o
    jhV                     @   sd  d dl Z d dlZd dlmZmZ d dlmZ d dlmZm	Z	m
Z
 d dlmZmZmZ d dlmZmZ d dlmZmZmZmZ d dlmZmZmZ d d	lmZ d d
lmZmZ d dl m!Z! d dl"m#Z# ddl$m%Z% ddl&m'Z'm(Z( ddl)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0 ddl1m2Z2 ddl3m4Z4 dZ5G dd de4Z6G dd de4Z7G dd de4Z8G dd de4Z9dS )    N)InvalidSignature
InvalidTag)default_backend)hasheshmacserialization)ecpaddingrsa)decode_dss_signatureencode_dss_signature)Cipheraead
algorithmsmodes)InvalidUnwrapaes_key_unwrapaes_key_wrap)PKCS7)load_pem_private_keyload_pem_public_key)int_to_bytes)load_pem_x509_certificate   )
ALGORITHMS)JWEErrorJWKError)base64_to_longbase64url_decodebase64url_encodeensure_binaryis_pem_format
is_ssh_keylong_to_base64   )get_random_bytes)Keyc                   @   sz   e Zd ZejZejZejZefddZdd Z	dd Z
dd Zd	d
 Zdd Zdd Zdd Zdd Zdd Zdd ZdS )CryptographyECKeyc              
   C   s(  |t jvrtd| t j| jt j| jt j| ji	|| _
|| _|| _t|ds-t|dr2|| _d S t|dr>| d}t|trK| || _d S t|trU|d}t|trzz	t||  }W n tyv   t|d |  d}Y nw W n ty } zt|d }~ww || _d S td| )N*hash_alg: %s is not a valid hash algorithmpublic_bytesprivate_bytesto_pemutf-8passwordbackendz%Unable to parse an ECKey from key: %s)r   ECr   ES256SHA256ES384SHA384ES512SHA512gethash_alg
_algorithmcryptography_backendhasattrprepared_keyr+   decode
isinstancedict_process_jwkstrencodebytesr   
ValueErrorr   	Exceptionselfkey	algorithmr:   e rK   d/var/www/html/pro-man-master/venv/lib/python3.10/site-packages/jose/backends/cryptography_backend.py__init__&   sF   





zCryptographyECKey.__init__c                    s     ddkstd  d t fdddD stdt  d}t  d	}tjtjtjd
 d  }t||| }d v rZt  d}t	||}|
|  S ||  S )Nktyr0   z0Incorrect key type. Expected: 'EC', Received: %sc                 3       | ]}| v V  qd S NrK   .0kjwk_dictrK   rL   	<genexpr>W       z1CryptographyECKey._process_jwk.<locals>.<genexpr>)xycrvz Mandatory parameters are missingrX   rY   )P-256P-384P-521rZ   d)r7   r   allr   r   	SECP256R1	SECP384R1	SECP521R1EllipticCurvePublicNumbersEllipticCurvePrivateNumbersprivate_keyr:   
public_key)rG   rU   rX   rY   curvepublicr^   privaterK   rT   rL   r@   S   s$   zCryptographyECKey._process_jwkc                 C   s   t t| jjd S )zDetermine the correct serialization length for an encoded signature component.

        This is the number of bytes required to encode the maximum key value.
        g       @)intmathceilr<   key_sizerG   rK   rK   rL   _sig_component_lengthl   s   z'CryptographyECKey._sig_component_lengthc                 C   s(   t |\}}|  }t||t|| S )z4Convert signature from DER encoding to RAW encoding.)r   ro   r   )rG   der_signaturerscomponent_lengthrK   rK   rL   _der_to_raws   s   zCryptographyECKey._der_to_rawc                 C   s^   |   }t|td| krtd|d| }||d }t|d}t|d}t||S )z4Convert signature from RAW encoding to DER encoding.r   zInvalid signatureNbig)ro   lenrj   rD   
from_bytesr   )rG   raw_signaturers   r_bytess_bytesrq   rr   rK   rK   rL   _raw_to_dery   s   
zCryptographyECKey._raw_to_derc                 C   sV   | j jd | jjjkrtd| jjjd| j j f | j|t	|   }| 
|S )N   z1this curve (%s) is too short for your digest (%d))r8   digest_sizer<   rg   rm   	TypeErrornamesignr   ECDSArt   )rG   msg	signaturerK   rK   rL   r      s   
zCryptographyECKey.signc                 C   s@   z|  |}| j||t|   W dS  ty   Y dS w )NTF)r{   r<   verifyr   r   r8   rE   )rG   r   sigr   rK   rK   rL   r      s   
zCryptographyECKey.verifyc                 C      t | jdS Nr)   r;   r<   rn   rK   rK   rL   	is_public      zCryptographyECKey.is_publicc                 C       |   r| S | | j | jS rP   r   	__class__r<   rf   r9   rn   rK   rK   rL   rf         zCryptographyECKey.public_keyc                 C   sF   |   r| jjtjjtjjd}|S | jjtjjtj	j
t d}|S )Nencodingformatr   r   encryption_algorithm)r   r<   r)   r   EncodingPEMPublicFormatSubjectPublicKeyInfor*   PrivateFormatTraditionalOpenSSLNoEncryption)rG   pemrK   rK   rL   r+      s   zCryptographyECKey.to_pemc                 C   s   |   s
| j }n| j}dddd| jjj }| jjjd d }| jd|t| j	|d
d	t| j|d
d	d
}|   sS| j j}t||d
d	|d< |S )Nr[   r\   r]   )	secp256r1	secp384r1	secp521r1   r|   r0   )sizeASCII)algrN   rZ   rX   rY   r^   )r   r<   rf   rg   r   rm   r9   r#   public_numbersrX   r=   rY   private_numbersprivate_value)rG   rf   rZ   rm   datar   rK   rK   rL   to_dict   s(   	zCryptographyECKey.to_dictN)__name__
__module____qualname__r   r2   r4   r6   r   rM   r@   ro   rt   r{   r   r   r   rf   r+   r   rK   rK   rK   rL   r'   !   s    -	r'   c                   @   s   e Zd ZejZejZejZe Z	e
ee e dZe
ee e dZefddZdd Zdd Zdd	 Zd
d Zdd Zdd ZdddZdd Zdd Zdd ZdS )CryptographyRSAKeyNc              
   C   sV  |t jvrtd| t j| jt j| jt j| ji	|| _
|| _t j| jt j| jt j| ji	|| _|| _t|dr?t|dsDt|drI|| _d S t|trV| || _d S t|tr`|d}t|trz/|drs| | W d S zt||  | _W W d S  ty   t|d |  d| _Y W d S w  ty } zt|d }~ww td| )	Nr(   r)   r   r*   r,   s   -----BEGIN CERTIFICATE-----r-   z'Unable to parse an RSA_JWK from key: %s)r   RSAr   RS256r2   RS384r4   RS512r6   r7   r8   r9   RSA1_5RSA_OAEPRSA_OAEP_256r	   r:   r;   r<   r>   r?   r@   rA   rB   rC   
startswith_process_certr   rD   r   rE   rF   rK   rK   rL   rM      sR   






zCryptographyRSAKey.__init__c              	      sB    ddkstd  d t  dd}t  d}t||}d vr0||  S t  d}g d}t fd	d
|D rtt fdd
|D sUtdt d }t d }t d }	t d }
t d }nt	|||\}}t
||}	t||}
t||}t||||	|
||}||  S )NrN   r   z1Incorrect key type. Expected: 'RSA', Received: %srJ      nr^   )pqdpdqqic                 3   rO   rP   rK   rQ   rT   rK   rL   rV     rW   z2CryptographyRSAKey._process_jwk.<locals>.<genexpr>c                 3   rO   rP   rK   rQ   rT   rK   rL   rV     rW   z2Precomputed private key parameters are incomplete.r   r   r   r   r   )r7   r   r   r
   RSAPublicNumbersrf   r:   anyr_   rsa_recover_prime_factorsrsa_crt_dmp1rsa_crt_dmq1rsa_crt_iqmpRSAPrivateNumbersre   )rG   rU   rJ   r   rh   r^   extra_paramsr   r   r   r   r   ri   rK   rT   rL   r@     s.   zCryptographyRSAKey._process_jwkc                 C   s   t ||  }| | _d S rP   )r   r:   rf   r<   )rG   rH   rK   rK   rL   r   ,  s   z CryptographyRSAKey._process_certc              
   C   s@   z| j |t |  }W |S  ty } zt|d }~ww rP   )r<   r   r	   PKCS1v15r8   rE   r   )rG   r   r   rJ   rK   rK   rL   r   0  s   zCryptographyRSAKey.signc                 C   sL   |   s	td z|  j||t |   W dS  t	y%   Y dS w )NzKAttempting to verify a message with a private key. This is not recommended.TF)
r   warningswarnrf   r<   r   r	   r   r8   r   )rG   r   r   rK   rK   rL   r   7  s   
zCryptographyRSAKey.verifyc                 C   r   r   r   rn   rK   rK   rL   r   A  r   zCryptographyRSAKey.is_publicc                 C   r   rP   r   rn   rK   rK   rL   rf   D  r   zCryptographyRSAKey.public_keyPKCS8c                 C   s   |   r(|dkrtjj}n|dkrtjj}ntd| | jjtjj	|d}|S |dkr1tj
j}n|dkr:tj
j}ntd| | jjtjj	|t dS )Nr   PKCS1zInvalid format specified: %rr   r   )r   r   r   r   r   rD   r<   r)   r   r   r   r   r   r*   r   )rG   
pem_formatfmtr   rK   rK   rL   r+   I  s    



zCryptographyRSAKey.to_pemc              
   C   s   |   s
| j }n| j}| jdt| jdt| jdd}|   sk|	t| j
 jdt| j
 jdt| j
 jdt| j
 jdt| j
 jdt| j
 jdd |S )Nr   r   )r   rN   r   rJ   )r^   r   r   r   r   r   )r   r<   rf   r9   r#   r   r   r=   rJ   updater   r^   r   r   dmp1dmq1iqmp)rG   rf   r   rK   rK   rL   r   _  s&   zCryptographyRSAKey.to_dictc              
   C   s8   z| j || j}W |S  ty } zt|d }~ww rP   )r<   encryptr	   rE   r   )rG   key_datawrapped_keyrJ   rK   rK   rL   wrap_keyz  s   zCryptographyRSAKey.wrap_keyc              
   C   s8   z| j || j}|W S  ty } zt|d }~ww rP   )r<   decryptr	   rE   r   )rG   r   unwrapped_keyrJ   rK   rK   rL   
unwrap_key  s   zCryptographyRSAKey.unwrap_key)r   )r   r   r   r   r2   r4   r6   r	   r   r   OAEPMGF1SHA1r   r   r   rM   r@   r   r   r   r   rf   r+   r   r   r   rK   rK   rK   rL   r      s$    /)

r   c                   @   s(  e Zd ZejejejejfZej	ej
ejejfZejejejejejfZejfZejfZejejejfZejejej	ejejejejejejejejejejejejejejejejejej
ejejejejdejdejdiZejjd ddZ dd Z!dd Z"dd	d
Z#dddZ$dd Z%dd Z&dS )CryptographyAESKeyNr|      )CBCGCMc                 C   s  |t jvrtd| |t jt jvrtd| || _| j| j| _	|| j
v r7t|dkr7td| || jv rIt|dkrItd| || jv r[t|dkr[td| || jv rmt|d	krmtd
| || jv rt|dkrtd| || _d S )Nz%s is not a valid AES algorithmz%s is not a supported algorithm   zKey must be 128 bit for alg    zKey must be 192 bit for alg     zKey must be 256 bit for alg 0   zKey must be 384 bit for alg @   zKey must be 512 bit for alg )r   AESr   	SUPPORTEDunion
AES_PSEUDOr9   MODESr7   _modeKEY_128rv   KEY_192KEY_256KEY_384KEY_512_keyrG   rH   rI   rK   rK   rL   rM     s"   

zCryptographyAESKey.__init__c                 C   s   | j dt| jd}|S )Noctr   rN   rS   )r9   r   r   )rG   r   rK   rK   rL   r     s   zCryptographyAESKey.to_dictc              
   C   s   t |}zk| j| jjtjj}t|}| |}|jdkr<t	
| j}||||}|d t|d  }|dd  }	n.tt| j|t d}| }
ttjj }||}|| 7 }|
||
  }d }	|||	fW S  ty } zt|d }~ww )Nr   r   ir/   )r    IV_BYTE_LENGTH_MODE_MAPr7   r   r   r   r   
block_sizer%   r   AESGCMr   r   rv   r   r   	encryptorr   padderr   finalizerE   r   )rG   
plain_textaadiv_byte_lengthivmodeciphercipher_text_and_tagcipher_textauth_tagr   r   padded_datarJ   rK   rK   rL   r     s,   


zCryptographyAESKey.encryptc              
   C   s   t |}zht |}| |}|jdkr<|d u rtdt| j}|| }z||||}W |W S  ty;   t	dw t
t| j|t d}| }	|	|}
|
|	 7 }
ttjj }||
}|| 7 }|W S  ty| } zt	|d }~ww )Nr   ztag cannot be NonezInvalid JWE Auth Tagr   )r    r   r   rD   r   r   r   r   r   r   r   r   r   r   	decryptorr   r   r   r   unpadderrE   )rG   r   r   r   tagr   r   r   r   r  padded_plain_textr  rJ   rK   rK   rL   r     s6   



zCryptographyAESKey.decryptc                 C   s   t |}t| j|t }|S rP   )r    r   r   r   )rG   r   r   rK   rK   rL   r     s   zCryptographyAESKey.wrap_keyc              
   C   s@   t |}zt| j|t }W |S  ty } zt|d }~ww rP   )r    r   r   r   r   r   )rG   r   r   causerK   rK   rL   r     s   zCryptographyAESKey.unwrap_keyrP   )NNN)'r   r   r   r   A128GCM	A128GCMKWA128KWA128CBCr   A192GCM	A192GCMKWA192KWA192CBCr   A256GCM	A256GCMKWA256KWA128CBC_HS256A256CBCr   A192CBC_HS384r   A256CBC_HS512r   AES_KW_ALGSr   r   r   r   r   r   r   r   rM   r   r   r   r   r   rK   rK   rK   rL   r     sF    

r   c                   @   sZ   e Zd ZdZeje eje	 ej
e iZdd Zdd Zdd Zdd	 Zd
d ZdS )CryptographyHMACKeyzf
    Performs signing and verification operations using HMAC
    and the specified hash function.
    c                 C   s   |t jvrtd| || _| j|| _t|tr"| 	|| _
d S t|ts0t|ts0tdt|tr:|d}t|sBt|rFtd|| _
d S )Nr(   z+Expecting a string- or bytes-formatted key.r,   zdThe specified key is an asymmetric key or x509 certificate and should not be used as an HMAC secret.)r   HMACr   r9   ALG_MAPr7   	_hash_algr>   r?   r@   r<   rA   rC   rB   r!   r"   r   rK   rK   rL   rM     s    




zCryptographyHMACKey.__init__c                 C   sH   | ddkstd| d | d}|d}t|}t|}|S )NrN   r   z1Incorrect key type. Expected: 'oct', Received: %srS   r,   )r7   r   rB   rC   r   )rG   rU   rS   rK   rK   rL   r@   '  s   

z CryptographyHMACKey._process_jwkc                 C   s   | j dt| jddS )Nr   r   r   )r9   r   r<   r=   rn   rK   rK   rL   r   2  s   zCryptographyHMACKey.to_dictc                 C   s4   t |}tj| j| jt d}|| | }|S )Nr   )r    r   r  r<   r  r   r   r   )rG   r   hr   rK   rK   rL   r   9  s
   
zCryptographyHMACKey.signc                 C   s^   t |}t |}tj| j| jt d}|| z
|| d}W |S  ty.   d}Y |S w )Nr   TF)	r    r   r  r<   r  r   r   r   r   )rG   r   r   r  verifiedrK   rK   rL   r   @  s   

zCryptographyHMACKey.verifyN)r   r   r   __doc__r   HS256r   r2   HS384r4   HS512r6   r  rM   r@   r   r   r   rK   rK   rK   rL   r    s    "r  ):rk   r   cryptography.exceptionsr   r   cryptography.hazmat.backendsr   cryptography.hazmat.primitivesr   r   r   )cryptography.hazmat.primitives.asymmetricr   r	   r
   /cryptography.hazmat.primitives.asymmetric.utilsr   r   &cryptography.hazmat.primitives.ciphersr   r   r   r   &cryptography.hazmat.primitives.keywrapr   r   r   &cryptography.hazmat.primitives.paddingr   ,cryptography.hazmat.primitives.serializationr   r   cryptography.utilsr   cryptography.x509r   	constantsr   
exceptionsr   r   utilsr   r   r   r    r!   r"   r#    r%   baser&   _bindingr'   r   r   r  rK   rK   rK   rL   <module>   s2    $	 + @}