updates

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/_oid.py

@@ -4,8 +4,6 @@
 
 from __future__ import annotations
 
-import typing
-
 from cryptography.hazmat.bindings._rust import (
     ObjectIdentifier as ObjectIdentifier,
 )
@@ -16,6 +14,7 @@ class ExtensionOID:
     SUBJECT_DIRECTORY_ATTRIBUTES = ObjectIdentifier("2.5.29.9")
     SUBJECT_KEY_IDENTIFIER = ObjectIdentifier("2.5.29.14")
     KEY_USAGE = ObjectIdentifier("2.5.29.15")
+    PRIVATE_KEY_USAGE_PERIOD = ObjectIdentifier("2.5.29.16")
     SUBJECT_ALTERNATIVE_NAME = ObjectIdentifier("2.5.29.17")
     ISSUER_ALTERNATIVE_NAME = ObjectIdentifier("2.5.29.18")
     BASIC_CONSTRAINTS = ObjectIdentifier("2.5.29.19")
@@ -41,6 +40,7 @@ class ExtensionOID:
     PRECERT_POISON = ObjectIdentifier("1.3.6.1.4.1.11129.2.4.3")
     SIGNED_CERTIFICATE_TIMESTAMPS = ObjectIdentifier("1.3.6.1.4.1.11129.2.4.5")
     MS_CERTIFICATE_TEMPLATE = ObjectIdentifier("1.3.6.1.4.1.311.21.7")
+    ADMISSIONS = ObjectIdentifier("1.3.36.8.3.3")
 
 
 class OCSPExtensionOID:
@@ -60,6 +60,7 @@ class NameOID:
     LOCALITY_NAME = ObjectIdentifier("2.5.4.7")
     STATE_OR_PROVINCE_NAME = ObjectIdentifier("2.5.4.8")
     STREET_ADDRESS = ObjectIdentifier("2.5.4.9")
+    ORGANIZATION_IDENTIFIER = ObjectIdentifier("2.5.4.97")
     ORGANIZATION_NAME = ObjectIdentifier("2.5.4.10")
     ORGANIZATIONAL_UNIT_NAME = ObjectIdentifier("2.5.4.11")
     SERIAL_NUMBER = ObjectIdentifier("2.5.4.5")
@@ -123,9 +124,7 @@ class SignatureAlgorithmOID:
     GOSTR3410_2012_WITH_3411_2012_512 = ObjectIdentifier("1.2.643.7.1.1.3.3")
 
 
-_SIG_OIDS_TO_HASH: typing.Dict[
-    ObjectIdentifier, typing.Optional[hashes.HashAlgorithm]
-] = {
+_SIG_OIDS_TO_HASH: dict[ObjectIdentifier, hashes.HashAlgorithm | None] = {
     SignatureAlgorithmOID.RSA_WITH_MD5: hashes.MD5(),
     SignatureAlgorithmOID.RSA_WITH_SHA1: hashes.SHA1(),
     SignatureAlgorithmOID._RSA_WITH_SHA1: hashes.SHA1(),
@@ -157,6 +156,33 @@ _SIG_OIDS_TO_HASH: typing.Dict[
 }
 
 
+class HashAlgorithmOID:
+    SHA1 = ObjectIdentifier("1.3.14.3.2.26")
+    SHA224 = ObjectIdentifier("2.16.840.1.101.3.4.2.4")
+    SHA256 = ObjectIdentifier("2.16.840.1.101.3.4.2.1")
+    SHA384 = ObjectIdentifier("2.16.840.1.101.3.4.2.2")
+    SHA512 = ObjectIdentifier("2.16.840.1.101.3.4.2.3")
+    SHA3_224 = ObjectIdentifier("1.3.6.1.4.1.37476.3.2.1.99.7.224")
+    SHA3_256 = ObjectIdentifier("1.3.6.1.4.1.37476.3.2.1.99.7.256")
+    SHA3_384 = ObjectIdentifier("1.3.6.1.4.1.37476.3.2.1.99.7.384")
+    SHA3_512 = ObjectIdentifier("1.3.6.1.4.1.37476.3.2.1.99.7.512")
+    SHA3_224_NIST = ObjectIdentifier("2.16.840.1.101.3.4.2.7")
+    SHA3_256_NIST = ObjectIdentifier("2.16.840.1.101.3.4.2.8")
+    SHA3_384_NIST = ObjectIdentifier("2.16.840.1.101.3.4.2.9")
+    SHA3_512_NIST = ObjectIdentifier("2.16.840.1.101.3.4.2.10")
+
+
+class PublicKeyAlgorithmOID:
+    DSA = ObjectIdentifier("1.2.840.10040.4.1")
+    EC_PUBLIC_KEY = ObjectIdentifier("1.2.840.10045.2.1")
+    RSAES_PKCS1_v1_5 = ObjectIdentifier("1.2.840.113549.1.1.1")
+    RSASSA_PSS = ObjectIdentifier("1.2.840.113549.1.1.10")
+    X25519 = ObjectIdentifier("1.3.101.110")
+    X448 = ObjectIdentifier("1.3.101.111")
+    ED25519 = ObjectIdentifier("1.3.101.112")
+    ED448 = ObjectIdentifier("1.3.101.113")
+
+
 class ExtendedKeyUsageOID:
     SERVER_AUTH = ObjectIdentifier("1.3.6.1.5.5.7.3.1")
     CLIENT_AUTH = ObjectIdentifier("1.3.6.1.5.5.7.3.2")
@@ -168,9 +194,20 @@ class ExtendedKeyUsageOID:
     SMARTCARD_LOGON = ObjectIdentifier("1.3.6.1.4.1.311.20.2.2")
     KERBEROS_PKINIT_KDC = ObjectIdentifier("1.3.6.1.5.2.3.5")
     IPSEC_IKE = ObjectIdentifier("1.3.6.1.5.5.7.3.17")
+    BUNDLE_SECURITY = ObjectIdentifier("1.3.6.1.5.5.7.3.35")
     CERTIFICATE_TRANSPARENCY = ObjectIdentifier("1.3.6.1.4.1.11129.2.4.4")
 
 
+class OtherNameFormOID:
+    PERMANENT_IDENTIFIER = ObjectIdentifier("1.3.6.1.5.5.7.8.3")
+    HW_MODULE_NAME = ObjectIdentifier("1.3.6.1.5.5.7.8.4")
+    DNS_SRV = ObjectIdentifier("1.3.6.1.5.5.7.8.7")
+    NAI_REALM = ObjectIdentifier("1.3.6.1.5.5.7.8.8")
+    SMTP_UTF8_MAILBOX = ObjectIdentifier("1.3.6.1.5.5.7.8.9")
+    ACP_NODE_NAME = ObjectIdentifier("1.3.6.1.5.5.7.8.10")
+    BUNDLE_EID = ObjectIdentifier("1.3.6.1.5.5.7.8.11")
+
+
 class AuthorityInformationAccessOID:
     CA_ISSUERS = ObjectIdentifier("1.3.6.1.5.5.7.48.2")
     OCSP = ObjectIdentifier("1.3.6.1.5.5.7.48.1")
@@ -228,7 +265,7 @@ _OID_NAMES = {
     SignatureAlgorithmOID.RSA_WITH_SHA256: "sha256WithRSAEncryption",
     SignatureAlgorithmOID.RSA_WITH_SHA384: "sha384WithRSAEncryption",
     SignatureAlgorithmOID.RSA_WITH_SHA512: "sha512WithRSAEncryption",
-    SignatureAlgorithmOID.RSASSA_PSS: "RSASSA-PSS",
+    SignatureAlgorithmOID.RSASSA_PSS: "rsassaPss",
     SignatureAlgorithmOID.ECDSA_WITH_SHA1: "ecdsa-with-SHA1",
     SignatureAlgorithmOID.ECDSA_WITH_SHA224: "ecdsa-with-SHA224",
     SignatureAlgorithmOID.ECDSA_WITH_SHA256: "ecdsa-with-SHA256",
@@ -248,6 +285,24 @@ _OID_NAMES = {
     SignatureAlgorithmOID.GOSTR3410_2012_WITH_3411_2012_512: (
         "GOST R 34.10-2012 with GOST R 34.11-2012 (512 bit)"
     ),
+    HashAlgorithmOID.SHA1: "sha1",
+    HashAlgorithmOID.SHA224: "sha224",
+    HashAlgorithmOID.SHA256: "sha256",
+    HashAlgorithmOID.SHA384: "sha384",
+    HashAlgorithmOID.SHA512: "sha512",
+    HashAlgorithmOID.SHA3_224: "sha3_224",
+    HashAlgorithmOID.SHA3_256: "sha3_256",
+    HashAlgorithmOID.SHA3_384: "sha3_384",
+    HashAlgorithmOID.SHA3_512: "sha3_512",
+    HashAlgorithmOID.SHA3_224_NIST: "sha3_224",
+    HashAlgorithmOID.SHA3_256_NIST: "sha3_256",
+    HashAlgorithmOID.SHA3_384_NIST: "sha3_384",
+    HashAlgorithmOID.SHA3_512_NIST: "sha3_512",
+    PublicKeyAlgorithmOID.DSA: "dsaEncryption",
+    PublicKeyAlgorithmOID.EC_PUBLIC_KEY: "id-ecPublicKey",
+    PublicKeyAlgorithmOID.RSAES_PKCS1_v1_5: "rsaEncryption",
+    PublicKeyAlgorithmOID.X25519: "X25519",
+    PublicKeyAlgorithmOID.X448: "X448",
     ExtendedKeyUsageOID.SERVER_AUTH: "serverAuth",
     ExtendedKeyUsageOID.CLIENT_AUTH: "clientAuth",
     ExtendedKeyUsageOID.CODE_SIGNING: "codeSigning",
@@ -259,6 +314,7 @@ _OID_NAMES = {
     ExtensionOID.SUBJECT_DIRECTORY_ATTRIBUTES: "subjectDirectoryAttributes",
     ExtensionOID.SUBJECT_KEY_IDENTIFIER: "subjectKeyIdentifier",
     ExtensionOID.KEY_USAGE: "keyUsage",
+    ExtensionOID.PRIVATE_KEY_USAGE_PERIOD: "privateKeyUsagePeriod",
     ExtensionOID.SUBJECT_ALTERNATIVE_NAME: "subjectAltName",
     ExtensionOID.ISSUER_ALTERNATIVE_NAME: "issuerAltName",
     ExtensionOID.BASIC_CONSTRAINTS: "basicConstraints",
@@ -270,6 +326,7 @@ _OID_NAMES = {
     ),
     ExtensionOID.PRECERT_POISON: "ctPoison",
     ExtensionOID.MS_CERTIFICATE_TEMPLATE: "msCertificateTemplate",
+    ExtensionOID.ADMISSIONS: "Admissions",
     CRLEntryExtensionOID.CRL_REASON: "cRLReason",
     CRLEntryExtensionOID.INVALIDITY_DATE: "invalidityDate",
     CRLEntryExtensionOID.CERTIFICATE_ISSUER: "certificateIssuer",
@@ -282,7 +339,7 @@ _OID_NAMES = {
     ExtensionOID.EXTENDED_KEY_USAGE: "extendedKeyUsage",
     ExtensionOID.FRESHEST_CRL: "freshestCRL",
     ExtensionOID.INHIBIT_ANY_POLICY: "inhibitAnyPolicy",
-    ExtensionOID.ISSUING_DISTRIBUTION_POINT: ("issuingDistributionPoint"),
+    ExtensionOID.ISSUING_DISTRIBUTION_POINT: "issuingDistributionPoint",
     ExtensionOID.AUTHORITY_INFORMATION_ACCESS: "authorityInfoAccess",
     ExtensionOID.SUBJECT_INFORMATION_ACCESS: "subjectInfoAccess",
     ExtensionOID.OCSP_NO_CHECK: "OCSPNoCheck",

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/asn1/__init__.py

@@ -0,0 +1,10 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+from cryptography.hazmat.asn1.asn1 import encode_der, sequence
+
+__all__ = [
+    "encode_der",
+    "sequence",
+]

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/asn1/asn1.py

@@ -0,0 +1,116 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+from __future__ import annotations
+
+import dataclasses
+import sys
+import typing
+
+if sys.version_info < (3, 11):
+    import typing_extensions
+
+    # We use the `include_extras` parameter of `get_type_hints`, which was
+    # added in Python 3.9. This can be replaced by the `typing` version
+    # once the min version is >= 3.9
+    if sys.version_info < (3, 9):
+        get_type_hints = typing_extensions.get_type_hints
+    else:
+        get_type_hints = typing.get_type_hints
+else:
+    get_type_hints = typing.get_type_hints
+
+from cryptography.hazmat.bindings._rust import declarative_asn1
+
+T = typing.TypeVar("T", covariant=True)
+U = typing.TypeVar("U")
+
+
+encode_der = declarative_asn1.encode_der
+
+
+def _normalize_field_type(
+    field_type: typing.Any, field_name: str
+) -> declarative_asn1.AnnotatedType:
+    annotation = declarative_asn1.Annotation()
+
+    if hasattr(field_type, "__asn1_root__"):
+        annotated_root = field_type.__asn1_root__
+        if not isinstance(annotated_root, declarative_asn1.AnnotatedType):
+            raise TypeError(f"unsupported root type: {annotated_root}")
+        return annotated_root
+    else:
+        rust_field_type = declarative_asn1.non_root_python_to_rust(field_type)
+
+    return declarative_asn1.AnnotatedType(rust_field_type, annotation)
+
+
+def _annotate_fields(
+    raw_fields: dict[str, type],
+) -> dict[str, declarative_asn1.AnnotatedType]:
+    fields = {}
+    for field_name, field_type in raw_fields.items():
+        # Recursively normalize the field type into something that the
+        # Rust code can understand.
+        annotated_field_type = _normalize_field_type(field_type, field_name)
+        fields[field_name] = annotated_field_type
+
+    return fields
+
+
+def _register_asn1_sequence(cls: type[U]) -> None:
+    raw_fields = get_type_hints(cls, include_extras=True)
+    root = declarative_asn1.AnnotatedType(
+        declarative_asn1.Type.Sequence(cls, _annotate_fields(raw_fields)),
+        declarative_asn1.Annotation(),
+    )
+
+    setattr(cls, "__asn1_root__", root)
+
+
+# Due to https://github.com/python/mypy/issues/19731, we can't define an alias
+# for `dataclass_transform` that conditionally points to `typing` or
+# `typing_extensions` depending on the Python version (like we do for
+# `get_type_hints`).
+# We work around it by making the whole decorated class conditional on the
+# Python version.
+if sys.version_info < (3, 11):
+
+    @typing_extensions.dataclass_transform(kw_only_default=True)
+    def sequence(cls: type[U]) -> type[U]:
+        # We use `dataclasses.dataclass` to add an __init__ method
+        # to the class with keyword-only parameters.
+        if sys.version_info >= (3, 10):
+            dataclass_cls = dataclasses.dataclass(
+                repr=False,
+                eq=False,
+                # `match_args` was added in Python 3.10 and defaults
+                # to True
+                match_args=False,
+                # `kw_only` was added in Python 3.10 and defaults to
+                # False
+                kw_only=True,
+            )(cls)
+        else:
+            dataclass_cls = dataclasses.dataclass(
+                repr=False,
+                eq=False,
+            )(cls)
+        _register_asn1_sequence(dataclass_cls)
+        return dataclass_cls
+
+else:
+
+    @typing.dataclass_transform(kw_only_default=True)
+    def sequence(cls: type[U]) -> type[U]:
+        # Only add an __init__ method, with keyword-only
+        # parameters.
+        dataclass_cls = dataclasses.dataclass(
+            repr=False,
+            eq=False,
+            match_args=False,
+            kw_only=True,
+        )(cls)
+        _register_asn1_sequence(dataclass_cls)
+        return dataclass_cls

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/backends/openssl/aead.py

@@ -1,527 +0,0 @@
-# This file is dual licensed under the terms of the Apache License, Version
-# 2.0, and the BSD License. See the LICENSE file in the root of this repository
-# for complete details.
-
-from __future__ import annotations
-
-import typing
-
-from cryptography.exceptions import InvalidTag
-
-if typing.TYPE_CHECKING:
-    from cryptography.hazmat.backends.openssl.backend import Backend
-    from cryptography.hazmat.primitives.ciphers.aead import (
-        AESCCM,
-        AESGCM,
-        AESOCB3,
-        AESSIV,
-        ChaCha20Poly1305,
-    )
-
-    _AEADTypes = typing.Union[
-        AESCCM, AESGCM, AESOCB3, AESSIV, ChaCha20Poly1305
-    ]
-
-
-def _is_evp_aead_supported_cipher(
-    backend: Backend, cipher: _AEADTypes
-) -> bool:
-    """
-    Checks whether the given cipher is supported through
-    EVP_AEAD rather than the normal OpenSSL EVP_CIPHER API.
-    """
-    from cryptography.hazmat.primitives.ciphers.aead import ChaCha20Poly1305
-
-    return backend._lib.Cryptography_HAS_EVP_AEAD and isinstance(
-        cipher, ChaCha20Poly1305
-    )
-
-
-def _aead_cipher_supported(backend: Backend, cipher: _AEADTypes) -> bool:
-    if _is_evp_aead_supported_cipher(backend, cipher):
-        return True
-    else:
-        cipher_name = _evp_cipher_cipher_name(cipher)
-        if backend._fips_enabled and cipher_name not in backend._fips_aead:
-            return False
-        # SIV isn't loaded through get_cipherbyname but instead a new fetch API
-        # only available in 3.0+. But if we know we're on 3.0+ then we know
-        # it's supported.
-        if cipher_name.endswith(b"-siv"):
-            return backend._lib.CRYPTOGRAPHY_OPENSSL_300_OR_GREATER == 1
-        else:
-            return (
-                backend._lib.EVP_get_cipherbyname(cipher_name)
-                != backend._ffi.NULL
-            )
-
-
-def _aead_create_ctx(
-    backend: Backend,
-    cipher: _AEADTypes,
-    key: bytes,
-):
-    if _is_evp_aead_supported_cipher(backend, cipher):
-        return _evp_aead_create_ctx(backend, cipher, key)
-    else:
-        return _evp_cipher_create_ctx(backend, cipher, key)
-
-
-def _encrypt(
-    backend: Backend,
-    cipher: _AEADTypes,
-    nonce: bytes,
-    data: bytes,
-    associated_data: typing.List[bytes],
-    tag_length: int,
-    ctx: typing.Any = None,
-) -> bytes:
-    if _is_evp_aead_supported_cipher(backend, cipher):
-        return _evp_aead_encrypt(
-            backend, cipher, nonce, data, associated_data, tag_length, ctx
-        )
-    else:
-        return _evp_cipher_encrypt(
-            backend, cipher, nonce, data, associated_data, tag_length, ctx
-        )
-
-
-def _decrypt(
-    backend: Backend,
-    cipher: _AEADTypes,
-    nonce: bytes,
-    data: bytes,
-    associated_data: typing.List[bytes],
-    tag_length: int,
-    ctx: typing.Any = None,
-) -> bytes:
-    if _is_evp_aead_supported_cipher(backend, cipher):
-        return _evp_aead_decrypt(
-            backend, cipher, nonce, data, associated_data, tag_length, ctx
-        )
-    else:
-        return _evp_cipher_decrypt(
-            backend, cipher, nonce, data, associated_data, tag_length, ctx
-        )
-
-
-def _evp_aead_create_ctx(
-    backend: Backend,
-    cipher: _AEADTypes,
-    key: bytes,
-    tag_len: typing.Optional[int] = None,
-):
-    aead_cipher = _evp_aead_get_cipher(backend, cipher)
-    assert aead_cipher is not None
-    key_ptr = backend._ffi.from_buffer(key)
-    tag_len = (
-        backend._lib.EVP_AEAD_DEFAULT_TAG_LENGTH
-        if tag_len is None
-        else tag_len
-    )
-    ctx = backend._lib.Cryptography_EVP_AEAD_CTX_new(
-        aead_cipher, key_ptr, len(key), tag_len
-    )
-    backend.openssl_assert(ctx != backend._ffi.NULL)
-    ctx = backend._ffi.gc(ctx, backend._lib.EVP_AEAD_CTX_free)
-    return ctx
-
-
-def _evp_aead_get_cipher(backend: Backend, cipher: _AEADTypes):
-    from cryptography.hazmat.primitives.ciphers.aead import (
-        ChaCha20Poly1305,
-    )
-
-    # Currently only ChaCha20-Poly1305 is supported using this API
-    assert isinstance(cipher, ChaCha20Poly1305)
-    return backend._lib.EVP_aead_chacha20_poly1305()
-
-
-def _evp_aead_encrypt(
-    backend: Backend,
-    cipher: _AEADTypes,
-    nonce: bytes,
-    data: bytes,
-    associated_data: typing.List[bytes],
-    tag_length: int,
-    ctx: typing.Any,
-) -> bytes:
-    assert ctx is not None
-
-    aead_cipher = _evp_aead_get_cipher(backend, cipher)
-    assert aead_cipher is not None
-
-    out_len = backend._ffi.new("size_t *")
-    # max_out_len should be in_len plus the result of
-    # EVP_AEAD_max_overhead.
-    max_out_len = len(data) + backend._lib.EVP_AEAD_max_overhead(aead_cipher)
-    out_buf = backend._ffi.new("uint8_t[]", max_out_len)
-    data_ptr = backend._ffi.from_buffer(data)
-    nonce_ptr = backend._ffi.from_buffer(nonce)
-    aad = b"".join(associated_data)
-    aad_ptr = backend._ffi.from_buffer(aad)
-
-    res = backend._lib.EVP_AEAD_CTX_seal(
-        ctx,
-        out_buf,
-        out_len,
-        max_out_len,
-        nonce_ptr,
-        len(nonce),
-        data_ptr,
-        len(data),
-        aad_ptr,
-        len(aad),
-    )
-    backend.openssl_assert(res == 1)
-    encrypted_data = backend._ffi.buffer(out_buf, out_len[0])[:]
-    return encrypted_data
-
-
-def _evp_aead_decrypt(
-    backend: Backend,
-    cipher: _AEADTypes,
-    nonce: bytes,
-    data: bytes,
-    associated_data: typing.List[bytes],
-    tag_length: int,
-    ctx: typing.Any,
-) -> bytes:
-    if len(data) < tag_length:
-        raise InvalidTag
-
-    assert ctx is not None
-
-    out_len = backend._ffi.new("size_t *")
-    #  max_out_len should at least in_len
-    max_out_len = len(data)
-    out_buf = backend._ffi.new("uint8_t[]", max_out_len)
-    data_ptr = backend._ffi.from_buffer(data)
-    nonce_ptr = backend._ffi.from_buffer(nonce)
-    aad = b"".join(associated_data)
-    aad_ptr = backend._ffi.from_buffer(aad)
-
-    res = backend._lib.EVP_AEAD_CTX_open(
-        ctx,
-        out_buf,
-        out_len,
-        max_out_len,
-        nonce_ptr,
-        len(nonce),
-        data_ptr,
-        len(data),
-        aad_ptr,
-        len(aad),
-    )
-
-    if res == 0:
-        backend._consume_errors()
-        raise InvalidTag
-
-    decrypted_data = backend._ffi.buffer(out_buf, out_len[0])[:]
-    return decrypted_data
-
-
-_ENCRYPT = 1
-_DECRYPT = 0
-
-
-def _evp_cipher_cipher_name(cipher: _AEADTypes) -> bytes:
-    from cryptography.hazmat.primitives.ciphers.aead import (
-        AESCCM,
-        AESGCM,
-        AESOCB3,
-        AESSIV,
-        ChaCha20Poly1305,
-    )
-
-    if isinstance(cipher, ChaCha20Poly1305):
-        return b"chacha20-poly1305"
-    elif isinstance(cipher, AESCCM):
-        return f"aes-{len(cipher._key) * 8}-ccm".encode("ascii")
-    elif isinstance(cipher, AESOCB3):
-        return f"aes-{len(cipher._key) * 8}-ocb".encode("ascii")
-    elif isinstance(cipher, AESSIV):
-        return f"aes-{len(cipher._key) * 8 // 2}-siv".encode("ascii")
-    else:
-        assert isinstance(cipher, AESGCM)
-        return f"aes-{len(cipher._key) * 8}-gcm".encode("ascii")
-
-
-def _evp_cipher(cipher_name: bytes, backend: Backend):
-    if cipher_name.endswith(b"-siv"):
-        evp_cipher = backend._lib.EVP_CIPHER_fetch(
-            backend._ffi.NULL,
-            cipher_name,
-            backend._ffi.NULL,
-        )
-        backend.openssl_assert(evp_cipher != backend._ffi.NULL)
-        evp_cipher = backend._ffi.gc(evp_cipher, backend._lib.EVP_CIPHER_free)
-    else:
-        evp_cipher = backend._lib.EVP_get_cipherbyname(cipher_name)
-        backend.openssl_assert(evp_cipher != backend._ffi.NULL)
-
-    return evp_cipher
-
-
-def _evp_cipher_create_ctx(
-    backend: Backend,
-    cipher: _AEADTypes,
-    key: bytes,
-):
-    ctx = backend._lib.EVP_CIPHER_CTX_new()
-    backend.openssl_assert(ctx != backend._ffi.NULL)
-    ctx = backend._ffi.gc(ctx, backend._lib.EVP_CIPHER_CTX_free)
-    cipher_name = _evp_cipher_cipher_name(cipher)
-    evp_cipher = _evp_cipher(cipher_name, backend)
-    key_ptr = backend._ffi.from_buffer(key)
-    res = backend._lib.EVP_CipherInit_ex(
-        ctx,
-        evp_cipher,
-        backend._ffi.NULL,
-        key_ptr,
-        backend._ffi.NULL,
-        0,
-    )
-    backend.openssl_assert(res != 0)
-    return ctx
-
-
-def _evp_cipher_aead_setup(
-    backend: Backend,
-    cipher_name: bytes,
-    key: bytes,
-    nonce: bytes,
-    tag: typing.Optional[bytes],
-    tag_len: int,
-    operation: int,
-):
-    evp_cipher = _evp_cipher(cipher_name, backend)
-    ctx = backend._lib.EVP_CIPHER_CTX_new()
-    ctx = backend._ffi.gc(ctx, backend._lib.EVP_CIPHER_CTX_free)
-    res = backend._lib.EVP_CipherInit_ex(
-        ctx,
-        evp_cipher,
-        backend._ffi.NULL,
-        backend._ffi.NULL,
-        backend._ffi.NULL,
-        int(operation == _ENCRYPT),
-    )
-    backend.openssl_assert(res != 0)
-    # CCM requires the IVLEN to be set before calling SET_TAG on decrypt
-    res = backend._lib.EVP_CIPHER_CTX_ctrl(
-        ctx,
-        backend._lib.EVP_CTRL_AEAD_SET_IVLEN,
-        len(nonce),
-        backend._ffi.NULL,
-    )
-    backend.openssl_assert(res != 0)
-    if operation == _DECRYPT:
-        assert tag is not None
-        _evp_cipher_set_tag(backend, ctx, tag)
-    elif cipher_name.endswith(b"-ccm"):
-        res = backend._lib.EVP_CIPHER_CTX_ctrl(
-            ctx,
-            backend._lib.EVP_CTRL_AEAD_SET_TAG,
-            tag_len,
-            backend._ffi.NULL,
-        )
-        backend.openssl_assert(res != 0)
-
-    nonce_ptr = backend._ffi.from_buffer(nonce)
-    key_ptr = backend._ffi.from_buffer(key)
-    res = backend._lib.EVP_CipherInit_ex(
-        ctx,
-        backend._ffi.NULL,
-        backend._ffi.NULL,
-        key_ptr,
-        nonce_ptr,
-        int(operation == _ENCRYPT),
-    )
-    backend.openssl_assert(res != 0)
-    return ctx
-
-
-def _evp_cipher_set_tag(backend, ctx, tag: bytes) -> None:
-    tag_ptr = backend._ffi.from_buffer(tag)
-    res = backend._lib.EVP_CIPHER_CTX_ctrl(
-        ctx, backend._lib.EVP_CTRL_AEAD_SET_TAG, len(tag), tag_ptr
-    )
-    backend.openssl_assert(res != 0)
-
-
-def _evp_cipher_set_nonce_operation(
-    backend, ctx, nonce: bytes, operation: int
-) -> None:
-    nonce_ptr = backend._ffi.from_buffer(nonce)
-    res = backend._lib.EVP_CipherInit_ex(
-        ctx,
-        backend._ffi.NULL,
-        backend._ffi.NULL,
-        backend._ffi.NULL,
-        nonce_ptr,
-        int(operation == _ENCRYPT),
-    )
-    backend.openssl_assert(res != 0)
-
-
-def _evp_cipher_set_length(backend: Backend, ctx, data_len: int) -> None:
-    intptr = backend._ffi.new("int *")
-    res = backend._lib.EVP_CipherUpdate(
-        ctx, backend._ffi.NULL, intptr, backend._ffi.NULL, data_len
-    )
-    backend.openssl_assert(res != 0)
-
-
-def _evp_cipher_process_aad(
-    backend: Backend, ctx, associated_data: bytes
-) -> None:
-    outlen = backend._ffi.new("int *")
-    a_data_ptr = backend._ffi.from_buffer(associated_data)
-    res = backend._lib.EVP_CipherUpdate(
-        ctx, backend._ffi.NULL, outlen, a_data_ptr, len(associated_data)
-    )
-    backend.openssl_assert(res != 0)
-
-
-def _evp_cipher_process_data(backend: Backend, ctx, data: bytes) -> bytes:
-    outlen = backend._ffi.new("int *")
-    buf = backend._ffi.new("unsigned char[]", len(data))
-    data_ptr = backend._ffi.from_buffer(data)
-    res = backend._lib.EVP_CipherUpdate(ctx, buf, outlen, data_ptr, len(data))
-    if res == 0:
-        # AES SIV can error here if the data is invalid on decrypt
-        backend._consume_errors()
-        raise InvalidTag
-    return backend._ffi.buffer(buf, outlen[0])[:]
-
-
-def _evp_cipher_encrypt(
-    backend: Backend,
-    cipher: _AEADTypes,
-    nonce: bytes,
-    data: bytes,
-    associated_data: typing.List[bytes],
-    tag_length: int,
-    ctx: typing.Any = None,
-) -> bytes:
-    from cryptography.hazmat.primitives.ciphers.aead import AESCCM, AESSIV
-
-    if ctx is None:
-        cipher_name = _evp_cipher_cipher_name(cipher)
-        ctx = _evp_cipher_aead_setup(
-            backend,
-            cipher_name,
-            cipher._key,
-            nonce,
-            None,
-            tag_length,
-            _ENCRYPT,
-        )
-    else:
-        _evp_cipher_set_nonce_operation(backend, ctx, nonce, _ENCRYPT)
-
-    # CCM requires us to pass the length of the data before processing
-    # anything.
-    # However calling this with any other AEAD results in an error
-    if isinstance(cipher, AESCCM):
-        _evp_cipher_set_length(backend, ctx, len(data))
-
-    for ad in associated_data:
-        _evp_cipher_process_aad(backend, ctx, ad)
-    processed_data = _evp_cipher_process_data(backend, ctx, data)
-    outlen = backend._ffi.new("int *")
-    # All AEADs we support besides OCB are streaming so they return nothing
-    # in finalization. OCB can return up to (16 byte block - 1) bytes so
-    # we need a buffer here too.
-    buf = backend._ffi.new("unsigned char[]", 16)
-    res = backend._lib.EVP_CipherFinal_ex(ctx, buf, outlen)
-    backend.openssl_assert(res != 0)
-    processed_data += backend._ffi.buffer(buf, outlen[0])[:]
-    tag_buf = backend._ffi.new("unsigned char[]", tag_length)
-    res = backend._lib.EVP_CIPHER_CTX_ctrl(
-        ctx, backend._lib.EVP_CTRL_AEAD_GET_TAG, tag_length, tag_buf
-    )
-    backend.openssl_assert(res != 0)
-    tag = backend._ffi.buffer(tag_buf)[:]
-
-    if isinstance(cipher, AESSIV):
-        # RFC 5297 defines the output as IV || C, where the tag we generate
-        # is the "IV" and C is the ciphertext. This is the opposite of our
-        # other AEADs, which are Ciphertext || Tag
-        backend.openssl_assert(len(tag) == 16)
-        return tag + processed_data
-    else:
-        return processed_data + tag
-
-
-def _evp_cipher_decrypt(
-    backend: Backend,
-    cipher: _AEADTypes,
-    nonce: bytes,
-    data: bytes,
-    associated_data: typing.List[bytes],
-    tag_length: int,
-    ctx: typing.Any = None,
-) -> bytes:
-    from cryptography.hazmat.primitives.ciphers.aead import AESCCM, AESSIV
-
-    if len(data) < tag_length:
-        raise InvalidTag
-
-    if isinstance(cipher, AESSIV):
-        # RFC 5297 defines the output as IV || C, where the tag we generate
-        # is the "IV" and C is the ciphertext. This is the opposite of our
-        # other AEADs, which are Ciphertext || Tag
-        tag = data[:tag_length]
-        data = data[tag_length:]
-    else:
-        tag = data[-tag_length:]
-        data = data[:-tag_length]
-    if ctx is None:
-        cipher_name = _evp_cipher_cipher_name(cipher)
-        ctx = _evp_cipher_aead_setup(
-            backend,
-            cipher_name,
-            cipher._key,
-            nonce,
-            tag,
-            tag_length,
-            _DECRYPT,
-        )
-    else:
-        _evp_cipher_set_nonce_operation(backend, ctx, nonce, _DECRYPT)
-        _evp_cipher_set_tag(backend, ctx, tag)
-
-    # CCM requires us to pass the length of the data before processing
-    # anything.
-    # However calling this with any other AEAD results in an error
-    if isinstance(cipher, AESCCM):
-        _evp_cipher_set_length(backend, ctx, len(data))
-
-    for ad in associated_data:
-        _evp_cipher_process_aad(backend, ctx, ad)
-    # CCM has a different error path if the tag doesn't match. Errors are
-    # raised in Update and Final is irrelevant.
-    if isinstance(cipher, AESCCM):
-        outlen = backend._ffi.new("int *")
-        buf = backend._ffi.new("unsigned char[]", len(data))
-        d_ptr = backend._ffi.from_buffer(data)
-        res = backend._lib.EVP_CipherUpdate(ctx, buf, outlen, d_ptr, len(data))
-        if res != 1:
-            backend._consume_errors()
-            raise InvalidTag
-
-        processed_data = backend._ffi.buffer(buf, outlen[0])[:]
-    else:
-        processed_data = _evp_cipher_process_data(backend, ctx, data)
-        outlen = backend._ffi.new("int *")
-        # OCB can return up to 15 bytes (16 byte block - 1) in finalization
-        buf = backend._ffi.new("unsigned char[]", 16)
-        res = backend._lib.EVP_CipherFinal_ex(ctx, buf, outlen)
-        processed_data += backend._ffi.buffer(buf, outlen[0])[:]
-        if res == 0:
-            backend._consume_errors()
-            raise InvalidTag
-
-    return processed_data

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/backends/openssl/ciphers.py

@@ -1,281 +0,0 @@
-# This file is dual licensed under the terms of the Apache License, Version
-# 2.0, and the BSD License. See the LICENSE file in the root of this repository
-# for complete details.
-
-from __future__ import annotations
-
-import typing
-
-from cryptography.exceptions import InvalidTag, UnsupportedAlgorithm, _Reasons
-from cryptography.hazmat.primitives import ciphers
-from cryptography.hazmat.primitives.ciphers import algorithms, modes
-
-if typing.TYPE_CHECKING:
-    from cryptography.hazmat.backends.openssl.backend import Backend
-
-
-class _CipherContext:
-    _ENCRYPT = 1
-    _DECRYPT = 0
-    _MAX_CHUNK_SIZE = 2**30 - 1
-
-    def __init__(self, backend: Backend, cipher, mode, operation: int) -> None:
-        self._backend = backend
-        self._cipher = cipher
-        self._mode = mode
-        self._operation = operation
-        self._tag: typing.Optional[bytes] = None
-
-        if isinstance(self._cipher, ciphers.BlockCipherAlgorithm):
-            self._block_size_bytes = self._cipher.block_size // 8
-        else:
-            self._block_size_bytes = 1
-
-        ctx = self._backend._lib.EVP_CIPHER_CTX_new()
-        ctx = self._backend._ffi.gc(
-            ctx, self._backend._lib.EVP_CIPHER_CTX_free
-        )
-
-        registry = self._backend._cipher_registry
-        try:
-            adapter = registry[type(cipher), type(mode)]
-        except KeyError:
-            raise UnsupportedAlgorithm(
-                "cipher {} in {} mode is not supported "
-                "by this backend.".format(
-                    cipher.name, mode.name if mode else mode
-                ),
-                _Reasons.UNSUPPORTED_CIPHER,
-            )
-
-        evp_cipher = adapter(self._backend, cipher, mode)
-        if evp_cipher == self._backend._ffi.NULL:
-            msg = f"cipher {cipher.name} "
-            if mode is not None:
-                msg += f"in {mode.name} mode "
-            msg += (
-                "is not supported by this backend (Your version of OpenSSL "
-                "may be too old. Current version: {}.)"
-            ).format(self._backend.openssl_version_text())
-            raise UnsupportedAlgorithm(msg, _Reasons.UNSUPPORTED_CIPHER)
-
-        if isinstance(mode, modes.ModeWithInitializationVector):
-            iv_nonce = self._backend._ffi.from_buffer(
-                mode.initialization_vector
-            )
-        elif isinstance(mode, modes.ModeWithTweak):
-            iv_nonce = self._backend._ffi.from_buffer(mode.tweak)
-        elif isinstance(mode, modes.ModeWithNonce):
-            iv_nonce = self._backend._ffi.from_buffer(mode.nonce)
-        elif isinstance(cipher, algorithms.ChaCha20):
-            iv_nonce = self._backend._ffi.from_buffer(cipher.nonce)
-        else:
-            iv_nonce = self._backend._ffi.NULL
-        # begin init with cipher and operation type
-        res = self._backend._lib.EVP_CipherInit_ex(
-            ctx,
-            evp_cipher,
-            self._backend._ffi.NULL,
-            self._backend._ffi.NULL,
-            self._backend._ffi.NULL,
-            operation,
-        )
-        self._backend.openssl_assert(res != 0)
-        # set the key length to handle variable key ciphers
-        res = self._backend._lib.EVP_CIPHER_CTX_set_key_length(
-            ctx, len(cipher.key)
-        )
-        self._backend.openssl_assert(res != 0)
-        if isinstance(mode, modes.GCM):
-            res = self._backend._lib.EVP_CIPHER_CTX_ctrl(
-                ctx,
-                self._backend._lib.EVP_CTRL_AEAD_SET_IVLEN,
-                len(iv_nonce),
-                self._backend._ffi.NULL,
-            )
-            self._backend.openssl_assert(res != 0)
-            if mode.tag is not None:
-                res = self._backend._lib.EVP_CIPHER_CTX_ctrl(
-                    ctx,
-                    self._backend._lib.EVP_CTRL_AEAD_SET_TAG,
-                    len(mode.tag),
-                    mode.tag,
-                )
-                self._backend.openssl_assert(res != 0)
-                self._tag = mode.tag
-
-        # pass key/iv
-        res = self._backend._lib.EVP_CipherInit_ex(
-            ctx,
-            self._backend._ffi.NULL,
-            self._backend._ffi.NULL,
-            self._backend._ffi.from_buffer(cipher.key),
-            iv_nonce,
-            operation,
-        )
-
-        # Check for XTS mode duplicate keys error
-        errors = self._backend._consume_errors()
-        lib = self._backend._lib
-        if res == 0 and (
-            (
-                not lib.CRYPTOGRAPHY_IS_LIBRESSL
-                and errors[0]._lib_reason_match(
-                    lib.ERR_LIB_EVP, lib.EVP_R_XTS_DUPLICATED_KEYS
-                )
-            )
-            or (
-                lib.Cryptography_HAS_PROVIDERS
-                and errors[0]._lib_reason_match(
-                    lib.ERR_LIB_PROV, lib.PROV_R_XTS_DUPLICATED_KEYS
-                )
-            )
-        ):
-            raise ValueError("In XTS mode duplicated keys are not allowed")
-
-        self._backend.openssl_assert(res != 0, errors=errors)
-
-        # We purposely disable padding here as it's handled higher up in the
-        # API.
-        self._backend._lib.EVP_CIPHER_CTX_set_padding(ctx, 0)
-        self._ctx = ctx
-
-    def update(self, data: bytes) -> bytes:
-        buf = bytearray(len(data) + self._block_size_bytes - 1)
-        n = self.update_into(data, buf)
-        return bytes(buf[:n])
-
-    def update_into(self, data: bytes, buf: bytes) -> int:
-        total_data_len = len(data)
-        if len(buf) < (total_data_len + self._block_size_bytes - 1):
-            raise ValueError(
-                "buffer must be at least {} bytes for this "
-                "payload".format(len(data) + self._block_size_bytes - 1)
-            )
-
-        data_processed = 0
-        total_out = 0
-        outlen = self._backend._ffi.new("int *")
-        baseoutbuf = self._backend._ffi.from_buffer(buf, require_writable=True)
-        baseinbuf = self._backend._ffi.from_buffer(data)
-
-        while data_processed != total_data_len:
-            outbuf = baseoutbuf + total_out
-            inbuf = baseinbuf + data_processed
-            inlen = min(self._MAX_CHUNK_SIZE, total_data_len - data_processed)
-
-            res = self._backend._lib.EVP_CipherUpdate(
-                self._ctx, outbuf, outlen, inbuf, inlen
-            )
-            if res == 0 and isinstance(self._mode, modes.XTS):
-                self._backend._consume_errors()
-                raise ValueError(
-                    "In XTS mode you must supply at least a full block in the "
-                    "first update call. For AES this is 16 bytes."
-                )
-            else:
-                self._backend.openssl_assert(res != 0)
-            data_processed += inlen
-            total_out += outlen[0]
-
-        return total_out
-
-    def finalize(self) -> bytes:
-        if (
-            self._operation == self._DECRYPT
-            and isinstance(self._mode, modes.ModeWithAuthenticationTag)
-            and self.tag is None
-        ):
-            raise ValueError(
-                "Authentication tag must be provided when decrypting."
-            )
-
-        buf = self._backend._ffi.new("unsigned char[]", self._block_size_bytes)
-        outlen = self._backend._ffi.new("int *")
-        res = self._backend._lib.EVP_CipherFinal_ex(self._ctx, buf, outlen)
-        if res == 0:
-            errors = self._backend._consume_errors()
-
-            if not errors and isinstance(self._mode, modes.GCM):
-                raise InvalidTag
-
-            lib = self._backend._lib
-            self._backend.openssl_assert(
-                errors[0]._lib_reason_match(
-                    lib.ERR_LIB_EVP,
-                    lib.EVP_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH,
-                )
-                or (
-                    lib.Cryptography_HAS_PROVIDERS
-                    and errors[0]._lib_reason_match(
-                        lib.ERR_LIB_PROV,
-                        lib.PROV_R_WRONG_FINAL_BLOCK_LENGTH,
-                    )
-                )
-                or (
-                    lib.CRYPTOGRAPHY_IS_BORINGSSL
-                    and errors[0].reason
-                    == lib.CIPHER_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH
-                ),
-                errors=errors,
-            )
-            raise ValueError(
-                "The length of the provided data is not a multiple of "
-                "the block length."
-            )
-
-        if (
-            isinstance(self._mode, modes.GCM)
-            and self._operation == self._ENCRYPT
-        ):
-            tag_buf = self._backend._ffi.new(
-                "unsigned char[]", self._block_size_bytes
-            )
-            res = self._backend._lib.EVP_CIPHER_CTX_ctrl(
-                self._ctx,
-                self._backend._lib.EVP_CTRL_AEAD_GET_TAG,
-                self._block_size_bytes,
-                tag_buf,
-            )
-            self._backend.openssl_assert(res != 0)
-            self._tag = self._backend._ffi.buffer(tag_buf)[:]
-
-        res = self._backend._lib.EVP_CIPHER_CTX_reset(self._ctx)
-        self._backend.openssl_assert(res == 1)
-        return self._backend._ffi.buffer(buf)[: outlen[0]]
-
-    def finalize_with_tag(self, tag: bytes) -> bytes:
-        tag_len = len(tag)
-        if tag_len < self._mode._min_tag_length:
-            raise ValueError(
-                "Authentication tag must be {} bytes or longer.".format(
-                    self._mode._min_tag_length
-                )
-            )
-        elif tag_len > self._block_size_bytes:
-            raise ValueError(
-                "Authentication tag cannot be more than {} bytes.".format(
-                    self._block_size_bytes
-                )
-            )
-        res = self._backend._lib.EVP_CIPHER_CTX_ctrl(
-            self._ctx, self._backend._lib.EVP_CTRL_AEAD_SET_TAG, len(tag), tag
-        )
-        self._backend.openssl_assert(res != 0)
-        self._tag = tag
-        return self.finalize()
-
-    def authenticate_additional_data(self, data: bytes) -> None:
-        outlen = self._backend._ffi.new("int *")
-        res = self._backend._lib.EVP_CipherUpdate(
-            self._ctx,
-            self._backend._ffi.NULL,
-            outlen,
-            self._backend._ffi.from_buffer(data),
-            len(data),
-        )
-        self._backend.openssl_assert(res != 0)
-
-    @property
-    def tag(self) -> typing.Optional[bytes]:
-        return self._tag

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/backends/openssl/cmac.py

@@ -1,89 +0,0 @@
-# This file is dual licensed under the terms of the Apache License, Version
-# 2.0, and the BSD License. See the LICENSE file in the root of this repository
-# for complete details.
-
-from __future__ import annotations
-
-import typing
-
-from cryptography.exceptions import (
-    InvalidSignature,
-    UnsupportedAlgorithm,
-    _Reasons,
-)
-from cryptography.hazmat.primitives import constant_time
-from cryptography.hazmat.primitives.ciphers.modes import CBC
-
-if typing.TYPE_CHECKING:
-    from cryptography.hazmat.backends.openssl.backend import Backend
-    from cryptography.hazmat.primitives import ciphers
-
-
-class _CMACContext:
-    def __init__(
-        self,
-        backend: Backend,
-        algorithm: ciphers.BlockCipherAlgorithm,
-        ctx=None,
-    ) -> None:
-        if not backend.cmac_algorithm_supported(algorithm):
-            raise UnsupportedAlgorithm(
-                "This backend does not support CMAC.",
-                _Reasons.UNSUPPORTED_CIPHER,
-            )
-
-        self._backend = backend
-        self._key = algorithm.key
-        self._algorithm = algorithm
-        self._output_length = algorithm.block_size // 8
-
-        if ctx is None:
-            registry = self._backend._cipher_registry
-            adapter = registry[type(algorithm), CBC]
-
-            evp_cipher = adapter(self._backend, algorithm, CBC)
-
-            ctx = self._backend._lib.CMAC_CTX_new()
-
-            self._backend.openssl_assert(ctx != self._backend._ffi.NULL)
-            ctx = self._backend._ffi.gc(ctx, self._backend._lib.CMAC_CTX_free)
-
-            key_ptr = self._backend._ffi.from_buffer(self._key)
-            res = self._backend._lib.CMAC_Init(
-                ctx,
-                key_ptr,
-                len(self._key),
-                evp_cipher,
-                self._backend._ffi.NULL,
-            )
-            self._backend.openssl_assert(res == 1)
-
-        self._ctx = ctx
-
-    def update(self, data: bytes) -> None:
-        res = self._backend._lib.CMAC_Update(self._ctx, data, len(data))
-        self._backend.openssl_assert(res == 1)
-
-    def finalize(self) -> bytes:
-        buf = self._backend._ffi.new("unsigned char[]", self._output_length)
-        length = self._backend._ffi.new("size_t *", self._output_length)
-        res = self._backend._lib.CMAC_Final(self._ctx, buf, length)
-        self._backend.openssl_assert(res == 1)
-
-        self._ctx = None
-
-        return self._backend._ffi.buffer(buf)[:]
-
-    def copy(self) -> _CMACContext:
-        copied_ctx = self._backend._lib.CMAC_CTX_new()
-        copied_ctx = self._backend._ffi.gc(
-            copied_ctx, self._backend._lib.CMAC_CTX_free
-        )
-        res = self._backend._lib.CMAC_CTX_copy(copied_ctx, self._ctx)
-        self._backend.openssl_assert(res == 1)
-        return _CMACContext(self._backend, self._algorithm, ctx=copied_ctx)
-
-    def verify(self, signature: bytes) -> None:
-        digest = self.finalize()
-        if not constant_time.bytes_eq(digest, signature):
-            raise InvalidSignature("Signature did not match digest.")

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/backends/openssl/decode_asn1.py

@@ -1,32 +0,0 @@
-# This file is dual licensed under the terms of the Apache License, Version
-# 2.0, and the BSD License. See the LICENSE file in the root of this repository
-# for complete details.
-
-from __future__ import annotations
-
-from cryptography import x509
-
-#    CRLReason ::= ENUMERATED {
-#        unspecified             (0),
-#        keyCompromise           (1),
-#        cACompromise            (2),
-#        affiliationChanged      (3),
-#        superseded              (4),
-#        cessationOfOperation    (5),
-#        certificateHold         (6),
-#             -- value 7 is not used
-#        removeFromCRL           (8),
-#        privilegeWithdrawn      (9),
-#        aACompromise           (10) }
-_CRL_ENTRY_REASON_ENUM_TO_CODE = {
-    x509.ReasonFlags.unspecified: 0,
-    x509.ReasonFlags.key_compromise: 1,
-    x509.ReasonFlags.ca_compromise: 2,
-    x509.ReasonFlags.affiliation_changed: 3,
-    x509.ReasonFlags.superseded: 4,
-    x509.ReasonFlags.cessation_of_operation: 5,
-    x509.ReasonFlags.certificate_hold: 6,
-    x509.ReasonFlags.remove_from_crl: 8,
-    x509.ReasonFlags.privilege_withdrawn: 9,
-    x509.ReasonFlags.aa_compromise: 10,
-}

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/backends/openssl/ec.py

@@ -1,328 +0,0 @@
-# This file is dual licensed under the terms of the Apache License, Version
-# 2.0, and the BSD License. See the LICENSE file in the root of this repository
-# for complete details.
-
-from __future__ import annotations
-
-import typing
-
-from cryptography.exceptions import (
-    InvalidSignature,
-    UnsupportedAlgorithm,
-    _Reasons,
-)
-from cryptography.hazmat.backends.openssl.utils import (
-    _calculate_digest_and_algorithm,
-    _evp_pkey_derive,
-)
-from cryptography.hazmat.primitives import serialization
-from cryptography.hazmat.primitives.asymmetric import ec
-
-if typing.TYPE_CHECKING:
-    from cryptography.hazmat.backends.openssl.backend import Backend
-
-
-def _check_signature_algorithm(
-    signature_algorithm: ec.EllipticCurveSignatureAlgorithm,
-) -> None:
-    if not isinstance(signature_algorithm, ec.ECDSA):
-        raise UnsupportedAlgorithm(
-            "Unsupported elliptic curve signature algorithm.",
-            _Reasons.UNSUPPORTED_PUBLIC_KEY_ALGORITHM,
-        )
-
-
-def _ec_key_curve_sn(backend: Backend, ec_key) -> str:
-    group = backend._lib.EC_KEY_get0_group(ec_key)
-    backend.openssl_assert(group != backend._ffi.NULL)
-
-    nid = backend._lib.EC_GROUP_get_curve_name(group)
-    # The following check is to find EC keys with unnamed curves and raise
-    # an error for now.
-    if nid == backend._lib.NID_undef:
-        raise ValueError(
-            "ECDSA keys with explicit parameters are unsupported at this time"
-        )
-
-    # This is like the above check, but it also catches the case where you
-    # explicitly encoded a curve with the same parameters as a named curve.
-    # Don't do that.
-    if (
-        not backend._lib.CRYPTOGRAPHY_IS_LIBRESSL
-        and backend._lib.EC_GROUP_get_asn1_flag(group) == 0
-    ):
-        raise ValueError(
-            "ECDSA keys with explicit parameters are unsupported at this time"
-        )
-
-    curve_name = backend._lib.OBJ_nid2sn(nid)
-    backend.openssl_assert(curve_name != backend._ffi.NULL)
-
-    sn = backend._ffi.string(curve_name).decode("ascii")
-    return sn
-
-
-def _mark_asn1_named_ec_curve(backend: Backend, ec_cdata):
-    """
-    Set the named curve flag on the EC_KEY. This causes OpenSSL to
-    serialize EC keys along with their curve OID which makes
-    deserialization easier.
-    """
-
-    backend._lib.EC_KEY_set_asn1_flag(
-        ec_cdata, backend._lib.OPENSSL_EC_NAMED_CURVE
-    )
-
-
-def _check_key_infinity(backend: Backend, ec_cdata) -> None:
-    point = backend._lib.EC_KEY_get0_public_key(ec_cdata)
-    backend.openssl_assert(point != backend._ffi.NULL)
-    group = backend._lib.EC_KEY_get0_group(ec_cdata)
-    backend.openssl_assert(group != backend._ffi.NULL)
-    if backend._lib.EC_POINT_is_at_infinity(group, point):
-        raise ValueError(
-            "Cannot load an EC public key where the point is at infinity"
-        )
-
-
-def _sn_to_elliptic_curve(backend: Backend, sn: str) -> ec.EllipticCurve:
-    try:
-        return ec._CURVE_TYPES[sn]()
-    except KeyError:
-        raise UnsupportedAlgorithm(
-            f"{sn} is not a supported elliptic curve",
-            _Reasons.UNSUPPORTED_ELLIPTIC_CURVE,
-        )
-
-
-def _ecdsa_sig_sign(
-    backend: Backend, private_key: _EllipticCurvePrivateKey, data: bytes
-) -> bytes:
-    max_size = backend._lib.ECDSA_size(private_key._ec_key)
-    backend.openssl_assert(max_size > 0)
-
-    sigbuf = backend._ffi.new("unsigned char[]", max_size)
-    siglen_ptr = backend._ffi.new("unsigned int[]", 1)
-    res = backend._lib.ECDSA_sign(
-        0, data, len(data), sigbuf, siglen_ptr, private_key._ec_key
-    )
-    backend.openssl_assert(res == 1)
-    return backend._ffi.buffer(sigbuf)[: siglen_ptr[0]]
-
-
-def _ecdsa_sig_verify(
-    backend: Backend,
-    public_key: _EllipticCurvePublicKey,
-    signature: bytes,
-    data: bytes,
-) -> None:
-    res = backend._lib.ECDSA_verify(
-        0, data, len(data), signature, len(signature), public_key._ec_key
-    )
-    if res != 1:
-        backend._consume_errors()
-        raise InvalidSignature
-
-
-class _EllipticCurvePrivateKey(ec.EllipticCurvePrivateKey):
-    def __init__(self, backend: Backend, ec_key_cdata, evp_pkey):
-        self._backend = backend
-        self._ec_key = ec_key_cdata
-        self._evp_pkey = evp_pkey
-
-        sn = _ec_key_curve_sn(backend, ec_key_cdata)
-        self._curve = _sn_to_elliptic_curve(backend, sn)
-        _mark_asn1_named_ec_curve(backend, ec_key_cdata)
-        _check_key_infinity(backend, ec_key_cdata)
-
-    @property
-    def curve(self) -> ec.EllipticCurve:
-        return self._curve
-
-    @property
-    def key_size(self) -> int:
-        return self.curve.key_size
-
-    def exchange(
-        self, algorithm: ec.ECDH, peer_public_key: ec.EllipticCurvePublicKey
-    ) -> bytes:
-        if not (
-            self._backend.elliptic_curve_exchange_algorithm_supported(
-                algorithm, self.curve
-            )
-        ):
-            raise UnsupportedAlgorithm(
-                "This backend does not support the ECDH algorithm.",
-                _Reasons.UNSUPPORTED_EXCHANGE_ALGORITHM,
-            )
-
-        if peer_public_key.curve.name != self.curve.name:
-            raise ValueError(
-                "peer_public_key and self are not on the same curve"
-            )
-
-        return _evp_pkey_derive(self._backend, self._evp_pkey, peer_public_key)
-
-    def public_key(self) -> ec.EllipticCurvePublicKey:
-        group = self._backend._lib.EC_KEY_get0_group(self._ec_key)
-        self._backend.openssl_assert(group != self._backend._ffi.NULL)
-
-        curve_nid = self._backend._lib.EC_GROUP_get_curve_name(group)
-        public_ec_key = self._backend._ec_key_new_by_curve_nid(curve_nid)
-
-        point = self._backend._lib.EC_KEY_get0_public_key(self._ec_key)
-        self._backend.openssl_assert(point != self._backend._ffi.NULL)
-
-        res = self._backend._lib.EC_KEY_set_public_key(public_ec_key, point)
-        self._backend.openssl_assert(res == 1)
-
-        evp_pkey = self._backend._ec_cdata_to_evp_pkey(public_ec_key)
-
-        return _EllipticCurvePublicKey(self._backend, public_ec_key, evp_pkey)
-
-    def private_numbers(self) -> ec.EllipticCurvePrivateNumbers:
-        bn = self._backend._lib.EC_KEY_get0_private_key(self._ec_key)
-        private_value = self._backend._bn_to_int(bn)
-        return ec.EllipticCurvePrivateNumbers(
-            private_value=private_value,
-            public_numbers=self.public_key().public_numbers(),
-        )
-
-    def private_bytes(
-        self,
-        encoding: serialization.Encoding,
-        format: serialization.PrivateFormat,
-        encryption_algorithm: serialization.KeySerializationEncryption,
-    ) -> bytes:
-        return self._backend._private_key_bytes(
-            encoding,
-            format,
-            encryption_algorithm,
-            self,
-            self._evp_pkey,
-            self._ec_key,
-        )
-
-    def sign(
-        self,
-        data: bytes,
-        signature_algorithm: ec.EllipticCurveSignatureAlgorithm,
-    ) -> bytes:
-        _check_signature_algorithm(signature_algorithm)
-        data, _ = _calculate_digest_and_algorithm(
-            data,
-            signature_algorithm.algorithm,
-        )
-        return _ecdsa_sig_sign(self._backend, self, data)
-
-
-class _EllipticCurvePublicKey(ec.EllipticCurvePublicKey):
-    def __init__(self, backend: Backend, ec_key_cdata, evp_pkey):
-        self._backend = backend
-        self._ec_key = ec_key_cdata
-        self._evp_pkey = evp_pkey
-
-        sn = _ec_key_curve_sn(backend, ec_key_cdata)
-        self._curve = _sn_to_elliptic_curve(backend, sn)
-        _mark_asn1_named_ec_curve(backend, ec_key_cdata)
-        _check_key_infinity(backend, ec_key_cdata)
-
-    @property
-    def curve(self) -> ec.EllipticCurve:
-        return self._curve
-
-    @property
-    def key_size(self) -> int:
-        return self.curve.key_size
-
-    def __eq__(self, other: object) -> bool:
-        if not isinstance(other, _EllipticCurvePublicKey):
-            return NotImplemented
-
-        return (
-            self._backend._lib.EVP_PKEY_cmp(self._evp_pkey, other._evp_pkey)
-            == 1
-        )
-
-    def public_numbers(self) -> ec.EllipticCurvePublicNumbers:
-        group = self._backend._lib.EC_KEY_get0_group(self._ec_key)
-        self._backend.openssl_assert(group != self._backend._ffi.NULL)
-
-        point = self._backend._lib.EC_KEY_get0_public_key(self._ec_key)
-        self._backend.openssl_assert(point != self._backend._ffi.NULL)
-
-        with self._backend._tmp_bn_ctx() as bn_ctx:
-            bn_x = self._backend._lib.BN_CTX_get(bn_ctx)
-            bn_y = self._backend._lib.BN_CTX_get(bn_ctx)
-
-            res = self._backend._lib.EC_POINT_get_affine_coordinates(
-                group, point, bn_x, bn_y, bn_ctx
-            )
-            self._backend.openssl_assert(res == 1)
-
-            x = self._backend._bn_to_int(bn_x)
-            y = self._backend._bn_to_int(bn_y)
-
-        return ec.EllipticCurvePublicNumbers(x=x, y=y, curve=self._curve)
-
-    def _encode_point(self, format: serialization.PublicFormat) -> bytes:
-        if format is serialization.PublicFormat.CompressedPoint:
-            conversion = self._backend._lib.POINT_CONVERSION_COMPRESSED
-        else:
-            assert format is serialization.PublicFormat.UncompressedPoint
-            conversion = self._backend._lib.POINT_CONVERSION_UNCOMPRESSED
-
-        group = self._backend._lib.EC_KEY_get0_group(self._ec_key)
-        self._backend.openssl_assert(group != self._backend._ffi.NULL)
-        point = self._backend._lib.EC_KEY_get0_public_key(self._ec_key)
-        self._backend.openssl_assert(point != self._backend._ffi.NULL)
-        with self._backend._tmp_bn_ctx() as bn_ctx:
-            buflen = self._backend._lib.EC_POINT_point2oct(
-                group, point, conversion, self._backend._ffi.NULL, 0, bn_ctx
-            )
-            self._backend.openssl_assert(buflen > 0)
-            buf = self._backend._ffi.new("char[]", buflen)
-            res = self._backend._lib.EC_POINT_point2oct(
-                group, point, conversion, buf, buflen, bn_ctx
-            )
-            self._backend.openssl_assert(buflen == res)
-
-        return self._backend._ffi.buffer(buf)[:]
-
-    def public_bytes(
-        self,
-        encoding: serialization.Encoding,
-        format: serialization.PublicFormat,
-    ) -> bytes:
-        if (
-            encoding is serialization.Encoding.X962
-            or format is serialization.PublicFormat.CompressedPoint
-            or format is serialization.PublicFormat.UncompressedPoint
-        ):
-            if encoding is not serialization.Encoding.X962 or format not in (
-                serialization.PublicFormat.CompressedPoint,
-                serialization.PublicFormat.UncompressedPoint,
-            ):
-                raise ValueError(
-                    "X962 encoding must be used with CompressedPoint or "
-                    "UncompressedPoint format"
-                )
-
-            return self._encode_point(format)
-        else:
-            return self._backend._public_key_bytes(
-                encoding, format, self, self._evp_pkey, None
-            )
-
-    def verify(
-        self,
-        signature: bytes,
-        data: bytes,
-        signature_algorithm: ec.EllipticCurveSignatureAlgorithm,
-    ) -> None:
-        _check_signature_algorithm(signature_algorithm)
-        data, _ = _calculate_digest_and_algorithm(
-            data,
-            signature_algorithm.algorithm,
-        )
-        _ecdsa_sig_verify(self._backend, self, signature, data)

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/backends/openssl/rsa.py

@@ -1,599 +0,0 @@
-# This file is dual licensed under the terms of the Apache License, Version
-# 2.0, and the BSD License. See the LICENSE file in the root of this repository
-# for complete details.
-
-from __future__ import annotations
-
-import threading
-import typing
-
-from cryptography.exceptions import (
-    InvalidSignature,
-    UnsupportedAlgorithm,
-    _Reasons,
-)
-from cryptography.hazmat.backends.openssl.utils import (
-    _calculate_digest_and_algorithm,
-)
-from cryptography.hazmat.primitives import hashes, serialization
-from cryptography.hazmat.primitives.asymmetric import utils as asym_utils
-from cryptography.hazmat.primitives.asymmetric.padding import (
-    MGF1,
-    OAEP,
-    PSS,
-    AsymmetricPadding,
-    PKCS1v15,
-    _Auto,
-    _DigestLength,
-    _MaxLength,
-    calculate_max_pss_salt_length,
-)
-from cryptography.hazmat.primitives.asymmetric.rsa import (
-    RSAPrivateKey,
-    RSAPrivateNumbers,
-    RSAPublicKey,
-    RSAPublicNumbers,
-)
-
-if typing.TYPE_CHECKING:
-    from cryptography.hazmat.backends.openssl.backend import Backend
-
-
-def _get_rsa_pss_salt_length(
-    backend: Backend,
-    pss: PSS,
-    key: typing.Union[RSAPrivateKey, RSAPublicKey],
-    hash_algorithm: hashes.HashAlgorithm,
-) -> int:
-    salt = pss._salt_length
-
-    if isinstance(salt, _MaxLength):
-        return calculate_max_pss_salt_length(key, hash_algorithm)
-    elif isinstance(salt, _DigestLength):
-        return hash_algorithm.digest_size
-    elif isinstance(salt, _Auto):
-        if isinstance(key, RSAPrivateKey):
-            raise ValueError(
-                "PSS salt length can only be set to AUTO when verifying"
-            )
-        return backend._lib.RSA_PSS_SALTLEN_AUTO
-    else:
-        return salt
-
-
-def _enc_dec_rsa(
-    backend: Backend,
-    key: typing.Union[_RSAPrivateKey, _RSAPublicKey],
-    data: bytes,
-    padding: AsymmetricPadding,
-) -> bytes:
-    if not isinstance(padding, AsymmetricPadding):
-        raise TypeError("Padding must be an instance of AsymmetricPadding.")
-
-    if isinstance(padding, PKCS1v15):
-        padding_enum = backend._lib.RSA_PKCS1_PADDING
-    elif isinstance(padding, OAEP):
-        padding_enum = backend._lib.RSA_PKCS1_OAEP_PADDING
-
-        if not isinstance(padding._mgf, MGF1):
-            raise UnsupportedAlgorithm(
-                "Only MGF1 is supported by this backend.",
-                _Reasons.UNSUPPORTED_MGF,
-            )
-
-        if not backend.rsa_padding_supported(padding):
-            raise UnsupportedAlgorithm(
-                "This combination of padding and hash algorithm is not "
-                "supported by this backend.",
-                _Reasons.UNSUPPORTED_PADDING,
-            )
-
-    else:
-        raise UnsupportedAlgorithm(
-            f"{padding.name} is not supported by this backend.",
-            _Reasons.UNSUPPORTED_PADDING,
-        )
-
-    return _enc_dec_rsa_pkey_ctx(backend, key, data, padding_enum, padding)
-
-
-def _enc_dec_rsa_pkey_ctx(
-    backend: Backend,
-    key: typing.Union[_RSAPrivateKey, _RSAPublicKey],
-    data: bytes,
-    padding_enum: int,
-    padding: AsymmetricPadding,
-) -> bytes:
-    init: typing.Callable[[typing.Any], int]
-    crypt: typing.Callable[[typing.Any, typing.Any, int, bytes, int], int]
-    if isinstance(key, _RSAPublicKey):
-        init = backend._lib.EVP_PKEY_encrypt_init
-        crypt = backend._lib.EVP_PKEY_encrypt
-    else:
-        init = backend._lib.EVP_PKEY_decrypt_init
-        crypt = backend._lib.EVP_PKEY_decrypt
-
-    pkey_ctx = backend._lib.EVP_PKEY_CTX_new(key._evp_pkey, backend._ffi.NULL)
-    backend.openssl_assert(pkey_ctx != backend._ffi.NULL)
-    pkey_ctx = backend._ffi.gc(pkey_ctx, backend._lib.EVP_PKEY_CTX_free)
-    res = init(pkey_ctx)
-    backend.openssl_assert(res == 1)
-    res = backend._lib.EVP_PKEY_CTX_set_rsa_padding(pkey_ctx, padding_enum)
-    backend.openssl_assert(res > 0)
-    buf_size = backend._lib.EVP_PKEY_size(key._evp_pkey)
-    backend.openssl_assert(buf_size > 0)
-    if isinstance(padding, OAEP):
-        mgf1_md = backend._evp_md_non_null_from_algorithm(
-            padding._mgf._algorithm
-        )
-        res = backend._lib.EVP_PKEY_CTX_set_rsa_mgf1_md(pkey_ctx, mgf1_md)
-        backend.openssl_assert(res > 0)
-        oaep_md = backend._evp_md_non_null_from_algorithm(padding._algorithm)
-        res = backend._lib.EVP_PKEY_CTX_set_rsa_oaep_md(pkey_ctx, oaep_md)
-        backend.openssl_assert(res > 0)
-
-    if (
-        isinstance(padding, OAEP)
-        and padding._label is not None
-        and len(padding._label) > 0
-    ):
-        # set0_rsa_oaep_label takes ownership of the char * so we need to
-        # copy it into some new memory
-        labelptr = backend._lib.OPENSSL_malloc(len(padding._label))
-        backend.openssl_assert(labelptr != backend._ffi.NULL)
-        backend._ffi.memmove(labelptr, padding._label, len(padding._label))
-        res = backend._lib.EVP_PKEY_CTX_set0_rsa_oaep_label(
-            pkey_ctx, labelptr, len(padding._label)
-        )
-        backend.openssl_assert(res == 1)
-
-    outlen = backend._ffi.new("size_t *", buf_size)
-    buf = backend._ffi.new("unsigned char[]", buf_size)
-    # Everything from this line onwards is written with the goal of being as
-    # constant-time as is practical given the constraints of Python and our
-    # API. See Bleichenbacher's '98 attack on RSA, and its many many variants.
-    # As such, you should not attempt to change this (particularly to "clean it
-    # up") without understanding why it was written this way (see
-    # Chesterton's Fence), and without measuring to verify you have not
-    # introduced observable time differences.
-    res = crypt(pkey_ctx, buf, outlen, data, len(data))
-    resbuf = backend._ffi.buffer(buf)[: outlen[0]]
-    backend._lib.ERR_clear_error()
-    if res <= 0:
-        raise ValueError("Encryption/decryption failed.")
-    return resbuf
-
-
-def _rsa_sig_determine_padding(
-    backend: Backend,
-    key: typing.Union[_RSAPrivateKey, _RSAPublicKey],
-    padding: AsymmetricPadding,
-    algorithm: typing.Optional[hashes.HashAlgorithm],
-) -> int:
-    if not isinstance(padding, AsymmetricPadding):
-        raise TypeError("Expected provider of AsymmetricPadding.")
-
-    pkey_size = backend._lib.EVP_PKEY_size(key._evp_pkey)
-    backend.openssl_assert(pkey_size > 0)
-
-    if isinstance(padding, PKCS1v15):
-        # Hash algorithm is ignored for PKCS1v15-padding, may be None.
-        padding_enum = backend._lib.RSA_PKCS1_PADDING
-    elif isinstance(padding, PSS):
-        if not isinstance(padding._mgf, MGF1):
-            raise UnsupportedAlgorithm(
-                "Only MGF1 is supported by this backend.",
-                _Reasons.UNSUPPORTED_MGF,
-            )
-
-        # PSS padding requires a hash algorithm
-        if not isinstance(algorithm, hashes.HashAlgorithm):
-            raise TypeError("Expected instance of hashes.HashAlgorithm.")
-
-        # Size of key in bytes - 2 is the maximum
-        # PSS signature length (salt length is checked later)
-        if pkey_size - algorithm.digest_size - 2 < 0:
-            raise ValueError(
-                "Digest too large for key size. Use a larger "
-                "key or different digest."
-            )
-
-        padding_enum = backend._lib.RSA_PKCS1_PSS_PADDING
-    else:
-        raise UnsupportedAlgorithm(
-            f"{padding.name} is not supported by this backend.",
-            _Reasons.UNSUPPORTED_PADDING,
-        )
-
-    return padding_enum
-
-
-# Hash algorithm can be absent (None) to initialize the context without setting
-# any message digest algorithm. This is currently only valid for the PKCS1v15
-# padding type, where it means that the signature data is encoded/decoded
-# as provided, without being wrapped in a DigestInfo structure.
-def _rsa_sig_setup(
-    backend: Backend,
-    padding: AsymmetricPadding,
-    algorithm: typing.Optional[hashes.HashAlgorithm],
-    key: typing.Union[_RSAPublicKey, _RSAPrivateKey],
-    init_func: typing.Callable[[typing.Any], int],
-):
-    padding_enum = _rsa_sig_determine_padding(backend, key, padding, algorithm)
-    pkey_ctx = backend._lib.EVP_PKEY_CTX_new(key._evp_pkey, backend._ffi.NULL)
-    backend.openssl_assert(pkey_ctx != backend._ffi.NULL)
-    pkey_ctx = backend._ffi.gc(pkey_ctx, backend._lib.EVP_PKEY_CTX_free)
-    res = init_func(pkey_ctx)
-    if res != 1:
-        errors = backend._consume_errors()
-        raise ValueError("Unable to sign/verify with this key", errors)
-
-    if algorithm is not None:
-        evp_md = backend._evp_md_non_null_from_algorithm(algorithm)
-        res = backend._lib.EVP_PKEY_CTX_set_signature_md(pkey_ctx, evp_md)
-        if res <= 0:
-            backend._consume_errors()
-            raise UnsupportedAlgorithm(
-                "{} is not supported by this backend for RSA signing.".format(
-                    algorithm.name
-                ),
-                _Reasons.UNSUPPORTED_HASH,
-            )
-    res = backend._lib.EVP_PKEY_CTX_set_rsa_padding(pkey_ctx, padding_enum)
-    if res <= 0:
-        backend._consume_errors()
-        raise UnsupportedAlgorithm(
-            "{} is not supported for the RSA signature operation.".format(
-                padding.name
-            ),
-            _Reasons.UNSUPPORTED_PADDING,
-        )
-    if isinstance(padding, PSS):
-        assert isinstance(algorithm, hashes.HashAlgorithm)
-        res = backend._lib.EVP_PKEY_CTX_set_rsa_pss_saltlen(
-            pkey_ctx,
-            _get_rsa_pss_salt_length(backend, padding, key, algorithm),
-        )
-        backend.openssl_assert(res > 0)
-
-        mgf1_md = backend._evp_md_non_null_from_algorithm(
-            padding._mgf._algorithm
-        )
-        res = backend._lib.EVP_PKEY_CTX_set_rsa_mgf1_md(pkey_ctx, mgf1_md)
-        backend.openssl_assert(res > 0)
-
-    return pkey_ctx
-
-
-def _rsa_sig_sign(
-    backend: Backend,
-    padding: AsymmetricPadding,
-    algorithm: hashes.HashAlgorithm,
-    private_key: _RSAPrivateKey,
-    data: bytes,
-) -> bytes:
-    pkey_ctx = _rsa_sig_setup(
-        backend,
-        padding,
-        algorithm,
-        private_key,
-        backend._lib.EVP_PKEY_sign_init,
-    )
-    buflen = backend._ffi.new("size_t *")
-    res = backend._lib.EVP_PKEY_sign(
-        pkey_ctx, backend._ffi.NULL, buflen, data, len(data)
-    )
-    backend.openssl_assert(res == 1)
-    buf = backend._ffi.new("unsigned char[]", buflen[0])
-    res = backend._lib.EVP_PKEY_sign(pkey_ctx, buf, buflen, data, len(data))
-    if res != 1:
-        errors = backend._consume_errors()
-        raise ValueError(
-            "Digest or salt length too long for key size. Use a larger key "
-            "or shorter salt length if you are specifying a PSS salt",
-            errors,
-        )
-
-    return backend._ffi.buffer(buf)[:]
-
-
-def _rsa_sig_verify(
-    backend: Backend,
-    padding: AsymmetricPadding,
-    algorithm: hashes.HashAlgorithm,
-    public_key: _RSAPublicKey,
-    signature: bytes,
-    data: bytes,
-) -> None:
-    pkey_ctx = _rsa_sig_setup(
-        backend,
-        padding,
-        algorithm,
-        public_key,
-        backend._lib.EVP_PKEY_verify_init,
-    )
-    res = backend._lib.EVP_PKEY_verify(
-        pkey_ctx, signature, len(signature), data, len(data)
-    )
-    # The previous call can return negative numbers in the event of an
-    # error. This is not a signature failure but we need to fail if it
-    # occurs.
-    backend.openssl_assert(res >= 0)
-    if res == 0:
-        backend._consume_errors()
-        raise InvalidSignature
-
-
-def _rsa_sig_recover(
-    backend: Backend,
-    padding: AsymmetricPadding,
-    algorithm: typing.Optional[hashes.HashAlgorithm],
-    public_key: _RSAPublicKey,
-    signature: bytes,
-) -> bytes:
-    pkey_ctx = _rsa_sig_setup(
-        backend,
-        padding,
-        algorithm,
-        public_key,
-        backend._lib.EVP_PKEY_verify_recover_init,
-    )
-
-    # Attempt to keep the rest of the code in this function as constant/time
-    # as possible. See the comment in _enc_dec_rsa_pkey_ctx. Note that the
-    # buflen parameter is used even though its value may be undefined in the
-    # error case. Due to the tolerant nature of Python slicing this does not
-    # trigger any exceptions.
-    maxlen = backend._lib.EVP_PKEY_size(public_key._evp_pkey)
-    backend.openssl_assert(maxlen > 0)
-    buf = backend._ffi.new("unsigned char[]", maxlen)
-    buflen = backend._ffi.new("size_t *", maxlen)
-    res = backend._lib.EVP_PKEY_verify_recover(
-        pkey_ctx, buf, buflen, signature, len(signature)
-    )
-    resbuf = backend._ffi.buffer(buf)[: buflen[0]]
-    backend._lib.ERR_clear_error()
-    # Assume that all parameter errors are handled during the setup phase and
-    # any error here is due to invalid signature.
-    if res != 1:
-        raise InvalidSignature
-    return resbuf
-
-
-class _RSAPrivateKey(RSAPrivateKey):
-    _evp_pkey: object
-    _rsa_cdata: object
-    _key_size: int
-
-    def __init__(
-        self,
-        backend: Backend,
-        rsa_cdata,
-        evp_pkey,
-        *,
-        unsafe_skip_rsa_key_validation: bool,
-    ):
-        res: int
-        # RSA_check_key is slower in OpenSSL 3.0.0 due to improved
-        # primality checking. In normal use this is unlikely to be a problem
-        # since users don't load new keys constantly, but for TESTING we've
-        # added an init arg that allows skipping the checks. You should not
-        # use this in production code unless you understand the consequences.
-        if not unsafe_skip_rsa_key_validation:
-            res = backend._lib.RSA_check_key(rsa_cdata)
-            if res != 1:
-                errors = backend._consume_errors()
-                raise ValueError("Invalid private key", errors)
-            # 2 is prime and passes an RSA key check, so we also check
-            # if p and q are odd just to be safe.
-            p = backend._ffi.new("BIGNUM **")
-            q = backend._ffi.new("BIGNUM **")
-            backend._lib.RSA_get0_factors(rsa_cdata, p, q)
-            backend.openssl_assert(p[0] != backend._ffi.NULL)
-            backend.openssl_assert(q[0] != backend._ffi.NULL)
-            p_odd = backend._lib.BN_is_odd(p[0])
-            q_odd = backend._lib.BN_is_odd(q[0])
-            if p_odd != 1 or q_odd != 1:
-                errors = backend._consume_errors()
-                raise ValueError("Invalid private key", errors)
-
-        self._backend = backend
-        self._rsa_cdata = rsa_cdata
-        self._evp_pkey = evp_pkey
-        # Used for lazy blinding
-        self._blinded = False
-        self._blinding_lock = threading.Lock()
-
-        n = self._backend._ffi.new("BIGNUM **")
-        self._backend._lib.RSA_get0_key(
-            self._rsa_cdata,
-            n,
-            self._backend._ffi.NULL,
-            self._backend._ffi.NULL,
-        )
-        self._backend.openssl_assert(n[0] != self._backend._ffi.NULL)
-        self._key_size = self._backend._lib.BN_num_bits(n[0])
-
-    def _enable_blinding(self) -> None:
-        # If you call blind on an already blinded RSA key OpenSSL will turn
-        # it off and back on, which is a performance hit we want to avoid.
-        if not self._blinded:
-            with self._blinding_lock:
-                self._non_threadsafe_enable_blinding()
-
-    def _non_threadsafe_enable_blinding(self) -> None:
-        # This is only a separate function to allow for testing to cover both
-        # branches. It should never be invoked except through _enable_blinding.
-        # Check if it's not True again in case another thread raced past the
-        # first non-locked check.
-        if not self._blinded:
-            res = self._backend._lib.RSA_blinding_on(
-                self._rsa_cdata, self._backend._ffi.NULL
-            )
-            self._backend.openssl_assert(res == 1)
-            self._blinded = True
-
-    @property
-    def key_size(self) -> int:
-        return self._key_size
-
-    def decrypt(self, ciphertext: bytes, padding: AsymmetricPadding) -> bytes:
-        self._enable_blinding()
-        key_size_bytes = (self.key_size + 7) // 8
-        if key_size_bytes != len(ciphertext):
-            raise ValueError("Ciphertext length must be equal to key size.")
-
-        return _enc_dec_rsa(self._backend, self, ciphertext, padding)
-
-    def public_key(self) -> RSAPublicKey:
-        ctx = self._backend._lib.RSAPublicKey_dup(self._rsa_cdata)
-        self._backend.openssl_assert(ctx != self._backend._ffi.NULL)
-        ctx = self._backend._ffi.gc(ctx, self._backend._lib.RSA_free)
-        evp_pkey = self._backend._rsa_cdata_to_evp_pkey(ctx)
-        return _RSAPublicKey(self._backend, ctx, evp_pkey)
-
-    def private_numbers(self) -> RSAPrivateNumbers:
-        n = self._backend._ffi.new("BIGNUM **")
-        e = self._backend._ffi.new("BIGNUM **")
-        d = self._backend._ffi.new("BIGNUM **")
-        p = self._backend._ffi.new("BIGNUM **")
-        q = self._backend._ffi.new("BIGNUM **")
-        dmp1 = self._backend._ffi.new("BIGNUM **")
-        dmq1 = self._backend._ffi.new("BIGNUM **")
-        iqmp = self._backend._ffi.new("BIGNUM **")
-        self._backend._lib.RSA_get0_key(self._rsa_cdata, n, e, d)
-        self._backend.openssl_assert(n[0] != self._backend._ffi.NULL)
-        self._backend.openssl_assert(e[0] != self._backend._ffi.NULL)
-        self._backend.openssl_assert(d[0] != self._backend._ffi.NULL)
-        self._backend._lib.RSA_get0_factors(self._rsa_cdata, p, q)
-        self._backend.openssl_assert(p[0] != self._backend._ffi.NULL)
-        self._backend.openssl_assert(q[0] != self._backend._ffi.NULL)
-        self._backend._lib.RSA_get0_crt_params(
-            self._rsa_cdata, dmp1, dmq1, iqmp
-        )
-        self._backend.openssl_assert(dmp1[0] != self._backend._ffi.NULL)
-        self._backend.openssl_assert(dmq1[0] != self._backend._ffi.NULL)
-        self._backend.openssl_assert(iqmp[0] != self._backend._ffi.NULL)
-        return RSAPrivateNumbers(
-            p=self._backend._bn_to_int(p[0]),
-            q=self._backend._bn_to_int(q[0]),
-            d=self._backend._bn_to_int(d[0]),
-            dmp1=self._backend._bn_to_int(dmp1[0]),
-            dmq1=self._backend._bn_to_int(dmq1[0]),
-            iqmp=self._backend._bn_to_int(iqmp[0]),
-            public_numbers=RSAPublicNumbers(
-                e=self._backend._bn_to_int(e[0]),
-                n=self._backend._bn_to_int(n[0]),
-            ),
-        )
-
-    def private_bytes(
-        self,
-        encoding: serialization.Encoding,
-        format: serialization.PrivateFormat,
-        encryption_algorithm: serialization.KeySerializationEncryption,
-    ) -> bytes:
-        return self._backend._private_key_bytes(
-            encoding,
-            format,
-            encryption_algorithm,
-            self,
-            self._evp_pkey,
-            self._rsa_cdata,
-        )
-
-    def sign(
-        self,
-        data: bytes,
-        padding: AsymmetricPadding,
-        algorithm: typing.Union[asym_utils.Prehashed, hashes.HashAlgorithm],
-    ) -> bytes:
-        self._enable_blinding()
-        data, algorithm = _calculate_digest_and_algorithm(data, algorithm)
-        return _rsa_sig_sign(self._backend, padding, algorithm, self, data)
-
-
-class _RSAPublicKey(RSAPublicKey):
-    _evp_pkey: object
-    _rsa_cdata: object
-    _key_size: int
-
-    def __init__(self, backend: Backend, rsa_cdata, evp_pkey):
-        self._backend = backend
-        self._rsa_cdata = rsa_cdata
-        self._evp_pkey = evp_pkey
-
-        n = self._backend._ffi.new("BIGNUM **")
-        self._backend._lib.RSA_get0_key(
-            self._rsa_cdata,
-            n,
-            self._backend._ffi.NULL,
-            self._backend._ffi.NULL,
-        )
-        self._backend.openssl_assert(n[0] != self._backend._ffi.NULL)
-        self._key_size = self._backend._lib.BN_num_bits(n[0])
-
-    @property
-    def key_size(self) -> int:
-        return self._key_size
-
-    def __eq__(self, other: object) -> bool:
-        if not isinstance(other, _RSAPublicKey):
-            return NotImplemented
-
-        return (
-            self._backend._lib.EVP_PKEY_cmp(self._evp_pkey, other._evp_pkey)
-            == 1
-        )
-
-    def encrypt(self, plaintext: bytes, padding: AsymmetricPadding) -> bytes:
-        return _enc_dec_rsa(self._backend, self, plaintext, padding)
-
-    def public_numbers(self) -> RSAPublicNumbers:
-        n = self._backend._ffi.new("BIGNUM **")
-        e = self._backend._ffi.new("BIGNUM **")
-        self._backend._lib.RSA_get0_key(
-            self._rsa_cdata, n, e, self._backend._ffi.NULL
-        )
-        self._backend.openssl_assert(n[0] != self._backend._ffi.NULL)
-        self._backend.openssl_assert(e[0] != self._backend._ffi.NULL)
-        return RSAPublicNumbers(
-            e=self._backend._bn_to_int(e[0]),
-            n=self._backend._bn_to_int(n[0]),
-        )
-
-    def public_bytes(
-        self,
-        encoding: serialization.Encoding,
-        format: serialization.PublicFormat,
-    ) -> bytes:
-        return self._backend._public_key_bytes(
-            encoding, format, self, self._evp_pkey, self._rsa_cdata
-        )
-
-    def verify(
-        self,
-        signature: bytes,
-        data: bytes,
-        padding: AsymmetricPadding,
-        algorithm: typing.Union[asym_utils.Prehashed, hashes.HashAlgorithm],
-    ) -> None:
-        data, algorithm = _calculate_digest_and_algorithm(data, algorithm)
-        _rsa_sig_verify(
-            self._backend, padding, algorithm, self, signature, data
-        )
-
-    def recover_data_from_signature(
-        self,
-        signature: bytes,
-        padding: AsymmetricPadding,
-        algorithm: typing.Optional[hashes.HashAlgorithm],
-    ) -> bytes:
-        if isinstance(algorithm, asym_utils.Prehashed):
-            raise TypeError(
-                "Prehashed is only supported in the sign and verify methods. "
-                "It cannot be used with recover_data_from_signature."
-            )
-        return _rsa_sig_recover(
-            self._backend, padding, algorithm, self, signature
-        )

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/backends/openssl/utils.py

@@ -1,63 +0,0 @@
-# This file is dual licensed under the terms of the Apache License, Version
-# 2.0, and the BSD License. See the LICENSE file in the root of this repository
-# for complete details.
-
-from __future__ import annotations
-
-import typing
-
-from cryptography.hazmat.primitives import hashes
-from cryptography.hazmat.primitives.asymmetric.utils import Prehashed
-
-if typing.TYPE_CHECKING:
-    from cryptography.hazmat.backends.openssl.backend import Backend
-
-
-def _evp_pkey_derive(backend: Backend, evp_pkey, peer_public_key) -> bytes:
-    ctx = backend._lib.EVP_PKEY_CTX_new(evp_pkey, backend._ffi.NULL)
-    backend.openssl_assert(ctx != backend._ffi.NULL)
-    ctx = backend._ffi.gc(ctx, backend._lib.EVP_PKEY_CTX_free)
-    res = backend._lib.EVP_PKEY_derive_init(ctx)
-    backend.openssl_assert(res == 1)
-
-    if backend._lib.Cryptography_HAS_EVP_PKEY_SET_PEER_EX:
-        res = backend._lib.EVP_PKEY_derive_set_peer_ex(
-            ctx, peer_public_key._evp_pkey, 0
-        )
-    else:
-        res = backend._lib.EVP_PKEY_derive_set_peer(
-            ctx, peer_public_key._evp_pkey
-        )
-    backend.openssl_assert(res == 1)
-
-    keylen = backend._ffi.new("size_t *")
-    res = backend._lib.EVP_PKEY_derive(ctx, backend._ffi.NULL, keylen)
-    backend.openssl_assert(res == 1)
-    backend.openssl_assert(keylen[0] > 0)
-    buf = backend._ffi.new("unsigned char[]", keylen[0])
-    res = backend._lib.EVP_PKEY_derive(ctx, buf, keylen)
-    if res != 1:
-        errors = backend._consume_errors()
-        raise ValueError("Error computing shared key.", errors)
-
-    return backend._ffi.buffer(buf, keylen[0])[:]
-
-
-def _calculate_digest_and_algorithm(
-    data: bytes,
-    algorithm: typing.Union[Prehashed, hashes.HashAlgorithm],
-) -> typing.Tuple[bytes, hashes.HashAlgorithm]:
-    if not isinstance(algorithm, Prehashed):
-        hash_ctx = hashes.Hash(algorithm)
-        hash_ctx.update(data)
-        data = hash_ctx.finalize()
-    else:
-        algorithm = algorithm._algorithm
-
-    if len(data) != algorithm.digest_size:
-        raise ValueError(
-            "The provided data must be the same length as the hash "
-            "algorithm's digest size."
-        )
-
-    return (data, algorithm)

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/bindings/_rust/__init__.pyi

@@ -2,33 +2,36 @@
 # 2.0, and the BSD License. See the LICENSE file in the root of this repository
 # for complete details.
 
-import types
 import typing
 
-def check_pkcs7_padding(data: bytes) -> bool: ...
-def check_ansix923_padding(data: bytes) -> bool: ...
+from cryptography.hazmat.primitives import padding
+from cryptography.utils import Buffer
+
+class PKCS7PaddingContext(padding.PaddingContext):
+    def __init__(self, block_size: int) -> None: ...
+    def update(self, data: Buffer) -> bytes: ...
+    def finalize(self) -> bytes: ...
+
+class ANSIX923PaddingContext(padding.PaddingContext):
+    def __init__(self, block_size: int) -> None: ...
+    def update(self, data: Buffer) -> bytes: ...
+    def finalize(self) -> bytes: ...
+
+class PKCS7UnpaddingContext(padding.PaddingContext):
+    def __init__(self, block_size: int) -> None: ...
+    def update(self, data: Buffer) -> bytes: ...
+    def finalize(self) -> bytes: ...
+
+class ANSIX923UnpaddingContext(padding.PaddingContext):
+    def __init__(self, block_size: int) -> None: ...
+    def update(self, data: Buffer) -> bytes: ...
+    def finalize(self) -> bytes: ...
 
 class ObjectIdentifier:
-    def __init__(self, val: str) -> None: ...
+    def __init__(self, value: str) -> None: ...
     @property
     def dotted_string(self) -> str: ...
     @property
     def _name(self) -> str: ...
 
 T = typing.TypeVar("T")
-
-class FixedPool(typing.Generic[T]):
-    def __init__(
-        self,
-        create: typing.Callable[[], T],
-    ) -> None: ...
-    def acquire(self) -> PoolAcquisition[T]: ...
-
-class PoolAcquisition(typing.Generic[T]):
-    def __enter__(self) -> T: ...
-    def __exit__(
-        self,
-        exc_type: typing.Optional[typing.Type[BaseException]],
-        exc_value: typing.Optional[BaseException],
-        exc_tb: typing.Optional[types.TracebackType],
-    ) -> None: ...

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/bindings/_rust/asn1.pyi

@@ -2,15 +2,6 @@
 # 2.0, and the BSD License. See the LICENSE file in the root of this repository
 # for complete details.
 
-import typing
-
-class TestCertificate:
-    not_after_tag: int
-    not_before_tag: int
-    issuer_value_tags: typing.List[int]
-    subject_value_tags: typing.List[int]
-
-def decode_dss_signature(signature: bytes) -> typing.Tuple[int, int]: ...
+def decode_dss_signature(signature: bytes) -> tuple[int, int]: ...
 def encode_dss_signature(r: int, s: int) -> bytes: ...
 def parse_spki_for_data(data: bytes) -> bytes: ...
-def test_parse_certificate(data: bytes) -> TestCertificate: ...

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/bindings/_rust/declarative_asn1.pyi

@@ -0,0 +1,32 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+import typing
+
+def encode_der(value: typing.Any) -> bytes: ...
+def non_root_python_to_rust(cls: type) -> Type: ...
+
+# Type is a Rust enum with tuple variants. For now, we express the type
+# annotations like this:
+class Type:
+    Sequence: typing.ClassVar[type]
+    PyInt: typing.ClassVar[type]
+
+class Annotation:
+    def __new__(
+        cls,
+    ) -> Annotation: ...
+
+class AnnotatedType:
+    inner: Type
+    annotation: Annotation
+
+    def __new__(cls, inner: Type, annotation: Annotation) -> AnnotatedType: ...
+
+class AnnotatedTypeObject:
+    annotated_type: AnnotatedType
+    value: typing.Any
+
+    def __new__(
+        cls, annotated_type: AnnotatedType, value: typing.Any
+    ) -> AnnotatedTypeObject: ...

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/bindings/_rust/ocsp.pyi

@@ -2,24 +2,116 @@
 # 2.0, and the BSD License. See the LICENSE file in the root of this repository
 # for complete details.
 
-import typing
+import datetime
+from collections.abc import Iterator
 
-from cryptography.hazmat.primitives import hashes
+from cryptography import x509
+from cryptography.hazmat.primitives import hashes, serialization
 from cryptography.hazmat.primitives.asymmetric.types import PrivateKeyTypes
-from cryptography.x509.ocsp import (
-    OCSPRequest,
-    OCSPRequestBuilder,
-    OCSPResponse,
-    OCSPResponseBuilder,
-    OCSPResponseStatus,
-)
+from cryptography.x509 import ocsp
 
-def load_der_ocsp_request(data: bytes) -> OCSPRequest: ...
-def load_der_ocsp_response(data: bytes) -> OCSPResponse: ...
-def create_ocsp_request(builder: OCSPRequestBuilder) -> OCSPRequest: ...
+class OCSPRequest:
+    @property
+    def issuer_key_hash(self) -> bytes: ...
+    @property
+    def issuer_name_hash(self) -> bytes: ...
+    @property
+    def hash_algorithm(self) -> hashes.HashAlgorithm: ...
+    @property
+    def serial_number(self) -> int: ...
+    def public_bytes(self, encoding: serialization.Encoding) -> bytes: ...
+    @property
+    def extensions(self) -> x509.Extensions: ...
+
+class OCSPResponse:
+    @property
+    def responses(self) -> Iterator[OCSPSingleResponse]: ...
+    @property
+    def response_status(self) -> ocsp.OCSPResponseStatus: ...
+    @property
+    def signature_algorithm_oid(self) -> x509.ObjectIdentifier: ...
+    @property
+    def signature_hash_algorithm(
+        self,
+    ) -> hashes.HashAlgorithm | None: ...
+    @property
+    def signature(self) -> bytes: ...
+    @property
+    def tbs_response_bytes(self) -> bytes: ...
+    @property
+    def certificates(self) -> list[x509.Certificate]: ...
+    @property
+    def responder_key_hash(self) -> bytes | None: ...
+    @property
+    def responder_name(self) -> x509.Name | None: ...
+    @property
+    def produced_at(self) -> datetime.datetime: ...
+    @property
+    def produced_at_utc(self) -> datetime.datetime: ...
+    @property
+    def certificate_status(self) -> ocsp.OCSPCertStatus: ...
+    @property
+    def revocation_time(self) -> datetime.datetime | None: ...
+    @property
+    def revocation_time_utc(self) -> datetime.datetime | None: ...
+    @property
+    def revocation_reason(self) -> x509.ReasonFlags | None: ...
+    @property
+    def this_update(self) -> datetime.datetime: ...
+    @property
+    def this_update_utc(self) -> datetime.datetime: ...
+    @property
+    def next_update(self) -> datetime.datetime | None: ...
+    @property
+    def next_update_utc(self) -> datetime.datetime | None: ...
+    @property
+    def issuer_key_hash(self) -> bytes: ...
+    @property
+    def issuer_name_hash(self) -> bytes: ...
+    @property
+    def hash_algorithm(self) -> hashes.HashAlgorithm: ...
+    @property
+    def serial_number(self) -> int: ...
+    @property
+    def extensions(self) -> x509.Extensions: ...
+    @property
+    def single_extensions(self) -> x509.Extensions: ...
+    def public_bytes(self, encoding: serialization.Encoding) -> bytes: ...
+
+class OCSPSingleResponse:
+    @property
+    def certificate_status(self) -> ocsp.OCSPCertStatus: ...
+    @property
+    def revocation_time(self) -> datetime.datetime | None: ...
+    @property
+    def revocation_time_utc(self) -> datetime.datetime | None: ...
+    @property
+    def revocation_reason(self) -> x509.ReasonFlags | None: ...
+    @property
+    def this_update(self) -> datetime.datetime: ...
+    @property
+    def this_update_utc(self) -> datetime.datetime: ...
+    @property
+    def next_update(self) -> datetime.datetime | None: ...
+    @property
+    def next_update_utc(self) -> datetime.datetime | None: ...
+    @property
+    def issuer_key_hash(self) -> bytes: ...
+    @property
+    def issuer_name_hash(self) -> bytes: ...
+    @property
+    def hash_algorithm(self) -> hashes.HashAlgorithm: ...
+    @property
+    def serial_number(self) -> int: ...
+
+def load_der_ocsp_request(data: bytes) -> ocsp.OCSPRequest: ...
+def load_der_ocsp_response(data: bytes) -> ocsp.OCSPResponse: ...
+def create_ocsp_request(
+    builder: ocsp.OCSPRequestBuilder,
+) -> ocsp.OCSPRequest: ...
 def create_ocsp_response(
-    status: OCSPResponseStatus,
-    builder: typing.Optional[OCSPResponseBuilder],
-    private_key: typing.Optional[PrivateKeyTypes],
-    hash_algorithm: typing.Optional[hashes.HashAlgorithm],
-) -> OCSPResponse: ...
+    status: ocsp.OCSPResponseStatus,
+    builder: ocsp.OCSPResponseBuilder | None,
+    private_key: PrivateKeyTypes | None,
+    hash_algorithm: hashes.HashAlgorithm | None,
+) -> ocsp.OCSPResponse: ...

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/bindings/_rust/openssl/__init__.pyi

@@ -5,37 +5,66 @@
 import typing
 
 from cryptography.hazmat.bindings._rust.openssl import (
+    aead,
+    ciphers,
+    cmac,
     dh,
     dsa,
+    ec,
     ed448,
     ed25519,
     hashes,
     hmac,
     kdf,
+    keys,
     poly1305,
+    rsa,
     x448,
     x25519,
 )
 
 __all__ = [
-    "openssl_version",
-    "raise_openssl_error",
+    "aead",
+    "ciphers",
+    "cmac",
     "dh",
     "dsa",
+    "ec",
+    "ed448",
+    "ed25519",
     "hashes",
     "hmac",
     "kdf",
-    "ed448",
-    "ed25519",
+    "keys",
+    "openssl_version",
+    "openssl_version_text",
     "poly1305",
+    "raise_openssl_error",
+    "rsa",
     "x448",
     "x25519",
 ]
 
+CRYPTOGRAPHY_IS_LIBRESSL: bool
+CRYPTOGRAPHY_IS_BORINGSSL: bool
+CRYPTOGRAPHY_IS_AWSLC: bool
+CRYPTOGRAPHY_OPENSSL_300_OR_GREATER: bool
+CRYPTOGRAPHY_OPENSSL_309_OR_GREATER: bool
+CRYPTOGRAPHY_OPENSSL_320_OR_GREATER: bool
+CRYPTOGRAPHY_OPENSSL_330_OR_GREATER: bool
+CRYPTOGRAPHY_OPENSSL_350_OR_GREATER: bool
+
+class Providers: ...
+
+_legacy_provider_loaded: bool
+_providers: Providers
+
 def openssl_version() -> int: ...
+def openssl_version_text() -> str: ...
 def raise_openssl_error() -> typing.NoReturn: ...
-def capture_error_stack() -> typing.List[OpenSSLError]: ...
+def capture_error_stack() -> list[OpenSSLError]: ...
 def is_fips_enabled() -> bool: ...
+def enable_fips(providers: Providers) -> None: ...
 
 class OpenSSLError:
     @property
@@ -44,4 +73,3 @@ class OpenSSLError:
     def reason(self) -> int: ...
     @property
     def reason_text(self) -> bytes: ...
-    def _lib_reason_match(self, lib: int, reason: int) -> bool: ...

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/bindings/_rust/openssl/aead.pyi

@@ -0,0 +1,107 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+from collections.abc import Sequence
+
+from cryptography.utils import Buffer
+
+class AESGCM:
+    def __init__(self, key: Buffer) -> None: ...
+    @staticmethod
+    def generate_key(bit_length: int) -> bytes: ...
+    def encrypt(
+        self,
+        nonce: Buffer,
+        data: Buffer,
+        associated_data: Buffer | None,
+    ) -> bytes: ...
+    def decrypt(
+        self,
+        nonce: Buffer,
+        data: Buffer,
+        associated_data: Buffer | None,
+    ) -> bytes: ...
+
+class ChaCha20Poly1305:
+    def __init__(self, key: Buffer) -> None: ...
+    @staticmethod
+    def generate_key() -> bytes: ...
+    def encrypt(
+        self,
+        nonce: Buffer,
+        data: Buffer,
+        associated_data: Buffer | None,
+    ) -> bytes: ...
+    def decrypt(
+        self,
+        nonce: Buffer,
+        data: Buffer,
+        associated_data: Buffer | None,
+    ) -> bytes: ...
+
+class AESCCM:
+    def __init__(self, key: Buffer, tag_length: int = 16) -> None: ...
+    @staticmethod
+    def generate_key(bit_length: int) -> bytes: ...
+    def encrypt(
+        self,
+        nonce: Buffer,
+        data: Buffer,
+        associated_data: Buffer | None,
+    ) -> bytes: ...
+    def decrypt(
+        self,
+        nonce: Buffer,
+        data: Buffer,
+        associated_data: Buffer | None,
+    ) -> bytes: ...
+
+class AESSIV:
+    def __init__(self, key: Buffer) -> None: ...
+    @staticmethod
+    def generate_key(bit_length: int) -> bytes: ...
+    def encrypt(
+        self,
+        data: Buffer,
+        associated_data: Sequence[Buffer] | None,
+    ) -> bytes: ...
+    def decrypt(
+        self,
+        data: Buffer,
+        associated_data: Sequence[Buffer] | None,
+    ) -> bytes: ...
+
+class AESOCB3:
+    def __init__(self, key: Buffer) -> None: ...
+    @staticmethod
+    def generate_key(bit_length: int) -> bytes: ...
+    def encrypt(
+        self,
+        nonce: Buffer,
+        data: Buffer,
+        associated_data: Buffer | None,
+    ) -> bytes: ...
+    def decrypt(
+        self,
+        nonce: Buffer,
+        data: Buffer,
+        associated_data: Buffer | None,
+    ) -> bytes: ...
+
+class AESGCMSIV:
+    def __init__(self, key: Buffer) -> None: ...
+    @staticmethod
+    def generate_key(bit_length: int) -> bytes: ...
+    def encrypt(
+        self,
+        nonce: Buffer,
+        data: Buffer,
+        associated_data: Buffer | None,
+    ) -> bytes: ...
+    def decrypt(
+        self,
+        nonce: Buffer,
+        data: Buffer,
+        associated_data: Buffer | None,
+    ) -> bytes: ...

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/bindings/_rust/openssl/ciphers.pyi

@@ -0,0 +1,38 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+import typing
+
+from cryptography.hazmat.primitives import ciphers
+from cryptography.hazmat.primitives.ciphers import modes
+
+@typing.overload
+def create_encryption_ctx(
+    algorithm: ciphers.CipherAlgorithm, mode: modes.ModeWithAuthenticationTag
+) -> ciphers.AEADEncryptionContext: ...
+@typing.overload
+def create_encryption_ctx(
+    algorithm: ciphers.CipherAlgorithm, mode: modes.Mode | None
+) -> ciphers.CipherContext: ...
+@typing.overload
+def create_decryption_ctx(
+    algorithm: ciphers.CipherAlgorithm, mode: modes.ModeWithAuthenticationTag
+) -> ciphers.AEADDecryptionContext: ...
+@typing.overload
+def create_decryption_ctx(
+    algorithm: ciphers.CipherAlgorithm, mode: modes.Mode | None
+) -> ciphers.CipherContext: ...
+def cipher_supported(
+    algorithm: ciphers.CipherAlgorithm, mode: modes.Mode
+) -> bool: ...
+def _advance(
+    ctx: ciphers.AEADEncryptionContext | ciphers.AEADDecryptionContext, n: int
+) -> None: ...
+def _advance_aad(
+    ctx: ciphers.AEADEncryptionContext | ciphers.AEADDecryptionContext, n: int
+) -> None: ...
+
+class CipherContext: ...
+class AEADEncryptionContext: ...
+class AEADDecryptionContext: ...

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/bindings/_rust/openssl/cmac.pyi

@@ -0,0 +1,18 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+import typing
+
+from cryptography.hazmat.primitives import ciphers
+
+class CMAC:
+    def __init__(
+        self,
+        algorithm: ciphers.BlockCipherAlgorithm,
+        backend: typing.Any = None,
+    ) -> None: ...
+    def update(self, data: bytes) -> None: ...
+    def finalize(self) -> bytes: ...
+    def verify(self, signature: bytes) -> None: ...
+    def copy(self) -> CMAC: ...

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/bindings/_rust/openssl/dh.pyi

@@ -2,6 +2,8 @@
 # 2.0, and the BSD License. See the LICENSE file in the root of this repository
 # for complete details.
 
+import typing
+
 from cryptography.hazmat.primitives.asymmetric import dh
 
 MIN_MODULUS_SIZE: int
@@ -10,13 +12,40 @@ class DHPrivateKey: ...
 class DHPublicKey: ...
 class DHParameters: ...
 
-def generate_parameters(generator: int, key_size: int) -> dh.DHParameters: ...
-def private_key_from_ptr(ptr: int) -> dh.DHPrivateKey: ...
-def public_key_from_ptr(ptr: int) -> dh.DHPublicKey: ...
-def from_pem_parameters(data: bytes) -> dh.DHParameters: ...
-def from_der_parameters(data: bytes) -> dh.DHParameters: ...
-def from_private_numbers(numbers: dh.DHPrivateNumbers) -> dh.DHPrivateKey: ...
-def from_public_numbers(numbers: dh.DHPublicNumbers) -> dh.DHPublicKey: ...
-def from_parameter_numbers(
-    numbers: dh.DHParameterNumbers,
+class DHPrivateNumbers:
+    def __init__(self, x: int, public_numbers: DHPublicNumbers) -> None: ...
+    def private_key(self, backend: typing.Any = None) -> dh.DHPrivateKey: ...
+    @property
+    def x(self) -> int: ...
+    @property
+    def public_numbers(self) -> DHPublicNumbers: ...
+
+class DHPublicNumbers:
+    def __init__(
+        self, y: int, parameter_numbers: DHParameterNumbers
+    ) -> None: ...
+    def public_key(self, backend: typing.Any = None) -> dh.DHPublicKey: ...
+    @property
+    def y(self) -> int: ...
+    @property
+    def parameter_numbers(self) -> DHParameterNumbers: ...
+
+class DHParameterNumbers:
+    def __init__(self, p: int, g: int, q: int | None = None) -> None: ...
+    def parameters(self, backend: typing.Any = None) -> dh.DHParameters: ...
+    @property
+    def p(self) -> int: ...
+    @property
+    def g(self) -> int: ...
+    @property
+    def q(self) -> int | None: ...
+
+def generate_parameters(
+    generator: int, key_size: int, backend: typing.Any = None
+) -> dh.DHParameters: ...
+def from_pem_parameters(
+    data: bytes, backend: typing.Any = None
+) -> dh.DHParameters: ...
+def from_der_parameters(
+    data: bytes, backend: typing.Any = None
 ) -> dh.DHParameters: ...

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/bindings/_rust/openssl/dsa.pyi

@@ -2,19 +2,40 @@
 # 2.0, and the BSD License. See the LICENSE file in the root of this repository
 # for complete details.
 
+import typing
+
 from cryptography.hazmat.primitives.asymmetric import dsa
 
 class DSAPrivateKey: ...
 class DSAPublicKey: ...
 class DSAParameters: ...
 
+class DSAPrivateNumbers:
+    def __init__(self, x: int, public_numbers: DSAPublicNumbers) -> None: ...
+    @property
+    def x(self) -> int: ...
+    @property
+    def public_numbers(self) -> DSAPublicNumbers: ...
+    def private_key(self, backend: typing.Any = None) -> dsa.DSAPrivateKey: ...
+
+class DSAPublicNumbers:
+    def __init__(
+        self, y: int, parameter_numbers: DSAParameterNumbers
+    ) -> None: ...
+    @property
+    def y(self) -> int: ...
+    @property
+    def parameter_numbers(self) -> DSAParameterNumbers: ...
+    def public_key(self, backend: typing.Any = None) -> dsa.DSAPublicKey: ...
+
+class DSAParameterNumbers:
+    def __init__(self, p: int, q: int, g: int) -> None: ...
+    @property
+    def p(self) -> int: ...
+    @property
+    def q(self) -> int: ...
+    @property
+    def g(self) -> int: ...
+    def parameters(self, backend: typing.Any = None) -> dsa.DSAParameters: ...
+
 def generate_parameters(key_size: int) -> dsa.DSAParameters: ...
-def private_key_from_ptr(ptr: int) -> dsa.DSAPrivateKey: ...
-def public_key_from_ptr(ptr: int) -> dsa.DSAPublicKey: ...
-def from_private_numbers(
-    numbers: dsa.DSAPrivateNumbers,
-) -> dsa.DSAPrivateKey: ...
-def from_public_numbers(numbers: dsa.DSAPublicNumbers) -> dsa.DSAPublicKey: ...
-def from_parameter_numbers(
-    numbers: dsa.DSAParameterNumbers,
-) -> dsa.DSAParameters: ...

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/bindings/_rust/openssl/ec.pyi

@@ -0,0 +1,52 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+import typing
+
+from cryptography.hazmat.primitives.asymmetric import ec
+
+class ECPrivateKey: ...
+class ECPublicKey: ...
+
+class EllipticCurvePrivateNumbers:
+    def __init__(
+        self, private_value: int, public_numbers: EllipticCurvePublicNumbers
+    ) -> None: ...
+    def private_key(
+        self, backend: typing.Any = None
+    ) -> ec.EllipticCurvePrivateKey: ...
+    @property
+    def private_value(self) -> int: ...
+    @property
+    def public_numbers(self) -> EllipticCurvePublicNumbers: ...
+
+class EllipticCurvePublicNumbers:
+    def __init__(self, x: int, y: int, curve: ec.EllipticCurve) -> None: ...
+    def public_key(
+        self, backend: typing.Any = None
+    ) -> ec.EllipticCurvePublicKey: ...
+    @property
+    def x(self) -> int: ...
+    @property
+    def y(self) -> int: ...
+    @property
+    def curve(self) -> ec.EllipticCurve: ...
+    def __eq__(self, other: object) -> bool: ...
+
+def curve_supported(curve: ec.EllipticCurve) -> bool: ...
+def generate_private_key(
+    curve: ec.EllipticCurve, backend: typing.Any = None
+) -> ec.EllipticCurvePrivateKey: ...
+def from_private_numbers(
+    numbers: ec.EllipticCurvePrivateNumbers,
+) -> ec.EllipticCurvePrivateKey: ...
+def from_public_numbers(
+    numbers: ec.EllipticCurvePublicNumbers,
+) -> ec.EllipticCurvePublicKey: ...
+def from_public_bytes(
+    curve: ec.EllipticCurve, data: bytes
+) -> ec.EllipticCurvePublicKey: ...
+def derive_private_key(
+    private_value: int, curve: ec.EllipticCurve
+) -> ec.EllipticCurvePrivateKey: ...

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/bindings/_rust/openssl/ed25519.pyi

@@ -3,12 +3,11 @@
 # for complete details.
 
 from cryptography.hazmat.primitives.asymmetric import ed25519
+from cryptography.utils import Buffer
 
 class Ed25519PrivateKey: ...
 class Ed25519PublicKey: ...
 
 def generate_key() -> ed25519.Ed25519PrivateKey: ...
-def private_key_from_ptr(ptr: int) -> ed25519.Ed25519PrivateKey: ...
-def public_key_from_ptr(ptr: int) -> ed25519.Ed25519PublicKey: ...
-def from_private_bytes(data: bytes) -> ed25519.Ed25519PrivateKey: ...
+def from_private_bytes(data: Buffer) -> ed25519.Ed25519PrivateKey: ...
 def from_public_bytes(data: bytes) -> ed25519.Ed25519PublicKey: ...

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/bindings/_rust/openssl/ed448.pyi

@@ -3,12 +3,11 @@
 # for complete details.
 
 from cryptography.hazmat.primitives.asymmetric import ed448
+from cryptography.utils import Buffer
 
 class Ed448PrivateKey: ...
 class Ed448PublicKey: ...
 
 def generate_key() -> ed448.Ed448PrivateKey: ...
-def private_key_from_ptr(ptr: int) -> ed448.Ed448PrivateKey: ...
-def public_key_from_ptr(ptr: int) -> ed448.Ed448PublicKey: ...
-def from_private_bytes(data: bytes) -> ed448.Ed448PrivateKey: ...
+def from_private_bytes(data: Buffer) -> ed448.Ed448PrivateKey: ...
 def from_public_bytes(data: bytes) -> ed448.Ed448PublicKey: ...

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/bindings/_rust/openssl/hashes.pyi

@@ -5,6 +5,7 @@
 import typing
 
 from cryptography.hazmat.primitives import hashes
+from cryptography.utils import Buffer
 
 class Hash(hashes.HashContext):
     def __init__(
@@ -12,6 +13,16 @@ class Hash(hashes.HashContext):
     ) -> None: ...
     @property
     def algorithm(self) -> hashes.HashAlgorithm: ...
-    def update(self, data: bytes) -> None: ...
+    def update(self, data: Buffer) -> None: ...
     def finalize(self) -> bytes: ...
     def copy(self) -> Hash: ...
+
+def hash_supported(algorithm: hashes.HashAlgorithm) -> bool: ...
+
+class XOFHash:
+    def __init__(self, algorithm: hashes.ExtendableOutputFunction) -> None: ...
+    @property
+    def algorithm(self) -> hashes.ExtendableOutputFunction: ...
+    def update(self, data: Buffer) -> None: ...
+    def squeeze(self, length: int) -> bytes: ...
+    def copy(self) -> XOFHash: ...

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/bindings/_rust/openssl/hmac.pyi

@@ -5,17 +5,18 @@
 import typing
 
 from cryptography.hazmat.primitives import hashes
+from cryptography.utils import Buffer
 
 class HMAC(hashes.HashContext):
     def __init__(
         self,
-        key: bytes,
+        key: Buffer,
         algorithm: hashes.HashAlgorithm,
         backend: typing.Any = None,
     ) -> None: ...
     @property
     def algorithm(self) -> hashes.HashAlgorithm: ...
-    def update(self, data: bytes) -> None: ...
+    def update(self, data: Buffer) -> None: ...
     def finalize(self) -> bytes: ...
     def verify(self, signature: bytes) -> None: ...
     def copy(self) -> HMAC: ...

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/bindings/_rust/openssl/kdf.pyi

@@ -2,21 +2,71 @@
 # 2.0, and the BSD License. See the LICENSE file in the root of this repository
 # for complete details.
 
+import typing
+
 from cryptography.hazmat.primitives.hashes import HashAlgorithm
+from cryptography.utils import Buffer
 
 def derive_pbkdf2_hmac(
-    key_material: bytes,
+    key_material: Buffer,
     algorithm: HashAlgorithm,
     salt: bytes,
     iterations: int,
     length: int,
 ) -> bytes: ...
-def derive_scrypt(
-    key_material: bytes,
-    salt: bytes,
-    n: int,
-    r: int,
-    p: int,
-    max_mem: int,
-    length: int,
-) -> bytes: ...
+
+class Scrypt:
+    def __init__(
+        self,
+        salt: bytes,
+        length: int,
+        n: int,
+        r: int,
+        p: int,
+        backend: typing.Any = None,
+    ) -> None: ...
+    def derive(self, key_material: Buffer) -> bytes: ...
+    def verify(self, key_material: bytes, expected_key: bytes) -> None: ...
+
+class Argon2id:
+    def __init__(
+        self,
+        *,
+        salt: bytes,
+        length: int,
+        iterations: int,
+        lanes: int,
+        memory_cost: int,
+        ad: bytes | None = None,
+        secret: bytes | None = None,
+    ) -> None: ...
+    def derive(self, key_material: bytes) -> bytes: ...
+    def verify(self, key_material: bytes, expected_key: bytes) -> None: ...
+    def derive_phc_encoded(self, key_material: bytes) -> str: ...
+    @classmethod
+    def verify_phc_encoded(
+        cls, key_material: bytes, phc_encoded: str, secret: bytes | None = None
+    ) -> None: ...
+
+class HKDF:
+    def __init__(
+        self,
+        algorithm: HashAlgorithm,
+        length: int,
+        salt: bytes | None,
+        info: bytes | None,
+        backend: typing.Any = None,
+    ): ...
+    def derive(self, key_material: Buffer) -> bytes: ...
+    def verify(self, key_material: bytes, expected_key: bytes) -> None: ...
+
+class HKDFExpand:
+    def __init__(
+        self,
+        algorithm: HashAlgorithm,
+        length: int,
+        info: bytes | None,
+        backend: typing.Any = None,
+    ): ...
+    def derive(self, key_material: Buffer) -> bytes: ...
+    def verify(self, key_material: bytes, expected_key: bytes) -> None: ...

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/bindings/_rust/openssl/keys.pyi

@@ -0,0 +1,34 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+import typing
+
+from cryptography.hazmat.primitives.asymmetric.types import (
+    PrivateKeyTypes,
+    PublicKeyTypes,
+)
+from cryptography.utils import Buffer
+
+def load_der_private_key(
+    data: Buffer,
+    password: bytes | None,
+    backend: typing.Any = None,
+    *,
+    unsafe_skip_rsa_key_validation: bool = False,
+) -> PrivateKeyTypes: ...
+def load_pem_private_key(
+    data: Buffer,
+    password: bytes | None,
+    backend: typing.Any = None,
+    *,
+    unsafe_skip_rsa_key_validation: bool = False,
+) -> PrivateKeyTypes: ...
+def load_der_public_key(
+    data: bytes,
+    backend: typing.Any = None,
+) -> PublicKeyTypes: ...
+def load_pem_public_key(
+    data: bytes,
+    backend: typing.Any = None,
+) -> PublicKeyTypes: ...

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/bindings/_rust/openssl/poly1305.pyi

@@ -2,12 +2,14 @@
 # 2.0, and the BSD License. See the LICENSE file in the root of this repository
 # for complete details.
 
+from cryptography.utils import Buffer
+
 class Poly1305:
-    def __init__(self, key: bytes) -> None: ...
+    def __init__(self, key: Buffer) -> None: ...
     @staticmethod
-    def generate_tag(key: bytes, data: bytes) -> bytes: ...
+    def generate_tag(key: Buffer, data: Buffer) -> bytes: ...
     @staticmethod
-    def verify_tag(key: bytes, data: bytes, tag: bytes) -> None: ...
-    def update(self, data: bytes) -> None: ...
+    def verify_tag(key: Buffer, data: Buffer, tag: bytes) -> None: ...
+    def update(self, data: Buffer) -> None: ...
     def finalize(self) -> bytes: ...
     def verify(self, tag: bytes) -> None: ...

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/bindings/_rust/openssl/rsa.pyi

@@ -0,0 +1,55 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+import typing
+
+from cryptography.hazmat.primitives.asymmetric import rsa
+
+class RSAPrivateKey: ...
+class RSAPublicKey: ...
+
+class RSAPrivateNumbers:
+    def __init__(
+        self,
+        p: int,
+        q: int,
+        d: int,
+        dmp1: int,
+        dmq1: int,
+        iqmp: int,
+        public_numbers: RSAPublicNumbers,
+    ) -> None: ...
+    @property
+    def p(self) -> int: ...
+    @property
+    def q(self) -> int: ...
+    @property
+    def d(self) -> int: ...
+    @property
+    def dmp1(self) -> int: ...
+    @property
+    def dmq1(self) -> int: ...
+    @property
+    def iqmp(self) -> int: ...
+    @property
+    def public_numbers(self) -> RSAPublicNumbers: ...
+    def private_key(
+        self,
+        backend: typing.Any = None,
+        *,
+        unsafe_skip_rsa_key_validation: bool = False,
+    ) -> rsa.RSAPrivateKey: ...
+
+class RSAPublicNumbers:
+    def __init__(self, e: int, n: int) -> None: ...
+    @property
+    def n(self) -> int: ...
+    @property
+    def e(self) -> int: ...
+    def public_key(self, backend: typing.Any = None) -> rsa.RSAPublicKey: ...
+
+def generate_private_key(
+    public_exponent: int,
+    key_size: int,
+) -> rsa.RSAPrivateKey: ...

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/bindings/_rust/openssl/x25519.pyi

@@ -3,12 +3,11 @@
 # for complete details.
 
 from cryptography.hazmat.primitives.asymmetric import x25519
+from cryptography.utils import Buffer
 
 class X25519PrivateKey: ...
 class X25519PublicKey: ...
 
 def generate_key() -> x25519.X25519PrivateKey: ...
-def private_key_from_ptr(ptr: int) -> x25519.X25519PrivateKey: ...
-def public_key_from_ptr(ptr: int) -> x25519.X25519PublicKey: ...
-def from_private_bytes(data: bytes) -> x25519.X25519PrivateKey: ...
+def from_private_bytes(data: Buffer) -> x25519.X25519PrivateKey: ...
 def from_public_bytes(data: bytes) -> x25519.X25519PublicKey: ...

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/bindings/_rust/openssl/x448.pyi

@@ -3,12 +3,11 @@
 # for complete details.
 
 from cryptography.hazmat.primitives.asymmetric import x448
+from cryptography.utils import Buffer
 
 class X448PrivateKey: ...
 class X448PublicKey: ...
 
 def generate_key() -> x448.X448PrivateKey: ...
-def private_key_from_ptr(ptr: int) -> x448.X448PrivateKey: ...
-def public_key_from_ptr(ptr: int) -> x448.X448PublicKey: ...
-def from_private_bytes(data: bytes) -> x448.X448PrivateKey: ...
+def from_private_bytes(data: Buffer) -> x448.X448PrivateKey: ...
 def from_public_bytes(data: bytes) -> x448.X448PublicKey: ...

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/bindings/_rust/pkcs12.pyi

@@ -0,0 +1,52 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+import typing
+from collections.abc import Iterable
+
+from cryptography import x509
+from cryptography.hazmat.primitives.asymmetric.types import PrivateKeyTypes
+from cryptography.hazmat.primitives.serialization import (
+    KeySerializationEncryption,
+)
+from cryptography.hazmat.primitives.serialization.pkcs12 import (
+    PKCS12KeyAndCertificates,
+    PKCS12PrivateKeyTypes,
+)
+from cryptography.utils import Buffer
+
+class PKCS12Certificate:
+    def __init__(
+        self, cert: x509.Certificate, friendly_name: bytes | None
+    ) -> None: ...
+    @property
+    def friendly_name(self) -> bytes | None: ...
+    @property
+    def certificate(self) -> x509.Certificate: ...
+
+def load_key_and_certificates(
+    data: Buffer,
+    password: Buffer | None,
+    backend: typing.Any = None,
+) -> tuple[
+    PrivateKeyTypes | None,
+    x509.Certificate | None,
+    list[x509.Certificate],
+]: ...
+def load_pkcs12(
+    data: bytes,
+    password: bytes | None,
+    backend: typing.Any = None,
+) -> PKCS12KeyAndCertificates: ...
+def serialize_java_truststore(
+    certs: Iterable[PKCS12Certificate],
+    encryption_algorithm: KeySerializationEncryption,
+) -> bytes: ...
+def serialize_key_and_certificates(
+    name: bytes | None,
+    key: PKCS12PrivateKeyTypes | None,
+    cert: x509.Certificate | None,
+    cas: Iterable[x509.Certificate | PKCS12Certificate] | None,
+    encryption_algorithm: KeySerializationEncryption,
+) -> bytes: ...

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/bindings/_rust/pkcs7.pyi

@@ -1,15 +1,50 @@
-import typing
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+from collections.abc import Iterable
 
 from cryptography import x509
 from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
 from cryptography.hazmat.primitives.serialization import pkcs7
 
 def serialize_certificates(
-    certs: typing.List[x509.Certificate],
+    certs: list[x509.Certificate],
     encoding: serialization.Encoding,
 ) -> bytes: ...
+def encrypt_and_serialize(
+    builder: pkcs7.PKCS7EnvelopeBuilder,
+    content_encryption_algorithm: pkcs7.ContentEncryptionAlgorithm,
+    encoding: serialization.Encoding,
+    options: Iterable[pkcs7.PKCS7Options],
+) -> bytes: ...
 def sign_and_serialize(
     builder: pkcs7.PKCS7SignatureBuilder,
     encoding: serialization.Encoding,
-    options: typing.Iterable[pkcs7.PKCS7Options],
+    options: Iterable[pkcs7.PKCS7Options],
 ) -> bytes: ...
+def decrypt_der(
+    data: bytes,
+    certificate: x509.Certificate,
+    private_key: rsa.RSAPrivateKey,
+    options: Iterable[pkcs7.PKCS7Options],
+) -> bytes: ...
+def decrypt_pem(
+    data: bytes,
+    certificate: x509.Certificate,
+    private_key: rsa.RSAPrivateKey,
+    options: Iterable[pkcs7.PKCS7Options],
+) -> bytes: ...
+def decrypt_smime(
+    data: bytes,
+    certificate: x509.Certificate,
+    private_key: rsa.RSAPrivateKey,
+    options: Iterable[pkcs7.PKCS7Options],
+) -> bytes: ...
+def load_pem_pkcs7_certificates(
+    data: bytes,
+) -> list[x509.Certificate]: ...
+def load_der_pkcs7_certificates(
+    data: bytes,
+) -> list[x509.Certificate]: ...

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/bindings/_rust/test_support.pyi

@@ -0,0 +1,23 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+from cryptography import x509
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.serialization import pkcs7
+from cryptography.utils import Buffer
+
+class TestCertificate:
+    not_after_tag: int
+    not_before_tag: int
+    issuer_value_tags: list[int]
+    subject_value_tags: list[int]
+
+def test_parse_certificate(data: bytes) -> TestCertificate: ...
+def pkcs7_verify(
+    encoding: serialization.Encoding,
+    sig: bytes,
+    msg: Buffer | None,
+    certs: list[x509.Certificate],
+    options: list[pkcs7.PKCS7Options],
+) -> None: ...

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/bindings/_rust/x509.pyi

@@ -2,43 +2,300 @@
 # 2.0, and the BSD License. See the LICENSE file in the root of this repository
 # for complete details.
 
+import datetime
 import typing
+from collections.abc import Iterator
 
 from cryptography import x509
-from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric.ec import ECDSA
 from cryptography.hazmat.primitives.asymmetric.padding import PSS, PKCS1v15
-from cryptography.hazmat.primitives.asymmetric.types import PrivateKeyTypes
+from cryptography.hazmat.primitives.asymmetric.types import (
+    CertificateIssuerPublicKeyTypes,
+    CertificatePublicKeyTypes,
+    PrivateKeyTypes,
+)
+from cryptography.x509 import certificate_transparency
 
-def load_pem_x509_certificate(data: bytes) -> x509.Certificate: ...
+def load_pem_x509_certificate(
+    data: bytes, backend: typing.Any = None
+) -> x509.Certificate: ...
+def load_der_x509_certificate(
+    data: bytes, backend: typing.Any = None
+) -> x509.Certificate: ...
 def load_pem_x509_certificates(
     data: bytes,
-) -> typing.List[x509.Certificate]: ...
-def load_der_x509_certificate(data: bytes) -> x509.Certificate: ...
-def load_pem_x509_crl(data: bytes) -> x509.CertificateRevocationList: ...
-def load_der_x509_crl(data: bytes) -> x509.CertificateRevocationList: ...
-def load_pem_x509_csr(data: bytes) -> x509.CertificateSigningRequest: ...
-def load_der_x509_csr(data: bytes) -> x509.CertificateSigningRequest: ...
+) -> list[x509.Certificate]: ...
+def load_pem_x509_crl(
+    data: bytes, backend: typing.Any = None
+) -> x509.CertificateRevocationList: ...
+def load_der_x509_crl(
+    data: bytes, backend: typing.Any = None
+) -> x509.CertificateRevocationList: ...
+def load_pem_x509_csr(
+    data: bytes, backend: typing.Any = None
+) -> x509.CertificateSigningRequest: ...
+def load_der_x509_csr(
+    data: bytes, backend: typing.Any = None
+) -> x509.CertificateSigningRequest: ...
 def encode_name_bytes(name: x509.Name) -> bytes: ...
 def encode_extension_value(extension: x509.ExtensionType) -> bytes: ...
 def create_x509_certificate(
     builder: x509.CertificateBuilder,
     private_key: PrivateKeyTypes,
-    hash_algorithm: typing.Optional[hashes.HashAlgorithm],
-    padding: typing.Optional[typing.Union[PKCS1v15, PSS]],
+    hash_algorithm: hashes.HashAlgorithm | None,
+    rsa_padding: PKCS1v15 | PSS | None,
+    ecdsa_deterministic: bool | None,
 ) -> x509.Certificate: ...
 def create_x509_csr(
     builder: x509.CertificateSigningRequestBuilder,
     private_key: PrivateKeyTypes,
-    hash_algorithm: typing.Optional[hashes.HashAlgorithm],
+    hash_algorithm: hashes.HashAlgorithm | None,
+    rsa_padding: PKCS1v15 | PSS | None,
+    ecdsa_deterministic: bool | None,
 ) -> x509.CertificateSigningRequest: ...
 def create_x509_crl(
     builder: x509.CertificateRevocationListBuilder,
     private_key: PrivateKeyTypes,
-    hash_algorithm: typing.Optional[hashes.HashAlgorithm],
+    hash_algorithm: hashes.HashAlgorithm | None,
+    rsa_padding: PKCS1v15 | PSS | None,
+    ecdsa_deterministic: bool | None,
 ) -> x509.CertificateRevocationList: ...
 
-class Sct: ...
-class Certificate: ...
+class Sct:
+    @property
+    def version(self) -> certificate_transparency.Version: ...
+    @property
+    def log_id(self) -> bytes: ...
+    @property
+    def timestamp(self) -> datetime.datetime: ...
+    @property
+    def entry_type(self) -> certificate_transparency.LogEntryType: ...
+    @property
+    def signature_hash_algorithm(self) -> hashes.HashAlgorithm: ...
+    @property
+    def signature_algorithm(
+        self,
+    ) -> certificate_transparency.SignatureAlgorithm: ...
+    @property
+    def signature(self) -> bytes: ...
+    @property
+    def extension_bytes(self) -> bytes: ...
+
+class Certificate:
+    def fingerprint(self, algorithm: hashes.HashAlgorithm) -> bytes: ...
+    @property
+    def serial_number(self) -> int: ...
+    @property
+    def version(self) -> x509.Version: ...
+    def public_key(self) -> CertificatePublicKeyTypes: ...
+    @property
+    def public_key_algorithm_oid(self) -> x509.ObjectIdentifier: ...
+    @property
+    def not_valid_before(self) -> datetime.datetime: ...
+    @property
+    def not_valid_before_utc(self) -> datetime.datetime: ...
+    @property
+    def not_valid_after(self) -> datetime.datetime: ...
+    @property
+    def not_valid_after_utc(self) -> datetime.datetime: ...
+    @property
+    def issuer(self) -> x509.Name: ...
+    @property
+    def subject(self) -> x509.Name: ...
+    @property
+    def signature_hash_algorithm(
+        self,
+    ) -> hashes.HashAlgorithm | None: ...
+    @property
+    def signature_algorithm_oid(self) -> x509.ObjectIdentifier: ...
+    @property
+    def signature_algorithm_parameters(
+        self,
+    ) -> PSS | PKCS1v15 | ECDSA | None: ...
+    @property
+    def extensions(self) -> x509.Extensions: ...
+    @property
+    def signature(self) -> bytes: ...
+    @property
+    def tbs_certificate_bytes(self) -> bytes: ...
+    @property
+    def tbs_precertificate_bytes(self) -> bytes: ...
+    def __eq__(self, other: object) -> bool: ...
+    def __hash__(self) -> int: ...
+    def public_bytes(self, encoding: serialization.Encoding) -> bytes: ...
+    def verify_directly_issued_by(self, issuer: Certificate) -> None: ...
+
 class RevokedCertificate: ...
-class CertificateRevocationList: ...
-class CertificateSigningRequest: ...
+
+class CertificateRevocationList:
+    def public_bytes(self, encoding: serialization.Encoding) -> bytes: ...
+    def fingerprint(self, algorithm: hashes.HashAlgorithm) -> bytes: ...
+    def get_revoked_certificate_by_serial_number(
+        self, serial_number: int
+    ) -> x509.RevokedCertificate | None: ...
+    @property
+    def signature_hash_algorithm(
+        self,
+    ) -> hashes.HashAlgorithm | None: ...
+    @property
+    def signature_algorithm_oid(self) -> x509.ObjectIdentifier: ...
+    @property
+    def signature_algorithm_parameters(
+        self,
+    ) -> PSS | PKCS1v15 | ECDSA | None: ...
+    @property
+    def issuer(self) -> x509.Name: ...
+    @property
+    def next_update(self) -> datetime.datetime | None: ...
+    @property
+    def next_update_utc(self) -> datetime.datetime | None: ...
+    @property
+    def last_update(self) -> datetime.datetime: ...
+    @property
+    def last_update_utc(self) -> datetime.datetime: ...
+    @property
+    def extensions(self) -> x509.Extensions: ...
+    @property
+    def signature(self) -> bytes: ...
+    @property
+    def tbs_certlist_bytes(self) -> bytes: ...
+    def __eq__(self, other: object) -> bool: ...
+    def __len__(self) -> int: ...
+    @typing.overload
+    def __getitem__(self, idx: int) -> x509.RevokedCertificate: ...
+    @typing.overload
+    def __getitem__(self, idx: slice) -> list[x509.RevokedCertificate]: ...
+    def __iter__(self) -> Iterator[x509.RevokedCertificate]: ...
+    def is_signature_valid(
+        self, public_key: CertificateIssuerPublicKeyTypes
+    ) -> bool: ...
+
+class CertificateSigningRequest:
+    def __eq__(self, other: object) -> bool: ...
+    def __hash__(self) -> int: ...
+    def public_key(self) -> CertificatePublicKeyTypes: ...
+    @property
+    def subject(self) -> x509.Name: ...
+    @property
+    def signature_hash_algorithm(
+        self,
+    ) -> hashes.HashAlgorithm | None: ...
+    @property
+    def signature_algorithm_oid(self) -> x509.ObjectIdentifier: ...
+    @property
+    def signature_algorithm_parameters(
+        self,
+    ) -> PSS | PKCS1v15 | ECDSA | None: ...
+    @property
+    def extensions(self) -> x509.Extensions: ...
+    @property
+    def attributes(self) -> x509.Attributes: ...
+    def public_bytes(self, encoding: serialization.Encoding) -> bytes: ...
+    @property
+    def signature(self) -> bytes: ...
+    @property
+    def tbs_certrequest_bytes(self) -> bytes: ...
+    @property
+    def is_signature_valid(self) -> bool: ...
+
+class PolicyBuilder:
+    def time(self, time: datetime.datetime) -> PolicyBuilder: ...
+    def store(self, store: Store) -> PolicyBuilder: ...
+    def max_chain_depth(self, max_chain_depth: int) -> PolicyBuilder: ...
+    def extension_policies(
+        self, *, ca_policy: ExtensionPolicy, ee_policy: ExtensionPolicy
+    ) -> PolicyBuilder: ...
+    def build_client_verifier(self) -> ClientVerifier: ...
+    def build_server_verifier(
+        self, subject: x509.verification.Subject
+    ) -> ServerVerifier: ...
+
+class Policy:
+    @property
+    def max_chain_depth(self) -> int: ...
+    @property
+    def subject(self) -> x509.verification.Subject | None: ...
+    @property
+    def validation_time(self) -> datetime.datetime: ...
+    @property
+    def extended_key_usage(self) -> x509.ObjectIdentifier: ...
+    @property
+    def minimum_rsa_modulus(self) -> int: ...
+
+class Criticality:
+    CRITICAL: Criticality
+    AGNOSTIC: Criticality
+    NON_CRITICAL: Criticality
+
+T = typing.TypeVar("T", contravariant=True, bound=x509.ExtensionType)
+
+MaybeExtensionValidatorCallback = typing.Callable[
+    [
+        Policy,
+        x509.Certificate,
+        T | None,
+    ],
+    None,
+]
+
+PresentExtensionValidatorCallback = typing.Callable[
+    [Policy, x509.Certificate, T],
+    None,
+]
+
+class ExtensionPolicy:
+    @staticmethod
+    def permit_all() -> ExtensionPolicy: ...
+    @staticmethod
+    def webpki_defaults_ca() -> ExtensionPolicy: ...
+    @staticmethod
+    def webpki_defaults_ee() -> ExtensionPolicy: ...
+    def require_not_present(
+        self, extension_type: type[x509.ExtensionType]
+    ) -> ExtensionPolicy: ...
+    def may_be_present(
+        self,
+        extension_type: type[T],
+        criticality: Criticality,
+        validator: MaybeExtensionValidatorCallback[T] | None,
+    ) -> ExtensionPolicy: ...
+    def require_present(
+        self,
+        extension_type: type[T],
+        criticality: Criticality,
+        validator: PresentExtensionValidatorCallback[T] | None,
+    ) -> ExtensionPolicy: ...
+
+class VerifiedClient:
+    @property
+    def subjects(self) -> list[x509.GeneralName] | None: ...
+    @property
+    def chain(self) -> list[x509.Certificate]: ...
+
+class ClientVerifier:
+    @property
+    def policy(self) -> Policy: ...
+    @property
+    def store(self) -> Store: ...
+    def verify(
+        self,
+        leaf: x509.Certificate,
+        intermediates: list[x509.Certificate],
+    ) -> VerifiedClient: ...
+
+class ServerVerifier:
+    @property
+    def policy(self) -> Policy: ...
+    @property
+    def store(self) -> Store: ...
+    def verify(
+        self,
+        leaf: x509.Certificate,
+        intermediates: list[x509.Certificate],
+    ) -> list[x509.Certificate]: ...
+
+class Store:
+    def __init__(self, certs: list[x509.Certificate]) -> None: ...
+
+class VerificationError(Exception): ...

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/bindings/openssl/_conditional.py

@@ -4,17 +4,15 @@
 
 from __future__ import annotations
 
-import typing
 
-
-def cryptography_has_set_cert_cb() -> typing.List[str]:
+def cryptography_has_set_cert_cb() -> list[str]:
     return [
         "SSL_CTX_set_cert_cb",
         "SSL_set_cert_cb",
     ]
 
 
-def cryptography_has_ssl_st() -> typing.List[str]:
+def cryptography_has_ssl_st() -> list[str]:
     return [
         "SSL_ST_BEFORE",
         "SSL_ST_OK",
@@ -23,72 +21,20 @@ def cryptography_has_ssl_st() -> typing.List[str]:
     ]
 
 
-def cryptography_has_tls_st() -> typing.List[str]:
+def cryptography_has_tls_st() -> list[str]:
     return [
         "TLS_ST_BEFORE",
         "TLS_ST_OK",
     ]
 
 
-def cryptography_has_evp_pkey_dhx() -> typing.List[str]:
-    return [
-        "EVP_PKEY_DHX",
-    ]
-
-
-def cryptography_has_mem_functions() -> typing.List[str]:
-    return [
-        "Cryptography_CRYPTO_set_mem_functions",
-    ]
-
-
-def cryptography_has_x509_store_ctx_get_issuer() -> typing.List[str]:
-    return [
-        "X509_STORE_set_get_issuer",
-    ]
-
-
-def cryptography_has_ed448() -> typing.List[str]:
-    return [
-        "EVP_PKEY_ED448",
-        "NID_ED448",
-    ]
-
-
-def cryptography_has_ed25519() -> typing.List[str]:
-    return [
-        "NID_ED25519",
-        "EVP_PKEY_ED25519",
-    ]
-
-
-def cryptography_has_poly1305() -> typing.List[str]:
-    return [
-        "NID_poly1305",
-        "EVP_PKEY_POLY1305",
-    ]
-
-
-def cryptography_has_evp_digestfinal_xof() -> typing.List[str]:
-    return [
-        "EVP_DigestFinalXOF",
-    ]
-
-
-def cryptography_has_fips() -> typing.List[str]:
-    return [
-        "FIPS_mode_set",
-        "FIPS_mode",
-    ]
-
-
-def cryptography_has_ssl_sigalgs() -> typing.List[str]:
+def cryptography_has_ssl_sigalgs() -> list[str]:
     return [
         "SSL_CTX_set1_sigalgs_list",
     ]
 
 
-def cryptography_has_psk() -> typing.List[str]:
+def cryptography_has_psk() -> list[str]:
     return [
         "SSL_CTX_use_psk_identity_hint",
         "SSL_CTX_set_psk_server_callback",
@@ -96,7 +42,7 @@ def cryptography_has_psk() -> typing.List[str]:
     ]
 
 
-def cryptography_has_psk_tlsv13() -> typing.List[str]:
+def cryptography_has_psk_tlsv13() -> list[str]:
     return [
         "SSL_CTX_set_psk_find_session_callback",
         "SSL_CTX_set_psk_use_session_callback",
@@ -108,7 +54,7 @@ def cryptography_has_psk_tlsv13() -> typing.List[str]:
     ]
 
 
-def cryptography_has_custom_ext() -> typing.List[str]:
+def cryptography_has_custom_ext() -> list[str]:
     return [
         "SSL_CTX_add_client_custom_ext",
         "SSL_CTX_add_server_custom_ext",
@@ -116,10 +62,15 @@ def cryptography_has_custom_ext() -> typing.List[str]:
     ]
 
 
-def cryptography_has_tlsv13_functions() -> typing.List[str]:
+def cryptography_has_tlsv13_functions() -> list[str]:
+    return [
+        "SSL_CTX_set_ciphersuites",
+    ]
+
+
+def cryptography_has_tlsv13_hs_functions() -> list[str]:
     return [
         "SSL_VERIFY_POST_HANDSHAKE",
-        "SSL_CTX_set_ciphersuites",
         "SSL_verify_client_post_handshake",
         "SSL_CTX_set_post_handshake_auth",
         "SSL_set_post_handshake_auth",
@@ -130,16 +81,13 @@ def cryptography_has_tlsv13_functions() -> typing.List[str]:
     ]
 
 
-def cryptography_has_raw_key() -> typing.List[str]:
+def cryptography_has_ssl_verify_client_post_handshake() -> list[str]:
     return [
-        "EVP_PKEY_new_raw_private_key",
-        "EVP_PKEY_new_raw_public_key",
-        "EVP_PKEY_get_raw_private_key",
-        "EVP_PKEY_get_raw_public_key",
+        "SSL_verify_client_post_handshake",
     ]
 
 
-def cryptography_has_engine() -> typing.List[str]:
+def cryptography_has_engine() -> list[str]:
     return [
         "ENGINE_by_id",
         "ENGINE_init",
@@ -158,13 +106,13 @@ def cryptography_has_engine() -> typing.List[str]:
     ]
 
 
-def cryptography_has_verified_chain() -> typing.List[str]:
+def cryptography_has_verified_chain() -> list[str]:
     return [
         "SSL_get0_verified_chain",
     ]
 
 
-def cryptography_has_srtp() -> typing.List[str]:
+def cryptography_has_srtp() -> list[str]:
     return [
         "SSL_CTX_set_tlsext_use_srtp",
         "SSL_set_tlsext_use_srtp",
@@ -172,36 +120,19 @@ def cryptography_has_srtp() -> typing.List[str]:
     ]
 
 
-def cryptography_has_providers() -> typing.List[str]:
-    return [
-        "OSSL_PROVIDER_load",
-        "OSSL_PROVIDER_unload",
-        "ERR_LIB_PROV",
-        "PROV_R_WRONG_FINAL_BLOCK_LENGTH",
-        "PROV_R_BAD_DECRYPT",
-    ]
-
-
-def cryptography_has_op_no_renegotiation() -> typing.List[str]:
+def cryptography_has_op_no_renegotiation() -> list[str]:
     return [
         "SSL_OP_NO_RENEGOTIATION",
     ]
 
 
-def cryptography_has_dtls_get_data_mtu() -> typing.List[str]:
+def cryptography_has_dtls_get_data_mtu() -> list[str]:
     return [
         "DTLS_get_data_mtu",
     ]
 
 
-def cryptography_has_300_fips() -> typing.List[str]:
-    return [
-        "EVP_default_properties_is_fips_enabled",
-        "EVP_default_properties_enable_fips",
-    ]
-
-
-def cryptography_has_ssl_cookie() -> typing.List[str]:
+def cryptography_has_ssl_cookie() -> list[str]:
     return [
         "SSL_OP_COOKIE_EXCHANGE",
         "DTLSv1_listen",
@@ -210,67 +141,28 @@ def cryptography_has_ssl_cookie() -> typing.List[str]:
     ]
 
 
-def cryptography_has_pkcs7_funcs() -> typing.List[str]:
+def cryptography_has_prime_checks() -> list[str]:
     return [
-        "SMIME_write_PKCS7",
-        "PEM_write_bio_PKCS7_stream",
-        "PKCS7_sign_add_signer",
-        "PKCS7_final",
-        "PKCS7_verify",
-        "SMIME_read_PKCS7",
-        "PKCS7_get0_signers",
-    ]
-
-
-def cryptography_has_bn_flags() -> typing.List[str]:
-    return [
-        "BN_FLG_CONSTTIME",
-        "BN_set_flags",
         "BN_prime_checks_for_size",
     ]
 
 
-def cryptography_has_evp_pkey_dh() -> typing.List[str]:
-    return [
-        "EVP_PKEY_set1_DH",
-    ]
-
-
-def cryptography_has_300_evp_cipher() -> typing.List[str]:
-    return ["EVP_CIPHER_fetch", "EVP_CIPHER_free"]
-
-
-def cryptography_has_unexpected_eof_while_reading() -> typing.List[str]:
+def cryptography_has_unexpected_eof_while_reading() -> list[str]:
     return ["SSL_R_UNEXPECTED_EOF_WHILE_READING"]
 
 
-def cryptography_has_pkcs12_set_mac() -> typing.List[str]:
-    return ["PKCS12_set_mac"]
-
-
-def cryptography_has_ssl_op_ignore_unexpected_eof() -> typing.List[str]:
+def cryptography_has_ssl_op_ignore_unexpected_eof() -> list[str]:
     return [
         "SSL_OP_IGNORE_UNEXPECTED_EOF",
     ]
 
 
-def cryptography_has_get_extms_support() -> typing.List[str]:
+def cryptography_has_get_extms_support() -> list[str]:
     return ["SSL_get_extms_support"]
 
 
-def cryptography_has_evp_pkey_set_peer_ex() -> typing.List[str]:
-    return ["EVP_PKEY_derive_set_peer_ex"]
-
-
-def cryptography_has_evp_aead() -> typing.List[str]:
-    return [
-        "EVP_aead_chacha20_poly1305",
-        "EVP_AEAD_CTX_free",
-        "EVP_AEAD_CTX_seal",
-        "EVP_AEAD_CTX_open",
-        "EVP_AEAD_max_overhead",
-        "Cryptography_EVP_AEAD_CTX_new",
-    ]
+def cryptography_has_ssl_get0_group_name() -> list[str]:
+    return ["SSL_get0_group_name"]
 
 
 # This is a mapping of
@@ -282,48 +174,34 @@ CONDITIONAL_NAMES = {
     "Cryptography_HAS_SET_CERT_CB": cryptography_has_set_cert_cb,
     "Cryptography_HAS_SSL_ST": cryptography_has_ssl_st,
     "Cryptography_HAS_TLS_ST": cryptography_has_tls_st,
-    "Cryptography_HAS_EVP_PKEY_DHX": cryptography_has_evp_pkey_dhx,
-    "Cryptography_HAS_MEM_FUNCTIONS": cryptography_has_mem_functions,
-    "Cryptography_HAS_X509_STORE_CTX_GET_ISSUER": (
-        cryptography_has_x509_store_ctx_get_issuer
-    ),
-    "Cryptography_HAS_ED448": cryptography_has_ed448,
-    "Cryptography_HAS_ED25519": cryptography_has_ed25519,
-    "Cryptography_HAS_POLY1305": cryptography_has_poly1305,
-    "Cryptography_HAS_FIPS": cryptography_has_fips,
     "Cryptography_HAS_SIGALGS": cryptography_has_ssl_sigalgs,
     "Cryptography_HAS_PSK": cryptography_has_psk,
     "Cryptography_HAS_PSK_TLSv1_3": cryptography_has_psk_tlsv13,
     "Cryptography_HAS_CUSTOM_EXT": cryptography_has_custom_ext,
     "Cryptography_HAS_TLSv1_3_FUNCTIONS": cryptography_has_tlsv13_functions,
-    "Cryptography_HAS_RAW_KEY": cryptography_has_raw_key,
-    "Cryptography_HAS_EVP_DIGESTFINAL_XOF": (
-        cryptography_has_evp_digestfinal_xof
+    "Cryptography_HAS_TLSv1_3_HS_FUNCTIONS": (
+        cryptography_has_tlsv13_hs_functions
+    ),
+    "Cryptography_HAS_SSL_VERIFY_CLIENT_POST_HANDSHAKE": (
+        cryptography_has_ssl_verify_client_post_handshake
     ),
     "Cryptography_HAS_ENGINE": cryptography_has_engine,
     "Cryptography_HAS_VERIFIED_CHAIN": cryptography_has_verified_chain,
     "Cryptography_HAS_SRTP": cryptography_has_srtp,
-    "Cryptography_HAS_PROVIDERS": cryptography_has_providers,
     "Cryptography_HAS_OP_NO_RENEGOTIATION": (
         cryptography_has_op_no_renegotiation
     ),
     "Cryptography_HAS_DTLS_GET_DATA_MTU": cryptography_has_dtls_get_data_mtu,
-    "Cryptography_HAS_300_FIPS": cryptography_has_300_fips,
     "Cryptography_HAS_SSL_COOKIE": cryptography_has_ssl_cookie,
-    "Cryptography_HAS_PKCS7_FUNCS": cryptography_has_pkcs7_funcs,
-    "Cryptography_HAS_BN_FLAGS": cryptography_has_bn_flags,
-    "Cryptography_HAS_EVP_PKEY_DH": cryptography_has_evp_pkey_dh,
-    "Cryptography_HAS_300_EVP_CIPHER": cryptography_has_300_evp_cipher,
+    "Cryptography_HAS_PRIME_CHECKS": cryptography_has_prime_checks,
     "Cryptography_HAS_UNEXPECTED_EOF_WHILE_READING": (
         cryptography_has_unexpected_eof_while_reading
     ),
-    "Cryptography_HAS_PKCS12_SET_MAC": cryptography_has_pkcs12_set_mac,
     "Cryptography_HAS_SSL_OP_IGNORE_UNEXPECTED_EOF": (
         cryptography_has_ssl_op_ignore_unexpected_eof
     ),
     "Cryptography_HAS_GET_EXTMS_SUPPORT": cryptography_has_get_extms_support,
-    "Cryptography_HAS_EVP_PKEY_SET_PEER_EX": (
-        cryptography_has_evp_pkey_set_peer_ex
+    "Cryptography_HAS_SSL_GET0_GROUP_NAME": (
+        cryptography_has_ssl_get0_group_name
     ),
-    "Cryptography_HAS_EVP_AEAD": (cryptography_has_evp_aead),
 }

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/bindings/openssl/binding.py

@@ -10,21 +10,18 @@ import threading
 import types
 import typing
 import warnings
+from collections.abc import Callable
 
 import cryptography
 from cryptography.exceptions import InternalError
 from cryptography.hazmat.bindings._rust import _openssl, openssl
 from cryptography.hazmat.bindings.openssl._conditional import CONDITIONAL_NAMES
+from cryptography.utils import CryptographyDeprecationWarning
 
 
-def _openssl_assert(
-    lib,
-    ok: bool,
-    errors: typing.Optional[typing.List[openssl.OpenSSLError]] = None,
-) -> None:
+def _openssl_assert(ok: bool) -> None:
     if not ok:
-        if errors is None:
-            errors = openssl.capture_error_stack()
+        errors = openssl.capture_error_stack()
 
         raise InternalError(
             "Unknown OpenSSL error. This error is commonly encountered when "
@@ -33,25 +30,14 @@ def _openssl_assert(
             "OpenSSL try disabling it before reporting a bug. Otherwise "
             "please file an issue at https://github.com/pyca/cryptography/"
             "issues with information on how to reproduce "
-            "this. ({!r})".format(errors),
+            f"this. ({errors!r})",
             errors,
         )
 
 
-def _legacy_provider_error(loaded: bool) -> None:
-    if not loaded:
-        raise RuntimeError(
-            "OpenSSL 3.0's legacy provider failed to load. This is a fatal "
-            "error by default, but cryptography supports running without "
-            "legacy algorithms by setting the environment variable "
-            "CRYPTOGRAPHY_OPENSSL_NO_LEGACY. If you did not expect this error,"
-            " you have likely made a mistake with your OpenSSL configuration."
-        )
-
-
 def build_conditional_library(
     lib: typing.Any,
-    conditional_names: typing.Dict[str, typing.Callable[[], typing.List[str]]],
+    conditional_names: dict[str, Callable[[], list[str]]],
 ) -> typing.Any:
     conditional_lib = types.ModuleType("lib")
     conditional_lib._original_lib = lib  # type: ignore[attr-defined]
@@ -72,33 +58,14 @@ class Binding:
     OpenSSL API wrapper.
     """
 
-    lib: typing.ClassVar = None
+    lib: typing.ClassVar[typing.Any] = None
     ffi = _openssl.ffi
     _lib_loaded = False
     _init_lock = threading.Lock()
-    _legacy_provider: typing.Any = ffi.NULL
-    _legacy_provider_loaded = False
-    _default_provider: typing.Any = ffi.NULL
 
     def __init__(self) -> None:
         self._ensure_ffi_initialized()
 
-    def _enable_fips(self) -> None:
-        # This function enables FIPS mode for OpenSSL 3.0.0 on installs that
-        # have the FIPS provider installed properly.
-        _openssl_assert(self.lib, self.lib.CRYPTOGRAPHY_OPENSSL_300_OR_GREATER)
-        self._base_provider = self.lib.OSSL_PROVIDER_load(
-            self.ffi.NULL, b"base"
-        )
-        _openssl_assert(self.lib, self._base_provider != self.ffi.NULL)
-        self.lib._fips_provider = self.lib.OSSL_PROVIDER_load(
-            self.ffi.NULL, b"fips"
-        )
-        _openssl_assert(self.lib, self.lib._fips_provider != self.ffi.NULL)
-
-        res = self.lib.EVP_default_properties_enable_fips(self.ffi.NULL, 1)
-        _openssl_assert(self.lib, res == 1)
-
     @classmethod
     def _ensure_ffi_initialized(cls) -> None:
         with cls._init_lock:
@@ -107,27 +74,6 @@ class Binding:
                     _openssl.lib, CONDITIONAL_NAMES
                 )
                 cls._lib_loaded = True
-                # As of OpenSSL 3.0.0 we must register a legacy cipher provider
-                # to get RC2 (needed for junk asymmetric private key
-                # serialization), RC4, Blowfish, IDEA, SEED, etc. These things
-                # are ugly legacy, but we aren't going to get rid of them
-                # any time soon.
-                if cls.lib.CRYPTOGRAPHY_OPENSSL_300_OR_GREATER:
-                    if not os.environ.get("CRYPTOGRAPHY_OPENSSL_NO_LEGACY"):
-                        cls._legacy_provider = cls.lib.OSSL_PROVIDER_load(
-                            cls.ffi.NULL, b"legacy"
-                        )
-                        cls._legacy_provider_loaded = (
-                            cls._legacy_provider != cls.ffi.NULL
-                        )
-                        _legacy_provider_error(cls._legacy_provider_loaded)
-
-                    cls._default_provider = cls.lib.OSSL_PROVIDER_load(
-                        cls.ffi.NULL, b"default"
-                    )
-                    _openssl_assert(
-                        cls.lib, cls._default_provider != cls.ffi.NULL
-                    )
 
     @classmethod
     def init_static_locks(cls) -> None:
@@ -151,13 +97,11 @@ def _verify_package_version(version: str) -> None:
             "shared object. This can happen if you have multiple copies of "
             "cryptography installed in your Python path. Please try creating "
             "a new virtual environment to resolve this issue. "
-            "Loaded python version: {}, shared object version: {}".format(
-                version, so_package_version
-            )
+            f"Loaded python version: {version}, "
+            f"shared object version: {so_package_version}"
         )
 
     _openssl_assert(
-        _openssl.lib,
         _openssl.lib.OpenSSL_version_num() == openssl.openssl_version(),
     )
 
@@ -177,3 +121,17 @@ if (
         UserWarning,
         stacklevel=2,
     )
+
+if (
+    not openssl.CRYPTOGRAPHY_IS_LIBRESSL
+    and not openssl.CRYPTOGRAPHY_IS_BORINGSSL
+    and not openssl.CRYPTOGRAPHY_IS_AWSLC
+    and not openssl.CRYPTOGRAPHY_OPENSSL_300_OR_GREATER
+):
+    warnings.warn(
+        "You are using OpenSSL < 3.0. Support for OpenSSL < 3.0 is deprecated "
+        "and will be removed in the next release. Please upgrade to OpenSSL "
+        "3.0 or later.",
+        CryptographyDeprecationWarning,
+        stacklevel=2,
+    )

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/decrepit/__init__.py

@@ -0,0 +1,5 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+from __future__ import annotations

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/decrepit/ciphers/__init__.py

@@ -0,0 +1,5 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+from __future__ import annotations

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/decrepit/ciphers/algorithms.py

@@ -0,0 +1,112 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+from __future__ import annotations
+
+from cryptography.hazmat.primitives._cipheralgorithm import (
+    BlockCipherAlgorithm,
+    CipherAlgorithm,
+    _verify_key_size,
+)
+
+
+class ARC4(CipherAlgorithm):
+    name = "RC4"
+    key_sizes = frozenset([40, 56, 64, 80, 128, 160, 192, 256])
+
+    def __init__(self, key: bytes):
+        self.key = _verify_key_size(self, key)
+
+    @property
+    def key_size(self) -> int:
+        return len(self.key) * 8
+
+
+class TripleDES(BlockCipherAlgorithm):
+    name = "3DES"
+    block_size = 64
+    key_sizes = frozenset([64, 128, 192])
+
+    def __init__(self, key: bytes):
+        if len(key) == 8:
+            key += key + key
+        elif len(key) == 16:
+            key += key[:8]
+        self.key = _verify_key_size(self, key)
+
+    @property
+    def key_size(self) -> int:
+        return len(self.key) * 8
+
+
+# Not actually supported, marker for tests
+class _DES:
+    key_size = 64
+
+
+class Blowfish(BlockCipherAlgorithm):
+    name = "Blowfish"
+    block_size = 64
+    key_sizes = frozenset(range(32, 449, 8))
+
+    def __init__(self, key: bytes):
+        self.key = _verify_key_size(self, key)
+
+    @property
+    def key_size(self) -> int:
+        return len(self.key) * 8
+
+
+class CAST5(BlockCipherAlgorithm):
+    name = "CAST5"
+    block_size = 64
+    key_sizes = frozenset(range(40, 129, 8))
+
+    def __init__(self, key: bytes):
+        self.key = _verify_key_size(self, key)
+
+    @property
+    def key_size(self) -> int:
+        return len(self.key) * 8
+
+
+class SEED(BlockCipherAlgorithm):
+    name = "SEED"
+    block_size = 128
+    key_sizes = frozenset([128])
+
+    def __init__(self, key: bytes):
+        self.key = _verify_key_size(self, key)
+
+    @property
+    def key_size(self) -> int:
+        return len(self.key) * 8
+
+
+class IDEA(BlockCipherAlgorithm):
+    name = "IDEA"
+    block_size = 64
+    key_sizes = frozenset([128])
+
+    def __init__(self, key: bytes):
+        self.key = _verify_key_size(self, key)
+
+    @property
+    def key_size(self) -> int:
+        return len(self.key) * 8
+
+
+# This class only allows RC2 with a 128-bit key. No support for
+# effective key bits or other key sizes is provided.
+class RC2(BlockCipherAlgorithm):
+    name = "RC2"
+    block_size = 64
+    key_sizes = frozenset([128])
+
+    def __init__(self, key: bytes):
+        self.key = _verify_key_size(self, key)
+
+    @property
+    def key_size(self) -> int:
+        return len(self.key) * 8

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/primitives/_cipheralgorithm.py

@@ -5,7 +5,8 @@
 from __future__ import annotations
 
 import abc
-import typing
+
+from cryptography import utils
 
 # This exists to break an import cycle. It is normally accessible from the
 # ciphers module.
@@ -21,7 +22,7 @@ class CipherAlgorithm(metaclass=abc.ABCMeta):
 
     @property
     @abc.abstractmethod
-    def key_sizes(self) -> typing.FrozenSet[int]:
+    def key_sizes(self) -> frozenset[int]:
         """
         Valid key sizes for this algorithm in bits
         """
@@ -35,7 +36,7 @@ class CipherAlgorithm(metaclass=abc.ABCMeta):
 
 
 class BlockCipherAlgorithm(CipherAlgorithm):
-    key: bytes
+    key: utils.Buffer
 
     @property
     @abc.abstractmethod
@@ -43,3 +44,17 @@ class BlockCipherAlgorithm(CipherAlgorithm):
         """
         The size of a block as an integer in bits (e.g. 64, 128).
         """
+
+
+def _verify_key_size(
+    algorithm: CipherAlgorithm, key: utils.Buffer
+) -> utils.Buffer:
+    # Verify that the key is instance of bytes
+    utils._check_byteslike("key", key)
+
+    # Verify that the key size matches the expected key size
+    if len(key) * 8 not in algorithm.key_sizes:
+        raise ValueError(
+            f"Invalid key size ({len(key) * 8}) for {algorithm.name}."
+        )
+    return key

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/primitives/_serialization.py

@@ -5,7 +5,6 @@
 from __future__ import annotations
 
 import abc
-import typing
 
 from cryptography import utils
 from cryptography.hazmat.primitives.hashes import HashAlgorithm
@@ -78,9 +77,9 @@ class KeySerializationEncryptionBuilder:
         self,
         format: PrivateFormat,
         *,
-        _kdf_rounds: typing.Optional[int] = None,
-        _hmac_hash: typing.Optional[HashAlgorithm] = None,
-        _key_cert_algorithm: typing.Optional[PBES] = None,
+        _kdf_rounds: int | None = None,
+        _hmac_hash: HashAlgorithm | None = None,
+        _key_cert_algorithm: PBES | None = None,
     ) -> None:
         self._format = format
 
@@ -127,8 +126,7 @@ class KeySerializationEncryptionBuilder:
     ) -> KeySerializationEncryptionBuilder:
         if self._format is not PrivateFormat.PKCS12:
             raise TypeError(
-                "key_cert_algorithm only supported with "
-                "PrivateFormat.PKCS12"
+                "key_cert_algorithm only supported with PrivateFormat.PKCS12"
             )
         if self._key_cert_algorithm is not None:
             raise ValueError("key_cert_algorithm already set")
@@ -158,9 +156,9 @@ class _KeySerializationEncryption(KeySerializationEncryption):
         format: PrivateFormat,
         password: bytes,
         *,
-        kdf_rounds: typing.Optional[int],
-        hmac_hash: typing.Optional[HashAlgorithm],
-        key_cert_algorithm: typing.Optional[PBES],
+        kdf_rounds: int | None,
+        hmac_hash: HashAlgorithm | None,
+        key_cert_algorithm: PBES | None,
     ):
         self._format = format
         self.password = password

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/primitives/asymmetric/dh.py

@@ -5,142 +5,16 @@
 from __future__ import annotations
 
 import abc
-import typing
 
 from cryptography.hazmat.bindings._rust import openssl as rust_openssl
 from cryptography.hazmat.primitives import _serialization
 
-
-def generate_parameters(
-    generator: int, key_size: int, backend: typing.Any = None
-) -> DHParameters:
-    from cryptography.hazmat.backends.openssl.backend import backend as ossl
-
-    return ossl.generate_dh_parameters(generator, key_size)
+generate_parameters = rust_openssl.dh.generate_parameters
 
 
-class DHParameterNumbers:
-    def __init__(self, p: int, g: int, q: typing.Optional[int] = None) -> None:
-        if not isinstance(p, int) or not isinstance(g, int):
-            raise TypeError("p and g must be integers")
-        if q is not None and not isinstance(q, int):
-            raise TypeError("q must be integer or None")
-
-        if g < 2:
-            raise ValueError("DH generator must be 2 or greater")
-
-        if p.bit_length() < rust_openssl.dh.MIN_MODULUS_SIZE:
-            raise ValueError(
-                f"p (modulus) must be at least "
-                f"{rust_openssl.dh.MIN_MODULUS_SIZE}-bit"
-            )
-
-        self._p = p
-        self._g = g
-        self._q = q
-
-    def __eq__(self, other: object) -> bool:
-        if not isinstance(other, DHParameterNumbers):
-            return NotImplemented
-
-        return (
-            self._p == other._p and self._g == other._g and self._q == other._q
-        )
-
-    def parameters(self, backend: typing.Any = None) -> DHParameters:
-        from cryptography.hazmat.backends.openssl.backend import (
-            backend as ossl,
-        )
-
-        return ossl.load_dh_parameter_numbers(self)
-
-    @property
-    def p(self) -> int:
-        return self._p
-
-    @property
-    def g(self) -> int:
-        return self._g
-
-    @property
-    def q(self) -> typing.Optional[int]:
-        return self._q
-
-
-class DHPublicNumbers:
-    def __init__(self, y: int, parameter_numbers: DHParameterNumbers) -> None:
-        if not isinstance(y, int):
-            raise TypeError("y must be an integer.")
-
-        if not isinstance(parameter_numbers, DHParameterNumbers):
-            raise TypeError(
-                "parameters must be an instance of DHParameterNumbers."
-            )
-
-        self._y = y
-        self._parameter_numbers = parameter_numbers
-
-    def __eq__(self, other: object) -> bool:
-        if not isinstance(other, DHPublicNumbers):
-            return NotImplemented
-
-        return (
-            self._y == other._y
-            and self._parameter_numbers == other._parameter_numbers
-        )
-
-    def public_key(self, backend: typing.Any = None) -> DHPublicKey:
-        from cryptography.hazmat.backends.openssl.backend import (
-            backend as ossl,
-        )
-
-        return ossl.load_dh_public_numbers(self)
-
-    @property
-    def y(self) -> int:
-        return self._y
-
-    @property
-    def parameter_numbers(self) -> DHParameterNumbers:
-        return self._parameter_numbers
-
-
-class DHPrivateNumbers:
-    def __init__(self, x: int, public_numbers: DHPublicNumbers) -> None:
-        if not isinstance(x, int):
-            raise TypeError("x must be an integer.")
-
-        if not isinstance(public_numbers, DHPublicNumbers):
-            raise TypeError(
-                "public_numbers must be an instance of " "DHPublicNumbers."
-            )
-
-        self._x = x
-        self._public_numbers = public_numbers
-
-    def __eq__(self, other: object) -> bool:
-        if not isinstance(other, DHPrivateNumbers):
-            return NotImplemented
-
-        return (
-            self._x == other._x
-            and self._public_numbers == other._public_numbers
-        )
-
-    def private_key(self, backend: typing.Any = None) -> DHPrivateKey:
-        from cryptography.hazmat.backends.openssl.backend import (
-            backend as ossl,
-        )
-
-        return ossl.load_dh_private_numbers(self)
-
-    @property
-    def public_numbers(self) -> DHPublicNumbers:
-        return self._public_numbers
-
-    @property
-    def x(self) -> int:
-        return self._x
+DHPrivateNumbers = rust_openssl.dh.DHPrivateNumbers
+DHPublicNumbers = rust_openssl.dh.DHPublicNumbers
+DHParameterNumbers = rust_openssl.dh.DHParameterNumbers
 
 
 class DHParameters(metaclass=abc.ABCMeta):
@@ -207,6 +81,12 @@ class DHPublicKey(metaclass=abc.ABCMeta):
         Checks equality.
         """
 
+    @abc.abstractmethod
+    def __copy__(self) -> DHPublicKey:
+        """
+        Returns a copy.
+        """
+
 
 DHPublicKeyWithSerialization = DHPublicKey
 DHPublicKey.register(rust_openssl.dh.DHPublicKey)
@@ -256,6 +136,12 @@ class DHPrivateKey(metaclass=abc.ABCMeta):
         Returns the key serialized as bytes.
         """
 
+    @abc.abstractmethod
+    def __copy__(self) -> DHPrivateKey:
+        """
+        Returns a copy.
+        """
+
 
 DHPrivateKeyWithSerialization = DHPrivateKey
 DHPrivateKey.register(rust_openssl.dh.DHPrivateKey)

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/primitives/asymmetric/dsa.py

@@ -10,6 +10,7 @@ import typing
 from cryptography.hazmat.bindings._rust import openssl as rust_openssl
 from cryptography.hazmat.primitives import _serialization, hashes
 from cryptography.hazmat.primitives.asymmetric import utils as asym_utils
+from cryptography.utils import Buffer
 
 
 class DSAParameters(metaclass=abc.ABCMeta):
@@ -53,8 +54,8 @@ class DSAPrivateKey(metaclass=abc.ABCMeta):
     @abc.abstractmethod
     def sign(
         self,
-        data: bytes,
-        algorithm: typing.Union[asym_utils.Prehashed, hashes.HashAlgorithm],
+        data: Buffer,
+        algorithm: asym_utils.Prehashed | hashes.HashAlgorithm,
     ) -> bytes:
         """
         Signs the data
@@ -77,6 +78,12 @@ class DSAPrivateKey(metaclass=abc.ABCMeta):
         Returns the key serialized as bytes.
         """
 
+    @abc.abstractmethod
+    def __copy__(self) -> DSAPrivateKey:
+        """
+        Returns a copy.
+        """
+
 
 DSAPrivateKeyWithSerialization = DSAPrivateKey
 DSAPrivateKey.register(rust_openssl.dsa.DSAPrivateKey)
@@ -115,9 +122,9 @@ class DSAPublicKey(metaclass=abc.ABCMeta):
     @abc.abstractmethod
     def verify(
         self,
-        signature: bytes,
-        data: bytes,
-        algorithm: typing.Union[asym_utils.Prehashed, hashes.HashAlgorithm],
+        signature: Buffer,
+        data: Buffer,
+        algorithm: asym_utils.Prehashed | hashes.HashAlgorithm,
     ) -> None:
         """
         Verifies the signature of the data.
@@ -129,171 +136,32 @@ class DSAPublicKey(metaclass=abc.ABCMeta):
         Checks equality.
         """
 
+    @abc.abstractmethod
+    def __copy__(self) -> DSAPublicKey:
+        """
+        Returns a copy.
+        """
+
 
 DSAPublicKeyWithSerialization = DSAPublicKey
 DSAPublicKey.register(rust_openssl.dsa.DSAPublicKey)
 
-
-class DSAParameterNumbers:
-    def __init__(self, p: int, q: int, g: int):
-        if (
-            not isinstance(p, int)
-            or not isinstance(q, int)
-            or not isinstance(g, int)
-        ):
-            raise TypeError(
-                "DSAParameterNumbers p, q, and g arguments must be integers."
-            )
-
-        self._p = p
-        self._q = q
-        self._g = g
-
-    @property
-    def p(self) -> int:
-        return self._p
-
-    @property
-    def q(self) -> int:
-        return self._q
-
-    @property
-    def g(self) -> int:
-        return self._g
-
-    def parameters(self, backend: typing.Any = None) -> DSAParameters:
-        from cryptography.hazmat.backends.openssl.backend import (
-            backend as ossl,
-        )
-
-        return ossl.load_dsa_parameter_numbers(self)
-
-    def __eq__(self, other: object) -> bool:
-        if not isinstance(other, DSAParameterNumbers):
-            return NotImplemented
-
-        return self.p == other.p and self.q == other.q and self.g == other.g
-
-    def __repr__(self) -> str:
-        return (
-            "<DSAParameterNumbers(p={self.p}, q={self.q}, "
-            "g={self.g})>".format(self=self)
-        )
-
-
-class DSAPublicNumbers:
-    def __init__(self, y: int, parameter_numbers: DSAParameterNumbers):
-        if not isinstance(y, int):
-            raise TypeError("DSAPublicNumbers y argument must be an integer.")
-
-        if not isinstance(parameter_numbers, DSAParameterNumbers):
-            raise TypeError(
-                "parameter_numbers must be a DSAParameterNumbers instance."
-            )
-
-        self._y = y
-        self._parameter_numbers = parameter_numbers
-
-    @property
-    def y(self) -> int:
-        return self._y
-
-    @property
-    def parameter_numbers(self) -> DSAParameterNumbers:
-        return self._parameter_numbers
-
-    def public_key(self, backend: typing.Any = None) -> DSAPublicKey:
-        from cryptography.hazmat.backends.openssl.backend import (
-            backend as ossl,
-        )
-
-        return ossl.load_dsa_public_numbers(self)
-
-    def __eq__(self, other: object) -> bool:
-        if not isinstance(other, DSAPublicNumbers):
-            return NotImplemented
-
-        return (
-            self.y == other.y
-            and self.parameter_numbers == other.parameter_numbers
-        )
-
-    def __repr__(self) -> str:
-        return (
-            "<DSAPublicNumbers(y={self.y}, "
-            "parameter_numbers={self.parameter_numbers})>".format(self=self)
-        )
-
-
-class DSAPrivateNumbers:
-    def __init__(self, x: int, public_numbers: DSAPublicNumbers):
-        if not isinstance(x, int):
-            raise TypeError("DSAPrivateNumbers x argument must be an integer.")
-
-        if not isinstance(public_numbers, DSAPublicNumbers):
-            raise TypeError(
-                "public_numbers must be a DSAPublicNumbers instance."
-            )
-        self._public_numbers = public_numbers
-        self._x = x
-
-    @property
-    def x(self) -> int:
-        return self._x
-
-    @property
-    def public_numbers(self) -> DSAPublicNumbers:
-        return self._public_numbers
-
-    def private_key(self, backend: typing.Any = None) -> DSAPrivateKey:
-        from cryptography.hazmat.backends.openssl.backend import (
-            backend as ossl,
-        )
-
-        return ossl.load_dsa_private_numbers(self)
-
-    def __eq__(self, other: object) -> bool:
-        if not isinstance(other, DSAPrivateNumbers):
-            return NotImplemented
-
-        return (
-            self.x == other.x and self.public_numbers == other.public_numbers
-        )
+DSAPrivateNumbers = rust_openssl.dsa.DSAPrivateNumbers
+DSAPublicNumbers = rust_openssl.dsa.DSAPublicNumbers
+DSAParameterNumbers = rust_openssl.dsa.DSAParameterNumbers
 
 
 def generate_parameters(
     key_size: int, backend: typing.Any = None
 ) -> DSAParameters:
-    from cryptography.hazmat.backends.openssl.backend import backend as ossl
+    if key_size not in (1024, 2048, 3072, 4096):
+        raise ValueError("Key size must be 1024, 2048, 3072, or 4096 bits.")
 
-    return ossl.generate_dsa_parameters(key_size)
+    return rust_openssl.dsa.generate_parameters(key_size)
 
 
 def generate_private_key(
     key_size: int, backend: typing.Any = None
 ) -> DSAPrivateKey:
-    from cryptography.hazmat.backends.openssl.backend import backend as ossl
-
-    return ossl.generate_dsa_private_key_and_parameters(key_size)
-
-
-def _check_dsa_parameters(parameters: DSAParameterNumbers) -> None:
-    if parameters.p.bit_length() not in [1024, 2048, 3072, 4096]:
-        raise ValueError(
-            "p must be exactly 1024, 2048, 3072, or 4096 bits long"
-        )
-    if parameters.q.bit_length() not in [160, 224, 256]:
-        raise ValueError("q must be exactly 160, 224, or 256 bits long")
-
-    if not (1 < parameters.g < parameters.p):
-        raise ValueError("g, p don't satisfy 1 < g < p.")
-
-
-def _check_dsa_private_numbers(numbers: DSAPrivateNumbers) -> None:
-    parameters = numbers.public_numbers.parameter_numbers
-    _check_dsa_parameters(parameters)
-    if numbers.x <= 0 or numbers.x >= parameters.q:
-        raise ValueError("x must be > 0 and < q.")
-
-    if numbers.public_numbers.y != pow(parameters.g, numbers.x, parameters.p):
-        raise ValueError("y must be equal to (g ** x % p).")
+    parameters = generate_parameters(key_size)
+    return parameters.generate_private_key()

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/primitives/asymmetric/ec.py

@@ -8,7 +8,9 @@ import abc
 import typing
 
 from cryptography import utils
+from cryptography.exceptions import UnsupportedAlgorithm, _Reasons
 from cryptography.hazmat._oid import ObjectIdentifier
+from cryptography.hazmat.bindings._rust import openssl as rust_openssl
 from cryptography.hazmat.primitives import _serialization, hashes
 from cryptography.hazmat.primitives.asymmetric import utils as asym_utils
 
@@ -50,13 +52,20 @@ class EllipticCurve(metaclass=abc.ABCMeta):
         Bit size of a secret scalar for the curve.
         """
 
+    @property
+    @abc.abstractmethod
+    def group_order(self) -> int:
+        """
+        The order of the curve's group.
+        """
+
 
 class EllipticCurveSignatureAlgorithm(metaclass=abc.ABCMeta):
     @property
     @abc.abstractmethod
     def algorithm(
         self,
-    ) -> typing.Union[asym_utils.Prehashed, hashes.HashAlgorithm]:
+    ) -> asym_utils.Prehashed | hashes.HashAlgorithm:
         """
         The digest algorithm used with this signature.
         """
@@ -95,7 +104,7 @@ class EllipticCurvePrivateKey(metaclass=abc.ABCMeta):
     @abc.abstractmethod
     def sign(
         self,
-        data: bytes,
+        data: utils.Buffer,
         signature_algorithm: EllipticCurveSignatureAlgorithm,
     ) -> bytes:
         """
@@ -119,8 +128,15 @@ class EllipticCurvePrivateKey(metaclass=abc.ABCMeta):
         Returns the key serialized as bytes.
         """
 
+    @abc.abstractmethod
+    def __copy__(self) -> EllipticCurvePrivateKey:
+        """
+        Returns a copy.
+        """
+
 
 EllipticCurvePrivateKeyWithSerialization = EllipticCurvePrivateKey
+EllipticCurvePrivateKey.register(rust_openssl.ec.ECPrivateKey)
 
 
 class EllipticCurvePublicKey(metaclass=abc.ABCMeta):
@@ -157,8 +173,8 @@ class EllipticCurvePublicKey(metaclass=abc.ABCMeta):
     @abc.abstractmethod
     def verify(
         self,
-        signature: bytes,
-        data: bytes,
+        signature: utils.Buffer,
+        data: utils.Buffer,
         signature_algorithm: EllipticCurveSignatureAlgorithm,
     ) -> None:
         """
@@ -171,18 +187,13 @@ class EllipticCurvePublicKey(metaclass=abc.ABCMeta):
     ) -> EllipticCurvePublicKey:
         utils._check_bytes("data", data)
 
-        if not isinstance(curve, EllipticCurve):
-            raise TypeError("curve must be an EllipticCurve instance")
-
         if len(data) == 0:
             raise ValueError("data must not be an empty byte string")
 
         if data[0] not in [0x02, 0x03, 0x04]:
             raise ValueError("Unsupported elliptic curve point type")
 
-        from cryptography.hazmat.backends.openssl.backend import backend
-
-        return backend.load_elliptic_curve_public_bytes(curve, data)
+        return rust_openssl.ec.from_public_bytes(curve, data)
 
     @abc.abstractmethod
     def __eq__(self, other: object) -> bool:
@@ -190,150 +201,199 @@ class EllipticCurvePublicKey(metaclass=abc.ABCMeta):
         Checks equality.
         """
 
+    @abc.abstractmethod
+    def __copy__(self) -> EllipticCurvePublicKey:
+        """
+        Returns a copy.
+        """
+
 
 EllipticCurvePublicKeyWithSerialization = EllipticCurvePublicKey
+EllipticCurvePublicKey.register(rust_openssl.ec.ECPublicKey)
+
+EllipticCurvePrivateNumbers = rust_openssl.ec.EllipticCurvePrivateNumbers
+EllipticCurvePublicNumbers = rust_openssl.ec.EllipticCurvePublicNumbers
 
 
 class SECT571R1(EllipticCurve):
     name = "sect571r1"
     key_size = 570
+    group_order = 0x3FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE661CE18FF55987308059B186823851EC7DD9CA1161DE93D5174D66E8382E9BB2FE84E47  # noqa: E501
 
 
 class SECT409R1(EllipticCurve):
     name = "sect409r1"
     key_size = 409
+    group_order = 0x10000000000000000000000000000000000000000000000000001E2AAD6A612F33307BE5FA47C3C9E052F838164CD37D9A21173  # noqa: E501
 
 
 class SECT283R1(EllipticCurve):
     name = "sect283r1"
     key_size = 283
+    group_order = 0x3FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEF90399660FC938A90165B042A7CEFADB307  # noqa: E501
 
 
 class SECT233R1(EllipticCurve):
     name = "sect233r1"
     key_size = 233
+    group_order = 0x1000000000000000000000000000013E974E72F8A6922031D2603CFE0D7
 
 
 class SECT163R2(EllipticCurve):
     name = "sect163r2"
     key_size = 163
+    group_order = 0x40000000000000000000292FE77E70C12A4234C33
 
 
 class SECT571K1(EllipticCurve):
     name = "sect571k1"
     key_size = 571
+    group_order = 0x20000000000000000000000000000000000000000000000000000000000000000000000131850E1F19A63E4B391A8DB917F4138B630D84BE5D639381E91DEB45CFE778F637C1001  # noqa: E501
 
 
 class SECT409K1(EllipticCurve):
     name = "sect409k1"
     key_size = 409
+    group_order = 0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE5F83B2D4EA20400EC4557D5ED3E3E7CA5B4B5C83B8E01E5FCF  # noqa: E501
 
 
 class SECT283K1(EllipticCurve):
     name = "sect283k1"
     key_size = 283
+    group_order = 0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE9AE2ED07577265DFF7F94451E061E163C61  # noqa: E501
 
 
 class SECT233K1(EllipticCurve):
     name = "sect233k1"
     key_size = 233
+    group_order = 0x8000000000000000000000000000069D5BB915BCD46EFB1AD5F173ABDF
 
 
 class SECT163K1(EllipticCurve):
     name = "sect163k1"
     key_size = 163
+    group_order = 0x4000000000000000000020108A2E0CC0D99F8A5EF
 
 
 class SECP521R1(EllipticCurve):
     name = "secp521r1"
     key_size = 521
+    group_order = 0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409  # noqa: E501
 
 
 class SECP384R1(EllipticCurve):
     name = "secp384r1"
     key_size = 384
+    group_order = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973  # noqa: E501
 
 
 class SECP256R1(EllipticCurve):
     name = "secp256r1"
     key_size = 256
+    group_order = (
+        0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551
+    )
 
 
 class SECP256K1(EllipticCurve):
     name = "secp256k1"
     key_size = 256
+    group_order = (
+        0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
+    )
 
 
 class SECP224R1(EllipticCurve):
     name = "secp224r1"
     key_size = 224
+    group_order = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D
 
 
 class SECP192R1(EllipticCurve):
     name = "secp192r1"
     key_size = 192
+    group_order = 0xFFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22831
 
 
 class BrainpoolP256R1(EllipticCurve):
     name = "brainpoolP256r1"
     key_size = 256
+    group_order = (
+        0xA9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7
+    )
 
 
 class BrainpoolP384R1(EllipticCurve):
     name = "brainpoolP384r1"
     key_size = 384
+    group_order = 0x8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B31F166E6CAC0425A7CF3AB6AF6B7FC3103B883202E9046565  # noqa: E501
 
 
 class BrainpoolP512R1(EllipticCurve):
     name = "brainpoolP512r1"
     key_size = 512
+    group_order = 0xAADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA70330870553E5C414CA92619418661197FAC10471DB1D381085DDADDB58796829CA90069  # noqa: E501
 
 
-_CURVE_TYPES: typing.Dict[str, typing.Type[EllipticCurve]] = {
-    "prime192v1": SECP192R1,
-    "prime256v1": SECP256R1,
-    "secp192r1": SECP192R1,
-    "secp224r1": SECP224R1,
-    "secp256r1": SECP256R1,
-    "secp384r1": SECP384R1,
-    "secp521r1": SECP521R1,
-    "secp256k1": SECP256K1,
-    "sect163k1": SECT163K1,
-    "sect233k1": SECT233K1,
-    "sect283k1": SECT283K1,
-    "sect409k1": SECT409K1,
-    "sect571k1": SECT571K1,
-    "sect163r2": SECT163R2,
-    "sect233r1": SECT233R1,
-    "sect283r1": SECT283R1,
-    "sect409r1": SECT409R1,
-    "sect571r1": SECT571R1,
-    "brainpoolP256r1": BrainpoolP256R1,
-    "brainpoolP384r1": BrainpoolP384R1,
-    "brainpoolP512r1": BrainpoolP512R1,
+_CURVE_TYPES: dict[str, EllipticCurve] = {
+    "prime192v1": SECP192R1(),
+    "prime256v1": SECP256R1(),
+    "secp192r1": SECP192R1(),
+    "secp224r1": SECP224R1(),
+    "secp256r1": SECP256R1(),
+    "secp384r1": SECP384R1(),
+    "secp521r1": SECP521R1(),
+    "secp256k1": SECP256K1(),
+    "sect163k1": SECT163K1(),
+    "sect233k1": SECT233K1(),
+    "sect283k1": SECT283K1(),
+    "sect409k1": SECT409K1(),
+    "sect571k1": SECT571K1(),
+    "sect163r2": SECT163R2(),
+    "sect233r1": SECT233R1(),
+    "sect283r1": SECT283R1(),
+    "sect409r1": SECT409R1(),
+    "sect571r1": SECT571R1(),
+    "brainpoolP256r1": BrainpoolP256R1(),
+    "brainpoolP384r1": BrainpoolP384R1(),
+    "brainpoolP512r1": BrainpoolP512R1(),
 }
 
 
 class ECDSA(EllipticCurveSignatureAlgorithm):
     def __init__(
         self,
-        algorithm: typing.Union[asym_utils.Prehashed, hashes.HashAlgorithm],
+        algorithm: asym_utils.Prehashed | hashes.HashAlgorithm,
+        deterministic_signing: bool = False,
     ):
+        from cryptography.hazmat.backends.openssl.backend import backend
+
+        if (
+            deterministic_signing
+            and not backend.ecdsa_deterministic_supported()
+        ):
+            raise UnsupportedAlgorithm(
+                "ECDSA with deterministic signature (RFC 6979) is not "
+                "supported by this version of OpenSSL.",
+                _Reasons.UNSUPPORTED_PUBLIC_KEY_ALGORITHM,
+            )
         self._algorithm = algorithm
+        self._deterministic_signing = deterministic_signing
 
     @property
     def algorithm(
         self,
-    ) -> typing.Union[asym_utils.Prehashed, hashes.HashAlgorithm]:
+    ) -> asym_utils.Prehashed | hashes.HashAlgorithm:
         return self._algorithm
 
+    @property
+    def deterministic_signing(
+        self,
+    ) -> bool:
+        return self._deterministic_signing
 
-def generate_private_key(
-    curve: EllipticCurve, backend: typing.Any = None
-) -> EllipticCurvePrivateKey:
-    from cryptography.hazmat.backends.openssl.backend import backend as ossl
 
-    return ossl.generate_elliptic_curve_private_key(curve)
+generate_private_key = rust_openssl.ec.generate_private_key
 
 
 def derive_private_key(
@@ -341,116 +401,13 @@ def derive_private_key(
     curve: EllipticCurve,
     backend: typing.Any = None,
 ) -> EllipticCurvePrivateKey:
-    from cryptography.hazmat.backends.openssl.backend import backend as ossl
-
     if not isinstance(private_value, int):
         raise TypeError("private_value must be an integer type.")
 
     if private_value <= 0:
         raise ValueError("private_value must be a positive integer.")
 
-    if not isinstance(curve, EllipticCurve):
-        raise TypeError("curve must provide the EllipticCurve interface.")
-
-    return ossl.derive_elliptic_curve_private_key(private_value, curve)
-
-
-class EllipticCurvePublicNumbers:
-    def __init__(self, x: int, y: int, curve: EllipticCurve):
-        if not isinstance(x, int) or not isinstance(y, int):
-            raise TypeError("x and y must be integers.")
-
-        if not isinstance(curve, EllipticCurve):
-            raise TypeError("curve must provide the EllipticCurve interface.")
-
-        self._y = y
-        self._x = x
-        self._curve = curve
-
-    def public_key(self, backend: typing.Any = None) -> EllipticCurvePublicKey:
-        from cryptography.hazmat.backends.openssl.backend import (
-            backend as ossl,
-        )
-
-        return ossl.load_elliptic_curve_public_numbers(self)
-
-    @property
-    def curve(self) -> EllipticCurve:
-        return self._curve
-
-    @property
-    def x(self) -> int:
-        return self._x
-
-    @property
-    def y(self) -> int:
-        return self._y
-
-    def __eq__(self, other: object) -> bool:
-        if not isinstance(other, EllipticCurvePublicNumbers):
-            return NotImplemented
-
-        return (
-            self.x == other.x
-            and self.y == other.y
-            and self.curve.name == other.curve.name
-            and self.curve.key_size == other.curve.key_size
-        )
-
-    def __hash__(self) -> int:
-        return hash((self.x, self.y, self.curve.name, self.curve.key_size))
-
-    def __repr__(self) -> str:
-        return (
-            "<EllipticCurvePublicNumbers(curve={0.curve.name}, x={0.x}, "
-            "y={0.y}>".format(self)
-        )
-
-
-class EllipticCurvePrivateNumbers:
-    def __init__(
-        self, private_value: int, public_numbers: EllipticCurvePublicNumbers
-    ):
-        if not isinstance(private_value, int):
-            raise TypeError("private_value must be an integer.")
-
-        if not isinstance(public_numbers, EllipticCurvePublicNumbers):
-            raise TypeError(
-                "public_numbers must be an EllipticCurvePublicNumbers "
-                "instance."
-            )
-
-        self._private_value = private_value
-        self._public_numbers = public_numbers
-
-    def private_key(
-        self, backend: typing.Any = None
-    ) -> EllipticCurvePrivateKey:
-        from cryptography.hazmat.backends.openssl.backend import (
-            backend as ossl,
-        )
-
-        return ossl.load_elliptic_curve_private_numbers(self)
-
-    @property
-    def private_value(self) -> int:
-        return self._private_value
-
-    @property
-    def public_numbers(self) -> EllipticCurvePublicNumbers:
-        return self._public_numbers
-
-    def __eq__(self, other: object) -> bool:
-        if not isinstance(other, EllipticCurvePrivateNumbers):
-            return NotImplemented
-
-        return (
-            self.private_value == other.private_value
-            and self.public_numbers == other.public_numbers
-        )
-
-    def __hash__(self) -> int:
-        return hash((self.private_value, self.public_numbers))
+    return rust_openssl.ec.derive_private_key(private_value, curve)
 
 
 class ECDH:
@@ -480,7 +437,7 @@ _OID_TO_CURVE = {
 }
 
 
-def get_curve_for_oid(oid: ObjectIdentifier) -> typing.Type[EllipticCurve]:
+def get_curve_for_oid(oid: ObjectIdentifier) -> type[EllipticCurve]:
     try:
         return _OID_TO_CURVE[oid]
     except KeyError:

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/primitives/asymmetric/ed25519.py

@@ -9,6 +9,7 @@ import abc
 from cryptography.exceptions import UnsupportedAlgorithm, _Reasons
 from cryptography.hazmat.bindings._rust import openssl as rust_openssl
 from cryptography.hazmat.primitives import _serialization
+from cryptography.utils import Buffer
 
 
 class Ed25519PublicKey(metaclass=abc.ABCMeta):
@@ -22,7 +23,7 @@ class Ed25519PublicKey(metaclass=abc.ABCMeta):
                 _Reasons.UNSUPPORTED_PUBLIC_KEY_ALGORITHM,
             )
 
-        return backend.ed25519_load_public_bytes(data)
+        return rust_openssl.ed25519.from_public_bytes(data)
 
     @abc.abstractmethod
     def public_bytes(
@@ -42,7 +43,7 @@ class Ed25519PublicKey(metaclass=abc.ABCMeta):
         """
 
     @abc.abstractmethod
-    def verify(self, signature: bytes, data: bytes) -> None:
+    def verify(self, signature: Buffer, data: Buffer) -> None:
         """
         Verify the signature.
         """
@@ -53,9 +54,14 @@ class Ed25519PublicKey(metaclass=abc.ABCMeta):
         Checks equality.
         """
 
+    @abc.abstractmethod
+    def __copy__(self) -> Ed25519PublicKey:
+        """
+        Returns a copy.
+        """
 
-if hasattr(rust_openssl, "ed25519"):
-    Ed25519PublicKey.register(rust_openssl.ed25519.Ed25519PublicKey)
+
+Ed25519PublicKey.register(rust_openssl.ed25519.Ed25519PublicKey)
 
 
 class Ed25519PrivateKey(metaclass=abc.ABCMeta):
@@ -69,10 +75,10 @@ class Ed25519PrivateKey(metaclass=abc.ABCMeta):
                 _Reasons.UNSUPPORTED_PUBLIC_KEY_ALGORITHM,
             )
 
-        return backend.ed25519_generate_key()
+        return rust_openssl.ed25519.generate_key()
 
     @classmethod
-    def from_private_bytes(cls, data: bytes) -> Ed25519PrivateKey:
+    def from_private_bytes(cls, data: Buffer) -> Ed25519PrivateKey:
         from cryptography.hazmat.backends.openssl.backend import backend
 
         if not backend.ed25519_supported():
@@ -81,7 +87,7 @@ class Ed25519PrivateKey(metaclass=abc.ABCMeta):
                 _Reasons.UNSUPPORTED_PUBLIC_KEY_ALGORITHM,
             )
 
-        return backend.ed25519_load_private_bytes(data)
+        return rust_openssl.ed25519.from_private_bytes(data)
 
     @abc.abstractmethod
     def public_key(self) -> Ed25519PublicKey:
@@ -108,11 +114,16 @@ class Ed25519PrivateKey(metaclass=abc.ABCMeta):
         """
 
     @abc.abstractmethod
-    def sign(self, data: bytes) -> bytes:
+    def sign(self, data: Buffer) -> bytes:
         """
         Signs the data.
         """
 
+    @abc.abstractmethod
+    def __copy__(self) -> Ed25519PrivateKey:
+        """
+        Returns a copy.
+        """
 
-if hasattr(rust_openssl, "x25519"):
-    Ed25519PrivateKey.register(rust_openssl.ed25519.Ed25519PrivateKey)
+
+Ed25519PrivateKey.register(rust_openssl.ed25519.Ed25519PrivateKey)

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/primitives/asymmetric/ed448.py

@@ -9,6 +9,7 @@ import abc
 from cryptography.exceptions import UnsupportedAlgorithm, _Reasons
 from cryptography.hazmat.bindings._rust import openssl as rust_openssl
 from cryptography.hazmat.primitives import _serialization
+from cryptography.utils import Buffer
 
 
 class Ed448PublicKey(metaclass=abc.ABCMeta):
@@ -22,7 +23,7 @@ class Ed448PublicKey(metaclass=abc.ABCMeta):
                 _Reasons.UNSUPPORTED_PUBLIC_KEY_ALGORITHM,
             )
 
-        return backend.ed448_load_public_bytes(data)
+        return rust_openssl.ed448.from_public_bytes(data)
 
     @abc.abstractmethod
     def public_bytes(
@@ -42,7 +43,7 @@ class Ed448PublicKey(metaclass=abc.ABCMeta):
         """
 
     @abc.abstractmethod
-    def verify(self, signature: bytes, data: bytes) -> None:
+    def verify(self, signature: Buffer, data: Buffer) -> None:
         """
         Verify the signature.
         """
@@ -53,6 +54,12 @@ class Ed448PublicKey(metaclass=abc.ABCMeta):
         Checks equality.
         """
 
+    @abc.abstractmethod
+    def __copy__(self) -> Ed448PublicKey:
+        """
+        Returns a copy.
+        """
+
 
 if hasattr(rust_openssl, "ed448"):
     Ed448PublicKey.register(rust_openssl.ed448.Ed448PublicKey)
@@ -68,10 +75,11 @@ class Ed448PrivateKey(metaclass=abc.ABCMeta):
                 "ed448 is not supported by this version of OpenSSL.",
                 _Reasons.UNSUPPORTED_PUBLIC_KEY_ALGORITHM,
             )
-        return backend.ed448_generate_key()
+
+        return rust_openssl.ed448.generate_key()
 
     @classmethod
-    def from_private_bytes(cls, data: bytes) -> Ed448PrivateKey:
+    def from_private_bytes(cls, data: Buffer) -> Ed448PrivateKey:
         from cryptography.hazmat.backends.openssl.backend import backend
 
         if not backend.ed448_supported():
@@ -80,7 +88,7 @@ class Ed448PrivateKey(metaclass=abc.ABCMeta):
                 _Reasons.UNSUPPORTED_PUBLIC_KEY_ALGORITHM,
             )
 
-        return backend.ed448_load_private_bytes(data)
+        return rust_openssl.ed448.from_private_bytes(data)
 
     @abc.abstractmethod
     def public_key(self) -> Ed448PublicKey:
@@ -89,7 +97,7 @@ class Ed448PrivateKey(metaclass=abc.ABCMeta):
         """
 
     @abc.abstractmethod
-    def sign(self, data: bytes) -> bytes:
+    def sign(self, data: Buffer) -> bytes:
         """
         Signs the data.
         """
@@ -112,6 +120,12 @@ class Ed448PrivateKey(metaclass=abc.ABCMeta):
         Equivalent to private_bytes(Raw, Raw, NoEncryption()).
         """
 
+    @abc.abstractmethod
+    def __copy__(self) -> Ed448PrivateKey:
+        """
+        Returns a copy.
+        """
+
 
 if hasattr(rust_openssl, "x448"):
     Ed448PrivateKey.register(rust_openssl.ed448.Ed448PrivateKey)

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/primitives/asymmetric/padding.py

@@ -5,7 +5,6 @@
 from __future__ import annotations
 
 import abc
-import typing
 
 from cryptography.hazmat.primitives import hashes
 from cryptography.hazmat.primitives._asymmetric import (
@@ -35,12 +34,12 @@ class PSS(AsymmetricPadding):
     AUTO = _Auto()
     DIGEST_LENGTH = _DigestLength()
     name = "EMSA-PSS"
-    _salt_length: typing.Union[int, _MaxLength, _Auto, _DigestLength]
+    _salt_length: int | _MaxLength | _Auto | _DigestLength
 
     def __init__(
         self,
         mgf: MGF,
-        salt_length: typing.Union[int, _MaxLength, _Auto, _DigestLength],
+        salt_length: int | _MaxLength | _Auto | _DigestLength,
     ) -> None:
         self._mgf = mgf
 
@@ -57,6 +56,10 @@ class PSS(AsymmetricPadding):
 
         self._salt_length = salt_length
 
+    @property
+    def mgf(self) -> MGF:
+        return self._mgf
+
 
 class OAEP(AsymmetricPadding):
     name = "EME-OAEP"
@@ -65,7 +68,7 @@ class OAEP(AsymmetricPadding):
         self,
         mgf: MGF,
         algorithm: hashes.HashAlgorithm,
-        label: typing.Optional[bytes],
+        label: bytes | None,
     ):
         if not isinstance(algorithm, hashes.HashAlgorithm):
             raise TypeError("Expected instance of hashes.HashAlgorithm.")
@@ -74,14 +77,20 @@ class OAEP(AsymmetricPadding):
         self._algorithm = algorithm
         self._label = label
 
+    @property
+    def algorithm(self) -> hashes.HashAlgorithm:
+        return self._algorithm
+
+    @property
+    def mgf(self) -> MGF:
+        return self._mgf
+
 
 class MGF(metaclass=abc.ABCMeta):
     _algorithm: hashes.HashAlgorithm
 
 
 class MGF1(MGF):
-    MAX_LENGTH = _MaxLength()
-
     def __init__(self, algorithm: hashes.HashAlgorithm):
         if not isinstance(algorithm, hashes.HashAlgorithm):
             raise TypeError("Expected instance of hashes.HashAlgorithm.")
@@ -90,7 +99,7 @@ class MGF1(MGF):
 
 
 def calculate_max_pss_salt_length(
-    key: typing.Union[rsa.RSAPrivateKey, rsa.RSAPublicKey],
+    key: rsa.RSAPrivateKey | rsa.RSAPublicKey,
     hash_algorithm: hashes.HashAlgorithm,
 ) -> int:
     if not isinstance(key, (rsa.RSAPrivateKey, rsa.RSAPublicKey)):

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/primitives/asymmetric/rsa.py

@@ -5,9 +5,11 @@
 from __future__ import annotations
 
 import abc
+import random
 import typing
 from math import gcd
 
+from cryptography.hazmat.bindings._rust import openssl as rust_openssl
 from cryptography.hazmat.primitives import _serialization, hashes
 from cryptography.hazmat.primitives._asymmetric import AsymmetricPadding
 from cryptography.hazmat.primitives.asymmetric import utils as asym_utils
@@ -38,7 +40,7 @@ class RSAPrivateKey(metaclass=abc.ABCMeta):
         self,
         data: bytes,
         padding: AsymmetricPadding,
-        algorithm: typing.Union[asym_utils.Prehashed, hashes.HashAlgorithm],
+        algorithm: asym_utils.Prehashed | hashes.HashAlgorithm,
     ) -> bytes:
         """
         Signs the data.
@@ -61,8 +63,15 @@ class RSAPrivateKey(metaclass=abc.ABCMeta):
         Returns the key serialized as bytes.
         """
 
+    @abc.abstractmethod
+    def __copy__(self) -> RSAPrivateKey:
+        """
+        Returns a copy.
+        """
+
 
 RSAPrivateKeyWithSerialization = RSAPrivateKey
+RSAPrivateKey.register(rust_openssl.rsa.RSAPrivateKey)
 
 
 class RSAPublicKey(metaclass=abc.ABCMeta):
@@ -101,7 +110,7 @@ class RSAPublicKey(metaclass=abc.ABCMeta):
         signature: bytes,
         data: bytes,
         padding: AsymmetricPadding,
-        algorithm: typing.Union[asym_utils.Prehashed, hashes.HashAlgorithm],
+        algorithm: asym_utils.Prehashed | hashes.HashAlgorithm,
     ) -> None:
         """
         Verifies the signature of the data.
@@ -112,7 +121,7 @@ class RSAPublicKey(metaclass=abc.ABCMeta):
         self,
         signature: bytes,
         padding: AsymmetricPadding,
-        algorithm: typing.Optional[hashes.HashAlgorithm],
+        algorithm: hashes.HashAlgorithm | None,
     ) -> bytes:
         """
         Recovers the original data from the signature.
@@ -124,8 +133,18 @@ class RSAPublicKey(metaclass=abc.ABCMeta):
         Checks equality.
         """
 
+    @abc.abstractmethod
+    def __copy__(self) -> RSAPublicKey:
+        """
+        Returns a copy.
+        """
+
 
 RSAPublicKeyWithSerialization = RSAPublicKey
+RSAPublicKey.register(rust_openssl.rsa.RSAPublicKey)
+
+RSAPrivateNumbers = rust_openssl.rsa.RSAPrivateNumbers
+RSAPublicNumbers = rust_openssl.rsa.RSAPublicNumbers
 
 
 def generate_private_key(
@@ -133,10 +152,8 @@ def generate_private_key(
     key_size: int,
     backend: typing.Any = None,
 ) -> RSAPrivateKey:
-    from cryptography.hazmat.backends.openssl.backend import backend as ossl
-
     _verify_rsa_parameters(public_exponent, key_size)
-    return ossl.generate_rsa_private_key(public_exponent, key_size)
+    return rust_openssl.rsa.generate_private_key(public_exponent, key_size)
 
 
 def _verify_rsa_parameters(public_exponent: int, key_size: int) -> None:
@@ -146,66 +163,8 @@ def _verify_rsa_parameters(public_exponent: int, key_size: int) -> None:
             "65537. Almost everyone should choose 65537 here!"
         )
 
-    if key_size < 512:
-        raise ValueError("key_size must be at least 512-bits.")
-
-
-def _check_private_key_components(
-    p: int,
-    q: int,
-    private_exponent: int,
-    dmp1: int,
-    dmq1: int,
-    iqmp: int,
-    public_exponent: int,
-    modulus: int,
-) -> None:
-    if modulus < 3:
-        raise ValueError("modulus must be >= 3.")
-
-    if p >= modulus:
-        raise ValueError("p must be < modulus.")
-
-    if q >= modulus:
-        raise ValueError("q must be < modulus.")
-
-    if dmp1 >= modulus:
-        raise ValueError("dmp1 must be < modulus.")
-
-    if dmq1 >= modulus:
-        raise ValueError("dmq1 must be < modulus.")
-
-    if iqmp >= modulus:
-        raise ValueError("iqmp must be < modulus.")
-
-    if private_exponent >= modulus:
-        raise ValueError("private_exponent must be < modulus.")
-
-    if public_exponent < 3 or public_exponent >= modulus:
-        raise ValueError("public_exponent must be >= 3 and < modulus.")
-
-    if public_exponent & 1 == 0:
-        raise ValueError("public_exponent must be odd.")
-
-    if dmp1 & 1 == 0:
-        raise ValueError("dmp1 must be odd.")
-
-    if dmq1 & 1 == 0:
-        raise ValueError("dmq1 must be odd.")
-
-    if p * q != modulus:
-        raise ValueError("p*q must equal modulus.")
-
-
-def _check_public_key_components(e: int, n: int) -> None:
-    if n < 3:
-        raise ValueError("n must be >= 3.")
-
-    if e < 3 or e >= n:
-        raise ValueError("e must be >= 3 and < n.")
-
-    if e & 1 == 0:
-        raise ValueError("e must be odd.")
+    if key_size < 1024:
+        raise ValueError("key_size must be at least 1024-bits.")
 
 
 def _modinv(e: int, m: int) -> int:
@@ -225,6 +184,8 @@ def rsa_crt_iqmp(p: int, q: int) -> int:
     """
     Compute the CRT (q ** -1) % p value from RSA primes p and q.
     """
+    if p <= 1 or q <= 1:
+        raise ValueError("Values can't be <= 1")
     return _modinv(q, p)
 
 
@@ -233,6 +194,8 @@ def rsa_crt_dmp1(private_exponent: int, p: int) -> int:
     Compute the CRT private_exponent % (p - 1) value from the RSA
     private_exponent (d) and p.
     """
+    if private_exponent <= 1 or p <= 1:
+        raise ValueError("Values can't be <= 1")
     return private_exponent % (p - 1)
 
 
@@ -241,22 +204,49 @@ def rsa_crt_dmq1(private_exponent: int, q: int) -> int:
     Compute the CRT private_exponent % (q - 1) value from the RSA
     private_exponent (d) and q.
     """
+    if private_exponent <= 1 or q <= 1:
+        raise ValueError("Values can't be <= 1")
     return private_exponent % (q - 1)
 
 
+def rsa_recover_private_exponent(e: int, p: int, q: int) -> int:
+    """
+    Compute the RSA private_exponent (d) given the public exponent (e)
+    and the RSA primes p and q.
+
+    This uses the Carmichael totient function to generate the
+    smallest possible working value of the private exponent.
+    """
+    # This lambda_n is the Carmichael totient function.
+    # The original RSA paper uses the Euler totient function
+    # here: phi_n = (p - 1) * (q - 1)
+    # Either version of the private exponent will work, but the
+    # one generated by the older formulation may be larger
+    # than necessary. (lambda_n always divides phi_n)
+    #
+    # TODO: Replace with lcm(p - 1, q - 1) once the minimum
+    # supported Python version is >= 3.9.
+    if e <= 1 or p <= 1 or q <= 1:
+        raise ValueError("Values can't be <= 1")
+    lambda_n = (p - 1) * (q - 1) // gcd(p - 1, q - 1)
+    return _modinv(e, lambda_n)
+
+
 # Controls the number of iterations rsa_recover_prime_factors will perform
-# to obtain the prime factors. Each iteration increments by 2 so the actual
-# maximum attempts is half this number.
-_MAX_RECOVERY_ATTEMPTS = 1000
+# to obtain the prime factors.
+_MAX_RECOVERY_ATTEMPTS = 500
 
 
-def rsa_recover_prime_factors(
-    n: int, e: int, d: int
-) -> typing.Tuple[int, int]:
+def rsa_recover_prime_factors(n: int, e: int, d: int) -> tuple[int, int]:
     """
     Compute factors p and q from the private exponent d. We assume that n has
     no more than two factors. This function is adapted from code in PyCrypto.
     """
+    # reject invalid values early
+    if d <= 1 or e <= 1:
+        raise ValueError("d, e can't be <= 1")
+    if 17 != pow(17, e * d, n):
+        raise ValueError("n, d, e don't match")
     # See 8.2.2(i) in Handbook of Applied Cryptography.
     ktot = d * e - 1
     # The quantity d*e-1 is a multiple of phi(n), even,
@@ -270,8 +260,10 @@ def rsa_recover_prime_factors(
     # See "Digitalized Signatures and Public Key Functions as Intractable
     # as Factorization", M. Rabin, 1979
     spotted = False
-    a = 2
-    while not spotted and a < _MAX_RECOVERY_ATTEMPTS:
+    tries = 0
+    while not spotted and tries < _MAX_RECOVERY_ATTEMPTS:
+        a = random.randint(2, n - 1)
+        tries += 1
         k = t
         # Cycle through all values a^{t*2^i}=a^k
         while k < ktot:
@@ -284,8 +276,6 @@ def rsa_recover_prime_factors(
                 spotted = True
                 break
             k *= 2
-        # This value was not any good... let's try another!
-        a += 2
     if not spotted:
         raise ValueError("Unable to compute factors p and q from exponent d.")
     # Found !
@@ -293,147 +283,3 @@ def rsa_recover_prime_factors(
     assert r == 0
     p, q = sorted((p, q), reverse=True)
     return (p, q)
-
-
-class RSAPrivateNumbers:
-    def __init__(
-        self,
-        p: int,
-        q: int,
-        d: int,
-        dmp1: int,
-        dmq1: int,
-        iqmp: int,
-        public_numbers: RSAPublicNumbers,
-    ):
-        if (
-            not isinstance(p, int)
-            or not isinstance(q, int)
-            or not isinstance(d, int)
-            or not isinstance(dmp1, int)
-            or not isinstance(dmq1, int)
-            or not isinstance(iqmp, int)
-        ):
-            raise TypeError(
-                "RSAPrivateNumbers p, q, d, dmp1, dmq1, iqmp arguments must"
-                " all be an integers."
-            )
-
-        if not isinstance(public_numbers, RSAPublicNumbers):
-            raise TypeError(
-                "RSAPrivateNumbers public_numbers must be an RSAPublicNumbers"
-                " instance."
-            )
-
-        self._p = p
-        self._q = q
-        self._d = d
-        self._dmp1 = dmp1
-        self._dmq1 = dmq1
-        self._iqmp = iqmp
-        self._public_numbers = public_numbers
-
-    @property
-    def p(self) -> int:
-        return self._p
-
-    @property
-    def q(self) -> int:
-        return self._q
-
-    @property
-    def d(self) -> int:
-        return self._d
-
-    @property
-    def dmp1(self) -> int:
-        return self._dmp1
-
-    @property
-    def dmq1(self) -> int:
-        return self._dmq1
-
-    @property
-    def iqmp(self) -> int:
-        return self._iqmp
-
-    @property
-    def public_numbers(self) -> RSAPublicNumbers:
-        return self._public_numbers
-
-    def private_key(
-        self,
-        backend: typing.Any = None,
-        *,
-        unsafe_skip_rsa_key_validation: bool = False,
-    ) -> RSAPrivateKey:
-        from cryptography.hazmat.backends.openssl.backend import (
-            backend as ossl,
-        )
-
-        return ossl.load_rsa_private_numbers(
-            self, unsafe_skip_rsa_key_validation
-        )
-
-    def __eq__(self, other: object) -> bool:
-        if not isinstance(other, RSAPrivateNumbers):
-            return NotImplemented
-
-        return (
-            self.p == other.p
-            and self.q == other.q
-            and self.d == other.d
-            and self.dmp1 == other.dmp1
-            and self.dmq1 == other.dmq1
-            and self.iqmp == other.iqmp
-            and self.public_numbers == other.public_numbers
-        )
-
-    def __hash__(self) -> int:
-        return hash(
-            (
-                self.p,
-                self.q,
-                self.d,
-                self.dmp1,
-                self.dmq1,
-                self.iqmp,
-                self.public_numbers,
-            )
-        )
-
-
-class RSAPublicNumbers:
-    def __init__(self, e: int, n: int):
-        if not isinstance(e, int) or not isinstance(n, int):
-            raise TypeError("RSAPublicNumbers arguments must be integers.")
-
-        self._e = e
-        self._n = n
-
-    @property
-    def e(self) -> int:
-        return self._e
-
-    @property
-    def n(self) -> int:
-        return self._n
-
-    def public_key(self, backend: typing.Any = None) -> RSAPublicKey:
-        from cryptography.hazmat.backends.openssl.backend import (
-            backend as ossl,
-        )
-
-        return ossl.load_rsa_public_numbers(self)
-
-    def __repr__(self) -> str:
-        return "<RSAPublicNumbers(e={0.e}, n={0.n})>".format(self)
-
-    def __eq__(self, other: object) -> bool:
-        if not isinstance(other, RSAPublicNumbers):
-            return NotImplemented
-
-        return self.e == other.e and self.n == other.n
-
-    def __hash__(self) -> int:
-        return hash((self.e, self.n))

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/primitives/asymmetric/x25519.py

@@ -9,6 +9,7 @@ import abc
 from cryptography.exceptions import UnsupportedAlgorithm, _Reasons
 from cryptography.hazmat.bindings._rust import openssl as rust_openssl
 from cryptography.hazmat.primitives import _serialization
+from cryptography.utils import Buffer
 
 
 class X25519PublicKey(metaclass=abc.ABCMeta):
@@ -22,7 +23,7 @@ class X25519PublicKey(metaclass=abc.ABCMeta):
                 _Reasons.UNSUPPORTED_EXCHANGE_ALGORITHM,
             )
 
-        return backend.x25519_load_public_bytes(data)
+        return rust_openssl.x25519.from_public_bytes(data)
 
     @abc.abstractmethod
     def public_bytes(
@@ -47,10 +48,14 @@ class X25519PublicKey(metaclass=abc.ABCMeta):
         Checks equality.
         """
 
+    @abc.abstractmethod
+    def __copy__(self) -> X25519PublicKey:
+        """
+        Returns a copy.
+        """
 
-# For LibreSSL
-if hasattr(rust_openssl, "x25519"):
-    X25519PublicKey.register(rust_openssl.x25519.X25519PublicKey)
+
+X25519PublicKey.register(rust_openssl.x25519.X25519PublicKey)
 
 
 class X25519PrivateKey(metaclass=abc.ABCMeta):
@@ -63,10 +68,10 @@ class X25519PrivateKey(metaclass=abc.ABCMeta):
                 "X25519 is not supported by this version of OpenSSL.",
                 _Reasons.UNSUPPORTED_EXCHANGE_ALGORITHM,
             )
-        return backend.x25519_generate_key()
+        return rust_openssl.x25519.generate_key()
 
     @classmethod
-    def from_private_bytes(cls, data: bytes) -> X25519PrivateKey:
+    def from_private_bytes(cls, data: Buffer) -> X25519PrivateKey:
         from cryptography.hazmat.backends.openssl.backend import backend
 
         if not backend.x25519_supported():
@@ -75,12 +80,12 @@ class X25519PrivateKey(metaclass=abc.ABCMeta):
                 _Reasons.UNSUPPORTED_EXCHANGE_ALGORITHM,
             )
 
-        return backend.x25519_load_private_bytes(data)
+        return rust_openssl.x25519.from_private_bytes(data)
 
     @abc.abstractmethod
     def public_key(self) -> X25519PublicKey:
         """
-        Returns the public key assosciated with this private key
+        Returns the public key associated with this private key
         """
 
     @abc.abstractmethod
@@ -107,7 +112,11 @@ class X25519PrivateKey(metaclass=abc.ABCMeta):
         Performs a key exchange operation using the provided peer's public key.
         """
 
+    @abc.abstractmethod
+    def __copy__(self) -> X25519PrivateKey:
+        """
+        Returns a copy.
+        """
 
-# For LibreSSL
-if hasattr(rust_openssl, "x25519"):
-    X25519PrivateKey.register(rust_openssl.x25519.X25519PrivateKey)
+
+X25519PrivateKey.register(rust_openssl.x25519.X25519PrivateKey)

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/primitives/asymmetric/x448.py

@@ -9,6 +9,7 @@ import abc
 from cryptography.exceptions import UnsupportedAlgorithm, _Reasons
 from cryptography.hazmat.bindings._rust import openssl as rust_openssl
 from cryptography.hazmat.primitives import _serialization
+from cryptography.utils import Buffer
 
 
 class X448PublicKey(metaclass=abc.ABCMeta):
@@ -22,7 +23,7 @@ class X448PublicKey(metaclass=abc.ABCMeta):
                 _Reasons.UNSUPPORTED_EXCHANGE_ALGORITHM,
             )
 
-        return backend.x448_load_public_bytes(data)
+        return rust_openssl.x448.from_public_bytes(data)
 
     @abc.abstractmethod
     def public_bytes(
@@ -47,6 +48,12 @@ class X448PublicKey(metaclass=abc.ABCMeta):
         Checks equality.
         """
 
+    @abc.abstractmethod
+    def __copy__(self) -> X448PublicKey:
+        """
+        Returns a copy.
+        """
+
 
 if hasattr(rust_openssl, "x448"):
     X448PublicKey.register(rust_openssl.x448.X448PublicKey)
@@ -62,10 +69,11 @@ class X448PrivateKey(metaclass=abc.ABCMeta):
                 "X448 is not supported by this version of OpenSSL.",
                 _Reasons.UNSUPPORTED_EXCHANGE_ALGORITHM,
             )
-        return backend.x448_generate_key()
+
+        return rust_openssl.x448.generate_key()
 
     @classmethod
-    def from_private_bytes(cls, data: bytes) -> X448PrivateKey:
+    def from_private_bytes(cls, data: Buffer) -> X448PrivateKey:
         from cryptography.hazmat.backends.openssl.backend import backend
 
         if not backend.x448_supported():
@@ -74,7 +82,7 @@ class X448PrivateKey(metaclass=abc.ABCMeta):
                 _Reasons.UNSUPPORTED_EXCHANGE_ALGORITHM,
             )
 
-        return backend.x448_load_private_bytes(data)
+        return rust_openssl.x448.from_private_bytes(data)
 
     @abc.abstractmethod
     def public_key(self) -> X448PublicKey:
@@ -106,6 +114,12 @@ class X448PrivateKey(metaclass=abc.ABCMeta):
         Performs a key exchange operation using the provided peer's public key.
         """
 
+    @abc.abstractmethod
+    def __copy__(self) -> X448PrivateKey:
+        """
+        Returns a copy.
+        """
+
 
 if hasattr(rust_openssl, "x448"):
     X448PrivateKey.register(rust_openssl.x448.X448PrivateKey)

Backend/venv/lib/python3.12/site-packages/cryptography/hazmat/primitives/ciphers/__init__.py

@@ -17,11 +17,11 @@ from cryptography.hazmat.primitives.ciphers.base import (
 )
 
 __all__ = [
-    "Cipher",
-    "CipherAlgorithm",
-    "BlockCipherAlgorithm",
-    "CipherContext",
     "AEADCipherContext",
     "AEADDecryptionContext",
     "AEADEncryptionContext",
+    "BlockCipherAlgorithm",
+    "Cipher",
+    "CipherAlgorithm",
+    "CipherContext",
 ]