⚝
One Hat Cyber Team
⚝
Your IP:
216.73.216.184
Server IP:
97.74.87.16
Server:
Linux 16.87.74.97.host.secureserver.net 5.14.0-503.38.1.el9_5.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Apr 18 08:52:10 EDT 2025 x86_64
Server Software:
Apache
PHP Version:
8.2.28
Buat File
|
Buat Folder
Eksekusi
Dir :
~
/
var
/
opt
/
nydus
/
ops
/
oscrypto
/
_mac
/
__pycache__
/
View File Name :
asymmetric.cpython-39.pyc
a ���g� � @ sL d dl mZmZmZmZ d dlmZ d dlZd dlZd dl Z ddl m Z m Z mZmZmZmZmZmZmZ ddlmZmZmZmZmZmZm Z m Z m Z ddl m Z ddl!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z) d d l*m+Z+m,Z,m-Z-m.Z. d d l/m0Z0m1Z1m2Z2 d d l3m4Z4 dd l5m6Z6m7Z7m8Z8 ddl9m:Z:m;Z;m<Z< ddl=m>Z>m?Z?m@Z@mAZA g d�ZBG dd� de�ZCG dd� de�ZDG dd� de�Z dIdd�ZEdd� ZFdd � ZGd d � ZHdJd d �ZId!d"� ZJd#d$� ZKdKd%d&�ZLdLd'd(�ZMd)d*� ZNd+d,� ZOd-d.� ZPd/d0� ZQd1d2� ZRd3d4� ZSd5d6� ZTd7d8� ZUd9d:� ZVd;d<� ZWd=d>� ZXd?d@� ZYdAdB� ZZdCdD� Z[dEdF� Z\dGdH� Z]dS )M� )�unicode_literals�division�absolute_import�print_function)� b32encodeN� ) � Certificate�ECDomainParameters�Integer�KeyExchangeAlgorithm�Null�PrivateKeyInfo�PublicKeyAlgorithm� PublicKeyInfo� RSAPublicKey) �_CertificateBase� _fingerprint� _parse_pkcs12�_PrivateKeyBase�_PublicKeyBase�_unwrap_private_key_info�parse_certificate� parse_private� parse_public)�pretty_message)�new�unwrap�bytes_from_buffer�buffer_from_bytes�deref�null�is_null� pointer_set� )�Security� SecurityConst�handle_sec_error�osx_version_info)�CoreFoundation� CFHelpers�handle_cf_error)� rand_bytes)�AsymmetricKeyError� IncompleteAsymmetricKeyError�SignatureError)�add_pss_padding�verify_pss_padding�"remove_pkcs1v15_encryption_padding)� type_name�str_cls�byte_cls� int_types)r �dsa_sign� dsa_verify� ecdsa_sign� ecdsa_verify� generate_pair�load_certificate� load_pkcs12�load_private_key�load_public_key� parse_pkcs12� PrivateKey� PublicKey�rsa_oaep_decrypt�rsa_oaep_encrypt�rsa_pkcs1v15_decrypt�rsa_pkcs1v15_encrypt�rsa_pkcs1v15_sign�rsa_pkcs1v15_verify� rsa_pss_sign�rsa_pss_verifyc @ sD e Zd ZdZdZdZdZdd� Zedd� �Z edd� �Z d d � Z dS ) r@ zM Container for the OS crypto library representation of a private key Nc C s || _ || _t| _dS )z� :param sec_key_ref: A Security framework SecKeyRef value from loading/importing the key :param asn1: An asn1crypto.keys.PrivateKeyInfo object N�� sec_key_ref�asn1r( �_lib��selfrK rL � rP �I/opt/nydus/tmp/pip-target-mke_irhy/lib/python/oscrypto/_mac/asymmetric.py�__init__M s zPrivateKey.__init__c C s\ | j du �rVd}�z&ttd�}t�| jddt� |�}t|� t|�}t � |�}t |�}|j dkr�t tdt� d��t|d jd |d jd d ��d ��}n�|j d kr�|d d }t td |�� d��tt|d j|d jj|d j��d ��}n8|j dk�r&t tdtd| jd�d��|d jd d ��}W |�rLt�|� n|�rJt�|� 0 t|�| _ | j S )z\ :return: A PublicKey object corresponding to this private key. N� CFDataRef *r �rsa)� algorithm� parameters� private_key�modulus�public_exponent)rX rY )rU � public_key�dsaZprivate_key_algorithmrV �g�p�ec�named)�name�valuerZ )� _public_keyr r( r$ � SecItemExportrK r r& r r) �cf_data_to_bytesr rU r r r r �parsed�copyr �pow�nativer �curve� CFRelease� _load_key)rO �cf_data_private�cf_data_private_pointer�result�private_key_bytes�keyZ public_asn1�paramsrP rP rQ rZ [ sd � �� � �� �� � � zPrivateKey.public_keyc C s | j du rt | jt�| _ | j S )aY Creates a fingerprint that can be compared with a public key to see if the two form a pair. This fingerprint is not compatible with fingerprints generated by any other software. :return: A byte string that is a sha256 hash of selected components (based on the key type) N)r rL r= �rO rP rP rQ � fingerprint� s zPrivateKey.fingerprintc C s$ | j r | j�| j � d | _d | _ d S �N�rK rM rj rr rP rP rQ �__del__� s zPrivateKey.__del__) �__name__� __module__� __qualname__�__doc__rK rb rM rR �propertyrZ rs rv rP rP rP rQ r@ A s A r@ c @ s( e Zd ZdZdZdZdd� Zdd� ZdS )rA zL Container for the OS crypto library representation of a public key Nc C s || _ || _t| _dS )z� :param sec_key_ref: A Security framework SecKeyRef value from loading/importing the key :param asn1: An asn1crypto.keys.PublicKeyInfo object NrJ rN rP rP rQ rR � s zPublicKey.__init__c C s$ | j r | j�| j � d | _d | _ d S rt ru rr rP rP rQ rv � s zPublicKey.__del__)rw rx ry rz rK rM rR rv rP rP rP rQ rA � s rA c @ sP e Zd ZdZdZdZdZdd� Zedd� �Z edd� �Z ed d � �Z d d � Z dS ) r zM Container for the OS crypto library representation of a certificate Nc C s || _ || _dS )z� :param sec_certificate_ref: A Security framework SecCertificateRef value from loading/importing the certificate :param asn1: An asn1crypto.x509.Certificate object N)�sec_certificate_refrL )rO r| rL rP rP rQ rR � s zCertificate.__init__c C s | j jS )zF :return: The SecKeyRef of the public key )rZ rK rr rP rP rQ rK � s zCertificate.sec_key_refc C s� | j s�| jr�| jjdkrF| j�� }d|d d d d< t|�}|j}n| j}ttd�}t�||�}t |� t |�}t || jd d �| _ | j S )zh :return: The PublicKey object for the public key this certificate contains � rsassa_pssrT �tbs_certificateZsubject_public_key_inforU � SecKeyRef *) rb r| rL �signature_algorf � _load_x509r r$ ZSecCertificateCopyPublicKeyr& r rA )rO rL Z temp_certZ sec_cert_refZsec_public_key_ref_pointer�resZsec_public_key_refrP rP rQ rZ � s zCertificate.public_keyc C s� | j du r�d| _ | jjtddg�v r�| jd j}| jd j}|dkrJt}n8|dkrXt}n*|dkrft}n |d krtt }nt t d |���z,|| j | jd j | jd �� |� d | _ W n ty� Y n0 | j S )zT :return: A boolean - if the certificate is self-signed NF�yes�maybeZsignature_algorithmZrsassa_pkcs1v15r} r[ Zecdsaz� Unable to verify the signature of the certificate since it uses the unsupported algorithm %s Zsignature_valuer~ T)� _self_signedrL � self_signed�setr� � hash_algorG rI r7 r9 �OSErrorr rZ rh �dumpr. )rO r� r� Z verify_funcrP rP rQ r� s8 � � zCertificate.self_signedc C s2 | j r| j �� d | _ | jr.t�| j� d | _d S rt )rb rv r| r( rj rr rP rP rQ rv ; s zCertificate.__del__) rw rx ry rz r| rb r� rR r{ rK rZ r� rv rP rP rP rQ r � s +r c C s� | t g d��vr"ttdt| ����| dkrN|t g d��vr�ttdt|����nT| dkrx|t dg�vr�ttdt|����n*| d kr�|t g d ��vr�ttd t|����d }d }d }d }d }d }d } d } d } �zvtjtjtjd �| } | d kr�dddd �| } n|} tt d�}tt d�}t � d�}d}t d| �}|dd � }t |d d� ��d�}t�� } tj�| |��d�}tt d�}t �|||dt� |�}t|� t|�} tt d�}t �|t� |�}t|� t|�} t �| | | dtjtj tj B tj tj tj B | ||� }t|� t|�}t|�}tt d�}t � |ddt� |�}t|� t|�}t �!|�}tt d�}t � |ddt� |�}t|� t|�}t �!|�}t �"|�}t|� t �"|�}t|� W |�r�t �#|� |�r�t �#|� |�r�t �#|� |�r�t �#|� |�r�t �#|� |�rt �#|� | �r t �$| � t �#| � | �r.t%�&| � | �r�t �#| � n�|�rPt �#|� |�r`t �#|� |�rpt �#|� |�r�t �#|� |�r�t �#|� |�r�t �#|� | �r�t �$| � t �#| � | �r�t%�&| � | �r�t �#| � 0 t'|�t(|�fS )a Generates a public/private key pair :param algorithm: The key algorithm - "rsa", "dsa" or "ec" :param bit_size: An integer - used for "rsa" and "dsa". For "rsa" the value maye be 1024, 2048, 3072 or 4096. For "dsa" the value may be 1024. :param curve: A unicode string - used for "ec" keys. Valid values include "secp256r1", "secp384r1" and "secp521r1". :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A 2-element tuple of (PublicKey, PrivateKey). The contents of each key may be saved by calling .asn1.dump(). )rT r[ r^ zM algorithm must be one of "rsa", "dsa", "ec", not %s rT )� i i � zX bit_size must be one of 1024, 2048, 3072, 4096, not %s r[ r� z? bit_size must be 1024, not %s r^ �Z secp256r1Z secp384r1Z secp521r1zd curve must be one of "secp256r1", "secp384r1", "secp521r1", not %s N)r[ r^ rT � � i r �Temporary oscrypto key� � �utf-8�SecKeychainRef *F�SecAccessRef *r rS ))r� � ValueErrorr �reprr% ZCSSM_ALGID_DSAZCSSM_ALGID_ECDSAZCSSM_ALGID_RSAr r$ r) �cf_string_from_unicoder+ r �decode�tempfile�mkdtemp�os�path�join�encode�SecKeychainCreater r& r �SecAccessCreate�SecKeyCreatePairZCSSM_KEYUSE_VERIFY�CSSM_KEYATTR_EXTRACTABLE�CSSM_KEYATTR_PERMANENTZCSSM_KEYUSE_SIGNr( rc rd �SecKeychainItemDeleterj �SecKeychainDelete�shutil�rmtreer> r= ) rU �bit_sizeri Zcf_dict�public_key_ref�private_key_ref�cf_data_publicrl � cf_string�sec_access_ref�sec_keychain_ref�temp_dirZalg_idZkey_size�private_key_pointer�public_key_pointer�passphrase_len� rand_data� passphrase� temp_filename� temp_path�sec_keychain_ref_pointerrn �sec_access_ref_pointerZcf_data_public_pointerZpublic_key_bytesrm ro rP rP rQ r: E s �������� � � � r: c C s� t | t�s ttdt| ����| dk r,td��| dkr<td��| d dkrPtd��d }d }d }d }d }d }d }d }�z�ttd �} ttd �} t� d �}d } t d | �} | d d � } t | d d � �� d�}t �� }tj�||��d�}ttd�}t�|| | dt� |�}t|� t|�}ttd�}t�|t� |�}t|� t|�}t�|tj| ddtjtj B dtjtj B || | � }t|� t| �}t| �}tt d�}t� |ddt� |�}t|� t|�}t� |�}t� |�}t|� t� |�}t|� t!�"|�d W |�r�t �#|� |�r t �#|� |�r t �#|� |�r,t �#|� |�r<t �#|� |�rVt�$|� t �#|� |�rft%�&|� |�rvt �#|� S |�r�t �#|� |�r�t �#|� |�r�t �#|� |�r�t �#|� |�r�t�$|� t �#|� |�r�t%�&|� |�r�t �#|� n�|�rt �#|� |�rt �#|� |�r$t �#|� |�r4t �#|� |�rDt �#|� |�r^t�$|� t �#|� |�rnt%�&|� |�r~t �#|� 0 d S )a` Generates DH parameters for use with Diffie-Hellman key exchange. Returns a structure in the format of DHParameter defined in PKCS#3, which is also used by the OpenSSL dhparam tool. THIS CAN BE VERY TIME CONSUMING! :param bit_size: The integer bit size of the parameters to generate. Must be between 512 and 4096, and divisible by 64. Recommended secure value as of early 2016 is 2048, with an absolute minimum of 1024. :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: An asn1crypto.algos.DHParameters object. Use oscrypto.asymmetric.dump_dh_parameters() to save to disk for usage with web servers. z= bit_size must be an integer, not %s � z-bit_size must be greater than or equal to 512r� z+bit_size must be less than or equal to 4096�@ r z!bit_size must be a multiple of 64Nr r� r� r� r� r� Fr� rS rV )'� isinstancer5 � TypeErrorr r2 r� r r$ r) r� r+ r r� r� r� r� r� r� r� r� r r& r r� r� r% Z CSSM_ALGID_DHr� r� r( rc rd r� r �loadrj r� r� r� )r� r� r� r� rl r� r� r� r� r� r� r� r� r� r� r� r� rn r� rm ro rP rP rQ �generate_dh_parameters� s� � � � � � r� c C s� t | t�r| }nht | t�r$t| �}nTt | t�rft| d�� }t|�� �}W d � qx1 sZ0 Y nttdt | ����t |�S )a� Loads an x509 certificate into a Certificate object :param source: A byte string of file contents, a unicode string filename or an asn1crypto.x509.Certificate object :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A Certificate object �rbNz� source must be a byte string, unicode string or asn1crypto.x509.Certificate object, not %s ) r� �Asn1Certificater4 r r3 �open�readr� r r2 r� )�source� certificate�frP rP rQ r; s ,�r; c C sV | � � }d}z4t�|�}t�tj|�}t|| �W |r>t�|� S n|rPt�|� 0 dS )z� Loads an ASN.1 object of an x509 certificate into a Certificate object :param certificate: An asn1crypto.x509.Certificate object :return: A Certificate object N) r� r) �cf_data_from_bytesr$ Z SecCertificateCreateWithDatar( ZkCFAllocatorDefaultr rj )r� r� � cf_sourcerK rP rP rQ r� � s � �r� c C s� t | t�r| }n�|durHt |t�r,|�d�}t |t�sHttdt|����t | t�r�t| d��}|� � } W d � q�1 sz0 Y n t | t�s�ttdt| ����t | |�}t |�S )a Loads a private key into a PrivateKey object :param source: A byte string of file contents, a unicode string filename or an asn1crypto.keys.PrivateKeyInfo object :param password: A byte or unicode string to decrypt the private key file. Unicode strings will be encoded using UTF-8. Not used is the source is a PrivateKeyInfo object. :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type oscrypto.errors.AsymmetricKeyError - when the private key is incompatible with the OS crypto library OSError - when an error is returned by the OS crypto library :return: A PrivateKey object Nr� zP password must be a byte string, not %s r� z� source must be a byte string, unicode string or asn1crypto.keys.PrivateKeyInfo object, not %s ) r� r r3 r� r4 r� r r2 r� r� r rk )r� �passwordZprivate_objectr� rP rP rQ r= � s( � ( � r= c C s� t | t�r| }nht | t�r$t| �}nTt | t�rft| d�� }t|�� �}W d � qx1 sZ0 Y nttdt | ����t |�S )a3 Loads a public key into a PublicKey object :param source: A byte string of file contents, a unicode string filename or an asn1crypto.keys.PublicKeyInfo object :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type oscrypto.errors.AsymmetricKeyError - when the public key is incompatible with the OS crypto library OSError - when an error is returned by the OS crypto library :return: A PublicKey object r� Nz� source must be a byte string, unicode string or asn1crypto.keys.PublicKeyInfo object, not %s ) r� r r4 r r3 r� r� r� r r2 rk )r� rZ r� rP rP rQ r> � s ,�r> c C s� | j dkrB| j\}}|dkr$td��|tg d��vr�ttd���nF| j dkrh| jdkrhttd| j���n | j dkr�| jd u r�ttd ���t| t �r�| j d kr�| � � }d |d d < |� � }n| � � }t j }nt| �� � }t j}d }d }d }�z�t�|�}ttd�} t| t j� ttd�} t| |� ttd�} t�tjg�}ttd�} t| �} d| _d| _t � | _ t � | _ t � | _ t � | _ t � | _!|| _"t�#|t � | | d| t � | �}t$|� t| �}t�%|�}|dk�r�t�&|d�}t�'|� |t j k�r"t(|| �W |�r t�)|� |�rt�)|� |�r t�)|� S |t jk�rjt*|| �W |�rHt�)|� |�rXt�)|� |�rht�)|� S W |�r|t�)|� |�r�t�)|� |�r�t�)|� n2|�r�t�)|� |�r�t�)|� |�r�t�)|� 0 d S )aN Common code to load public and private keys into PublicKey and PrivateKey objects :param key_object: An asn1crypto.keys.PublicKeyInfo or asn1crypto.keys.PrivateKeyInfo object :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type oscrypto.errors.AsymmetricKeyError - when the key is incompatible with the OS crypto library OSError - when an error is returned by the OS crypto library :return: A PublicKey or PrivateKey object r^ r_ z-OS X only supports EC keys using named curvesr� z� OS X only supports EC keys using the named curves secp256r1, secp384r1 and secp521r1 r[ Zsha2z� OS X only supports DSA keys based on SHA1 (2048 bits or less) - this key is based on SHA2 and is %s bits Nzz The DSA key does not contain the necessary p, q and g parameters and can not be used r} rT rU z uint32_t *z CFArrayRef *z"SecItemImportExportKeyParameters *r )+rU ri r, r� r r� r� r- r� r rf r� r% ZkSecItemTypePublicKeyr ZkSecItemTypePrivateKeyr) r� r r$ r" ZkSecFormatOpenSSLr( Zcf_array_from_listZkSecAttrIsExtractabler �version�flagsr r� Z alertTitleZ alertPromptZ accessRefZkeyUsageZ keyAttributesZ SecItemImportr& ZCFArrayGetCountZCFArrayGetValueAtIndexZCFRetainrA rj r@ )Z key_objectZ curve_type�detailsZtemp_key_objectr� Z item_typer� Z keys_arrayZ attr_arrayZformat_pointerZ type_pointerZ keys_pointerZ import_export_params_pointerZimport_export_paramsr� �lengthrK rP rP rQ rk s� ��� � � � � � rk c C s t | |t�S )a� Parses a PKCS#12 ANS.1 DER-encoded structure and extracts certs and keys :param data: A byte string of a DER-encoded PKCS#12 file :param password: A byte string of the password to any encrypted data :raises: ValueError - when any of the parameters are of the wrong type or value OSError - when an error is returned by one of the OS decryption functions :return: A three-element tuple of: 1. An asn1crypto.keys.PrivateKeyInfo object 2. An asn1crypto.x509.Certificate object 3. A list of zero or more asn1crypto.x509.Certificate objects that are "extra" certificates, possibly intermediates from the cert chain )r r= )�datar� rP rP rQ r? � s r? c C s� |dur8t |t�r |�d�}t |t�s8ttdt|����t | t�rvt| d��}|�� } W d � q�1 sj0 Y n t | t�s�ttdt| ����t | |�\}}}d}d}|r�t |�}|r�t |�}dd� |D �}|||fS )a� Loads a .p12 or .pfx file into a PrivateKey object and one or more Certificates objects :param source: A byte string of file contents or a unicode string filename :param password: A byte or unicode string to decrypt the PKCS12 file. Unicode strings will be encoded using UTF-8. :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type oscrypto.errors.AsymmetricKeyError - when a contained key is incompatible with the OS crypto library OSError - when an error is returned by the OS crypto library :return: A three-element tuple containing (PrivateKey, Certificate, [Certificate, ...]) Nr� zH password must be a byte string, not %s r� zR source must be a byte string or a unicode string, not %s c S s g | ] }t |��qS rP )r� )�.0�inforP rP rQ � <listcomp>� � z load_pkcs12.<locals>.<listcomp>) r� r3 r� r4 r� r r2 r� r� r? rk r� ) r� r� r� Zkey_infoZ cert_infoZextra_certs_inforp �certZ extra_certsrP rP rQ r< � s2 � ( �r< c C s� t | ttf�s ttdt| ����t |t�s<ttdt|����| j}t|�}t t d|�}t � | j t j|t|�||�}t|� t|t|��S )aF Encrypts a byte string using an RSA public key or certificate. Uses PKCS#1 v1.5 padding. :param certificate_or_public_key: A PublicKey or Certificate object :param data: A byte string, with a maximum length 11 bytes less than the key length (in bytes) :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the encrypted data �� certificate_or_public_key must be an instance of the Certificate or PublicKey class, not %s �< data must be a byte string, not %s �size_t *)r� r rA r� r r2 r4 � byte_sizer r r$ � SecKeyEncryptrK r% �kSecPaddingPKCS1�lenr& r r )�certificate_or_public_keyr� � key_length�buffer� output_lengthrn rP rP rQ rE � s. � � �rE c C s� t | t�s ttdt| ����t |t�s8ttdt|����| j}t|�}tt d|�}t dk rbt j }nt j }t �| j||t|�||�}t|� t|t|��}t dk r�t||�}|S )a� Decrypts a byte string using an RSA private key. Uses PKCS#1 v1.5 padding. :param private_key: A PrivateKey object :param ciphertext: A byte string of the encrypted data :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the original plaintext zV private_key must an instance of the PrivateKey class, not %s r� r� )r� � )r� r@ r� r r2 r4 r� r r r$ r' r% �kSecPaddingNoner� � SecKeyDecryptrK r� r& r r r1 )rW � ciphertextr� r� r� �paddingrn �outputrP rP rQ rD & s: � � � rD c C s t | |tj�S )aZ Encrypts a byte string using an RSA public key or certificate. Uses PKCS#1 OAEP padding with SHA1. :param certificate_or_public_key: A PublicKey or Certificate object :param data: A byte string, with a maximum length 41 bytes (or more) less than the key length (in bytes) :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the encrypted data )�_encryptr$ �kSecPaddingOAEPKey)r� r� rP rP rQ rC d s rC c C s t | |tj�S )a� Decrypts a byte string using an RSA private key. Uses PKCS#1 OAEP padding with SHA1. :param private_key: A PrivateKey object :param ciphertext: A byte string of the encrypted data :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the original plaintext )�_decryptr$ r� )rW r� rP rP rQ rB | s rB c C s( t | ttf�s ttdt| ����t |t�s<ttdt|����|sHtd��d}d}z�t� |�}t t d�}t � | j|�}t|� |r�t �|t j||� t|� t �|t j||� t|� t �||�}t|� t�|�W |r�t �|� |r�t �|� S |�r$t �|� n"|�rt �|� |�r"t �|� 0 dS )a> Encrypts plaintext using an RSA public key or certificate :param certificate_or_public_key: A Certificate or PublicKey object :param data: The plaintext - a byte string :param padding: The padding mode to use, specified as a kSecPadding*Key value :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the ciphertext r� r� �padding must be specifiedN� CFErrorRef *)r� r rA r� r r2 r4 r� r) r� r r( r$ ZSecEncryptTransformCreaterK r* �SecTransformSetAttribute�kSecPaddingKey� kSecTransformInputAttributeName�SecTransformExecuterd rj )r� r� r� �cf_data� sec_transform� error_pointerr� rP rP rQ r� � sj � � ��� � � r� c C s t | t�s ttdt| ����t |t�s8ttdt|����|sDtd��d}d}z�t�|�}t t d�}t � | j |�}t|� t �|t j||� t|� t �|t j||� t|� t �||�}t|� t�|�W |r�t �|� |r�t �|� S |�r t �|� n"|�r t �|� |�rt �|� 0 dS )a Decrypts RSA ciphertext using a private key :param private_key: A PrivateKey object :param ciphertext: The ciphertext - a byte string :param padding: The padding mode to use, specified as a kSecPadding*Key value :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the plaintext �Y private_key must be an instance of the PrivateKey class, not %s zB ciphertext must be a byte string, not %s r� Nr� )r� r@ r� r r2 r4 r� r) r� r r( r$ ZSecDecryptTransformCreaterK r* r� r� r� r� rd rj )rW r� r� r� r� r� � plaintextrP rP rQ r� � sh � � ��� � � r� c C s | j dkrtd��t| |||�S )a� Verifies an RSASSA-PKCS-v1.5 signature. When the hash_algorithm is "raw", the operation is identical to RSA public key decryption. That is: the data is not hashed and no ASN.1 structure with an algorithm identifier of the hash algorithm is placed in the encrypted byte string. :param certificate_or_public_key: A Certificate or PublicKey instance to verify the signature with :param signature: A byte string of the signature to verify :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384", "sha512" or "raw" :raises: oscrypto.errors.SignatureError - when the signature is determined to be invalid ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library rT �*The key specified is not an RSA public key�rU r� �_verify�r� � signaturer� �hash_algorithmrP rP rQ rG 9 s rG c C s� t | ttf�s ttdt| ����t |t�s<ttdt|����| j}|dkrZ|dkrZtd��dddd d d �� |d �}| j }t |�}t t d |�}t �| jtj|t|�||�} t| � t|t|��} t||| j|| �s�td��dS )a� Verifies an RSASSA-PSS signature. For the PSS padding the mask gen algorithm will be mgf1 using the same hash algorithm as the signature. The salt length with be the length of the hash algorithm, and the trailer field with be the standard 0xBC byte. :param certificate_or_public_key: A Certificate or PublicKey instance to verify the signature with :param signature: A byte string of the signature to verify :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384" or "sha512" :raises: oscrypto.errors.SignatureError - when the signature is determined to be invalid ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library r� r� rT r} r� � � � �0 r� ��sha1�sha224�sha256�sha384�sha512r r� �Signature is invalidN)r� r rA r� r r2 r4 rU r� �getr� r r r$ r� rK r% r� r� r& r r r0 r� r. ) r� r� r� r� Zcp_algo� hash_lengthr� r� r� rn r� rP rP rQ rI [ sH � ��� �rI c C s | j dkrtd��t| |||�S )a� Verifies a DSA signature :param certificate_or_public_key: A Certificate or PublicKey instance to verify the signature with :param signature: A byte string of the signature to verify :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384" or "sha512" :raises: oscrypto.errors.SignatureError - when the signature is determined to be invalid ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library r[ z)The key specified is not a DSA public keyr� r� rP rP rQ r7 � s r7 c C s | j dkrtd��t| |||�S )a� Verifies an ECDSA signature :param certificate_or_public_key: A Certificate or PublicKey instance to verify the signature with :param signature: A byte string of the signature to verify :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384" or "sha512" :raises: oscrypto.errors.SignatureError - when the signature is determined to be invalid ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library r^ z)The key specified is not an EC public keyr� r� rP rP rQ r9 � s r9 c C s t | ttf�s ttdt| ����t |t�s<ttdt|����t |t�sXttdt|����tg d��}| jdkr||tdg�O }||vr�d}| jdkr�|d7 }t td |t |����| jdk�r8|dk�r8t |�| j d kr�t td | j t |����t �| jtj|t |�|t |��}|tjk�s$|tjk�r,td ��t|� d S d }d }d } d } �z�ttd�} t�|�}t �| j|| �} t| � t j t j t j t j t j t j d�| } t � | t j | | � t| � |tg d��v �r�ddddd�| } t�!| �} t � | t j"| | � t| � | jdk�r$t � | t j#t j$| � t| � t�|�}t � | t j%|| � t| � t �&| | �}t'| ��sxt(| �}t'|��sxtd ��t)t�*|��}|�s�td ��W | �r�t�+| � |�r�t�+|� |�r�t�+|� | �rt�+| � nB| �r�t�+| � |�r�t�+|� |�rt�+|� | �rt�+| � 0 d S )a� Verifies an RSA, DSA or ECDSA signature :param certificate_or_public_key: A Certificate or PublicKey instance to verify the signature with :param signature: A byte string of the signature to verify :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384" or "sha512" :raises: oscrypto.errors.SignatureError - when the signature is determined to be invalid ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library r� zA signature must be a byte string, not %s r� ��md5r� r� r r r rT �raw�5"md5", "sha1", "sha224", "sha256", "sha384", "sha512"�, "raw"�B hash_algorithm must be one of %s, not %s � z� data must be 11 bytes shorter than the key size when hash_algorithm is "raw" - key size is %s bytes, but data is %s bytes long r Nr� �r� r r r �� r� r� r� ),r� r rA r� r r2 r4 r� rU r� r� r� r� r$ ZSecKeyRawVerifyrK r% r� ZerrSecVerifyFailedZ errSSLCryptor. r& r r( r) r� ZSecVerifyTransformCreater* � kSecDigestMD5�kSecDigestSHA1�kSecDigestSHA2r� �kSecDigestTypeAttribute�cf_number_from_integer�kSecDigestLengthAttributer� �kSecPaddingPKCS1Keyr� r� r! r �boolZCFBooleanGetValuerj )r� r� r� r� �valid_hash_algorithms�valid_hash_algorithms_errorrn � cf_signaturer� �cf_hash_lengthr� r� � hash_constantr r� �errorrP rP rQ r� � s � � � �� � ��� ��� � � � � r� c C s | j dkrtd��t| ||�S )a^ Generates an RSASSA-PKCS-v1.5 signature. When the hash_algorithm is "raw", the operation is identical to RSA private key encryption. That is: the data is not hashed and no ASN.1 structure with an algorithm identifier of the hash algorithm is placed in the encrypted byte string. :param private_key: The PrivateKey to generate the signature with :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384", "sha512" or "raw" :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the signature rT �+The key specified is not an RSA private key�rU r� �_sign�rW r� r� rP rP rQ rF � s rF c C s� t | t�s ttdt| ����t |t�s8ttdt|����| j}|dkrV|dkrVtd��dddd d d ��|d �}t ||| j |�}| j }t |�}t td |�}t�| jtj|t|�||�} t| � t|t|��S )a6 Generates an RSASSA-PSS signature. For the PSS padding the mask gen algorithm will be mgf1 using the same hash algorithm as the signature. The salt length with be the length of the hash algorithm, and the trailer field with be the standard 0xBC byte. :param private_key: The PrivateKey to generate the signature with :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384" or "sha512" :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the signature r� r� rT r} r r� r� r� r� r� r� r r� )r� r@ r� r r2 r4 rU r� r r/ r� r� r r r$ r� rK r% r� r� r& r r ) rW r� r� Zpk_algor Z encoded_datar� r� r� rn rP rP rQ rH � sF � ��� �rH c C s | j dkrtd��t| ||�S )aI Generates a DSA signature :param private_key: The PrivateKey to generate the signature with :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384" or "sha512" :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the signature r[ z*The key specified is not a DSA private keyr r rP rP rQ r6 � s r6 c C s | j dkrtd��t| ||�S )aL Generates an ECDSA signature :param private_key: The PrivateKey to generate the signature with :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384" or "sha512" :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the signature r^ z*The key specified is not an EC private keyr r rP rP rQ r8 s r8 c C s� t | t�s ttdt| ����t |t�s8ttdt|����tg d��}| jdkr\|tdg�O }||vr�d}| jdkrz|d7 }ttd|t |����| jdk�r|dk�rt |�| j d kr�ttd | j t |����| j }t |�}t td |�}t�| jtj|t |�||�}t|� t|t|��S d } d } d } d } �z�t td �} t�| j| �} t| � tjtjtjtjtjtjd�| }t� | tj || � t| � |tg d��v �r�ddddd�| }t � |�} t� | tj | | � t| � | jdk�r�t� | tj!tj"| � t| � t �#|�} t� | tj$| | � t| � t�%| | �} t| � t �&| �W | �rJt�'| � | �rZt�'| � | �rjt�'| � | �rzt�'| � S | �r�t�'| � | �r�t�'| � | �r�t�'| � nB| �r�t�'| � | �r�t�'| � | �r�t�'| � | �r�t�'| � 0 d S )aX Generates an RSA, DSA or ECDSA signature :param private_key: The PrivateKey to generate the signature with :param data: A byte string of the data the signature is for :param hash_algorithm: A unicode string of "md5", "sha1", "sha224", "sha256", "sha384" or "sha512" :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the signature zO private_key must be an instance of PrivateKey, not %s r� r rT r r r r r z� data must be 11 bytes shorter than the key size when hash_algorithm is "raw" - key size is %s bytes, but data is %s bytes long r� Nr� r r r� r� r� )(r� r@ r� r r2 r4 r� rU r� r� r� r� r r r$ Z SecKeyRawSignrK r% r� r& r r r( ZSecSignTransformCreater* r r r r� r r) r r r� r r� r� r� rd rj )rW r� r� r r r� r� r� rn r r� r r� r� r r rP rP rQ r 6 s� � � �� � �� ��� � � � � � r )NN)N)N)N)^� __future__r r r r �base64r r� r� r� Z_asn1r r� r r r r r r r r Z _asymmetricr r r r r r r r r �_errorsr Z_ffir r r r r r r! r" Z _securityr$ r% r& r' Z_core_foundationr( r) r* �utilr+ �errorsr, r- r. Z_pkcs1r/ r0 r1 �_typesr2 r3 r4 r5 �__all__r@ rA r: r� r; r� r= r> rk r? r< rE rD rC rB r� r� rG rI r7 r9 r� rF rH r6 r8 r rP rP rP rQ �<module> s\ , , ( u o 5 ' 8(| =6>TR"I 5"H