b'[4 @ s d d l Z d d l Z d d l Z d d l m Z m Z d d l m Z d d l m Z m
Z
m Z m Z m
Z
m Z m Z m Z y d d l m Z d d l m Z m Z m Z d d l m Z m Z m Z m Z m Z m Z m Z m Z d d l m! Z! m" Z" d d
l# m$ Z$ m% Z% d d l& m' Z' d d l( m) Z) d
Z* Wn e+ k
rZd Z* Yn Xe, d d d d d d d d d d g
Z- d d Z. Gd d d e/ Z0 Gd d d e0 Z1 Gd d d e0 Z2 e* rGd! d" d" e0 Z3 Gd# d$ d$ e0 Z4 Gd% d& d& e3 Z5 d S)' N )constant_time_compare string_types)InvalidKeyError)base64url_decodebase64url_encodeder_to_raw_signature force_bytes
force_unicodefrom_base64url_uintraw_to_der_signatureto_base64url_uint)hashes)load_pem_private_keyload_pem_public_keyload_ssh_public_key)
RSAPrivateKey RSAPublicKeyRSAPrivateNumbersRSAPublicNumbersrsa_recover_prime_factors rsa_crt_dmp1 rsa_crt_dmq1 rsa_crt_iqmp)EllipticCurvePrivateKeyEllipticCurvePublicKey)ecpadding)default_backend)InvalidSignatureTFRS256RS384RS512ES256ES384ES521ES512PS256PS384PS512c C s d t d t t j d t t j d t t j i } t r | j d t t j d t t j d t t j d t t j d t t j d
t t j d t t j d t t j d
t t j d t t j i
| S)zE
Returns the algorithms that are implemented by the library.
ZnoneZHS256ZHS384ZHS512r r! r" r# r$ r% r& r' r( r) )
NoneAlgorithm
HMACAlgorithmSHA256SHA384SHA512
has_cryptoupdate RSAAlgorithm ECAlgorithmRSAPSSAlgorithm)Zdefault_algorithms r4 /algorithms.pyget_default_algorithms& s" r6 c @ s^ e Z d Z d Z d d Z d d Z d d Z e d d Z e d
d Z d S)
AlgorithmzH
The interface for an algorithm used to sign and verify tokens.
c C s
t d S)z
Performs necessary validation and conversions on the key and returns
the key value in the proper format for sign() and verify().
N)NotImplementedError)selfkeyr4 r4 r5 prepare_keyF s zAlgorithm.prepare_keyc C s
t d S)zn
Returns a digital signature for the specified message
using the specified key value.
N)r8 )r9 msgr: r4 r4 r5 signM s zAlgorithm.signc C s
t d S)zz
Verifies that the specified digital signature is valid
for the specified message and key values.
N)r8 )r9 r< r: sigr4 r4 r5 verifyT s zAlgorithm.verifyc C s
t d S)z7
Serializes a given RSA key into a JWK
N)r8 )key_objr4 r4 r5 to_jwk[ s zAlgorithm.to_jwkc C s
t d S)zb
Deserializes a given RSA key from JWK back into a PublicKey or PrivateKey object
N)r8 )jwkr4 r4 r5 from_jwkb s zAlgorithm.from_jwkN)
__name__
__module__ __qualname____doc__r; r= r? staticmethodrA rC r4 r4 r4 r5 r7 B s r7 c @ s: e Z d Z d Z d d Z d d Z d d Z d S) r* zZ
Placeholder for use when no signing or verification
operations are required.
c C s. | d k r d } | d k r* t d | S)N z*When alg = "none", key value must be None.)r )r9 r: r4 r4 r5 r; o s
zNoneAlgorithm.prepare_keyc C s d S)N r4 )r9 r< r: r4 r4 r5 r= x s zNoneAlgorithm.signc C s d S)NFr4 )r9 r< r: r> r4 r4 r5 r? { s zNoneAlgorithm.verifyN)rD rE rF rG r; r= r? r4 r4 r4 r5 r* j s r* c @ s e Z d Z d Z e j Z e j Z e j Z
d d Z d d Z e
d d Z e
d d Z d
d Z d d
Z d S)r+ zf
Performs signing and verification operations using HMAC
and the specified hash function.
c C s
| | _ d S)N)hash_alg)r9 rK r4 r4 r5 __init__ s zHMACAlgorithm.__init__c sM t d d d d g } t f d d | D rI t d S)Ns -----BEGIN PUBLIC KEY-----s -----BEGIN CERTIFICATE-----s -----BEGIN RSA PUBLIC KEY-----s ssh-rsac s g | ] } | k q Sr4 r4 ).0Z string_value)r: r4 r5
<listcomp> s z-HMACAlgorithm.prepare_key.<locals>.<listcomp>zdThe specified key is an asymmetric key or x509 certificate and should not be used as an HMAC secret.)r anyr )r9 r: Zinvalid_stringsr4 )r: r5 r; s zHMACAlgorithm.prepare_keyc C s+ t j d t t t | d d i S)Nkktyoct)jsondumpsr
r r )r@ r4 r4 r5 rA s zHMACAlgorithm.to_jwkc C s> t j | } | j d d k r0 t d t | d S)NrQ rR zNot an HMAC keyrP )rS loadsgetr r )rB objr4 r4 r5 rC s zHMACAlgorithm.from_jwkc C s t j | | | j j S)N)hmacnewrK digest)r9 r< r: r4 r4 r5 r= s zHMACAlgorithm.signc C s t | | j | | S)N)r r= )r9 r< r: r> r4 r4 r5 r? s zHMACAlgorithm.verifyN)rD rE rF rG hashlibsha256r, sha384r- sha512r. rL r; rH rA rC r= r? r4 r4 r4 r5 r+ s r+ c @ s e Z d Z d Z e j Z e j Z e j Z d d Z d d Z e
d d Z e
d d Z d
d Z
d d
Z d S)r1 z~
Performs signing and verification operations using
RSASSA-PKCS-v1_5 and the specified hash function.
c C s
| | _ d S)N)rK )r9 rK r4 r4 r5 rL s zRSAAlgorithm.__init__c C s t | t s t | t r" | St | t r t | } yF | j d rg t | d t } n t | d d d t } Wq t k
r t
| d t } Yq Xn t d | S)Ns ssh-rsabackendpasswordz Expecting a PEM-formatted key.)
isinstancer r r r
startswithr r r
ValueErrorr TypeError)r9 r: r4 r4 r5 r; s
zRSAAlgorithm.prepare_keyc C sc d } t | d d r | j } d d d d g d t t | j j d t t | j j d t t | j d t t | j d
t t | j d t t | j
d t t | j d
t t | j i
} nl t | d d rJ| j } d d d d g d t t | j d t t | j i } n t
d t j | S)Nprivate_numbersrQ RSAZkey_opsr= nedpqdpdqqir? zNot a public or private key)getattrre r
r
public_numbersrg rh ri rj rk dmp1dmq1iqmpr rS rT )r@ rW numbersr4 r4 r5 rA s* zRSAAlgorithm.to_jwkc sl y t j | Wn t k
r3 t d Yn X j d d k rU t d d k rd k rd k rd k r t d d
d d d
d g } f d d | D } t | } | r t | r t d t t d t d } | rt d t d d
t d
d t d d t d d t d
d t d d | } n| t d } t
| j | | j \ } } t d | d
| d | d t
| | d t | | d t | | d | } | j t Sd k r\d k r\t t d t d } | j t St d d S)NzKey is not valid JSONrQ rf zNot an RSA keyri rh rg Zothz5Unsupported RSA private key: > 2 primes not supportedrj rk rl rm rn c s g | ] } | k q Sr4 r4 )rM Zprop)rW r4 r5 rN s z)RSAAlgorithm.from_jwk.<locals>.<listcomp>z@RSA key must include all parameters if any are present besides drq rr rs rp zNot a public or private key)rS rU rc r rV rO allr r r r rg rh r r r Z private_keyr Z
public_key) rB Z other_propsZ props_foundZany_props_foundrp rt ri rj rk r4 )rW r5 rC sT
$ zRSAAlgorithm.from_jwkc C s | j | t j | j S)N)r= r PKCS1v15rK )r9 r< r: r4 r4 r5 r= 8 s zRSAAlgorithm.signc C sG y* | j | | t j | j d SWn t k
rB d SYn Xd S)NTF)r? r rv rK r )r9 r< r: r> r4 r4 r5 r? ; s
"
zRSAAlgorithm.verifyN)rD rE rF rG r r, r- r. rL r; rH rA rC r= r? r4 r4 r4 r5 r1 s $? r1 c @ sa e Z d Z d Z e j Z e j Z e j Z d d Z d d Z d d Z
d d Z d
S) r2 zr
Performs signing and verification operations using
ECDSA and the specified hash function
c C s
| | _ d S)N)rK )r9 rK r4 r4 r5 rL K s zECAlgorithm.__init__c C s t | t s t | t r" | St | t r t | } y@ | j d rg t | d t } n t | d t } Wq t k
r t
| d d d t } Yq Xn t d | S)Ns ecdsa-sha2-r_ r` z Expecting a PEM-formatted key.) ra r r r r rb r r r rc r rd )r9 r: r4 r4 r5 r; N s
# zECAlgorithm.prepare_keyc C s1 | j | t j | j } t | | j S)N)r= r ECDSArK r curve)r9 r< r: der_sigr4 r4 r5 r= f s !zECAlgorithm.signc C sv y t | | j } Wn t k
r. d SYn Xy* | j | | t j | j d SWn t k
rq d SYn Xd S)NFT)r rx rc r? r rw rK r )r9 r< r: r> ry r4 r4 r5 r? k s
"
zECAlgorithm.verifyN) rD rE rF rG r r, r- r. rL r; r= r? r4 r4 r4 r5 r2 B s r2 c @ s. e Z d Z d Z d d Z d d Z d S)r3 zA
Performs a signature using RSASSA-PSS with MGF1
c C s@ | j | t j d t j | j d | j j | j S)Nmgf salt_length)r= r PSSMGF1rK digest_size)r9 r< r: r4 r4 r5 r= | s zRSAPSSAlgorithm.signc C sh yK | j | | t j d t j | j d | j j | j d SWn t k
rc d SYn Xd S)Nrz r{ TF)r? r r| r} rK r~ r )r9 r< r: r> r4 r4 r5 r? s
zRSAPSSAlgorithm.verifyN)rD rE rF rG r= r? r4 r4 r4 r5 r3 w s
r3 )6r[ rX rS compatr r
exceptionsr Zutilsr r r r r
r r r
Z cryptography.hazmat.primitivesr Z,cryptography.hazmat.primitives.serializationr r r Z-cryptography.hazmat.primitives.asymmetric.rsar r r r r r r r Z,cryptography.hazmat.primitives.asymmetric.ecr r Z)cryptography.hazmat.primitives.asymmetricr r Z cryptography.hazmat.backendsr Zcryptography.exceptionsr r/ ImportErrorsetZrequires_cryptographyr6 objectr7 r* r+ r1 r2 r3 r4 r4 r4 r5 <module> s4 : :
(45