U
tJ`S @ s d dl Z d dlZd dlZddlmZ ddlmZmZmZm Z m
Z
m Z m Z zd dl
Zd dl
mZ d dlmZ d dlmZmZ d dlmZmZ d d lmZmZ d d
lm Z m Z m Z m Z m Z m!Z!m"Z"m#Z# d d l$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+ d Z,W n e-k
r d
Z,Y nX ddddddddddddh Z.dd Z/G d d d Z0G d d d e0Z1G d d! d!e0Z2e,rG d"d# d#e0Z3G d$d% d%e0Z4G d&d' d'e3Z5G d(d) d)e0Z6dS )* N InvalidKeyError)base64url_decodebase64url_encodeder_to_raw_signature force_bytesfrom_base64url_uintraw_to_der_signatureto_base64url_uint)InvalidSignature)hashes)ecpadding)EllipticCurvePrivateKeyEllipticCurvePublicKey)Ed25519PrivateKeyEd25519PublicKey)
RSAPrivateKeyRSAPrivateNumbers RSAPublicKeyRSAPublicNumbers rsa_crt_dmp1 rsa_crt_dmq1 rsa_crt_iqmprsa_recover_prime_factors)Encoding NoEncryption
PrivateFormat PublicFormatload_pem_private_keyload_pem_public_keyload_ssh_public_keyTFRS256RS384RS512ES256ES256KES384ES521ES512PS256PS384PS512EdDSAc C s t ttjttjttjd} tr| ttjttjttjttjttjttjttjttjt t jt t jt t jt
d | S )zE
Returns the algorithms that are implemented by the library.
)ZnoneZHS256ZHS384ZHS512) r# r$ r% r& r' r( r) r* r+ r, r- r. )
NoneAlgorithm
HMACAlgorithmSHA256SHA384SHA512
has_cryptoupdate RSAAlgorithm ECAlgorithmRSAPSSAlgorithmEd25519Algorithm)Zdefault_algorithms r: ?/opt/alt/python38/lib/python3.8/site-packages/jwt/algorithms.pyget_default_algorithmsE s0 r< c @ s@ e Zd ZdZdd Zdd Zdd Zedd Zed
d Z d S )
AlgorithmzH
The interface for an algorithm used to sign and verify tokens.
c C s t dS )z
Performs necessary validation and conversions on the key and returns
the key value in the proper format for sign() and verify().
NNotImplementedErrorselfkeyr: r: r; prepare_keyl s zAlgorithm.prepare_keyc C s t dS )zn
Returns a digital signature for the specified message
using the specified key value.
Nr> rA msgrB r: r: r; signs s zAlgorithm.signc C s t dS )zz
Verifies that the specified digital signature is valid
for the specified message and key values.
Nr> rA rE rB sigr: r: r; verifyz s zAlgorithm.verifyc C s t dS )z7
Serializes a given RSA key into a JWK
Nr> key_objr: r: r; to_jwk s zAlgorithm.to_jwkc C s t dS )zb
Deserializes a given RSA key from JWK back into a PublicKey or PrivateKey object
Nr> )jwkr: r: r; from_jwk s zAlgorithm.from_jwkN)
__name__
__module__ __qualname____doc__rC rF rI staticmethodrL rN r: r: r: r; r= g s
r= c @ s( e Zd ZdZdd Zdd Zdd ZdS ) r/ zZ
Placeholder for use when no signing or verification
operations are required.
c C s |dkr d }|d k r t d|S )N z*When alg = "none", key value must be None.r r@ r: r: r; rC s
zNoneAlgorithm.prepare_keyc C s dS )N r: rD r: r: r; rF s zNoneAlgorithm.signc C s dS )NFr: rG r: r: r; rI s zNoneAlgorithm.verifyN)rO rP rQ rR rC rF rI r: r: r: r; r/ s r/ c @ sZ e Zd ZdZejZejZej Z
dd Z dd Z e
dd Ze
dd Zd
d Zd d
ZdS )r0 zf
Performs signing and verification operations using HMAC
and the specified hash function.
c C s
|| _ d S Nhash_algrA rX r: r: r; __init__ s zHMACAlgorithm.__init__c s6 t ddddg}t fdd|D r2td S )Ns -----BEGIN PUBLIC KEY-----s -----BEGIN CERTIFICATE-----s -----BEGIN RSA PUBLIC KEY----- ssh-rsac 3 s | ]}| kV qd S rV r: ).0Z string_valuerB r: r; <genexpr> s z,HMACAlgorithm.prepare_key.<locals>.<genexpr>zdThe specified key is an asymmetric key or x509 certificate and should not be used as an HMAC secret.)r anyr )rA rB Zinvalid_stringsr: r] r; rC s zHMACAlgorithm.prepare_keyc C s t tt| ddS )Noct)kkty)jsondumpsr r decoderJ r: r: r; rL s
zHMACAlgorithm.to_jwkc C sn z.t | trt| }nt | tr(| }ntW n tk
rJ tdY nX |ddkrbtdt|d S )NKey is not valid JSONrb r` zNot an HMAC keyra )
isinstancestrrc loadsdict
ValueErrorr getr )rM objr: r: r; rN s
zHMACAlgorithm.from_jwkc C s t ||| j S rV )hmacnewrX ZdigestrD r: r: r; rF s zHMACAlgorithm.signc C s t || ||S rV )rn Zcompare_digestrF rG r: r: r; rI s zHMACAlgorithm.verifyN)rO rP rQ rR hashlibZsha256r1 Zsha384r2 Zsha512r3 rZ rC rS rL rN rF rI r: r: r: r; r0 s
r0 c @ sZ e Zd ZdZejZejZejZdd Zdd Z e
dd Z e
dd Z d
d Z
d d
ZdS )r6 z~
Performs signing and verification operations using
RSASSA-PKCS-v1_5 and the specified hash function.
c C s
|| _ d S rV rW rY r: r: r; rZ s zRSAAlgorithm.__init__c C s~ t |tst |tr|S t |ttfrrt|}z$|drDt|}n t|d d}W qz t k
rn t
|}Y qzX nt d|S )Nr[ Zpassword Expecting a PEM-formatted key.) rg r r bytesrh r
startswithr" r rk r! TypeErrorr@ r: r: r; rC s
zRSAAlgorithm.prepare_keyc C s d }t | dd r| }ddgt|jj t|jj t|j t|j t|j t|j
t|j t|j d
}nBt | dd r| }ddgt|j t|j d}nt
dt|S )Nprivate_numbersRSArF )
rb key_opsnedpqdpdqqirI )rb rx ry rz Not a public or private key)getattrrv r public_numbersry re rz r{ r| r} dmp1dmq1iqmpr rc rd )rK rm numbersr: r: r; rL s.
zRSAAlgorithm.to_jwkc s z.t | trt| nt | tr(| ntW n tk
rJ tdY nX ddkrbtdd krd krd krd krtd d
d d d
dg} fdd|D }t|}|rt |stdt
t d t d }|r4t t d t d
t d t d t d
t d |d}nHt d }t
|j||j\}}t |||t||t||t|||d}| S d krd krt
t d t d }| S tdd S )Nrf rb rw zNot an RSA keyr{ rz ry Zothz5Unsupported RSA private key: > 2 primes not supportedr| r} r~ r r c s g | ] }| kqS r: r: )r\ Zproprm r: r;
<listcomp>C s z)RSAAlgorithm.from_jwk.<locals>.<listcomp>z@RSA key must include all parameters if any are present besides d)r{ r| r} r r r r r )rg rh rc ri rj rk r rl r_ allr r r r ry rz r r r private_key
public_key) rM Z other_propsZ props_foundZany_props_foundr r r{ r| r} r: r r; rN , sv
zRSAAlgorithm.from_jwkc C s | |t | S rV )rF r PKCS1v15rX rD r: r: r; rF v s zRSAAlgorithm.signc C s: z | ||t | W dS tk
r4 Y dS X d S )NTF)rI r r rX r rG r: r: r; rI y s
zRSAAlgorithm.verifyN)rO rP rQ rR r
r1 r2 r3 rZ rC rS rL rN rF rI r: r: r: r; r6 s
#
Ir6 c @ sN e Zd ZdZejZejZejZdd Zdd Z dd Z
dd Z e d
d Z
d S )
r7 zr
Performs signing and verification operations using
ECDSA and the specified hash function
c C s
|| _ d S rV rW rY r: r: r; rZ s zECAlgorithm.__init__c C s~ t |tst |tr|S t |ttfrrt|}z |drDt|}nt|}W qz t k
rn t
|d d}Y qzX nt d|S )Ns ecdsa-sha2-rq rr ) rg r r rs rh r rt r" r! rk r ru r@ r: r: r; rC s
zECAlgorithm.prepare_keyc C s" | |t| }t||jS rV )rF r ECDSArX r curve)rA rE rB der_sigr: r: r; rF s zECAlgorithm.signc C st zt ||j}W n tk
r& Y dS X z0t|tr<| }|||t| W dS t
k
rn Y dS X d S )NFT) r
r rk rg r r rI r r rX r )rA rE rB rH r r: r: r; rI s
zECAlgorithm.verifyc C s0 z.t | trt| }nt | tr(| }ntW n tk
rJ tdY nX |ddkrbtdd|ksrd|krztdt|d}t|d}|d}|dkrt |t | krd krn n
t
}ntd
n|d kr t |t | krd krn n
t
}ntd
n|dkr`t |t | krHdkrVn n
t
}ntdnP|dkrt |t | krd krn n
t
}ntdntd| t
jtj|ddtj|dd|d}d|kr| S t|d}t |t |krtdt ||t
tj|dd| S )Nrf rb ZECzNot an Elliptic curve keyxycrvzP-256 z)Coords should be 32 bytes for curve P-256zP-3840 z)Coords should be 48 bytes for curve P-384zP-521B z)Coords should be 66 bytes for curve P-521Z secp256k1z-Coords should be 32 bytes for curve secp256k1Invalid curve: Zbig) byteorder)r r r r{ z!D should be {} bytes for curve {})rg rh rc ri rj rk r rl r lenr Z SECP256R1Z SECP384R1Z SECP521R1Z SECP256K1ZEllipticCurvePublicNumbersint
from_bytesr ZEllipticCurvePrivateNumbersr )rM rm r r r Z curve_objr r{ r: r: r; rN sh
$
$
$
zECAlgorithm.from_jwkN)rO rP rQ rR r
r1 r2 r3 rZ rC rF rI rS rN r: r: r: r; r7 s r7 c @ s e Zd ZdZdd Zdd ZdS )r8 zA
Performs a signature using RSASSA-PSS with MGF1
c C s* | |tjt| | jjd| S )NZmgfZ salt_length)rF r PSSMGF1rX digest_sizerD r: r: r; rF s zRSAPSSAlgorithm.signc C sN z2| ||tjt| | jjd| W dS tk
rH Y dS X d S )Nr TF)rI r r r rX r r rG r: r: r; rI
s zRSAPSSAlgorithm.verifyN)rO rP rQ rR rF rI r: r: r: r; r8 s
r8 c @ sH e Zd ZdZdd Zdd Zdd Zdd Zed
d Z ed d
Z
dS )r9 z
Performs signing and verification operations using Ed25519
This class requires ``cryptography>=2.6`` to be installed.
c K s d S rV r: )rA kwargsr: r: r; rZ s zEd25519Algorithm.__init__c C s t |ttfr|S t |ttfrzt |tr4|d}|d}d|krNt|S d|krbt|d dS |dd dkrzt |S t
dd S ) Nutf-8z-----BEGIN PUBLICz-----BEGIN PRIVATErq r zssh-z)Expecting a PEM-formatted or OpenSSH key.) rg r r rs rh encodere r! r r" ru )rA rB Zstr_keyr: r: r; rC # s
z Ed25519Algorithm.prepare_keyc C s$ t |tk rt|dn|}||S )a
Sign a message ``msg`` using the Ed25519 private key ``key``
:param str|bytes msg: Message to sign
:param Ed25519PrivateKey key: A :class:`.Ed25519PrivateKey` instance
:return bytes signature: The signature, as bytes
r )typers rF rD r: r: r; rF 6 s zEd25519Algorithm.signc C sx zXt |tk rt|dn|}t |tk r2t|dn|}t|trH| }||| W dS tjjk
rr Y dS X dS )a
Verify a given ``msg`` against a signature ``sig`` using the Ed25519 key ``key``
:param str|bytes sig: Ed25519 signature to check ``msg`` against
:param str|bytes msg: Message to sign
:param Ed25519PrivateKey|Ed25519PublicKey key: A private or public Ed25519 key instance
:return bool verified: True if signature is valid, False if not.
r TFN) r rs rg r r rI cryptography
exceptionsr rG r: r: r; rI @ s
zEd25519Algorithm.verifyc C s t | tr:| jtjtjd}ttt |
dddS t | t r| j tjt
jt d}| jtjtjd}ttt |
tt |
dddS tdd S )N)encodingformatOKPEd25519)r rb r )r r Zencryption_algorithm)r r{ rb r r )rg r Z public_bytesr ZRawr rc rd r r re r Z
private_bytesr r r r )rB r r{ r: r: r; rL T s:
zEd25519Algorithm.to_jwkc
C s z.t | trt| }nt | tr(| }ntW n tk
rJ tdY nX |ddkrbtd|d}|dkrtd| d|krtd t|d}z.d
|krt
|W S t|d
}t |W S tk
r } ztd |W 5 d }~X Y nX d S ) Nrf rb r zNot an Octet Key Pairr r r r z OKP should have "x" parameterr{ zInvalid key parameter)
rg rh rc ri rj rk r rl r r Zfrom_public_bytesr Zfrom_private_bytes)rM rm r r r{ errr: r: r; rN { s.
zEd25519Algorithm.from_jwkN) rO rP rQ rR rZ rC rF rI rS rL rN r: r: r: r; r9 s
&r9 )7rp rn rc r r Zutilsr r r r r r
r Zcryptography.exceptionsr r Z cryptography.hazmat.primitivesr
Z)cryptography.hazmat.primitives.asymmetricr r Z,cryptography.hazmat.primitives.asymmetric.ecr r Z1cryptography.hazmat.primitives.asymmetric.ed25519r r Z-cryptography.hazmat.primitives.asymmetric.rsar r r r r r r r Z,cryptography.hazmat.primitives.serializationr r r r r r! r" r4 ModuleNotFoundErrorZrequires_cryptographyr< r= r/ r0 r6 r7 r8 r9 r: r: r: r; <module> sN $
(
$
")@ {