관리-도구
편집 파일: backend.cpython-36.pyc
3 y�_�� � @ s� d dl mZmZmZ d dlZd dlZd dlZd dlZd dlmZ d dl Z d dl m Z d dl m Z mZ d dlmZmZ d dlmZmZmZmZmZ d dlmZmZmZm Z m Z m Z m Z m Z m!Z!m"Z"m#Z#m$Z$m%Z% d d l&m'Z' d d l(m)Z) d d l*m+Z+ d d l,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5 d d l6m7Z7m8Z8m9Z9m:Z: d dl;m<Z<m=Z=m>Z> d dl?m@Z@mAZA d dlBmCZCmDZD d dlEmFZFmGZGmHZH d dlImJZJmKZKmLZLmMZMmNZNmOZOmPZPmQZQmRZR d dlSmTZT d dlUmVZV d dlWmXZXmYZY d dlZm[Z[m\Z\ d dl]m^Z^m_Z_ d dl`maZambZb d dlcmdZdmeZe d dlfmgZgmhZhmiZimjZj d dlkmlZl d d lmmnZnmoZo d d lpmqZqmrZrmsZsmtZtmuZu d d lvmwZwmxZxmyZymzZz d d l{m|Z|m}Z}m~Z~mZm�Z�m�Z�m�Z�m�Z�m�Z� d d l�m�Z�m�Z�m�Z�m�Z�m�Z�m�Z�m�Z�m�Z� d d!l�m�Z� d d"l�m�Z�m�Z� d d#l�m�Z� ej�d$d%d&g�Z�G d'd(� d(e��Z�e j�e�e j�e�e j�e�e j�e �e j�e �e j�e �e j�e �e j�e �e j�e!�e j�e#�e j�e"�e j�e%�e j�elj�� j�j�e$�G d)d*� d*e���������������Z�G d+d,� d,e��Z�d-d.� Z�e�� Z�dS )/� )�absolute_import�division�print_functionN)�contextmanager)�range)�utils�x509)�UnsupportedAlgorithm�_Reasons)�INTEGER�NULL�SEQUENCE� encode_der�encode_der_integer) � CMACBackend� CipherBackend�DERSerializationBackend� DHBackend� DSABackend�EllipticCurveBackend� HMACBackend� HashBackend�PBKDF2HMACBackend�PEMSerializationBackend� RSABackend� ScryptBackend� X509Backend)�aead)�_CipherContext)� _CMACContext) � _CRL_ENTRY_REASON_ENUM_TO_CODE�_CRL_EXTENSION_HANDLERS�_EXTENSION_HANDLERS_BASE�_EXTENSION_HANDLERS_SCT�"_OCSP_BASICRESP_EXTENSION_HANDLERS� _OCSP_REQ_EXTENSION_HANDLERS�'_OCSP_SINGLERESP_EXTENSION_HANDLERS_SCT�_REVOKED_EXTENSION_HANDLERS�_X509ExtensionParser)� _DHParameters� _DHPrivateKey� _DHPublicKey�_dh_params_dup)�_DSAParameters�_DSAPrivateKey� _DSAPublicKey)�_EllipticCurvePrivateKey�_EllipticCurvePublicKey)�_Ed25519PrivateKey�_Ed25519PublicKey)�_ED448_KEY_SIZE�_Ed448PrivateKey�_Ed448PublicKey) �$_CRL_ENTRY_EXTENSION_ENCODE_HANDLERS� _CRL_EXTENSION_ENCODE_HANDLERS�_EXTENSION_ENCODE_HANDLERS�)_OCSP_BASICRESP_EXTENSION_ENCODE_HANDLERS�'_OCSP_REQUEST_EXTENSION_ENCODE_HANDLERS�_encode_asn1_int_gc�_encode_asn1_str_gc�_encode_name_gc� _txt2obj_gc)� _HashContext)� _HMACContext)� _OCSPRequest� _OCSPResponse)�_POLY1305_KEY_SIZE�_Poly1305Context)�_RSAPrivateKey� _RSAPublicKey)�_X25519PrivateKey�_X25519PublicKey)�_X448PrivateKey�_X448PublicKey)� _Certificate�_CertificateRevocationList�_CertificateSigningRequest�_RevokedCertificate)�binding)�hashes� serialization)�dsa�ec�ed25519�ed448�rsa)�MGF1�OAEP�PKCS1v15�PSS) �AES�ARC4�Blowfish�CAST5�Camellia�ChaCha20�IDEA�SEED� TripleDES)�CBC�CFB�CFB8�CTR�ECB�GCM�OFB�XTS)�scrypt)�pkcs7�ssh)�ocsp� _MemoryBIO�bioZchar_ptrc @ s e Zd ZdS )�_RC2N)�__name__� __module__� __qualname__� rw rw � /usr/lib64/python3.6/backend.pyrs � s rs c @ s| e Zd ZdZdZddddddhZeefZe j e j e j e j e je je je je je je je je jf Zd Zd Zd d > Zd Zd e> Z d d � Z �d-dd�Z dd� Z dd� Z e!j"dd� �Z#dd� Z$dd� Z%dd � Z&d d � Z'd d � Z(d!d"� Z)d#d$� Z*d%d&� Z+d'd(� Z,d)d*� Z-d+d,� Z.d-d.� Z/d/d0� Z0d1d2� Z1d3d4� Z2d5d6� Z3d7d8� Z4d9d:� Z5d;d<� Z6d=d>� Z7d?d@� Z8dAdB� Z9�d.dCdD�Z:dEdF� Z;dGdH� Z<dIdJ� Z=dKdL� Z>dMdN� Z?dOdP� Z@dQdR� ZAdSdT� ZBdUdV� ZCdWdX� ZDdYdZ� ZEd[d\� ZFd]d^� ZGd_d`� ZHdadb� ZIdcdd� ZJdedf� ZKdgdh� ZLdidj� ZMdkdl� ZNdmdn� ZOdodp� ZPdqdr� ZQdsdt� ZRdudv� ZSdwdx� ZTdydz� ZUd{d|� ZVd}d~� ZWdd�� ZXd�d�� ZYd�d�� ZZd�d�� Z[d�d�� Z\d�d�� Z]d�d�� Z^d�d�� Z_d�d�� Z`d�d�� Zad�d�� Zbd�d�� Zcd�d�� Zdd�d�� Zed�d�� Zfd�d�� Zgd�d�� Zhd�d�� Zid�d�� Zjd�d�� Zkd�d�� Zld�d�� Zmd�d�� Znd�d�� Zod�d�� Zpd�d�� Zqd�d�� Zrd�d�� Zsd�d�� Ztd�d�� Zud�d�� Zvd�d�� Zwd�d�� Zxd�d Zyd�dĄ Zzd�dƄ Z{d�dȄ Z|d�dʄ Z}d�d̄ Z~e"d�d΄ �Zd�dЄ Z�d�d҄ Z�d�dԄ Z�d�dք Z�d�d Z�d�dڄ Z�d�d܄ Z�d�dބ Z�d�d� Z�d�d� Z�d�d� Z�d�d� Z�d�d� Z�d�d� Z��d/d�d�Z�d�d� Z�d�d� Z�d�d� Z�d�d� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d��d � Z��d�d� Z��d�d� Z��d�d� Z��d�d� Z��d �d � Z��d �d � Z��d �d� Z��d�d� Z��d�d� Z��d�d� Z��d�d� Z�e!j"�d�d� �Z��d�d� Z�e!j"�d�d � �Z��d �d � Z��d �d � Z��d!�d"� Z��d#�d$� Z��d%�d&� Z��d'�d(� Z��d)�d*� Z��d+�d,� Z�dS (0 �Backendz) OpenSSL API binding interfaces. Zopenssls aes-128-ccms aes-192-ccms aes-256-ccms aes-128-gcms aes-192-gcms aes-256-gcmi i � c C s� t j� | _| jj| _| jj| _| j� | _i | _ | j � | j � | j � | jrb| jj rbtjdt� n| j� | jjg| _| jjr�| jj| jj� d S )Nz<OpenSSL FIPS mode is enabled. Can't enable DRBG fork safety.)rP �BindingZ_bindingZffi�_ffi�lib�_lib�_is_fips_enabled� _fips_enabled�_cipher_registry�_register_default_ciphers�_register_x509_ext_parsers�_register_x509_encoders�"CRYPTOGRAPHY_NEEDS_OSRANDOM_ENGINE�warnings�warn� UserWarning�activate_osrandom_engineZ EVP_PKEY_DH� _dh_types� Cryptography_HAS_EVP_PKEY_DHX�appendZ EVP_PKEY_DHX)�selfrw rw rx �__init__� s zBackend.__init__Nc C s t j| j||d�S )N)�errors)rP Z_openssl_assertr~ )r� �okr� rw rw rx �openssl_assert� s zBackend.openssl_assertc C s2 t | jddd� �}|� }|dkr*| jj� t|�S )NZ FIPS_modec S s dS )Nr rw rw rw rw rx �<lambda>� s z*Backend._is_fips_enabled.<locals>.<lambda>r )�getattrr~ ZERR_clear_error�bool)r� Z fips_mode�moderw rw rx r � s zBackend._is_fips_enabledc C sf | j jrb| j j� }|| jjkrb| j j|� | j j| jj�}| j|dk� | j j|�}| j|dk� d S )Nrz ) r~ r� ZENGINE_get_default_RANDr| r ZENGINE_unregister_RAND�RAND_set_rand_methodr� � ENGINE_finish)r� �e�resrw rw rx �activate_builtin_random� s z Backend.activate_builtin_randomc c s� | j j| j j�}| j|| jjk� | j j|�}| j|dk� z |V W d | j j|�}| j|dk� | j j|�}| j|dk� X d S )Nrz ) r~ Z ENGINE_by_idZ Cryptography_osrandom_engine_idr� r| r Z ENGINE_initZ ENGINE_freer� )r� r� r� rw rw rx �_get_osurandom_engine s z Backend._get_osurandom_enginec C s` | j jr\| j� | j� � }| j j|�}| j|dk� W d Q R X | j j| jj�}| j|dk� d S )Nrz ) r~ r� r� r� ZENGINE_set_default_RANDr� r� r| r )r� r� r� rw rw rx r� s z Backend.activate_osrandom_enginec C s` | j jdd�}| j� �2}| jj|dt|�|| j jd�}| j|dk� W d Q R X | j j|�j d�S )Nzchar[]�@ s get_implementationr �ascii) r| �newr� r~ ZENGINE_ctrl_cmd�lenr r� �string�decode)r� �bufr� r� rw rw rx � osrandom_engine_implementation+ s z&Backend.osrandom_engine_implementationc C s | j j| jj| jj��jd�S )z� Friendly string name of the loaded OpenSSL library. This is not necessarily the same version as it was compiled against. Example: OpenSSL 1.1.1d 10 Sep 2019 r� )r| r� r~ ZOpenSSL_versionZOPENSSL_VERSIONr� )r� rw rw rx �openssl_version_text4 s z Backend.openssl_version_textc C s | j j� S )N)r~ ZOpenSSL_version_num)r� rw rw rx �openssl_version_number? s z Backend.openssl_version_numberc C s t | ||�S )N)rA )r� �key� algorithmrw rw rx �create_hmac_ctxB s zBackend.create_hmac_ctxc C sL |j dks|j dkr0dj|j |jd �jd�}n |j jd�}| jj|�}|S )NZblake2bZblake2sz{}{}� r� )�name�formatZ digest_size�encoder~ ZEVP_get_digestbyname)r� r� Zalg�evp_mdrw rw rx �_evp_md_from_algorithmE s z Backend._evp_md_from_algorithmc C s | j |�}| j|| jjk� |S )N)r� r� r| r )r� r� r� rw rw rx � _evp_md_non_null_from_algorithmP s z'Backend._evp_md_non_null_from_algorithmc C s. | j rt|| j� rdS | j|�}|| jjkS )NF)r� � isinstance� _fips_hashesr� r| r )r� r� r� rw rw rx �hash_supportedU s zBackend.hash_supportedc C s | j |�S )N)r� )r� r� rw rw rx �hmac_supported\ s zBackend.hmac_supportedc C s t | |�S )N)r@ )r� r� rw rw rx �create_hash_ctx_ s zBackend.create_hash_ctxc C s` | j rt|| j� rdS y| jt|�t|�f }W n tk rF dS X || ||�}| jj|kS )NF)r� r� � _fips_ciphersr� �type�KeyErrorr| r )r� �cipherr� �adapter� evp_cipherrw rw rx �cipher_supportedb s zBackend.cipher_supportedc C s0 ||f| j kr tdj||���|| j ||f< d S )Nz"Duplicate registration for: {} {}.)r� � ValueErrorr� )r� � cipher_cls�mode_clsr� rw rw rx �register_cipher_adapterl s z Backend.register_cipher_adapterc C sn x,t ttttttgD ]}| jt|t d�� qW x(t ttttgD ]}| jt |t d�� q>W x&t tttgD ]}| jt |t d�� qfW | jt tt d�� x&t tttgD ]}| jt |t d�� q�W x&t tttgD ]}| jt |t d�� q�W x6tjttgt tttg�D ]\}}| j||t d�� q�W | jttd �t d�� | jttd �t d�� | jttd �t d �� | jttt� d S ) Nz+{cipher.name}-{cipher.key_size}-{mode.name}zdes-ede3-{mode.name}zdes-ede3zbf-{mode.name}zseed-{mode.name}z{cipher.name}-{mode.name}Zrc4Zrc2Zchacha20)re rh ri rk rf rg rj r� r\ �GetCipherByNamer` rd r^ rc � itertools�productr_ rb r] r� rs ra rl �_get_xts_cipher)r� r� r� rw rw rx r� u sB z!Backend._register_default_ciphersc C s� t j� }tj� }| jjr,|jt� |jt� t| | jj | jj |d�| _ t| | jj | jj |d�| _t| | jj| jjtd�| _t| | jj| jjtd�| _t| | jj| jjtd�| _t| | jj| jjt d�| _ t| | jj | jj |d�| _ d S )N)Z ext_countZget_ext�handlers)!r" �copyr' r~ ZCryptography_HAS_SCT�updater# r& r( ZX509_get_ext_countZ X509_get_extZ _certificate_extension_parserZsk_X509_EXTENSION_numZsk_X509_EXTENSION_valueZ_csr_extension_parserZX509_REVOKED_get_ext_countZX509_REVOKED_get_extZ _revoked_cert_extension_parserZX509_CRL_get_ext_countZX509_CRL_get_extr! Z_crl_extension_parserZOCSP_REQUEST_get_ext_countZOCSP_REQUEST_get_extr% Z_ocsp_req_ext_parserZ OCSP_BASICRESP_get_ext_countZOCSP_BASICRESP_get_extr$ Z_ocsp_basicresp_ext_parserZ OCSP_SINGLERESP_get_ext_countZOCSP_SINGLERESP_get_extZ_ocsp_singleresp_ext_parser)r� Z ext_handlersZsingleresp_handlersrw rw rx r� � sP z"Backend._register_x509_ext_parsersc C s6 t j� | _tj� | _tj� | _tj� | _t j� | _ d S )N) r9 r� �_extension_encode_handlersr8 � _crl_extension_encode_handlersr7 �$_crl_entry_extension_encode_handlersr; �'_ocsp_request_extension_encode_handlersr: �)_ocsp_basicresp_extension_encode_handlers)r� rw rw rx r� � s z Backend._register_x509_encodersc C s t | ||t j�S )N)r Z_ENCRYPT)r� r� r� rw rw rx � create_symmetric_encryption_ctx� s z'Backend.create_symmetric_encryption_ctxc C s t | ||t j�S )N)r Z_DECRYPT)r� r� r� rw rw rx � create_symmetric_decryption_ctx� s z'Backend.create_symmetric_decryption_ctxc C s | j |�S )N)r� )r� r� rw rw rx �pbkdf2_hmac_supported� s z Backend.pbkdf2_hmac_supportedc C sh | j jd|�}| j|�}| j j|�}| jj|t|�|t|�||||�} | j| dk� | j j|�d d � S )Nzunsigned char[]rz ) r| r� r� � from_bufferr~ ZPKCS5_PBKDF2_HMACr� r� �buffer) r� r� �length�saltZ iterations� key_materialr� r� �key_material_ptrr� rw rw rx �derive_pbkdf2_hmac� s zBackend.derive_pbkdf2_hmacc C s t j| j�S )N)rP �_consume_errorsr~ )r� rw rw rx r� s zBackend._consume_errorsc C s t j| j�S )N)rP �_consume_errors_with_textr~ )r� rw rw rx r� s z!Backend._consume_errors_with_textc C s� || j jkst�tjs~| jj|�}| j jd|�}| jj||�}| j |dk� t j | j j |�d |� d�}| jj |�rz| }|S | jj|�}| j || j jk� | j j|�}| jj|� t |d�S d S )Nzunsigned char[]r �big� )r| r �AssertionError�six�PY2r~ Z BN_num_bytesr� Z BN_bn2binr� �int� from_bytesr� ZBN_is_negativeZ BN_bn2hexr� � OPENSSL_free)r� �bnZ bn_num_bytesZbin_ptrZbin_len�valZ hex_cdataZhex_strrw rw rx � _bn_to_int s zBackend._bn_to_intc C s� |dks|| j jkst�|dkr(| j j}tjst|jt|j� d d �d�}| jj |t |�|�}| j || j jk� |S t |�j d�dd� jd�}| j jd�}||d < | jj||�}| j |d k� | j |d | j jk� |d S dS ) a Converts a python integer to a BIGNUM. The returned BIGNUM will not be garbage collected (to support adding them to structs that take ownership of the object). Be sure to register it for GC if it will be discarded after use. Ng @rz r� �L� r� z BIGNUM **r )r| r r� r� r� �to_bytesr� � bit_lengthr~ Z BN_bin2bnr� r� �hex�rstripr� r� Z BN_hex2bn)r� �numr� ZbinaryZbn_ptrZhex_numr� rw rw rx � _int_to_bn s zBackend._int_to_bnc C s� t j||� | jj� }| j|| jjk� | jj|| jj�}| j |�}| jj|| jj �}| jj |||| jj�}| j|dk� | j |�}t | ||�S )Nrz )rW Z_verify_rsa_parametersr~ �RSA_newr� r| r �gc�RSA_freer� �BN_freeZRSA_generate_key_ex�_rsa_cdata_to_evp_pkeyrF )r� �public_exponent�key_size� rsa_cdatar� r� �evp_pkeyrw rw rx �generate_rsa_private_key= s z Backend.generate_rsa_private_keyc C s |dko|d@ dko|dkS )N� rz r i rw )r� r� r� rw rw rx �!generate_rsa_parameters_supportedO s z)Backend.generate_rsa_parameters_supportedc C s2 t j|j|j|j|j|j|j|jj |jj � | j j � }| j || jjk� | jj|| j j�}| j|j�}| j|j�}| j|j�}| j|j�}| j|j�}| j|j�}| j|jj �} | j|jj �} | j j|||�} | j | dk� | j j|| | |�} | j | dk� | j j||||�} | j | dk� | j|�} t| || �S )Nrz )rW Z _check_private_key_components�p�q�d�dmp1�dmq1�iqmp�public_numbersr� �nr~ r� r� r| r r� r� r� ZRSA_set0_factors� RSA_set0_keyZRSA_set0_crt_paramsr� rF ) r� �numbersr� r� r� r� r� r� r� r� r� r� r� rw rw rx �load_rsa_private_numbersV s8 z Backend.load_rsa_private_numbersc C s� t j|j|j� | jj� }| j|| jjk� | jj || jj �}| j |j�}| j |j�}| jj |||| jj�}| j|dk� | j |�}t| ||�S )Nrz )rW Z _check_public_key_componentsr� r� r~ r� r� r| r r� r� r� r� r� rG )r� r r� r� r� r� r� rw rw rx �load_rsa_public_numbersv s z Backend.load_rsa_public_numbersc C s2 | j j� }| j|| jjk� | jj|| j j�}|S )N)r~ Z EVP_PKEY_newr� r| r r� � EVP_PKEY_free)r� r� rw rw rx �_create_evp_pkey_gc� s zBackend._create_evp_pkey_gcc C s( | j � }| jj||�}| j|dk� |S )Nrz )r r~ ZEVP_PKEY_set1_RSAr� )r� r� r� r� rw rw rx r� � s z Backend._rsa_cdata_to_evp_pkeyc C sH | j j|�}| jj|t|��}| j|| j jk� t| j j|| jj �|�S )z� Return a _MemoryBIO namedtuple of (BIO, char*). The char* is the storage for the BIO and it must stay alive until the BIO is finished with. ) r| r� r~ ZBIO_new_mem_bufr� r� r rq r� �BIO_free)r� �data�data_ptrrr rw rw rx � _bytes_to_bio� s zBackend._bytes_to_bioc C sP | j j� }| j|| jjk� | j j|�}| j|| jjk� | jj|| j j�}|S )z. Creates an empty memory BIO. )r~ Z BIO_s_memr� r| r ZBIO_newr� r )r� Z bio_methodrr rw rw rx �_create_mem_bio_gc� s zBackend._create_mem_bio_gcc C s\ | j jd�}| jj||�}| j|dk� | j|d | j jk� | j j|d |�dd� }|S )zE Reads a memory BIO. This only works on memory BIOs. zchar **r N)r| r� r~ ZBIO_get_mem_datar� r r� )r� rr r� Zbuf_len�bio_datarw rw rx � _read_mem_bio� s zBackend._read_mem_bioc C s� | j j|�}|| j jkrT| j j|�}| j|| jjk� | jj|| j j�}t | ||�S || j j kr�| j j |�}| j|| jjk� | jj|| j j �}t | ||�S || j jkr�| j j|�}| j|| jjk� | jj|| j j�}t| ||�S || jk�r,| j j|�}| j|| jjk� | jj|| j j�}t| ||�S |t| j dd�k�rJt| |�S |t| j dd�k�rht| |�S |t| j dd�k�r�t| |�S |t| j dd�k�r�t| |�S td��dS )zd Return the appropriate type of PrivateKey given an evp_pkey cdata pointer. �EVP_PKEY_ED25519N� EVP_PKEY_X448�EVP_PKEY_X25519�EVP_PKEY_ED448zUnsupported key type.) r~ � EVP_PKEY_id� EVP_PKEY_RSA�EVP_PKEY_get1_RSAr� r| r r� r� rF � EVP_PKEY_DSA�EVP_PKEY_get1_DSA�DSA_freer. � EVP_PKEY_EC�EVP_PKEY_get1_EC_KEY� EC_KEY_freer0 r� �EVP_PKEY_get1_DH�DH_freer* r� r2 rJ rH r5 r )r� r� �key_typer� � dsa_cdata�ec_cdata�dh_cdatarw rw rx �_evp_pkey_to_private_key� s< z Backend._evp_pkey_to_private_keyc C s� | j j|�}|| j jkrT| j j|�}| j|| jjk� | jj|| j j�}t | ||�S || j j kr�| j j |�}| j|| jjk� | jj|| j j �}t | ||�S || j jkr�| j j|�}| j|| jjk� | jj|| j j�}t| ||�S || jk�r,| j j|�}| j|| jjk� | jj|| j j�}t| ||�S |t| j dd�k�rJt| |�S |t| j dd�k�rht| |�S |t| j dd�k�r�t| |�S |t| j dd�k�r�t| |�S td��dS )zc Return the appropriate type of PublicKey given an evp_pkey cdata pointer. r Nr r r zUnsupported key type.) r~ r r r r� r| r r� r� rG r r r r/ r r r r1 r� r r r+ r� r3 rK rI r6 r )r� r� r r� r r r rw rw rx �_evp_pkey_to_public_key� s< z Backend._evp_pkey_to_public_keyc C s6 | j jr&t|tjtjtjtjtjf�S t|tj�S d S )N) r~ Z Cryptography_HAS_RSA_OAEP_MDr� rQ �SHA1�SHA224�SHA256�SHA384�SHA512)r� r� rw rw rx �_oaep_hash_supported s z Backend._oaep_hash_supportedc C s� t |t�rdS t |t�r2t |jt�r2| j|jj�S t |t�r�t |jt�r�| j|jj�o�| j|j�o�|j d kp�t |j �dkp�| j j dkS dS d S )NTr rz F) r� rZ r[ Z_mgfrX r� � _algorithmrY r& Z_labelr� r~ Z Cryptography_HAS_RSA_OAEP_LABEL)r� Zpaddingrw rw rx �rsa_padding_supported s z Backend.rsa_padding_supportedc C s~ |dkrt d��| jj� }| j|| jjk� | jj|| jj�}| jj||| jjd| jj| jj| jj�}| j|dk� t | |�S ) N� � � � z0Key size must be 1024, 2048, 3072, or 4096 bits.r rz )r) r* r+ r, ) r� r~ �DSA_newr� r| r r� r ZDSA_generate_parameters_exr- )r� r� �ctxr� rw rw rx �generate_dsa_parameters( s z Backend.generate_dsa_parametersc C sT | j j|j�}| j|| jjk� | jj|| j j�}| j j|� | j |�}t | ||�S )N) r~ Z DSAparams_dupZ _dsa_cdatar� r| r r� r ZDSA_generate_key�_dsa_cdata_to_evp_pkeyr. )r� � parametersr. r� rw rw rx �generate_dsa_private_key@ s z Backend.generate_dsa_private_keyc C s | j |�}| j|�S )N)r/ r2 )r� r� r1 rw rw rx �'generate_dsa_private_key_and_parametersI s z/Backend.generate_dsa_private_key_and_parametersc C sB | j j||||�}| j|dk� | j j|||�}| j|dk� d S )Nrz )r~ � DSA_set0_pqgr� Z DSA_set0_key)r� r r� r� �g�pub_key�priv_keyr� rw rw rx �_dsa_cdata_set_valuesM s z Backend._dsa_cdata_set_valuesc C s� t j|� |jj}| jj� }| j|| jjk� | jj || jj �}| j |j �}| j |j �}| j |j�}| j |jj�}| j |j�}| j||||||� | j|�} t| || �S )N)rS Z_check_dsa_private_numbersr� �parameter_numbersr~ r- r� r| r r� r r� r� r� r5 �y�xr8 r0 r. ) r� r r9 r r� r� r5 r6 r7 r� rw rw rx �load_dsa_private_numbersS s z Backend.load_dsa_private_numbersc C s� t j|j� | jj� }| j|| jjk� | jj|| jj �}| j |jj �}| j |jj �}| j |jj �}| j |j�}| jj}| j||||||� | j|�}t| ||�S )N)rS �_check_dsa_parametersr9 r~ r- r� r| r r� r r� r� r� r5 r: r8 r0 r/ ) r� r r r� r� r5 r6 r7 r� rw rw rx �load_dsa_public_numbersf s z Backend.load_dsa_public_numbersc C s� t j|� | jj� }| j|| jjk� | jj|| jj�}| j |j �}| j |j �}| j |j �}| jj ||||�}| j|dk� t| |�S )Nrz )rS r= r~ r- r� r| r r� r r� r� r� r5 r4 r- )r� r r r� r� r5 r� rw rw rx �load_dsa_parameter_numbersw s z"Backend.load_dsa_parameter_numbersc C s( | j � }| jj||�}| j|dk� |S )Nrz )r r~ ZEVP_PKEY_set1_DSAr� )r� r r� r� rw rw rx r0 � s z Backend._dsa_cdata_to_evp_pkeyc C s | j |�S )N)r� )r� r� rw rw rx �dsa_hash_supported� s zBackend.dsa_hash_supportedc C s dS )NTrw )r� r� r� r5 rw rw rx �dsa_parameters_supported� s z Backend.dsa_parameters_supportedc C s | j |td|j ��S )N� )r� re Z block_size)r� r� rw rw rx �cmac_algorithm_supported� s z Backend.cmac_algorithm_supportedc C s t | |�S )N)r )r� r� rw rw rx �create_cmac_ctx� s zBackend.create_cmac_ctxc C s� t |tjtjf�r$|d k r|td��nXt |tjtj t j f�sDt d��n8t |t j�sZt d��n"t |t j�r|t |tj� r|td��d S )Nz8algorithm must be None when signing via ed25519 or ed448z;Key must be an rsa, dsa, ec, ed25519, or ed448 private key.z.Algorithm must be a registered hash algorithm.z2MD5 hash algorithm is only supported with RSA keys)r� rU �Ed25519PrivateKeyrV �Ed448PrivateKeyr� rW Z RSAPrivateKeyrS Z DSAPrivateKeyrT ZEllipticCurvePrivateKey� TypeErrorrQ Z HashAlgorithmZMD5)r� � private_keyr� rw rw rx � _x509_check_signature_params� s z$Backend._x509_check_signature_paramsc s� t |tj�std��� j||� � j||�}� jj� }� j|� j j k� � j j |� jj �}� jj |tjjj�}� j|dk� � jj|t� |j��}� j|dk� |j� }� jj||j�}� j|dk� � jj� }� j|� j j k� � j j |� fdd��}� j|j� j|� jjdd� � jj ||�}� j|dk� xN|j D ]D\} } t � | j �} � jj || tj!j"j#j| t$| ��}� j|dk� �q8W � jj%||j|�}|dk�r�� j&� } t'd| ��t(� |�S ) NzBuilder type mismatch.rz c s � j j| � jj� j jd��S )N�X509_EXTENSION_free)r~ Zsk_X509_EXTENSION_pop_freer| � addressof� _original_lib)r; )r� rw rx r� � s z)Backend.create_x509_csr.<locals>.<lambda>F)� extensionsr� �x509_obj�add_funcr� r zSigning failed))r� r Z CertificateSigningRequestBuilderrG rI �_evp_md_x509_null_if_eddsar~ Z X509_REQ_newr� r| r r� � X509_REQ_freeZX509_REQ_set_versionZVersionZv1�valueZX509_REQ_set_subject_namer> � _subject_name� public_keyZX509_REQ_set_pubkey� _evp_pkeyZsk_X509_EXTENSION_new_null�_create_x509_extensions� _extensionsr� Zsk_X509_EXTENSION_insertZX509_REQ_add_extensions� _attributesr? � dotted_stringZX509_REQ_add1_attr_by_OBJr� Z _ASN1TypeZ UTF8Stringr� Z X509_REQ_signr� r� rN ) r� �builderrH r� r� �x509_reqr� rT Z sk_extensionZattr_oidZattr_val�objr� rw )r� rx �create_x509_csr� sT zBackend.create_x509_csrc C sx t |tj�std��| j||� | j||�}| jj� }| jj || jj �}| jj ||j j �}| j|dk� | jj|t| |j��}| j|dk� | jj||jj�}| j|dk� t| |j�}| jj||�}| j|dk� | j| jj|�|j� | j| jj|�|j � | j |j | j || jj dd� | jj!|t| |j"��}| j|dk� | jj#||j|�}|dk�rn| j$� }t%d|��t&| |�S )NzBuilder type mismatch.rz T)rM r� rN rO r� r zSigning failed)'r� r ZCertificateBuilderrG rI rP r~ ZX509_newr| r� � X509_freeZX509_set_versionZ_versionrR r� ZX509_set_subject_namer> rS ZX509_set_pubkeyZ _public_keyrU r< �_serial_numberZX509_set_serialNumber�_set_asn1_timeZX509_getm_notBeforeZ_not_valid_beforeZX509_getm_notAfterZ_not_valid_afterrV rW r� Z X509_add_extZX509_set_issuer_name� _issuer_nameZ X509_signr� r� rL ) r� rZ rH r� r� Z x509_certr� � serial_numberr� rw rw rx �create_x509_certificate� sF z Backend.create_x509_certificatec C s( t |tjtjf�r| jjS | j|�S d S )N)r� rU rE rV rF r| r r� )r� rH r� rw rw rx rP ; s z"Backend._evp_md_x509_null_if_eddsac C sL |j dkr |jd�jd�}n|jd�jd�}| jj||�}| j|dk� d S )Ni z %Y%m%d%H%M%SZr� z %y%m%d%H%M%SZrz )ZyearZstrftimer� r~ ZASN1_TIME_set_stringr� )r� � asn1_time�timeZasn1_strr� rw rw rx r` D s zBackend._set_asn1_timec C s> | j j� }| j|| jjk� | jj|| j j�}| j||� |S )N)r~ Z ASN1_TIME_newr� r| r r� ZASN1_TIME_freer` )r� re rd rw rw rx �_create_asn1_timeL s zBackend._create_asn1_timec C sx t |tj�std��| j||� | j||�}| jj� }| jj || jj �}| jj |d�}| j |dk� | jj |t| |j��}| j |dk� | j|j�}| jj||�}| j |dk� | j|j�}| jj||�}| j |dk� | j|j| j|| jjdd� xJ|jD ]@} | jj| j�} | j | | jj k� | jj || �}| j |dk� q�W | jj ||j |�}|dk�rn| j � } t!d| ��t"| |�S )NzBuilder type mismatch.rz T)rM r� rN rO r� r zSigning failed)#r� r Z CertificateRevocationListBuilderrG rI rP r~ Z X509_CRL_newr| r� � X509_CRL_freeZX509_CRL_set_versionr� ZX509_CRL_set_issuer_namer> ra rf Z _last_updateZX509_CRL_set_lastUpdate� _next_updateZX509_CRL_set_nextUpdaterV rW r� ZX509_CRL_add_extZ_revoked_certificatesZX509_REVOKED_dupZ _x509_revokedr ZX509_CRL_add0_revokedZ X509_CRL_signrU r� r� rM ) r� rZ rH r� r� �x509_crlr� Z last_update� next_updateZ revoked_certZrevokedr� rw rw rx �create_x509_crlS sB zBackend.create_x509_crlc C sh xbt |�D ]V\}}| j||�}| j|| jjk� |rF| jj|| jj�}||||�} | j| dk� q W d S )Nrz )� enumerate�_create_x509_extensionr� r| r r� r~ rJ ) r� rM r� rN rO r� �i� extensionZx509_extensionr� rw rw rx rV � s z Backend._create_x509_extensionsc C s. t | |jj�}| jj| jj||jr&dnd|�S )Nrz r )r? �oidrY r~ Z X509_EXTENSION_create_by_OBJr| r �critical)r� ro rR r\ rw rw rx �_create_raw_x509_extension� s z"Backend._create_raw_x509_extensionc C s t |jtj�r(t| |jj�}| j||�S t |jtj�rfttfdd� |jD ��� }t| |�}| j||�S t |jtj �r�t| tt ��}| j||�S y||j }W n$ t k r� t dj|j ���Y nX || |j�}| jj|j jjd��}| j|| jjk� | jj||j�r dnd|�S d S )Nc S s g | ]}t tt|j���qS rw )r r r rR )�.0r; rw rw rx � <listcomp>� s z2Backend._create_x509_extension.<locals>.<listcomp>zExtension not supported: {}r� rz r )r� rR r ZUnrecognizedExtensionr= rr Z TLSFeaturer r Z PrecertPoisonr rp r� �NotImplementedErrorr� r~ Z OBJ_txt2nidrY r� r� � NID_undefZX509V3_EXT_i2drq )r� r� ro rR Zasn1r� Z ext_struct�nidrw rw rx rm � s0 z Backend._create_x509_extensionc C s� t |tj�std��| jj� }| j|| jjk� | jj || jj �}t | |j �}| jj ||�}| j|dk� | j|j�}| jj||�}| j|dk� | j|j| j|| jjdd� t| d |�S )NzBuilder type mismatch.rz T)rM r� rN rO r� )r� r ZRevokedCertificateBuilderrG r~ ZX509_REVOKED_newr� r| r r� ZX509_REVOKED_freer< r_ Z X509_REVOKED_set_serialNumberrf Z_revocation_dateZ X509_REVOKED_set_revocationDaterV rW r� ZX509_REVOKED_add_extrO )r� rZ Z x509_revokedrb r� Zrev_daterw rw rx � create_x509_revoked_certificate� s& z'Backend.create_x509_revoked_certificatec C s | j | jj| j||�S )N)� _load_keyr~ ZPEM_read_bio_PrivateKeyr )r� r �passwordrw rw rx �load_pem_private_key� s z Backend.load_pem_private_keyc C s� | j |�}| jj|j| jj| jj| jj�}|| jjkrR| jj|| jj�}| j|�S | j � | jj |j�}| j |dk� | jj |j| jj| jj| jj�}|| jjkr�| jj|| jj �}| j|�}t| ||�S | j� d S )Nrz )r r~ ZPEM_read_bio_PUBKEYrr r| r r� r r r� � BIO_resetr� ZPEM_read_bio_RSAPublicKeyr� r� rG �_handle_key_loading_error)r� r �mem_bior� r� r� rw rw rx �load_pem_public_key� s zBackend.load_pem_public_keyc C s^ | j |�}| jj|j| jj| jj| jj�}|| jjkrR| jj|| jj�}t| |�S | j � d S )N) r r~ ZPEM_read_bio_DHparamsrr r| r r� r r) r} )r� r r~ r rw rw rx �load_pem_parameters� s zBackend.load_pem_parametersc C s> | j |�}| j||�}|r$| j|�S | j| jj| j||�S d S )N)r �"_evp_pkey_from_der_traditional_keyr ry r~ Zd2i_PKCS8PrivateKey_bio)r� r rz r r� rw rw rx �load_der_private_key s z Backend.load_der_private_keyc C sV | j j|j| jj�}|| jjkrF| jj|| j j�}|d k rBtd��|S | j� d S d S )Nz4Password was given but private key is not encrypted.) r~ �d2i_PrivateKey_biorr r| r r� r rG r� )r� r rz r� rw rw rx r� s z*Backend._evp_pkey_from_der_traditional_keyc C s� | j |�}| jj|j| jj�}|| jjkrF| jj|| jj�}| j|�S | j � | jj |j�}| j |dk� | jj |j| jj�}|| jjkr�| jj|| jj �}| j|�}t| ||�S | j� d S )Nrz )r r~ Zd2i_PUBKEY_biorr r| r r� r r r� r| r� Zd2i_RSAPublicKey_bior� r� rG r} )r� r r~ r� r� r� rw rw rx �load_der_public_key( s zBackend.load_der_public_keyc C s� | j |�}| jj|j| jj�}|| jjkrF| jj|| jj�}t| |�S | jj r�| j � | jj |j�}| j |dk� | jj |j| jj�}|| jjkr�| jj|| jj�}t| |�S | j� d S )Nrz )r r~ Zd2i_DHparams_biorr r| r r� r r) r� r� r| r� Z Cryptography_d2i_DHxparams_bior} )r� r r~ r r� rw rw rx �load_der_parameters? s zBackend.load_der_parametersc C sb | j |�}| jj|j| jj| jj| jj�}|| jjkrF| j� td��| jj|| jj �}t | |�S )NzwUnable to load certificate. See https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file for more details.) r r~ ZPEM_read_bio_X509rr r| r r� r� r� r^ rL )r� r r~ r rw rw rx �load_pem_x509_certificateS s z!Backend.load_pem_x509_certificatec C sV | j |�}| jj|j| jj�}|| jjkr:| j� td��| jj|| jj �}t | |�S )NzUnable to load certificate) r r~ Z d2i_X509_biorr r| r r� r� r� r^ rL )r� r r~ r rw rw rx �load_der_x509_certificateb s z!Backend.load_der_x509_certificatec C sb | j |�}| jj|j| jj| jj| jj�}|| jjkrF| j� td��| jj|| jj �}t | |�S )NzoUnable to load CRL. See https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file for more details.) r r~ ZPEM_read_bio_X509_CRLrr r| r r� r� r� rg rM )r� r r~ ri rw rw rx �load_pem_x509_crll s zBackend.load_pem_x509_crlc C sV | j |�}| jj|j| jj�}|| jjkr:| j� td��| jj|| jj �}t | |�S )NzUnable to load CRL) r r~ Zd2i_X509_CRL_biorr r| r r� r� r� rg rM )r� r r~ ri rw rw rx �load_der_x509_crl{ s zBackend.load_der_x509_crlc C sb | j |�}| jj|j| jj| jj| jj�}|| jjkrF| j� td��| jj|| jj �}t | |�S )NzsUnable to load request. See https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file for more details.) r r~ ZPEM_read_bio_X509_REQrr r| r r� r� r� rQ rN )r� r r~ r[ rw rw rx �load_pem_x509_csr� s zBackend.load_pem_x509_csrc C sV | j |�}| jj|j| jj�}|| jjkr:| j� td��| jj|| jj �}t | |�S )NzUnable to load request) r r~ Zd2i_X509_REQ_biorr r| r r� r� r� rQ rN )r� r r~ r[ rw rw rx �load_der_x509_csr� s zBackend.load_der_x509_csrc C s* | j |�}| jjd�}|d k rFtjd|� | jj|�}||_t|�|_||j | jj | jj | j j d�|�}|| jj kr�|jdkr�| j� } | j| � |jd kr�td��q�|jd ks�t�tdj|jd ���n| j� | jj|| j j�}|d k o�|jdk� r�td ��|d k �r|jdk�s"|d k�s"t�||�S ) Nz CRYPTOGRAPHY_PASSWORD_DATA *rz Z Cryptography_pem_password_cbr rz z3Password was not given but private key is encryptedr� zAPasswords longer than {} bytes are not supported by this backend.z4Password was given but private key is not encrypted.������)r r| r� r �_check_bytesliker� rz r� r� rr r rK r~ rL �errorr� r� rG r� r� r� �maxsizer} r� r Zcalled) r� Zopenssl_read_funcZ convert_funcr rz r~ ZuserdataZ password_ptrr� r� rw rw rx ry � s@ zBackend._load_keyc s� � j � }|std��n�|d j� jj� jj�sF|d j� jj� jj�rPtd��n�|d j� jj� jj�s�|d j� jj � jj �r�t dt j ��nLt� fdd�|D ��r�td��n,|d j� jj� jj � jjfks�t�td��d S )Nz Could not deserialize key data.r z Bad decrypt. Incorrect password?z0PEM data is encrypted with an unsupported cipherc 3 s" | ]}|j � jj� jj�V qd S )N)�_lib_reason_matchr~ � ERR_LIB_EVPZ'EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM)rs r� )r� rw rx � <genexpr>� s z4Backend._handle_key_loading_error.<locals>.<genexpr>z!Unsupported public key algorithm.)r� r� r� r~ r� ZEVP_R_BAD_DECRYPTZERR_LIB_PKCS12Z!PKCS12_R_PKCS12_CIPHERFINAL_ERRORZEVP_R_UNKNOWN_PBE_ALGORITHMZ ERR_LIB_PEMZ PEM_R_UNSUPPORTED_ENCRYPTIONr r ZUNSUPPORTED_CIPHER�anyr} Z ERR_LIB_ASN1r� )r� r� rw )r� rx r} � s2 z!Backend._handle_key_loading_errorc C sv y| j |�}W n tk r* | jj}Y nX | jj|�}|| jjkrP| j� dS | j|| jjk� | jj |� dS d S )NFT) �_elliptic_curve_to_nidr r~ rv ZEC_GROUP_new_by_curve_namer| r r� r� Z EC_GROUP_free)r� �curve� curve_nid�grouprw rw rx �elliptic_curve_supported� s z Backend.elliptic_curve_supportedc C s t |tj�sdS | j|�S )NF)r� rT ZECDSAr� )r� Zsignature_algorithmr� rw rw rx �,elliptic_curve_signature_algorithm_supported s z4Backend.elliptic_curve_signature_algorithm_supportedc C s\ | j |�rD| j|�}| jj|�}| j|dk� | j|�}t| ||�S tdj|j �t j ��dS )z@ Generate a new private key on the named curve. rz z#Backend object does not support {}.N) r� �_ec_key_new_by_curver~ ZEC_KEY_generate_keyr� �_ec_cdata_to_evp_pkeyr0 r r� r� r �UNSUPPORTED_ELLIPTIC_CURVE)r� r� r r� r� rw rw rx �#generate_elliptic_curve_private_key s z+Backend.generate_elliptic_curve_private_keyc C sp |j }| j|j�}| jj| j|j�| jj�}| jj ||�}| j |dk� | j ||j |j �}| j|�}t| ||�S )Nrz )r� r� r� r| r� r� � private_valuer~ � BN_clear_free�EC_KEY_set_private_keyr� �)_ec_key_set_public_key_affine_coordinatesr; r: r� r0 )r� r Zpublicr r� r� r� rw rw rx �#load_elliptic_curve_private_numbers% s z+Backend.load_elliptic_curve_private_numbersc C s4 | j |j�}| j||j|j�}| j|�}t| ||�S )N)r� r� r� r; r: r� r1 )r� r r r� rw rw rx �"load_elliptic_curve_public_numbers8 s z*Backend.load_elliptic_curve_public_numbersc C s� | j |�}| jj|�}| j|| jjk� | jj|�}| j|| jjk� | jj|| jj�}| j � �6}| jj |||t |�|�}|dkr�| j � t d��W d Q R X | jj||�}| j|dk� | j|�}t| ||�S )Nrz z(Invalid public bytes for the given curve)r� r~ �EC_KEY_get0_groupr� r| r � EC_POINT_newr� � EC_POINT_free� _tmp_bn_ctxZEC_POINT_oct2pointr� r� r� �EC_KEY_set_public_keyr� r1 ) r� r� Z point_bytesr r� �point�bn_ctxr� r� rw rw rx � load_elliptic_curve_public_bytesA s z(Backend.load_elliptic_curve_public_bytesc C sD | j |�}| j|�\}}| jj|�}| j|| jjk� | jj|| jj�}| j |�}| jj|| jj �}| j � �h}| jj |||| jj| jj|�} | j| dk� | jj |�} | jj |�} |||| | |�} | j| dk� W d Q R X | jj||�} | j| dk� | j |�} | jj| | jj �} | jj|| �} | j| dk� | j|�} t| || �S )Nrz )r� � _ec_key_determine_group_get_funcr~ r� r� r| r r� r� r� r� r� Z EC_POINT_mulZ BN_CTX_getr� r� r� r0 )r� r� r� r �get_funcr� r� rR r� r� Zbn_xZbn_yZprivater� rw rw rx �!derive_elliptic_curve_private_keyU s. z)Backend.derive_elliptic_curve_private_keyc C s | j |�}| j|�S )N)r� �_ec_key_new_by_curve_nid)r� r� r� rw rw rx r� x s z Backend._ec_key_new_by_curvec C sB | j j|�}| j|| jjk� | j j|tj j� | jj|| j j �S )N) r~ ZEC_KEY_new_by_curve_namer� r| r ZEC_KEY_set_asn1_flag�backendZOPENSSL_EC_NAMED_CURVEr� r )r� r� r rw rw rx r� | s z Backend._ec_key_new_by_curve_nidc C sV | j |�}| jj|j| jj�}|| jjkr:| j� td��| jj|| jj �}t | |�S )NzUnable to load OCSP request) r r~ Zd2i_OCSP_REQUEST_biorr r| r r� r� r� �OCSP_REQUEST_freerB )r� r r~ Zrequestrw rw rx �load_der_ocsp_request� s z Backend.load_der_ocsp_requestc C sV | j |�}| jj|j| jj�}|| jjkr:| j� td��| jj|| jj �}t | |�S )Nz Unable to load OCSP response) r r~ Zd2i_OCSP_RESPONSE_biorr r| r r� r� r� �OCSP_RESPONSE_freerC )r� r r~ Zresponserw rw rx �load_der_ocsp_response� s z Backend.load_der_ocsp_responsec C s� | j j� }| j|| jjk� | jj|| j j�}|j\}}}| j|�}| j j ||j |j �}| j|| jjk� | j j ||�}| j|| jjk� | j |j | j|| j jdd� t| |�S )NT)rM r� rN rO r� )r~ ZOCSP_REQUEST_newr� r| r r� r� Z_requestr� �OCSP_cert_to_id�_x509ZOCSP_request_add0_idrV rW r� ZOCSP_REQUEST_add_extrB ) r� rZ Zocsp_req�certZissuerr� r� �certidZonereqrw rw rx �create_ocsp_request� s zBackend.create_ocsp_requestc C s� | j ||� | jj� }| j|| jjk� | jj|| jj�}| j|j j �}| jj ||j j j |j jj �}| j|| jjk� | jj|| jj�}|j jd kr�d}n t|j j }|j jd kr�| jj}n| j|j j�}| jj} |j jd k r�| j|j j�} | j|j j�} | jj|||j jj||| | �} | j| | jjk� | j||�}|j\} } | jj}| t j j k�rb|| jj O }|j d k �r�x.|j D ]$}| jj!||j �} | j| dk� �qvW | j"|j#| j$|| jj%dd� | jj&|| j |j'|| jj|�} | dk�r�| j(� }t)d|��|S )Nrz T)rM r� rN rO r� zAError while signing. responder_cert must be signed by private_keyr� )*rI r~ ZOCSP_BASICRESP_newr� r| r r� ZOCSP_BASICRESP_freer� Z _responser' r� Z_certr� Z_issuerZOCSP_CERTID_freeZ_revocation_reasonr Z_revocation_timerf rh Z _this_updateZOCSP_basic_add1_statusZ _cert_statusrR rP Z _responder_idZ OCSP_NOCERTSrp ZOCSPResponderEncodingZHASHZOCSP_RESPID_KEYZ_certsZOCSP_basic_add1_certrV rW r� ZOCSP_BASICRESP_add_extZOCSP_basic_signrU r� r� )r� rZ rH r� �basicr� r� �reasonZrev_timerj Z this_updater� Zresponder_certZresponder_encoding�flagsr� r� rw rw rx �_create_ocsp_basic_response� s| z#Backend._create_ocsp_basic_responsec C sb |t jjkr | j|||�}n| jj}| jj|j|�}| j || jjk� | jj || jj �}t | |�S )N) rp ZOCSPResponseStatusZ SUCCESSFULr� r| r r~ ZOCSP_response_createrR r� r� r� rC )r� Zresponse_statusrZ rH r� r� Z ocsp_resprw rw rx �create_ocsp_response s z Backend.create_ocsp_responsec C s | j |�ot|tj�S )N)r� r� rT ZECDH)r� r� r� rw rw rx �+elliptic_curve_exchange_algorithm_supported s z3Backend.elliptic_curve_exchange_algorithm_supportedc C s( | j � }| jj||�}| j|dk� |S )Nrz )r r~ ZEVP_PKEY_set1_EC_KEYr� )r� r r� r� rw rw rx r� s z Backend._ec_cdata_to_evp_pkeyc C sN ddd�}|j |j|j�}| jj|j� �}|| jjkrJtdj|j�tj ��|S )z/ Get the NID for a curve name. Z prime192v1Z prime256v1)Z secp192r1Z secp256r1z${} is not a supported elliptic curve) �getr� r~ � OBJ_sn2nidr� rv r r� r r� )r� r� Z curve_aliasesZ curve_namer� rw rw rx r� ! s z Backend._elliptic_curve_to_nidc c sX | j j� }| j|| jjk� | jj|| j j�}| j j|� z |V W d | j j|� X d S )N) r~ Z BN_CTX_newr� r| r r� Z BN_CTX_freeZ BN_CTX_startZ BN_CTX_end)r� r� rw rw rx r� 2 s zBackend._tmp_bn_ctxc C s� | j || jjk� | jjd�}| j || jjk� | jj|�}| j || jjk� | jj|�}| j || jjk� | jj|�}| j || jjk� ||kr�| jj r�| jj }n| jj }|s�t �||fS )zu Given an EC_KEY determine the group and what function is required to get point coordinates. s characteristic-two-field) r� r| r r~ r� rv r� ZEC_GROUP_method_ofZEC_METHOD_get_field_typeZCryptography_HAS_EC2MZ$EC_POINT_get_affine_coordinates_GF2mZ#EC_POINT_get_affine_coordinates_GFpr� )r� r. Z nid_two_fieldr� �methodrw r� rw rw rx r� = s z(Backend._ec_key_determine_group_get_funcc C st |dk s|dk rt d��| jj| j|�| jj�}| jj| j|�| jj�}| jj|||�}|dkrp| j� t d��|S )zg Sets the public key point in the EC_KEY context to the affine x and y values. r z2Invalid EC key. Both x and y must be non-negative.rz zInvalid EC key.)r� r| r� r� r~ r� Z(EC_KEY_set_public_key_affine_coordinatesr� )r� r. r; r: r� rw rw rx r� Y s z1Backend._ec_key_set_public_key_affine_coordinatesc C s* t |tj�std��t |tj�s(td��t |tj�s<td��t |tj�rNd}n0t |tj�rv|j}t |�dkr~t d��nt d��|tjj kr�|tjj kr�| j j}n |tjjkr�| j j}nt d��| j|||�S |tjjk�r�| jr�t |tj� r�t d ��| j j|�} |tjj k�rn| | j jk�r(| j j}n8| | j jk�r@| j j}n | | j jk�rX| j j}nt d ��| j|||�S |tjjk�r�|�r�t d ��| | j jk�r�| j j}n8| | j jk�r�| j j }n | | j jk�r�| j j }nt d ��| j ||�S t d ��|tjj k�r |tjj k�rt j!||�S t d ��t d��d S )Nz/encoding must be an item from the Encoding enumz2format must be an item from the PrivateFormat enumzBEncryption algorithm must be a KeySerializationEncryption instance� i� zBPasswords longer than 1023 bytes are not supported by this backendzUnsupported encryption typez Unsupported encoding for PKCS8zCEncrypted traditional OpenSSL format is not supported in FIPS mode.z+Unsupported key type for TraditionalOpenSSLzDEncryption is not supported for DER encoded traditional OpenSSL keysz+Unsupported encoding for TraditionalOpenSSLz=OpenSSH private key format can only be used with PEM encodingz format is invalid with this key)"r� rR �EncodingrG Z PrivateFormatZKeySerializationEncryption� NoEncryption�BestAvailableEncryptionrz r� r� ZPKCS8�PEMr~ Z PEM_write_bio_PKCS8PrivateKey�DERZi2d_PKCS8PrivateKey_bio�_private_key_bytes_via_bioZTraditionalOpenSSLr� r r ZPEM_write_bio_RSAPrivateKeyr ZPEM_write_bio_DSAPrivateKeyr ZPEM_write_bio_ECPrivateKeyZi2d_RSAPrivateKey_bioZi2d_ECPrivateKey_bioZi2d_DSAPrivateKey_bio�_bio_func_output�OpenSSHro Zserialize_ssh_private_key) r� �encodingr� �encryption_algorithmr� r� �cdatarz � write_bior rw rw rx �_private_key_bytesm s~ zBackend._private_key_bytesc C s< |s| j j}n | jjd�}| j||||t|�| j j| j j�S )Ns aes-256-cbc)r| r r~ �EVP_get_cipherbynamer� r� )r� r� r� rz r� rw rw rx r� � s z"Backend._private_key_bytes_via_bioc G s. | j � }||f|�� }| j|dk� | j|�S )Nrz )r r� r )r� r� �argsrr r� rw rw rx r� � s zBackend._bio_func_outputc C s t |tj�std��t |tj�s(td��|tjjkrt|tjjkrJ| jj}n |tjj kr`| jj }nt d��| j ||�S |tjj kr�| jj|�}|| jjkr�t d��|tjjkr�| jj}n |tjj kr�| jj}nt d��| j ||�S |tjjk�r|tjjk�rtj|�S t d��t d��d S )Nz/encoding must be an item from the Encoding enumz1format must be an item from the PublicFormat enumz8SubjectPublicKeyInfo works only with PEM or DER encodingz+PKCS1 format is supported only for RSA keysz)PKCS1 works only with PEM or DER encodingz1OpenSSH format must be used with OpenSSH encodingz format is invalid with this key)r� rR r� rG Z PublicFormatZSubjectPublicKeyInfor� r~ ZPEM_write_bio_PUBKEYr� Zi2d_PUBKEY_bior� r� ZPKCS1r r ZPEM_write_bio_RSAPublicKeyZi2d_RSAPublicKey_bior� ro Zserialize_ssh_public_key)r� r� r� r� r� r� r� r rw rw rx �_public_key_bytes� s: zBackend._public_key_bytesc C s� |t jjkrtd��| jjd�}| jj|| jj|| jj� |t jj krj|d | jjkr`| jj }q�| jj }n8|t jj kr�|d | jjkr�| jj }q�| jj}ntd��| j� }|||�}| j|dk� | j|�S )Nz!OpenSSH encoding is not supportedz BIGNUM **r z/encoding must be an item from the Encoding enumrz )rR r� r� rG r| r� r~ Z DH_get0_pqgr r� ZPEM_write_bio_DHxparamsZPEM_write_bio_DHparamsr� Z Cryptography_i2d_DHxparams_bioZi2d_DHparams_bior r� r )r� r� r� r� r� r� rr r� rw rw rx �_parameter_bytes s" zBackend._parameter_bytesc C s| |dk rt d��|dkr t d��| jj� }| j|| jjk� | jj|| jj�}| jj|||| jj�}| j|dk� t | |�S )Ni z%DH key_size must be at least 512 bitsr� � zDH generator must be 2 or 5rz )r� r� ) r� r~ �DH_newr� r| r r� r ZDH_generate_parameters_exr) )r� � generatorr� Zdh_param_cdatar� rw rw rx �generate_dh_parameters6 s z Backend.generate_dh_parametersc C s( | j � }| jj||�}| j|dk� |S )Nrz )r r~ ZEVP_PKEY_set1_DHr� )r� r r� r� rw rw rx �_dh_cdata_to_evp_pkeyH s z Backend._dh_cdata_to_evp_pkeyc C s< t |j| �}| jj|�}| j|dk� | j|�}t| ||�S )Nrz )r, Z _dh_cdatar~ ZDH_generate_keyr� r� r* )r� r1 Z dh_key_cdatar� r� rw rw rx �generate_dh_private_keyN s z Backend.generate_dh_private_keyc C s | j | j||��S )N)r� r� )r� r� r� rw rw rx �&generate_dh_private_key_and_parametersX s z.Backend.generate_dh_private_key_and_parametersc C s@ |j j}| jj� }| j|| jjk� | jj|| jj�}| j |j �}| j |j �}|j d k rf| j |j �}n| jj}| j |j j �}| j |j�}| jj||||�} | j| dk� | jj|||�} | j| dk� | jjdd�} | jj|| �} | j| dk� | d dk�r*|j dk�o | d | jjA dk �r*td��| j|�} t| || �S )Nrz zint[]r r� z.DH private numbers did not pass safety checks.)r� r9 r~ r� r� r| r r� r r� r� r5 r� r: r; � DH_set0_pqg� DH_set0_keyr� �Cryptography_DH_checkZDH_NOT_SUITABLE_GENERATORr� r� r* ) r� r r9 r r� r5 r� r6 r7 r� �codesr� rw rw rx �load_dh_private_numbers] s0 z Backend.load_dh_private_numbersc C s� | j j� }| j|| jjk� | jj|| j j�}|j}| j|j �}| j|j �}|j d k rd| j|j �}n| jj}| j|j �}| j j ||||�}| j|dk� | j j||| jj�}| j|dk� | j|�} t| || �S )Nrz )r~ r� r� r| r r� r r9 r� r� r5 r� r: r� r� r� r+ ) r� r r r9 r� r5 r� r6 r� r� rw rw rx �load_dh_public_numbers� s z Backend.load_dh_public_numbersc C s� | j j� }| j|| jjk� | jj|| j j�}| j|j�}| j|j �}|j d k r^| j|j �}n| jj}| j j ||||�}| j|dk� t | |�S )Nrz ) r~ r� r� r| r r� r r� r� r5 r� r� r) )r� r r r� r5 r� r� rw rw rx �load_dh_parameter_numbers� s z!Backend.load_dh_parameter_numbersc C s� | j j� }| j|| jjk� | jj|| j j�}| j|�}| j|�}|d k rV| j|�}n| jj}| j j||||�}| j|dk� | jj dd�}| j j ||�}| j|dk� |d dkS )Nrz zint[]r ) r~ r� r� r| r r� r r� r� r� r� )r� r� r5 r� r r� r� rw rw rx �dh_parameters_supported� s z Backend.dh_parameters_supportedc C s | j jdkS )Nrz )r~ r� )r� rw rw rx � dh_x942_serialization_supported� s z'Backend.dh_x942_serialization_supportedc sx t � |�}� jjd�}� jj||�}� j|d � jjk� � jj|� fdd��}� j|dk� � jj|d |�d d � S )Nzunsigned char **r c s � j j| d �S )Nr )r~ r� )Zpointer)r� rw rx r� � s z)Backend.x509_name_bytes.<locals>.<lambda>) r> r| r� r~ Z i2d_X509_NAMEr� r r� r� )r� r� Z x509_nameZppr� rw )r� rx �x509_name_bytes� s zBackend.x509_name_bytesc C sh t |�dkrtd��| j� }| jj|| jj�}| j|dk� | jj||t |��}| j|dk� t| |�S )N� z%An X25519 public key is 32 bytes longrz ) r� r� r r~ ZEVP_PKEY_set_type� NID_X25519r� Z EVP_PKEY_set1_tls_encodedpointrI )r� r r� r� rw rw rx �x25519_load_public_bytes� s z Backend.x25519_load_public_bytesc C s� t |�dkrtd��d}| jd��<}||dd�< ||dd �< | j|�}| jj|j| jj�}W d Q R X | j || jjk� | jj || jj �}| j | jj |�| jj k� t| |�S )Nr� z&An X25519 private key is 32 bytes longs 0. 0+en" �0 r r� )r� r� �_zeroed_bytearrayr r~ r� rr r| r r� r� r r r rH )r� r Z pkcs8_prefix�barr r� rw rw rx �x25519_load_private_bytes� s z!Backend.x25519_load_private_bytesc C s� | j j|| jj�}| j|| jjk� | jj|| j j�}| j j|�}| j|dk� | jjd�}| j j ||�}| j|dk� | j|d | jjk� | jj|d | j j �}|S )Nrz z EVP_PKEY **r ) r~ ZEVP_PKEY_CTX_new_idr| r r� r� ZEVP_PKEY_CTX_freeZEVP_PKEY_keygen_initr� ZEVP_PKEY_keygenr )r� rw Z evp_pkey_ctxr� Z evp_ppkeyr� rw rw rx �_evp_pkey_keygen_gc s zBackend._evp_pkey_keygen_gcc C s | j | jj�}t| |�S )N)r� r~ r� rH )r� r� rw rw rx �x25519_generate_key s zBackend.x25519_generate_keyc C s | j r dS | jjS )NF)r� r~ Z#CRYPTOGRAPHY_OPENSSL_110_OR_GREATER)r� rw rw rx �x25519_supported s zBackend.x25519_supportedc C s` t |�dkrtd��| jj| jj| jj|t |��}| j|| jjk� | jj|| jj �}t | |�S )N�8 z#An X448 public key is 56 bytes long) r� r� r~ �EVP_PKEY_new_raw_public_key�NID_X448r| r r� r� r rK )r� r r� rw rw rx �x448_load_public_bytes# s z Backend.x448_load_public_bytesc C sl t |�dkrtd��| jj|�}| jj| jj| jj|t |��}| j|| jjk� | jj || jj �}t | |�S )Nr� z$An X448 private key is 56 bytes long) r� r� r| r� r~ � EVP_PKEY_new_raw_private_keyr� r r� r� r rJ )r� r r r� rw rw rx �x448_load_private_bytes. s z Backend.x448_load_private_bytesc C s | j | jj�}t| |�S )N)r� r~ r� rJ )r� r� rw rw rx �x448_generate_key: s zBackend.x448_generate_keyc C s | j r dS | jj S )NF)r� r~ Z"CRYPTOGRAPHY_OPENSSL_LESS_THAN_111)r� rw rw rx �x448_supported> s zBackend.x448_supportedc C s | j r dS | jj S )NF)r� r~ �#CRYPTOGRAPHY_OPENSSL_LESS_THAN_111B)r� rw rw rx �ed25519_supportedC s zBackend.ed25519_supportedc C sn t jd|� t|�tjkr"td��| jj| jj| j j |t|��}| j || j j k� | j j || jj �}t| |�S )Nr z&An Ed25519 public key is 32 bytes long)r � _check_bytesr� rU �_ED25519_KEY_SIZEr� r~ r� � NID_ED25519r| r r� r� r r3 )r� r r� rw rw rx �ed25519_load_public_bytesH s z!Backend.ed25519_load_public_bytesc C sz t |�tjkrtd��tjd|� | jj|�}| jj | jj | jj |t |��}| j || jj k� | jj || jj�}t| |�S )Nz'An Ed25519 private key is 32 bytes longr )r� rU r� r� r r� r| r� r~ r� r� r r� r� r r2 )r� r r r� rw rw rx �ed25519_load_private_bytesV s z"Backend.ed25519_load_private_bytesc C s | j | jj�}t| |�S )N)r� r~ r� r2 )r� r� rw rw rx �ed25519_generate_keyd s z Backend.ed25519_generate_keyc C s | j r dS | jj S )NF)r� r~ r� )r� rw rw rx �ed448_supportedh s zBackend.ed448_supportedc C sl t jd|� t|�tkr td��| jj| jj| jj |t|��}| j || jj k� | jj || jj �}t | |�S )Nr z$An Ed448 public key is 57 bytes long)r r� r� r4 r� r~ r� � NID_ED448r| r r� r� r r6 )r� r r� rw rw rx �ed448_load_public_bytesm s z Backend.ed448_load_public_bytesc C sx t jd|� t|�tkr td��| jj|�}| jj| jj | jj |t|��}| j || jj k� | jj || jj �}t| |�S )Nr z%An Ed448 private key is 57 bytes long)r r� r� r4 r� r| r� r~ r� r r r� r� r r5 )r� r r r� rw rw rx �ed448_load_private_bytesz s z Backend.ed448_load_private_bytesc C s | j | jj�}t| |�S )N)r� r~ r r5 )r� r� rw rw rx �ed448_generate_key� s zBackend.ed448_generate_keyc C s� | j jd|�}| j j|�}| jj|t|�|t|�|||tj||� } | dkrr| j� } d| | d } t dj | �| ��| j j |�d d � S )Nzunsigned char[]rz � i r� zJNot enough memory to derive key. These parameters require {} MB of memory.i ) r| r� r� r~ ZEVP_PBE_scryptr� rm Z _MEM_LIMITr� � MemoryErrorr� r� ) r� r� r� r� r� �rr� r� r� r� r� Z min_memoryrw rw rx � derive_scrypt� s* zBackend.derive_scryptc C s2 t j|�}| jr || jkr dS | jj|�| jjkS )NF)r Z_aead_cipher_namer� � _fips_aeadr~ r� r| r )r� r� � cipher_namerw rw rx �aead_cipher_supported� s z Backend.aead_cipher_supportedc c s& t |�}z |V W d| j||� X dS )z� This method creates a bytearray, which we copy data into (hopefully also from a mutable buffer that can be dynamically erased!), and then zero when we're done. N)� bytearray� _zero_data)r� r� r� rw rw rx r� � s zBackend._zeroed_bytearrayc C s xt |�D ] }d||< q W d S )Nr )r )r� r r� rn rw rw rx r � s zBackend._zero_datac c sf |dkr| j jV nNt|�}| j jd|d �}| j j|||� z |V W d| j| j jd|�|� X dS )a� This method takes bytes, which can be a bytestring or a mutable buffer like a bytearray, and yields a null-terminated version of that data. This is required because PKCS12_parse doesn't take a length with its password char * and ffi.from_buffer doesn't provide null termination. So, to support zeroing the data via bytearray we need to build this ridiculous construct that copies the memory, but zeroes it after use. Nzchar[]rz z uint8_t *)r| r r� r� Zmemmover �cast)r� r Zdata_lenr� rw rw rx �_zeroed_null_terminated_buf� s z#Backend._zeroed_null_terminated_bufc C s� |d k rt jd|� | j|�}| jj|j| jj�}|| jjkrN| j� t d��| jj || jj �}| jj d�}| jj d�}| jj d�}| j |��}| jj|||||�} W d Q R X | dkr�| j� t d��d } d } g } |d | jjk�r| jj |d | jj�} | j| �} |d | jjk�r6| jj |d | jj�}t| |�} |d | jjk�r�| jj |d | jj�}| jj|d �}xTt|�D ]H}| jj||�}| j|| jjk� | jj || jj�}| jt| |�� �qxW | | | fS )Nrz z!Could not deserialize PKCS12 dataz EVP_PKEY **zX509 **z Cryptography_STACK_OF_X509 **r z Invalid password or PKCS12 data)r r� r r~ Zd2i_PKCS12_biorr r| r r� r� r� � PKCS12_freer� r Z PKCS12_parser r r^ rL � sk_X509_free� sk_X509_numr � sk_X509_valuer� r� )r� r rz rr �p12Z evp_pkey_ptrZx509_ptrZ sk_x509_ptr� password_bufr� r� r� Zadditional_certificatesr� r �sk_x509r� rn rw rw rx �%load_key_and_certificates_from_pkcs12� sF z-Backend.load_key_and_certificates_from_pkcs12c C s� d }|d k rt jd|� t|tj�r6d}d}d} d} n4t|tj�rb| jj}| jj}d} d} |j}nt d��|d ks~t |�dkr�| j j } nL| jj � } | j j| | jj�} x.t|�D ]"} | jj| | j�} tj| dk� q�W | j|��Z}| j|��D}| jj|||�r|jn| j j |�r|jn| j j | ||| | d� }W d Q R X W d Q R X | j|| j j k� | j j|| jj�}| j� }| jj||�} | j| dk� | j|�S )Nr� rz r i N z Unsupported key encryption typer� r� ) r r� r� rR r� r� r~ Z&NID_pbe_WithSHA1And3_Key_TripleDES_CBCrz r� r� r| r �sk_X509_new_nullr� r �reversed� sk_X509_pushr� r� r� r Z PKCS12_createrU r r Zi2d_PKCS12_bior )r� r� r� r� Zcasr� rz Znid_certZnid_keyZ pkcs12_iterZmac_iterr Zcar� r Zname_bufr rr rw rw rx �(serialize_key_and_certificates_to_pkcs12 sT z0Backend.serialize_key_and_certificates_to_pkcs12c C s | j r dS | jjdkS )NFrz )r� r~ ZCryptography_HAS_POLY1305)r� rw rw rx �poly1305_supportedF s zBackend.poly1305_supportedc C s* t jd|� t|�tkr td��t| |�S )Nr� z A poly1305 key is 32 bytes long)r r� r� rD r� rE )r� r� rw rw rx �create_poly1305_ctxK s zBackend.create_poly1305_ctxc C sn t jd|� | j|�}| jj|j| jj| jj| jj�}|| jjkrR| j� t d��| jj || jj �}| j |�S )Nr zUnable to parse PKCS7 data) r r� r r~ ZPEM_read_bio_PKCS7rr r| r r� r� r� � PKCS7_free�_load_pkcs7_certificates)r� r rr �p7rw rw rx �load_pem_pkcs7_certificatesR s z#Backend.load_pem_pkcs7_certificatesc C sb t jd|� | j|�}| jj|j| jj�}|| jjkrF| j� t d��| jj || jj �}| j |�S )Nr zUnable to parse PKCS7 data) r r� r r~ Z d2i_PKCS7_biorr r| r r� r� r� r r )r� r rr r! rw rw rx �load_der_pkcs7_certificates_ s z#Backend.load_der_pkcs7_certificatesc C s� | j j|j�}| j|| j jk� || j jkr>tdj|�tj ��|j j j }| j j |�}g }xlt|�D ]`}| j j||�}| j|| jjk� | j j|�}| j|dk� | jj|| j j�}|jt| |�� qbW |S )NzNOnly basic signed structures are currently supported. NID for this data was {}rz )r~ Z OBJ_obj2nidr� r� rv ZNID_pkcs7_signedr r� r ZUNSUPPORTED_SERIALIZATIONr� Zsignr� r r r r| r Z X509_up_refr� r^ r� rL ) r� r! rw r r� �certsrn r r� rw rw rx r j s$ z Backend._load_pkcs7_certificatesc C s� | j |j�}| jj}d}t|j�dkr0| jj}nJ| jj� }| jj || jj �}x,|jD ]"}| jj ||j �} | j | dk� qTW tjj|kr�|| jjO }|| jjO }| jj| jj| jj|| jj|�} | j | | jjk� | jj | | jj�} d} tjj|k�r| | jjO } ntjj|k�r | | jjO } tjj|k�r6| | jjO } xJ|jD ]@\} } }| j|�}| jj | | j | j || �}| j || jjk� �q>W xD|D ]<}|tjj k�r�|| jj O }n|tjj k�r�|| jj!O }�q�W | j"� }|t#j$j%k�r�| jj&|| |j'|�} n�|t#j$j(k�r8| jj)| |j'|�} | j | dk� | jj*|| |j'|�} n@|t#j$j+k�sJt,�| jj)| |j'|�} | j | dk� | jj-|| �} | j | dk� | j.|�S )Nr rz )/r �_datar~ Z PKCS7_PARTIALr� Z_additional_certsr| r r r� r r r� r� rn Z PKCS7OptionsZDetachedSignatureZPKCS7_DETACHEDZ PKCS7_signr ZNoCapabilitiesZPKCS7_NOSMIMECAPZ NoAttributesZ PKCS7_NOATTRZNoCertsZ PKCS7_NOCERTSZ_signersr� ZPKCS7_sign_add_signerrU ZTextZ PKCS7_TEXTZBinaryZ PKCS7_BINARYr rR r� ZSMIMEZSMIME_write_PKCS7rr r� Z PKCS7_finalZPEM_write_bio_PKCS7_streamr� r� Z i2d_PKCS7_bior )r� rZ r� Zoptionsrr Z init_flagsZ final_flagsr$ r� r� r! Z signer_flagsZ certificaterH Zhash_algorithmZmdZ p7signerinfoZoptionZbio_outrw rw rx � pkcs7_sign� sj zBackend.pkcs7_sign)N)N)N)�rt ru rv �__doc__r� r r\ rd r� rQ r! r" r# r$ r% Z SHA512_224Z SHA512_256ZSHA3_224ZSHA3_256ZSHA3_384ZSHA3_512ZSHAKE128ZSHAKE256r� Z_fips_rsa_min_key_sizeZ _fips_rsa_min_public_exponentZ_fips_dsa_min_modulusZ_fips_dh_min_key_sizeZ_fips_dh_min_modulusr� r� r r� � contextlibr r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r� r r r r r r& r( r/ r2 r3 r8 r< r> r? r0 r@ rA rC rD rI r] rc rP r` rf rk rV rr rm rx r{ r r� r� r� r� r� r� r� r� r� r� r� ry r} r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r r r r� r r r r r r r" r# r r& rw rw rw rx ry � sV -5 ++ HB 8" 1) # U i0 . " . @ ry c @ s e Zd Zdd� Zdd� ZdS )r� c C s || _ d S )N)�_fmt)r� Zfmtrw rw rx r� � s zGetCipherByName.__init__c C s& | j j||d�j� }|jj|jd��S )N)r� r� r� )r) r� �lowerr~ r� r� )r� r� r� r� r rw rw rx �__call__� s zGetCipherByName.__call__N)rt ru rv r� r+ rw rw rw rx r� � s r� c C s" dj |jd �}| jj|jd��S )Nz aes-{}-xtsr� r� )r� r� r~ r� r� )r� r� r� r rw rw rx r� � s r� )�Z __future__r r r � collectionsr( r� r� r r� Z six.movesr Z cryptographyr r Zcryptography.exceptionsr r Zcryptography.hazmat._derr r r r r Z'cryptography.hazmat.backends.interfacesr r r r r r r r r r r r r Z$cryptography.hazmat.backends.opensslr Z,cryptography.hazmat.backends.openssl.ciphersr Z)cryptography.hazmat.backends.openssl.cmacr Z0cryptography.hazmat.backends.openssl.decode_asn1r r! r" r# r$ r% r& r' r( Z'cryptography.hazmat.backends.openssl.dhr) r* r+ r, Z(cryptography.hazmat.backends.openssl.dsar- r. r/ Z'cryptography.hazmat.backends.openssl.ecr0 r1 Z,cryptography.hazmat.backends.openssl.ed25519r2 r3 Z*cryptography.hazmat.backends.openssl.ed448r4 r5 r6 Z0cryptography.hazmat.backends.openssl.encode_asn1r7 r8 r9 r: r; r< r= r> r? Z+cryptography.hazmat.backends.openssl.hashesr@ Z)cryptography.hazmat.backends.openssl.hmacrA Z)cryptography.hazmat.backends.openssl.ocsprB rC Z-cryptography.hazmat.backends.openssl.poly1305rD rE Z(cryptography.hazmat.backends.openssl.rsarF rG Z+cryptography.hazmat.backends.openssl.x25519rH rI Z)cryptography.hazmat.backends.openssl.x448rJ rK Z)cryptography.hazmat.backends.openssl.x509rL rM rN rO Z$cryptography.hazmat.bindings.opensslrP Z cryptography.hazmat.primitivesrQ rR Z)cryptography.hazmat.primitives.asymmetricrS rT rU rV rW Z1cryptography.hazmat.primitives.asymmetric.paddingrX rY rZ r[ Z1cryptography.hazmat.primitives.ciphers.algorithmsr\ r] r^ r_ r` ra rb rc rd Z,cryptography.hazmat.primitives.ciphers.modesre rf rg rh ri rj rk rl Z"cryptography.hazmat.primitives.kdfrm Z,cryptography.hazmat.primitives.serializationrn ro Zcryptography.x509rp � namedtuplerq �objectrs Zregister_interfaceZregister_interface_ifr{ r} ZCryptography_HAS_SCRYPTry r� r� r� rw rw rw rx �<module> s� < , , , ( 2