U bxW @sddlZddlZddlZddlmZddlmZmZmZm Z m Z m Z m Z m Z mZzddlZddlmZddlmZddlmZmZddlmZmZdd lmZmZdd lmZmZdd l m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(dd l)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0d Z1Wne2k rdZ1YnXddddddddddddh Z3ddZ4GdddZ5Gdd d e5Z6Gd!d"d"e5Z7e1rGd#d$d$e5Z8Gd%d&d&e5Z9Gd'd(d(e8Z:Gd)d*d*e5Z;dS)+NInvalidKeyError) base64url_decodebase64url_encodeder_to_raw_signature force_bytesfrom_base64url_uint is_pem_format is_ssh_keyraw_to_der_signatureto_base64url_uint)InvalidSignature)hashes)ecpadding)EllipticCurvePrivateKeyEllipticCurvePublicKey)Ed448PrivateKeyEd448PublicKey)Ed25519PrivateKeyEd25519PublicKey) RSAPrivateKeyRSAPrivateNumbers RSAPublicKeyRSAPublicNumbers rsa_crt_dmp1 rsa_crt_dmq1 rsa_crt_iqmprsa_recover_prime_factors)Encoding NoEncryption PrivateFormat PublicFormatload_pem_private_keyload_pem_public_keyload_ssh_public_keyTFRS256RS384RS512ES256ES256KES384ES521ES512PS256PS384PS512EdDSAcCstttjttjttjd}tr|ttjttjttjttjttjttjttjttjt t jt t jt t jt d |S)zE Returns the algorithms that are implemented by the library. )noneZHS256ZHS384ZHS512) r'r(r)r*r+r,r-r.r/r0r1r2) NoneAlgorithm HMACAlgorithmSHA256SHA384SHA512 has_cryptoupdate RSAAlgorithm ECAlgorithmRSAPSSAlgorithm OKPAlgorithm)Zdefault_algorithmsr?2/tmp/pip-unpacked-wheel-ivybibab/jwt/algorithms.pyget_default_algorithmsKs0rAc@s@eZdZdZddZddZddZedd Zed d Z d S) AlgorithmzH The interface for an algorithm used to sign and verify tokens. cCstdS)z Performs necessary validation and conversions on the key and returns the key value in the proper format for sign() and verify(). NNotImplementedErrorselfkeyr?r?r@ prepare_keyrszAlgorithm.prepare_keycCstdS)zn Returns a digital signature for the specified message using the specified key value. NrCrFmsgrGr?r?r@signyszAlgorithm.signcCstdS)zz Verifies that the specified digital signature is valid for the specified message and key values. NrCrFrJrGsigr?r?r@verifyszAlgorithm.verifycCstdS)z7 Serializes a given RSA key into a JWK NrCkey_objr?r?r@to_jwkszAlgorithm.to_jwkcCstdS)zb Deserializes a given RSA key from JWK back into a PublicKey or PrivateKey object NrC)jwkr?r?r@from_jwkszAlgorithm.from_jwkN) __name__ __module__ __qualname____doc__rHrKrN staticmethodrQrSr?r?r?r@rBms rBc@s(eZdZdZddZddZddZdS) r4zZ Placeholder for use when no signing or verification operations are required. cCs |dkr d}|dk rtd|S)Nz*When alg = "none", key value must be None.rrEr?r?r@rHs zNoneAlgorithm.prepare_keycCsdS)Nr?rIr?r?r@rKszNoneAlgorithm.signcCsdS)NFr?rLr?r?r@rNszNoneAlgorithm.verifyN)rTrUrVrWrHrKrNr?r?r?r@r4s r4c@sZeZdZdZejZejZej Z ddZ ddZ e ddZe dd Zd d Zd d ZdS)r5zf Performs signing and verification operations using HMAC and the specified hash function. cCs ||_dSNhash_algrFr]r?r?r@__init__szHMACAlgorithm.__init__cCs$t|}t|st|r td|S)NzdThe specified key is an asymmetric key or x509 certificate and should not be used as an HMAC secret.)rr r rrEr?r?r@rHs zHMACAlgorithm.prepare_keycCsttt|ddS)Noct)kkty)jsondumpsrrdecoderOr?r?r@rQs zHMACAlgorithm.to_jwkcCsnz.t|trt|}nt|tr(|}ntWntk rJtdYnX|ddkrbtdt|dS)NKey is not valid JSONrbr`zNot an HMAC keyra) isinstancestrrcloadsdict ValueErrorrgetr)rRobjr?r?r@rSs   zHMACAlgorithm.from_jwkcCst|||jSr[)hmacnewr]digestrIr?r?r@rKszHMACAlgorithm.signcCst||||Sr[)rncompare_digestrKrLr?r?r@rNszHMACAlgorithm.verifyN)rTrUrVrWhashlibsha256r6sha384r7sha512r8r_rHrXrQrSrKrNr?r?r?r@r5s   r5c@sZeZdZdZejZejZejZddZddZ e ddZ e dd Z d d Z d d ZdS)r;z~ Performs signing and verification operations using RSASSA-PKCS-v1_5 and the specified hash function. cCs ||_dSr[r\r^r?r?r@r_szRSAAlgorithm.__init__cCsvt|ttfr|St|ttfs(tdt|}z$|drFt|}n t |dd}Wnt k rpt |}YnX|S)NExpecting a PEM-formatted key.sssh-rsapassword) rgrrbytesrh TypeErrorr startswithr&r$rkr%rEr?r?r@rHs  zRSAAlgorithm.prepare_keyc Csd}t|ddr|}ddgt|jjt|jjt|jt|jt|j t|j t|j t|j d }nBt|ddr|}ddgt|jt|jd}nt dt|S)Nprivate_numbersRSArK) rbkey_opsnedpqdpdqqirN)rbr~rrNot a public or private key)getattrr|r public_numbersrrerrrrdmp1dmq1iqmprrcrd)rPrmnumbersr?r?r@rQs.          zRSAAlgorithm.to_jwkc sz.t|trt|nt|tr(|ntWntk rJtdYnXddkrbtddkrdkrdkrdkrtd d d d d dg}fdd|D}t|}|rt |stdt t dt d}|r4t t dt d t d t d t d t d|d}nHt d}t |j||j\}}t |||t||t||t|||d}|Sdkrdkrt t dt d}|StddS)Nrfrbr}zNot an RSA keyrrrZothz5Unsupported RSA private key: > 2 primes not supportedrrrrrcsg|] }|kqSr?r?).0proprmr?r@ Asz)RSAAlgorithm.from_jwk..z@RSA key must include all parameters if any are present besides d)rrrrrrrr)rgrhrcrirjrkrrlanyallrr rrrrrrr private_key public_key) rRZ other_propsZ props_foundZany_props_foundrrrrrr?rr@rS*sv                zRSAAlgorithm.from_jwkcCs||t|Sr[)rKrPKCS1v15r]rIr?r?r@rKtszRSAAlgorithm.signcCs:z|||t|WdStk r4YdSXdS)NTF)rNrrr]rrLr?r?r@rNws zRSAAlgorithm.verifyN)rTrUrVrWrr6r7r8r_rHrXrQrSrKrNr?r?r?r@r;s # Ir;c@sNeZdZdZejZejZejZddZddZ ddZ dd Z e d d Z d S) r<zr Performs signing and verification operations using ECDSA and the specified hash function cCs ||_dSr[r\r^r?r?r@r_szECAlgorithm.__init__cCst|ttfr|St|ttfs(tdt|}z |drFt|}nt |}Wn t k rpt |dd}YnXt|ttfst d|S)Nrvs ecdsa-sha2-rwzcExpecting a EllipticCurvePrivateKey/EllipticCurvePublicKey. Wrong key provided for ECDSA algorithms) rgrrryrhrzrr{r&r%rkr$rrEr?r?r@rHs    zECAlgorithm.prepare_keycCs"||t|}t||jSr[)rKrECDSAr]rcurve)rFrJrGder_sigr?r?r@rKszECAlgorithm.signcCstzt||j}Wntk r&YdSXz0t|tr<|}|||t| WdSt k rnYdSXdS)NFT) r rrkrgrrrNrrr]r)rFrJrGrMrr?r?r@rNs zECAlgorithm.verifycCs0z.t|trt|}nt|tr(|}ntWntk rJtdYnX|ddkrbtdd|ksrd|krztdt|d}t|d}|d}|dkrt |t |krd krnn t }ntd n|d krt |t |krd krnn t }ntd n|dkr`t |t |krHdkrVnn t }ntdnP|dkrt |t |krd krnn t }ntdntd|t jtj|ddtj|dd|d}d|kr|St|d}t |t |krtdt ||t tj|dd|S)NrfrbZECzNot an Elliptic curve keyxycrvzP-256 z)Coords should be 32 bytes for curve P-256zP-3840z)Coords should be 48 bytes for curve P-384zP-521Bz)Coords should be 66 bytes for curve P-521Z secp256k1z-Coords should be 32 bytes for curve secp256k1Invalid curve: big) byteorder)rrrrz!D should be {} bytes for curve {})rgrhrcrirjrkrrlrlenrZ SECP256R1Z SECP384R1Z SECP521R1Z SECP256K1ZEllipticCurvePublicNumbersint from_bytesrZEllipticCurvePrivateNumbersr)rRrmrrrZ curve_objrrr?r?r@rSsh        $   $   $     zECAlgorithm.from_jwkN)rTrUrVrWrr6r7r8r_rHrKrNrXrSr?r?r?r@r<~sr<c@s eZdZdZddZddZdS)r=zA Performs a signature using RSASSA-PSS with MGF1 cCs*||tjt||jjd|S)NZmgfZ salt_length)rKrPSSMGF1r] digest_sizerIr?r?r@rKs zRSAPSSAlgorithm.signc CsNz2|||tjt||jjd|WdStk rHYdSXdS)NrTF)rNrrrr]rrrLr?r?r@rN s  zRSAPSSAlgorithm.verifyN)rTrUrVrWrKrNr?r?r?r@r=s r=c@sHeZdZdZddZddZddZdd Zed d Z ed d Z dS)r>z Performs signing and verification operations using EdDSA This class requires ``cryptography>=2.6`` to be installed. cKsdSr[r?)rFkwargsr?r?r@r_!szOKPAlgorithm.__init__cCst|ttfrlt|tr"|d}|d}d|kr>t|}n.d|krTt|dd}n|dddkrlt|}t|tt t t fst d|S) Nutf-8z-----BEGIN PUBLICz-----BEGIN PRIVATErwrzssh-zcExpecting a EllipticCurvePrivateKey/EllipticCurvePublicKey. Wrong key provided for EdDSA algorithms) rgryrhencoderer%r$r&rrrrr)rFrGZstr_keyr?r?r@rH$s$     zOKPAlgorithm.prepare_keycCs$t|tk rt|dn|}||S)aR Sign a message ``msg`` using the EdDSA private key ``key`` :param str|bytes msg: Message to sign :param Ed25519PrivateKey}Ed448PrivateKey key: A :class:`.Ed25519PrivateKey` or :class:`.Ed448PrivateKey` iinstance :return bytes signature: The signature, as bytes r)typeryrKrIr?r?r@rK<szOKPAlgorithm.signcCs|z\t|tk rt|dn|}t|tk r2t|dn|}t|ttfrL|}|||WdStjj k rvYdSXdS)a Verify a given ``msg`` against a signature ``sig`` using the EdDSA key ``key`` :param str|bytes sig: EdDSA signature to check ``msg`` against :param str|bytes msg: Message to sign :param Ed25519PrivateKey|Ed25519PublicKey|Ed448PrivateKey|Ed448PublicKey key: A private or public EdDSA key instance :return bool verified: True if signature is valid, False if not. rTFN) rryrgrrrrN cryptography exceptionsrrLr?r?r@rNGs  zOKPAlgorithm.verifycCst|ttfrP|jtjtjd}t|tr.dnd}tt t | d|dSt|t t fr|jtjtjtd}|jtjtjd}t|t rdnd}tt t | t t | d|dStddS) N)encodingformatEd25519Ed448OKP)rrbr)rrZencryption_algorithm)rrrbrr)rgrrZ public_bytesr ZRawr#rcrdrrrerrZ private_bytesr"r!rr)rGrrrr?r?r@rQ\s> zOKPAlgorithm.to_jwkc Cs2z.t|trt|}nt|tr(|}ntWntk rJtdYnX|ddkrbtd|d}|dkr|dkrtd|d |krtd t|d }zVd |kr|dkrt |WSt |WSt|d }|dkrt |WSt |WStk r,}ztd |W5d}~XYnXdS) NrfrbrzNot an Octet Key PairrrrrrzOKP should have "x" parameterrzInvalid key parameter)rgrhrcrirjrkrrlrrZfrom_public_bytesrrZfrom_private_bytesr)rRrmrrrerrr?r?r@rSs6        zOKPAlgorithm.from_jwkN) rTrUrVrWr_rHrKrNrXrQrSr?r?r?r@r>s  'r>)r?r?r?r@sP ,   ( $  ")9~