CasperSecurity
o
�l�iV � @ s� d dl Z d dlZd dlZddlmZ ddlmZmZmZm Z m
Z
m Z m Z m
Z
mZ zZd dlZd dlmZ d dlmZ d dlmZmZ d dlmZmZ d d lmZm Z d d
l m Z m Z d d l m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z( d d l)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0 d
Z1W n e2y� dZ1Y nw h d�Z3dd� Z4G dd� d�Z5G dd� de5�Z6G dd� de5�Z7e1r�G dd� de5�Z8G dd� de5�Z9G d d � d e8�Z:G d d � d e5�Z;dS dS ) � N� ��InvalidKeyError) �base64url_decode�base64url_encode�der_to_raw_signature� force_bytes�from_base64url_uint�
is_pem_format�
is_ssh_key�raw_to_der_signature�to_base64url_uint)�InvalidSignature)�hashes)�ec�padding)�EllipticCurvePrivateKey�EllipticCurvePublicKey)�Ed448PrivateKey�Ed448PublicKey)�Ed25519PrivateKey�Ed25519PublicKey)�
RSAPrivateKey�RSAPrivateNumbers� RSAPublicKey�RSAPublicNumbers� rsa_crt_dmp1� rsa_crt_dmq1� rsa_crt_iqmp�rsa_recover_prime_factors)�Encoding� NoEncryption�
PrivateFormat� PublicFormat�load_pem_private_key�load_pem_public_key�load_ssh_public_keyTF> �ES256�ES384�ES512�ES521�EdDSA�PS256�PS384�PS512�RS256�RS384�RS512�ES256Kc C s� t � ttj�ttj�ttj�d�} trG| �ttj�ttj�ttj�ttj�ttj�ttj�ttj�ttj�t t j�t t j�t t j�t
� d� � | S )zE
Returns the algorithms that are implemented by the library.
)�none�HS256�HS384�HS512) r/ r0 r1 r' r2 r( r* r) r, r- r. r+ ) �
NoneAlgorithm�
HMACAlgorithm�SHA256�SHA384�SHA512�
has_crypto�update� RSAAlgorithm� ECAlgorithm�RSAPSSAlgorithm� OKPAlgorithm)�default_algorithms� rC �0/usr/lib/python3/dist-packages/jwt/algorithms.py�get_default_algorithmsK s0 ����rE c @ s@ e Zd ZdZdd� Zdd� Zdd� Zedd � �Zed
d � �Z d S )
� AlgorithmzH
The interface for an algorithm used to sign and verify tokens.
c C � t �)z�
Performs necessary validation and conversions on the key and returns
the key value in the proper format for sign() and verify().
��NotImplementedError��self�keyrC rC rD � prepare_keyr � zAlgorithm.prepare_keyc C rG )zn
Returns a digital signature for the specified message
using the specified key value.
rH �rK �msgrL rC rC rD �signy rN zAlgorithm.signc C rG )zz
Verifies that the specified digital signature is valid
for the specified message and key values.
rH �rK rP rL �sigrC rC rD �verify� rN zAlgorithm.verifyc C rG )z7
Serializes a given RSA key into a JWK
rH ��key_objrC rC rD �to_jwk� rN zAlgorithm.to_jwkc C rG )zb
Deserializes a given RSA key from JWK back into a PublicKey or PrivateKey object
rH )�jwkrC rC rD �from_jwk� rN zAlgorithm.from_jwkN)
�__name__�
__module__� __qualname__�__doc__rM rQ rT � staticmethodrW rY rC rC rC rD rF m s
rF c @ s( e Zd ZdZdd� Zdd� Zdd� ZdS ) r7 zZ
Placeholder for use when no signing or verification
operations are required.
c C s |dkrd }|d urt d��|S )N� z*When alg = "none", key value must be None.r rJ rC rC rD rM � s
zNoneAlgorithm.prepare_keyc C � dS )N� rC rO rC rC rD rQ � � zNoneAlgorithm.signc C r` )NFrC rR rC rC rD rT � rb zNoneAlgorithm.verifyN)rZ r[ r\ r] rM rQ rT rC rC rC rD r7 � s
r7 c @ sZ e Zd ZdZejZejZej Z
dd� Z dd� Z e
dd� �Ze
dd � �Zd
d � Zd d
� ZdS )r8 zf
Performs signing and verification operations using HMAC
and the specified hash function.
c C �
|| _ d S �N��hash_alg�rK rf rC rC rD �__init__� �
zHMACAlgorithm.__init__c C s$ t |�}t|�s t|�rtd��|S )NzdThe specified key is an asymmetric key or x509 certificate and should not be used as an HMAC secret.)r r
r r rJ rC rC rD rM � s �zHMACAlgorithm.prepare_keyc C s t �tt| ���� dd��S )N�oct)�k�kty)�json�dumpsr r �decoderU rC rC rD rW � s
��zHMACAlgorithm.to_jwkc C sh zt | t�r t�| �}n
t | t�r| }nt�W n ty" td��w |�d�dkr.td��t|d �S )N�Key is not valid JSONrl rj zNot an HMAC keyrk ) �
isinstance�strrm �loads�dict�
ValueErrorr �getr )rX �objrC rC rD rY � s
� � zHMACAlgorithm.from_jwkc C s t �||| j��� S rd )�hmac�newrf �digestrO rC rC rD rQ � � zHMACAlgorithm.signc C s t �|| �||��S rd )rx �compare_digestrQ rR rC rC rD rT � r{ zHMACAlgorithm.verifyN)rZ r[ r\ r] �hashlib�sha256r9 �sha384r: �sha512r; rh rM r^ rW rY rQ rT rC rC rC rD r8 � s
r8 c @ sZ e Zd ZdZejZejZejZdd� Zdd� Z e
dd� �Z e
dd � �Z d
d � Z
d d
� ZdS )r> z~
Performs signing and verification operations using
RSASSA-PKCS-v1_5 and the specified hash function.
c C rc rd re rg rC rC rD rh � ri zRSAAlgorithm.__init__c C sx t |ttf�r |S t |ttf�std��t|�}z|�d�r%t|�}W |S t |d d�}W |S t
y; t |�}Y |S w )N� Expecting a PEM-formatted key.s ssh-rsa��password) rq r r �bytesrr � TypeErrorr �
startswithr& r$ ru r% rJ rC rC rD rM � s
� �
�zRSAAlgorithm.prepare_keyc C s� d }t | dd �rE| �� }ddgt|jj��� t|jj��� t|j��� t|j��� t|j ��� t|j
��� t|j ��� t|j ��� d�
}n!t | dd �rb| �� }ddgt|j��� t|j��� d�}nt
d��t�|�S )N�private_numbers�RSArQ )
rl �key_ops�n�e�d�p�q�dp�dq�qirT )rl r� r� r� �Not a public or private key)�getattrr� r
�public_numbersr� ro r� r� r� r� �dmp1�dmq1�iqmpr rm rn )rV rw �numbersrC rC rD rW s. �
�
zRSAAlgorithm.to_jwkc s� zt | t�r t�| �� n
t | t�r| � nt�W n ty" td��w � �d�dkr.td��d� v r�d� v r�d� v r�d� v rBtd ��g d
�}� fd d �|D �}t|�}|r]t |�s]td
��t
t � d �t � d ��}|r�t t � d �t � d �t � d �t � d �t � d �t � d �|d�}|�� S t � d �}t
|j||j�\}}t |||t||�t||�t||�|d�}|�� S d� v r�d� v r�t
t � d �t � d ��}|�� S td��)Nrp rl r� zNot an RSA keyr� r� r� �othz5Unsupported RSA private key: > 2 primes not supported)r� r� r� r� r� c s g | ]}|� v �qS rC rC )�.0�prop�rw rC rD �
<listcomp>A s z)RSAAlgorithm.from_jwk.<locals>.<listcomp>z@RSA key must include all parameters if any are present besides dr� r� r� r� r� )r� r� r� r� r� r� r� r� )rq rr rm rs rt ru r rv �any�allr r r r r� r� r r r � private_key�
public_key) rX � other_props� props_found�any_props_foundr� r� r� r� r� rC r� rD rY * sx
� �� �
�
� �
��
�zRSAAlgorithm.from_jwkc C s |� |t�� | �� �S rd )rQ r �PKCS1v15rf rO rC rC rD rQ t s zRSAAlgorithm.signc C s4 z|� ||t�� | �� � W dS ty Y dS w )NTF)rT r r� rf r rR rC rC rD rT w s �zRSAAlgorithm.verifyN)rZ r[ r\ r] r r9 r: r; rh rM r^ rW rY rQ rT rC rC rC rD r> � s
#
I r> c @ sN e Zd ZdZejZejZejZdd� Zdd� Z dd� Z
dd � Z e d
d � �Z
d S )
r? zr
Performs signing and verification operations using
ECDSA and the specified hash function
c C rc rd re rg rC rC rD rh � ri zECAlgorithm.__init__c C sx t |ttf�r |S t |ttf�std��t|�}z|�d�r%t|�}W |S t |�}W |S t
y; t |d d�}Y |S w )Nr� s ecdsa-sha2-r� ) rq r r r� rr r� r r� r& r% ru r$ rJ rC rC rD rM � s
� ��zECAlgorithm.prepare_keyc C s" |� |t�| �� ��}t||j�S rd )rQ r �ECDSArf r �curve)rK rP rL �der_sigrC rC rD rQ � s zECAlgorithm.signc C sl zt ||j�}W n
ty Y dS w zt|t�r |�� }|�||t�| � � �� W dS t
y5 Y dS w )NFT) r r� ru rq r r� rT r r� rf r )rK rP rL rS r� rC rC rD rT � s �
�zECAlgorithm.verifyc C s& zt | t�r t�| �}n
t | t�r| }nt�W n ty" td��w |�d�dkr.td��d|vs6d|vr:td��t|�d��}t|�d��}|�d�}|dkrmt |�t |� kr_d krin td
��t
� � }nktd
��|d kr�t |�t |� krd kr�n td
��t
� � }nKtd
��|dkr�t |�t |� kr�dkr�n td��t
�
� }n+td��|dkr�t |�t |� kr�d kr�n td��t
�� }n td��td|� ���t
jtj|dd�tj|dd�|d�}d|vr�|�� S t|�d��}t |�t |�k�rtdt |�|��t
�tj|dd�|��� S )Nrp rl �ECzNot an Elliptic curve key�x�y�crvzP-256� z)Coords should be 32 bytes for curve P-256zP-384�0 z)Coords should be 48 bytes for curve P-384zP-521�B z)Coords should be 66 bytes for curve P-521� secp256k1z-Coords should be 32 bytes for curve secp256k1�Invalid curve: �big)� byteorder)r� r� r� r� z!D should be {} bytes for curve {})rq rr rm rs rt ru r rv r �lenr � SECP256R1� SECP384R1� SECP521R1� SECP256K1�EllipticCurvePublicNumbers�int�
from_bytesr� �EllipticCurvePrivateNumbersr� )rX rw r� r� r� � curve_objr� r� rC rC rD rY � sv
� �
�
�
� �
�� �
���zECAlgorithm.from_jwkN)rZ r[ r\ r] r r9 r: r; rh rM rQ rT r^ rY rC rC rC rD r? ~ s r? c @ s e Zd ZdZdd� Zdd� ZdS )r@ zA
Performs a signature using RSASSA-PSS with MGF1
c C s* |� |tjt�| �� �| jjd�| �� �S )N��mgf� salt_length)rQ r �PSS�MGF1rf � digest_sizerO rC rC rD rQ � s ��zRSAPSSAlgorithm.signc C sH z|� ||tjt�| �� �| jjd�| �� � W dS ty# Y dS w )Nr� TF)rT r r� r� rf r� r rR rC rC rD rT s �� �zRSAPSSAlgorithm.verifyN)rZ r[ r\ r] rQ rT rC rC rC rD r@ � s
r@ c @ sH e Zd ZdZdd� Zdd� Zdd� Zdd � Zed
d � �Z ed d
� �Z
dS )rA z�
Performs signing and verification operations using EdDSA
This class requires ``cryptography>=2.6`` to be installed.
c K s d S rd rC )rK �kwargsrC rC rD rh rb zOKPAlgorithm.__init__c C s� t |ttf�r6t |t�r|�d�}|�d�}d|v r t|�}nd|v r*t|d d�}n |dd� dkr6t|�}t |tt t
t f�sCt d��|S ) N�utf-8z-----BEGIN PUBLICz-----BEGIN PRIVATEr� r � zssh-zcExpecting a EllipticCurvePrivateKey/EllipticCurvePublicKey. Wrong key provided for EdDSA algorithms)
rq r� rr �encodero r% r$ r& r r r r r )rK rL �str_keyrC rC rD rM s$
��zOKPAlgorithm.prepare_keyc C s$ t |�tur t|d�n|}|�|�S )aR
Sign a message ``msg`` using the EdDSA private key ``key``
:param str|bytes msg: Message to sign
:param Ed25519PrivateKey}Ed448PrivateKey key: A :class:`.Ed25519PrivateKey`
or :class:`.Ed448PrivateKey` iinstance
:return bytes signature: The signature, as bytes
r� )�typer� rQ rO rC rC rD rQ 6 s
zOKPAlgorithm.signc C sv z.t |�tur t|d�n|}t |�turt|d�n|}t|ttf�r&|�� }|�||� W dS tjj y: Y dS w )a�
Verify a given ``msg`` against a signature ``sig`` using the EdDSA key ``key``
:param str|bytes sig: EdDSA signature to check ``msg`` against
:param str|bytes msg: Message to sign
:param Ed25519PrivateKey|Ed25519PublicKey|Ed448PrivateKey|Ed448PublicKey key:
A private or public EdDSA key instance
:return bool verified: True if signature is valid, False if not.
r� TF)
r� r� rq r r r� rT � cryptography�
exceptionsr rR rC rC rD rT A s
�zOKPAlgorithm.verifyc C s� t | ttf�r(| jtjtjd�}t | t�rdnd}t�t t
|��� � d|d��S t | t t
f�rd| jtjtjt� d�}| �� jtjtjd�}t | t �rLdnd}t�t t
|��� � t t
|��� � d|d��S td��) N)�encoding�format�Ed25519�Ed448�OKP)r� rl r� )r� r� �encryption_algorithm)r� r� rl r� r� )rq r r � public_bytesr �Rawr# rm rn r r ro r r �
private_bytesr" r! r� r )rL r� r� r� rC rC rD rW V s> ������� zOKPAlgorithm.to_jwkc
C s zt | t�r t�| �}n
t | t�r| }nt�W n ty" td��w |�d�dkr.td��|�d�}|dkrB|dkrBtd|� ���d |vrJtd
��t|�d ��}z+d |vrf|dkr`t �
|�W S t �
|�W S t|�d ��}|dkrwt �
|�W S t�
|�W S ty� } ztd �|�d }~ww )
Nrp rl r� zNot an Octet Key Pairr� r� r� r� r� z OKP should have "x" parameterr� zInvalid key parameter)rq rr rm rs rt ru r rv r r �from_public_bytesr r �from_private_bytesr )rX rw r� r� r� �errrC rC rD rY ~ s>
� �
��zOKPAlgorithm.from_jwkN) rZ r[ r\ r] rh rM rQ rT r^ rW rY rC rC rC rD rA s
'rA )<r} rx rm r� r �utilsr r r r r r
r r r
�cryptography.exceptionsr� r � cryptography.hazmat.primitivesr �)cryptography.hazmat.primitives.asymmetricr r �,cryptography.hazmat.primitives.asymmetric.ecr r �/cryptography.hazmat.primitives.asymmetric.ed448r r �1cryptography.hazmat.primitives.asymmetric.ed25519r r �-cryptography.hazmat.primitives.asymmetric.rsar r r r r r r r �,cryptography.hazmat.primitives.serializationr r! r" r# r$ r% r& r< �ModuleNotFoundError�requires_cryptographyrE rF r7 r8 r> r? r@ rA rC rC rC rD �<module> sB , ($
�")9 x � ��