o
    6hX                     @   sl  d dl Z d dlZd dlmZmZ d dlmZ d dlmZ d dl	m
Z
mZmZ d dlmZmZmZ d dlmZmZ d dlmZmZmZmZ d d	lmZmZmZ d d
lmZ d dlm Z m!Z! d dl"m#Z# d dl$m%Z% ddl&m'Z' ddl(m)Z)m*Z* ddl+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2 ddl3m4Z4 da5dd Z6G dd de4Z7G dd de4Z8G dd de4Z9G dd de4Z:dS )    N)InvalidSignature
InvalidTag)default_backend)Binding)hasheshmacserialization)ecpaddingrsa)decode_dss_signatureencode_dss_signature)Cipheraead
algorithmsmodes)InvalidUnwrapaes_key_unwrapaes_key_wrap)PKCS7)load_pem_private_keyload_pem_public_key)int_to_bytes)load_pem_x509_certificate   )
ALGORITHMS)JWEErrorJWKError)base64_to_longbase64url_decodebase64url_encodeensure_binaryis_pem_format
is_ssh_keylong_to_base64   )Keyc                 C   sD   t du rt a t jd| }t j||  t j|| dd }|S )aK  
    Get random bytes

    Currently, Cryptography returns OS random bytes. If you want OpenSSL
    generated random bytes, you'll have to switch the RAND engine after
    initializing the OpenSSL backend
    Args:
        num_bytes (int): Number of random bytes to generate and return
    Returns:
        bytes: Random bytes
    Nzchar[])_bindingr   ffinewlib
RAND_bytesbuffer)	num_bytesbuf
rand_bytes r0   v/var/www/html/construction_image-detection-poc/venv/lib/python3.10/site-packages/jose/backends/cryptography_backend.pyget_random_bytes!   s   r2   c                   @   sz   e Zd ZejZejZejZefddZdd Z	dd Z
dd Zd	d
 Zdd Zdd Zdd Zdd Zdd Zdd ZdS )CryptographyECKeyc              
   C   s(  |t jvrtd| t j| jt j| jt j| ji	|| _
|| _|| _t|ds-t|dr2|| _d S t|dr>| d}t|trK| || _d S t|trU|d}t|trzz	t||  }W n tyv   t|d |  d}Y nw W n ty } zt|d }~ww || _d S td| )N*hash_alg: %s is not a valid hash algorithmpublic_bytesprivate_bytesto_pemutf-8passwordbackendz%Unable to parse an ECKey from key: %s)r   ECr   ES256SHA256ES384SHA384ES512SHA512gethash_alg
_algorithmcryptography_backendhasattrprepared_keyr7   decode
isinstancedict_process_jwkstrencodebytesr   
ValueErrorr   	Exceptionselfkey	algorithmrF   er0   r0   r1   __init__=   sF   





zCryptographyECKey.__init__c                    s     ddkstd  d t fdddD stdt  d}t  d	}tjtjtjd
 d  }t||| }d v rZt  d}t	||}|
|  S ||  S )Nktyr<   z0Incorrect key type. Expected: 'EC', Received: %sc                 3       | ]}| v V  qd S Nr0   .0kjwk_dictr0   r1   	<genexpr>n       z1CryptographyECKey._process_jwk.<locals>.<genexpr>)xycrvz Mandatory parameters are missingrb   rc   )P-256P-384P-521rd   d)rC   r   allr   r	   	SECP256R1	SECP384R1	SECP521R1EllipticCurvePublicNumbersEllipticCurvePrivateNumbersprivate_keyrF   
public_key)rS   r_   rb   rc   curvepublicrh   privater0   r^   r1   rL   j   s$   zCryptographyECKey._process_jwkc                 C   s   t t| jjd S )zDetermine the correct serialization length for an encoded signature component.

        This is the number of bytes required to encode the maximum key value.
        g       @)intmathceilrH   key_sizerS   r0   r0   r1   _sig_component_length   s   z'CryptographyECKey._sig_component_lengthc                 C   s(   t |\}}|  }t||t|| S )z4Convert signature from DER encoding to RAW encoding.)r   ry   r   )rS   der_signaturerscomponent_lengthr0   r0   r1   _der_to_raw   s   zCryptographyECKey._der_to_rawc                 C   s^   |   }t|td| krtd|d| }||d }t|d}t|d}t||S )z4Convert signature from RAW encoding to DER encoding.r   zInvalid signatureNbig)ry   lenrt   rP   
from_bytesr   )rS   raw_signaturer}   r_bytess_bytesr{   r|   r0   r0   r1   _raw_to_der   s   
zCryptographyECKey._raw_to_derc                 C   sV   | j jd | jjjkrtd| jjjd| j j f | j|t	|   }| 
|S )N   z1this curve (%s) is too short for your digest (%d))rD   digest_sizerH   rq   rw   	TypeErrornamesignr	   ECDSAr~   )rS   msg	signaturer0   r0   r1   r      s   
zCryptographyECKey.signc                 C   s@   z|  |}| j||t|   W dS  ty   Y dS w )NTF)r   rH   verifyr	   r   rD   rQ   )rS   r   sigr   r0   r0   r1   r      s   
zCryptographyECKey.verifyc                 C      t | jdS Nr5   rG   rH   rx   r0   r0   r1   	is_public      zCryptographyECKey.is_publicc                 C       |   r| S | | j | jS rZ   r   	__class__rH   rp   rE   rx   r0   r0   r1   rp         zCryptographyECKey.public_keyc                 C   sF   |   r| jjtjjtjjd}|S | jjtjjtj	j
t d}|S )Nencodingformatr   r   encryption_algorithm)r   rH   r5   r   EncodingPEMPublicFormatSubjectPublicKeyInfor6   PrivateFormatTraditionalOpenSSLNoEncryption)rS   pemr0   r0   r1   r7      s   zCryptographyECKey.to_pemc                 C   s   |   s
| j }n| j}dddd| jjj }| jjjd d }| jd|t| j	|d
d	t| j|d
d	d
}|   sS| j j}t||d
d	|d< |S )Nre   rf   rg   )	secp256r1	secp384r1	secp521r1   r   r<   )sizeASCII)algrX   rd   rb   rc   rh   )r   rH   rp   rq   r   rw   rE   r$   public_numbersrb   rI   rc   private_numbersprivate_value)rS   rp   rd   rw   datar   r0   r0   r1   to_dict   s(   	zCryptographyECKey.to_dictN)__name__
__module____qualname__r   r>   r@   rB   r   rW   rL   ry   r~   r   r   r   r   rp   r7   r   r0   r0   r0   r1   r3   8   s    -	r3   c                   @   s   e Zd ZejZejZejZe Z	e
ee e dZe
ee e dZefddZdd Zdd Zdd	 Zd
d Zdd Zdd ZdddZdd Zdd Zdd ZdS )CryptographyRSAKeyNc              
   C   sL  |t jvrtd| t j| jt j| jt j| ji	|| _
|| _t j| jt j| jt j| ji	|| _|| _t|drDt|drD|| _d S t|trQ| || _d S t|tr[|d}t|trz/|drn| | W d S zt||  | _W W d S  ty   t|d |  d| _Y W d S w  ty } zt|d }~ww td| )Nr4   r5   r   r8   s   -----BEGIN CERTIFICATE-----r9   z'Unable to parse an RSA_JWK from key: %s)r   RSAr   RS256r>   RS384r@   RS512rB   rC   rD   rE   RSA1_5RSA_OAEPRSA_OAEP_256r
   rF   rG   rH   rJ   rK   rL   rM   rN   rO   
startswith_process_certr   rP   r   rQ   rR   r0   r0   r1   rW      sR   






zCryptographyRSAKey.__init__c              	      sB    ddkstd  d t  dd}t  d}t||}d vr0||  S t  d}g d}t fd	d
|D rtt fdd
|D sUtdt d }t d }t d }	t d }
t d }nt	|||\}}t
||}	t||}
t||}t||||	|
||}||  S )NrX   r   z1Incorrect key type. Expected: 'RSA', Received: %srV      nrh   )pqdpdqqic                 3   rY   rZ   r0   r[   r^   r0   r1   r`   *  ra   z2CryptographyRSAKey._process_jwk.<locals>.<genexpr>c                 3   rY   rZ   r0   r[   r^   r0   r1   r`   ,  ra   z2Precomputed private key parameters are incomplete.r   r   r   r   r   )rC   r   r   r   RSAPublicNumbersrp   rF   anyri   rsa_recover_prime_factorsrsa_crt_dmp1rsa_crt_dmq1rsa_crt_iqmpRSAPrivateNumbersro   )rS   r_   rV   r   rr   rh   extra_paramsr   r   r   r   r   rs   r0   r^   r1   rL     s.   zCryptographyRSAKey._process_jwkc                 C   s   t ||  }| | _d S rZ   )r   rF   rp   rH   )rS   rT   r0   r0   r1   r   C  s   z CryptographyRSAKey._process_certc              
   C   s@   z| j |t |  }W |S  ty } zt|d }~ww rZ   )rH   r   r
   PKCS1v15rD   rQ   r   )rS   r   r   rV   r0   r0   r1   r   G  s   zCryptographyRSAKey.signc                 C   sL   |   s	td z|  j||t |   W dS  t	y%   Y dS w )NzKAttempting to verify a message with a private key. This is not recommended.TF)
r   warningswarnrp   rH   r   r
   r   rD   r   )rS   r   r   r0   r0   r1   r   N  s   
zCryptographyRSAKey.verifyc                 C   r   r   r   rx   r0   r0   r1   r   X  r   zCryptographyRSAKey.is_publicc                 C   r   rZ   r   rx   r0   r0   r1   rp   [  r   zCryptographyRSAKey.public_keyPKCS8c                 C   s   |   r(|dkrtjj}n|dkrtjj}ntd| | jjtjj	|d}|S |dkr1tj
j}n|dkr:tj
j}ntd| | jjtjj	|t dS )Nr   PKCS1zInvalid format specified: %rr   r   )r   r   r   r   r   rP   rH   r5   r   r   r   r   r   r6   r   )rS   
pem_formatfmtr   r0   r0   r1   r7   `  s    



zCryptographyRSAKey.to_pemc              
   C   s   |   s
| j }n| j}| jdt| jdt| jdd}|   sk|	t| j
 jdt| j
 jdt| j
 jdt| j
 jdt| j
 jdt| j
 jdd |S )Nr   r   )r   rX   r   rV   )rh   r   r   r   r   r   )r   rH   rp   rE   r$   r   r   rI   rV   updater   rh   r   r   dmp1dmq1iqmp)rS   rp   r   r0   r0   r1   r   v  s&   zCryptographyRSAKey.to_dictc              
   C   s8   z| j || j}W |S  ty } zt|d }~ww rZ   )rH   encryptr
   rQ   r   )rS   key_datawrapped_keyrV   r0   r0   r1   wrap_key  s   zCryptographyRSAKey.wrap_keyc              
   C   s8   z| j || j}|W S  ty } zt|d }~ww rZ   )rH   decryptr
   rQ   r   )rS   r   unwrapped_keyrV   r0   r0   r1   
unwrap_key  s   zCryptographyRSAKey.unwrap_key)r   )r   r   r   r   r>   r@   rB   r
   r   r   OAEPMGF1SHA1r   r   r   rW   rL   r   r   r   r   rp   r7   r   r   r   r0   r0   r0   r1   r      s$    /)

r   c                   @   s(  e Zd ZejejejejfZej	ej
ejejfZejejejejejfZejfZejfZejejejfZejejej	ejejejejejejejejejejejejejejejejejej
ejejejejdejdejdiZejjd ddZ dd Z!dd Z"dd	d
Z#dddZ$dd Z%dd Z&dS )CryptographyAESKeyNr      )CBCGCMc                 C   s  |t jvrtd| |t jt jvrtd| || _| j| j| _	|| j
v r7t|dkr7td| || jv rIt|dkrItd| || jv r[t|dkr[td| || jv rmt|d	krmtd
| || jv rt|dkrtd| || _d S )Nz%s is not a valid AES algorithmz%s is not a supported algorithm   zKey must be 128 bit for alg    zKey must be 192 bit for alg     zKey must be 256 bit for alg 0   zKey must be 384 bit for alg @   zKey must be 512 bit for alg )r   AESr   	SUPPORTEDunion
AES_PSEUDOrE   MODESrC   _modeKEY_128r   KEY_192KEY_256KEY_384KEY_512_keyrS   rT   rU   r0   r0   r1   rW     s"   

zCryptographyAESKey.__init__c                 C   s   | j dt| jd}|S )Noctr   rX   r]   )rE   r    r   )rS   r   r0   r0   r1   r     s   zCryptographyAESKey.to_dictc              
   C   s   t |}zk| j| jjtjj}t|}| |}|jdkr<t	
| j}||||}|d t|d  }|dd  }	n.tt| j|t d}| }
ttjj }||}|| 7 }|
||
  }d }	|||	fW S  ty } zt|d }~ww )Nr   r   ir;   )r!   IV_BYTE_LENGTH_MODE_MAPrC   r   r   r   r   
block_sizer2   r   AESGCMr   r   r   r   r   	encryptorr   padderr   finalizerQ   r   )rS   
plain_textaadiv_byte_lengthivmodeciphercipher_text_and_tagcipher_textauth_tagr   r   padded_datarV   r0   r0   r1   r     s,   


zCryptographyAESKey.encryptc              
   C   s   t |}zht |}| |}|jdkr<|d u rtdt| j}|| }z||||}W |W S  ty;   t	dw t
t| j|t d}| }	|	|}
|
|	 7 }
ttjj }||
}|| 7 }|W S  ty| } zt	|d }~ww )Nr   ztag cannot be NonezInvalid JWE Auth Tagr   )r!   r   r   rP   r   r   r   r   r   r   r   r   r   r   	decryptorr   r  r   r   unpadderrQ   )rS   r	  r  r  tagr  r  r  r  r  padded_plain_textr  rV   r0   r0   r1   r     s6   



zCryptographyAESKey.decryptc                 C   s   t |}t| j|t }|S rZ   )r!   r   r   r   )rS   r   r	  r0   r0   r1   r     s   zCryptographyAESKey.wrap_keyc              
   C   s@   t |}zt| j|t }W |S  ty } zt|d }~ww rZ   )r!   r   r   r   r   r   )rS   r   r  causer0   r0   r1   r     s   zCryptographyAESKey.unwrap_keyrZ   )NNN)'r   r   r   r   A128GCM	A128GCMKWA128KWA128CBCr   A192GCM	A192GCMKWA192KWA192CBCr   A256GCM	A256GCMKWA256KWA128CBC_HS256A256CBCr   A192CBC_HS384r   A256CBC_HS512r   AES_KW_ALGSr   r   r   r   r   r   r   r   rW   r   r   r   r   r   r0   r0   r0   r1   r     sF    

r   c                   @   sZ   e Zd ZdZeje eje	 ej
e iZdd Zdd Zdd Zdd	 Zd
d ZdS )CryptographyHMACKeyzf
    Performs signing and verification operations using HMAC
    and the specified hash function.
    c                 C   s   |t jvrtd| || _| j|| _t|tr"| 	|| _
d S t|ts0t|ts0tdt|tr:|d}t|sBt|rFtd|| _
d S )Nr4   z+Expecting a string- or bytes-formatted key.r8   zdThe specified key is an asymmetric key or x509 certificate and should not be used as an HMAC secret.)r   HMACr   rE   ALG_MAPrC   	_hash_algrJ   rK   rL   rH   rM   rO   rN   r"   r#   r   r0   r0   r1   rW   &  s    




zCryptographyHMACKey.__init__c                 C   sH   | ddkstd| d | d}|d}t|}t|}|S )NrX   r   z1Incorrect key type. Expected: 'oct', Received: %sr]   r8   )rC   r   rN   rO   r   )rS   r_   r]   r0   r0   r1   rL   >  s   

z CryptographyHMACKey._process_jwkc                 C   s   | j dt| jddS )Nr   r   r   )rE   r    rH   rI   rx   r0   r0   r1   r   I  s   zCryptographyHMACKey.to_dictc                 C   s4   t |}tj| j| jt d}|| | }|S )Nr   )r!   r   r"  rH   r$  r   r   r  )rS   r   hr   r0   r0   r1   r   P  s
   
zCryptographyHMACKey.signc                 C   s^   t |}t |}tj| j| jt d}|| z
|| d}W |S  ty.   d}Y |S w )Nr   TF)	r!   r   r"  rH   r$  r   r   r   r   )rS   r   r   r%  verifiedr0   r0   r1   r   W  s   

zCryptographyHMACKey.verifyN)r   r   r   __doc__r   HS256r   r>   HS384r@   HS512rB   r#  rW   rL   r   r   r   r0   r0   r0   r1   r!    s    "r!  );ru   r   cryptography.exceptionsr   r   cryptography.hazmat.backendsr   ,cryptography.hazmat.bindings.openssl.bindingr   cryptography.hazmat.primitivesr   r   r   )cryptography.hazmat.primitives.asymmetricr	   r
   r   /cryptography.hazmat.primitives.asymmetric.utilsr   r   &cryptography.hazmat.primitives.ciphersr   r   r   r   &cryptography.hazmat.primitives.keywrapr   r   r   &cryptography.hazmat.primitives.paddingr   ,cryptography.hazmat.primitives.serializationr   r   cryptography.utilsr   cryptography.x509r   	constantsr   
exceptionsr   r   utilsr   r   r    r!   r"   r#   r$   baser&   r'   r2   r3   r   r   r!  r0   r0   r0   r1   <module>   s4    $	 + @}