­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ 3 i@sddlZddlZddlZddlZddlZddlZddlmZmZm Z ddl m Z m Z m Z ddlmZmZddlmZeZddlTddlmZdd lmZdd lmZmZdd lmZdd lmZmZdd lmZddlmZddlm Z ddlm!Z!ddlm"Z"ddl#m$Z$m%Z%ddl&m'Z'ddl(m)Z)ddl*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1dfZ2de"kZ3GdddeZ4GdddeZ5GdddeZ6Gd d!d!eZ7Gd"d#d#eZ8Gd$d%d%eZ9Gd&d'd'eZ:Gd(d)d)eZ;Gd*d+d+eZGd0d1d1e>Z?Gd2d3d3eZ@Gd4d5d5eZAGd6d7d7eZBGd8d9d9ZCd:d;ZDdd?ZFd@dAZGdBdCZHdDdEZIGdFdGdGZJGdHdIdIeJZKdJdKZLGdLdMdMZMGdNdOdOZNGdPdQdQeJZOGdRdSdSePZQGdTdUdUeNeOZRGdVdWdWeOZSGdXdYdYeNeSZTGdZd[d[eNeSZUGd\d]d]eMeTZVGd^d_d_eMeUZWGd`dadaeUZXGdbdcdceXZYGdddedeeMeXZZeKeReTeUeYeVeWeZfZ[dS)gN) a2b_base64 b2a_base64hexlify)sha256sha512 pbkdf2_hmac)HMACcompare_digest) create_logger)*) Compressor) StableDict)ErrorIntegrityError)yes) get_keys_dirget_security_dir)get_limited_unpacker) bin_to_hex)prepare_subprocess_env)msgpack) workarounds)Key EncryptedKey)SaveFile) NonceManager)AES bytes_to_long bytes_to_intnum_aes_blocks hmac_sha256 blake2b_256hkdf_hmac_sha512Zauthenticated_no_keyc@seZdZdZdS)NoPassphraseFailurez can not acquire a passphrase: {}N)__name__ __module__ __qualname____doc__r,r,/usr/lib64/python3.6/key.pyr'&sr'c@seZdZdZdS)PassphraseWrongzcpassphrase supplied in BORG_PASSPHRASE, by BORG_PASSCOMMAND or via BORG_PASSPHRASE_FD is incorrect.N)r(r)r*r+r,r,r,r-r.*sr.c@seZdZdZdS)PasscommandFailurez3passcommand supplied in BORG_PASSCOMMAND failed: {}N)r(r)r*r+r,r,r,r-r/.sr/c@seZdZdZdS)PasswordRetriesExceededz%exceeded the maximum password retriesN)r(r)r*r+r,r,r,r-r02sr0c@seZdZdZdS)UnsupportedPayloadErrorzSUnsupported payload type {}. A newer version is required to access this repository.N)r(r)r*r+r,r,r,r-r16sr1c@seZdZdZdS)UnsupportedManifestErrorzUUnsupported manifest envelope. A newer version is required to access this repository.N)r(r)r*r+r,r,r,r-r2:sr2c@seZdZdZdS)KeyfileNotFoundErrorz*No key file for repository {} found in {}.N)r(r)r*r+r,r,r,r-r3>sr3c@seZdZdZdS)KeyfileInvalidErrorz/Invalid key file for repository {} found in {}.N)r(r)r*r+r,r,r,r-r4Bsr4c@seZdZdZdS)KeyfileMismatchErrorz/Mismatch between repository {} and key file {}.N)r(r)r*r+r,r,r,r-r5Fsr5c@seZdZdZdS)RepoKeyNotFoundErrorz2No key entry found in the config of repository {}.N)r(r)r*r+r,r,r,r-r6Jsr6c@seZdZejdjZdZdS)TAMRequiredErroraT Manifest is unauthenticated, but it is required for this repository. This either means that you are under attack, or that you modified this repository with a Borg version older than 1.0.9 after TAM authentication was enabled. In the latter case, use "borg upgrade --tam --force '{}'" to re-authenticate the manifest. FN)r(r)r*textwrapdedentstripr+ tracebackr,r,r,r-r7Ns r7c@seZdZejdjZdZdS)ArchiveTAMRequiredErrorzR Archive '{}' is unauthenticated, but it is required for this repository. FN)r(r)r*r8r9r:r+r;r,r,r,r-r<Zs r<cs&eZdZejZdZfddZZS) TAMInvalidFcstjddS)Nz&Manifest authentication did not verify)super__init__)self) __class__r,r-r?eszTAMInvalid.__init__)r(r)r*rr+r;r? __classcell__r,r,)rAr-r=asr=cs&eZdZejZdZfddZZS)ArchiveTAMInvalidFcstjddS)Nz%Archive authentication did not verify)r>r?)r@)rAr,r-r?nszArchiveTAMInvalid.__init__)r(r)r*rr+r;r?rBr,r,)rAr-rCjsrCc@seZdZdZdZdS)TAMUnsupportedSuiteErrorzMCould not verify manifest: Unsupported suite {!r}; a newer version is needed.FN)r(r)r*r+r;r,r,r,r-rDssrDc@seZdZdZdZdZdS)KeyBlobStorageZ no_storagekeyfile repositoryN)r(r)r* NO_STORAGEKEYFILEREPOr,r,r,r-rExsrEcCsFx@tD]*}|j|jkr|jdk s$t|j||SqWtd|jdS)NzInvalid encryption mode "%s")AVAILABLE_KEY_TYPESARG_NAMEZ encryptionAssertionErrorcreate ValueError)rGargskeyr,r,r- key_creator~s   rRcCsddtDS)NcSsg|]}|jr|jqSr,)rL).0rQr,r,r- sz&key_argument_names..)rKr,r,r,r-key_argument_namessrUcCs>|d}|tjkrtSx"tD]}|j|kr|SqWt|dS)Nr) PassphraseKeyTYPERepoKeyrKr1) manifest_dataZkey_typerQr,r,r- identify_keys   rZcCst|j||S)N)rZdetect)rGrYr,r,r- key_factorysr\cCstt|j}tjj|dS)N tam_required)rridospathjoin)rGZ security_dirr,r,r-tam_required_filesrbcCst|}tjj|S)N)rbr_r`isfile)rGfiler,r,r-r]sr]c@sveZdZdZdZdZejZdZ dZ ddZ ddZ dd Z dd d Zd dZddZdddZdddZdddZdS)KeyBaseNZ UNDEFINEDFcCs8t|jg|_||_d|_td|_|jj|_d|_dS)NZlz4T) bytesrWTYPE_STRrGtargetr compressor decompressr])r@rGr,r,r-r?s   zKeyBase.__init__cCsdS)z1Return HMAC hash using the "id" HMAC key Nr,)r@datar,r,r-id_hashszKeyBase.id_hashcCsdS)Nr,)r@chunkr,r,r-encryptszKeyBase.encryptTcCsdS)Nr,)r@r^rkrjr,r,r-decryptszKeyBase.decryptcCs,|r(|j|}t||s(tdt|dS)Nz Chunk %s: id verification failed)rlr rr)r@r^rkZ id_computedr,r,r- assert_ids  zKeyBase.assert_idcCs"t|j|j|j|d|ddS)Nsborg-metadata-authentication-@)ZikmsaltinfoZ output_length)r$id_keyenc_key enc_hmac_key)r@rrcontextr,r,r-_tam_keys zKeyBase._tam_keymanifestcCsr|dkrtjd}t|}tdtd|d}|d<tj|dd}|j||}t||tj |d<tj|ddS)NrqHKDF_HMAC_SHA512)typehmacrrtamsurrogateescape)Zunicode_errorsr|) r_urandomrrfrpackbrxrrdigest)r@Z metadata_dictrwrrr}Zpackedtam_keyr,r,r-pack_and_authenticate_metadatas  z&KeyBase.pack_and_authenticate_metadatac Cs~|jdrt|j}|r,|r,tjdd}t|}td}|j||j}t rZ|dfSd|kr|rxt |j j j ntjd|dfS|jdd }t|tst|jd d jd d }|dkr|rtt|ntjd||dfS|jd}|jd} t| t st|t rt|j|} td|| | d<|j| dd} t| |tj} t| |slttjd|dfS)z8Unpack msgpacked *data* and return (object, did_verify).z!Manifest authentication DISABLED.FZmanifestTstamz'Manifest TAM not found and not requiredNstypesasciireplacerzzPIgnoring manifest TAM made with unsupported suite, since TAM is not required: %rshmacssaltrqsmanifest)rwzTAM-verified manifests) startswithr2r]loggerwarning bytearrayrfeedunpackAUTHENTICATED_NO_KEYr7rG _locationcanonical_pathdebugpop isinstancedictr=getdecoderDreprrfindexrxrrrr ) r@rkforce_tam_not_requiredr]unpackerunpackedr}tam_typetam_hmactam_saltoffsetrcalculated_hmacr,r,r-unpack_and_verify_manifestsL            z"KeyBase.unpack_and_verify_manifestcCs|j}|r|rtjdd}t|}td}|j||j}d|kr||rh|jddjdd}t |ntjd |dd fS|j dd }t |t st |jd d jdd}|d kr|rtt|ntjd||dd fS|jd} |jd} t | t s t | t rt |j| } td|| | d<|j| dd} t| |tj} t| | s~dtkrxtjd|dd fSt tjd|d| fS)z>Unpack msgpacked *data* and return (object, did_verify, salt).z Archive authentication DISABLED.Farchivestamsnames rrz&Archive TAM not found and not requiredNstypesrzzOIgnoring archive TAM made with unsupported suite, since TAM is not required: %rshmacssaltrqsarchive)rwZignore_invalid_archive_tamz4ignoring invalid archive TAM due to BORG_WORKAROUNDSzTAM-verified archiveT)r]rrrrrrrrr<rrrrCrDrrfrrxrrrr r)r@rkrr]rrZ archive_namer}rrrrrrr,r,r-unpack_and_verify_archivesL                 z!KeyBase.unpack_and_verify_archive)T)ryN)F)F)r(r)r*rWNAMErLrErHSTORAGE chunk_seedlogically_encryptedr?rlrnrorprxrrrr,r,r,r-res     ,recspeZdZdZdZdZejZdZ dZ fddZ e dd Z e d d Zd d ZddZdddZddZZS) PlaintextKeyr Z plaintextZnonerFcstj|d|_dS)NF)r>r?r])r@rG)rAr,r-r?Us zPlaintextKey.__init__cCstjd||S)NzTEncryption NOT enabled. Use the "--encryption=repokey|keyfile" to enable encryption.)rrs)clsrGrPr,r,r-rNYs zPlaintextKey.createcCs||S)Nr,)rrGrYr,r,r-r[^szPlaintextKey.detectcCs t|jS)N)rr)r@rkr,r,r-rlbszPlaintextKey.id_hashcCs|jj|}dj|j|gS)N)ricompressrarg)r@rmrkr,r,r-rnes zPlaintextKey.encryptTcCs`|d|jkr.|dk rt|nd}td|t|dd}|sF|S|j|}|j|||S)Nrz (unknown)z%Chunk %s: Invalid encryption enveloper)rWrr memoryviewrjrp)r@r^rkrjid_strpayloadr,r,r-rois   zPlaintextKey.decryptcCs||S)Nr,)r@rrrwr,r,r-rxtszPlaintextKey._tam_key)T)r(r)r*rWrrLrErHrrrr? classmethodrNr[rlrnrorxrBr,r,)rAr-rLs    rcCstjdtdS)Nrq)r_rrfr,r,r,r-random_blake2b_256_keyxs rcs*eZdZdZddZdfdd ZZS)ID_BLAKE2b_256zi Key mix-in class for using BLAKE2b-256 for the id key. The id_key length must be 32 bytes. cCs t|j|S)N)r#rt)r@rkr,r,r-rlszID_BLAKE2b_256.id_hashNcs*|dks ttjt|_t|_dS)N)rMr>init_from_random_datarrvrt)r@rk)rAr,r-rs  z$ID_BLAKE2b_256.init_from_random_data)N)r(r)r*r+rlrrBr,r,)rAr-rsrc@seZdZdZddZdS)ID_HMAC_SHA_256zj Key mix-in class for using HMAC-SHA-256 for the id key. The id_key length must be 32 bytes. cCs t|j|S)N)r"rt)r@rkr,r,r-rlszID_HMAC_SHA_256.id_hashN)r(r)r*r+rlr,r,r,r-rsrc@sJeZdZdZdZeZdZddZddd Z d d Z dd dZ dddZ d S) AESKeyBasea Common base class shared by KeyfileKey and PassphraseKey Chunks are encrypted using 256bit AES in Counter Mode (CTR) Payload layout: TYPE(1) + HMAC(32) + NONCE(8) + CIPHERTEXT To reduce payload size only 8 bytes of the 16 bytes nonce is saved in the payload, the first 8 bytes are always zeros. This does not affect security but limits the maximum repository capacity to only 295 exabytes! r r&TcCs|jj|}|jjtt||jjdj|jj dd|jj |f}|j t krdt|j dks|j tkr|t|j dkst|j |j |}dj|j||fS)Nrr&r)rir nonce_managerZensure_reservationr!len enc_cipherresetraivrnMACr#rvr"rMrg)r@rmrkr|r,r,r-rns  "zAESKeyBase.encryptc Cs$|d|jkp$|dtjko$t|tsF|dk r6t|nd}td|t|}|dd}|jtkrrt |j dks|jt krt |j dkst t|j|j |dd}t ||s|dk rt|nd}td||jjt|dd d |jj|d d}|s |S|j|}|j|||S) Nrz (unknown)z%Chunk %s: Invalid encryption enveloper!rrz/Chunk %s: Encryption envelope checksum mismatch))r)rWrVrrXrrrrr#rrvr"rMr dec_cipherrPREFIXrorjrp) r@r^rkrjrZ data_viewZ hmac_givenZ hmac_computedrr,r,r-ros&      zAESKeyBase.decryptcCsB|d|jkp$|dtjko$t|ts.tdt|dd}|S)Nrz%Manifest: Invalid encryption enveloperr)rWrVrrXrr)r@rZnoncer,r,r- extract_nonces zAESKeyBase.extract_nonceNcCsl|dkrtjd}|dd|_|dd|_|dd|_t|dd|_|jd@rh|jdd|_dS) Ndrrrq`llr)r_rrurvrtr r)r@rkr,r,r-rs  z AESKeyBase.init_from_random_datarcCsBtd|j|jdddd|_t|j|j||_td|jd|_dS)NTZbig) byteorder) is_encryptrQrF)rrQ)rruto_bytesrrrGrr)r@Zmanifest_noncer,r,r- init_ciphersszAESKeyBase.init_ciphersrr)T)N)r) r(r)r*r+ZPAYLOAD_OVERHEADr"rrrnrorrrr,r,r,r-rs   rc@seZdZedddZedddZedddZedd Zedd d Zed d Z eddZ edddZ ddZ ddZ dS) PassphraseNcCs"tjj||}|dk r||SdS)N)r_environr)renv_vardefault passphraser,r,r-_env_passphraseszPassphrase._env_passphrasecCsD|jd|}|dk r|S|j}|dk r,|S|j}|dk r@|SdS)NBORG_PASSPHRASE)renv_passcommand fd_passphrase)rrrr,r,r-env_passphrases zPassphrase.env_passphrasecCs~tjjdd}|dk rztdd}ytjtj|d|d}Wn0tjt fk rj}zt |WYdd}~XnX||j dSdS)NBORG_PASSCOMMANDT)system)Zuniversal_newlinesenv ) r_rrr subprocessZ check_outputshlexsplitZCalledProcessErrorFileNotFoundErrorr/rstrip)rrZ passcommandrrer,r,r-rs zPassphrase.env_passcommandcCs^yttjjd}Wnttfk r,dSXtj|dd}|j}WdQRX||jdS)NZBORG_PASSPHRASE_FDr)moder) intr_rrrO TypeErrorfdopenreadr)rfdfrr,r,r-r szPassphrase.fd_passphrasecCs |jd|S)NZBORG_NEW_PASSPHRASE)r)rrr,r,r-env_new_passphraseszPassphrase.env_new_passphrasec Csytj|}Wnttk r|r(tg}x6dD].}tjj|dk }|jd||rVdndfq2W|jdtdj|dYn X||SdS) Nrrz %s is %s.setznot setz"Interactive password query failed. )rr) getpassEOFErrorprintr_rrappendr'ra)rpromptZpwmsgrZ env_var_setr,r,r-rs  zPassphrase.getpassc Csd}t||ddddrtd|tjdtdtjdy|jd Wn>tk rtd t|jd tjdtd tjdYnXdS) NzDDo you want your passphrase to be displayed for verification? [yN]: zInvalid answer, try again.TZBORG_DISPLAY_PASSPHRASE)Z retry_msgZ invalid_msgretryZenv_var_overridez-Your passphrase (between double-quotes): "%s")rdzDMake sure the passphrase displayed above is exactly what you wanted.rz+Your passphrase (UTF-8 encoding in hex): %szutf-8zAs you have a non-ASCII passphrase, it is recommended to keep the UTF-8 encoding in hex together with the passphrase at a safe place.)rrsysstderrencodeUnicodeEncodeErrorr)rrrr,r,r- verification*s    zPassphrase.verificationFcCs|j}|dk r|S|j}|dk r(|SxptddD]^}|jd}|sJ|r|jd}||krt|j|tjd|Stdtj dq4tdtj dq4Wt dS) Nr zEnter new passphrase: zEnter same passphrase again: zDRemember your passphrase. Your data will be inaccessible without it.zPassphrases do not match)rdzPassphrase must not be blank) rrrangerrrrsrrrr0)r allow_emptyrrZ passphrase2r,r,r-new<s"    zPassphrase.newcCsdS)Nzr,)r@r,r,r-__repr__SszPassphrase.__repr__cCstd|jd|||S)Nrzutf-8)rr)r@rr iterationsZlengthr,r,r-kdfVszPassphrase.kdf)N)N)N)N)F)r(r)r*rrrrrrrrrrrr,r,r,r-rs       rc@sJeZdZdZdZdZejZdZ e ddZ e ddZ d d Z d d ZdS) rVrrNicCs.||}tjdtjdd}|j|||S)Nz9WARNING: "passphrase" mode is unsupported since borg 1.0.F)r)rrrrinit)rrGrPrQrr,r,r-rNjs    zPassphraseKey.createc Csd|jj}||}tj}|dkr0tj|}x|tddD]j}|j||y:|jd|tt |d}|j |j ||||_ |St k rtj|}Yq.ImmutablePassphraseErrorz=The passphrase for this encryption key type can't be changed.N)r(r)r*r+r,r,r,r-ImmutablePassphraseErrorsr)r)r@rr,r,r-change_passphraseszPassphraseKey.change_passphrasecCs*|j|j|j|jd|jd|_dS)NrF)rrr^rrr])r@rGrr,r,r-rszPassphraseKey.init)r(r)r*rWrrLrErHrrrrNr[rrr,r,r,r-rVZs   rVc@speZdZeddZddZddZddZd d Zd d Z d dZ dddZ eddZ dddZ ddZdS)KeyfileKeyBasec Cs||}|j}d|}tj}|dkrlt}|j||s|x@tddD]}tj|}|j||rFPqFWtn|j||s|ttt |d}|j |j ||||_ |S)NzEnter passphrase for key %s: rrr) find_keyrrloadrrr0r.r!rrrr) rrGrYrQrhrrrrr,r,r-r[s$    zKeyfileKeyBase.detectcCstdS)N)NotImplementedError)r@r,r,r-rszKeyfileKeyBase.find_keycCstdS)N)r)r@rhrr,r,r-rszKeyfileKeyBase.loadcCst|}|j||}|r~tj|}t|d}|jdkr>td|j|_|j|_|j |_ |j |_ |j |_ |j dt |j|_ dSdS)N) internal_dictrz5key version %d is not supported by this borg version.r]TF)rdecrypt_key_filerZunpackbrversionr repository_idrurvrtrrr]rG)r@key_datarcdatarkrQr,r,r-_loads    zKeyfileKeyBase._loadcCstd}|j||j}t|d}|jdkrKeep this key safe. Your data will be inaccessible without it.) rrr^rrrget_new_targetrrrs)rrGrPrrQrhr,r,r-rNs   zKeyfileKeyBase.createFcCstdS)N)r)r@rhrrNr,r,r-rszKeyfileKeyBase.savecCstdS)N)r)r@rPr,r,r-rszKeyfileKeyBase.get_new_target)N)F)r(r)r*rr[rrr rrrrrNrrr,r,r,r-rs   rc@sLeZdZdZdZdZejZdZ ddZ ddZ d d Z d d Z dddZdS) KeyfileKeyrzkey filerFBORG_KEYc Csx|jjd}t|}t|dN}|jt||krFt|jjj ||jt||krjt |jjj ||SQRXdS)N rb) FILE_IDrropenrrr4rGrrr5)r@filenamer^Zfile_idZrepo_idrr,r,r- sanity_checks zKeyfileKey.sanity_checkc Cs|jj}tjjd}|r,|jtjj||St}xFtj |D]8}tjj ||}y |j||St t fk rtYq>Xq>Wt |jjjtdS)N BORG_KEY_FILE)rGr^r_rrrr`abspathrlistdirrar4r5r3rr)r@r^rFZkeys_dirnamerr,r,r-rs   zKeyfileKey.find_keycCsXtjjd}|rtjj|S|jj}|}d}x$tjj|rR|d7}|d|}q0W|S)Nrrz.%d)r_rrr`rlocationZto_key_filenameexists)r@rPrFrr`ir,r,r-r(s   zKeyfileKey.get_new_targetc CsFt|d}dj|jdd}WdQRX|j||}|rB||_|S)Nrr)rra readlinesr rh)r@rhrrr successr,r,r-r4s    zKeyfileKey.loadFc Csr|rtjj|rtd||j|}t|4}|jd|jt|j f|j||jdWdQRX||_ dS)Nz,Aborting because key in "%s" already exists.z%s %s r) r_r`rcrrrwriterrrrh)r@rhrrNr rr,r,r-r<s    zKeyfileKey.saveN)F)r(r)r*rWrrLrErIrrrrrrrr,r,r,r-rs  rc@s@eZdZdZdZdZejZddZ ddZ ddZ d d d Z d S)rXrZrepokeycCs(|jjj}|jj}|s$t|d|S)N)rGrrload_keyr6)r@locrQr,r,r-rPs    zRepoKey.find_keycCs|jS)N)rG)r@rPr,r,r-rXszRepoKey.get_new_targetcCsT|dk|_|j}|j}|s0|jj}t|d|jd}|j||}|rP||_|S)Nr"zutf-8) rrGr&rrr6rr rh)r@rhrr r'r$r,r,r-r[s     z RepoKey.loadFcCs2|dk|_|j|}|jd}|j|||_dS)Nr"zutf-8)rrrZsave_keyrh)r@rhrrNr r,r,r-rms     z RepoKey.saveN)F) r(r)r*rWrrLrErJrrrrrr,r,r,r-rXJsrXc@s&eZdZdZdZdZejZdZ e Z dS)Blake2KeyfileKeyrzkey file BLAKE2bzkeyfile-blake2rN) r(r)r*rWrrLrErIrrr#rr,r,r,r-r(us r(c@s"eZdZdZdZdZejZe Z dS) Blake2RepoKeyzrepokey BLAKE2bzrepokey-blake2N) r(r)r*rWrrLrErJrr#rr,r,r,r-r)s r)csZeZdZejZdZfddZfddZdfdd Z dd Z d d Z dd dZ Z S)AuthenticatedKeyBaseFcsBtr4td}||_||_||_||_d|_d|_dStj ||S)NrrFT) rrfrrurvrtrr]r>r )r@r rZNOPE)rAr,r-r szAuthenticatedKeyBase._loadcstj||}d|_|S)NF)r>rr)r@rhrr$)rAr,r-rszAuthenticatedKeyBase.loadcstj|||dd|_dS)N)rNF)r>rr)r@rhrrN)rAr,r-rszAuthenticatedKeyBase.savecCs|d|jkrtddS)Nrz%Manifest: Invalid encryption envelope*)rWr)r@rr,r,r-rsz"AuthenticatedKeyBase.extract_noncecCs|jj|}dj|j|gS)Nr)rirrarg)r@rmrkr,r,r-rns zAuthenticatedKeyBase.encryptTcCsX|d|jkrtdt|t|dd}|s6|S|j|}trH|S|j|||S)NrzChunk %s: Invalid enveloper)rWrrrrjrrp)r@r^rkrjrr,r,r-ros  zAuthenticatedKeyBase.decrypt)F)T)r(r)r*rErJrrr rrrrnrorBr,r,)rAr-r+s  r+c@seZdZdZdZdZdS)AuthenticatedKeyZ authenticatedN)r(r)r*rWrrLr,r,r,r-r-sr-c@seZdZdZdZdZdS)Blake2AuthenticatedKeyzauthenticated BLAKE2bzauthenticated-blake2N)r(r)r*rWrrLr,r,r,r-r/sr/s)\rr_rrr8rZbinasciirrrZhashlibrrrr|rr Z borg.loggerr rZ constantsrr ZhelpersrrrrrrrrrrritemrrplatformrZnoncesrZ low_levelrrr r!r"r#r$rrr'r.r/r0r1r2r3r4r5r6r7r<r=rCrDrErRrUrZr\rbr]rerrrrrstrrrVrrrXr(r)r+r-r/rKr,r,r,r-s           $    &, Km8tD+  8