a
êÇËhÚX ã @ sz d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZmZ d dl m
Z
m Z d dl m
Z d dlmZ d dlmZ d dlmZ d d lmZmZmZmZ d d
lmZm Z m Z d d l m Z m Z d d l!m"Z"m#Z# d d
l$m%Z%m&Z&m'Z' d dl(m)Z) d dl*m+Z+ d dl,m-Z-m.Z. d dl/m0Z0m1Z1 d dl2m3Z3m4Z4 d dl5m6Z6m7Z7 d dl8mZ9 d dl:m;Z; d dlZ> d dl?m@Z@mAZAmBZBmCZCmDZD d dlEmFZFmGZGmHZHmIZI d dlJmKZKmLZLmMZMmNZNmOZOmPZPmQZQmRZRmSZSmTZT d dlUmVZVmWZWmXZXmYZYmZZZm[Z[m\Z\m]Z] d dl^m_Z_ d d l`maZambZb d d lcmdZdmeZe d d lfmgZg e hd d d!g¡ZiG d"d#„ d#ejƒZkG d$d%„ d%eƒZ
G d&d'„ d'ejƒZld(d)„ Zme
ƒ ZndS )*é N)Úcontextmanager)ÚutilsÚx509)ÚUnsupportedAlgorithmÚ_Reasons)ÚBackend)Úaead)Ú_CipherContext©Ú _CMACContext)Ú
_DHParametersÚ
_DHPrivateKeyÚ _DHPublicKeyÚ_dh_params_dup)Ú_DSAParametersÚ_DSAPrivateKeyÚ
_DSAPublicKey)Ú_EllipticCurvePrivateKeyÚ_EllipticCurvePublicKey)Ú_Ed25519PrivateKeyÚ_Ed25519PublicKey)Ú_ED448_KEY_SIZEÚ_Ed448PrivateKeyÚ_Ed448PublicKey©Ú _HashContext©Ú _HMACContext)Ú_POLY1305_KEY_SIZEÚ_Poly1305Context)Ú_RSAPrivateKeyÚ
_RSAPublicKey)Ú_X25519PrivateKeyÚ_X25519PublicKey)Ú_X448PrivateKeyÚ_X448PublicKey)r )Úbinding)ÚhashesÚ
serialization)ÚdhÚdsaÚecÚed25519Úrsa)ÚMGF1ÚOAEPÚPKCS1v15ÚPSS)
ÚAESÚARC4ÚBlowfishÚCAST5ÚCamelliaÚChaCha20ÚIDEAÚSEEDÚSM4Ú TripleDES)ÚCBCÚCFBÚCFB8ÚCTRÚECBÚGCMÚOFBÚXTS)Úscrypt)Úpkcs7Ússh)ÚPKCS12CertificateÚPKCS12KeyAndCertificates)ÚPUBLIC_KEY_TYPESÚ
_MemoryBIOÚbioZchar_ptrc @ s e Zd ZdS )Ú_RC2N)Ú__name__Ú
__module__Ú __qualname__© rP rP úR/usr/lib64/python3.9/site-packages/cryptography/hazmat/backends/openssl/backend.pyrL r s rL c @ sŒ e Zd ZdZdZh d£ZefZej ej
ej ej ej
ejejejejejejejf ZejejejejfZdZ dZ dd> Z dZ de > Z dd„ Z!d d
„ Z"d d d
„Z#dd„ Z$dd„ Z%dd„ Z&e'j(dd„ ƒZ)dd„ Z*dd„ Z+dd„ Z,d d „ Z-d d „ Z.d d!„ Z/d"d#„ Z0d$d%„ Z1d&d'„ Z2d(d)„ Z3d*d+„ Z4d,d-„ Z5d.d/„ Z6d0d1„ Z7d2d3„ Z8d4d5„ Z9d6d7„ Z:d8d9„ Z;d:d;„ Zd?„ Z>d d@dA„Z?dBdC„ Z@dDdE„ ZAdFdG„ ZBdHdI„ ZCdJdK„ ZDdLdM„ ZEdNdO„ ZFdPdQ„ ZGdRdS„ ZHdTdU„ ZIdVdW„ ZJdXdY„ ZKdZd[„ ZLd\d]„ ZMd^d_„ ZNd`da„ ZOdbdc„ ZPddde„ ZQdfdg„ ZRdhdi„ ZSdjdk„ ZTeUdlœdmdn„ZVejWeUdoœdpdq„ZXdrds„ ZYdtdu„ ZZdvdw„ Z[dxdy„ Z\dzd{„ Z]d|d}„ Z^d~d„ Z_d€d„ Z`d‚dƒ„ Zad„d…„ Zbecjdeejfd†œd‡dˆ„Zgeejfecjdd‰œdŠd‹„ZhecjieejfdŒœddŽ„Zjeejfecjidœdd‘„Zkecjleejfd’œd“d”„Zmeejfecjld•œd–d—„ZnecjleoeUd˜œd™dš„ZpecjieUdŒœd›dœ„Zqddž„ ZrdŸd „ Zsd¡d¢„ Ztd£d¤„ Zud¥d¦„ Zvd§d¨„ Zwd©dª„ Zxd«d¬„ Zydd®„ Zzd¯d°„ Z{d±d²„ Z|d³d´„ Z}dµd¶„ Z~d·d¸„ Zd¹dº„ Z€e(d»d¼„ ƒZd½d¾„ Z‚d¿dÀ„ ZƒdÁd„ Z„dÃdÄ„ Z…dÅdÆ„ Z†dÇdÈ„ Z‡dÉdÊ„ ZˆdËdÌ„ Z‰dÍd΄ ZŠdÏdЄ Z‹dÑdÒ„ ZŒdÓdÔ„ ZdÕdÖ„ ZŽd×dØ„ ZdÙdÚ„ Zd!dÛdÜ„Z‘dÝdÞ„ Z’dßdà„ Z“dádâ„ Z”dãdä„ Z•dådæ„ Z–dçdè„ Z—dédê„ Z˜dëdì„ Z™dídî„ Zšdïdð„ Z›dñdò„ Zœdódô„ Zdõdö„ Zžd÷dø„ ZŸdùdú„ Z dûdü„ Z¡dýdþ„ Z¢dÿd „ Z£dd„ Z¤dd„ Z¥e'j(dd„ ƒZ¦dd„ Z§e'j(d d
„ ƒZ¨d d „ Z©d
d„ Zªdd„ Z«dd„ Z¬dd„ Zdd„ Z®dd„ Z¯dd„ Z°dd „ Z±d d „ Z²d S (" r z)
OpenSSL API binding interfaces.
Zopenssl> s aes-256-gcms aes-256-ccms aes-128-ccms aes-192-gcms aes-192-ccms aes-128-gcmé i é c C sˆ t ¡ | _| jj| _| jj| _d| _| ¡ | _ i | _
| ¡ | j rX| jj rXt
dt¡ n| ¡ | jjg| _| jjr„| j | jj¡ d S )NFz)ÚformatÚopenssl_version_textrZ re rP rP rQ Ú__repr__¼ s
ÿzBackend.__repr__Nc C s t j| j||dS )N)Úerrors)r& Z_openssl_assertrW )rf Úokrk rP rP rQ Úopenssl_assertÁ s zBackend.openssl_assertc C sH | j jr| j | jj¡}nt| j ddd„ ƒƒ }|dkr@| j ¡ t|ƒS )NZ FIPS_modec S s dS ©Nr rP rP rP rP rQ ÚÊ ó z*Backend._is_fips_enabled..r )rW ZCryptography_HAS_300_FIPSZ&EVP_default_properties_is_fips_enabledrU ÚNULLÚgetattrZERR_clear_errorÚbool)rf ÚmoderP rP rQ rY Ä s ÿ
zBackend._is_fips_enabledc C s$ | j ¡ | ¡ sJ ‚| ¡ | _d S ©N)rT Ú _enable_fipsrY rZ re rP rP rQ rv Ñ s
zBackend._enable_fipsc C sf | j jrb| j ¡ }|| jjkrb| j |¡ | j | jj¡}| |dk¡ | j |¡}| |dk¡ d S ©NrS ) rW r] ZENGINE_get_default_RANDrU rq ZENGINE_unregister_RANDÚRAND_set_rand_methodrm Ú
ENGINE_finish©rf ÚeÚresrP rP rQ Úactivate_builtin_randomØ s
z Backend.activate_builtin_randomc
c s¶ | j | j j¡}| || jjk¡ | j |¡}| |dk¡ z>|V W | j |¡}| |dk¡ | j |¡}| |dk¡ n6| j |¡}| |dk¡ | j |¡}| |dk¡ 0 d S rw ) rW Z ENGINE_by_idZ Cryptography_osrandom_engine_idrm rU rq Z ENGINE_initZ ENGINE_freery rz rP rP rQ Ú_get_osurandom_engineå s ü z Backend._get_osurandom_enginec C st | j jrp| ¡ | ¡ *}| j |¡}| |dk¡ W d ƒ n1 sH0 Y | j | jj¡}| |dk¡ d S rw ) rW r] r} r~ ZENGINE_set_default_RANDrm rx rU rq rz rP rP rQ ra ù s
,z Backend.activate_osrandom_enginec C st | j dd¡}| ¡ <}| j |dt|ƒ|| j jd¡}| |dk¡ W d ƒ n1 sX0 Y | j |¡ d¡S )Núchar[]é@ s get_implementationr Úascii)
rU Únewr~ rW ZENGINE_ctrl_cmdÚlenrq rm ÚstringÚdecode)rf Úbufr{ r| rP rP rQ Ú osrandom_engine_implementation s
ÿ,z&Backend.osrandom_engine_implementationc C s | j | j | jj¡¡ d¡S )zÀ
Friendly string name of the loaded OpenSSL library. This is not
necessarily the same version as it was compiled against.
Example: OpenSSL 1.1.1d 10 Sep 2019
r )rU r„ rW ZOpenSSL_versionZOPENSSL_VERSIONr… re rP rP rQ ri s
ÿþz Backend.openssl_version_textc C s
| j ¡ S ru )rW ZOpenSSL_version_numre rP rP rQ Úopenssl_version_number s z Backend.openssl_version_numberc C s t | ||ƒS ru r )rf ÚkeyÚ algorithmrP rP rQ Úcreate_hmac_ctx s zBackend.create_hmac_ctxc C sL |j dks|j dkr0d |j |jd ¡ d¡}n |j d¡}| j |¡}|S )NZblake2bZblake2sz{}{}é r )Únamerh Z digest_sizeÚencoderW ZEVP_get_digestbyname)rf rŠ ZalgÚevp_mdrP rP rQ Ú_evp_md_from_algorithm s ÿþ z Backend._evp_md_from_algorithmc C s | |¡}| || jjk¡ |S ru )r rm rU rq ©rf rŠ r rP rP rQ Ú _evp_md_non_null_from_algorithm* s
z'Backend._evp_md_non_null_from_algorithmc C s, | j rt|| jƒsdS | |¡}|| jjkS ©NF)rZ Ú
isinstanceÚ _fips_hashesr rU rq r‘ rP rP rQ Úhash_supported/ s
zBackend.hash_supportedc C s | j r
dS | jjdkS d S ©NFrS )rZ rW ZCryptography_HAS_SCRYPTre rP rP rQ Úscrypt_supported6 s zBackend.scrypt_supportedc C s | j rt|tjƒrdS | |¡S ©NT)rZ r” r' ÚSHA1r– ©rf rŠ rP rP rQ Úhmac_supported< s zBackend.hmac_supportedc C s
t | |ƒS ru r r› rP rP rQ Úcreate_hash_ctxC s zBackend.create_hash_ctxc C s^ | j rt|| jƒsdS z| jt|ƒt|ƒf }W n tyD Y dS 0 || ||ƒ}| jj|kS r“ )rZ r” Ú
_fips_ciphersr[ ÚtypeÚKeyErrorrU rq )rf Úcipherrt ÚadapterÚ
evp_cipherrP rP rQ Úcipher_supportedF s zBackend.cipher_supportedc C s0 ||f| j v r td ||¡ƒ‚|| j ||f< d S )Nz"Duplicate registration for: {} {}.)r[ Ú
ValueErrorrh )rf Ú
cipher_clsÚmode_clsr¢ rP rP rQ Úregister_cipher_adapterT s ÿÿz Backend.register_cipher_adapterc C s~ t ttttttfD ]}| t|t dƒ¡ qt ttttfD ]}| t
|t dƒ¡ q8t tttfD ]}| t |t dƒ¡ q\| t tt dƒ¡ t tttfD ]}| t |t dƒ¡ q’t tttfD ]}| t
|t dƒ¡ q¶t ttgt tttg¡D ]\}}| ||t dƒ¡ qæ| ttd ƒt dƒ¡ | ttd ƒt dƒ¡ | ttd ƒt d ƒ¡ | ttt¡ tt tttfD ]}| t|t d
ƒ¡ q`d S ) Nz+{cipher.name}-{cipher.key_size}-{mode.name}zdes-ede3-{mode.name}zdes-ede3zbf-{mode.name}zseed-{mode.name}z{cipher.name}-{mode.name}Zrc4Zrc2Zchacha20zsm4-{mode.name})r< r? r@ rB r= r> rA r¨ r2 ÚGetCipherByNamer6 r; r4 r9 Ú itertoolsÚproductr5 r8 r3 rŸ rL r7 rC Ú_get_xts_cipherr: )rf r§ r¦ rP rP rQ r\ ] s\ ýý
ÿ
ÿ
ÿ
ÿ
þ ýÿ
ÿz!Backend._register_default_ciphersc C s t | ||t jƒS ru )r Z_ENCRYPT©rf r¡ rt rP rP rQ Ú create_symmetric_encryption_ctxŽ s z'Backend.create_symmetric_encryption_ctxc C s t | ||t jƒS ru )r Z_DECRYPTr rP rP rQ Ú create_symmetric_decryption_ctx‘ s z'Backend.create_symmetric_decryption_ctxc C s
| |¡S ru )rœ r› rP rP rQ Úpbkdf2_hmac_supported” s z Backend.pbkdf2_hmac_supportedc
C sh | j d|¡}| |¡}| j |¡}| j |t|ƒ|t|ƒ||||¡} | | dk¡ | j |¡d d … S )Núunsigned char[]rS ) rU r‚ r’ Ú from_bufferrW ZPKCS5_PBKDF2_HMACrƒ rm Úbuffer)
rf rŠ ÚlengthÚsaltZ
iterationsÚ key_materialr† r Úkey_material_ptrr| rP rP rQ Úderive_pbkdf2_hmac— s
ø
zBackend.derive_pbkdf2_hmacc C s t | j¡S ru )r& Ú_consume_errorsrW re rP rP rQ r¹ ª s zBackend._consume_errorsc C s t | j¡S ru )r& Ú_consume_errors_with_textrW re rP rP rQ rº s z!Backend._consume_errors_with_textc C sz || j jksJ ‚| | j |¡ ¡ | j |¡}| j d|¡}| j ||¡}| |dk¡ t | j
|¡d |… d¡}|S )Nr± r Úbig) rU rq rm rW ZBN_is_negativeZ BN_num_bytesr‚ Z BN_bn2binÚintÚ
from_bytesr³ )rf ÚbnZ bn_num_bytesZbin_ptrZbin_lenÚvalrP rP rQ Ú
_bn_to_int° s zBackend._bn_to_intc C sn |du s|| j jksJ ‚|du r(| j j}| t| ¡ d d ƒd¡}| j |t|ƒ|¡}| || j jk¡ |S )a
Converts a python integer to a BIGNUM. The returned BIGNUM will not
be garbage collected (to support adding them to structs that take
ownership of the object). Be sure to register it for GC if it will
be discarded after use.
Ng @rS r» ) rU rq Úto_bytesr¼ Ú
bit_lengthrW Z BN_bin2bnrƒ rm )rf Únumr¾ ZbinaryZbn_ptrrP rP rQ Ú
_int_to_bn¼ s zBackend._int_to_bnc C s” t ||¡ | j ¡ }| || jjk¡ | j || jj¡}| |¡}| j || jj
¡}| j |||| jj¡}| |dk¡ | |¡}t
| ||| jƒS rw )r- Z_verify_rsa_parametersrW ÚRSA_newrm rU rq ÚgcÚRSA_freerÄ ÚBN_freeZRSA_generate_key_exÚ_rsa_cdata_to_evp_pkeyr rX )rf Úpublic_exponentÚkey_sizeÚ rsa_cdatar¾ r| Úevp_pkeyrP rP rQ Úgenerate_rsa_private_keyÍ s
ÿ
ÿz Backend.generate_rsa_private_keyc C s |dko|d@ dko|dkS )Né rS r i rP )rf rÊ rË rP rP rQ Ú!generate_rsa_parameters_supportedá s
ÿýz)Backend.generate_rsa_parameters_supportedc
C s6 t |j|j|j|j|j|j|jj |jj
¡ | j ¡ }|
|| jjk¡ | j || j j¡}| |j¡}| |j¡}| |j¡}| |j¡}| |j¡}| |j¡}| |jj ¡} | |jj
¡}
| j |||¡} |
| dk¡ | j ||
| |¡} |
| dk¡ | j ||||¡} |
| dk¡ | |¡} t| || | jƒS rw )r- Z _check_private_key_componentsÚpÚqÚdÚdmp1Údmq1ÚiqmpÚpublic_numbersr{ ÚnrW rÅ rm rU rq rÆ rÇ rÄ ZRSA_set0_factorsÚ RSA_set0_keyZRSA_set0_crt_paramsrÉ r rX )
rf ÚnumbersrÌ rÑ rÒ rÓ rÔ rÕ rÖ r{ rØ r| rÍ rP rP rQ Úload_rsa_private_numbersè s> ø
ÿz Backend.load_rsa_private_numbersc C s t |j|j¡ | j ¡ }| || jjk¡ | j || jj
¡}| |j¡}| |j¡}| j |||| jj¡}| |dk¡ |
|¡}t| ||ƒS rw )r- Z _check_public_key_componentsr{ rØ rW rÅ rm rU rq rÆ rÇ rÄ rÙ rÉ r! )rf rÚ rÌ r{ rØ r| rÍ rP rP rQ Úload_rsa_public_numbers
s
z Backend.load_rsa_public_numbersc C s2 | j ¡ }| || jjk¡ | j || j j¡}|S ru )rW Z EVP_PKEY_newrm rU rq rÆ Ú
EVP_PKEY_free©rf rÍ rP rP rQ Ú_create_evp_pkey_gc s
zBackend._create_evp_pkey_gcc C s( | ¡ }| j ||¡}| |dk¡ |S rw )rß rW ZEVP_PKEY_set1_RSArm )rf rÌ rÍ r| rP rP rQ rÉ s z Backend._rsa_cdata_to_evp_pkeyc C sH | j |¡}| j |t|ƒ¡}| || j jk¡ t| j || jj ¡|ƒS )z®
Return a _MemoryBIO namedtuple of (BIO, char*).
The char* is the storage for the BIO and it must stay alive until the
BIO is finished with.
)
rU r² rW ZBIO_new_mem_bufrƒ rm rq rJ rÆ ÚBIO_free)rf ÚdataÚdata_ptrrK rP rP rQ Ú
_bytes_to_bio# s zBackend._bytes_to_bioc C sP | j ¡ }| || jjk¡ | j |¡}| || jjk¡ | j || j j¡}|S )z.
Creates an empty memory BIO.
)rW Z BIO_s_memrm rU rq ZBIO_newrÆ rà )rf Z
bio_methodrK rP rP rQ Ú_create_mem_bio_gc0 s
zBackend._create_mem_bio_gcc C s\ | j d¡}| j ||¡}| |dk¡ | |d | j jk¡ | j |d |¡dd… }|S )zE
Reads a memory BIO. This only works on memory BIOs.
zchar **r N)rU r‚ rW ZBIO_get_mem_datarm rq r³ )rf rK r† Zbuf_lenÚbio_datarP rP rQ Ú
_read_mem_bio; s zBackend._read_mem_bioc C s´ | j |¡}|| j jkrX| j |¡}| || jjk¡ | j || j j¡}t | ||| j
ƒS || j j kr | j |¡}| || jjk¡ | j || j j
¡}t| ||ƒS || j jkrè| j |¡}| || jjk¡ | j || j j¡}t| ||ƒS || jv r0| j |¡}| || jjk¡ | j || j j¡}t| ||ƒS |t| j ddƒkrNt| |ƒS |t| j ddƒkrlt| |ƒS |t| j ddƒkrŠt| |ƒS |t| j ddƒkr¨t| |ƒS t dƒ‚dS )zd
Return the appropriate type of PrivateKey given an evp_pkey cdata
pointer.
ÚEVP_PKEY_ED25519NÚ
EVP_PKEY_X448ÚEVP_PKEY_X25519ÚEVP_PKEY_ED448úUnsupported key type.) rW Ú EVP_PKEY_idÚ EVP_PKEY_RSAÚEVP_PKEY_get1_RSArm rU rq rÆ rÇ r rX Ú EVP_PKEY_DSAÚEVP_PKEY_get1_DSAÚDSA_freer Ú EVP_PKEY_ECÚEVP_PKEY_get1_EC_KEYÚ EC_KEY_freer rb ÚEVP_PKEY_get1_DHÚDH_freer
rr r r$ r" r r ©rf rÍ Úkey_typerÌ Ú dsa_cdataÚec_cdataÚdh_cdatarP rP rQ Ú_evp_pkey_to_private_keyF s@
ÿ
z Backend._evp_pkey_to_private_keyc C s° | j |¡}|| j jkrT| j |¡}| || jjk¡ | j || j j¡}t | ||ƒS || j j
krœ| j |¡}| || jjk¡ | j || j j ¡}t
| ||ƒS || j jkrä| j |¡}| || jjk¡ | j || j j¡}t| ||ƒS || jv r,| j |¡}| || jjk¡ | j || j j¡}t| ||ƒS |t| j ddƒkrJt| |ƒS |t| j ddƒkrht| |ƒS |t| j ddƒkr†t| |ƒS |t| j ddƒkr¤t| |ƒS tdƒ‚dS )zc
Return the appropriate type of PublicKey given an evp_pkey cdata
pointer.
rç Nrè ré rê rë ) rW rì rí rî rm rU rq rÆ rÇ r! rï rð rñ r rò ró rô r rb rõ rö r rr r r% r# r r r÷ rP rP rQ Ú_evp_pkey_to_public_keys s<
z Backend._evp_pkey_to_public_keyc C s6 | j jr&t|tjtjtjtjtjfƒS t|tjƒS d S ru ) rW Z Cryptography_HAS_RSA_OAEP_MDr” r' rš ÚSHA224ÚSHA256ÚSHA384ÚSHA512r› rP rP rQ Ú_oaep_hash_supportedž s ûþ z Backend._oaep_hash_supportedc C sª t |tƒrdS t |tƒrNt |jtƒrN| jr>t |jjtjƒr>dS | |jj¡S nXt |t
ƒr¢t |jtƒr¢| |jj¡o | |j¡o |j d u p t
|j ƒdkp | jjdkS dS d S )NTr rS F)r” r0 r1 Z_mgfr. rZ Z
_algorithmr' rš r– r/ r Z_labelrƒ rW Z Cryptography_HAS_RSA_OAEP_LABEL)rf ZpaddingrP rP rQ Úrsa_padding_supported s
ÿ
ÿ
û z Backend.rsa_padding_supportedc C s~ |dvrt dƒ‚| j ¡ }| || jjk¡ | j || jj¡}| j ||| jjd| jj| jj| jj¡}| |dk¡ t | |ƒS )N)i rR i i z0Key size must be 1024, 2048, 3072, or 4096 bits.r rS )
r¥ rW ÚDSA_newrm rU rq rÆ rñ ZDSA_generate_parameters_exr )rf rË Úctxr| rP rP rQ Úgenerate_dsa_parametersÄ s$ ÿ
ù
z Backend.generate_dsa_parametersc C sT | j |j¡}| || jjk¡ | j || j j¡}| j |¡ | |¡}t
| ||ƒS ru ) rW Z
DSAparams_dupZ
_dsa_cdatarm rU rq rÆ rñ ZDSA_generate_keyÚ_dsa_cdata_to_evp_pkeyr )rf Ú
parametersr rÍ rP rP rQ Úgenerate_dsa_private_keyÜ s
z Backend.generate_dsa_private_keyc C s | |¡}| |¡S ru )r r )rf rË r rP rP rQ Ú'generate_dsa_private_key_and_parameterså s
z/Backend.generate_dsa_private_key_and_parametersc C sB | j ||||¡}| |dk¡ | j |||¡}| |dk¡ d S rw )rW Ú DSA_set0_pqgrm Z DSA_set0_key)rf rù rÑ rÒ ÚgÚpub_keyÚpriv_keyr| rP rP rQ Ú_dsa_cdata_set_valuesé s z Backend._dsa_cdata_set_valuesc
C s¨ t |¡ |jj}| j ¡ }| || jjk¡ | j || jj
¡}| |j ¡}| |j
¡}| |j¡}| |jj¡}| |j¡}| ||||||¡ | |¡} t| || ƒS ru )r* Z_check_dsa_private_numbersr× Úparameter_numbersrW r rm rU rq rÆ rñ rÄ rÑ rÒ r ÚyÚxr r r )
rf rÚ r rù rÑ rÒ r r
r rÍ rP rP rQ Úload_dsa_private_numbersï s
z Backend.load_dsa_private_numbersc C s¢ t |j¡ | j ¡ }| || jjk¡ | j || jj ¡}|
|jj ¡}|
|jj ¡}|
|jj
¡}|
|j¡}| jj}| ||||||¡ | |¡}t| ||ƒS ru )r* Ú_check_dsa_parametersr rW r rm rU rq rÆ rñ rÄ rÑ rÒ r r r r r ) rf rÚ rù rÑ rÒ r r
r rÍ rP rP rQ Úload_dsa_public_numbers s
z Backend.load_dsa_public_numbersc C s† t |¡ | j ¡ }| || jjk¡ | j || jj¡}| |j
¡}| |j ¡}| |j ¡}| j
||||¡}| |dk¡ t| |ƒS rw )r* r rW r rm rU rq rÆ rñ rÄ rÑ rÒ r r r )rf rÚ rù rÑ rÒ r r| rP rP rQ Úload_dsa_parameter_numbers s
z"Backend.load_dsa_parameter_numbersc C s( | ¡ }| j ||¡}| |dk¡ |S rw )rß rW ZEVP_PKEY_set1_DSArm )rf rù rÍ r| rP rP rQ r ! s z Backend._dsa_cdata_to_evp_pkey)Úreturnc C s | j S ru )rZ re rP rP rQ Ú
dsa_supported' s zBackend.dsa_supported)rŠ r c C s | ¡ s dS | |¡S r“ )r r– r› rP rP rQ Údsa_hash_supported* s zBackend.dsa_hash_supportedc C s dS r™ rP )rf rÑ rÒ r rP rP rQ Údsa_parameters_supported/ s z Backend.dsa_parameters_supportedc C s | |td|j ƒ¡S )Nó )r¤ r< Z
block_sizer› rP rP rQ Úcmac_algorithm_supported2 s ÿz Backend.cmac_algorithm_supportedc C s
t | |ƒS ru r
r› rP rP rQ Úcreate_cmac_ctx7 s zBackend.create_cmac_ctxc C s | | jj| j||¡S ru )Ú _load_keyrW ZPEM_read_bio_PrivateKeyrü )rf rá ÚpasswordrP rP rQ Úload_pem_private_key: s üz Backend.load_pem_private_keyc C sÖ | |¡}| j |j| jj| jj| jj¡}|| jjkrR| j || jj¡}| |¡S | ¡ | j
|j¡}| |dk¡ | j |j| jj| jj| jj¡}|| jjkrÊ| j || jj
¡}| |¡}t| ||ƒS | ¡ d S rw )rã rW ZPEM_read_bio_PUBKEYrK rU rq rÆ rÝ rý r¹ Ú BIO_resetrm ZPEM_read_bio_RSAPublicKeyrÇ rÉ r! Ú_handle_key_loading_error©rf rá Úmem_biorÍ r| rÌ rP rP rQ Úload_pem_public_keyB s$
ÿ
ÿ
zBackend.load_pem_public_keyc C s^ | |¡}| j |j| jj| jj| jj¡}|| jjkrR| j || jj¡}t| |ƒS | ¡ d S ru )
rã rW ZPEM_read_bio_DHparamsrK rU rq rÆ rö r r" )rf rá r$ rû rP rP rQ Úload_pem_parameters[ s
ÿ
zBackend.load_pem_parametersc C s> | |¡}| ||¡}|r$| |¡S | | jj| j||¡S d S ru )rã Ú"_evp_pkey_from_der_traditional_keyrü r rW Zd2i_PKCS8PrivateKey_bio)rf rá r rå r‰ rP rP rQ Úload_der_private_keyg s
üz Backend.load_der_private_keyc C s^ | j |j| jj¡}|| jjkrN| ¡ | j || j j¡}|d urJtdƒ‚|S | ¡ d S d S )Nú4Password was given but private key is not encrypted.) rW Úd2i_PrivateKey_biorK rU rq r¹ rÆ rÝ Ú TypeError)rf rå r r‰ rP rP rQ r' z s ÿz*Backend._evp_pkey_from_der_traditional_keyc C s¾ | |¡}| j |j| jj¡}|| jjkrF| j || jj¡}| |¡S | ¡ | j
|j¡}| |dk¡ | j |j| jj¡}|| jjkr²| j || jj
¡}| |¡}t| ||ƒS | ¡ d S rw )rã rW Zd2i_PUBKEY_biorK rU rq rÆ rÝ rý r¹ r! rm Zd2i_RSAPublicKey_biorÇ rÉ r! r" r# rP rP rQ Úload_der_public_key s
ÿ
zBackend.load_der_public_keyc C sº | |¡}| j |j| jj¡}|| jjkrF| j || jj¡}t| |ƒS | jj r®|
¡ | j |j¡}| |dk¡ | j
|j| jj¡}|| jjkr®| j || jj¡}t| |ƒS | ¡ d S rw )rã rW Zd2i_DHparams_biorK rU rq rÆ rö r rc r¹ r! rm Z Cryptography_d2i_DHxparams_bior" )rf rá r$ rû r| rP rP rQ Úload_der_parameters¤ s
ÿ
zBackend.load_der_parameters)Úcertr c C sT | tjj¡}| |¡}| j |j| jj ¡}|
|| jj k¡ | j || jj ¡}|S ru )
Ú public_bytesr( ÚEncodingÚDERrã rW Z d2i_X509_biorK rU rq rm rÆ Ú X509_free)rf r. rá r$ r rP rP rQ Ú
_cert2ossl¸ s
zBackend._cert2ossl)r r c C s4 | ¡ }| j ||¡}| |dk¡ t | |¡¡S rw )rä rW Z i2d_X509_biorm Ú rust_x509Zload_der_x509_certificateræ )rf r rK r| rP rP rQ Ú
_ossl2certÀ s zBackend._ossl2cert)Úcsrr c C sT | tjj¡}| |¡}| j |j| jj ¡}|
|| jj k¡ | j || jj ¡}|S ru )
r/ r( r0 r1 rã rW Zd2i_X509_REQ_biorK rU rq rm rÆ Z
X509_REQ_free)rf r6 rá r$ Úx509_reqrP rP rQ Ú _csr2osslÆ s
zBackend._csr2ossl)r7 r c C s4 | ¡ }| j ||¡}| |dk¡ t | |¡¡S rw )rä rW Zi2d_X509_REQ_biorm r4 Zload_der_x509_csrræ )rf r7 rK r| rP rP rQ Ú _ossl2csrÎ s zBackend._ossl2csr)Úcrlr c C sT | tjj¡}| |¡}| j |j| jj ¡}|
|| jj k¡ | j || jj ¡}|S ru )
r/ r( r0 r1 rã rW Zd2i_X509_CRL_biorK rU rq rm rÆ Z
X509_CRL_free)rf r: rá r$ Úx509_crlrP rP rQ Ú _crl2osslÖ s
zBackend._crl2ossl)r; r c C s4 | ¡ }| j ||¡}| |dk¡ t | |¡¡S rw )rä rW Zi2d_X509_CRL_biorm r4 Zload_der_x509_crlræ )rf r; rK r| rP rP rQ Ú _ossl2crlÞ s zBackend._ossl2crl)r: Ú
public_keyr c C sJ t |tttfƒstdƒ‚| |¡}| j ||j¡}|dkrF| ¡ dS dS )NzGExpecting one of DSAPublicKey, RSAPublicKey, or EllipticCurvePublicKey.rS FT)
r” r r! r r+ r< rW ZX509_CRL_verifyÚ _evp_pkeyr¹ )rf r: r> r; r| rP rP rQ Ú_crl_is_signature_validæ s ýþÿ
z Backend._crl_is_signature_validc C s` | |¡}| j |¡}| || jjk¡ | j || jj¡}| j ||¡}|dkr\| ¡ dS dS )NrS FT)
r8 rW ZX509_REQ_get_pubkeyrm rU rq rÆ rÝ ZX509_REQ_verifyr¹ )rf r6 r7 Zpkeyr| rP rP rQ Ú_csr_is_signature_validþ s
z Backend._csr_is_signature_validc C s" | j |j|j¡dkr tdƒ‚d S )NrS zKeys do not correspond)rW Z EVP_PKEY_cmpr? r¥ )rf Zkey1Zkey2rP rP rQ Ú_check_keys_correspond
s z Backend._check_keys_correspondc C s& | |¡}| j d¡}|d urFt d|¡ | j |¡}||_t|ƒ|_||j | jj
| j | j j
d¡|ƒ}|| jj
krÆ|jdkr¾| ¡ |jdkrštdƒ‚qÆ|jdks¨J ‚td |jd ¡ƒ‚n| ¡ | ¡ | j || j j¡}|d urú|jdkrútd
ƒ‚|d ur|jd ks |d u s J ‚||ƒS ) Nz CRYPTOGRAPHY_PASSWORD_DATA *r Z Cryptography_pem_password_cbr éÿÿÿÿz3Password was not given but private key is encryptedéþÿÿÿzAPasswords longer than {} bytes are not supported by this backend.rS r) )rã rU r‚ r Ú_check_bytesliker² r rƒ r´ rK rq Z addressofrW Z
_original_libÚerrorr¹ r+ r¥ rh Úmaxsizer" rÆ rÝ Zcalled) rf Zopenssl_read_funcZ convert_funcrá r r$ ZuserdataZ password_ptrrÍ rP rP rQ r sT
ÿú
ÿÿÿÿÿÿþzBackend._load_keyc s¨ ˆ ¡ }|stdƒ‚nŽ|d ˆ jjˆ jj¡sf|d ˆ jjˆ jj¡sfˆ jjrp|d ˆ jj ˆ jj
¡rptdƒ‚n4t ‡ fdd„|D ƒƒrtdƒ‚nt
|¡}td|ƒ‚d S )Nz|Could not deserialize key data. The data may be in an incorrect format or it may be encrypted with an unsupported algorithm.r z Bad decrypt. Incorrect password?c 3 s" | ]}| ˆ jjˆ jj¡V qd S ru )Ú_lib_reason_matchrW Ú ERR_LIB_EVPZ'EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM)Ú.0rF re rP rQ Ú b s
üþz4Backend._handle_key_loading_error..z!Unsupported public key algorithm.zÊCould not deserialize key data. The data may be in an incorrect format, it may be encrypted with an unsupported algorithm, or it may be an unsupported key type (e.g. EC curves with explicit parameters).)r¹ r¥ rH rW rI ZEVP_R_BAD_DECRYPTZERR_LIB_PKCS12Z!PKCS12_R_PKCS12_CIPHERFINAL_ERRORZCryptography_HAS_PROVIDERSZ ERR_LIB_PROVZPROV_R_BAD_DECRYPTÚanyr& Z_errors_with_text)rf rk rP re rQ r" F s> ÿ ÿÿþü ÷
þö
û
ûz!Backend._handle_key_loading_errorc C st z| |¡}W n ty( | jj}Y n0 | j |¡}|| jjkrN| ¡ dS | || jjk¡ | j |¡ dS d S )NFT)
Ú_elliptic_curve_to_nidr rW Ú NID_undefZEC_GROUP_new_by_curve_namerU rq r¹ rm Z
EC_GROUP_free)rf ÚcurveÚ curve_nidÚgrouprP rP rQ Úelliptic_curve_supportedu s z Backend.elliptic_curve_supportedc C s t |tjƒsdS | |¡S r“ )r” r+ ZECDSArR )rf Zsignature_algorithmrO rP rP rQ Ú,elliptic_curve_signature_algorithm_supported… s z4Backend.elliptic_curve_signature_algorithm_supportedc C s\ | |¡rD| |¡}| j |¡}| |dk¡ | |¡}t| ||ƒS td |j ¡t
j ƒ‚dS )z@
Generate a new private key on the named curve.
rS z#Backend object does not support {}.N) rR Ú_ec_key_new_by_curverW ZEC_KEY_generate_keyrm Ú_ec_cdata_to_evp_pkeyr r rh r r ÚUNSUPPORTED_ELLIPTIC_CURVE)rf rO rú r| rÍ rP rP rQ Ú#generate_elliptic_curve_private_keyŽ s
þz+Backend.generate_elliptic_curve_private_keyc C sz |j }| |j¡}| j | |j¡| jj¡}| j ||¡}|dkrR|
¡ t dƒ‚| ||j
|j¡}| |¡}t| ||ƒS )NrS úInvalid EC key.)r× rT rO rU rÆ rÄ Ú
private_valuerW Ú
BN_clear_freeÚEC_KEY_set_private_keyr¹ r¥ Ú)_ec_key_set_public_key_affine_coordinatesr r rU r )rf rÚ Zpublicrú rY r| rÍ rP rP rQ Ú#load_elliptic_curve_private_numbers¢ s ÿ
ÿ
z+Backend.load_elliptic_curve_private_numbersc C s4 | |j¡}| ||j|j¡}| |¡}t| ||ƒS ru )rT rO r\ r r rU r )rf rÚ rú rÍ rP rP rQ Ú"load_elliptic_curve_public_numbers· s
ÿ
z*Backend.load_elliptic_curve_public_numbersc C sâ | |¡}| j |¡}| || jjk¡ | j |¡}| || jjk¡ | j || jj¡}| ¡ @}| j
|||t |ƒ|¡}|dkr’| ¡ t
dƒ‚W d ƒ n1 s¦0 Y | j ||¡}| |dk¡ | |¡}t| ||ƒS )NrS z(Invalid public bytes for the given curve)rT rW ÚEC_KEY_get0_grouprm rU rq Ú EC_POINT_newrÆ Ú
EC_POINT_freeÚ _tmp_bn_ctxZEC_POINT_oct2pointrƒ r¹ r¥ ÚEC_KEY_set_public_keyrU r ) rf rO Z point_bytesrú rQ ÚpointÚbn_ctxr| rÍ rP rP rQ Ú load_elliptic_curve_public_bytesÀ s"
ÿ&
z(Backend.load_elliptic_curve_public_bytesc C sb | |¡}| |¡\}}| j |¡}| || jjk¡ | j || jj¡}| |¡}| j || jj
¡}| ¡ |}| j |||| jj| jj|¡} | | dk¡ | j
|¡}
| j
|¡} ||||
| |ƒ} | dkrÚ| ¡ tdƒ‚W d ƒ n1 sî0 Y | j ||¡} | | dk¡ | |¡} | j | | jj
¡} | j || ¡} | | dk¡ | |¡}
t| ||
ƒS )NrS z'Unable to derive key from private_value)rT Ú _ec_key_determine_group_get_funcrW r` rm rU rq rÆ ra rÄ rZ rb Z EC_POINT_mulZ
BN_CTX_getr¹ r¥ rc r[ rU r )rf rY rO rú Úget_funcrQ rd Úvaluere r| Zbn_xZbn_yZprivaterÍ rP rP rQ Ú!derive_elliptic_curve_private_keyÔ s4
ÿ &
z)Backend.derive_elliptic_curve_private_keyc C s | |¡}| |¡S ru )rM Ú_ec_key_new_by_curve_nid)rf rO rP rP rP rQ rT ù s
z Backend._ec_key_new_by_curvec C s0 | j |¡}| || jjk¡ | j || j j¡S ru )rW ZEC_KEY_new_by_curve_namerm rU rq rÆ rô )rf rP rú rP rP rQ rk ý s z Backend._ec_key_new_by_curve_nidc C s, | j rt|| jƒsdS | |¡o*t|tjƒS r“ )rZ r” Ú_fips_ecdh_curvesrR r+ ZECDH)rf rŠ rO rP rP rQ Ú+elliptic_curve_exchange_algorithm_supported s ÿ ÿz3Backend.elliptic_curve_exchange_algorithm_supportedc C s( | ¡ }| j ||¡}| |dk¡ |S rw )rß rW ZEVP_PKEY_set1_EC_KEYrm )rf rú rÍ r| rP rP rQ rU s z Backend._ec_cdata_to_evp_pkeyc C sN dddœ}| |j|j¡}| j | ¡ ¡}|| jjkrJtd |j¡tj ƒ‚|S )z/
Get the NID for a curve name.
Z
prime192v1Z
prime256v1)Z secp192r1Z secp256r1z${} is not a supported elliptic curve)
Úgetr rW Ú
OBJ_sn2nidrŽ rN r rh r rV )rf rO Z
curve_aliasesZ
curve_namerP rP rP rQ rM s
þz Backend._elliptic_curve_to_nidc c sd | j ¡ }| || jjk¡ | j || j j¡}| j |¡ z|V W | j |¡ n| j |¡ 0 d S ru ) rW Z
BN_CTX_newrm rU rq rÆ Z BN_CTX_freeZ BN_CTX_startZ
BN_CTX_end)rf re rP rP rQ rb # s
zBackend._tmp_bn_ctxc C s¼ | || jjk¡ | j d¡}| || jjk¡ | j |¡}| || jjk¡ | j |¡}| || jjk¡ | j |¡}| || jjk¡ ||kr¤| jj r¤| jj
}n| jj }|s´J ‚||fS )zu
Given an EC_KEY determine the group and what function is required to
get point coordinates.
s characteristic-two-field) rm rU rq rW ro rN r_ ZEC_GROUP_method_ofZEC_METHOD_get_field_typeZCryptography_HAS_EC2MZ$EC_POINT_get_affine_coordinates_GF2mZ#EC_POINT_get_affine_coordinates_GFp)rf r Z
nid_two_fieldrQ ÚmethodÚnidrh rP rP rQ rg . s
z(Backend._ec_key_determine_group_get_funcc C st |dk s|dk rt dƒ‚| j | |¡| jj¡}| j | |¡| jj¡}| j |||¡}|dkrp| ¡ t dƒ‚|S )zg
Sets the public key point in the EC_KEY context to the affine x and y
values.
r z2Invalid EC key. Both x and y must be non-negative.rS rX )r¥ rU rÆ rÄ rW rÈ Z(EC_KEY_set_public_key_affine_coordinatesr¹ )rf r r r r| rP rP rQ r\ J s ÿz1Backend._ec_key_set_public_key_affine_coordinatesc
C s( t |tjƒstdƒ‚t |tjƒs(tdƒ‚t |tjƒs| j
j}n | | j
jkrV| j
j}nt
d
ƒ‚| |||¡S |tjju rä|rˆt
d ƒ‚| | j
jkr | j
j}n8| | j
jkr¸| j
j }n | | j
jkrÐ| j
j }nt
d
ƒ‚| ||¡S t
d ƒ‚|tjj u r |tjj u rt !||¡S t
d
ƒ‚t
dƒ‚d S )Nú/encoding must be an item from the Encoding enumz2format must be an item from the PrivateFormat enumzBEncryption algorithm must be a KeySerializationEncryption instancerp iÿ zBPasswords longer than 1023 bytes are not supported by this backendzUnsupported encryption typez Unsupported encoding for PKCS8zCEncrypted traditional OpenSSL format is not supported in FIPS mode.z+Unsupported key type for TraditionalOpenSSLzDEncryption is not supported for DER encoded traditional OpenSSL keysz+Unsupported encoding for TraditionalOpenSSLz=OpenSSH private key format can only be used with PEM encodingú format is invalid with this key)"r” r( r0 r+ Z
PrivateFormatZKeySerializationEncryptionÚ NoEncryptionÚBestAvailableEncryptionr rƒ r¥ ZPKCS8ÚPEMrW Z PEM_write_bio_PKCS8PrivateKeyr1 Zi2d_PKCS8PrivateKey_bioÚ_private_key_bytes_via_bioZTraditionalOpenSSLrZ rì rí ZPEM_write_bio_RSAPrivateKeyrï ZPEM_write_bio_DSAPrivateKeyrò ZPEM_write_bio_ECPrivateKeyZi2d_RSAPrivateKey_bioZi2d_ECPrivateKey_bioZi2d_DSAPrivateKey_bioÚ_bio_func_outputÚOpenSSHrF Zserialize_ssh_private_key)
rf Úencodingrh Úencryption_algorithmr‰ rÍ Úcdatar Ú write_biorø rP rP rQ Ú_private_key_bytes^ s˜ ÿÿÿ ÿ ÿ
ÿÿÿ
ÿÿÿ
ÿ ÿzBackend._private_key_bytesc C s< |s| j j}n | j d¡}| ||||t|ƒ| j j| j j¡S )Ns aes-256-cbc)rU rq rW ÚEVP_get_cipherbynamerx rƒ )rf r} rÍ r r£ rP rP rQ rw Ç s
ùz"Backend._private_key_bytes_via_bioc G s0 | ¡ }||g|¢R Ž }| |dk¡ | |¡S rw )rä rm ræ )rf r} ÚargsrK r| rP rP rQ rx Ø s zBackend._bio_func_outputc C s t |tjƒstdƒ‚t |tjƒs(tdƒ‚|tjju rt|tjju rJ| jj}n |tjj u r`| jj
}nt dƒ‚| ||¡S |tjj
u rà| j |¡}|| jjkr t dƒ‚|tjju r¶| jj}n |tjj u rÌ| jj}nt dƒ‚| ||¡S |tjju r|tjju rt |¡S t dƒ‚t dƒ‚d S )Nrr z1format must be an item from the PublicFormat enumz8SubjectPublicKeyInfo works only with PEM or DER encodingz+PKCS1 format is supported only for RSA keysz)PKCS1 works only with PEM or DER encodingz1OpenSSH format must be used with OpenSSH encodingrs )r” r( r0 r+ Z PublicFormatZSubjectPublicKeyInforv rW ZPEM_write_bio_PUBKEYr1 Zi2d_PUBKEY_bior¥ rx ZPKCS1rì rí ZPEM_write_bio_RSAPublicKeyZi2d_RSAPublicKey_biory rF Zserialize_ssh_public_key)rf rz rh r‰ rÍ r| r} rø rP rP rQ Ú_public_key_bytesÞ s@ ÿ
ÿ
ÿzBackend._public_key_bytesc C sÌ |t jju rtdƒ‚| j d¡}| j || jj|| jj¡ |t jj u rj|d | jjkr`| jj
}q¢| jj }n8|t jj u rš|d | jjkr| jj
}q¢| jj}ntdƒ‚| ¡ }|||ƒ}| |dk¡ | |¡S )Nz!OpenSSH encoding is not supportedz BIGNUM **r rr rS )r( r0 ry r+ rU r‚ rW Z DH_get0_pqgrq rv ZPEM_write_bio_DHxparamsZPEM_write_bio_DHparamsr1 Z Cryptography_i2d_DHxparams_bioZi2d_DHparams_biorä rm ræ )rf rz rh r| rÒ r} rK r| rP rP rQ Ú_parameter_bytes s"
zBackend._parameter_bytesc C s
| j j S ru ©rW ÚCRYPTOGRAPHY_IS_BORINGSSLre rP rP rQ Ú dh_supported' s zBackend.dh_supportedc C s† |t jk rtd t j¡ƒ‚|dvr*tdƒ‚| j ¡ }| || jjk¡ | j || jj
¡}| j |||| jj¡}| |dk¡ t | |ƒS )Nz$DH key_size must be at least {} bits)é é zDH generator must be 2 or 5rS )
r) Z_MIN_MODULUS_SIZEr¥ rh rW ÚDH_newrm rU rq rÆ rö ZDH_generate_parameters_exr )rf Ú generatorrË Zdh_param_cdatar| rP rP rQ Úgenerate_dh_parameters* s
ÿÿ
ÿz Backend.generate_dh_parametersc C s( | ¡ }| j ||¡}| |dk¡ |S rw )rß rW ZEVP_PKEY_set1_DHrm )rf rû rÍ r| rP rP rQ Ú_dh_cdata_to_evp_pkey@ s z Backend._dh_cdata_to_evp_pkeyc C s< t |j| ƒ}| j |¡}| |dk¡ | |¡}t| ||ƒS rw )r Z _dh_cdatarW ZDH_generate_keyrm r‹ r
)rf r Z dh_key_cdatar| rÍ rP rP rQ Úgenerate_dh_private_keyF s
z Backend.generate_dh_private_keyc C s | | ||¡¡S ru )rŒ rŠ )rf r‰ rË rP rP rQ Ú&generate_dh_private_key_and_parametersP s
ÿz.Backend.generate_dh_private_key_and_parametersc C s> |j j}| j ¡ }| || jjk¡ | j || jj¡}| |j
¡}| |j ¡}|j d urf| |j ¡}n| jj}| |j j
¡}| |j¡}| j ||||¡} | | dk¡ | j |||¡} | | dk¡ | j dd¡}
| j ||
¡} | | dk¡ |
d dkr(|j dkr |
d | jjA dks(tdƒ‚| |¡} t| || ƒS )NrS úint[]r r† z.DH private numbers did not pass safety checks.)r× r rW rˆ rm rU rq rÆ rö rÄ rÑ r rÒ r r Ú DH_set0_pqgÚ DH_set0_keyr‚ ÚCryptography_DH_checkZDH_NOT_SUITABLE_GENERATORr¥ r‹ r
) rf rÚ r rû rÑ r rÒ r
r r| ÚcodesrÍ rP rP rQ Úload_dh_private_numbersU s4
ÿþ
z Backend.load_dh_private_numbersc
C sÐ | j ¡ }| || jjk¡ | j || j j¡}|j}| |j ¡}| |j
¡}|j d urd| |j ¡}n| jj}| |j ¡}| j
||||¡}| |dk¡ | j ||| jj¡}| |dk¡ | |¡} t| || ƒS rw )rW rˆ rm rU rq rÆ rö r rÄ rÑ r rÒ r r r r‹ r )
rf rÚ rû r rÑ r rÒ r
r| rÍ rP rP rQ Úload_dh_public_numbersƒ s
z Backend.load_dh_public_numbersc C s | j ¡ }| || jjk¡ | j || j j¡}| |j¡}| |j ¡}|j
d ur^| |j
¡}n| jj}| j ||||¡}| |dk¡ t | |ƒS rw )
rW rˆ rm rU rq rÆ rö rÄ rÑ r rÒ r r )rf rÚ rû rÑ r rÒ r| rP rP rQ Úload_dh_parameter_numbersž s
z!Backend.load_dh_parameter_numbersc C s´ | j ¡ }| || jjk¡ | j || j j¡}| |¡}| |¡}|d urV| |¡}n| jj}| j ||||¡}| |dk¡ | j dd¡}| j
||¡}| |dk¡ |d dkS )NrS rŽ r ) rW rˆ rm rU rq rÆ rö rÄ r r‚ r‘ )rf rÑ r rÒ rû r| r’ rP rP rQ Údh_parameters_supported° s
z Backend.dh_parameters_supportedc C s | j jdkS rw )rW rc re rP rP rQ Ú dh_x942_serialization_supportedÆ s z'Backend.dh_x942_serialization_supportedc C sh t |ƒdkrtdƒ‚| ¡ }| j || jj¡}| |dk¡ | j ||t |ƒ¡}| |dk¡ t| |ƒS )Né z%An X25519 public key is 32 bytes longrS ) rƒ r¥ rß rW ZEVP_PKEY_set_typeÚ
NID_X25519rm Z EVP_PKEY_set1_tls_encodedpointr# )rf rá rÍ r| rP rP rQ Úx25519_load_public_bytesÉ s
ÿz Backend.x25519_load_public_bytesc C sÀ t |ƒdkrtdƒ‚d}| d¡F}||dd…< ||dd …< | |¡}| j |j| jj¡}W d ƒ n1 sn0 Y | || jjk¡ | j
|| jj ¡}| | j |¡| jj
k¡ t| |ƒS )Nr˜ z&An X25519 private key is 32 bytes longs 0. 0+en" é0 r é )rƒ r¥ Ú_zeroed_bytearrayrã rW r* rK rU rq rm rÆ rÝ rì ré r" )rf rá Z pkcs8_prefixÚbarK rÍ rP rP rQ Úx25519_load_private_bytesØ s
2ÿz!Backend.x25519_load_private_bytesc C s¨ | j || jj¡}| || jjk¡ | j || j j¡}| j |¡}| |dk¡ | j d¡}| j ||¡}| |dk¡ | |d | jjk¡ | j |d | j j
¡}|S )NrS ú EVP_PKEY **r ) rW ZEVP_PKEY_CTX_new_idrU rq rm rÆ ZEVP_PKEY_CTX_freeZEVP_PKEY_keygen_initr‚ ZEVP_PKEY_keygenrÝ )rf rq Z evp_pkey_ctxr| Z evp_ppkeyrÍ rP rP rQ Ú_evp_pkey_keygen_gcú s zBackend._evp_pkey_keygen_gcc C s | | jj¡}t| |ƒS ru )r¡ rW r™ r" rÞ rP rP rQ Úx25519_generate_key s zBackend.x25519_generate_keyc C s | j r
dS | jj S r“ )rZ rW ÚCRYPTOGRAPHY_IS_LIBRESSLre rP rP rQ Úx25519_supported s zBackend.x25519_supportedc C s` t |ƒdkrtdƒ‚| j | jj| jj|t |ƒ¡}| || jjk¡ | j || jj ¡}t
| |ƒS )Né8 z#An X448 public key is 56 bytes long) rƒ r¥ rW ÚEVP_PKEY_new_raw_public_keyÚNID_X448rU rq rm rÆ rÝ r% ©rf rá rÍ rP rP rQ Úx448_load_public_bytes s ÿz Backend.x448_load_public_bytesc C sl t |ƒdkrtdƒ‚| j |¡}| j | jj| jj|t |ƒ¡}| || jjk¡ | j || jj
¡}t | |ƒS )Nr¥ z$An X448 private key is 56 bytes long) rƒ r¥ rU r² rW Ú EVP_PKEY_new_raw_private_keyr§ rq rm rÆ rÝ r$ ©rf rá râ rÍ rP rP rQ Úx448_load_private_bytes s ÿz Backend.x448_load_private_bytesc C s | | jj¡}t| |ƒS ru )r¡ rW r§ r$ rÞ rP rP rQ Úx448_generate_key' s zBackend.x448_generate_keyc C s | j r
dS | jj o | jj S r“ )rZ rW Z"CRYPTOGRAPHY_OPENSSL_LESS_THAN_111r„ re rP rP rQ Úx448_supported+ s
þzBackend.x448_supportedc C s | j r
dS | jj S r“ )rZ rW Ú#CRYPTOGRAPHY_OPENSSL_LESS_THAN_111Bre rP rP rQ Úed25519_supported3 s zBackend.ed25519_supportedc C sn t d|¡ t|ƒtjkr"tdƒ‚| j | jj| j j
|t|ƒ¡}| || j j
k¡ | j || jj
¡}t| |ƒS )Nrá z&An Ed25519 public key is 32 bytes long)r Ú _check_bytesrƒ r, Ú_ED25519_KEY_SIZEr¥ rW r¦ Ú NID_ED25519rU rq rm rÆ rÝ r r¨ rP rP rQ Úed25519_load_public_bytes8 s ÿz!Backend.ed25519_load_public_bytesc C sz t |ƒtjkrtdƒ‚t d|¡ | j |¡}| j | jj
| jj |t |ƒ¡}| || jj k¡ | j
|| jj¡}t| |ƒS )Nz'An Ed25519 private key is 32 bytes longrá )rƒ r, r² r¥ r rE rU r² rW rª r³ rq rm rÆ rÝ r r« rP rP rQ Úed25519_load_private_bytesF s ÿz"Backend.ed25519_load_private_bytesc C s | | jj¡}t| |ƒS ru )r¡ rW r³ r rÞ rP rP rQ Úed25519_generate_keyT s z Backend.ed25519_generate_keyc C s | j r
dS | jj o | jj S r“ )rZ rW r¯ r„ re rP rP rQ Úed448_supportedX s
þzBackend.ed448_supportedc C sl t d|¡ t|ƒtkr tdƒ‚| j | jj| jj |t|ƒ¡}|
|| jj k¡ | j || jj ¡}t
| |ƒS )Nrá z$An Ed448 public key is 57 bytes long)r r± rƒ r r¥ rW r¦ Ú NID_ED448rU rq rm rÆ rÝ r r¨ rP rP rQ Úed448_load_public_bytes` s ÿz Backend.ed448_load_public_bytesc C sx t d|¡ t|ƒtkr tdƒ‚| j |¡}| j | jj | jj
|t|ƒ¡}| || jj
k¡ | j || jj
¡}t| |ƒS )Nrá z%An Ed448 private key is 57 bytes long)r rE rƒ r r¥ rU r² rW rª r¸ rq rm rÆ rÝ r r« rP rP rQ Úed448_load_private_bytesm s ÿz Backend.ed448_load_private_bytesc C s | | jj¡}t| |ƒS ru )r¡ rW r¸ r rÞ rP rP rQ Úed448_generate_key{ s zBackend.ed448_generate_keyc C s† | j d|¡}| j |¡}| j |t|ƒ|t|ƒ|||tj||¡
} | dkrr| ¡ }
d| | d } t d
| ¡|
ƒ‚| j |¡d d … S )Nr± rS é€ i zJNot enough memory to derive key. These parameters require {} MB of memory.) rU r‚ r² rW ZEVP_PBE_scryptrƒ rD Z
_MEM_LIMITrº Ú MemoryErrorrh r³ ) rf r¶ rµ r´ rØ ÚrrÑ r† r· r| rk Z
min_memoryrP rP rQ Ú
derive_scrypt s0 ö ÿýzBackend.derive_scryptc C s2 t |¡}| jr || jvr dS | j |¡| jjkS r“ )r Z_aead_cipher_namerZ Ú
_fips_aeadrW r rU rq )rf r¡ Ú cipher_namerP rP rQ Úaead_cipher_supportedš s
z Backend.aead_cipher_supportedc
c s2 t |ƒ}z|V W | ||¡ n| ||¡ 0 dS )zÁ
This method creates a bytearray, which we copy data into (hopefully
also from a mutable buffer that can be dynamically erased!), and then
zero when we're done.
N)Ú bytearrayÚ
_zero_data)rf r´ rž rP rP rQ r s zBackend._zeroed_bytearrayc C s t |ƒD ] }d||< qd S rn )Úrange)rf rá r´ ÚirP rP rQ rÄ s zBackend._zero_datac c s| |du r| j jV ndt|ƒ}| j d|d ¡}| j |||¡ z |V W | | j d|¡|¡ n| | j d|¡|¡ 0 dS )aâ
This method takes bytes, which can be a bytestring or a mutable
buffer like a bytearray, and yields a null-terminated version of that
data. This is required because PKCS12_parse doesn't take a length with
its password char * and ffi.from_buffer doesn't provide null
termination. So, to support zeroing the data via bytearray we
need to build this ridiculous construct that copies the memory, but
zeroes it after use.
Nr rS z uint8_t *)rU rq rƒ r‚ ZmemmoverÄ Úcast)rf rá Zdata_lenr† rP rP rQ Ú_zeroed_null_terminated_buf´ s z#Backend._zeroed_null_terminated_bufc C s2 | ||¡}|j|jr |jjnd dd„ |jD ƒfS )Nc S s g | ]
}|j ‘qS rP )Ú certificate)rJ r. rP rP rQ Ú
Ð rp zABackend.load_key_and_certificates_from_pkcs12..)Ú load_pkcs12r‰ r. rÉ Zadditional_certs)rf rá r Zpkcs12rP rP rQ Ú%load_key_and_certificates_from_pkcs12Ë s
ýz-Backend.load_key_and_certificates_from_pkcs12c C sŠ |d urt d|¡ | |¡}| j |j| jj¡}|| jjkrN| ¡ t dƒ‚| j
|| jj ¡}| j d¡}| j d¡}| j d¡}|
|¡$}| j |||||¡} W d ƒ n1 s¸0 Y | jjrÒ| ¡ | dkrê| ¡ t dƒ‚d }
d } g } |d | jjkr(| j
|d | jj¡}
| |
¡} |d | jjkr”| j
|d | jj¡}| |¡}d }| j || jj¡}|| jjkrŠ| j |¡}t||ƒ}
|d | jjkr~| j
|d | jj¡}| j |d ¡}| jjsà| jjrêt|ƒ}n t t|ƒƒ}|D ]‚}| j ||¡}| || jjk¡ | j
|| jj¡}| |¡}d }| j || jj¡}|| jjkrj| j |¡}| t||ƒ¡ qút | |
| ƒS )Nr z!Could not deserialize PKCS12 datar zX509 **z Cryptography_STACK_OF_X509 **r z Invalid password or PKCS12 data)!r rE rã rW Zd2i_PKCS12_biorK rU rq r¹ r¥ rÆ Ú PKCS12_freer‚ rÈ Z PKCS12_parser£ rÝ rü r2 r5 ZX509_alias_get0r„ rG Ú sk_X509_freeÚ sk_X509_numÚ#CRYPTOGRAPHY_OPENSSL_300_OR_GREATERr„ rÅ ÚreversedÚ
sk_X509_valuerm rd rH )rf rá r rK Úp12Z evp_pkey_ptrZx509_ptrZ sk_x509_ptrÚ password_bufr| r. r‰ Zadditional_certificatesrÍ r Zcert_objr Z
maybe_nameÚsk_x509rà ÚindicesrÆ Z addl_certZ addl_namerP rP rQ rË Ó sp
ÿ"
ÿþ
ÿzBackend.load_pkcs12c C sÖ d }|d urt d|¡ t|tjƒr6d}d}d} d}
n4t|tjƒrb| jj}| jj}d} d}
|j}nt dƒ‚|d u s~t
|ƒdkrˆ| j j } nZ| j
¡ } | j | | jj¡} g } |D ]4}
| |
¡}| |¡ | j | |¡}t |dk¡ q¬| |¡†}| |¡Z}|r
| |¡n| j j }|r |jn| j j }| j ||||| ||| |
d¡
}W d ƒ n1 sZ0 Y W d ƒ n1 sz0 Y | || j j k¡ | j || jj¡}| ¡ }| j ||¡}| |dk¡ | |¡S )Nr rC r i N rS z Unsupported key encryption type) r r± r” r( rt ru rW Z&NID_pbe_WithSHA1And3_Key_TripleDES_CBCr r¥ rƒ rU rq Úsk_X509_new_nullrÆ rÎ r3 rd Ú sk_X509_pushÚbackendrm rÈ r? Z
PKCS12_createrÍ rä Zi2d_PKCS12_bioræ )rf r r‰ r. Zcasr{ r Znid_certZnid_keyZ pkcs12_iterZmac_iterrÕ Zossl_casÚcaZossl_car| rÔ Zname_bufÚ ossl_certrÍ rÓ rK rP rP rQ Ú(serialize_key_and_certificates_to_pkcs12 sb ÿ
öD
z0Backend.serialize_key_and_certificates_to_pkcs12c C s | j r
dS | jjdkS r— )rZ rW ZCryptography_HAS_POLY1305re rP rP rQ Úpoly1305_supportedc s zBackend.poly1305_supportedc C s* t d|¡ t|ƒtkr tdƒ‚t| |ƒS )Nr‰ z A poly1305 key is 32 bytes long)r rE rƒ r r¥ r )rf r‰ rP rP rQ Úcreate_poly1305_ctxh s zBackend.create_poly1305_ctxc C s
| j j S ru rƒ re rP rP rQ Úpkcs7_supportedo s zBackend.pkcs7_supportedc C sn t d|¡ | |¡}| j |j| jj| jj| jj¡}|| jjkrR| ¡ t dƒ‚| j
|| jj ¡}| |¡S ©Nrá zUnable to parse PKCS7 data)
r r± rã rW ZPEM_read_bio_PKCS7rK rU rq r¹ r¥ rÆ Ú
PKCS7_freeÚ_load_pkcs7_certificates©rf rá rK Úp7rP rP rQ Úload_pem_pkcs7_certificatesr s
ÿ z#Backend.load_pem_pkcs7_certificatesc C sb t d|¡ | |¡}| j |j| jj¡}|| jjkrF| ¡ t dƒ‚| j
|| jj ¡}| |¡S rà )
r r± rã rW Z
d2i_PKCS7_biorK rU rq r¹ r¥ rÆ rá râ rã rP rP rQ Úload_der_pkcs7_certificates s
z#Backend.load_der_pkcs7_certificatesc
C sÞ | j |j¡}| || j jk¡ || j jkr>td |¡tj ƒ‚g }|j
j | j j
krV|S |j
j j}| j |¡}t|ƒD ]d}| j ||¡}| || j j
k¡ | j |¡}| |dk¡ | j || j j¡}| |¡} | | ¡ qt|S )NzNOnly basic signed structures are currently supported. NID for this data was {}rS )rW Z OBJ_obj2nidrŸ rm rN ZNID_pkcs7_signedr rh r ZUNSUPPORTED_SERIALIZATIONrÓ ÚsignrU rq r. rÏ rÅ rÒ Z X509_up_refrÆ r2 r5 rd )
rf rä rq ÚcertsrÕ rà rÆ r r| r. rP rP rQ râ Š s. ÿý
z Backend._load_pkcs7_certificatesc C s´ | |j¡}| jj}d}t|jƒdkr0| jj}n\| j ¡ }| j || jj
¡}g }|jD ]4} | | ¡}
| |
¡ | j
||
¡} | | dk¡ qVtjj|v r°|| jjO }|| jjO }| j | jj| jj|| jj|¡} | | | jjk¡ | j | | jj¡} d}
tjj|v r|
| jjO }
ntjj|v r.|
| jjO }
tjj|v rH|
| jjO }
|jD ]H\}}}| |¡}
| |¡}| j | |
|j ||
¡}| || jjk¡ qN|D ]<}|tjj u r¼|| jj O }n|tjj!u rœ|| jj"O }qœ| #¡ }|t$j%j&u r| j '|| |j(|¡} n–|t$j%j)u rJ| j *| |j(|¡} | | dk¡ | j +|| |j(|¡} nR|t$j%j,u s\J ‚| j *| |j(|¡} | | dk¡ | jj-rŽ| .¡ | j /|| ¡} | | dk¡ | 0|¡S )Nr rS )1rã Ú_datarW Z
PKCS7_PARTIALrƒ Z_additional_certsrU rq r× rÆ rÎ r3 rd rØ rm rE Z PKCS7OptionsZDetachedSignatureZPKCS7_DETACHEDZ
PKCS7_signrá ZNoCapabilitiesZPKCS7_NOSMIMECAPZ NoAttributesZ PKCS7_NOATTRZNoCertsZ
PKCS7_NOCERTSZ_signersr’ ZPKCS7_sign_add_signerr? ÚTextZ
PKCS7_TEXTZBinaryZ PKCS7_BINARYrä r( r0 ZSMIMEZSMIME_write_PKCS7rK rv Z PKCS7_finalZPEM_write_bio_PKCS7_streamr1 rÐ r¹ Z
i2d_PKCS7_bioræ )rf Zbuilderrz ÚoptionsrK Z
init_flagsZ final_flagsrè Z
ossl_certsr. rÛ r| rä Z signer_flagsrÉ Z private_keyZhash_algorithmZmdZ p7signerinfoÚoptionZbio_outrP rP rQ Ú
pkcs7_sign§ s~
û
ÿ
ÿ
ÿ
zBackend.pkcs7_sign)N)N)N)³rM rN rO Ú__doc__r rÀ r2 rž r' rþ rÿ r r Z
SHA512_224Z
SHA512_256ZSHA3_224ZSHA3_256ZSHA3_384ZSHA3_512ZSHAKE128ZSHAKE256r• r+ Z SECP224R1Z SECP256R1Z SECP384R1Z SECP521R1rl Z_fips_rsa_min_key_sizeZ _fips_rsa_min_public_exponentZ_fips_dsa_min_modulusZ_fips_dh_min_key_sizeZ_fips_dh_min_modulusrg rj rm rY rv r} Ú
contextlibr r~ ra r‡ ri rˆ r‹ r r’ r– r˜ rœ r r¤ r¨ r\ r® r¯ r° r¸ r¹ rº rÀ rÄ rÎ rÐ rÛ rÜ rß rÉ rã rä ræ rü rý r r r r r
r r r r r rs r Z
HashAlgorithmr r r r r r% r& r( r' r, r- r Z CertificateÚtypingÚAnyr3 r5 ZCertificateSigningRequestr8 r9 ZCertificateRevocationListr< r= rI r@ rA rB r r" rR rS rW r] r^ rf rj rT rk rm rU rM rb rg r\ r~ rw rx r r‚ r… rŠ r‹ rŒ r r“ r” r• r– r— rš rŸ r¡ r¢ r¤ r© r¬ r r® r° r´ rµ r¶ r· r¹ rº r» r¿ r r rÄ rÈ rÌ rË rÜ rÝ rÞ rß rå ræ râ rí rP rP rP rQ r v s\
ôü
1 "
-+ þ þ þ þ 5/ %
i0
. "
L D
r c @ s e Zd Zdd„ Zdd„ ZdS )r© c C s
|| _ d S ru )Ú_fmt)rf ÚfmtrP rP rQ rg s zGetCipherByName.__init__c C s& | j j||d ¡ }|j | d¡¡S )N)r¡ rt r )rò rh ÚlowerrW r rŽ )rf rÙ r¡ rt rÁ rP rP rQ Ú__call__ s zGetCipherByName.__call__N)rM rN rO rg rõ rP rP rP rQ r© s r© c C s" d |jd ¡}| j | d¡¡S )Nz
aes-{}-xtsr† r )rh rË rW r rŽ )rÙ r¡ rt rÁ rP rP rQ r¬ s r¬ )oÚ collectionsrï rª rð r^ r Z cryptographyr r Zcryptography.exceptionsr r Z'cryptography.hazmat.backends.interfacesr ZBackendInterfaceZ$cryptography.hazmat.backends.opensslr Z,cryptography.hazmat.backends.openssl.ciphersr Z)cryptography.hazmat.backends.openssl.cmacr Z'cryptography.hazmat.backends.openssl.dhr r
r r Z(cryptography.hazmat.backends.openssl.dsar r r Z'cryptography.hazmat.backends.openssl.ecr r Z,cryptography.hazmat.backends.openssl.ed25519r r Z*cryptography.hazmat.backends.openssl.ed448r r r Z+cryptography.hazmat.backends.openssl.hashesr Z)cryptography.hazmat.backends.openssl.hmacr Z-cryptography.hazmat.backends.openssl.poly1305r r Z(cryptography.hazmat.backends.openssl.rsar r! Z+cryptography.hazmat.backends.openssl.x25519r" r# Z)cryptography.hazmat.backends.openssl.x448r$ r% Z"cryptography.hazmat.bindings._rustr4 Z$cryptography.hazmat.bindings.opensslr& Z cryptography.hazmat.primitivesr' r( Z)cryptography.hazmat.primitives.asymmetricr) r* r+ r, r- Z1cryptography.hazmat.primitives.asymmetric.paddingr. r/ r0 r1 Z1cryptography.hazmat.primitives.ciphers.algorithmsr2 r3 r4 r5 r6 r7 r8 r9 r: r; Z,cryptography.hazmat.primitives.ciphers.modesr< r= r> r? r@ rA rB rC Z"cryptography.hazmat.primitives.kdfrD Z,cryptography.hazmat.primitives.serializationrE rF Z3cryptography.hazmat.primitives.serialization.pkcs12rG rH Zcryptography.x509.baserI Ú
namedtuplerJ ÚobjectrL r© r¬ rÙ rP rP rP rQ Ú sp 0 (