­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ U tJ`S @sddlZddlZddlZddlmZddlmZmZmZm Z m Z m Z m Z zddl Zddl mZddlmZddlmZmZddlmZmZdd lmZmZdd lmZmZmZmZm Z m!Z!m"Z"m#Z#dd l$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+d Z,Wne-k rd Z,YnXddddddddddddh Z.ddZ/GdddZ0Gddde0Z1Gd d!d!e0Z2e,rGd"d#d#e0Z3Gd$d%d%e0Z4Gd&d'd'e3Z5Gd(d)d)e0Z6dS)*NInvalidKeyError)base64url_decodebase64url_encodeder_to_raw_signature force_bytesfrom_base64url_uintraw_to_der_signatureto_base64url_uint)InvalidSignature)hashes)ecpadding)EllipticCurvePrivateKeyEllipticCurvePublicKey)Ed25519PrivateKeyEd25519PublicKey) RSAPrivateKeyRSAPrivateNumbers RSAPublicKeyRSAPublicNumbers rsa_crt_dmp1 rsa_crt_dmq1 rsa_crt_iqmprsa_recover_prime_factors)Encoding NoEncryption PrivateFormat PublicFormatload_pem_private_keyload_pem_public_keyload_ssh_public_keyTFRS256RS384RS512ES256ES256KES384ES521ES512PS256PS384PS512EdDSAcCstttjttjttjd}tr|ttjttjttjttjttjttjttjttjt t jt t jt t jt d |S)zE Returns the algorithms that are implemented by the library. )ZnoneZHS256ZHS384ZHS512) r#r$r%r&r'r(r)r*r+r,r-r.) NoneAlgorithm HMACAlgorithmSHA256SHA384SHA512 has_cryptoupdate RSAAlgorithm ECAlgorithmRSAPSSAlgorithmEd25519Algorithm)Zdefault_algorithmsr:?/opt/alt/python38/lib/python3.8/site-packages/jwt/algorithms.pyget_default_algorithmsEs0r<c@s@eZdZdZddZddZddZedd Zed d Z d S) AlgorithmzH The interface for an algorithm used to sign and verify tokens. cCstdS)z Performs necessary validation and conversions on the key and returns the key value in the proper format for sign() and verify(). NNotImplementedErrorselfkeyr:r:r; prepare_keylszAlgorithm.prepare_keycCstdS)zn Returns a digital signature for the specified message using the specified key value. Nr>rAmsgrBr:r:r;signsszAlgorithm.signcCstdS)zz Verifies that the specified digital signature is valid for the specified message and key values. Nr>rArErBsigr:r:r;verifyzszAlgorithm.verifycCstdS)z7 Serializes a given RSA key into a JWK Nr>key_objr:r:r;to_jwkszAlgorithm.to_jwkcCstdS)zb Deserializes a given RSA key from JWK back into a PublicKey or PrivateKey object Nr>)jwkr:r:r;from_jwkszAlgorithm.from_jwkN) __name__ __module__ __qualname____doc__rCrFrI staticmethodrLrNr:r:r:r;r=gs r=c@s(eZdZdZddZddZddZdS) r/zZ Placeholder for use when no signing or verification operations are required. cCs |dkr d}|dk rtd|S)Nz*When alg = "none", key value must be None.rr@r:r:r;rCs zNoneAlgorithm.prepare_keycCsdS)Nr:rDr:r:r;rFszNoneAlgorithm.signcCsdS)NFr:rGr:r:r;rIszNoneAlgorithm.verifyN)rOrPrQrRrCrFrIr:r:r:r;r/s r/c@sZeZdZdZejZejZej Z ddZ ddZ e ddZe dd Zd d Zd d ZdS)r0zf Performs signing and verification operations using HMAC and the specified hash function. cCs ||_dSNhash_algrArXr:r:r;__init__szHMACAlgorithm.__init__cs6tddddg}tfdd|Dr2tdS)Ns-----BEGIN PUBLIC KEY-----s-----BEGIN CERTIFICATE-----s-----BEGIN RSA PUBLIC KEY-----ssh-rsac3s|]}|kVqdSrVr:).0Z string_valuerBr:r; sz,HMACAlgorithm.prepare_key..zdThe specified key is an asymmetric key or x509 certificate and should not be used as an HMAC secret.)ranyr)rArBZinvalid_stringsr:r]r;rCszHMACAlgorithm.prepare_keycCsttt|ddS)Noct)kkty)jsondumpsrrdecoderJr:r:r;rLs zHMACAlgorithm.to_jwkcCsnz.t|trt|}nt|tr(|}ntWntk rJtdYnX|ddkrbtdt|dS)NKey is not valid JSONrbr`zNot an HMAC keyra) isinstancestrrcloadsdict ValueErrorrgetr)rMobjr:r:r;rNs   zHMACAlgorithm.from_jwkcCst|||jSrV)hmacnewrXdigestrDr:r:r;rFszHMACAlgorithm.signcCst||||SrV)rnZcompare_digestrFrGr:r:r;rIszHMACAlgorithm.verifyN)rOrPrQrRhashlibZsha256r1sha384r2sha512r3rZrCrSrLrNrFrIr:r:r:r;r0s  r0c@sZeZdZdZejZejZejZddZddZ e ddZ e dd Z d d Z d d ZdS)r6z~ Performs signing and verification operations using RSASSA-PKCS-v1_5 and the specified hash function. cCs ||_dSrVrWrYr:r:r;rZszRSAAlgorithm.__init__cCs~t|tst|tr|St|ttfrrt|}z$|drDt|}n t|dd}Wqzt k rnt |}YqzXnt d|S)Nr[passwordExpecting a PEM-formatted key.) rgrrbytesrhr startswithr"r rkr! TypeErrorr@r:r:r;rCs  zRSAAlgorithm.prepare_keyc Csd}t|ddr|}ddgt|jjt|jjt|jt|jt|j t|j t|j t|j d }nBt|ddr|}ddgt|jt|jd}nt dt|S)Nprivate_numbersRSArF) rbkey_opsnedpqdpdqqirI)rbr|r}r~Not a public or private key)getattrrzr public_numbersr}rer~rrrdmp1dmq1iqmprrcrd)rKrmnumbersr:r:r;rLs.          zRSAAlgorithm.to_jwkc sz.t|trt|nt|tr(|ntWntk rJtdYnXddkrbtddkrdkrdkrdkrtd d d d d dg}fdd|D}t|}|rt |stdt t dt d}|r4t t dt d t d t d t d t d|d}nHt d}t |j||j\}}t |||t||t||t|||d}|Sdkrdkrt t dt d}|StddS)Nrfrbr{zNot an RSA keyrr~r}Zothz5Unsupported RSA private key: > 2 primes not supportedrrrrrcsg|] }|kqSr:r:)r\Zproprmr:r; Csz)RSAAlgorithm.from_jwk..z@RSA key must include all parameters if any are present besides d)rrrrrrrr)rgrhrcrirjrkrrlr_allrr rrr}r~rrr private_key public_key) rMZ other_propsZ props_foundZany_props_foundrrrrrr:rr;rN,sv                zRSAAlgorithm.from_jwkcCs||t|SrV)rFrPKCS1v15rXrDr:r:r;rFvszRSAAlgorithm.signcCs:z|||t|WdStk r4YdSXdS)NTF)rIrrrXr rGr:r:r;rIys zRSAAlgorithm.verifyN)rOrPrQrRr r1r2r3rZrCrSrLrNrFrIr:r:r:r;r6s # Ir6c@sNeZdZdZejZejZejZddZddZ ddZ dd Z e d d Z d S) r7zr Performs signing and verification operations using ECDSA and the specified hash function cCs ||_dSrVrWrYr:r:r;rZszECAlgorithm.__init__cCs~t|tst|tr|St|ttfrrt|}z |drDt|}nt|}Wqzt k rnt |dd}YqzXnt d|S)Ns ecdsa-sha2-rtrv) rgrrrwrhrrxr"r!rkr ryr@r:r:r;rCs    zECAlgorithm.prepare_keycCs"||t|}t||jSrV)rFrECDSArXrcurve)rArErBder_sigr:r:r;rFszECAlgorithm.signcCstzt||j}Wntk r&YdSXz0t|tr<|}|||t| WdSt k rnYdSXdS)NFT) r rrkrgrrrIrrrXr )rArErBrHrr:r:r;rIs zECAlgorithm.verifycCs0z.t|trt|}nt|tr(|}ntWntk rJtdYnX|ddkrbtdd|ksrd|krztdt|d}t|d}|d}|dkrt |t |krd krnn t }ntd n|d krt |t |krd krnn t }ntd n|dkr`t |t |krHdkrVnn t }ntdnP|dkrt |t |krd krnn t }ntdntd|t jtj|ddtj|dd|d}d|kr|St|d}t |t |krtdt ||t tj|dd|S)NrfrbZECzNot an Elliptic curve keyxycrvzP-256 z)Coords should be 32 bytes for curve P-256zP-3840z)Coords should be 48 bytes for curve P-384zP-521Bz)Coords should be 66 bytes for curve P-521Z secp256k1z-Coords should be 32 bytes for curve secp256k1Invalid curve: big) byteorder)rrrrz!D should be {} bytes for curve {})rgrhrcrirjrkrrlrlenrZ SECP256R1Z SECP384R1Z SECP521R1Z SECP256K1ZEllipticCurvePublicNumbersint from_bytesrZEllipticCurvePrivateNumbersr)rMrmrrrZ curve_objrrr:r:r;rNsh        $   $   $     zECAlgorithm.from_jwkN)rOrPrQrRr r1r2r3rZrCrFrIrSrNr:r:r:r;r7sr7c@s eZdZdZddZddZdS)r8zA Performs a signature using RSASSA-PSS with MGF1 cCs*||tjt||jjd|S)NZmgfZ salt_length)rFrPSSMGF1rX digest_sizerDr:r:r;rFs zRSAPSSAlgorithm.signc CsNz2|||tjt||jjd|WdStk rHYdSXdS)NrTF)rIrrrrXrr rGr:r:r;rI s  zRSAPSSAlgorithm.verifyN)rOrPrQrRrFrIr:r:r:r;r8s r8c@sHeZdZdZddZddZddZdd Zed d Z ed d Z dS)r9z Performs signing and verification operations using Ed25519 This class requires ``cryptography>=2.6`` to be installed. cKsdSrVr:)rAkwargsr:r:r;rZ szEd25519Algorithm.__init__cCst|ttfr|St|ttfrzt|tr4|d}|d}d|krNt|Sd|krbt|ddS|dddkrzt |St ddS) Nutf-8z-----BEGIN PUBLICz-----BEGIN PRIVATErtrzssh-z)Expecting a PEM-formatted or OpenSSH key.) rgrrrwrhencoderer!r r"ry)rArBZstr_keyr:r:r;rC#s    zEd25519Algorithm.prepare_keycCs$t|tk rt|dn|}||S)a Sign a message ``msg`` using the Ed25519 private key ``key`` :param str|bytes msg: Message to sign :param Ed25519PrivateKey key: A :class:`.Ed25519PrivateKey` instance :return bytes signature: The signature, as bytes r)typerwrFrDr:r:r;rF6szEd25519Algorithm.signcCsxzXt|tk rt|dn|}t|tk r2t|dn|}t|trH|}|||WdStjjk rrYdSXdS)a Verify a given ``msg`` against a signature ``sig`` using the Ed25519 key ``key`` :param str|bytes sig: Ed25519 signature to check ``msg`` against :param str|bytes msg: Message to sign :param Ed25519PrivateKey|Ed25519PublicKey key: A private or public Ed25519 key instance :return bool verified: True if signature is valid, False if not. rTFN) rrwrgrrrI cryptography exceptionsr rGr:r:r;rI@s   zEd25519Algorithm.verifycCst|tr:|jtjtjd}ttt | dddSt|t r|j tjt jtd}|jtjtjd}ttt | tt | dddStddS)N)encodingformatOKPEd25519)rrbr)rrZencryption_algorithm)rrrbrr)rgrZ public_bytesrZRawrrcrdrrrerZ private_bytesrrrr)rBrrr:r:r;rLTs:   zEd25519Algorithm.to_jwkc Csz.t|trt|}nt|tr(|}ntWntk rJtdYnX|ddkrbtd|d}|dkrtd|d|krtd t|d}z.d |krt |WSt|d }t |WStk r}ztd |W5d}~XYnXdS) NrfrbrzNot an Octet Key PairrrrrzOKP should have "x" parameterrzInvalid key parameter) rgrhrcrirjrkrrlrrZfrom_public_bytesrZfrom_private_bytes)rMrmrrrerrr:r:r;rN{s.      zEd25519Algorithm.from_jwkN) rOrPrQrRrZrCrFrIrSrLrNr:r:r:r;r9s  &r9)7rqrnrcrrutilsrrrrr r r Zcryptography.exceptionsrr Zcryptography.hazmat.primitivesr Z)cryptography.hazmat.primitives.asymmetricrrZ,cryptography.hazmat.primitives.asymmetric.ecrrZ1cryptography.hazmat.primitives.asymmetric.ed25519rrZ-cryptography.hazmat.primitives.asymmetric.rsarrrrrrrrZ,cryptography.hazmat.primitives.serializationrrrrr r!r"r4ModuleNotFoundErrorZrequires_cryptographyr<r=r/r0r6r7r8r9r:r:r:r;sN $   ( $  ")@{