updates
This commit is contained in:
Iliyan Angelov
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -1,527 +0,0 @@
|
||||
# This file is dual licensed under the terms of the Apache License, Version
|
||||
# 2.0, and the BSD License. See the LICENSE file in the root of this repository
|
||||
# for complete details.
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import typing
|
||||
|
||||
from cryptography.exceptions import InvalidTag
|
||||
|
||||
if typing.TYPE_CHECKING:
|
||||
from cryptography.hazmat.backends.openssl.backend import Backend
|
||||
from cryptography.hazmat.primitives.ciphers.aead import (
|
||||
AESCCM,
|
||||
AESGCM,
|
||||
AESOCB3,
|
||||
AESSIV,
|
||||
ChaCha20Poly1305,
|
||||
)
|
||||
|
||||
_AEADTypes = typing.Union[
|
||||
AESCCM, AESGCM, AESOCB3, AESSIV, ChaCha20Poly1305
|
||||
]
|
||||
|
||||
|
||||
def _is_evp_aead_supported_cipher(
|
||||
backend: Backend, cipher: _AEADTypes
|
||||
) -> bool:
|
||||
"""
|
||||
Checks whether the given cipher is supported through
|
||||
EVP_AEAD rather than the normal OpenSSL EVP_CIPHER API.
|
||||
"""
|
||||
from cryptography.hazmat.primitives.ciphers.aead import ChaCha20Poly1305
|
||||
|
||||
return backend._lib.Cryptography_HAS_EVP_AEAD and isinstance(
|
||||
cipher, ChaCha20Poly1305
|
||||
)
|
||||
|
||||
|
||||
def _aead_cipher_supported(backend: Backend, cipher: _AEADTypes) -> bool:
|
||||
if _is_evp_aead_supported_cipher(backend, cipher):
|
||||
return True
|
||||
else:
|
||||
cipher_name = _evp_cipher_cipher_name(cipher)
|
||||
if backend._fips_enabled and cipher_name not in backend._fips_aead:
|
||||
return False
|
||||
# SIV isn't loaded through get_cipherbyname but instead a new fetch API
|
||||
# only available in 3.0+. But if we know we're on 3.0+ then we know
|
||||
# it's supported.
|
||||
if cipher_name.endswith(b"-siv"):
|
||||
return backend._lib.CRYPTOGRAPHY_OPENSSL_300_OR_GREATER == 1
|
||||
else:
|
||||
return (
|
||||
backend._lib.EVP_get_cipherbyname(cipher_name)
|
||||
!= backend._ffi.NULL
|
||||
)
|
||||
|
||||
|
||||
def _aead_create_ctx(
|
||||
backend: Backend,
|
||||
cipher: _AEADTypes,
|
||||
key: bytes,
|
||||
):
|
||||
if _is_evp_aead_supported_cipher(backend, cipher):
|
||||
return _evp_aead_create_ctx(backend, cipher, key)
|
||||
else:
|
||||
return _evp_cipher_create_ctx(backend, cipher, key)
|
||||
|
||||
|
||||
def _encrypt(
|
||||
backend: Backend,
|
||||
cipher: _AEADTypes,
|
||||
nonce: bytes,
|
||||
data: bytes,
|
||||
associated_data: typing.List[bytes],
|
||||
tag_length: int,
|
||||
ctx: typing.Any = None,
|
||||
) -> bytes:
|
||||
if _is_evp_aead_supported_cipher(backend, cipher):
|
||||
return _evp_aead_encrypt(
|
||||
backend, cipher, nonce, data, associated_data, tag_length, ctx
|
||||
)
|
||||
else:
|
||||
return _evp_cipher_encrypt(
|
||||
backend, cipher, nonce, data, associated_data, tag_length, ctx
|
||||
)
|
||||
|
||||
|
||||
def _decrypt(
|
||||
backend: Backend,
|
||||
cipher: _AEADTypes,
|
||||
nonce: bytes,
|
||||
data: bytes,
|
||||
associated_data: typing.List[bytes],
|
||||
tag_length: int,
|
||||
ctx: typing.Any = None,
|
||||
) -> bytes:
|
||||
if _is_evp_aead_supported_cipher(backend, cipher):
|
||||
return _evp_aead_decrypt(
|
||||
backend, cipher, nonce, data, associated_data, tag_length, ctx
|
||||
)
|
||||
else:
|
||||
return _evp_cipher_decrypt(
|
||||
backend, cipher, nonce, data, associated_data, tag_length, ctx
|
||||
)
|
||||
|
||||
|
||||
def _evp_aead_create_ctx(
|
||||
backend: Backend,
|
||||
cipher: _AEADTypes,
|
||||
key: bytes,
|
||||
tag_len: typing.Optional[int] = None,
|
||||
):
|
||||
aead_cipher = _evp_aead_get_cipher(backend, cipher)
|
||||
assert aead_cipher is not None
|
||||
key_ptr = backend._ffi.from_buffer(key)
|
||||
tag_len = (
|
||||
backend._lib.EVP_AEAD_DEFAULT_TAG_LENGTH
|
||||
if tag_len is None
|
||||
else tag_len
|
||||
)
|
||||
ctx = backend._lib.Cryptography_EVP_AEAD_CTX_new(
|
||||
aead_cipher, key_ptr, len(key), tag_len
|
||||
)
|
||||
backend.openssl_assert(ctx != backend._ffi.NULL)
|
||||
ctx = backend._ffi.gc(ctx, backend._lib.EVP_AEAD_CTX_free)
|
||||
return ctx
|
||||
|
||||
|
||||
def _evp_aead_get_cipher(backend: Backend, cipher: _AEADTypes):
|
||||
from cryptography.hazmat.primitives.ciphers.aead import (
|
||||
ChaCha20Poly1305,
|
||||
)
|
||||
|
||||
# Currently only ChaCha20-Poly1305 is supported using this API
|
||||
assert isinstance(cipher, ChaCha20Poly1305)
|
||||
return backend._lib.EVP_aead_chacha20_poly1305()
|
||||
|
||||
|
||||
def _evp_aead_encrypt(
|
||||
backend: Backend,
|
||||
cipher: _AEADTypes,
|
||||
nonce: bytes,
|
||||
data: bytes,
|
||||
associated_data: typing.List[bytes],
|
||||
tag_length: int,
|
||||
ctx: typing.Any,
|
||||
) -> bytes:
|
||||
assert ctx is not None
|
||||
|
||||
aead_cipher = _evp_aead_get_cipher(backend, cipher)
|
||||
assert aead_cipher is not None
|
||||
|
||||
out_len = backend._ffi.new("size_t *")
|
||||
# max_out_len should be in_len plus the result of
|
||||
# EVP_AEAD_max_overhead.
|
||||
max_out_len = len(data) + backend._lib.EVP_AEAD_max_overhead(aead_cipher)
|
||||
out_buf = backend._ffi.new("uint8_t[]", max_out_len)
|
||||
data_ptr = backend._ffi.from_buffer(data)
|
||||
nonce_ptr = backend._ffi.from_buffer(nonce)
|
||||
aad = b"".join(associated_data)
|
||||
aad_ptr = backend._ffi.from_buffer(aad)
|
||||
|
||||
res = backend._lib.EVP_AEAD_CTX_seal(
|
||||
ctx,
|
||||
out_buf,
|
||||
out_len,
|
||||
max_out_len,
|
||||
nonce_ptr,
|
||||
len(nonce),
|
||||
data_ptr,
|
||||
len(data),
|
||||
aad_ptr,
|
||||
len(aad),
|
||||
)
|
||||
backend.openssl_assert(res == 1)
|
||||
encrypted_data = backend._ffi.buffer(out_buf, out_len[0])[:]
|
||||
return encrypted_data
|
||||
|
||||
|
||||
def _evp_aead_decrypt(
|
||||
backend: Backend,
|
||||
cipher: _AEADTypes,
|
||||
nonce: bytes,
|
||||
data: bytes,
|
||||
associated_data: typing.List[bytes],
|
||||
tag_length: int,
|
||||
ctx: typing.Any,
|
||||
) -> bytes:
|
||||
if len(data) < tag_length:
|
||||
raise InvalidTag
|
||||
|
||||
assert ctx is not None
|
||||
|
||||
out_len = backend._ffi.new("size_t *")
|
||||
# max_out_len should at least in_len
|
||||
max_out_len = len(data)
|
||||
out_buf = backend._ffi.new("uint8_t[]", max_out_len)
|
||||
data_ptr = backend._ffi.from_buffer(data)
|
||||
nonce_ptr = backend._ffi.from_buffer(nonce)
|
||||
aad = b"".join(associated_data)
|
||||
aad_ptr = backend._ffi.from_buffer(aad)
|
||||
|
||||
res = backend._lib.EVP_AEAD_CTX_open(
|
||||
ctx,
|
||||
out_buf,
|
||||
out_len,
|
||||
max_out_len,
|
||||
nonce_ptr,
|
||||
len(nonce),
|
||||
data_ptr,
|
||||
len(data),
|
||||
aad_ptr,
|
||||
len(aad),
|
||||
)
|
||||
|
||||
if res == 0:
|
||||
backend._consume_errors()
|
||||
raise InvalidTag
|
||||
|
||||
decrypted_data = backend._ffi.buffer(out_buf, out_len[0])[:]
|
||||
return decrypted_data
|
||||
|
||||
|
||||
_ENCRYPT = 1
|
||||
_DECRYPT = 0
|
||||
|
||||
|
||||
def _evp_cipher_cipher_name(cipher: _AEADTypes) -> bytes:
|
||||
from cryptography.hazmat.primitives.ciphers.aead import (
|
||||
AESCCM,
|
||||
AESGCM,
|
||||
AESOCB3,
|
||||
AESSIV,
|
||||
ChaCha20Poly1305,
|
||||
)
|
||||
|
||||
if isinstance(cipher, ChaCha20Poly1305):
|
||||
return b"chacha20-poly1305"
|
||||
elif isinstance(cipher, AESCCM):
|
||||
return f"aes-{len(cipher._key) * 8}-ccm".encode("ascii")
|
||||
elif isinstance(cipher, AESOCB3):
|
||||
return f"aes-{len(cipher._key) * 8}-ocb".encode("ascii")
|
||||
elif isinstance(cipher, AESSIV):
|
||||
return f"aes-{len(cipher._key) * 8 // 2}-siv".encode("ascii")
|
||||
else:
|
||||
assert isinstance(cipher, AESGCM)
|
||||
return f"aes-{len(cipher._key) * 8}-gcm".encode("ascii")
|
||||
|
||||
|
||||
def _evp_cipher(cipher_name: bytes, backend: Backend):
|
||||
if cipher_name.endswith(b"-siv"):
|
||||
evp_cipher = backend._lib.EVP_CIPHER_fetch(
|
||||
backend._ffi.NULL,
|
||||
cipher_name,
|
||||
backend._ffi.NULL,
|
||||
)
|
||||
backend.openssl_assert(evp_cipher != backend._ffi.NULL)
|
||||
evp_cipher = backend._ffi.gc(evp_cipher, backend._lib.EVP_CIPHER_free)
|
||||
else:
|
||||
evp_cipher = backend._lib.EVP_get_cipherbyname(cipher_name)
|
||||
backend.openssl_assert(evp_cipher != backend._ffi.NULL)
|
||||
|
||||
return evp_cipher
|
||||
|
||||
|
||||
def _evp_cipher_create_ctx(
|
||||
backend: Backend,
|
||||
cipher: _AEADTypes,
|
||||
key: bytes,
|
||||
):
|
||||
ctx = backend._lib.EVP_CIPHER_CTX_new()
|
||||
backend.openssl_assert(ctx != backend._ffi.NULL)
|
||||
ctx = backend._ffi.gc(ctx, backend._lib.EVP_CIPHER_CTX_free)
|
||||
cipher_name = _evp_cipher_cipher_name(cipher)
|
||||
evp_cipher = _evp_cipher(cipher_name, backend)
|
||||
key_ptr = backend._ffi.from_buffer(key)
|
||||
res = backend._lib.EVP_CipherInit_ex(
|
||||
ctx,
|
||||
evp_cipher,
|
||||
backend._ffi.NULL,
|
||||
key_ptr,
|
||||
backend._ffi.NULL,
|
||||
0,
|
||||
)
|
||||
backend.openssl_assert(res != 0)
|
||||
return ctx
|
||||
|
||||
|
||||
def _evp_cipher_aead_setup(
|
||||
backend: Backend,
|
||||
cipher_name: bytes,
|
||||
key: bytes,
|
||||
nonce: bytes,
|
||||
tag: typing.Optional[bytes],
|
||||
tag_len: int,
|
||||
operation: int,
|
||||
):
|
||||
evp_cipher = _evp_cipher(cipher_name, backend)
|
||||
ctx = backend._lib.EVP_CIPHER_CTX_new()
|
||||
ctx = backend._ffi.gc(ctx, backend._lib.EVP_CIPHER_CTX_free)
|
||||
res = backend._lib.EVP_CipherInit_ex(
|
||||
ctx,
|
||||
evp_cipher,
|
||||
backend._ffi.NULL,
|
||||
backend._ffi.NULL,
|
||||
backend._ffi.NULL,
|
||||
int(operation == _ENCRYPT),
|
||||
)
|
||||
backend.openssl_assert(res != 0)
|
||||
# CCM requires the IVLEN to be set before calling SET_TAG on decrypt
|
||||
res = backend._lib.EVP_CIPHER_CTX_ctrl(
|
||||
ctx,
|
||||
backend._lib.EVP_CTRL_AEAD_SET_IVLEN,
|
||||
len(nonce),
|
||||
backend._ffi.NULL,
|
||||
)
|
||||
backend.openssl_assert(res != 0)
|
||||
if operation == _DECRYPT:
|
||||
assert tag is not None
|
||||
_evp_cipher_set_tag(backend, ctx, tag)
|
||||
elif cipher_name.endswith(b"-ccm"):
|
||||
res = backend._lib.EVP_CIPHER_CTX_ctrl(
|
||||
ctx,
|
||||
backend._lib.EVP_CTRL_AEAD_SET_TAG,
|
||||
tag_len,
|
||||
backend._ffi.NULL,
|
||||
)
|
||||
backend.openssl_assert(res != 0)
|
||||
|
||||
nonce_ptr = backend._ffi.from_buffer(nonce)
|
||||
key_ptr = backend._ffi.from_buffer(key)
|
||||
res = backend._lib.EVP_CipherInit_ex(
|
||||
ctx,
|
||||
backend._ffi.NULL,
|
||||
backend._ffi.NULL,
|
||||
key_ptr,
|
||||
nonce_ptr,
|
||||
int(operation == _ENCRYPT),
|
||||
)
|
||||
backend.openssl_assert(res != 0)
|
||||
return ctx
|
||||
|
||||
|
||||
def _evp_cipher_set_tag(backend, ctx, tag: bytes) -> None:
|
||||
tag_ptr = backend._ffi.from_buffer(tag)
|
||||
res = backend._lib.EVP_CIPHER_CTX_ctrl(
|
||||
ctx, backend._lib.EVP_CTRL_AEAD_SET_TAG, len(tag), tag_ptr
|
||||
)
|
||||
backend.openssl_assert(res != 0)
|
||||
|
||||
|
||||
def _evp_cipher_set_nonce_operation(
|
||||
backend, ctx, nonce: bytes, operation: int
|
||||
) -> None:
|
||||
nonce_ptr = backend._ffi.from_buffer(nonce)
|
||||
res = backend._lib.EVP_CipherInit_ex(
|
||||
ctx,
|
||||
backend._ffi.NULL,
|
||||
backend._ffi.NULL,
|
||||
backend._ffi.NULL,
|
||||
nonce_ptr,
|
||||
int(operation == _ENCRYPT),
|
||||
)
|
||||
backend.openssl_assert(res != 0)
|
||||
|
||||
|
||||
def _evp_cipher_set_length(backend: Backend, ctx, data_len: int) -> None:
|
||||
intptr = backend._ffi.new("int *")
|
||||
res = backend._lib.EVP_CipherUpdate(
|
||||
ctx, backend._ffi.NULL, intptr, backend._ffi.NULL, data_len
|
||||
)
|
||||
backend.openssl_assert(res != 0)
|
||||
|
||||
|
||||
def _evp_cipher_process_aad(
|
||||
backend: Backend, ctx, associated_data: bytes
|
||||
) -> None:
|
||||
outlen = backend._ffi.new("int *")
|
||||
a_data_ptr = backend._ffi.from_buffer(associated_data)
|
||||
res = backend._lib.EVP_CipherUpdate(
|
||||
ctx, backend._ffi.NULL, outlen, a_data_ptr, len(associated_data)
|
||||
)
|
||||
backend.openssl_assert(res != 0)
|
||||
|
||||
|
||||
def _evp_cipher_process_data(backend: Backend, ctx, data: bytes) -> bytes:
|
||||
outlen = backend._ffi.new("int *")
|
||||
buf = backend._ffi.new("unsigned char[]", len(data))
|
||||
data_ptr = backend._ffi.from_buffer(data)
|
||||
res = backend._lib.EVP_CipherUpdate(ctx, buf, outlen, data_ptr, len(data))
|
||||
if res == 0:
|
||||
# AES SIV can error here if the data is invalid on decrypt
|
||||
backend._consume_errors()
|
||||
raise InvalidTag
|
||||
return backend._ffi.buffer(buf, outlen[0])[:]
|
||||
|
||||
|
||||
def _evp_cipher_encrypt(
|
||||
backend: Backend,
|
||||
cipher: _AEADTypes,
|
||||
nonce: bytes,
|
||||
data: bytes,
|
||||
associated_data: typing.List[bytes],
|
||||
tag_length: int,
|
||||
ctx: typing.Any = None,
|
||||
) -> bytes:
|
||||
from cryptography.hazmat.primitives.ciphers.aead import AESCCM, AESSIV
|
||||
|
||||
if ctx is None:
|
||||
cipher_name = _evp_cipher_cipher_name(cipher)
|
||||
ctx = _evp_cipher_aead_setup(
|
||||
backend,
|
||||
cipher_name,
|
||||
cipher._key,
|
||||
nonce,
|
||||
None,
|
||||
tag_length,
|
||||
_ENCRYPT,
|
||||
)
|
||||
else:
|
||||
_evp_cipher_set_nonce_operation(backend, ctx, nonce, _ENCRYPT)
|
||||
|
||||
# CCM requires us to pass the length of the data before processing
|
||||
# anything.
|
||||
# However calling this with any other AEAD results in an error
|
||||
if isinstance(cipher, AESCCM):
|
||||
_evp_cipher_set_length(backend, ctx, len(data))
|
||||
|
||||
for ad in associated_data:
|
||||
_evp_cipher_process_aad(backend, ctx, ad)
|
||||
processed_data = _evp_cipher_process_data(backend, ctx, data)
|
||||
outlen = backend._ffi.new("int *")
|
||||
# All AEADs we support besides OCB are streaming so they return nothing
|
||||
# in finalization. OCB can return up to (16 byte block - 1) bytes so
|
||||
# we need a buffer here too.
|
||||
buf = backend._ffi.new("unsigned char[]", 16)
|
||||
res = backend._lib.EVP_CipherFinal_ex(ctx, buf, outlen)
|
||||
backend.openssl_assert(res != 0)
|
||||
processed_data += backend._ffi.buffer(buf, outlen[0])[:]
|
||||
tag_buf = backend._ffi.new("unsigned char[]", tag_length)
|
||||
res = backend._lib.EVP_CIPHER_CTX_ctrl(
|
||||
ctx, backend._lib.EVP_CTRL_AEAD_GET_TAG, tag_length, tag_buf
|
||||
)
|
||||
backend.openssl_assert(res != 0)
|
||||
tag = backend._ffi.buffer(tag_buf)[:]
|
||||
|
||||
if isinstance(cipher, AESSIV):
|
||||
# RFC 5297 defines the output as IV || C, where the tag we generate
|
||||
# is the "IV" and C is the ciphertext. This is the opposite of our
|
||||
# other AEADs, which are Ciphertext || Tag
|
||||
backend.openssl_assert(len(tag) == 16)
|
||||
return tag + processed_data
|
||||
else:
|
||||
return processed_data + tag
|
||||
|
||||
|
||||
def _evp_cipher_decrypt(
|
||||
backend: Backend,
|
||||
cipher: _AEADTypes,
|
||||
nonce: bytes,
|
||||
data: bytes,
|
||||
associated_data: typing.List[bytes],
|
||||
tag_length: int,
|
||||
ctx: typing.Any = None,
|
||||
) -> bytes:
|
||||
from cryptography.hazmat.primitives.ciphers.aead import AESCCM, AESSIV
|
||||
|
||||
if len(data) < tag_length:
|
||||
raise InvalidTag
|
||||
|
||||
if isinstance(cipher, AESSIV):
|
||||
# RFC 5297 defines the output as IV || C, where the tag we generate
|
||||
# is the "IV" and C is the ciphertext. This is the opposite of our
|
||||
# other AEADs, which are Ciphertext || Tag
|
||||
tag = data[:tag_length]
|
||||
data = data[tag_length:]
|
||||
else:
|
||||
tag = data[-tag_length:]
|
||||
data = data[:-tag_length]
|
||||
if ctx is None:
|
||||
cipher_name = _evp_cipher_cipher_name(cipher)
|
||||
ctx = _evp_cipher_aead_setup(
|
||||
backend,
|
||||
cipher_name,
|
||||
cipher._key,
|
||||
nonce,
|
||||
tag,
|
||||
tag_length,
|
||||
_DECRYPT,
|
||||
)
|
||||
else:
|
||||
_evp_cipher_set_nonce_operation(backend, ctx, nonce, _DECRYPT)
|
||||
_evp_cipher_set_tag(backend, ctx, tag)
|
||||
|
||||
# CCM requires us to pass the length of the data before processing
|
||||
# anything.
|
||||
# However calling this with any other AEAD results in an error
|
||||
if isinstance(cipher, AESCCM):
|
||||
_evp_cipher_set_length(backend, ctx, len(data))
|
||||
|
||||
for ad in associated_data:
|
||||
_evp_cipher_process_aad(backend, ctx, ad)
|
||||
# CCM has a different error path if the tag doesn't match. Errors are
|
||||
# raised in Update and Final is irrelevant.
|
||||
if isinstance(cipher, AESCCM):
|
||||
outlen = backend._ffi.new("int *")
|
||||
buf = backend._ffi.new("unsigned char[]", len(data))
|
||||
d_ptr = backend._ffi.from_buffer(data)
|
||||
res = backend._lib.EVP_CipherUpdate(ctx, buf, outlen, d_ptr, len(data))
|
||||
if res != 1:
|
||||
backend._consume_errors()
|
||||
raise InvalidTag
|
||||
|
||||
processed_data = backend._ffi.buffer(buf, outlen[0])[:]
|
||||
else:
|
||||
processed_data = _evp_cipher_process_data(backend, ctx, data)
|
||||
outlen = backend._ffi.new("int *")
|
||||
# OCB can return up to 15 bytes (16 byte block - 1) in finalization
|
||||
buf = backend._ffi.new("unsigned char[]", 16)
|
||||
res = backend._lib.EVP_CipherFinal_ex(ctx, buf, outlen)
|
||||
processed_data += backend._ffi.buffer(buf, outlen[0])[:]
|
||||
if res == 0:
|
||||
backend._consume_errors()
|
||||
raise InvalidTag
|
||||
|
||||
return processed_data
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,281 +0,0 @@
|
||||
# This file is dual licensed under the terms of the Apache License, Version
|
||||
# 2.0, and the BSD License. See the LICENSE file in the root of this repository
|
||||
# for complete details.
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import typing
|
||||
|
||||
from cryptography.exceptions import InvalidTag, UnsupportedAlgorithm, _Reasons
|
||||
from cryptography.hazmat.primitives import ciphers
|
||||
from cryptography.hazmat.primitives.ciphers import algorithms, modes
|
||||
|
||||
if typing.TYPE_CHECKING:
|
||||
from cryptography.hazmat.backends.openssl.backend import Backend
|
||||
|
||||
|
||||
class _CipherContext:
|
||||
_ENCRYPT = 1
|
||||
_DECRYPT = 0
|
||||
_MAX_CHUNK_SIZE = 2**30 - 1
|
||||
|
||||
def __init__(self, backend: Backend, cipher, mode, operation: int) -> None:
|
||||
self._backend = backend
|
||||
self._cipher = cipher
|
||||
self._mode = mode
|
||||
self._operation = operation
|
||||
self._tag: typing.Optional[bytes] = None
|
||||
|
||||
if isinstance(self._cipher, ciphers.BlockCipherAlgorithm):
|
||||
self._block_size_bytes = self._cipher.block_size // 8
|
||||
else:
|
||||
self._block_size_bytes = 1
|
||||
|
||||
ctx = self._backend._lib.EVP_CIPHER_CTX_new()
|
||||
ctx = self._backend._ffi.gc(
|
||||
ctx, self._backend._lib.EVP_CIPHER_CTX_free
|
||||
)
|
||||
|
||||
registry = self._backend._cipher_registry
|
||||
try:
|
||||
adapter = registry[type(cipher), type(mode)]
|
||||
except KeyError:
|
||||
raise UnsupportedAlgorithm(
|
||||
"cipher {} in {} mode is not supported "
|
||||
"by this backend.".format(
|
||||
cipher.name, mode.name if mode else mode
|
||||
),
|
||||
_Reasons.UNSUPPORTED_CIPHER,
|
||||
)
|
||||
|
||||
evp_cipher = adapter(self._backend, cipher, mode)
|
||||
if evp_cipher == self._backend._ffi.NULL:
|
||||
msg = f"cipher {cipher.name} "
|
||||
if mode is not None:
|
||||
msg += f"in {mode.name} mode "
|
||||
msg += (
|
||||
"is not supported by this backend (Your version of OpenSSL "
|
||||
"may be too old. Current version: {}.)"
|
||||
).format(self._backend.openssl_version_text())
|
||||
raise UnsupportedAlgorithm(msg, _Reasons.UNSUPPORTED_CIPHER)
|
||||
|
||||
if isinstance(mode, modes.ModeWithInitializationVector):
|
||||
iv_nonce = self._backend._ffi.from_buffer(
|
||||
mode.initialization_vector
|
||||
)
|
||||
elif isinstance(mode, modes.ModeWithTweak):
|
||||
iv_nonce = self._backend._ffi.from_buffer(mode.tweak)
|
||||
elif isinstance(mode, modes.ModeWithNonce):
|
||||
iv_nonce = self._backend._ffi.from_buffer(mode.nonce)
|
||||
elif isinstance(cipher, algorithms.ChaCha20):
|
||||
iv_nonce = self._backend._ffi.from_buffer(cipher.nonce)
|
||||
else:
|
||||
iv_nonce = self._backend._ffi.NULL
|
||||
# begin init with cipher and operation type
|
||||
res = self._backend._lib.EVP_CipherInit_ex(
|
||||
ctx,
|
||||
evp_cipher,
|
||||
self._backend._ffi.NULL,
|
||||
self._backend._ffi.NULL,
|
||||
self._backend._ffi.NULL,
|
||||
operation,
|
||||
)
|
||||
self._backend.openssl_assert(res != 0)
|
||||
# set the key length to handle variable key ciphers
|
||||
res = self._backend._lib.EVP_CIPHER_CTX_set_key_length(
|
||||
ctx, len(cipher.key)
|
||||
)
|
||||
self._backend.openssl_assert(res != 0)
|
||||
if isinstance(mode, modes.GCM):
|
||||
res = self._backend._lib.EVP_CIPHER_CTX_ctrl(
|
||||
ctx,
|
||||
self._backend._lib.EVP_CTRL_AEAD_SET_IVLEN,
|
||||
len(iv_nonce),
|
||||
self._backend._ffi.NULL,
|
||||
)
|
||||
self._backend.openssl_assert(res != 0)
|
||||
if mode.tag is not None:
|
||||
res = self._backend._lib.EVP_CIPHER_CTX_ctrl(
|
||||
ctx,
|
||||
self._backend._lib.EVP_CTRL_AEAD_SET_TAG,
|
||||
len(mode.tag),
|
||||
mode.tag,
|
||||
)
|
||||
self._backend.openssl_assert(res != 0)
|
||||
self._tag = mode.tag
|
||||
|
||||
# pass key/iv
|
||||
res = self._backend._lib.EVP_CipherInit_ex(
|
||||
ctx,
|
||||
self._backend._ffi.NULL,
|
||||
self._backend._ffi.NULL,
|
||||
self._backend._ffi.from_buffer(cipher.key),
|
||||
iv_nonce,
|
||||
operation,
|
||||
)
|
||||
|
||||
# Check for XTS mode duplicate keys error
|
||||
errors = self._backend._consume_errors()
|
||||
lib = self._backend._lib
|
||||
if res == 0 and (
|
||||
(
|
||||
not lib.CRYPTOGRAPHY_IS_LIBRESSL
|
||||
and errors[0]._lib_reason_match(
|
||||
lib.ERR_LIB_EVP, lib.EVP_R_XTS_DUPLICATED_KEYS
|
||||
)
|
||||
)
|
||||
or (
|
||||
lib.Cryptography_HAS_PROVIDERS
|
||||
and errors[0]._lib_reason_match(
|
||||
lib.ERR_LIB_PROV, lib.PROV_R_XTS_DUPLICATED_KEYS
|
||||
)
|
||||
)
|
||||
):
|
||||
raise ValueError("In XTS mode duplicated keys are not allowed")
|
||||
|
||||
self._backend.openssl_assert(res != 0, errors=errors)
|
||||
|
||||
# We purposely disable padding here as it's handled higher up in the
|
||||
# API.
|
||||
self._backend._lib.EVP_CIPHER_CTX_set_padding(ctx, 0)
|
||||
self._ctx = ctx
|
||||
|
||||
def update(self, data: bytes) -> bytes:
|
||||
buf = bytearray(len(data) + self._block_size_bytes - 1)
|
||||
n = self.update_into(data, buf)
|
||||
return bytes(buf[:n])
|
||||
|
||||
def update_into(self, data: bytes, buf: bytes) -> int:
|
||||
total_data_len = len(data)
|
||||
if len(buf) < (total_data_len + self._block_size_bytes - 1):
|
||||
raise ValueError(
|
||||
"buffer must be at least {} bytes for this "
|
||||
"payload".format(len(data) + self._block_size_bytes - 1)
|
||||
)
|
||||
|
||||
data_processed = 0
|
||||
total_out = 0
|
||||
outlen = self._backend._ffi.new("int *")
|
||||
baseoutbuf = self._backend._ffi.from_buffer(buf, require_writable=True)
|
||||
baseinbuf = self._backend._ffi.from_buffer(data)
|
||||
|
||||
while data_processed != total_data_len:
|
||||
outbuf = baseoutbuf + total_out
|
||||
inbuf = baseinbuf + data_processed
|
||||
inlen = min(self._MAX_CHUNK_SIZE, total_data_len - data_processed)
|
||||
|
||||
res = self._backend._lib.EVP_CipherUpdate(
|
||||
self._ctx, outbuf, outlen, inbuf, inlen
|
||||
)
|
||||
if res == 0 and isinstance(self._mode, modes.XTS):
|
||||
self._backend._consume_errors()
|
||||
raise ValueError(
|
||||
"In XTS mode you must supply at least a full block in the "
|
||||
"first update call. For AES this is 16 bytes."
|
||||
)
|
||||
else:
|
||||
self._backend.openssl_assert(res != 0)
|
||||
data_processed += inlen
|
||||
total_out += outlen[0]
|
||||
|
||||
return total_out
|
||||
|
||||
def finalize(self) -> bytes:
|
||||
if (
|
||||
self._operation == self._DECRYPT
|
||||
and isinstance(self._mode, modes.ModeWithAuthenticationTag)
|
||||
and self.tag is None
|
||||
):
|
||||
raise ValueError(
|
||||
"Authentication tag must be provided when decrypting."
|
||||
)
|
||||
|
||||
buf = self._backend._ffi.new("unsigned char[]", self._block_size_bytes)
|
||||
outlen = self._backend._ffi.new("int *")
|
||||
res = self._backend._lib.EVP_CipherFinal_ex(self._ctx, buf, outlen)
|
||||
if res == 0:
|
||||
errors = self._backend._consume_errors()
|
||||
|
||||
if not errors and isinstance(self._mode, modes.GCM):
|
||||
raise InvalidTag
|
||||
|
||||
lib = self._backend._lib
|
||||
self._backend.openssl_assert(
|
||||
errors[0]._lib_reason_match(
|
||||
lib.ERR_LIB_EVP,
|
||||
lib.EVP_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH,
|
||||
)
|
||||
or (
|
||||
lib.Cryptography_HAS_PROVIDERS
|
||||
and errors[0]._lib_reason_match(
|
||||
lib.ERR_LIB_PROV,
|
||||
lib.PROV_R_WRONG_FINAL_BLOCK_LENGTH,
|
||||
)
|
||||
)
|
||||
or (
|
||||
lib.CRYPTOGRAPHY_IS_BORINGSSL
|
||||
and errors[0].reason
|
||||
== lib.CIPHER_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH
|
||||
),
|
||||
errors=errors,
|
||||
)
|
||||
raise ValueError(
|
||||
"The length of the provided data is not a multiple of "
|
||||
"the block length."
|
||||
)
|
||||
|
||||
if (
|
||||
isinstance(self._mode, modes.GCM)
|
||||
and self._operation == self._ENCRYPT
|
||||
):
|
||||
tag_buf = self._backend._ffi.new(
|
||||
"unsigned char[]", self._block_size_bytes
|
||||
)
|
||||
res = self._backend._lib.EVP_CIPHER_CTX_ctrl(
|
||||
self._ctx,
|
||||
self._backend._lib.EVP_CTRL_AEAD_GET_TAG,
|
||||
self._block_size_bytes,
|
||||
tag_buf,
|
||||
)
|
||||
self._backend.openssl_assert(res != 0)
|
||||
self._tag = self._backend._ffi.buffer(tag_buf)[:]
|
||||
|
||||
res = self._backend._lib.EVP_CIPHER_CTX_reset(self._ctx)
|
||||
self._backend.openssl_assert(res == 1)
|
||||
return self._backend._ffi.buffer(buf)[: outlen[0]]
|
||||
|
||||
def finalize_with_tag(self, tag: bytes) -> bytes:
|
||||
tag_len = len(tag)
|
||||
if tag_len < self._mode._min_tag_length:
|
||||
raise ValueError(
|
||||
"Authentication tag must be {} bytes or longer.".format(
|
||||
self._mode._min_tag_length
|
||||
)
|
||||
)
|
||||
elif tag_len > self._block_size_bytes:
|
||||
raise ValueError(
|
||||
"Authentication tag cannot be more than {} bytes.".format(
|
||||
self._block_size_bytes
|
||||
)
|
||||
)
|
||||
res = self._backend._lib.EVP_CIPHER_CTX_ctrl(
|
||||
self._ctx, self._backend._lib.EVP_CTRL_AEAD_SET_TAG, len(tag), tag
|
||||
)
|
||||
self._backend.openssl_assert(res != 0)
|
||||
self._tag = tag
|
||||
return self.finalize()
|
||||
|
||||
def authenticate_additional_data(self, data: bytes) -> None:
|
||||
outlen = self._backend._ffi.new("int *")
|
||||
res = self._backend._lib.EVP_CipherUpdate(
|
||||
self._ctx,
|
||||
self._backend._ffi.NULL,
|
||||
outlen,
|
||||
self._backend._ffi.from_buffer(data),
|
||||
len(data),
|
||||
)
|
||||
self._backend.openssl_assert(res != 0)
|
||||
|
||||
@property
|
||||
def tag(self) -> typing.Optional[bytes]:
|
||||
return self._tag
|
||||
@@ -1,89 +0,0 @@
|
||||
# This file is dual licensed under the terms of the Apache License, Version
|
||||
# 2.0, and the BSD License. See the LICENSE file in the root of this repository
|
||||
# for complete details.
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import typing
|
||||
|
||||
from cryptography.exceptions import (
|
||||
InvalidSignature,
|
||||
UnsupportedAlgorithm,
|
||||
_Reasons,
|
||||
)
|
||||
from cryptography.hazmat.primitives import constant_time
|
||||
from cryptography.hazmat.primitives.ciphers.modes import CBC
|
||||
|
||||
if typing.TYPE_CHECKING:
|
||||
from cryptography.hazmat.backends.openssl.backend import Backend
|
||||
from cryptography.hazmat.primitives import ciphers
|
||||
|
||||
|
||||
class _CMACContext:
|
||||
def __init__(
|
||||
self,
|
||||
backend: Backend,
|
||||
algorithm: ciphers.BlockCipherAlgorithm,
|
||||
ctx=None,
|
||||
) -> None:
|
||||
if not backend.cmac_algorithm_supported(algorithm):
|
||||
raise UnsupportedAlgorithm(
|
||||
"This backend does not support CMAC.",
|
||||
_Reasons.UNSUPPORTED_CIPHER,
|
||||
)
|
||||
|
||||
self._backend = backend
|
||||
self._key = algorithm.key
|
||||
self._algorithm = algorithm
|
||||
self._output_length = algorithm.block_size // 8
|
||||
|
||||
if ctx is None:
|
||||
registry = self._backend._cipher_registry
|
||||
adapter = registry[type(algorithm), CBC]
|
||||
|
||||
evp_cipher = adapter(self._backend, algorithm, CBC)
|
||||
|
||||
ctx = self._backend._lib.CMAC_CTX_new()
|
||||
|
||||
self._backend.openssl_assert(ctx != self._backend._ffi.NULL)
|
||||
ctx = self._backend._ffi.gc(ctx, self._backend._lib.CMAC_CTX_free)
|
||||
|
||||
key_ptr = self._backend._ffi.from_buffer(self._key)
|
||||
res = self._backend._lib.CMAC_Init(
|
||||
ctx,
|
||||
key_ptr,
|
||||
len(self._key),
|
||||
evp_cipher,
|
||||
self._backend._ffi.NULL,
|
||||
)
|
||||
self._backend.openssl_assert(res == 1)
|
||||
|
||||
self._ctx = ctx
|
||||
|
||||
def update(self, data: bytes) -> None:
|
||||
res = self._backend._lib.CMAC_Update(self._ctx, data, len(data))
|
||||
self._backend.openssl_assert(res == 1)
|
||||
|
||||
def finalize(self) -> bytes:
|
||||
buf = self._backend._ffi.new("unsigned char[]", self._output_length)
|
||||
length = self._backend._ffi.new("size_t *", self._output_length)
|
||||
res = self._backend._lib.CMAC_Final(self._ctx, buf, length)
|
||||
self._backend.openssl_assert(res == 1)
|
||||
|
||||
self._ctx = None
|
||||
|
||||
return self._backend._ffi.buffer(buf)[:]
|
||||
|
||||
def copy(self) -> _CMACContext:
|
||||
copied_ctx = self._backend._lib.CMAC_CTX_new()
|
||||
copied_ctx = self._backend._ffi.gc(
|
||||
copied_ctx, self._backend._lib.CMAC_CTX_free
|
||||
)
|
||||
res = self._backend._lib.CMAC_CTX_copy(copied_ctx, self._ctx)
|
||||
self._backend.openssl_assert(res == 1)
|
||||
return _CMACContext(self._backend, self._algorithm, ctx=copied_ctx)
|
||||
|
||||
def verify(self, signature: bytes) -> None:
|
||||
digest = self.finalize()
|
||||
if not constant_time.bytes_eq(digest, signature):
|
||||
raise InvalidSignature("Signature did not match digest.")
|
||||
@@ -1,32 +0,0 @@
|
||||
# This file is dual licensed under the terms of the Apache License, Version
|
||||
# 2.0, and the BSD License. See the LICENSE file in the root of this repository
|
||||
# for complete details.
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
from cryptography import x509
|
||||
|
||||
# CRLReason ::= ENUMERATED {
|
||||
# unspecified (0),
|
||||
# keyCompromise (1),
|
||||
# cACompromise (2),
|
||||
# affiliationChanged (3),
|
||||
# superseded (4),
|
||||
# cessationOfOperation (5),
|
||||
# certificateHold (6),
|
||||
# -- value 7 is not used
|
||||
# removeFromCRL (8),
|
||||
# privilegeWithdrawn (9),
|
||||
# aACompromise (10) }
|
||||
_CRL_ENTRY_REASON_ENUM_TO_CODE = {
|
||||
x509.ReasonFlags.unspecified: 0,
|
||||
x509.ReasonFlags.key_compromise: 1,
|
||||
x509.ReasonFlags.ca_compromise: 2,
|
||||
x509.ReasonFlags.affiliation_changed: 3,
|
||||
x509.ReasonFlags.superseded: 4,
|
||||
x509.ReasonFlags.cessation_of_operation: 5,
|
||||
x509.ReasonFlags.certificate_hold: 6,
|
||||
x509.ReasonFlags.remove_from_crl: 8,
|
||||
x509.ReasonFlags.privilege_withdrawn: 9,
|
||||
x509.ReasonFlags.aa_compromise: 10,
|
||||
}
|
||||
@@ -1,328 +0,0 @@
|
||||
# This file is dual licensed under the terms of the Apache License, Version
|
||||
# 2.0, and the BSD License. See the LICENSE file in the root of this repository
|
||||
# for complete details.
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import typing
|
||||
|
||||
from cryptography.exceptions import (
|
||||
InvalidSignature,
|
||||
UnsupportedAlgorithm,
|
||||
_Reasons,
|
||||
)
|
||||
from cryptography.hazmat.backends.openssl.utils import (
|
||||
_calculate_digest_and_algorithm,
|
||||
_evp_pkey_derive,
|
||||
)
|
||||
from cryptography.hazmat.primitives import serialization
|
||||
from cryptography.hazmat.primitives.asymmetric import ec
|
||||
|
||||
if typing.TYPE_CHECKING:
|
||||
from cryptography.hazmat.backends.openssl.backend import Backend
|
||||
|
||||
|
||||
def _check_signature_algorithm(
|
||||
signature_algorithm: ec.EllipticCurveSignatureAlgorithm,
|
||||
) -> None:
|
||||
if not isinstance(signature_algorithm, ec.ECDSA):
|
||||
raise UnsupportedAlgorithm(
|
||||
"Unsupported elliptic curve signature algorithm.",
|
||||
_Reasons.UNSUPPORTED_PUBLIC_KEY_ALGORITHM,
|
||||
)
|
||||
|
||||
|
||||
def _ec_key_curve_sn(backend: Backend, ec_key) -> str:
|
||||
group = backend._lib.EC_KEY_get0_group(ec_key)
|
||||
backend.openssl_assert(group != backend._ffi.NULL)
|
||||
|
||||
nid = backend._lib.EC_GROUP_get_curve_name(group)
|
||||
# The following check is to find EC keys with unnamed curves and raise
|
||||
# an error for now.
|
||||
if nid == backend._lib.NID_undef:
|
||||
raise ValueError(
|
||||
"ECDSA keys with explicit parameters are unsupported at this time"
|
||||
)
|
||||
|
||||
# This is like the above check, but it also catches the case where you
|
||||
# explicitly encoded a curve with the same parameters as a named curve.
|
||||
# Don't do that.
|
||||
if (
|
||||
not backend._lib.CRYPTOGRAPHY_IS_LIBRESSL
|
||||
and backend._lib.EC_GROUP_get_asn1_flag(group) == 0
|
||||
):
|
||||
raise ValueError(
|
||||
"ECDSA keys with explicit parameters are unsupported at this time"
|
||||
)
|
||||
|
||||
curve_name = backend._lib.OBJ_nid2sn(nid)
|
||||
backend.openssl_assert(curve_name != backend._ffi.NULL)
|
||||
|
||||
sn = backend._ffi.string(curve_name).decode("ascii")
|
||||
return sn
|
||||
|
||||
|
||||
def _mark_asn1_named_ec_curve(backend: Backend, ec_cdata):
|
||||
"""
|
||||
Set the named curve flag on the EC_KEY. This causes OpenSSL to
|
||||
serialize EC keys along with their curve OID which makes
|
||||
deserialization easier.
|
||||
"""
|
||||
|
||||
backend._lib.EC_KEY_set_asn1_flag(
|
||||
ec_cdata, backend._lib.OPENSSL_EC_NAMED_CURVE
|
||||
)
|
||||
|
||||
|
||||
def _check_key_infinity(backend: Backend, ec_cdata) -> None:
|
||||
point = backend._lib.EC_KEY_get0_public_key(ec_cdata)
|
||||
backend.openssl_assert(point != backend._ffi.NULL)
|
||||
group = backend._lib.EC_KEY_get0_group(ec_cdata)
|
||||
backend.openssl_assert(group != backend._ffi.NULL)
|
||||
if backend._lib.EC_POINT_is_at_infinity(group, point):
|
||||
raise ValueError(
|
||||
"Cannot load an EC public key where the point is at infinity"
|
||||
)
|
||||
|
||||
|
||||
def _sn_to_elliptic_curve(backend: Backend, sn: str) -> ec.EllipticCurve:
|
||||
try:
|
||||
return ec._CURVE_TYPES[sn]()
|
||||
except KeyError:
|
||||
raise UnsupportedAlgorithm(
|
||||
f"{sn} is not a supported elliptic curve",
|
||||
_Reasons.UNSUPPORTED_ELLIPTIC_CURVE,
|
||||
)
|
||||
|
||||
|
||||
def _ecdsa_sig_sign(
|
||||
backend: Backend, private_key: _EllipticCurvePrivateKey, data: bytes
|
||||
) -> bytes:
|
||||
max_size = backend._lib.ECDSA_size(private_key._ec_key)
|
||||
backend.openssl_assert(max_size > 0)
|
||||
|
||||
sigbuf = backend._ffi.new("unsigned char[]", max_size)
|
||||
siglen_ptr = backend._ffi.new("unsigned int[]", 1)
|
||||
res = backend._lib.ECDSA_sign(
|
||||
0, data, len(data), sigbuf, siglen_ptr, private_key._ec_key
|
||||
)
|
||||
backend.openssl_assert(res == 1)
|
||||
return backend._ffi.buffer(sigbuf)[: siglen_ptr[0]]
|
||||
|
||||
|
||||
def _ecdsa_sig_verify(
|
||||
backend: Backend,
|
||||
public_key: _EllipticCurvePublicKey,
|
||||
signature: bytes,
|
||||
data: bytes,
|
||||
) -> None:
|
||||
res = backend._lib.ECDSA_verify(
|
||||
0, data, len(data), signature, len(signature), public_key._ec_key
|
||||
)
|
||||
if res != 1:
|
||||
backend._consume_errors()
|
||||
raise InvalidSignature
|
||||
|
||||
|
||||
class _EllipticCurvePrivateKey(ec.EllipticCurvePrivateKey):
|
||||
def __init__(self, backend: Backend, ec_key_cdata, evp_pkey):
|
||||
self._backend = backend
|
||||
self._ec_key = ec_key_cdata
|
||||
self._evp_pkey = evp_pkey
|
||||
|
||||
sn = _ec_key_curve_sn(backend, ec_key_cdata)
|
||||
self._curve = _sn_to_elliptic_curve(backend, sn)
|
||||
_mark_asn1_named_ec_curve(backend, ec_key_cdata)
|
||||
_check_key_infinity(backend, ec_key_cdata)
|
||||
|
||||
@property
|
||||
def curve(self) -> ec.EllipticCurve:
|
||||
return self._curve
|
||||
|
||||
@property
|
||||
def key_size(self) -> int:
|
||||
return self.curve.key_size
|
||||
|
||||
def exchange(
|
||||
self, algorithm: ec.ECDH, peer_public_key: ec.EllipticCurvePublicKey
|
||||
) -> bytes:
|
||||
if not (
|
||||
self._backend.elliptic_curve_exchange_algorithm_supported(
|
||||
algorithm, self.curve
|
||||
)
|
||||
):
|
||||
raise UnsupportedAlgorithm(
|
||||
"This backend does not support the ECDH algorithm.",
|
||||
_Reasons.UNSUPPORTED_EXCHANGE_ALGORITHM,
|
||||
)
|
||||
|
||||
if peer_public_key.curve.name != self.curve.name:
|
||||
raise ValueError(
|
||||
"peer_public_key and self are not on the same curve"
|
||||
)
|
||||
|
||||
return _evp_pkey_derive(self._backend, self._evp_pkey, peer_public_key)
|
||||
|
||||
def public_key(self) -> ec.EllipticCurvePublicKey:
|
||||
group = self._backend._lib.EC_KEY_get0_group(self._ec_key)
|
||||
self._backend.openssl_assert(group != self._backend._ffi.NULL)
|
||||
|
||||
curve_nid = self._backend._lib.EC_GROUP_get_curve_name(group)
|
||||
public_ec_key = self._backend._ec_key_new_by_curve_nid(curve_nid)
|
||||
|
||||
point = self._backend._lib.EC_KEY_get0_public_key(self._ec_key)
|
||||
self._backend.openssl_assert(point != self._backend._ffi.NULL)
|
||||
|
||||
res = self._backend._lib.EC_KEY_set_public_key(public_ec_key, point)
|
||||
self._backend.openssl_assert(res == 1)
|
||||
|
||||
evp_pkey = self._backend._ec_cdata_to_evp_pkey(public_ec_key)
|
||||
|
||||
return _EllipticCurvePublicKey(self._backend, public_ec_key, evp_pkey)
|
||||
|
||||
def private_numbers(self) -> ec.EllipticCurvePrivateNumbers:
|
||||
bn = self._backend._lib.EC_KEY_get0_private_key(self._ec_key)
|
||||
private_value = self._backend._bn_to_int(bn)
|
||||
return ec.EllipticCurvePrivateNumbers(
|
||||
private_value=private_value,
|
||||
public_numbers=self.public_key().public_numbers(),
|
||||
)
|
||||
|
||||
def private_bytes(
|
||||
self,
|
||||
encoding: serialization.Encoding,
|
||||
format: serialization.PrivateFormat,
|
||||
encryption_algorithm: serialization.KeySerializationEncryption,
|
||||
) -> bytes:
|
||||
return self._backend._private_key_bytes(
|
||||
encoding,
|
||||
format,
|
||||
encryption_algorithm,
|
||||
self,
|
||||
self._evp_pkey,
|
||||
self._ec_key,
|
||||
)
|
||||
|
||||
def sign(
|
||||
self,
|
||||
data: bytes,
|
||||
signature_algorithm: ec.EllipticCurveSignatureAlgorithm,
|
||||
) -> bytes:
|
||||
_check_signature_algorithm(signature_algorithm)
|
||||
data, _ = _calculate_digest_and_algorithm(
|
||||
data,
|
||||
signature_algorithm.algorithm,
|
||||
)
|
||||
return _ecdsa_sig_sign(self._backend, self, data)
|
||||
|
||||
|
||||
class _EllipticCurvePublicKey(ec.EllipticCurvePublicKey):
|
||||
def __init__(self, backend: Backend, ec_key_cdata, evp_pkey):
|
||||
self._backend = backend
|
||||
self._ec_key = ec_key_cdata
|
||||
self._evp_pkey = evp_pkey
|
||||
|
||||
sn = _ec_key_curve_sn(backend, ec_key_cdata)
|
||||
self._curve = _sn_to_elliptic_curve(backend, sn)
|
||||
_mark_asn1_named_ec_curve(backend, ec_key_cdata)
|
||||
_check_key_infinity(backend, ec_key_cdata)
|
||||
|
||||
@property
|
||||
def curve(self) -> ec.EllipticCurve:
|
||||
return self._curve
|
||||
|
||||
@property
|
||||
def key_size(self) -> int:
|
||||
return self.curve.key_size
|
||||
|
||||
def __eq__(self, other: object) -> bool:
|
||||
if not isinstance(other, _EllipticCurvePublicKey):
|
||||
return NotImplemented
|
||||
|
||||
return (
|
||||
self._backend._lib.EVP_PKEY_cmp(self._evp_pkey, other._evp_pkey)
|
||||
== 1
|
||||
)
|
||||
|
||||
def public_numbers(self) -> ec.EllipticCurvePublicNumbers:
|
||||
group = self._backend._lib.EC_KEY_get0_group(self._ec_key)
|
||||
self._backend.openssl_assert(group != self._backend._ffi.NULL)
|
||||
|
||||
point = self._backend._lib.EC_KEY_get0_public_key(self._ec_key)
|
||||
self._backend.openssl_assert(point != self._backend._ffi.NULL)
|
||||
|
||||
with self._backend._tmp_bn_ctx() as bn_ctx:
|
||||
bn_x = self._backend._lib.BN_CTX_get(bn_ctx)
|
||||
bn_y = self._backend._lib.BN_CTX_get(bn_ctx)
|
||||
|
||||
res = self._backend._lib.EC_POINT_get_affine_coordinates(
|
||||
group, point, bn_x, bn_y, bn_ctx
|
||||
)
|
||||
self._backend.openssl_assert(res == 1)
|
||||
|
||||
x = self._backend._bn_to_int(bn_x)
|
||||
y = self._backend._bn_to_int(bn_y)
|
||||
|
||||
return ec.EllipticCurvePublicNumbers(x=x, y=y, curve=self._curve)
|
||||
|
||||
def _encode_point(self, format: serialization.PublicFormat) -> bytes:
|
||||
if format is serialization.PublicFormat.CompressedPoint:
|
||||
conversion = self._backend._lib.POINT_CONVERSION_COMPRESSED
|
||||
else:
|
||||
assert format is serialization.PublicFormat.UncompressedPoint
|
||||
conversion = self._backend._lib.POINT_CONVERSION_UNCOMPRESSED
|
||||
|
||||
group = self._backend._lib.EC_KEY_get0_group(self._ec_key)
|
||||
self._backend.openssl_assert(group != self._backend._ffi.NULL)
|
||||
point = self._backend._lib.EC_KEY_get0_public_key(self._ec_key)
|
||||
self._backend.openssl_assert(point != self._backend._ffi.NULL)
|
||||
with self._backend._tmp_bn_ctx() as bn_ctx:
|
||||
buflen = self._backend._lib.EC_POINT_point2oct(
|
||||
group, point, conversion, self._backend._ffi.NULL, 0, bn_ctx
|
||||
)
|
||||
self._backend.openssl_assert(buflen > 0)
|
||||
buf = self._backend._ffi.new("char[]", buflen)
|
||||
res = self._backend._lib.EC_POINT_point2oct(
|
||||
group, point, conversion, buf, buflen, bn_ctx
|
||||
)
|
||||
self._backend.openssl_assert(buflen == res)
|
||||
|
||||
return self._backend._ffi.buffer(buf)[:]
|
||||
|
||||
def public_bytes(
|
||||
self,
|
||||
encoding: serialization.Encoding,
|
||||
format: serialization.PublicFormat,
|
||||
) -> bytes:
|
||||
if (
|
||||
encoding is serialization.Encoding.X962
|
||||
or format is serialization.PublicFormat.CompressedPoint
|
||||
or format is serialization.PublicFormat.UncompressedPoint
|
||||
):
|
||||
if encoding is not serialization.Encoding.X962 or format not in (
|
||||
serialization.PublicFormat.CompressedPoint,
|
||||
serialization.PublicFormat.UncompressedPoint,
|
||||
):
|
||||
raise ValueError(
|
||||
"X962 encoding must be used with CompressedPoint or "
|
||||
"UncompressedPoint format"
|
||||
)
|
||||
|
||||
return self._encode_point(format)
|
||||
else:
|
||||
return self._backend._public_key_bytes(
|
||||
encoding, format, self, self._evp_pkey, None
|
||||
)
|
||||
|
||||
def verify(
|
||||
self,
|
||||
signature: bytes,
|
||||
data: bytes,
|
||||
signature_algorithm: ec.EllipticCurveSignatureAlgorithm,
|
||||
) -> None:
|
||||
_check_signature_algorithm(signature_algorithm)
|
||||
data, _ = _calculate_digest_and_algorithm(
|
||||
data,
|
||||
signature_algorithm.algorithm,
|
||||
)
|
||||
_ecdsa_sig_verify(self._backend, self, signature, data)
|
||||
@@ -1,599 +0,0 @@
|
||||
# This file is dual licensed under the terms of the Apache License, Version
|
||||
# 2.0, and the BSD License. See the LICENSE file in the root of this repository
|
||||
# for complete details.
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import threading
|
||||
import typing
|
||||
|
||||
from cryptography.exceptions import (
|
||||
InvalidSignature,
|
||||
UnsupportedAlgorithm,
|
||||
_Reasons,
|
||||
)
|
||||
from cryptography.hazmat.backends.openssl.utils import (
|
||||
_calculate_digest_and_algorithm,
|
||||
)
|
||||
from cryptography.hazmat.primitives import hashes, serialization
|
||||
from cryptography.hazmat.primitives.asymmetric import utils as asym_utils
|
||||
from cryptography.hazmat.primitives.asymmetric.padding import (
|
||||
MGF1,
|
||||
OAEP,
|
||||
PSS,
|
||||
AsymmetricPadding,
|
||||
PKCS1v15,
|
||||
_Auto,
|
||||
_DigestLength,
|
||||
_MaxLength,
|
||||
calculate_max_pss_salt_length,
|
||||
)
|
||||
from cryptography.hazmat.primitives.asymmetric.rsa import (
|
||||
RSAPrivateKey,
|
||||
RSAPrivateNumbers,
|
||||
RSAPublicKey,
|
||||
RSAPublicNumbers,
|
||||
)
|
||||
|
||||
if typing.TYPE_CHECKING:
|
||||
from cryptography.hazmat.backends.openssl.backend import Backend
|
||||
|
||||
|
||||
def _get_rsa_pss_salt_length(
|
||||
backend: Backend,
|
||||
pss: PSS,
|
||||
key: typing.Union[RSAPrivateKey, RSAPublicKey],
|
||||
hash_algorithm: hashes.HashAlgorithm,
|
||||
) -> int:
|
||||
salt = pss._salt_length
|
||||
|
||||
if isinstance(salt, _MaxLength):
|
||||
return calculate_max_pss_salt_length(key, hash_algorithm)
|
||||
elif isinstance(salt, _DigestLength):
|
||||
return hash_algorithm.digest_size
|
||||
elif isinstance(salt, _Auto):
|
||||
if isinstance(key, RSAPrivateKey):
|
||||
raise ValueError(
|
||||
"PSS salt length can only be set to AUTO when verifying"
|
||||
)
|
||||
return backend._lib.RSA_PSS_SALTLEN_AUTO
|
||||
else:
|
||||
return salt
|
||||
|
||||
|
||||
def _enc_dec_rsa(
|
||||
backend: Backend,
|
||||
key: typing.Union[_RSAPrivateKey, _RSAPublicKey],
|
||||
data: bytes,
|
||||
padding: AsymmetricPadding,
|
||||
) -> bytes:
|
||||
if not isinstance(padding, AsymmetricPadding):
|
||||
raise TypeError("Padding must be an instance of AsymmetricPadding.")
|
||||
|
||||
if isinstance(padding, PKCS1v15):
|
||||
padding_enum = backend._lib.RSA_PKCS1_PADDING
|
||||
elif isinstance(padding, OAEP):
|
||||
padding_enum = backend._lib.RSA_PKCS1_OAEP_PADDING
|
||||
|
||||
if not isinstance(padding._mgf, MGF1):
|
||||
raise UnsupportedAlgorithm(
|
||||
"Only MGF1 is supported by this backend.",
|
||||
_Reasons.UNSUPPORTED_MGF,
|
||||
)
|
||||
|
||||
if not backend.rsa_padding_supported(padding):
|
||||
raise UnsupportedAlgorithm(
|
||||
"This combination of padding and hash algorithm is not "
|
||||
"supported by this backend.",
|
||||
_Reasons.UNSUPPORTED_PADDING,
|
||||
)
|
||||
|
||||
else:
|
||||
raise UnsupportedAlgorithm(
|
||||
f"{padding.name} is not supported by this backend.",
|
||||
_Reasons.UNSUPPORTED_PADDING,
|
||||
)
|
||||
|
||||
return _enc_dec_rsa_pkey_ctx(backend, key, data, padding_enum, padding)
|
||||
|
||||
|
||||
def _enc_dec_rsa_pkey_ctx(
|
||||
backend: Backend,
|
||||
key: typing.Union[_RSAPrivateKey, _RSAPublicKey],
|
||||
data: bytes,
|
||||
padding_enum: int,
|
||||
padding: AsymmetricPadding,
|
||||
) -> bytes:
|
||||
init: typing.Callable[[typing.Any], int]
|
||||
crypt: typing.Callable[[typing.Any, typing.Any, int, bytes, int], int]
|
||||
if isinstance(key, _RSAPublicKey):
|
||||
init = backend._lib.EVP_PKEY_encrypt_init
|
||||
crypt = backend._lib.EVP_PKEY_encrypt
|
||||
else:
|
||||
init = backend._lib.EVP_PKEY_decrypt_init
|
||||
crypt = backend._lib.EVP_PKEY_decrypt
|
||||
|
||||
pkey_ctx = backend._lib.EVP_PKEY_CTX_new(key._evp_pkey, backend._ffi.NULL)
|
||||
backend.openssl_assert(pkey_ctx != backend._ffi.NULL)
|
||||
pkey_ctx = backend._ffi.gc(pkey_ctx, backend._lib.EVP_PKEY_CTX_free)
|
||||
res = init(pkey_ctx)
|
||||
backend.openssl_assert(res == 1)
|
||||
res = backend._lib.EVP_PKEY_CTX_set_rsa_padding(pkey_ctx, padding_enum)
|
||||
backend.openssl_assert(res > 0)
|
||||
buf_size = backend._lib.EVP_PKEY_size(key._evp_pkey)
|
||||
backend.openssl_assert(buf_size > 0)
|
||||
if isinstance(padding, OAEP):
|
||||
mgf1_md = backend._evp_md_non_null_from_algorithm(
|
||||
padding._mgf._algorithm
|
||||
)
|
||||
res = backend._lib.EVP_PKEY_CTX_set_rsa_mgf1_md(pkey_ctx, mgf1_md)
|
||||
backend.openssl_assert(res > 0)
|
||||
oaep_md = backend._evp_md_non_null_from_algorithm(padding._algorithm)
|
||||
res = backend._lib.EVP_PKEY_CTX_set_rsa_oaep_md(pkey_ctx, oaep_md)
|
||||
backend.openssl_assert(res > 0)
|
||||
|
||||
if (
|
||||
isinstance(padding, OAEP)
|
||||
and padding._label is not None
|
||||
and len(padding._label) > 0
|
||||
):
|
||||
# set0_rsa_oaep_label takes ownership of the char * so we need to
|
||||
# copy it into some new memory
|
||||
labelptr = backend._lib.OPENSSL_malloc(len(padding._label))
|
||||
backend.openssl_assert(labelptr != backend._ffi.NULL)
|
||||
backend._ffi.memmove(labelptr, padding._label, len(padding._label))
|
||||
res = backend._lib.EVP_PKEY_CTX_set0_rsa_oaep_label(
|
||||
pkey_ctx, labelptr, len(padding._label)
|
||||
)
|
||||
backend.openssl_assert(res == 1)
|
||||
|
||||
outlen = backend._ffi.new("size_t *", buf_size)
|
||||
buf = backend._ffi.new("unsigned char[]", buf_size)
|
||||
# Everything from this line onwards is written with the goal of being as
|
||||
# constant-time as is practical given the constraints of Python and our
|
||||
# API. See Bleichenbacher's '98 attack on RSA, and its many many variants.
|
||||
# As such, you should not attempt to change this (particularly to "clean it
|
||||
# up") without understanding why it was written this way (see
|
||||
# Chesterton's Fence), and without measuring to verify you have not
|
||||
# introduced observable time differences.
|
||||
res = crypt(pkey_ctx, buf, outlen, data, len(data))
|
||||
resbuf = backend._ffi.buffer(buf)[: outlen[0]]
|
||||
backend._lib.ERR_clear_error()
|
||||
if res <= 0:
|
||||
raise ValueError("Encryption/decryption failed.")
|
||||
return resbuf
|
||||
|
||||
|
||||
def _rsa_sig_determine_padding(
|
||||
backend: Backend,
|
||||
key: typing.Union[_RSAPrivateKey, _RSAPublicKey],
|
||||
padding: AsymmetricPadding,
|
||||
algorithm: typing.Optional[hashes.HashAlgorithm],
|
||||
) -> int:
|
||||
if not isinstance(padding, AsymmetricPadding):
|
||||
raise TypeError("Expected provider of AsymmetricPadding.")
|
||||
|
||||
pkey_size = backend._lib.EVP_PKEY_size(key._evp_pkey)
|
||||
backend.openssl_assert(pkey_size > 0)
|
||||
|
||||
if isinstance(padding, PKCS1v15):
|
||||
# Hash algorithm is ignored for PKCS1v15-padding, may be None.
|
||||
padding_enum = backend._lib.RSA_PKCS1_PADDING
|
||||
elif isinstance(padding, PSS):
|
||||
if not isinstance(padding._mgf, MGF1):
|
||||
raise UnsupportedAlgorithm(
|
||||
"Only MGF1 is supported by this backend.",
|
||||
_Reasons.UNSUPPORTED_MGF,
|
||||
)
|
||||
|
||||
# PSS padding requires a hash algorithm
|
||||
if not isinstance(algorithm, hashes.HashAlgorithm):
|
||||
raise TypeError("Expected instance of hashes.HashAlgorithm.")
|
||||
|
||||
# Size of key in bytes - 2 is the maximum
|
||||
# PSS signature length (salt length is checked later)
|
||||
if pkey_size - algorithm.digest_size - 2 < 0:
|
||||
raise ValueError(
|
||||
"Digest too large for key size. Use a larger "
|
||||
"key or different digest."
|
||||
)
|
||||
|
||||
padding_enum = backend._lib.RSA_PKCS1_PSS_PADDING
|
||||
else:
|
||||
raise UnsupportedAlgorithm(
|
||||
f"{padding.name} is not supported by this backend.",
|
||||
_Reasons.UNSUPPORTED_PADDING,
|
||||
)
|
||||
|
||||
return padding_enum
|
||||
|
||||
|
||||
# Hash algorithm can be absent (None) to initialize the context without setting
|
||||
# any message digest algorithm. This is currently only valid for the PKCS1v15
|
||||
# padding type, where it means that the signature data is encoded/decoded
|
||||
# as provided, without being wrapped in a DigestInfo structure.
|
||||
def _rsa_sig_setup(
|
||||
backend: Backend,
|
||||
padding: AsymmetricPadding,
|
||||
algorithm: typing.Optional[hashes.HashAlgorithm],
|
||||
key: typing.Union[_RSAPublicKey, _RSAPrivateKey],
|
||||
init_func: typing.Callable[[typing.Any], int],
|
||||
):
|
||||
padding_enum = _rsa_sig_determine_padding(backend, key, padding, algorithm)
|
||||
pkey_ctx = backend._lib.EVP_PKEY_CTX_new(key._evp_pkey, backend._ffi.NULL)
|
||||
backend.openssl_assert(pkey_ctx != backend._ffi.NULL)
|
||||
pkey_ctx = backend._ffi.gc(pkey_ctx, backend._lib.EVP_PKEY_CTX_free)
|
||||
res = init_func(pkey_ctx)
|
||||
if res != 1:
|
||||
errors = backend._consume_errors()
|
||||
raise ValueError("Unable to sign/verify with this key", errors)
|
||||
|
||||
if algorithm is not None:
|
||||
evp_md = backend._evp_md_non_null_from_algorithm(algorithm)
|
||||
res = backend._lib.EVP_PKEY_CTX_set_signature_md(pkey_ctx, evp_md)
|
||||
if res <= 0:
|
||||
backend._consume_errors()
|
||||
raise UnsupportedAlgorithm(
|
||||
"{} is not supported by this backend for RSA signing.".format(
|
||||
algorithm.name
|
||||
),
|
||||
_Reasons.UNSUPPORTED_HASH,
|
||||
)
|
||||
res = backend._lib.EVP_PKEY_CTX_set_rsa_padding(pkey_ctx, padding_enum)
|
||||
if res <= 0:
|
||||
backend._consume_errors()
|
||||
raise UnsupportedAlgorithm(
|
||||
"{} is not supported for the RSA signature operation.".format(
|
||||
padding.name
|
||||
),
|
||||
_Reasons.UNSUPPORTED_PADDING,
|
||||
)
|
||||
if isinstance(padding, PSS):
|
||||
assert isinstance(algorithm, hashes.HashAlgorithm)
|
||||
res = backend._lib.EVP_PKEY_CTX_set_rsa_pss_saltlen(
|
||||
pkey_ctx,
|
||||
_get_rsa_pss_salt_length(backend, padding, key, algorithm),
|
||||
)
|
||||
backend.openssl_assert(res > 0)
|
||||
|
||||
mgf1_md = backend._evp_md_non_null_from_algorithm(
|
||||
padding._mgf._algorithm
|
||||
)
|
||||
res = backend._lib.EVP_PKEY_CTX_set_rsa_mgf1_md(pkey_ctx, mgf1_md)
|
||||
backend.openssl_assert(res > 0)
|
||||
|
||||
return pkey_ctx
|
||||
|
||||
|
||||
def _rsa_sig_sign(
|
||||
backend: Backend,
|
||||
padding: AsymmetricPadding,
|
||||
algorithm: hashes.HashAlgorithm,
|
||||
private_key: _RSAPrivateKey,
|
||||
data: bytes,
|
||||
) -> bytes:
|
||||
pkey_ctx = _rsa_sig_setup(
|
||||
backend,
|
||||
padding,
|
||||
algorithm,
|
||||
private_key,
|
||||
backend._lib.EVP_PKEY_sign_init,
|
||||
)
|
||||
buflen = backend._ffi.new("size_t *")
|
||||
res = backend._lib.EVP_PKEY_sign(
|
||||
pkey_ctx, backend._ffi.NULL, buflen, data, len(data)
|
||||
)
|
||||
backend.openssl_assert(res == 1)
|
||||
buf = backend._ffi.new("unsigned char[]", buflen[0])
|
||||
res = backend._lib.EVP_PKEY_sign(pkey_ctx, buf, buflen, data, len(data))
|
||||
if res != 1:
|
||||
errors = backend._consume_errors()
|
||||
raise ValueError(
|
||||
"Digest or salt length too long for key size. Use a larger key "
|
||||
"or shorter salt length if you are specifying a PSS salt",
|
||||
errors,
|
||||
)
|
||||
|
||||
return backend._ffi.buffer(buf)[:]
|
||||
|
||||
|
||||
def _rsa_sig_verify(
|
||||
backend: Backend,
|
||||
padding: AsymmetricPadding,
|
||||
algorithm: hashes.HashAlgorithm,
|
||||
public_key: _RSAPublicKey,
|
||||
signature: bytes,
|
||||
data: bytes,
|
||||
) -> None:
|
||||
pkey_ctx = _rsa_sig_setup(
|
||||
backend,
|
||||
padding,
|
||||
algorithm,
|
||||
public_key,
|
||||
backend._lib.EVP_PKEY_verify_init,
|
||||
)
|
||||
res = backend._lib.EVP_PKEY_verify(
|
||||
pkey_ctx, signature, len(signature), data, len(data)
|
||||
)
|
||||
# The previous call can return negative numbers in the event of an
|
||||
# error. This is not a signature failure but we need to fail if it
|
||||
# occurs.
|
||||
backend.openssl_assert(res >= 0)
|
||||
if res == 0:
|
||||
backend._consume_errors()
|
||||
raise InvalidSignature
|
||||
|
||||
|
||||
def _rsa_sig_recover(
|
||||
backend: Backend,
|
||||
padding: AsymmetricPadding,
|
||||
algorithm: typing.Optional[hashes.HashAlgorithm],
|
||||
public_key: _RSAPublicKey,
|
||||
signature: bytes,
|
||||
) -> bytes:
|
||||
pkey_ctx = _rsa_sig_setup(
|
||||
backend,
|
||||
padding,
|
||||
algorithm,
|
||||
public_key,
|
||||
backend._lib.EVP_PKEY_verify_recover_init,
|
||||
)
|
||||
|
||||
# Attempt to keep the rest of the code in this function as constant/time
|
||||
# as possible. See the comment in _enc_dec_rsa_pkey_ctx. Note that the
|
||||
# buflen parameter is used even though its value may be undefined in the
|
||||
# error case. Due to the tolerant nature of Python slicing this does not
|
||||
# trigger any exceptions.
|
||||
maxlen = backend._lib.EVP_PKEY_size(public_key._evp_pkey)
|
||||
backend.openssl_assert(maxlen > 0)
|
||||
buf = backend._ffi.new("unsigned char[]", maxlen)
|
||||
buflen = backend._ffi.new("size_t *", maxlen)
|
||||
res = backend._lib.EVP_PKEY_verify_recover(
|
||||
pkey_ctx, buf, buflen, signature, len(signature)
|
||||
)
|
||||
resbuf = backend._ffi.buffer(buf)[: buflen[0]]
|
||||
backend._lib.ERR_clear_error()
|
||||
# Assume that all parameter errors are handled during the setup phase and
|
||||
# any error here is due to invalid signature.
|
||||
if res != 1:
|
||||
raise InvalidSignature
|
||||
return resbuf
|
||||
|
||||
|
||||
class _RSAPrivateKey(RSAPrivateKey):
|
||||
_evp_pkey: object
|
||||
_rsa_cdata: object
|
||||
_key_size: int
|
||||
|
||||
def __init__(
|
||||
self,
|
||||
backend: Backend,
|
||||
rsa_cdata,
|
||||
evp_pkey,
|
||||
*,
|
||||
unsafe_skip_rsa_key_validation: bool,
|
||||
):
|
||||
res: int
|
||||
# RSA_check_key is slower in OpenSSL 3.0.0 due to improved
|
||||
# primality checking. In normal use this is unlikely to be a problem
|
||||
# since users don't load new keys constantly, but for TESTING we've
|
||||
# added an init arg that allows skipping the checks. You should not
|
||||
# use this in production code unless you understand the consequences.
|
||||
if not unsafe_skip_rsa_key_validation:
|
||||
res = backend._lib.RSA_check_key(rsa_cdata)
|
||||
if res != 1:
|
||||
errors = backend._consume_errors()
|
||||
raise ValueError("Invalid private key", errors)
|
||||
# 2 is prime and passes an RSA key check, so we also check
|
||||
# if p and q are odd just to be safe.
|
||||
p = backend._ffi.new("BIGNUM **")
|
||||
q = backend._ffi.new("BIGNUM **")
|
||||
backend._lib.RSA_get0_factors(rsa_cdata, p, q)
|
||||
backend.openssl_assert(p[0] != backend._ffi.NULL)
|
||||
backend.openssl_assert(q[0] != backend._ffi.NULL)
|
||||
p_odd = backend._lib.BN_is_odd(p[0])
|
||||
q_odd = backend._lib.BN_is_odd(q[0])
|
||||
if p_odd != 1 or q_odd != 1:
|
||||
errors = backend._consume_errors()
|
||||
raise ValueError("Invalid private key", errors)
|
||||
|
||||
self._backend = backend
|
||||
self._rsa_cdata = rsa_cdata
|
||||
self._evp_pkey = evp_pkey
|
||||
# Used for lazy blinding
|
||||
self._blinded = False
|
||||
self._blinding_lock = threading.Lock()
|
||||
|
||||
n = self._backend._ffi.new("BIGNUM **")
|
||||
self._backend._lib.RSA_get0_key(
|
||||
self._rsa_cdata,
|
||||
n,
|
||||
self._backend._ffi.NULL,
|
||||
self._backend._ffi.NULL,
|
||||
)
|
||||
self._backend.openssl_assert(n[0] != self._backend._ffi.NULL)
|
||||
self._key_size = self._backend._lib.BN_num_bits(n[0])
|
||||
|
||||
def _enable_blinding(self) -> None:
|
||||
# If you call blind on an already blinded RSA key OpenSSL will turn
|
||||
# it off and back on, which is a performance hit we want to avoid.
|
||||
if not self._blinded:
|
||||
with self._blinding_lock:
|
||||
self._non_threadsafe_enable_blinding()
|
||||
|
||||
def _non_threadsafe_enable_blinding(self) -> None:
|
||||
# This is only a separate function to allow for testing to cover both
|
||||
# branches. It should never be invoked except through _enable_blinding.
|
||||
# Check if it's not True again in case another thread raced past the
|
||||
# first non-locked check.
|
||||
if not self._blinded:
|
||||
res = self._backend._lib.RSA_blinding_on(
|
||||
self._rsa_cdata, self._backend._ffi.NULL
|
||||
)
|
||||
self._backend.openssl_assert(res == 1)
|
||||
self._blinded = True
|
||||
|
||||
@property
|
||||
def key_size(self) -> int:
|
||||
return self._key_size
|
||||
|
||||
def decrypt(self, ciphertext: bytes, padding: AsymmetricPadding) -> bytes:
|
||||
self._enable_blinding()
|
||||
key_size_bytes = (self.key_size + 7) // 8
|
||||
if key_size_bytes != len(ciphertext):
|
||||
raise ValueError("Ciphertext length must be equal to key size.")
|
||||
|
||||
return _enc_dec_rsa(self._backend, self, ciphertext, padding)
|
||||
|
||||
def public_key(self) -> RSAPublicKey:
|
||||
ctx = self._backend._lib.RSAPublicKey_dup(self._rsa_cdata)
|
||||
self._backend.openssl_assert(ctx != self._backend._ffi.NULL)
|
||||
ctx = self._backend._ffi.gc(ctx, self._backend._lib.RSA_free)
|
||||
evp_pkey = self._backend._rsa_cdata_to_evp_pkey(ctx)
|
||||
return _RSAPublicKey(self._backend, ctx, evp_pkey)
|
||||
|
||||
def private_numbers(self) -> RSAPrivateNumbers:
|
||||
n = self._backend._ffi.new("BIGNUM **")
|
||||
e = self._backend._ffi.new("BIGNUM **")
|
||||
d = self._backend._ffi.new("BIGNUM **")
|
||||
p = self._backend._ffi.new("BIGNUM **")
|
||||
q = self._backend._ffi.new("BIGNUM **")
|
||||
dmp1 = self._backend._ffi.new("BIGNUM **")
|
||||
dmq1 = self._backend._ffi.new("BIGNUM **")
|
||||
iqmp = self._backend._ffi.new("BIGNUM **")
|
||||
self._backend._lib.RSA_get0_key(self._rsa_cdata, n, e, d)
|
||||
self._backend.openssl_assert(n[0] != self._backend._ffi.NULL)
|
||||
self._backend.openssl_assert(e[0] != self._backend._ffi.NULL)
|
||||
self._backend.openssl_assert(d[0] != self._backend._ffi.NULL)
|
||||
self._backend._lib.RSA_get0_factors(self._rsa_cdata, p, q)
|
||||
self._backend.openssl_assert(p[0] != self._backend._ffi.NULL)
|
||||
self._backend.openssl_assert(q[0] != self._backend._ffi.NULL)
|
||||
self._backend._lib.RSA_get0_crt_params(
|
||||
self._rsa_cdata, dmp1, dmq1, iqmp
|
||||
)
|
||||
self._backend.openssl_assert(dmp1[0] != self._backend._ffi.NULL)
|
||||
self._backend.openssl_assert(dmq1[0] != self._backend._ffi.NULL)
|
||||
self._backend.openssl_assert(iqmp[0] != self._backend._ffi.NULL)
|
||||
return RSAPrivateNumbers(
|
||||
p=self._backend._bn_to_int(p[0]),
|
||||
q=self._backend._bn_to_int(q[0]),
|
||||
d=self._backend._bn_to_int(d[0]),
|
||||
dmp1=self._backend._bn_to_int(dmp1[0]),
|
||||
dmq1=self._backend._bn_to_int(dmq1[0]),
|
||||
iqmp=self._backend._bn_to_int(iqmp[0]),
|
||||
public_numbers=RSAPublicNumbers(
|
||||
e=self._backend._bn_to_int(e[0]),
|
||||
n=self._backend._bn_to_int(n[0]),
|
||||
),
|
||||
)
|
||||
|
||||
def private_bytes(
|
||||
self,
|
||||
encoding: serialization.Encoding,
|
||||
format: serialization.PrivateFormat,
|
||||
encryption_algorithm: serialization.KeySerializationEncryption,
|
||||
) -> bytes:
|
||||
return self._backend._private_key_bytes(
|
||||
encoding,
|
||||
format,
|
||||
encryption_algorithm,
|
||||
self,
|
||||
self._evp_pkey,
|
||||
self._rsa_cdata,
|
||||
)
|
||||
|
||||
def sign(
|
||||
self,
|
||||
data: bytes,
|
||||
padding: AsymmetricPadding,
|
||||
algorithm: typing.Union[asym_utils.Prehashed, hashes.HashAlgorithm],
|
||||
) -> bytes:
|
||||
self._enable_blinding()
|
||||
data, algorithm = _calculate_digest_and_algorithm(data, algorithm)
|
||||
return _rsa_sig_sign(self._backend, padding, algorithm, self, data)
|
||||
|
||||
|
||||
class _RSAPublicKey(RSAPublicKey):
|
||||
_evp_pkey: object
|
||||
_rsa_cdata: object
|
||||
_key_size: int
|
||||
|
||||
def __init__(self, backend: Backend, rsa_cdata, evp_pkey):
|
||||
self._backend = backend
|
||||
self._rsa_cdata = rsa_cdata
|
||||
self._evp_pkey = evp_pkey
|
||||
|
||||
n = self._backend._ffi.new("BIGNUM **")
|
||||
self._backend._lib.RSA_get0_key(
|
||||
self._rsa_cdata,
|
||||
n,
|
||||
self._backend._ffi.NULL,
|
||||
self._backend._ffi.NULL,
|
||||
)
|
||||
self._backend.openssl_assert(n[0] != self._backend._ffi.NULL)
|
||||
self._key_size = self._backend._lib.BN_num_bits(n[0])
|
||||
|
||||
@property
|
||||
def key_size(self) -> int:
|
||||
return self._key_size
|
||||
|
||||
def __eq__(self, other: object) -> bool:
|
||||
if not isinstance(other, _RSAPublicKey):
|
||||
return NotImplemented
|
||||
|
||||
return (
|
||||
self._backend._lib.EVP_PKEY_cmp(self._evp_pkey, other._evp_pkey)
|
||||
== 1
|
||||
)
|
||||
|
||||
def encrypt(self, plaintext: bytes, padding: AsymmetricPadding) -> bytes:
|
||||
return _enc_dec_rsa(self._backend, self, plaintext, padding)
|
||||
|
||||
def public_numbers(self) -> RSAPublicNumbers:
|
||||
n = self._backend._ffi.new("BIGNUM **")
|
||||
e = self._backend._ffi.new("BIGNUM **")
|
||||
self._backend._lib.RSA_get0_key(
|
||||
self._rsa_cdata, n, e, self._backend._ffi.NULL
|
||||
)
|
||||
self._backend.openssl_assert(n[0] != self._backend._ffi.NULL)
|
||||
self._backend.openssl_assert(e[0] != self._backend._ffi.NULL)
|
||||
return RSAPublicNumbers(
|
||||
e=self._backend._bn_to_int(e[0]),
|
||||
n=self._backend._bn_to_int(n[0]),
|
||||
)
|
||||
|
||||
def public_bytes(
|
||||
self,
|
||||
encoding: serialization.Encoding,
|
||||
format: serialization.PublicFormat,
|
||||
) -> bytes:
|
||||
return self._backend._public_key_bytes(
|
||||
encoding, format, self, self._evp_pkey, self._rsa_cdata
|
||||
)
|
||||
|
||||
def verify(
|
||||
self,
|
||||
signature: bytes,
|
||||
data: bytes,
|
||||
padding: AsymmetricPadding,
|
||||
algorithm: typing.Union[asym_utils.Prehashed, hashes.HashAlgorithm],
|
||||
) -> None:
|
||||
data, algorithm = _calculate_digest_and_algorithm(data, algorithm)
|
||||
_rsa_sig_verify(
|
||||
self._backend, padding, algorithm, self, signature, data
|
||||
)
|
||||
|
||||
def recover_data_from_signature(
|
||||
self,
|
||||
signature: bytes,
|
||||
padding: AsymmetricPadding,
|
||||
algorithm: typing.Optional[hashes.HashAlgorithm],
|
||||
) -> bytes:
|
||||
if isinstance(algorithm, asym_utils.Prehashed):
|
||||
raise TypeError(
|
||||
"Prehashed is only supported in the sign and verify methods. "
|
||||
"It cannot be used with recover_data_from_signature."
|
||||
)
|
||||
return _rsa_sig_recover(
|
||||
self._backend, padding, algorithm, self, signature
|
||||
)
|
||||
@@ -1,63 +0,0 @@
|
||||
# This file is dual licensed under the terms of the Apache License, Version
|
||||
# 2.0, and the BSD License. See the LICENSE file in the root of this repository
|
||||
# for complete details.
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import typing
|
||||
|
||||
from cryptography.hazmat.primitives import hashes
|
||||
from cryptography.hazmat.primitives.asymmetric.utils import Prehashed
|
||||
|
||||
if typing.TYPE_CHECKING:
|
||||
from cryptography.hazmat.backends.openssl.backend import Backend
|
||||
|
||||
|
||||
def _evp_pkey_derive(backend: Backend, evp_pkey, peer_public_key) -> bytes:
|
||||
ctx = backend._lib.EVP_PKEY_CTX_new(evp_pkey, backend._ffi.NULL)
|
||||
backend.openssl_assert(ctx != backend._ffi.NULL)
|
||||
ctx = backend._ffi.gc(ctx, backend._lib.EVP_PKEY_CTX_free)
|
||||
res = backend._lib.EVP_PKEY_derive_init(ctx)
|
||||
backend.openssl_assert(res == 1)
|
||||
|
||||
if backend._lib.Cryptography_HAS_EVP_PKEY_SET_PEER_EX:
|
||||
res = backend._lib.EVP_PKEY_derive_set_peer_ex(
|
||||
ctx, peer_public_key._evp_pkey, 0
|
||||
)
|
||||
else:
|
||||
res = backend._lib.EVP_PKEY_derive_set_peer(
|
||||
ctx, peer_public_key._evp_pkey
|
||||
)
|
||||
backend.openssl_assert(res == 1)
|
||||
|
||||
keylen = backend._ffi.new("size_t *")
|
||||
res = backend._lib.EVP_PKEY_derive(ctx, backend._ffi.NULL, keylen)
|
||||
backend.openssl_assert(res == 1)
|
||||
backend.openssl_assert(keylen[0] > 0)
|
||||
buf = backend._ffi.new("unsigned char[]", keylen[0])
|
||||
res = backend._lib.EVP_PKEY_derive(ctx, buf, keylen)
|
||||
if res != 1:
|
||||
errors = backend._consume_errors()
|
||||
raise ValueError("Error computing shared key.", errors)
|
||||
|
||||
return backend._ffi.buffer(buf, keylen[0])[:]
|
||||
|
||||
|
||||
def _calculate_digest_and_algorithm(
|
||||
data: bytes,
|
||||
algorithm: typing.Union[Prehashed, hashes.HashAlgorithm],
|
||||
) -> typing.Tuple[bytes, hashes.HashAlgorithm]:
|
||||
if not isinstance(algorithm, Prehashed):
|
||||
hash_ctx = hashes.Hash(algorithm)
|
||||
hash_ctx.update(data)
|
||||
data = hash_ctx.finalize()
|
||||
else:
|
||||
algorithm = algorithm._algorithm
|
||||
|
||||
if len(data) != algorithm.digest_size:
|
||||
raise ValueError(
|
||||
"The provided data must be the same length as the hash "
|
||||
"algorithm's digest size."
|
||||
)
|
||||
|
||||
return (data, algorithm)
|
||||
Reference in New Issue
Block a user