update to python fastpi
This commit is contained in:
Iliyan Angelov
@@ -0,0 +1,27 @@
|
||||
# This file is dual licensed under the terms of the Apache License, Version
|
||||
# 2.0, and the BSD License. See the LICENSE file in the root of this repository
|
||||
# for complete details.
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
from cryptography.hazmat.primitives._cipheralgorithm import (
|
||||
BlockCipherAlgorithm,
|
||||
CipherAlgorithm,
|
||||
)
|
||||
from cryptography.hazmat.primitives.ciphers.base import (
|
||||
AEADCipherContext,
|
||||
AEADDecryptionContext,
|
||||
AEADEncryptionContext,
|
||||
Cipher,
|
||||
CipherContext,
|
||||
)
|
||||
|
||||
__all__ = [
|
||||
"Cipher",
|
||||
"CipherAlgorithm",
|
||||
"BlockCipherAlgorithm",
|
||||
"CipherContext",
|
||||
"AEADCipherContext",
|
||||
"AEADDecryptionContext",
|
||||
"AEADEncryptionContext",
|
||||
]
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,378 @@
|
||||
# This file is dual licensed under the terms of the Apache License, Version
|
||||
# 2.0, and the BSD License. See the LICENSE file in the root of this repository
|
||||
# for complete details.
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import os
|
||||
import typing
|
||||
|
||||
from cryptography import exceptions, utils
|
||||
from cryptography.hazmat.backends.openssl import aead
|
||||
from cryptography.hazmat.backends.openssl.backend import backend
|
||||
from cryptography.hazmat.bindings._rust import FixedPool
|
||||
|
||||
|
||||
class ChaCha20Poly1305:
|
||||
_MAX_SIZE = 2**31 - 1
|
||||
|
||||
def __init__(self, key: bytes):
|
||||
if not backend.aead_cipher_supported(self):
|
||||
raise exceptions.UnsupportedAlgorithm(
|
||||
"ChaCha20Poly1305 is not supported by this version of OpenSSL",
|
||||
exceptions._Reasons.UNSUPPORTED_CIPHER,
|
||||
)
|
||||
utils._check_byteslike("key", key)
|
||||
|
||||
if len(key) != 32:
|
||||
raise ValueError("ChaCha20Poly1305 key must be 32 bytes.")
|
||||
|
||||
self._key = key
|
||||
self._pool = FixedPool(self._create_fn)
|
||||
|
||||
@classmethod
|
||||
def generate_key(cls) -> bytes:
|
||||
return os.urandom(32)
|
||||
|
||||
def _create_fn(self):
|
||||
return aead._aead_create_ctx(backend, self, self._key)
|
||||
|
||||
def encrypt(
|
||||
self,
|
||||
nonce: bytes,
|
||||
data: bytes,
|
||||
associated_data: typing.Optional[bytes],
|
||||
) -> bytes:
|
||||
if associated_data is None:
|
||||
associated_data = b""
|
||||
|
||||
if len(data) > self._MAX_SIZE or len(associated_data) > self._MAX_SIZE:
|
||||
# This is OverflowError to match what cffi would raise
|
||||
raise OverflowError(
|
||||
"Data or associated data too long. Max 2**31 - 1 bytes"
|
||||
)
|
||||
|
||||
self._check_params(nonce, data, associated_data)
|
||||
with self._pool.acquire() as ctx:
|
||||
return aead._encrypt(
|
||||
backend, self, nonce, data, [associated_data], 16, ctx
|
||||
)
|
||||
|
||||
def decrypt(
|
||||
self,
|
||||
nonce: bytes,
|
||||
data: bytes,
|
||||
associated_data: typing.Optional[bytes],
|
||||
) -> bytes:
|
||||
if associated_data is None:
|
||||
associated_data = b""
|
||||
|
||||
self._check_params(nonce, data, associated_data)
|
||||
with self._pool.acquire() as ctx:
|
||||
return aead._decrypt(
|
||||
backend, self, nonce, data, [associated_data], 16, ctx
|
||||
)
|
||||
|
||||
def _check_params(
|
||||
self,
|
||||
nonce: bytes,
|
||||
data: bytes,
|
||||
associated_data: bytes,
|
||||
) -> None:
|
||||
utils._check_byteslike("nonce", nonce)
|
||||
utils._check_byteslike("data", data)
|
||||
utils._check_byteslike("associated_data", associated_data)
|
||||
if len(nonce) != 12:
|
||||
raise ValueError("Nonce must be 12 bytes")
|
||||
|
||||
|
||||
class AESCCM:
|
||||
_MAX_SIZE = 2**31 - 1
|
||||
|
||||
def __init__(self, key: bytes, tag_length: int = 16):
|
||||
utils._check_byteslike("key", key)
|
||||
if len(key) not in (16, 24, 32):
|
||||
raise ValueError("AESCCM key must be 128, 192, or 256 bits.")
|
||||
|
||||
self._key = key
|
||||
if not isinstance(tag_length, int):
|
||||
raise TypeError("tag_length must be an integer")
|
||||
|
||||
if tag_length not in (4, 6, 8, 10, 12, 14, 16):
|
||||
raise ValueError("Invalid tag_length")
|
||||
|
||||
self._tag_length = tag_length
|
||||
|
||||
if not backend.aead_cipher_supported(self):
|
||||
raise exceptions.UnsupportedAlgorithm(
|
||||
"AESCCM is not supported by this version of OpenSSL",
|
||||
exceptions._Reasons.UNSUPPORTED_CIPHER,
|
||||
)
|
||||
|
||||
@classmethod
|
||||
def generate_key(cls, bit_length: int) -> bytes:
|
||||
if not isinstance(bit_length, int):
|
||||
raise TypeError("bit_length must be an integer")
|
||||
|
||||
if bit_length not in (128, 192, 256):
|
||||
raise ValueError("bit_length must be 128, 192, or 256")
|
||||
|
||||
return os.urandom(bit_length // 8)
|
||||
|
||||
def encrypt(
|
||||
self,
|
||||
nonce: bytes,
|
||||
data: bytes,
|
||||
associated_data: typing.Optional[bytes],
|
||||
) -> bytes:
|
||||
if associated_data is None:
|
||||
associated_data = b""
|
||||
|
||||
if len(data) > self._MAX_SIZE or len(associated_data) > self._MAX_SIZE:
|
||||
# This is OverflowError to match what cffi would raise
|
||||
raise OverflowError(
|
||||
"Data or associated data too long. Max 2**31 - 1 bytes"
|
||||
)
|
||||
|
||||
self._check_params(nonce, data, associated_data)
|
||||
self._validate_lengths(nonce, len(data))
|
||||
return aead._encrypt(
|
||||
backend, self, nonce, data, [associated_data], self._tag_length
|
||||
)
|
||||
|
||||
def decrypt(
|
||||
self,
|
||||
nonce: bytes,
|
||||
data: bytes,
|
||||
associated_data: typing.Optional[bytes],
|
||||
) -> bytes:
|
||||
if associated_data is None:
|
||||
associated_data = b""
|
||||
|
||||
self._check_params(nonce, data, associated_data)
|
||||
return aead._decrypt(
|
||||
backend, self, nonce, data, [associated_data], self._tag_length
|
||||
)
|
||||
|
||||
def _validate_lengths(self, nonce: bytes, data_len: int) -> None:
|
||||
# For information about computing this, see
|
||||
# https://tools.ietf.org/html/rfc3610#section-2.1
|
||||
l_val = 15 - len(nonce)
|
||||
if 2 ** (8 * l_val) < data_len:
|
||||
raise ValueError("Data too long for nonce")
|
||||
|
||||
def _check_params(
|
||||
self, nonce: bytes, data: bytes, associated_data: bytes
|
||||
) -> None:
|
||||
utils._check_byteslike("nonce", nonce)
|
||||
utils._check_byteslike("data", data)
|
||||
utils._check_byteslike("associated_data", associated_data)
|
||||
if not 7 <= len(nonce) <= 13:
|
||||
raise ValueError("Nonce must be between 7 and 13 bytes")
|
||||
|
||||
|
||||
class AESGCM:
|
||||
_MAX_SIZE = 2**31 - 1
|
||||
|
||||
def __init__(self, key: bytes):
|
||||
utils._check_byteslike("key", key)
|
||||
if len(key) not in (16, 24, 32):
|
||||
raise ValueError("AESGCM key must be 128, 192, or 256 bits.")
|
||||
|
||||
self._key = key
|
||||
|
||||
@classmethod
|
||||
def generate_key(cls, bit_length: int) -> bytes:
|
||||
if not isinstance(bit_length, int):
|
||||
raise TypeError("bit_length must be an integer")
|
||||
|
||||
if bit_length not in (128, 192, 256):
|
||||
raise ValueError("bit_length must be 128, 192, or 256")
|
||||
|
||||
return os.urandom(bit_length // 8)
|
||||
|
||||
def encrypt(
|
||||
self,
|
||||
nonce: bytes,
|
||||
data: bytes,
|
||||
associated_data: typing.Optional[bytes],
|
||||
) -> bytes:
|
||||
if associated_data is None:
|
||||
associated_data = b""
|
||||
|
||||
if len(data) > self._MAX_SIZE or len(associated_data) > self._MAX_SIZE:
|
||||
# This is OverflowError to match what cffi would raise
|
||||
raise OverflowError(
|
||||
"Data or associated data too long. Max 2**31 - 1 bytes"
|
||||
)
|
||||
|
||||
self._check_params(nonce, data, associated_data)
|
||||
return aead._encrypt(backend, self, nonce, data, [associated_data], 16)
|
||||
|
||||
def decrypt(
|
||||
self,
|
||||
nonce: bytes,
|
||||
data: bytes,
|
||||
associated_data: typing.Optional[bytes],
|
||||
) -> bytes:
|
||||
if associated_data is None:
|
||||
associated_data = b""
|
||||
|
||||
self._check_params(nonce, data, associated_data)
|
||||
return aead._decrypt(backend, self, nonce, data, [associated_data], 16)
|
||||
|
||||
def _check_params(
|
||||
self,
|
||||
nonce: bytes,
|
||||
data: bytes,
|
||||
associated_data: bytes,
|
||||
) -> None:
|
||||
utils._check_byteslike("nonce", nonce)
|
||||
utils._check_byteslike("data", data)
|
||||
utils._check_byteslike("associated_data", associated_data)
|
||||
if len(nonce) < 8 or len(nonce) > 128:
|
||||
raise ValueError("Nonce must be between 8 and 128 bytes")
|
||||
|
||||
|
||||
class AESOCB3:
|
||||
_MAX_SIZE = 2**31 - 1
|
||||
|
||||
def __init__(self, key: bytes):
|
||||
utils._check_byteslike("key", key)
|
||||
if len(key) not in (16, 24, 32):
|
||||
raise ValueError("AESOCB3 key must be 128, 192, or 256 bits.")
|
||||
|
||||
self._key = key
|
||||
|
||||
if not backend.aead_cipher_supported(self):
|
||||
raise exceptions.UnsupportedAlgorithm(
|
||||
"OCB3 is not supported by this version of OpenSSL",
|
||||
exceptions._Reasons.UNSUPPORTED_CIPHER,
|
||||
)
|
||||
|
||||
@classmethod
|
||||
def generate_key(cls, bit_length: int) -> bytes:
|
||||
if not isinstance(bit_length, int):
|
||||
raise TypeError("bit_length must be an integer")
|
||||
|
||||
if bit_length not in (128, 192, 256):
|
||||
raise ValueError("bit_length must be 128, 192, or 256")
|
||||
|
||||
return os.urandom(bit_length // 8)
|
||||
|
||||
def encrypt(
|
||||
self,
|
||||
nonce: bytes,
|
||||
data: bytes,
|
||||
associated_data: typing.Optional[bytes],
|
||||
) -> bytes:
|
||||
if associated_data is None:
|
||||
associated_data = b""
|
||||
|
||||
if len(data) > self._MAX_SIZE or len(associated_data) > self._MAX_SIZE:
|
||||
# This is OverflowError to match what cffi would raise
|
||||
raise OverflowError(
|
||||
"Data or associated data too long. Max 2**31 - 1 bytes"
|
||||
)
|
||||
|
||||
self._check_params(nonce, data, associated_data)
|
||||
return aead._encrypt(backend, self, nonce, data, [associated_data], 16)
|
||||
|
||||
def decrypt(
|
||||
self,
|
||||
nonce: bytes,
|
||||
data: bytes,
|
||||
associated_data: typing.Optional[bytes],
|
||||
) -> bytes:
|
||||
if associated_data is None:
|
||||
associated_data = b""
|
||||
|
||||
self._check_params(nonce, data, associated_data)
|
||||
return aead._decrypt(backend, self, nonce, data, [associated_data], 16)
|
||||
|
||||
def _check_params(
|
||||
self,
|
||||
nonce: bytes,
|
||||
data: bytes,
|
||||
associated_data: bytes,
|
||||
) -> None:
|
||||
utils._check_byteslike("nonce", nonce)
|
||||
utils._check_byteslike("data", data)
|
||||
utils._check_byteslike("associated_data", associated_data)
|
||||
if len(nonce) < 12 or len(nonce) > 15:
|
||||
raise ValueError("Nonce must be between 12 and 15 bytes")
|
||||
|
||||
|
||||
class AESSIV:
|
||||
_MAX_SIZE = 2**31 - 1
|
||||
|
||||
def __init__(self, key: bytes):
|
||||
utils._check_byteslike("key", key)
|
||||
if len(key) not in (32, 48, 64):
|
||||
raise ValueError("AESSIV key must be 256, 384, or 512 bits.")
|
||||
|
||||
self._key = key
|
||||
|
||||
if not backend.aead_cipher_supported(self):
|
||||
raise exceptions.UnsupportedAlgorithm(
|
||||
"AES-SIV is not supported by this version of OpenSSL",
|
||||
exceptions._Reasons.UNSUPPORTED_CIPHER,
|
||||
)
|
||||
|
||||
@classmethod
|
||||
def generate_key(cls, bit_length: int) -> bytes:
|
||||
if not isinstance(bit_length, int):
|
||||
raise TypeError("bit_length must be an integer")
|
||||
|
||||
if bit_length not in (256, 384, 512):
|
||||
raise ValueError("bit_length must be 256, 384, or 512")
|
||||
|
||||
return os.urandom(bit_length // 8)
|
||||
|
||||
def encrypt(
|
||||
self,
|
||||
data: bytes,
|
||||
associated_data: typing.Optional[typing.List[bytes]],
|
||||
) -> bytes:
|
||||
if associated_data is None:
|
||||
associated_data = []
|
||||
|
||||
self._check_params(data, associated_data)
|
||||
|
||||
if len(data) > self._MAX_SIZE or any(
|
||||
len(ad) > self._MAX_SIZE for ad in associated_data
|
||||
):
|
||||
# This is OverflowError to match what cffi would raise
|
||||
raise OverflowError(
|
||||
"Data or associated data too long. Max 2**31 - 1 bytes"
|
||||
)
|
||||
|
||||
return aead._encrypt(backend, self, b"", data, associated_data, 16)
|
||||
|
||||
def decrypt(
|
||||
self,
|
||||
data: bytes,
|
||||
associated_data: typing.Optional[typing.List[bytes]],
|
||||
) -> bytes:
|
||||
if associated_data is None:
|
||||
associated_data = []
|
||||
|
||||
self._check_params(data, associated_data)
|
||||
|
||||
return aead._decrypt(backend, self, b"", data, associated_data, 16)
|
||||
|
||||
def _check_params(
|
||||
self,
|
||||
data: bytes,
|
||||
associated_data: typing.List[bytes],
|
||||
) -> None:
|
||||
utils._check_byteslike("data", data)
|
||||
if len(data) == 0:
|
||||
raise ValueError("data must not be zero length")
|
||||
|
||||
if not isinstance(associated_data, list):
|
||||
raise TypeError(
|
||||
"associated_data must be a list of bytes-like objects or None"
|
||||
)
|
||||
for x in associated_data:
|
||||
utils._check_byteslike("associated_data elements", x)
|
||||
@@ -0,0 +1,228 @@
|
||||
# This file is dual licensed under the terms of the Apache License, Version
|
||||
# 2.0, and the BSD License. See the LICENSE file in the root of this repository
|
||||
# for complete details.
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
from cryptography import utils
|
||||
from cryptography.hazmat.primitives.ciphers import (
|
||||
BlockCipherAlgorithm,
|
||||
CipherAlgorithm,
|
||||
)
|
||||
|
||||
|
||||
def _verify_key_size(algorithm: CipherAlgorithm, key: bytes) -> bytes:
|
||||
# Verify that the key is instance of bytes
|
||||
utils._check_byteslike("key", key)
|
||||
|
||||
# Verify that the key size matches the expected key size
|
||||
if len(key) * 8 not in algorithm.key_sizes:
|
||||
raise ValueError(
|
||||
"Invalid key size ({}) for {}.".format(
|
||||
len(key) * 8, algorithm.name
|
||||
)
|
||||
)
|
||||
return key
|
||||
|
||||
|
||||
class AES(BlockCipherAlgorithm):
|
||||
name = "AES"
|
||||
block_size = 128
|
||||
# 512 added to support AES-256-XTS, which uses 512-bit keys
|
||||
key_sizes = frozenset([128, 192, 256, 512])
|
||||
|
||||
def __init__(self, key: bytes):
|
||||
self.key = _verify_key_size(self, key)
|
||||
|
||||
@property
|
||||
def key_size(self) -> int:
|
||||
return len(self.key) * 8
|
||||
|
||||
|
||||
class AES128(BlockCipherAlgorithm):
|
||||
name = "AES"
|
||||
block_size = 128
|
||||
key_sizes = frozenset([128])
|
||||
key_size = 128
|
||||
|
||||
def __init__(self, key: bytes):
|
||||
self.key = _verify_key_size(self, key)
|
||||
|
||||
|
||||
class AES256(BlockCipherAlgorithm):
|
||||
name = "AES"
|
||||
block_size = 128
|
||||
key_sizes = frozenset([256])
|
||||
key_size = 256
|
||||
|
||||
def __init__(self, key: bytes):
|
||||
self.key = _verify_key_size(self, key)
|
||||
|
||||
|
||||
class Camellia(BlockCipherAlgorithm):
|
||||
name = "camellia"
|
||||
block_size = 128
|
||||
key_sizes = frozenset([128, 192, 256])
|
||||
|
||||
def __init__(self, key: bytes):
|
||||
self.key = _verify_key_size(self, key)
|
||||
|
||||
@property
|
||||
def key_size(self) -> int:
|
||||
return len(self.key) * 8
|
||||
|
||||
|
||||
class TripleDES(BlockCipherAlgorithm):
|
||||
name = "3DES"
|
||||
block_size = 64
|
||||
key_sizes = frozenset([64, 128, 192])
|
||||
|
||||
def __init__(self, key: bytes):
|
||||
if len(key) == 8:
|
||||
key += key + key
|
||||
elif len(key) == 16:
|
||||
key += key[:8]
|
||||
self.key = _verify_key_size(self, key)
|
||||
|
||||
@property
|
||||
def key_size(self) -> int:
|
||||
return len(self.key) * 8
|
||||
|
||||
|
||||
class Blowfish(BlockCipherAlgorithm):
|
||||
name = "Blowfish"
|
||||
block_size = 64
|
||||
key_sizes = frozenset(range(32, 449, 8))
|
||||
|
||||
def __init__(self, key: bytes):
|
||||
self.key = _verify_key_size(self, key)
|
||||
|
||||
@property
|
||||
def key_size(self) -> int:
|
||||
return len(self.key) * 8
|
||||
|
||||
|
||||
_BlowfishInternal = Blowfish
|
||||
utils.deprecated(
|
||||
Blowfish,
|
||||
__name__,
|
||||
"Blowfish has been deprecated",
|
||||
utils.DeprecatedIn37,
|
||||
name="Blowfish",
|
||||
)
|
||||
|
||||
|
||||
class CAST5(BlockCipherAlgorithm):
|
||||
name = "CAST5"
|
||||
block_size = 64
|
||||
key_sizes = frozenset(range(40, 129, 8))
|
||||
|
||||
def __init__(self, key: bytes):
|
||||
self.key = _verify_key_size(self, key)
|
||||
|
||||
@property
|
||||
def key_size(self) -> int:
|
||||
return len(self.key) * 8
|
||||
|
||||
|
||||
_CAST5Internal = CAST5
|
||||
utils.deprecated(
|
||||
CAST5,
|
||||
__name__,
|
||||
"CAST5 has been deprecated",
|
||||
utils.DeprecatedIn37,
|
||||
name="CAST5",
|
||||
)
|
||||
|
||||
|
||||
class ARC4(CipherAlgorithm):
|
||||
name = "RC4"
|
||||
key_sizes = frozenset([40, 56, 64, 80, 128, 160, 192, 256])
|
||||
|
||||
def __init__(self, key: bytes):
|
||||
self.key = _verify_key_size(self, key)
|
||||
|
||||
@property
|
||||
def key_size(self) -> int:
|
||||
return len(self.key) * 8
|
||||
|
||||
|
||||
class IDEA(BlockCipherAlgorithm):
|
||||
name = "IDEA"
|
||||
block_size = 64
|
||||
key_sizes = frozenset([128])
|
||||
|
||||
def __init__(self, key: bytes):
|
||||
self.key = _verify_key_size(self, key)
|
||||
|
||||
@property
|
||||
def key_size(self) -> int:
|
||||
return len(self.key) * 8
|
||||
|
||||
|
||||
_IDEAInternal = IDEA
|
||||
utils.deprecated(
|
||||
IDEA,
|
||||
__name__,
|
||||
"IDEA has been deprecated",
|
||||
utils.DeprecatedIn37,
|
||||
name="IDEA",
|
||||
)
|
||||
|
||||
|
||||
class SEED(BlockCipherAlgorithm):
|
||||
name = "SEED"
|
||||
block_size = 128
|
||||
key_sizes = frozenset([128])
|
||||
|
||||
def __init__(self, key: bytes):
|
||||
self.key = _verify_key_size(self, key)
|
||||
|
||||
@property
|
||||
def key_size(self) -> int:
|
||||
return len(self.key) * 8
|
||||
|
||||
|
||||
_SEEDInternal = SEED
|
||||
utils.deprecated(
|
||||
SEED,
|
||||
__name__,
|
||||
"SEED has been deprecated",
|
||||
utils.DeprecatedIn37,
|
||||
name="SEED",
|
||||
)
|
||||
|
||||
|
||||
class ChaCha20(CipherAlgorithm):
|
||||
name = "ChaCha20"
|
||||
key_sizes = frozenset([256])
|
||||
|
||||
def __init__(self, key: bytes, nonce: bytes):
|
||||
self.key = _verify_key_size(self, key)
|
||||
utils._check_byteslike("nonce", nonce)
|
||||
|
||||
if len(nonce) != 16:
|
||||
raise ValueError("nonce must be 128-bits (16 bytes)")
|
||||
|
||||
self._nonce = nonce
|
||||
|
||||
@property
|
||||
def nonce(self) -> bytes:
|
||||
return self._nonce
|
||||
|
||||
@property
|
||||
def key_size(self) -> int:
|
||||
return len(self.key) * 8
|
||||
|
||||
|
||||
class SM4(BlockCipherAlgorithm):
|
||||
name = "SM4"
|
||||
block_size = 128
|
||||
key_sizes = frozenset([128])
|
||||
|
||||
def __init__(self, key: bytes):
|
||||
self.key = _verify_key_size(self, key)
|
||||
|
||||
@property
|
||||
def key_size(self) -> int:
|
||||
return len(self.key) * 8
|
||||
@@ -0,0 +1,269 @@
|
||||
# This file is dual licensed under the terms of the Apache License, Version
|
||||
# 2.0, and the BSD License. See the LICENSE file in the root of this repository
|
||||
# for complete details.
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import abc
|
||||
import typing
|
||||
|
||||
from cryptography.exceptions import (
|
||||
AlreadyFinalized,
|
||||
AlreadyUpdated,
|
||||
NotYetFinalized,
|
||||
)
|
||||
from cryptography.hazmat.primitives._cipheralgorithm import CipherAlgorithm
|
||||
from cryptography.hazmat.primitives.ciphers import modes
|
||||
|
||||
if typing.TYPE_CHECKING:
|
||||
from cryptography.hazmat.backends.openssl.ciphers import (
|
||||
_CipherContext as _BackendCipherContext,
|
||||
)
|
||||
|
||||
|
||||
class CipherContext(metaclass=abc.ABCMeta):
|
||||
@abc.abstractmethod
|
||||
def update(self, data: bytes) -> bytes:
|
||||
"""
|
||||
Processes the provided bytes through the cipher and returns the results
|
||||
as bytes.
|
||||
"""
|
||||
|
||||
@abc.abstractmethod
|
||||
def update_into(self, data: bytes, buf: bytes) -> int:
|
||||
"""
|
||||
Processes the provided bytes and writes the resulting data into the
|
||||
provided buffer. Returns the number of bytes written.
|
||||
"""
|
||||
|
||||
@abc.abstractmethod
|
||||
def finalize(self) -> bytes:
|
||||
"""
|
||||
Returns the results of processing the final block as bytes.
|
||||
"""
|
||||
|
||||
|
||||
class AEADCipherContext(CipherContext, metaclass=abc.ABCMeta):
|
||||
@abc.abstractmethod
|
||||
def authenticate_additional_data(self, data: bytes) -> None:
|
||||
"""
|
||||
Authenticates the provided bytes.
|
||||
"""
|
||||
|
||||
|
||||
class AEADDecryptionContext(AEADCipherContext, metaclass=abc.ABCMeta):
|
||||
@abc.abstractmethod
|
||||
def finalize_with_tag(self, tag: bytes) -> bytes:
|
||||
"""
|
||||
Returns the results of processing the final block as bytes and allows
|
||||
delayed passing of the authentication tag.
|
||||
"""
|
||||
|
||||
|
||||
class AEADEncryptionContext(AEADCipherContext, metaclass=abc.ABCMeta):
|
||||
@property
|
||||
@abc.abstractmethod
|
||||
def tag(self) -> bytes:
|
||||
"""
|
||||
Returns tag bytes. This is only available after encryption is
|
||||
finalized.
|
||||
"""
|
||||
|
||||
|
||||
Mode = typing.TypeVar(
|
||||
"Mode", bound=typing.Optional[modes.Mode], covariant=True
|
||||
)
|
||||
|
||||
|
||||
class Cipher(typing.Generic[Mode]):
|
||||
def __init__(
|
||||
self,
|
||||
algorithm: CipherAlgorithm,
|
||||
mode: Mode,
|
||||
backend: typing.Any = None,
|
||||
) -> None:
|
||||
if not isinstance(algorithm, CipherAlgorithm):
|
||||
raise TypeError("Expected interface of CipherAlgorithm.")
|
||||
|
||||
if mode is not None:
|
||||
# mypy needs this assert to narrow the type from our generic
|
||||
# type. Maybe it won't some time in the future.
|
||||
assert isinstance(mode, modes.Mode)
|
||||
mode.validate_for_algorithm(algorithm)
|
||||
|
||||
self.algorithm = algorithm
|
||||
self.mode = mode
|
||||
|
||||
@typing.overload
|
||||
def encryptor(
|
||||
self: Cipher[modes.ModeWithAuthenticationTag],
|
||||
) -> AEADEncryptionContext:
|
||||
...
|
||||
|
||||
@typing.overload
|
||||
def encryptor(
|
||||
self: _CIPHER_TYPE,
|
||||
) -> CipherContext:
|
||||
...
|
||||
|
||||
def encryptor(self):
|
||||
if isinstance(self.mode, modes.ModeWithAuthenticationTag):
|
||||
if self.mode.tag is not None:
|
||||
raise ValueError(
|
||||
"Authentication tag must be None when encrypting."
|
||||
)
|
||||
from cryptography.hazmat.backends.openssl.backend import backend
|
||||
|
||||
ctx = backend.create_symmetric_encryption_ctx(
|
||||
self.algorithm, self.mode
|
||||
)
|
||||
return self._wrap_ctx(ctx, encrypt=True)
|
||||
|
||||
@typing.overload
|
||||
def decryptor(
|
||||
self: Cipher[modes.ModeWithAuthenticationTag],
|
||||
) -> AEADDecryptionContext:
|
||||
...
|
||||
|
||||
@typing.overload
|
||||
def decryptor(
|
||||
self: _CIPHER_TYPE,
|
||||
) -> CipherContext:
|
||||
...
|
||||
|
||||
def decryptor(self):
|
||||
from cryptography.hazmat.backends.openssl.backend import backend
|
||||
|
||||
ctx = backend.create_symmetric_decryption_ctx(
|
||||
self.algorithm, self.mode
|
||||
)
|
||||
return self._wrap_ctx(ctx, encrypt=False)
|
||||
|
||||
def _wrap_ctx(
|
||||
self, ctx: _BackendCipherContext, encrypt: bool
|
||||
) -> typing.Union[
|
||||
AEADEncryptionContext, AEADDecryptionContext, CipherContext
|
||||
]:
|
||||
if isinstance(self.mode, modes.ModeWithAuthenticationTag):
|
||||
if encrypt:
|
||||
return _AEADEncryptionContext(ctx)
|
||||
else:
|
||||
return _AEADDecryptionContext(ctx)
|
||||
else:
|
||||
return _CipherContext(ctx)
|
||||
|
||||
|
||||
_CIPHER_TYPE = Cipher[
|
||||
typing.Union[
|
||||
modes.ModeWithNonce,
|
||||
modes.ModeWithTweak,
|
||||
None,
|
||||
modes.ECB,
|
||||
modes.ModeWithInitializationVector,
|
||||
]
|
||||
]
|
||||
|
||||
|
||||
class _CipherContext(CipherContext):
|
||||
_ctx: typing.Optional[_BackendCipherContext]
|
||||
|
||||
def __init__(self, ctx: _BackendCipherContext) -> None:
|
||||
self._ctx = ctx
|
||||
|
||||
def update(self, data: bytes) -> bytes:
|
||||
if self._ctx is None:
|
||||
raise AlreadyFinalized("Context was already finalized.")
|
||||
return self._ctx.update(data)
|
||||
|
||||
def update_into(self, data: bytes, buf: bytes) -> int:
|
||||
if self._ctx is None:
|
||||
raise AlreadyFinalized("Context was already finalized.")
|
||||
return self._ctx.update_into(data, buf)
|
||||
|
||||
def finalize(self) -> bytes:
|
||||
if self._ctx is None:
|
||||
raise AlreadyFinalized("Context was already finalized.")
|
||||
data = self._ctx.finalize()
|
||||
self._ctx = None
|
||||
return data
|
||||
|
||||
|
||||
class _AEADCipherContext(AEADCipherContext):
|
||||
_ctx: typing.Optional[_BackendCipherContext]
|
||||
_tag: typing.Optional[bytes]
|
||||
|
||||
def __init__(self, ctx: _BackendCipherContext) -> None:
|
||||
self._ctx = ctx
|
||||
self._bytes_processed = 0
|
||||
self._aad_bytes_processed = 0
|
||||
self._tag = None
|
||||
self._updated = False
|
||||
|
||||
def _check_limit(self, data_size: int) -> None:
|
||||
if self._ctx is None:
|
||||
raise AlreadyFinalized("Context was already finalized.")
|
||||
self._updated = True
|
||||
self._bytes_processed += data_size
|
||||
if self._bytes_processed > self._ctx._mode._MAX_ENCRYPTED_BYTES:
|
||||
raise ValueError(
|
||||
"{} has a maximum encrypted byte limit of {}".format(
|
||||
self._ctx._mode.name, self._ctx._mode._MAX_ENCRYPTED_BYTES
|
||||
)
|
||||
)
|
||||
|
||||
def update(self, data: bytes) -> bytes:
|
||||
self._check_limit(len(data))
|
||||
# mypy needs this assert even though _check_limit already checked
|
||||
assert self._ctx is not None
|
||||
return self._ctx.update(data)
|
||||
|
||||
def update_into(self, data: bytes, buf: bytes) -> int:
|
||||
self._check_limit(len(data))
|
||||
# mypy needs this assert even though _check_limit already checked
|
||||
assert self._ctx is not None
|
||||
return self._ctx.update_into(data, buf)
|
||||
|
||||
def finalize(self) -> bytes:
|
||||
if self._ctx is None:
|
||||
raise AlreadyFinalized("Context was already finalized.")
|
||||
data = self._ctx.finalize()
|
||||
self._tag = self._ctx.tag
|
||||
self._ctx = None
|
||||
return data
|
||||
|
||||
def authenticate_additional_data(self, data: bytes) -> None:
|
||||
if self._ctx is None:
|
||||
raise AlreadyFinalized("Context was already finalized.")
|
||||
if self._updated:
|
||||
raise AlreadyUpdated("Update has been called on this context.")
|
||||
|
||||
self._aad_bytes_processed += len(data)
|
||||
if self._aad_bytes_processed > self._ctx._mode._MAX_AAD_BYTES:
|
||||
raise ValueError(
|
||||
"{} has a maximum AAD byte limit of {}".format(
|
||||
self._ctx._mode.name, self._ctx._mode._MAX_AAD_BYTES
|
||||
)
|
||||
)
|
||||
|
||||
self._ctx.authenticate_additional_data(data)
|
||||
|
||||
|
||||
class _AEADDecryptionContext(_AEADCipherContext, AEADDecryptionContext):
|
||||
def finalize_with_tag(self, tag: bytes) -> bytes:
|
||||
if self._ctx is None:
|
||||
raise AlreadyFinalized("Context was already finalized.")
|
||||
data = self._ctx.finalize_with_tag(tag)
|
||||
self._tag = self._ctx.tag
|
||||
self._ctx = None
|
||||
return data
|
||||
|
||||
|
||||
class _AEADEncryptionContext(_AEADCipherContext, AEADEncryptionContext):
|
||||
@property
|
||||
def tag(self) -> bytes:
|
||||
if self._ctx is not None:
|
||||
raise NotYetFinalized(
|
||||
"You must finalize encryption before " "getting the tag."
|
||||
)
|
||||
assert self._tag is not None
|
||||
return self._tag
|
||||
@@ -0,0 +1,274 @@
|
||||
# This file is dual licensed under the terms of the Apache License, Version
|
||||
# 2.0, and the BSD License. See the LICENSE file in the root of this repository
|
||||
# for complete details.
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import abc
|
||||
import typing
|
||||
|
||||
from cryptography import utils
|
||||
from cryptography.exceptions import UnsupportedAlgorithm, _Reasons
|
||||
from cryptography.hazmat.primitives._cipheralgorithm import (
|
||||
BlockCipherAlgorithm,
|
||||
CipherAlgorithm,
|
||||
)
|
||||
from cryptography.hazmat.primitives.ciphers import algorithms
|
||||
|
||||
|
||||
class Mode(metaclass=abc.ABCMeta):
|
||||
@property
|
||||
@abc.abstractmethod
|
||||
def name(self) -> str:
|
||||
"""
|
||||
A string naming this mode (e.g. "ECB", "CBC").
|
||||
"""
|
||||
|
||||
@abc.abstractmethod
|
||||
def validate_for_algorithm(self, algorithm: CipherAlgorithm) -> None:
|
||||
"""
|
||||
Checks that all the necessary invariants of this (mode, algorithm)
|
||||
combination are met.
|
||||
"""
|
||||
|
||||
|
||||
class ModeWithInitializationVector(Mode, metaclass=abc.ABCMeta):
|
||||
@property
|
||||
@abc.abstractmethod
|
||||
def initialization_vector(self) -> bytes:
|
||||
"""
|
||||
The value of the initialization vector for this mode as bytes.
|
||||
"""
|
||||
|
||||
|
||||
class ModeWithTweak(Mode, metaclass=abc.ABCMeta):
|
||||
@property
|
||||
@abc.abstractmethod
|
||||
def tweak(self) -> bytes:
|
||||
"""
|
||||
The value of the tweak for this mode as bytes.
|
||||
"""
|
||||
|
||||
|
||||
class ModeWithNonce(Mode, metaclass=abc.ABCMeta):
|
||||
@property
|
||||
@abc.abstractmethod
|
||||
def nonce(self) -> bytes:
|
||||
"""
|
||||
The value of the nonce for this mode as bytes.
|
||||
"""
|
||||
|
||||
|
||||
class ModeWithAuthenticationTag(Mode, metaclass=abc.ABCMeta):
|
||||
@property
|
||||
@abc.abstractmethod
|
||||
def tag(self) -> typing.Optional[bytes]:
|
||||
"""
|
||||
The value of the tag supplied to the constructor of this mode.
|
||||
"""
|
||||
|
||||
|
||||
def _check_aes_key_length(self: Mode, algorithm: CipherAlgorithm) -> None:
|
||||
if algorithm.key_size > 256 and algorithm.name == "AES":
|
||||
raise ValueError(
|
||||
"Only 128, 192, and 256 bit keys are allowed for this AES mode"
|
||||
)
|
||||
|
||||
|
||||
def _check_iv_length(
|
||||
self: ModeWithInitializationVector, algorithm: BlockCipherAlgorithm
|
||||
) -> None:
|
||||
if len(self.initialization_vector) * 8 != algorithm.block_size:
|
||||
raise ValueError(
|
||||
"Invalid IV size ({}) for {}.".format(
|
||||
len(self.initialization_vector), self.name
|
||||
)
|
||||
)
|
||||
|
||||
|
||||
def _check_nonce_length(
|
||||
nonce: bytes, name: str, algorithm: CipherAlgorithm
|
||||
) -> None:
|
||||
if not isinstance(algorithm, BlockCipherAlgorithm):
|
||||
raise UnsupportedAlgorithm(
|
||||
f"{name} requires a block cipher algorithm",
|
||||
_Reasons.UNSUPPORTED_CIPHER,
|
||||
)
|
||||
if len(nonce) * 8 != algorithm.block_size:
|
||||
raise ValueError(f"Invalid nonce size ({len(nonce)}) for {name}.")
|
||||
|
||||
|
||||
def _check_iv_and_key_length(
|
||||
self: ModeWithInitializationVector, algorithm: CipherAlgorithm
|
||||
) -> None:
|
||||
if not isinstance(algorithm, BlockCipherAlgorithm):
|
||||
raise UnsupportedAlgorithm(
|
||||
f"{self} requires a block cipher algorithm",
|
||||
_Reasons.UNSUPPORTED_CIPHER,
|
||||
)
|
||||
_check_aes_key_length(self, algorithm)
|
||||
_check_iv_length(self, algorithm)
|
||||
|
||||
|
||||
class CBC(ModeWithInitializationVector):
|
||||
name = "CBC"
|
||||
|
||||
def __init__(self, initialization_vector: bytes):
|
||||
utils._check_byteslike("initialization_vector", initialization_vector)
|
||||
self._initialization_vector = initialization_vector
|
||||
|
||||
@property
|
||||
def initialization_vector(self) -> bytes:
|
||||
return self._initialization_vector
|
||||
|
||||
validate_for_algorithm = _check_iv_and_key_length
|
||||
|
||||
|
||||
class XTS(ModeWithTweak):
|
||||
name = "XTS"
|
||||
|
||||
def __init__(self, tweak: bytes):
|
||||
utils._check_byteslike("tweak", tweak)
|
||||
|
||||
if len(tweak) != 16:
|
||||
raise ValueError("tweak must be 128-bits (16 bytes)")
|
||||
|
||||
self._tweak = tweak
|
||||
|
||||
@property
|
||||
def tweak(self) -> bytes:
|
||||
return self._tweak
|
||||
|
||||
def validate_for_algorithm(self, algorithm: CipherAlgorithm) -> None:
|
||||
if isinstance(algorithm, (algorithms.AES128, algorithms.AES256)):
|
||||
raise TypeError(
|
||||
"The AES128 and AES256 classes do not support XTS, please use "
|
||||
"the standard AES class instead."
|
||||
)
|
||||
|
||||
if algorithm.key_size not in (256, 512):
|
||||
raise ValueError(
|
||||
"The XTS specification requires a 256-bit key for AES-128-XTS"
|
||||
" and 512-bit key for AES-256-XTS"
|
||||
)
|
||||
|
||||
|
||||
class ECB(Mode):
|
||||
name = "ECB"
|
||||
|
||||
validate_for_algorithm = _check_aes_key_length
|
||||
|
||||
|
||||
class OFB(ModeWithInitializationVector):
|
||||
name = "OFB"
|
||||
|
||||
def __init__(self, initialization_vector: bytes):
|
||||
utils._check_byteslike("initialization_vector", initialization_vector)
|
||||
self._initialization_vector = initialization_vector
|
||||
|
||||
@property
|
||||
def initialization_vector(self) -> bytes:
|
||||
return self._initialization_vector
|
||||
|
||||
validate_for_algorithm = _check_iv_and_key_length
|
||||
|
||||
|
||||
class CFB(ModeWithInitializationVector):
|
||||
name = "CFB"
|
||||
|
||||
def __init__(self, initialization_vector: bytes):
|
||||
utils._check_byteslike("initialization_vector", initialization_vector)
|
||||
self._initialization_vector = initialization_vector
|
||||
|
||||
@property
|
||||
def initialization_vector(self) -> bytes:
|
||||
return self._initialization_vector
|
||||
|
||||
validate_for_algorithm = _check_iv_and_key_length
|
||||
|
||||
|
||||
class CFB8(ModeWithInitializationVector):
|
||||
name = "CFB8"
|
||||
|
||||
def __init__(self, initialization_vector: bytes):
|
||||
utils._check_byteslike("initialization_vector", initialization_vector)
|
||||
self._initialization_vector = initialization_vector
|
||||
|
||||
@property
|
||||
def initialization_vector(self) -> bytes:
|
||||
return self._initialization_vector
|
||||
|
||||
validate_for_algorithm = _check_iv_and_key_length
|
||||
|
||||
|
||||
class CTR(ModeWithNonce):
|
||||
name = "CTR"
|
||||
|
||||
def __init__(self, nonce: bytes):
|
||||
utils._check_byteslike("nonce", nonce)
|
||||
self._nonce = nonce
|
||||
|
||||
@property
|
||||
def nonce(self) -> bytes:
|
||||
return self._nonce
|
||||
|
||||
def validate_for_algorithm(self, algorithm: CipherAlgorithm) -> None:
|
||||
_check_aes_key_length(self, algorithm)
|
||||
_check_nonce_length(self.nonce, self.name, algorithm)
|
||||
|
||||
|
||||
class GCM(ModeWithInitializationVector, ModeWithAuthenticationTag):
|
||||
name = "GCM"
|
||||
_MAX_ENCRYPTED_BYTES = (2**39 - 256) // 8
|
||||
_MAX_AAD_BYTES = (2**64) // 8
|
||||
|
||||
def __init__(
|
||||
self,
|
||||
initialization_vector: bytes,
|
||||
tag: typing.Optional[bytes] = None,
|
||||
min_tag_length: int = 16,
|
||||
):
|
||||
# OpenSSL 3.0.0 constrains GCM IVs to [64, 1024] bits inclusive
|
||||
# This is a sane limit anyway so we'll enforce it here.
|
||||
utils._check_byteslike("initialization_vector", initialization_vector)
|
||||
if len(initialization_vector) < 8 or len(initialization_vector) > 128:
|
||||
raise ValueError(
|
||||
"initialization_vector must be between 8 and 128 bytes (64 "
|
||||
"and 1024 bits)."
|
||||
)
|
||||
self._initialization_vector = initialization_vector
|
||||
if tag is not None:
|
||||
utils._check_bytes("tag", tag)
|
||||
if min_tag_length < 4:
|
||||
raise ValueError("min_tag_length must be >= 4")
|
||||
if len(tag) < min_tag_length:
|
||||
raise ValueError(
|
||||
"Authentication tag must be {} bytes or longer.".format(
|
||||
min_tag_length
|
||||
)
|
||||
)
|
||||
self._tag = tag
|
||||
self._min_tag_length = min_tag_length
|
||||
|
||||
@property
|
||||
def tag(self) -> typing.Optional[bytes]:
|
||||
return self._tag
|
||||
|
||||
@property
|
||||
def initialization_vector(self) -> bytes:
|
||||
return self._initialization_vector
|
||||
|
||||
def validate_for_algorithm(self, algorithm: CipherAlgorithm) -> None:
|
||||
_check_aes_key_length(self, algorithm)
|
||||
if not isinstance(algorithm, BlockCipherAlgorithm):
|
||||
raise UnsupportedAlgorithm(
|
||||
"GCM requires a block cipher algorithm",
|
||||
_Reasons.UNSUPPORTED_CIPHER,
|
||||
)
|
||||
block_size_bytes = algorithm.block_size // 8
|
||||
if self._tag is not None and len(self._tag) > block_size_bytes:
|
||||
raise ValueError(
|
||||
"Authentication tag cannot be more than {} bytes.".format(
|
||||
block_size_bytes
|
||||
)
|
||||
)
|
||||
Reference in New Issue
Block a user