관리-도구
편집 파일: backend.cpython-39.pyc
a ope�X � @ sz d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZmZ d dl m Z m Z d dl m Z d dlmZ d dlmZ d dlmZ d d lmZmZmZmZ d d lmZm Z m Z d d l m Z m Z d d l!m"Z"m#Z# d d l$m%Z%m&Z&m'Z' d dl(m)Z) d dl*m+Z+ d dl,m-Z-m.Z. d dl/m0Z0m1Z1 d dl2m3Z3m4Z4 d dl5m6Z6m7Z7 d dl8mZ9 d dl:m;Z; d dl<m=Z=m>Z> d dl?m@Z@mAZAmBZBmCZCmDZD d dlEmFZFmGZGmHZHmIZI d dlJmKZKmLZLmMZMmNZNmOZOmPZPmQZQmRZRmSZSmTZT d dlUmVZVmWZWmXZXmYZYmZZZm[Z[m\Z\m]Z] d dl^m_Z_ d d l`maZambZb d d lcmdZdmeZe d d lfmgZg e �hd d d!g�ZiG d"d#� d#ej�ZkG d$d%� d%e�Z G d&d'� d'ej�Zld(d)� Zme � ZndS )*� N)�contextmanager)�utils�x509)�UnsupportedAlgorithm�_Reasons)�Backend)�aead)�_CipherContext�� _CMACContext)� _DHParameters� _DHPrivateKey� _DHPublicKey�_dh_params_dup)�_DSAParameters�_DSAPrivateKey� _DSAPublicKey)�_EllipticCurvePrivateKey�_EllipticCurvePublicKey)�_Ed25519PrivateKey�_Ed25519PublicKey)�_ED448_KEY_SIZE�_Ed448PrivateKey�_Ed448PublicKey�� _HashContext�� _HMACContext)�_POLY1305_KEY_SIZE�_Poly1305Context)�_RSAPrivateKey� _RSAPublicKey)�_X25519PrivateKey�_X25519PublicKey)�_X448PrivateKey�_X448PublicKey)r )�binding)�hashes� serialization)�dh�dsa�ec�ed25519�rsa)�MGF1�OAEP�PKCS1v15�PSS) �AES�ARC4�Blowfish�CAST5�Camellia�ChaCha20�IDEA�SEED�SM4� TripleDES)�CBC�CFB�CFB8�CTR�ECB�GCM�OFB�XTS)�scrypt)�pkcs7�ssh)�PKCS12Certificate�PKCS12KeyAndCertificates)�PUBLIC_KEY_TYPES� _MemoryBIO�bioZchar_ptrc @ s e Zd ZdS )�_RC2N)�__name__� __module__� __qualname__� rP rP �R/usr/lib64/python3.9/site-packages/cryptography/hazmat/backends/openssl/backend.pyrL r s rL c @ s� e Zd ZdZdZh d�ZefZej ej ej ej ej ejejejejejejejf ZejejejejfZdZ dZ dd> Z dZ de > Z dd� Z!d d � Z"�d d d �Z#dd� Z$dd� Z%dd� Z&e'j(dd� �Z)dd� Z*dd� Z+dd� Z,d d � Z-d d � Z.d d!� Z/d"d#� Z0d$d%� Z1d&d'� Z2d(d)� Z3d*d+� Z4d,d-� Z5d.d/� Z6d0d1� Z7d2d3� Z8d4d5� Z9d6d7� Z:d8d9� Z;d:d;� Z<d<d=� Z=d>d?� Z>�d d@dA�Z?dBdC� Z@dDdE� ZAdFdG� ZBdHdI� ZCdJdK� ZDdLdM� ZEdNdO� ZFdPdQ� ZGdRdS� ZHdTdU� ZIdVdW� ZJdXdY� ZKdZd[� ZLd\d]� ZMd^d_� ZNd`da� ZOdbdc� ZPddde� ZQdfdg� ZRdhdi� ZSdjdk� ZTeUdl�dmdn�ZVejWeUdo�dpdq�ZXdrds� ZYdtdu� ZZdvdw� Z[dxdy� Z\dzd{� Z]d|d}� Z^d~d� Z_d�d�� Z`d�d�� Zad�d�� Zbecjdeejfd��d�d��Zgeejfecjdd��d�d��Zhecjieejfd��d�d��Zjeejfecjid��d�d��Zkecjleejfd��d�d��Zmeejfecjld��d�d��ZnecjleoeUd��d�d��ZpecjieUd��d�d��Zqd�d�� Zrd�d�� Zsd�d�� Ztd�d�� Zud�d�� Zvd�d�� Zwd�d�� Zxd�d�� Zyd�d�� Zzd�d�� Z{d�d�� Z|d�d�� Z}d�d�� Z~d�d�� Zd�d�� Z�e(d�d�� �Z�d�d�� Z�d�d�� Z�d�d Z�d�dĄ Z�d�dƄ Z�d�dȄ Z�d�dʄ Z�d�d̄ Z�d�d΄ Z�d�dЄ Z�d�d҄ Z�d�dԄ Z�d�dք Z�d�d Z�d�dڄ Z��d!d�d܄Z�d�dބ Z�d�d� Z�d�d� Z�d�d� Z�d�d� Z�d�d� Z�d�d� Z�d�d� Z�d�d� Z�d�d� Z�d�d� Z�d�d� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d��d � Z��d�d� Z��d�d� Z�e'j(�d�d� �Z��d�d� Z�e'j(�d �d � �Z��d �d � Z��d �d� Z��d�d� Z��d�d� Z��d�d� Z��d�d� Z��d�d� Z��d�d� Z��d�d � Z��d �d � Z�d S (" r z) OpenSSL API binding interfaces. Zopenssl> s aes-256-gcms aes-256-ccms aes-128-ccms aes-192-gcms aes-192-ccms aes-128-gcm� i � c C s� t �� | _| jj| _| jj| _d| _| �� | _ i | _ | � � | j rX| jj rXt �dt� n| �� | jjg| _| jjr�| j�| jj� d S )NFz<OpenSSL FIPS mode is enabled. Can't enable DRBG fork safety.)r& ZBinding�_bindingZffi�_ffi�lib�_lib�_rsa_skip_check_key�_is_fips_enabled� _fips_enabled�_cipher_registry�_register_default_ciphers�"CRYPTOGRAPHY_NEEDS_OSRANDOM_ENGINE�warnings�warn� UserWarning�activate_osrandom_engineZ EVP_PKEY_DH� _dh_types� Cryptography_HAS_EVP_PKEY_DHX�appendZ EVP_PKEY_DHX��selfrP rP rQ �__init__� s � zBackend.__init__c C s d� | �� | j�S )Nz'<OpenSSLBackend(version: {}, FIPS: {})>)�format�openssl_version_textrZ re rP rP rQ �__repr__� s �zBackend.__repr__Nc C s t j| j||d�S )N)�errors)r& Z_openssl_assertrW )rf �okrk rP rP rQ �openssl_assert� s zBackend.openssl_assertc C sH | j jr| j �| jj�}nt| j ddd� �� }|dkr@| j �� t|�S )NZ FIPS_modec S s dS �Nr rP rP rP rP rQ �<lambda>� � z*Backend._is_fips_enabled.<locals>.<lambda>r )rW ZCryptography_HAS_300_FIPSZ&EVP_default_properties_is_fips_enabledrU �NULL�getattrZERR_clear_error�bool)rf �moderP rP rQ rY � s � zBackend._is_fips_enabledc C s$ | j �� | �� sJ �| �� | _d S �N)rT � _enable_fipsrY rZ re rP rP rQ rv � s zBackend._enable_fipsc C sf | j jrb| j �� }|| jjkrb| j �|� | j �| jj�}| �|dk� | j �|�}| �|dk� d S �NrS ) rW r] ZENGINE_get_default_RANDrU rq ZENGINE_unregister_RAND�RAND_set_rand_methodrm � ENGINE_finish�rf �e�resrP rP rQ �activate_builtin_random� s z Backend.activate_builtin_randomc c s� | j �| j j�}| �|| jjk� | j �|�}| �|dk� z>|V W | j �|�}| �|dk� | j �|�}| �|dk� n6| j �|�}| �|dk� | j �|�}| �|dk� 0 d S rw ) rW Z ENGINE_by_idZ Cryptography_osrandom_engine_idrm rU rq Z ENGINE_initZ ENGINE_freery rz rP rP rQ �_get_osurandom_engine� s � z Backend._get_osurandom_enginec C st | j jrp| �� | �� �*}| j �|�}| �|dk� W d � n1 sH0 Y | j �| jj�}| �|dk� d S rw ) rW r] r} r~ ZENGINE_set_default_RANDrm rx rU rq rz rP rP rQ ra � s ,z Backend.activate_osrandom_enginec C st | j �dd�}| �� �<}| j�|dt|�|| j jd�}| �|dk� W d � n1 sX0 Y | j �|�� d�S )N�char[]�@ s get_implementationr �ascii) rU �newr~ rW ZENGINE_ctrl_cmd�lenrq rm �string�decode)rf �bufr{ r| rP rP rQ � osrandom_engine_implementation s �,z&Backend.osrandom_engine_implementationc C s | j �| j�| jj���d�S )z� Friendly string name of the loaded OpenSSL library. This is not necessarily the same version as it was compiled against. Example: OpenSSL 1.1.1d 10 Sep 2019 r� )rU r� rW ZOpenSSL_versionZOPENSSL_VERSIONr� re rP rP rQ ri s ��z Backend.openssl_version_textc C s | j �� S ru )rW ZOpenSSL_version_numre rP rP rQ �openssl_version_number s z Backend.openssl_version_numberc C s t | ||�S ru r )rf �key� algorithmrP rP rQ �create_hmac_ctx s zBackend.create_hmac_ctxc C sL |j dks|j dkr0d�|j |jd ��d�}n |j �d�}| j�|�}|S )NZblake2bZblake2sz{}{}� r� )�namerh � digest_size�encoderW ZEVP_get_digestbyname)rf r� Zalg�evp_mdrP rP rQ �_evp_md_from_algorithm s �� z Backend._evp_md_from_algorithmc C s | � |�}| �|| jjk� |S ru )r� rm rU rq �rf r� r� rP rP rQ � _evp_md_non_null_from_algorithm* s z'Backend._evp_md_non_null_from_algorithmc C s, | j rt|| j�sdS | �|�}|| jjkS �NF)rZ � isinstance� _fips_hashesr� rU rq r� rP rP rQ �hash_supported/ s zBackend.hash_supportedc C s | j r dS | jjdkS d S �NFrS )rZ rW ZCryptography_HAS_SCRYPTre rP rP rQ �scrypt_supported6 s zBackend.scrypt_supportedc C s | j rt|tj�rdS | �|�S �NT)rZ r� r' �SHA1r� �rf r� rP rP rQ �hmac_supported< s zBackend.hmac_supportedc C s t | |�S ru r r� rP rP rQ �create_hash_ctxC s zBackend.create_hash_ctxc C s^ | j rt|| j�sdS z| jt|�t|�f }W n tyD Y dS 0 || ||�}| jj|kS r� )rZ r� � _fips_ciphersr[ �type�KeyErrorrU rq )rf �cipherrt �adapter� evp_cipherrP rP rQ �cipher_supportedF s zBackend.cipher_supportedc C s0 ||f| j v r td�||���|| j ||f< d S )Nz"Duplicate registration for: {} {}.)r[ � ValueErrorrh )rf � cipher_cls�mode_clsr� rP rP rQ �register_cipher_adapterT s ��z Backend.register_cipher_adapterc C s~ t ttttttfD ]}| �t|t d�� qt ttttfD ]}| �t |t d�� q8t tttfD ]}| �t |t d�� q\| �t tt d�� t tttfD ]}| �t |t d�� q�t tttfD ]}| �t |t d�� q�t�ttgt tttg�D ]\}}| �||t d�� q�| �ttd �t d�� | �ttd �t d�� | �ttd �t d �� | �ttt� tt tttfD ]}| �t|t d �� �q`d S ) Nz+{cipher.name}-{cipher.key_size}-{mode.name}zdes-ede3-{mode.name}zdes-ede3zbf-{mode.name}zseed-{mode.name}z{cipher.name}-{mode.name}Zrc4Zrc2Zchacha20zsm4-{mode.name})r< r? r@ rB r= r> rA r� r2 �GetCipherByNamer6 r; r4 r9 � itertools�productr5 r8 r3 r� rL r7 rC �_get_xts_cipherr: )rf r� r� rP rP rQ r\ ] s\ �� � � � � � �� �z!Backend._register_default_ciphersc C s t | ||t j�S ru )r Z_ENCRYPT�rf r� rt rP rP rQ � create_symmetric_encryption_ctx� s z'Backend.create_symmetric_encryption_ctxc C s t | ||t j�S ru )r Z_DECRYPTr� rP rP rQ � create_symmetric_decryption_ctx� s z'Backend.create_symmetric_decryption_ctxc C s | � |�S ru )r� r� rP rP rQ �pbkdf2_hmac_supported� s z Backend.pbkdf2_hmac_supportedc C sh | j �d|�}| �|�}| j �|�}| j�|t|�|t|�||||�} | �| dk� | j �|�d d � S )N�unsigned char[]rS ) rU r� r� � from_bufferrW ZPKCS5_PBKDF2_HMACr� rm �buffer) rf r� �length�saltZ iterations� key_materialr� r� �key_material_ptrr| rP rP rQ �derive_pbkdf2_hmac� s � zBackend.derive_pbkdf2_hmacc C s t �| j�S ru )r& �_consume_errorsrW re rP rP rQ r� � s zBackend._consume_errorsc C s t �| j�S ru )r& �_consume_errors_with_textrW re rP rP rQ r� � s z!Backend._consume_errors_with_textc C sz || j jksJ �| �| j�|� � | j�|�}| j �d|�}| j�||�}| �|dk� t� | j � |�d |� d�}|S )Nr� r �big) rU rq rm rW ZBN_is_negativeZ BN_num_bytesr� Z BN_bn2bin�int� from_bytesr� )rf �bnZ bn_num_bytesZbin_ptrZbin_len�valrP rP rQ � _bn_to_int� s zBackend._bn_to_intc C sn |du s|| j jksJ �|du r(| j j}|�t|�� d d �d�}| j�|t|�|�}| �|| j jk� |S )a Converts a python integer to a BIGNUM. The returned BIGNUM will not be garbage collected (to support adding them to structs that take ownership of the object). Be sure to register it for GC if it will be discarded after use. Ng @rS r� ) rU rq �to_bytesr� � bit_lengthrW Z BN_bin2bnr� rm )rf �numr� ZbinaryZbn_ptrrP rP rQ � _int_to_bn� s zBackend._int_to_bnc C s� t �||� | j�� }| �|| jjk� | j�|| jj�}| � |�}| j�|| jj �}| j� |||| jj�}| �|dk� | � |�}t | ||| j�S rw )r- Z_verify_rsa_parametersrW �RSA_newrm rU rq �gc�RSA_freer� �BN_freeZRSA_generate_key_ex�_rsa_cdata_to_evp_pkeyr rX )rf �public_exponent�key_size� rsa_cdatar� r| �evp_pkeyrP rP rQ �generate_rsa_private_key� s � �z Backend.generate_rsa_private_keyc C s |dko|d@ dko|dkS )N� rS r i rP )rf r� r� rP rP rQ �!generate_rsa_parameters_supported� s ��z)Backend.generate_rsa_parameters_supportedc C s6 t �|j|j|j|j|j|j|jj |jj � | j � � }| � || jjk� | j�|| j j�}| �|j�}| �|j�}| �|j�}| �|j�}| �|j�}| �|j�}| �|jj �} | �|jj �} | j �|||�} | � | dk� | j �|| | |�} | � | dk� | j �||||�} | � | dk� | �|�} t| || | j�S rw )r- Z _check_private_key_components�p�q�d�dmp1�dmq1�iqmp�public_numbersr{ �nrW r� rm rU rq r� r� r� ZRSA_set0_factors� RSA_set0_keyZRSA_set0_crt_paramsr� r rX ) rf �numbersr� r� r� r� r� r� r� r{ r� r| r� rP rP rQ �load_rsa_private_numbers� s> � �z Backend.load_rsa_private_numbersc C s� t �|j|j� | j�� }| �|| jjk� | j� || jj �}| � |j�}| � |j�}| j� |||| jj�}| �|dk� | � |�}t| ||�S rw )r- Z _check_public_key_componentsr{ r� rW r� rm rU rq r� r� r� r� r� r! )rf r� r� r{ r� r| r� rP rP rQ �load_rsa_public_numbers s z Backend.load_rsa_public_numbersc C s2 | j �� }| �|| jjk� | j�|| j j�}|S ru )rW Z EVP_PKEY_newrm rU rq r� � EVP_PKEY_free�rf r� rP rP rQ �_create_evp_pkey_gc s zBackend._create_evp_pkey_gcc C s( | � � }| j�||�}| �|dk� |S rw )r� rW ZEVP_PKEY_set1_RSArm )rf r� r� r| rP rP rQ r� s z Backend._rsa_cdata_to_evp_pkeyc C sH | j �|�}| j�|t|��}| �|| j jk� t| j �|| jj �|�S )z� Return a _MemoryBIO namedtuple of (BIO, char*). The char* is the storage for the BIO and it must stay alive until the BIO is finished with. ) rU r� rW ZBIO_new_mem_bufr� rm rq rJ r� �BIO_free)rf �data�data_ptrrK rP rP rQ � _bytes_to_bio# s zBackend._bytes_to_bioc C sP | j �� }| �|| jjk� | j �|�}| �|| jjk� | j�|| j j�}|S )z. Creates an empty memory BIO. )rW Z BIO_s_memrm rU rq ZBIO_newr� r� )rf Z bio_methodrK rP rP rQ �_create_mem_bio_gc0 s zBackend._create_mem_bio_gcc C s\ | j �d�}| j�||�}| �|dk� | �|d | j jk� | j �|d |�dd� }|S )zE Reads a memory BIO. This only works on memory BIOs. zchar **r N)rU r� rW ZBIO_get_mem_datarm rq r� )rf rK r� Zbuf_len�bio_datarP rP rQ � _read_mem_bio; s zBackend._read_mem_bioc C s� | j �|�}|| j jkrX| j �|�}| �|| jjk� | j�|| j j�}t | ||| j �S || j j kr�| j � |�}| �|| jjk� | j�|| j j �}t| ||�S || j jkr�| j �|�}| �|| jjk� | j�|| j j�}t| ||�S || jv �r0| j �|�}| �|| jjk� | j�|| j j�}t| ||�S |t| j dd�k�rNt| |�S |t| j dd�k�rlt| |�S |t| j dd�k�r�t| |�S |t| j dd�k�r�t| |�S t d��dS )zd Return the appropriate type of PrivateKey given an evp_pkey cdata pointer. �EVP_PKEY_ED25519N� EVP_PKEY_X448�EVP_PKEY_X25519�EVP_PKEY_ED448�Unsupported key type.) rW � EVP_PKEY_id� EVP_PKEY_RSA�EVP_PKEY_get1_RSArm rU rq r� r� r rX � EVP_PKEY_DSA�EVP_PKEY_get1_DSA�DSA_freer � EVP_PKEY_EC�EVP_PKEY_get1_EC_KEY� EC_KEY_freer rb �EVP_PKEY_get1_DH�DH_freer rr r r$ r" r r �rf r� �key_typer� � dsa_cdata�ec_cdata�dh_cdatarP rP rQ �_evp_pkey_to_private_keyF s@ � z Backend._evp_pkey_to_private_keyc C s� | j �|�}|| j jkrT| j �|�}| �|| jjk� | j�|| j j�}t | ||�S || j j kr�| j � |�}| �|| jjk� | j�|| j j �}t | ||�S || j jkr�| j �|�}| �|| jjk� | j�|| j j�}t| ||�S || jv �r,| j �|�}| �|| jjk� | j�|| j j�}t| ||�S |t| j dd�k�rJt| |�S |t| j dd�k�rht| |�S |t| j dd�k�r�t| |�S |t| j dd�k�r�t| |�S td��dS )zc Return the appropriate type of PublicKey given an evp_pkey cdata pointer. r� Nr� r� r� r� ) rW r� r� r� rm rU rq r� r� r! r� r� r� r r� r� r� r rb r� r� r rr r r% r# r r r� rP rP rQ �_evp_pkey_to_public_keys s< z Backend._evp_pkey_to_public_keyc C s6 | j jr&t|tjtjtjtjtjf�S t|tj�S d S ru ) rW Z Cryptography_HAS_RSA_OAEP_MDr� r' r� �SHA224�SHA256�SHA384�SHA512r� rP rP rQ �_oaep_hash_supported� s �� z Backend._oaep_hash_supportedc C s� t |t�rdS t |t�rNt |jt�rN| jr>t |jjtj�r>dS | � |jj�S nXt |t �r�t |jt�r�| � |jj�o�| � |j�o�|j d u p�t |j �dkp�| jjdkS dS d S )NTr rS F)r� r0 r1 Z_mgfr. rZ Z _algorithmr' r� r� r/ r Z_labelr� rW Z Cryptography_HAS_RSA_OAEP_LABEL)rf ZpaddingrP rP rQ �rsa_padding_supported� s � � � z Backend.rsa_padding_supportedc C s~ |dvrt d��| j�� }| �|| jjk� | j�|| jj�}| j�||| jjd| jj| jj| jj�}| �|dk� t | |�S )N)i rR i i z0Key size must be 1024, 2048, 3072, or 4096 bits.r rS ) r� rW �DSA_newrm rU rq r� r� ZDSA_generate_parameters_exr )rf r� �ctxr| rP rP rQ �generate_dsa_parameters� s$ � � z Backend.generate_dsa_parametersc C sT | j �|j�}| �|| jjk� | j�|| j j�}| j �|� | � |�}t | ||�S ru ) rW Z DSAparams_dupZ _dsa_cdatarm rU rq r� r� ZDSA_generate_key�_dsa_cdata_to_evp_pkeyr )rf � parametersr r� rP rP rQ �generate_dsa_private_key� s z Backend.generate_dsa_private_keyc C s | � |�}| �|�S ru )r r )rf r� r rP rP rQ �'generate_dsa_private_key_and_parameters� s z/Backend.generate_dsa_private_key_and_parametersc C sB | j �||||�}| �|dk� | j �|||�}| �|dk� d S rw )rW � DSA_set0_pqgrm Z DSA_set0_key)rf r� r� r� �g�pub_key�priv_keyr| rP rP rQ �_dsa_cdata_set_values� s z Backend._dsa_cdata_set_valuesc C s� t �|� |jj}| j�� }| �|| jjk� | j� || jj �}| � |j �}| � |j �}| � |j�}| � |jj�}| � |j�}| �||||||� | �|�} t| || �S ru )r* Z_check_dsa_private_numbersr� �parameter_numbersrW r rm rU rq r� r� r� r� r� r �y�xr r r ) rf r� r r� r� r� r r r r� rP rP rQ �load_dsa_private_numbers� s z Backend.load_dsa_private_numbersc C s� t �|j� | j�� }| �|| jjk� | j�|| jj �}| � |jj �}| � |jj �}| � |jj �}| � |j�}| jj}| �||||||� | �|�}t| ||�S ru )r* �_check_dsa_parametersr rW r rm rU rq r� r� r� r� r� r r r r r ) rf r� r� r� r� r r r r� rP rP rQ �load_dsa_public_numbers s z Backend.load_dsa_public_numbersc C s� t �|� | j�� }| �|| jjk� | j�|| jj�}| � |j �}| � |j �}| � |j �}| j� ||||�}| �|dk� t| |�S rw )r* r rW r rm rU rq r� r� r� r� r� r r r )rf r� r� r� r� r r| rP rP rQ �load_dsa_parameter_numbers s z"Backend.load_dsa_parameter_numbersc C s( | � � }| j�||�}| �|dk� |S rw )r� rW ZEVP_PKEY_set1_DSArm )rf r� r� r| rP rP rQ r ! s z Backend._dsa_cdata_to_evp_pkey)�returnc C s | j S ru )rZ re rP rP rQ � dsa_supported' s zBackend.dsa_supported)r� r c C s | � � s dS | �|�S r� )r r� r� rP rP rQ �dsa_hash_supported* s zBackend.dsa_hash_supportedc C s dS r� rP )rf r� r� r rP rP rQ �dsa_parameters_supported/ s z Backend.dsa_parameters_supportedc C s | � |td|j ��S )N� )r� r< � block_sizer� rP rP rQ �cmac_algorithm_supported2 s �z Backend.cmac_algorithm_supportedc C s t | |�S ru r r� rP rP rQ �create_cmac_ctx7 s zBackend.create_cmac_ctxc C s | � | jj| j||�S ru )� _load_keyrW ZPEM_read_bio_PrivateKeyr� )rf r� �passwordrP rP rQ �load_pem_private_key: s �z Backend.load_pem_private_keyc C s� | � |�}| j�|j| jj| jj| jj�}|| jjkrR| j�|| jj�}| �|�S | � � | j� |j�}| � |dk� | j� |j| jj| jj| jj�}|| jjkr�| j�|| jj �}| �|�}t| ||�S | �� d S rw )r� rW ZPEM_read_bio_PUBKEYrK rU rq r� r� r� r� � BIO_resetrm ZPEM_read_bio_RSAPublicKeyr� r� r! �_handle_key_loading_error�rf r� �mem_bior� r| r� rP rP rQ �load_pem_public_keyB s$ � � zBackend.load_pem_public_keyc C s^ | � |�}| j�|j| jj| jj| jj�}|| jjkrR| j�|| jj�}t| |�S | � � d S ru ) r� rW ZPEM_read_bio_DHparamsrK rU rq r� r� r r$ )rf r� r& r� rP rP rQ �load_pem_parameters[ s � zBackend.load_pem_parametersc C s> | � |�}| �||�}|r$| �|�S | �| jj| j||�S d S ru )r� �"_evp_pkey_from_der_traditional_keyr� r rW Zd2i_PKCS8PrivateKey_bio)rf r� r! r� r� rP rP rQ �load_der_private_keyg s �z Backend.load_der_private_keyc C s^ | j �|j| jj�}|| jjkrN| �� | j�|| j j�}|d urJtd��|S | �� d S d S )N�4Password was given but private key is not encrypted.) rW �d2i_PrivateKey_biorK rU rq r� r� r� � TypeError)rf r� r! r� rP rP rQ r) z s �z*Backend._evp_pkey_from_der_traditional_keyc C s� | � |�}| j�|j| jj�}|| jjkrF| j�|| jj�}| �|�S | � � | j� |j�}| � |dk� | j� |j| jj�}|| jjkr�| j�|| jj �}| �|�}t| ||�S | �� d S rw )r� rW Zd2i_PUBKEY_biorK rU rq r� r� r� r� r# rm Zd2i_RSAPublicKey_bior� r� r! r$ r% rP rP rQ �load_der_public_key� s � zBackend.load_der_public_keyc C s� | � |�}| j�|j| jj�}|| jjkrF| j�|| jj�}t| |�S | jj r�| � � | j� |j�}| � |dk� | j� |j| jj�}|| jjkr�| j�|| jj�}t| |�S | �� d S rw )r� rW Zd2i_DHparams_biorK rU rq r� r� r rc r� r# rm Z Cryptography_d2i_DHxparams_bior$ )rf r� r& r� r| rP rP rQ �load_der_parameters� s � zBackend.load_der_parameters)�certr c C sT |� tjj�}| �|�}| j�|j| jj �}| � || jj k� | j� || jj �}|S ru ) � public_bytesr( �Encoding�DERr� rW Z d2i_X509_biorK rU rq rm r� � X509_free)rf r0 r� r& r rP rP rQ � _cert2ossl� s zBackend._cert2ossl)r r c C s4 | � � }| j�||�}| �|dk� t�| �|��S rw )r� rW Z i2d_X509_biorm � rust_x509Zload_der_x509_certificater� )rf r rK r| rP rP rQ � _ossl2cert� s zBackend._ossl2cert)�csrr c C sT |� tjj�}| �|�}| j�|j| jj �}| � || jj k� | j� || jj �}|S ru ) r1 r( r2 r3 r� rW Zd2i_X509_REQ_biorK rU rq rm r� Z X509_REQ_free)rf r8 r� r& �x509_reqrP rP rQ � _csr2ossl� s zBackend._csr2ossl)r9 r c C s4 | � � }| j�||�}| �|dk� t�| �|��S rw )r� rW Zi2d_X509_REQ_biorm r6 Zload_der_x509_csrr� )rf r9 rK r| rP rP rQ � _ossl2csr� s zBackend._ossl2csr)�crlr c C sT |� tjj�}| �|�}| j�|j| jj �}| � || jj k� | j� || jj �}|S ru ) r1 r( r2 r3 r� rW Zd2i_X509_CRL_biorK rU rq rm r� Z X509_CRL_free)rf r< r� r& �x509_crlrP rP rQ � _crl2ossl� s zBackend._crl2ossl)r= r c C s4 | � � }| j�||�}| �|dk� t�| �|��S rw )r� rW Zi2d_X509_CRL_biorm r6 Zload_der_x509_crlr� )rf r= rK r| rP rP rQ � _ossl2crl� s zBackend._ossl2crl)r< � public_keyr c C sJ t |tttf�std��| �|�}| j�||j�}|dkrF| � � dS dS )NzGExpecting one of DSAPublicKey, RSAPublicKey, or EllipticCurvePublicKey.rS FT) r� r r! r r- r> rW ZX509_CRL_verify� _evp_pkeyr� )rf r< r@ r= r| rP rP rQ �_crl_is_signature_valid� s ��� z Backend._crl_is_signature_validc C s` | � |�}| j�|�}| �|| jjk� | j�|| jj�}| j�||�}|dkr\| � � dS dS )NrS FT) r: rW ZX509_REQ_get_pubkeyrm rU rq r� r� ZX509_REQ_verifyr� )rf r8 r9 Zpkeyr| rP rP rQ �_csr_is_signature_valid� s z Backend._csr_is_signature_validc C s" | j �|j|j�dkr td��d S )NrS zKeys do not correspond)rW Z EVP_PKEY_cmprA r� )rf Zkey1Zkey2rP rP rQ �_check_keys_correspond s z Backend._check_keys_correspondc C s& | � |�}| j�d�}|d urFt�d|� | j�|�}||_t|�|_||j | jj | j� | j j d�|�}|| jj kr�|jdkr�| �� |jdkr�td��q�|jdks�J �td�|jd ���n| �� | �� | j�|| j j�}|d ur�|jdkr�td ��|d u�r|jd k�s |d u �s J �||�S ) Nz CRYPTOGRAPHY_PASSWORD_DATA *r! Z Cryptography_pem_password_cbr ���z3Password was not given but private key is encrypted���zAPasswords longer than {} bytes are not supported by this backend.rS r+ )r� rU r� r �_check_bytesliker� r! r� r� rK rq Z addressofrW Z _original_lib�errorr� r- r� rh �maxsizer$ r� r� Zcalled) rf Zopenssl_read_funcZ convert_funcr� r! r& ZuserdataZ password_ptrr� rP rP rQ r sT �� �������zBackend._load_keyc s� � � � }|std��n�|d �� jj� jj�sf|d �� jj� jj�sf� jjrp|d �� jj � jj �rptd��n4t � fdd�|D ��r�td��nt � |�}td|��d S )Nz|Could not deserialize key data. The data may be in an incorrect format or it may be encrypted with an unsupported algorithm.r z Bad decrypt. Incorrect password?c 3 s" | ]}|� � jj� jj�V qd S ru )�_lib_reason_matchrW � ERR_LIB_EVPZ'EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM)�.0rH re rP rQ � <genexpr>b s ��z4Backend._handle_key_loading_error.<locals>.<genexpr>z!Unsupported public key algorithm.z�Could not deserialize key data. The data may be in an incorrect format, it may be encrypted with an unsupported algorithm, or it may be an unsupported key type (e.g. EC curves with explicit parameters).)r� r� rJ rW rK ZEVP_R_BAD_DECRYPTZERR_LIB_PKCS12Z!PKCS12_R_PKCS12_CIPHERFINAL_ERRORZCryptography_HAS_PROVIDERSZ ERR_LIB_PROVZPROV_R_BAD_DECRYPT�anyr& Z_errors_with_text)rf rk rP re rQ r$ F s> � ���� � �� � �z!Backend._handle_key_loading_errorc C st z| � |�}W n ty( | jj}Y n0 | j�|�}|| jjkrN| �� dS | �|| jjk� | j� |� dS d S )NFT) �_elliptic_curve_to_nidr rW � NID_undefZEC_GROUP_new_by_curve_namerU rq r� rm Z EC_GROUP_free)rf �curve� curve_nid�grouprP rP rQ �elliptic_curve_supportedu s z Backend.elliptic_curve_supportedc C s t |tj�sdS | �|�S r� )r� r+ ZECDSArT )rf Zsignature_algorithmrQ rP rP rQ �,elliptic_curve_signature_algorithm_supported� s z4Backend.elliptic_curve_signature_algorithm_supportedc C s\ | � |�rD| �|�}| j�|�}| �|dk� | �|�}t| ||�S td�|j �t j ��dS )z@ Generate a new private key on the named curve. rS z#Backend object does not support {}.N) rT �_ec_key_new_by_curverW ZEC_KEY_generate_keyrm �_ec_cdata_to_evp_pkeyr r rh r� r �UNSUPPORTED_ELLIPTIC_CURVE)rf rQ r� r| r� rP rP rQ �#generate_elliptic_curve_private_key� s �z+Backend.generate_elliptic_curve_private_keyc C sz |j }| �|j�}| j�| �|j�| jj�}| j� ||�}|dkrR| � � t d��| � ||j |j�}| �|�}t| ||�S )NrS �Invalid EC key.)r� rV rQ rU r� r� � private_valuerW � BN_clear_free�EC_KEY_set_private_keyr� r� �)_ec_key_set_public_key_affine_coordinatesr r rW r )rf r� Zpublicr� r[ r| r� rP rP rQ �#load_elliptic_curve_private_numbers� s � � z+Backend.load_elliptic_curve_private_numbersc C s4 | � |j�}| �||j|j�}| �|�}t| ||�S ru )rV rQ r^ r r rW r )rf r� r� r� rP rP rQ �"load_elliptic_curve_public_numbers� s � z*Backend.load_elliptic_curve_public_numbersc C s� | � |�}| j�|�}| �|| jjk� | j�|�}| �|| jjk� | j�|| jj�}| � � �@}| j� |||t |�|�}|dkr�| � � t d��W d � n1 s�0 Y | j�||�}| �|dk� | �|�}t| ||�S )NrS z(Invalid public bytes for the given curve)rV rW �EC_KEY_get0_grouprm rU rq � EC_POINT_newr� � EC_POINT_free� _tmp_bn_ctxZEC_POINT_oct2pointr� r� r� �EC_KEY_set_public_keyrW r ) rf rQ Z point_bytesr� rS �point�bn_ctxr| r� rP rP rQ � load_elliptic_curve_public_bytes� s" �& z(Backend.load_elliptic_curve_public_bytesc C sb | � |�}| �|�\}}| j�|�}| �|| jjk� | j�|| jj�}| � |�}| j�|| jj �}| � � �|}| j� |||| jj| jj|�} | �| dk� | j� |�} | j� |�} |||| | |�} | dkr�| �� td��W d � n1 s�0 Y | j�||�} | �| dk� | � |�} | j�| | jj �} | j�|| �} | �| dk� | �|�} t| || �S )NrS z'Unable to derive key from private_value)rV � _ec_key_determine_group_get_funcrW rb rm rU rq r� rc r� r\ rd Z EC_POINT_mulZ BN_CTX_getr� r� re r] rW r )rf r[ rQ r� �get_funcrS rf �valuerg r| Zbn_xZbn_yZprivater� rP rP rQ �!derive_elliptic_curve_private_key� s4 � & z)Backend.derive_elliptic_curve_private_keyc C s | � |�}| �|�S ru )rO �_ec_key_new_by_curve_nid)rf rQ rR rP rP rQ rV � s z Backend._ec_key_new_by_curvec C s0 | j �|�}| �|| jjk� | j�|| j j�S ru )rW ZEC_KEY_new_by_curve_namerm rU rq r� r� )rf rR r� rP rP rQ rm � s z Backend._ec_key_new_by_curve_nidc C s, | j rt|| j�sdS | �|�o*t|tj�S r� )rZ r� �_fips_ecdh_curvesrT r+ ZECDH)rf r� rQ rP rP rQ �+elliptic_curve_exchange_algorithm_supported s � �z3Backend.elliptic_curve_exchange_algorithm_supportedc C s( | � � }| j�||�}| �|dk� |S rw )r� rW ZEVP_PKEY_set1_EC_KEYrm )rf r� r� r| rP rP rQ rW s z Backend._ec_cdata_to_evp_pkeyc C sN ddd�}|� |j|j�}| j�|�� �}|| jjkrJtd�|j�tj ��|S )z/ Get the NID for a curve name. Z prime192v1Z prime256v1)Z secp192r1Z secp256r1z${} is not a supported elliptic curve) �getr� rW � OBJ_sn2nidr� rP r rh r rX )rf rQ Z curve_aliasesZ curve_namerR rP rP rQ rO s �z Backend._elliptic_curve_to_nidc c sd | j �� }| �|| jjk� | j�|| j j�}| j �|� z|V W | j �|� n| j �|� 0 d S ru ) rW Z BN_CTX_newrm rU rq r� Z BN_CTX_freeZ BN_CTX_startZ BN_CTX_end)rf rg rP rP rQ rd # s zBackend._tmp_bn_ctxc C s� | � || jjk� | j�d�}| � || jjk� | j�|�}| � || jjk� | j�|�}| � || jjk� | j�|�}| � || jjk� ||kr�| jj r�| jj }n| jj }|s�J �||fS )zu Given an EC_KEY determine the group and what function is required to get point coordinates. s characteristic-two-field) rm rU rq rW rq rP ra ZEC_GROUP_method_ofZEC_METHOD_get_field_typeZCryptography_HAS_EC2MZ$EC_POINT_get_affine_coordinates_GF2mZ#EC_POINT_get_affine_coordinates_GFp)rf r Z nid_two_fieldrS �method�nidrj rP rP rQ ri . s z(Backend._ec_key_determine_group_get_funcc C st |dk s|dk rt d��| j�| �|�| jj�}| j�| �|�| jj�}| j�|||�}|dkrp| �� t d��|S )zg Sets the public key point in the EC_KEY context to the affine x and y values. r z2Invalid EC key. Both x and y must be non-negative.rS rZ )r� rU r� r� rW r� Z(EC_KEY_set_public_key_affine_coordinatesr� )rf r r r r| rP rP rQ r^ J s �z1Backend._ec_key_set_public_key_affine_coordinatesc C s( t |tj�std��t |tj�s(td��t |tj�s<td��t |tj�rNd}n0t |tj�rv|j}t |�dkr~t d��nt d��|tjj u r�|tjj u r�| j j}n |tjju r�| j j}nt d��| �|||�S |tjju �r�| jr�t |tj�s�t d ��| j �|�} |tjj u �rl| | j jk�r&| j j}n8| | j jk�r>| j j}n | | j jk�rV| j j}nt d ��| �|||�S |tjju �r�|�r�t d ��| | j jk�r�| j j}n8| | j jk�r�| j j }n | | j jk�r�| j j }nt d ��| � ||�S t d ��|tjj u �r |tjj u �rt �!||�S t d ��t d��d S )N�/encoding must be an item from the Encoding enumz2format must be an item from the PrivateFormat enumzBEncryption algorithm must be a KeySerializationEncryption instancerp i� zBPasswords longer than 1023 bytes are not supported by this backendzUnsupported encryption typez Unsupported encoding for PKCS8zCEncrypted traditional OpenSSL format is not supported in FIPS mode.z+Unsupported key type for TraditionalOpenSSLzDEncryption is not supported for DER encoded traditional OpenSSL keysz+Unsupported encoding for TraditionalOpenSSLz=OpenSSH private key format can only be used with PEM encoding� format is invalid with this key)"r� r( r2 r- Z PrivateFormatZKeySerializationEncryption� NoEncryption�BestAvailableEncryptionr! r� r� ZPKCS8�PEMrW Z PEM_write_bio_PKCS8PrivateKeyr3 Zi2d_PKCS8PrivateKey_bio�_private_key_bytes_via_bioZTraditionalOpenSSLrZ r� r� ZPEM_write_bio_RSAPrivateKeyr� ZPEM_write_bio_DSAPrivateKeyr� ZPEM_write_bio_ECPrivateKeyZi2d_RSAPrivateKey_bioZi2d_ECPrivateKey_bioZi2d_DSAPrivateKey_bio�_bio_func_output�OpenSSHrF Zserialize_ssh_private_key) rf �encodingrh �encryption_algorithmr� r� �cdatar! � write_bior� rP rP rQ �_private_key_bytes^ s� ��� � � ��� ��� � �zBackend._private_key_bytesc C s< |s| j j}n | j�d�}| �||||t|�| j j| j j�S )Ns aes-256-cbc)rU rq rW �EVP_get_cipherbynamerz r� )rf r r� r! r� rP rP rQ ry � s �z"Backend._private_key_bytes_via_bioc G s0 | � � }||g|�R � }| �|dk� | �|�S rw )r� rm r� )rf r �argsrK r| rP rP rQ rz � s zBackend._bio_func_outputc C s t |tj�std��t |tj�s(td��|tjju rt|tjju rJ| jj}n |tjj u r`| jj }nt d��| � ||�S |tjj u r�| j�|�}|| jjkr�t d��|tjju r�| jj}n |tjj u r�| jj}nt d��| � ||�S |tjju �r|tjju �rt�|�S t d��t d��d S )Nrt z1format must be an item from the PublicFormat enumz8SubjectPublicKeyInfo works only with PEM or DER encodingz+PKCS1 format is supported only for RSA keysz)PKCS1 works only with PEM or DER encodingz1OpenSSH format must be used with OpenSSH encodingru )r� r( r2 r- Z PublicFormatZSubjectPublicKeyInforx rW ZPEM_write_bio_PUBKEYr3 Zi2d_PUBKEY_bior� rz ZPKCS1r� r� ZPEM_write_bio_RSAPublicKeyZi2d_RSAPublicKey_bior{ rF Zserialize_ssh_public_key)rf r| rh r� r� r~ r r� rP rP rQ �_public_key_bytes� s@ � � �zBackend._public_key_bytesc C s� |t jju rtd��| j�d�}| j�|| jj|| jj� |t jj u rj|d | jjkr`| jj }q�| jj }n8|t jj u r�|d | jjkr�| jj }q�| jj}ntd��| �� }|||�}| �|dk� | �|�S )Nz!OpenSSH encoding is not supportedz BIGNUM **r rt rS )r( r2 r{ r- rU r� rW Z DH_get0_pqgrq rx ZPEM_write_bio_DHxparamsZPEM_write_bio_DHparamsr3 Z Cryptography_i2d_DHxparams_bioZi2d_DHparams_bior� rm r� )rf r| rh r~ r� r rK r| rP rP rQ �_parameter_bytes s" zBackend._parameter_bytesc C s | j j S ru �rW �CRYPTOGRAPHY_IS_BORINGSSLre rP rP rQ � dh_supported' s zBackend.dh_supportedc C s� |t jk rtd�t j���|dvr*td��| j�� }| �|| jjk� | j� || jj �}| j� |||| jj�}| �|dk� t | |�S )Nz$DH key_size must be at least {} bits)� � zDH generator must be 2 or 5rS ) r) Z_MIN_MODULUS_SIZEr� rh rW �DH_newrm rU rq r� r� ZDH_generate_parameters_exr )rf � generatorr� Zdh_param_cdatar| rP rP rQ �generate_dh_parameters* s �� �z Backend.generate_dh_parametersc C s( | � � }| j�||�}| �|dk� |S rw )r� rW ZEVP_PKEY_set1_DHrm )rf r� r� r| rP rP rQ �_dh_cdata_to_evp_pkey@ s z Backend._dh_cdata_to_evp_pkeyc C s< t |j| �}| j�|�}| �|dk� | �|�}t| ||�S rw )r Z _dh_cdatarW ZDH_generate_keyrm r� r )rf r Z dh_key_cdatar| r� rP rP rQ �generate_dh_private_keyF s z Backend.generate_dh_private_keyc C s | � | �||��S ru )r� r� )rf r� r� rP rP rQ �&generate_dh_private_key_and_parametersP s �z.Backend.generate_dh_private_key_and_parametersc C s> |j j}| j�� }| �|| jjk� | j�|| jj�}| � |j �}| � |j �}|j d urf| � |j �}n| jj}| � |j j �}| � |j�}| j�||||�} | �| dk� | j�|||�} | �| dk� | j�dd�} | j�|| �} | �| dk� | d dk�r(|j dk�r | d | jjA dk�s(td��| �|�} t| || �S )NrS �int[]r r� z.DH private numbers did not pass safety checks.)r� r rW r� rm rU rq r� r� r� r� r r� r r � DH_set0_pqg� DH_set0_keyr� �Cryptography_DH_checkZDH_NOT_SUITABLE_GENERATORr� r� r ) rf r� r r� r� r r� r r r| �codesr� rP rP rQ �load_dh_private_numbersU s4 �� z Backend.load_dh_private_numbersc C s� | j �� }| �|| jjk� | j�|| j j�}|j}| �|j �}| �|j �}|j d urd| �|j �}n| jj}| �|j �}| j � ||||�}| �|dk� | j �||| jj�}| �|dk� | �|�} t| || �S rw )rW r� rm rU rq r� r� r r� r� r r� r r� r� r� r ) rf r� r� r r� r r� r r| r� rP rP rQ �load_dh_public_numbers� s z Backend.load_dh_public_numbersc C s� | j �� }| �|| jjk� | j�|| j j�}| �|j�}| �|j �}|j d ur^| �|j �}n| jj}| j � ||||�}| �|dk� t | |�S rw ) rW r� rm rU rq r� r� r� r� r r� r� r )rf r� r� r� r r� r| rP rP rQ �load_dh_parameter_numbers� s z!Backend.load_dh_parameter_numbersc C s� | j �� }| �|| jjk� | j�|| j j�}| �|�}| �|�}|d urV| �|�}n| jj}| j �||||�}| �|dk� | j� dd�}| j � ||�}| �|dk� |d dkS )NrS r� r ) rW r� rm rU rq r� r� r� r� r� r� )rf r� r r� r� r| r� rP rP rQ �dh_parameters_supported� s z Backend.dh_parameters_supportedc C s | j jdkS rw )rW rc re rP rP rQ � dh_x942_serialization_supported� s z'Backend.dh_x942_serialization_supportedc C sh t |�dkrtd��| �� }| j�|| jj�}| �|dk� | j�||t |��}| �|dk� t| |�S )N� z%An X25519 public key is 32 bytes longrS ) r� r� r� rW ZEVP_PKEY_set_type� NID_X25519rm Z EVP_PKEY_set1_tls_encodedpointr# )rf r� r� r| rP rP rQ �x25519_load_public_bytes� s �z Backend.x25519_load_public_bytesc C s� t |�dkrtd��d}| �d��F}||dd�< ||dd �< | �|�}| j�|j| jj�}W d � n1 sn0 Y | � || jjk� | j� || jj �}| � | j� |�| jj k� t| |�S )Nr� z&An X25519 private key is 32 bytes longs 0. 0+en" �0 r � )r� r� �_zeroed_bytearrayr� rW r, rK rU rq rm r� r� r� r� r" )rf r� Z pkcs8_prefix�barK r� rP rP rQ �x25519_load_private_bytes� s 2�z!Backend.x25519_load_private_bytesc C s� | j �|| jj�}| �|| jjk� | j�|| j j�}| j �|�}| �|dk� | j�d�}| j � ||�}| �|dk� | �|d | jjk� | j�|d | j j �}|S )NrS � EVP_PKEY **r ) rW ZEVP_PKEY_CTX_new_idrU rq rm r� ZEVP_PKEY_CTX_freeZEVP_PKEY_keygen_initr� ZEVP_PKEY_keygenr� )rf rs Z evp_pkey_ctxr| Z evp_ppkeyr� rP rP rQ �_evp_pkey_keygen_gc� s zBackend._evp_pkey_keygen_gcc C s | � | jj�}t| |�S ru )r� rW r� r" r� rP rP rQ �x25519_generate_key s zBackend.x25519_generate_keyc C s | j r dS | jj S r� )rZ rW �CRYPTOGRAPHY_IS_LIBRESSLre rP rP rQ �x25519_supported s zBackend.x25519_supportedc C s` t |�dkrtd��| j�| jj| jj|t |��}| �|| jjk� | j�|| jj �}t | |�S )N�8 z#An X448 public key is 56 bytes long) r� r� rW �EVP_PKEY_new_raw_public_key�NID_X448rU rq rm r� r� r% �rf r� r� rP rP rQ �x448_load_public_bytes s �z Backend.x448_load_public_bytesc C sl t |�dkrtd��| j�|�}| j�| jj| jj|t |��}| �|| jjk� | j� || jj �}t | |�S )Nr� z$An X448 private key is 56 bytes long) r� r� rU r� rW � EVP_PKEY_new_raw_private_keyr� rq rm r� r� r$ �rf r� r� r� rP rP rQ �x448_load_private_bytes s �z Backend.x448_load_private_bytesc C s | � | jj�}t| |�S ru )r� rW r� r$ r� rP rP rQ �x448_generate_key' s zBackend.x448_generate_keyc C s | j r dS | jj o | jj S r� )rZ rW Z"CRYPTOGRAPHY_OPENSSL_LESS_THAN_111r� re rP rP rQ �x448_supported+ s �zBackend.x448_supportedc C s | j r dS | jj S r� )rZ rW �#CRYPTOGRAPHY_OPENSSL_LESS_THAN_111Bre rP rP rQ �ed25519_supported3 s zBackend.ed25519_supportedc C sn t �d|� t|�tjkr"td��| j�| jj| j j |t|��}| � || j j k� | j � || jj �}t| |�S )Nr� z&An Ed25519 public key is 32 bytes long)r � _check_bytesr� r, �_ED25519_KEY_SIZEr� rW r� � NID_ED25519rU rq rm r� r� r r� rP rP rQ �ed25519_load_public_bytes8 s �z!Backend.ed25519_load_public_bytesc C sz t |�tjkrtd��t�d|� | j�|�}| j� | jj | jj |t |��}| � || jj k� | j� || jj�}t| |�S )Nz'An Ed25519 private key is 32 bytes longr� )r� r, r� r� r rG rU r� rW r� r� rq rm r� r� r r� rP rP rQ �ed25519_load_private_bytesF s �z"Backend.ed25519_load_private_bytesc C s | � | jj�}t| |�S ru )r� rW r� r r� rP rP rQ �ed25519_generate_keyT s z Backend.ed25519_generate_keyc C s | j r dS | jj o | jj S r� )rZ rW r� r� re rP rP rQ �ed448_supportedX s �zBackend.ed448_supportedc C sl t �d|� t|�tkr td��| j�| jj| jj |t|��}| � || jj k� | j� || jj �}t | |�S )Nr� z$An Ed448 public key is 57 bytes long)r r� r� r r� rW r� � NID_ED448rU rq rm r� r� r r� rP rP rQ �ed448_load_public_bytes` s �z Backend.ed448_load_public_bytesc C sx t �d|� t|�tkr td��| j�|�}| j�| jj | jj |t|��}| � || jj k� | j� || jj �}t| |�S )Nr� z%An Ed448 private key is 57 bytes long)r rG r� r r� rU r� rW r� r� rq rm r� r� r r� rP rP rQ �ed448_load_private_bytesm s �z Backend.ed448_load_private_bytesc C s | � | jj�}t| |�S ru )r� rW r� r r� rP rP rQ �ed448_generate_key{ s zBackend.ed448_generate_keyc C s� | j �d|�}| j �|�}| j�|t|�|t|�|||tj||� } | dkrr| �� } d| | d } t d� | �| ��| j � |�d d � S )Nr� rS � i zJNot enough memory to derive key. These parameters require {} MB of memory.) rU r� r� rW ZEVP_PBE_scryptr� rD Z _MEM_LIMITr� � MemoryErrorrh r� ) rf r� r� r� r� �rr� r� r� r| rk Z min_memoryrP rP rQ � derive_scrypt s0 � ��zBackend.derive_scryptc C s2 t �|�}| jr || jvr dS | j�|�| jjkS r� )r Z_aead_cipher_namerZ � _fips_aeadrW r� rU rq )rf r� � cipher_namerP rP rQ �aead_cipher_supported� s z Backend.aead_cipher_supportedc c s2 t |�}z|V W | �||� n| �||� 0 dS )z� This method creates a bytearray, which we copy data into (hopefully also from a mutable buffer that can be dynamically erased!), and then zero when we're done. N)� bytearray� _zero_data)rf r� r� rP rP rQ r� � s zBackend._zeroed_bytearrayc C s t |�D ] }d||< qd S rn )�range)rf r� r� �irP rP rQ r� � s zBackend._zero_datac c s| |du r| j jV ndt|�}| j �d|d �}| j �|||� z |V W | �| j �d|�|� n| �| j �d|�|� 0 dS )a� This method takes bytes, which can be a bytestring or a mutable buffer like a bytearray, and yields a null-terminated version of that data. This is required because PKCS12_parse doesn't take a length with its password char * and ffi.from_buffer doesn't provide null termination. So, to support zeroing the data via bytearray we need to build this ridiculous construct that copies the memory, but zeroes it after use. Nr rS z uint8_t *)rU rq r� r� Zmemmover� �cast)rf r� Zdata_lenr� rP rP rQ �_zeroed_null_terminated_buf� s z#Backend._zeroed_null_terminated_bufc C s2 | � ||�}|j|jr |jjnd dd� |jD �fS )Nc S s g | ] }|j �qS rP )� certificate)rL r0 rP rP rQ � <listcomp>� rp zABackend.load_key_and_certificates_from_pkcs12.<locals>.<listcomp>)� load_pkcs12r� r0 r� Zadditional_certs)rf r� r! Zpkcs12rP rP rQ �%load_key_and_certificates_from_pkcs12� s �z-Backend.load_key_and_certificates_from_pkcs12c C s� |d urt �d|� | �|�}| j�|j| jj�}|| jjkrN| �� t d��| j� || jj �}| j� d�}| j� d�}| j� d�}| � |��$}| j�|||||�} W d � n1 s�0 Y | jjr�| �� | dkr�| �� t d��d } d } g } |d | jjk�r(| j� |d | jj�} | �| �} |d | jjk�r�| j� |d | jj�}| �|�}d }| j�|| jj�}|| jjk�r�| j�|�}t||�} |d | jjk�r~| j� |d | jj�}| j�|d �}| jj�s�| jj�r�t|�}n t t|��}|D ]�}| j� ||�}| � || jjk� | j� || jj�}| �|�}d }| j�|| jj�}|| jjk�rj| j�|�}| � t||�� �q�t | | | �S )Nr! z!Could not deserialize PKCS12 datar� zX509 **z Cryptography_STACK_OF_X509 **r z Invalid password or PKCS12 data)!r rG r� rW Zd2i_PKCS12_biorK rU rq r� r� r� � PKCS12_freer� r� Z PKCS12_parser� r� r� r4 r7 ZX509_alias_get0r� rG � sk_X509_free� sk_X509_num�#CRYPTOGRAPHY_OPENSSL_300_OR_GREATERr� r� �reversed� sk_X509_valuerm rd rH )rf r� r! rK �p12Z evp_pkey_ptrZx509_ptrZ sk_x509_ptr� password_bufr| r0 r� Zadditional_certificatesr� r Zcert_objr� Z maybe_name�sk_x509r� �indicesr� Z addl_certZ addl_namerP rP rQ r� � sp �" �� �zBackend.load_pkcs12c C s� d }|d urt �d|� t|tj�r6d}d}d} d} n4t|tj�rb| jj}| jj}d} d} |j}nt d��|d u s~t |�dkr�| j j } nZ| j� � } | j �| | jj�} g } |D ]4} | �| �}| �|� | j�| |�}t�|dk� q�| �|���}| �|��Z}|�r | �|�n| j j }|�r |jn| j j }| j�||||| ||| | d� }W d � n1 �sZ0 Y W d � n1 �sz0 Y | �|| j j k� | j �|| jj�}| �� }| j�||�}| �|dk� | �|�S )Nr� rE r i N rS z Unsupported key encryption type) r r� r� r( rv rw rW Z&NID_pbe_WithSHA1And3_Key_TripleDES_CBCr! r� r� rU rq �sk_X509_new_nullr� r� r5 rd � sk_X509_push�backendrm r� rA Z PKCS12_creater� r� Zi2d_PKCS12_bior� )rf r� r� r0 Zcasr} r! Znid_certZnid_keyZ pkcs12_iterZmac_iterr� Zossl_cas�caZossl_car| r� Zname_buf� ossl_certr� r� rK rP rP rQ �(serialize_key_and_certificates_to_pkcs12 sb � �D z0Backend.serialize_key_and_certificates_to_pkcs12c C s | j r dS | jjdkS r� )rZ rW ZCryptography_HAS_POLY1305re rP rP rQ �poly1305_supportedc s zBackend.poly1305_supportedc C s* t �d|� t|�tkr td��t| |�S )Nr� z A poly1305 key is 32 bytes long)r rG r� r r� r )rf r� rP rP rQ �create_poly1305_ctxh s zBackend.create_poly1305_ctxc C s | j j S ru r� re rP rP rQ �pkcs7_supportedo s zBackend.pkcs7_supportedc C sn t �d|� | �|�}| j�|j| jj| jj| jj�}|| jjkrR| �� t d��| j� || jj �}| � |�S �Nr� zUnable to parse PKCS7 data) r r� r� rW ZPEM_read_bio_PKCS7rK rU rq r� r� r� � PKCS7_free�_load_pkcs7_certificates�rf r� rK �p7rP rP rQ �load_pem_pkcs7_certificatesr s � z#Backend.load_pem_pkcs7_certificatesc C sb t �d|� | �|�}| j�|j| jj�}|| jjkrF| �� t d��| j� || jj �}| � |�S r� ) r r� r� rW Z d2i_PKCS7_biorK rU rq r� r� r� r� r� r� rP rP rQ �load_der_pkcs7_certificates s z#Backend.load_der_pkcs7_certificatesc C s� | j �|j�}| �|| j jk� || j jkr>td�|�tj ��|j j j }| j � |�}g }t|�D ]d}| j �||�}| �|| jjk� | j �|�}| �|dk� | j�|| j j�}| �|�} |�| � q`|S )NzNOnly basic signed structures are currently supported. NID for this data was {}rS )rW Z OBJ_obj2nidr� rm rP ZNID_pkcs7_signedr rh r ZUNSUPPORTED_SERIALIZATIONr� �signr0 r� r� r� rU rq Z X509_up_refr� r4 r7 rd ) rf r� rs r� r� �certsr� r r| r0 rP rP rQ r� � s* �� z Backend._load_pkcs7_certificatesc C s� | � |j�}| jj}d}t|j�dkr0| jj}n\| j�� }| j� || jj �}g }|jD ]4} | � | �} |� | � | j� || �} | �| dk� qVtjj|v r�|| jjO }|| jjO }| j�| jj| jj|| jj|�} | �| | jjk� | j� | | jj�} d} tjj|v �r| | jjO } ntjj|v �r.| | jjO } tjj|v �rH| | jjO } |jD ]H\}}}| � |�} | � |�}| j� | | |j || �}| �|| jjk� �qN|D ]<}|tjj u �r�|| jj O }n|tjj!u �r�|| jj"O }�q�| �#� }|t$j%j&u �r| j�'|| |j(|�} n�|t$j%j)u �rJ| j�*| |j(|�} | �| dk� | j�+|| |j(|�} nR|t$j%j,u �s\J �| j�*| |j(|�} | �| dk� | jj-�r�| �.� | j�/|| �} | �| dk� | �0|�S )Nr rS )1r� �_datarW Z PKCS7_PARTIALr� Z_additional_certsrU rq r� r� r� r5 rd r� rm rE Z PKCS7OptionsZDetachedSignatureZPKCS7_DETACHEDZ PKCS7_signr� ZNoCapabilitiesZPKCS7_NOSMIMECAPZ NoAttributesZ PKCS7_NOATTRZNoCertsZ PKCS7_NOCERTSZ_signersr� ZPKCS7_sign_add_signerrA �TextZ PKCS7_TEXTZBinaryZ PKCS7_BINARYr� r( r2 ZSMIMEZSMIME_write_PKCS7rK rx Z PKCS7_finalZPEM_write_bio_PKCS7_streamr3 r� r� Z i2d_PKCS7_bior� )rf Zbuilderr| �optionsrK Z init_flagsZ final_flagsr� Z ossl_certsr0 r� r| r� Z signer_flagsr� Z private_keyZhash_algorithmZmdZ p7signerinfo�optionZbio_outrP rP rQ � pkcs7_sign� s~ � � � � zBackend.pkcs7_sign)N)N)N)�rM rN rO �__doc__r� r� r2 r� r' r� r r r Z SHA512_224Z SHA512_256ZSHA3_224ZSHA3_256ZSHA3_384ZSHA3_512ZSHAKE128ZSHAKE256r� r+ Z SECP224R1Z SECP256R1Z SECP384R1Z SECP521R1rn Z_fips_rsa_min_key_sizeZ _fips_rsa_min_public_exponentZ_fips_dsa_min_modulusZ_fips_dh_min_key_sizeZ_fips_dh_min_modulusrg rj rm rY rv r} � contextlibr r~ ra r� ri r� r� r� r� r� r� r� r� r� r� r\ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r r r r r r rs r Z HashAlgorithmr r r r r" r' r( r* r) r. r/ r Z Certificate�typing�Anyr5 r7 ZCertificateSigningRequestr: r; ZCertificateRevocationListr> r? rI rB rC rD r r$ rT rU rY r_ r` rh rl rV rm ro rW rO rd ri r^ r� ry rz r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� rP rP rP rQ r v s\ �� 1 " -+ � � � � 5/ % i0 . " L D r c @ s e Zd Zdd� Zdd� ZdS )r� c C s || _ d S ru )�_fmt)rf ZfmtrP rP rQ rg � s zGetCipherByName.__init__c C s& | j j||d��� }|j�|�d��S )N)r� rt r� )r� rh �lowerrW r� r� )rf r� r� rt r� rP rP rQ �__call__ s zGetCipherByName.__call__N)rM rN rO rg r� rP rP rP rQ r� � s r� c C s" d� |jd �}| j�|�d��S )Nz aes-{}-xtsr� r� )rh r� rW r� r� )r� r� rt r� rP rP rQ r� s r� )o� collectionsr� r� r� r^ r Z cryptographyr r Zcryptography.exceptionsr r Z'cryptography.hazmat.backends.interfacesr ZBackendInterfaceZ$cryptography.hazmat.backends.opensslr Z,cryptography.hazmat.backends.openssl.ciphersr Z)cryptography.hazmat.backends.openssl.cmacr Z'cryptography.hazmat.backends.openssl.dhr r r r Z(cryptography.hazmat.backends.openssl.dsar r r Z'cryptography.hazmat.backends.openssl.ecr r Z,cryptography.hazmat.backends.openssl.ed25519r r Z*cryptography.hazmat.backends.openssl.ed448r r r Z+cryptography.hazmat.backends.openssl.hashesr Z)cryptography.hazmat.backends.openssl.hmacr Z-cryptography.hazmat.backends.openssl.poly1305r r Z(cryptography.hazmat.backends.openssl.rsar r! Z+cryptography.hazmat.backends.openssl.x25519r" r# Z)cryptography.hazmat.backends.openssl.x448r$ r% Z"cryptography.hazmat.bindings._rustr6 Z$cryptography.hazmat.bindings.opensslr& Z cryptography.hazmat.primitivesr' r( Z)cryptography.hazmat.primitives.asymmetricr) r* r+ r, r- Z1cryptography.hazmat.primitives.asymmetric.paddingr. r/ r0 r1 Z1cryptography.hazmat.primitives.ciphers.algorithmsr2 r3 r4 r5 r6 r7 r8 r9 r: r; Z,cryptography.hazmat.primitives.ciphers.modesr< r= r> r? r@ rA rB rC Z"cryptography.hazmat.primitives.kdfrD Z,cryptography.hazmat.primitives.serializationrE rF Z3cryptography.hazmat.primitives.serialization.pkcs12rG rH Zcryptography.x509.baserI � namedtuplerJ �objectrL r� r� r� rP rP rP rQ �<module> sp 0 (