "raw" :param rsa_pss_padding: If PSS padding should be used for RSA keys :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the signature zO private_key must be an instance of PrivateKey, not %s rrrrrrrrFrrez data must be 11 bytes shorter than the key size when hash_algorithm is "raw" - key size is %s bytes, but data is %s bytes long rAr)r>rXr?rr5r7rrrrrrrFr_pure_python_ecdsa_sign_advapi32_sign _bcrypt_sign)rrrr rZ pkey_is_rsarrrrrrX sR      rXc Cs|j}|dkp |dk}|r|dkrt|j|}t||S|r9|r9dddddd |d }t|||j|}t||S|jd krH|d krHttd d}zt j t j t j t j t jd|} ttd} t|j| td | } t| t| }t||t|d } t| ttd} t|t jtd t| } t| t| } t| }t|t jtd || } t| t|t| }|ddd}|d krt|d}||d|d|}t|}|W|rt |SS|rt |ww)a Generates an RSA, DSA or ECDSA signature via CryptoAPI :param private_key: The PrivateKey to generate the signature with :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha256", "sha384", "sha512" or "raw" :param rsa_pss_padding: If PSS padding should be used for RSA keys :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the signature rrrrqrrrr9r rrrzO Windows does not support md5 signatures with DSA keys Nrr#rrXr)!rr9rFr;r$r:rrrrCr%r&r'r(r)r'rBr*rr(rDr.r+rCryptSignHashW AT_SIGNATUREr%r r#r from_p1363rr0)rrrr rr1 padded_datar2r7r8r9rrrrrr:rrrr]0 s         r]c Cs|dkr|}ntjtjtjtjtjd|}tt||}t }d}|j }|dkp.|dk} | r~|rXdddd d d|} tj }t t d } t| } t|} tt d | | _| | _n tj}t t d } t| } |dkrmt | _n t|} tt d | | _tt d| }|dkr|jdkr|tddgvrttdtt d}t |j||t|t d||}t|t|}t|}| rtt d| }t |j||t|||||}t|t|t|}| st !|"}|S)a Generates an RSA, DSA or ECDSA signature via CNG :param private_key: The PrivateKey to generate the signature with :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha256", "sha384", "sha512" or "raw" :param rsa_pss_padding: If PSS padding should be used for RSA keys :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the signature rrrrrr rqrrr9r<r=r>r?rrrrz~ Windows does not support sha1 signatures with DSA keys based on sha224, sha256 or sha512 r)#rMr@rArBrCrDrErFrGr(rrHr+rLr.r!r$rIrJrKrrrrr'BCryptSignHashrrrDr%r r#r rbr)rrrr rGrOrPrrZr_r2rQrRrSrr buffer_lenrGrrrrr^ s    "    r^cCsxt|ttfsttdt|t|tsttdt|t|ts,ttdt|tdkr6t |||St |||S)aG Encrypts a value using an RSA public key :param certificate_or_public_key: A Certificate or PublicKey instance to encrypt with :param data: A byte string of the data to encrypt :param rsa_oaep_padding: If OAEP padding should be used instead of PKCS#1 v1.5 :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the ciphertext r rA rsa_oaep_padding must be a bool, not %s rA) r>rrYr?rr5r7boolr_advapi32_encrypt_bcrypt_encrypt)rrrsa_oaep_paddingrrr_encrypt# s$    rkc Csd}|rtj}ttdt|}t|jtd|t|d}t|t |}t |}t ||t |t|t|jtd||||}t|t |t |dddS)aU Encrypts a value using an RSA public key via CryptoAPI :param certificate_or_public_key: A Certificate or PublicKey instance to encrypt with :param data: A byte string of the data to encrypt :param rsa_oaep_padding: If OAEP padding should be used instead of PKCS#1 v1.5 :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the ciphertext rrTNrX)rC CRYPT_OAEPr'rBr CryptEncryptrr(rDr%r r/r)r#)rrrjrrrrerGrrrrhW s:   rhc Ctj}|dur-tj}ttd}t|}ttj}ttd||_ t |_ d|_ ttd|}nt }t td}t|j|t||t dt d|| } t| t|} t| } t|j|t||t d| | || } t| t| t|S)aO Encrypts a value using an RSA public key via CNG :param certificate_or_public_key: A Certificate or PublicKey instance to encrypt with :param data: A byte string of the data to encrypt :param rsa_oaep_padding: If OAEP padding should be used instead of PKCS#1 v1.5 :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the ciphertext TBCRYPT_OAEP_PADDING_INFOr=rr?r)rMrKBCRYPT_PAD_OAEPr+rLr.r!rAr$rIr(pbLabelcbLabelr' BCryptEncryptrrrDr%r r#) rrrjrrQrRrSrPrrrerGrrrri R     ricCstt|tsttdt|t|tsttdt|t|ts*ttdt|tdkr4t|||St |||S)a1 Encrypts a value using an RSA private key :param private_key: A PrivateKey instance to decrypt with :param ciphertext: A byte string of the data to decrypt :param rsa_oaep_padding: If OAEP padding should be used instead of PKCS#1 v1.5 :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the plaintext zY private_key must be an instance of the PrivateKey class, not %s zB ciphertext must be a byte string, not %s rfrA) r>rXr?rr5r7rgr_advapi32_decrypt_bcrypt_decrypt)r ciphertextrjrrr_decrypt s$     rxcCsbd}|rtj}|ddd}t|}ttdt|}t|jtd|||}t |t |t |S)a? Encrypts a value using an RSA private key via CryptoAPI :param private_key: A PrivateKey instance to decrypt with :param ciphertext: A byte string of the data to decrypt :param rsa_oaep_padding: If OAEP padding should be used instead of PKCS#1 v1.5 :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the plaintext rNrXrT) rCrlr r'rBr CryptDecryptrr(rDr#r%)rrwrjrrGrrrrrru s ruc Crn)a9 Encrypts a value using an RSA private key via CNG :param private_key: A PrivateKey instance to decrypt with :param ciphertext: A byte string of the data to decrypt :param rsa_oaep_padding: If OAEP padding should be used instead of PKCS#1 v1.5 :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the plaintext Tror=rr?r)rMrKrpr+rLr.r!rAr$rIr(rqrrr' BCryptDecryptrrrDr%r r#) rrwrjrrQrRrSrPrrrerGrrrrv6 rtrvcC t||S)aF Encrypts a byte string using an RSA public key or certificate. Uses PKCS#1 v1.5 padding. :param certificate_or_public_key: A PublicKey or Certificate object :param data: A byte string, with a maximum length 11 bytes less than the key length (in bytes) :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the encrypted data rkrrrrrr]~ s r]cCr{)a Decrypts a byte string using an RSA private key. Uses PKCS#1 v1.5 padding. :param private_key: A PrivateKey object :param ciphertext: A byte string of the encrypted data :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the original plaintext rxrrwrrrr\ s r\cCt||ddS)aZ Encrypts a byte string using an RSA public key or certificate. Uses PKCS#1 OAEP padding with SHA1. :param certificate_or_public_key: A PublicKey or Certificate object :param data: A byte string, with a maximum length 41 bytes (or more) less than the key length (in bytes) :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the encrypted data Trjr|r}rrrr[ sr[cCr)a Decrypts a byte string using an RSA private key. Uses PKCS#1 OAEP padding with SHA1. :param private_key: A PrivateKey object :param ciphertext: A byte string of the encrypted data :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the original plaintext Trr~rrrrrZ srZ)NN)N)T)F) __future__rrrrrAsysrFrP_asn1rrrr r r r r rrrrrrrr _asymmetricrrrrrrrrr_errorsr_ffir r!r"r#r$r%r&r'r(r)r*r+r,r-r.r/r0_intr1errorsr2r3r4_typesr5r6r7r8_pkcs1r9r:r;r<r=r>utilr?getwindowsversion_gwvrr _advapi32rBrCrDrErF_ecdsarGrrHrrIrJr\rKr_cngrLrMrNrO__all__rDrrXrYrRrrrrrMrErrr"r#r$rSrrrrrUrVrWrTr_rarQrrrr^r`rPrXr]r^rkrhrirxrurvr]r\r[rZrrrrsD, H    ,W LP X4 e@d.G=U[G&P Wg i8 ( =""  b nY!!  X z y 4 9 H 3 +H