U
    #iX                     @   sd  d dl Z d dlZd dlmZmZ d dlmZ d dlmZ d dl	m
Z
mZmZ d dlmZmZmZ d dlmZmZ d dlmZmZmZmZ d d	lmZmZmZ d d
lmZ d dlm Z m!Z! d dl"m#Z# d dl$m%Z% ddl&m'Z' ddl(m)Z)m*Z* ddl+m,Z,m-Z-m.Z.m/Z/m0Z0 ddl1m2Z2 da3dd Z4G dd de2Z5G dd de2Z6G dd de2Z7G dd de2Z8dS )    N)InvalidSignature
InvalidTag)default_backend)Binding)hasheshmacserialization)ecpaddingrsa)decode_dss_signatureencode_dss_signature)Cipheraead
algorithmsmodes)InvalidUnwrapaes_key_unwrapaes_key_wrap)PKCS7)load_pem_private_keyload_pem_public_key)int_to_bytes)load_pem_x509_certificate   )
ALGORITHMS)JWEErrorJWKError)base64_to_longbase64url_decodebase64url_encodeensure_binarylong_to_base64   )Keyc                 C   sD   t dkrt a t jd| }t j||  t j|| dd }|S )aK  
    Get random bytes

    Currently, Cryptography returns OS random bytes. If you want OpenSSL
    generated random bytes, you'll have to switch the RAND engine after
    initializing the OpenSSL backend
    Args:
        num_bytes (int): Number of random bytes to generate and return
    Returns:
        bytes: Random bytes
    Nzchar[])_bindingr   ffinewlib
RAND_bytesbuffer)Z	num_bytesbufZ
rand_bytes r,   j/var/www/html/me.goteku.com/backend/venv/lib/python3.8/site-packages/jose/backends/cryptography_backend.pyget_random_bytes   s    r.   c                   @   sz   e Zd ZejZejZejZefddZdd Z	dd Z
dd Zd	d
 Zdd Zdd Zdd Zdd Zdd Zdd ZdS )CryptographyECKeyc              
   C   s<  |t jkrtd| t j| jt j| jt j| ji	|| _
|| _|| _t|dsZt|drd|| _d S t|dr|| d}t|tr| || _d S t|tr|d}t|tr,z>zt||  }W n& tk
r   t|d |  d}Y nX W n, tk
r  } zt|W 5 d }~X Y nX || _d S td| d S )N*hash_alg: %s is not a valid hash algorithmpublic_bytesprivate_bytesto_pemutf-8passwordbackendz%Unable to parse an ECKey from key: %s)r   ECr   ZES256SHA256ZES384SHA384ZES512SHA512gethash_alg
_algorithmcryptography_backendhasattrprepared_keyr3   decode
isinstancedict_process_jwkstrencodebytesr   
ValueErrorr   	Exceptionselfkey	algorithmr?   er,   r,   r-   __init__5   sD    
   



zCryptographyECKey.__init__c                    s     ddks td  d t fdddD s>tdt  d}t  d	}tjtjtjd
 d  }t||| }d krt  d}t	||}|
|  S ||  S d S )Nktyr8   z0Incorrect key type. Expected: 'EC', Received: %sc                 3   s   | ]}| kV  qd S Nr,   .0kjwk_dictr,   r-   	<genexpr>f   s     z1CryptographyECKey._process_jwk.<locals>.<genexpr>)xycrvz Mandatory parameters are missingrY   rZ   )P-256P-384P-521r[   d)r<   r   allr   r	   Z	SECP256R1Z	SECP384R1Z	SECP521R1ZEllipticCurvePublicNumbersZEllipticCurvePrivateNumbersprivate_keyr?   
public_key)rL   rW   rY   rZ   curvepublicr_   privater,   rV   r-   rE   b   s$    zCryptographyECKey._process_jwkc                 C   s   t t| jjd S )zDetermine the correct serialization length for an encoded signature component.

        This is the number of bytes required to encode the maximum key value.
        g       @)intmathceilrA   key_sizerL   r,   r,   r-   _sig_component_length{   s    z'CryptographyECKey._sig_component_lengthc                 C   s(   t |\}}|  }t||t|| S )z4Convert signature from DER encoding to RAW encoding.)r   rk   r   )rL   Zder_signaturerscomponent_lengthr,   r,   r-   _der_to_raw   s    zCryptographyECKey._der_to_rawc                 C   s^   |   }t|td| kr$td|d| }||d }t|d}t|d}t||S )z4Convert signature from RAW encoding to DER encoding.r   zInvalid signatureNbig)rk   lenrf   rI   
from_bytesr   )rL   Zraw_signaturern   Zr_bytesZs_bytesrl   rm   r,   r,   r-   _raw_to_der   s    zCryptographyECKey._raw_to_derc                 C   sV   | j jd | jjjkr4td| jjjd| j j f | j|t	|   }| 
|S )N   z1this curve (%s) is too short for your digest (%d))r=   digest_sizerA   rc   ri   	TypeErrornamesignr	   ECDSAro   )rL   msg	signaturer,   r,   r-   rx      s    zCryptographyECKey.signc                 C   sF   z*|  |}| j||t|   W dS  tk
r@   Y dS X d S )NTF)rs   rA   verifyr	   ry   r=   rJ   )rL   rz   sigr{   r,   r,   r-   r|      s    
zCryptographyECKey.verifyc                 C   s   t | jdS Nr1   r@   rA   rj   r,   r,   r-   	is_public   s    zCryptographyECKey.is_publicc                 C   s    |   r| S | | j | jS rR   r   	__class__rA   rb   r>   rj   r,   r,   r-   rb      s    zCryptographyECKey.public_keyc                 C   sF   |   r$| jjtjjtjjd}|S | jjtjjtj	j
t d}|S )Nencodingformatr   r   Zencryption_algorithm)r   rA   r1   r   EncodingPEMPublicFormatSubjectPublicKeyInfor2   PrivateFormatTraditionalOpenSSLNoEncryption)rL   pemr,   r,   r-   r3      s     zCryptographyECKey.to_pemc                 C   s   |   s| j }n| j}dddd| jjj }| jjjd d }| jd|t| j	|d
d	t| j|d
d	d
}|   s| j j}t||d
d	|d< |S )Nr\   r]   r^   )Z	secp256r1Z	secp384r1Z	secp521r1   rt   r8   )sizeASCII)algrQ   r[   rY   rZ   r_   )r   rA   rb   rc   rw   ri   r>   r"   public_numbersrY   rB   rZ   private_numbersprivate_value)rL   rb   r[   ri   datar   r,   r,   r-   to_dict   s(    	zCryptographyECKey.to_dictN)__name__
__module____qualname__r   r9   r:   r;   r   rP   rE   rk   ro   rs   rx   r|   r   rb   r3   r   r,   r,   r,   r-   r/   0   s   -	r/   c                   @   s   e Zd ZejZejZejZe Z	e
ee e dZe
ee e dZefddZdd Zdd Zdd	 Zd
d Zdd Zdd ZdddZdd Zdd Zdd ZdS )CryptographyRSAKeyNc              
   C   sb  |t jkrtd| t j| jt j| jt j| ji	|| _
|| _t j| jt j| jt j| ji	|| _|| _t|drt|dr|| _d S t|tr| || _d S t|tr|d}t|trRz^|dr| | W d S zt||  | _W n* tk
r   t|d |  d| _Y nX W n, tk
rL } zt|W 5 d }~X Y nX d S td| d S )Nr0   r1   r   r4      -----BEGIN CERTIFICATE-----r5   z'Unable to parse an RSA_JWK from key: %s)r   RSAr   ZRS256r9   ZRS384r:   ZRS512r;   r<   r=   r>   RSA1_5RSA_OAEPRSA_OAEP_256r
   r?   r@   rA   rC   rD   rE   rF   rG   rH   
startswith_process_certr   rI   r   rJ   rK   r,   r,   r-   rP      sV    
      




zCryptographyRSAKey.__init__c              	      sL    ddks td  d t  dd}t  d}t||}d kr`||  S t  d}dd	d
ddg}t fdd|D rt fdd|D stdt d }t d	 }t d
 }	t d }
t d }n6t	|||\}}t
||}	t||}
t||}t||||	|
||}||  S d S )NrQ   r   z1Incorrect key type. Expected: 'RSA', Received: %srO      nr_   pqdpdqqic                 3   s   | ]}| kV  qd S rR   r,   rS   rV   r,   r-   rX   "  s     z2CryptographyRSAKey._process_jwk.<locals>.<genexpr>c                 3   s   | ]}| kV  qd S rR   r,   rS   rV   r,   r-   rX   $  s     z2Precomputed private key parameters are incomplete.)r<   r   r   r   ZRSAPublicNumbersrb   r?   anyr`   Zrsa_recover_prime_factorsZrsa_crt_dmp1Zrsa_crt_dmq1Zrsa_crt_iqmpZRSAPrivateNumbersra   )rL   rW   rO   r   rd   r_   Zextra_paramsr   r   r   r   r   re   r,   rV   r-   rE     s.    zCryptographyRSAKey._process_jwkc                 C   s   t ||  }| | _d S rR   )r   r?   rb   rA   )rL   rM   r,   r,   r-   r   ;  s    z CryptographyRSAKey._process_certc              
   C   sL   z| j |t |  }W n* tk
rF } zt|W 5 d }~X Y nX |S rR   )rA   rx   r
   PKCS1v15r=   rJ   r   )rL   rz   r{   rO   r,   r,   r-   rx   ?  s
    zCryptographyRSAKey.signc                 C   sR   |   std z$|  j||t |   W dS  t	k
rL   Y dS X d S )NzKAttempting to verify a message with a private key. This is not recommended.TF)
r   warningswarnrb   rA   r|   r
   r   r=   r   )rL   rz   r}   r,   r,   r-   r|   F  s    
zCryptographyRSAKey.verifyc                 C   s   t | jdS r~   r   rj   r,   r,   r-   r   P  s    zCryptographyRSAKey.is_publicc                 C   s    |   r| S | | j | jS rR   r   rj   r,   r,   r-   rb   S  s    zCryptographyRSAKey.public_keyPKCS8c                 C   s   |   rP|dkrtjj}n|dkr,tjj}ntd| | jjtjj	|d}|S |dkrbtj
j}n|dkrttj
j}ntd| | jjtjj	|t dS )Nr   PKCS1zInvalid format specified: %rr   r   )r   r   r   r   r   rI   rA   r1   r   r   r   r   r   r2   r   )rL   Z
pem_formatfmtr   r,   r,   r-   r3   X  s$    



  zCryptographyRSAKey.to_pemc              
   C   s   |   s| j }n| j}| jdt| jdt| jdd}|   s|	t| j
 jdt| j
 jdt| j
 jdt| j
 jdt| j
 jdt| j
 jdd |S )Nr   r   )r   rQ   r   rO   )r_   r   r   r   r   r   )r   rA   rb   r>   r"   r   r   rB   rO   updater   r_   r   r   Zdmp1Zdmq1Ziqmp)rL   rb   r   r,   r,   r-   r   n  s&    zCryptographyRSAKey.to_dictc              
   C   sD   z| j || j}W n* tk
r> } zt|W 5 d }~X Y nX |S rR   )rA   encryptr
   rJ   r   )rL   key_datawrapped_keyrO   r,   r,   r-   wrap_key  s
    zCryptographyRSAKey.wrap_keyc              
   C   sF   z| j || j}|W S  tk
r@ } zt|W 5 d }~X Y nX d S rR   )rA   decryptr
   rJ   r   )rL   r   Zunwrapped_keyrO   r,   r,   r-   
unwrap_key  s
    zCryptographyRSAKey.unwrap_key)r   )r   r   r   r   r9   r:   r;   r
   r   r   ZOAEPZMGF1SHA1r   r   r   rP   rE   r   rx   r|   r   rb   r3   r   r   r   r,   r,   r,   r-   r      s"   /)

r   c                   @   s  e Zd ZejejejejfZej	ej
ejejfZejejejejejfZejfZejfZejejejfZejejej	ejejejejejejejejejejejejejejejejejej
ejejejejdejdejdiZdd Zdd ZdddZddd	Z d
d Z!dd Z"dS )CryptographyAESKeyNc                 C   s  |t jkrtd| |t jt jkr4td| || _| j| j| _	|| j
krpt|dkrptd| n|| jkrt|dkrtd| nt|| jkrt|dkrtd| nN|| jkrt|d	krtd
| n(|| jkr
t|dkr
td| || _d S )Nz%s is not a valid AES algorithmz%s is not a supported algorithm   zKey must be 128 bit for alg    zKey must be 192 bit for alg     zKey must be 256 bit for alg 0   zKey must be 384 bit for alg @   zKey must be 512 bit for alg )r   AESr   Z	SUPPORTEDunionZ
AES_PSEUDOr>   MODESr<   _modeKEY_128rq   KEY_192KEY_256KEY_384KEY_512_key)rL   rM   rN   r,   r,   r-   rP     s"    
zCryptographyAESKey.__init__c                 C   s   | j dt| jd}|S )Noctr   rQ   rU   )r>   r    r   )rL   r   r,   r,   r-   r     s    zCryptographyAESKey.to_dictc              
   C   s   t |}zttjjd }| |}|jdkrjt| j	}|
|||}|d t|d  }|dd  }n\tt| j	|t d}| }	ttjj }
|
|}||
 7 }|	||	  }d }|||fW S  tk
r } zt|W 5 d }~X Y nX d S )Nrt   GCMr   ir7   )r!   r.   r   r   
block_sizer   rw   r   AESGCMr   r   rq   r   r   	encryptorr   padderr   finalizerJ   r   )rL   
plain_textaadivmodeciphercipher_text_and_tagcipher_textZauth_tagr   r   Zpadded_datarO   r,   r,   r-   r     s&    


zCryptographyAESKey.encryptc              
   C   s  t |}zt |}| |}|jdkr||d kr6tdt| j}|| }z||||}W q tk
rx   t	dY qX n\t
t| j|t d}| }	|	|}
|
|	 7 }
ttjj }||
}|| 7 }|W S  tk
r } zt	|W 5 d }~X Y nX d S )Nr   ztag cannot be NonezInvalid JWE Auth Tagr   )r!   r   rw   rI   r   r   r   r   r   r   r   r   r   r   	decryptorr   r   r   r   unpadderrJ   )rL   r   r   r   tagr   r   r   r   r   Zpadded_plain_textr   rO   r,   r,   r-   r     s.    



zCryptographyAESKey.decryptc                 C   s   t |}t| j|t }|S rR   )r!   r   r   r   )rL   r   r   r,   r,   r-   r     s    zCryptographyAESKey.wrap_keyc              
   C   sL   t |}zt| j|t }W n* tk
rF } zt|W 5 d }~X Y nX |S rR   )r!   r   r   r   r   r   )rL   r   r   causer,   r,   r-   r   
  s    zCryptographyAESKey.unwrap_key)N)NNN)#r   r   r   r   ZA128GCMZ	A128GCMKWZA128KWZA128CBCr   ZA192GCMZ	A192GCMKWZA192KWZA192CBCr   ZA256GCMZ	A256GCMKWZA256KWZA128CBC_HS256ZA256CBCr   ZA192CBC_HS384r   ZA256CBC_HS512r   ZAES_KW_ALGSr   r   ZCBCr   rP   r   r   r   r   r   r,   r,   r,   r-   r     s`                  

r   c                   @   sZ   e Zd ZdZeje eje	 ej
e iZdd Zdd Zdd Zdd	 Zd
d ZdS )CryptographyHMACKeyzf
    Performs signing and verification operations using HMAC
    and the specified hash function.
    c                    s   |t jkrtd| || _| j|| _t trD| 	 | _
d S t ts`t ts`tdt trt d ddddg}t fdd	|D rtd
 | _
d S )Nr0   z+Expecting a string- or bytes-formatted key.r4   s   -----BEGIN PUBLIC KEY-----s   -----BEGIN RSA PUBLIC KEY-----r   s   ssh-rsac                 3   s   | ]}| kV  qd S rR   r,   )rT   Zstring_valuerM   r,   r-   rX   2  s     z/CryptographyHMACKey.__init__.<locals>.<genexpr>zdThe specified key is an asymmetric key or x509 certificate and should not be used as an HMAC secret.)r   HMACr   r>   ALG_MAPr<   	_hash_algrC   rD   rE   rA   rF   rH   rG   r   )rL   rM   rN   Zinvalid_stringsr,   r   r-   rP     s*    



zCryptographyHMACKey.__init__c                 C   sH   | ddks td| d | d}|d}t|}t|}|S )NrQ   r   z1Incorrect key type. Expected: 'oct', Received: %srU   r4   )r<   r   rG   rH   r   )rL   rW   rU   r,   r,   r-   rE   :  s    

z CryptographyHMACKey._process_jwkc                 C   s   | j dt| jddS )Nr   r   r   )r>   r    rA   rB   rj   r,   r,   r-   r   E  s    zCryptographyHMACKey.to_dictc                 C   s4   t |}tj| j| jt d}|| | }|S )Nr   )r!   r   r   rA   r   r   r   r   )rL   rz   hr{   r,   r,   r-   rx   L  s
    
zCryptographyHMACKey.signc                 C   s`   t |}t |}tj| j| jt d}|| z|| d}W n tk
rZ   d}Y nX |S )Nr   TF)	r!   r   r   rA   r   r   r   r|   r   )rL   rz   r}   r   Zverifiedr,   r,   r-   r|   S  s    


zCryptographyHMACKey.verifyN)r   r   r   __doc__r   ZHS256r   r9   ZHS384r:   ZHS512r;   r   rP   rE   r   rx   r|   r,   r,   r,   r-   r     s   "r   )9rg   r   Zcryptography.exceptionsr   r   Zcryptography.hazmat.backendsr   Z,cryptography.hazmat.bindings.openssl.bindingr   Zcryptography.hazmat.primitivesr   r   r   Z)cryptography.hazmat.primitives.asymmetricr	   r
   r   Z/cryptography.hazmat.primitives.asymmetric.utilsr   r   Z&cryptography.hazmat.primitives.ciphersr   r   r   r   Z&cryptography.hazmat.primitives.keywrapr   r   r   Z&cryptography.hazmat.primitives.paddingr   Z,cryptography.hazmat.primitives.serializationr   r   Zcryptography.utilsr   Zcryptography.x509r   	constantsr   
exceptionsr   r   utilsr   r   r    r!   r"   baser$   r%   r.   r/   r   r   r   r,   r,   r,   r-   <module>   s2    + @z