Ë
|
¬`iU ã ó d Z dgZddlmZ ddlmZmZ ddlmZ ddl m
|
Z
|
m Z ddl m Z ddlmZ dd lmZmZmZmZmZmZmZ dd
|
lmZ d Zd Zd Z e« Z d Z e « Z G d de « Z d Z! e!dd¬« Z" G d de « Z#d Z$y)z
|
Galois/Counter Mode (GCM).
|
ÚGcmModeé )Ú unhexlify)ÚbordÚ _copy_bytes)Ú is_buffer)Ú long_to_bytesÚ bytes_to_long)ÚBLAKE2s)Úget_random_bytes)Úload_pycryptodome_raw_libÚ VoidPointerÚcreate_string_bufferÚget_raw_bufferÚ SmartPointerÚc_size_tÚ c_uint8_ptr)Ú _cpu_featuresa`
|
int ghash_%imp%(uint8_t y_out[16],
|
const uint8_t block_data[],
|
size_t len,
|
const uint8_t y_in[16],
|
const void *exp_key);
|
int ghash_expand_%imp%(const uint8_t h[16],
|
void **ghash_tables);
|
int ghash_destroy_%imp%(void *ghash_tables);
|
c óÒ ddl m} d} |d|« } |D cg c] }t | |dz |z « }}t t ||« « } |di |¤S c c}w # t $ r d gdz }Y 3w xY w)Nr )Ú
|
namedtuple)ÚghashÚ ghash_expandÚ ghash_destroyÚ
|
_GHash_ImpÚ_é © )Ú collectionsr ÚgetattrÚAttributeErrorÚdictÚzip)ÚlibÚpostfixr ÚfuncsÚ GHASH_ImpÚxÚ imp_funcsÚparamss õj H:\项ç®\archive\æµè¯ç»\èæ¬\Change_password\venv_build\Lib\site-packages\Crypto/Cipher/_mode_gcm.pyÚ _build_implr* B s Ý&à 8EÙ<¨Ó/Ið!Ø?DÖF¸!gc 1 s¡7¨WÑ#4Õ5ÐF ÐFô #eYÓ'Ó (FÙ Ñ vÑ Ð ùò GøÜ ò !ØHqL ð!ús! A A°A ÁA ÁA&Á%A&c ób t j dd« } t d| « }t |d« }|S )Nú%imp%ÚportablezCrypto.Hash._ghash_portable)Ú_ghash_api_templateÚreplacer r* ©Úapir" Úresults r) Ú_get_ghash_portabler3 O s2 Ü
|
×
|
%Ñ
|
% g¨zÓ
|
:CÜ
|
#Ð$AÀ3Ó
|
GCÜ jÓ )FØ Mó c ó² t j « sy t j dd« } t d| « }t |d« }|S # t $ r d}Y |S w xY w)z4Return None if CLMUL implementation is not availableNr, ÚclmulzCrypto.Hash._ghash_clmul)r Ú
|
have_clmulr. r/ r r* ÚOSErrorr0 s r) Ú_get_ghash_clmulr9 W se ô × #Ñ #Ô %ØðÜ!×)Ñ)¨'°7Ó;Ü'Ð(BÀCÓHÜ S 'Ó*ð Møô ò ØØ Mðús .A Á AÁAc ó" e Zd ZdZd Zd Zd Zy)Ú_GHASHa GHASH function defined in NIST SP 800-38D, Algorithm 2.
|
|
If X_1, X_2, .. X_m are the blocks of input data, the function
|
computes:
|
|
X_1*H^{m} + X_2*H^{m-1} + ... + X_m*H
|
|
in the Galois field GF(2^256) using the reducing polynomial
|
(x^128 + x^7 + x^2 + x + 1).
|
c ó\ t |« dk( sJ || _ t « | _ |j t |« | j j « « }|rt d|z « t | j j « |j « | _ t d« | _ y )Né z&Error %d while expanding the GHASH key) ÚlenÚghash_cr Ú_exp_keyr r Ú
|
address_ofÚ
|
ValueErrorr Úgetr r Ú_last_y)ÚselfÚsubkeyr? r2 s r) Ú__init__z_GHASH.__init__r s Ü6{bÒ Ð Ð à ä# Ø×%Ñ%¤k°&Ó&9Ø&*§m¡m×&>Ñ&>Ó&@óBá Ü Ð EÈÑ NÓOÐ Oä$ T§]¡]×%6Ñ%6Ó%8Ø%,×%:Ñ%:ó< ô ,¨BÓ/ r4 c ó t |« dz dk( sJ | j j | j t |« t t |« « | j | j j « « }|rt d|z « | S )Nr= r z Error %d while updating GHASH) r> r? r rD r r r@ rC rB )rE Ú
|
block_datar2 s r) Úupdatez _GHASH.update sy Ü: Ñ# qÒ(Ð(Ð(à ×#Ñ# D§L¡LÜ$/°
|
Ó$;Ü$,¬S°«_Ó$=Ø$(§L¡LØ$(§M¡M×$5Ñ$5Ó$7ó 9ñ
|
Ü Ð <¸vÑ EÓFÐ Fà r4 c ó, t | j « S ©N)r rD ©rE s r) Údigestz _GHASH.digest s Ü dllÓ+Ð+r4 N)Ú__name__Ú
|
__module__Ú __qualname__Ú__doc__rG rJ rN r r4 r) r; r; f s ñ ò0ò" ó,r4 r; c ó t dd| « S )NÚEnumr )Útype)Úenumss r) ÚenumrW s Ü EÓ "Ð"r4 é é )ÚPROCESSING_AUTH_DATAÚPROCESSING_CIPHERTEXTc óf e Zd ZdZd Zd Zd Zd ZddZddZ d Z
|
d
|
Z d Z d Z d ZddZddZy)r a Galois Counter Mode (GCM).
|
|
This is an Authenticated Encryption with Associated Data (`AEAD`_) mode.
|
It provides both confidentiality and authenticity.
|
|
The header of the message may be left in the clear, if needed, and it will
|
still be subject to authentication. The decryption step tells the receiver
|
if the message comes from a source that really knowns the secret key.
|
Additionally, decryption detects if any part of the message - including the
|
header - has been modified or corrupted.
|
|
This mode requires a *nonce*.
|
|
This mode is only available for ciphers that operate on 128 bits blocks
|
(e.g. AES but not TDES).
|
|
See `NIST SP800-38D`_.
|
|
.. _`NIST SP800-38D`: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
|
.. _AEAD: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
|
|
:undocumented: __init__
|
c óà |j | _ | j dk7 r t d« t |« dk( r t d« t |« s t d« t |« dkD r t d« t d d |« | _ || _ t d d |« | _ d | _ || _
|
d|cxk rdk st d « t d « g d
|
¢| _ d | _ d| _ d| _ |j || j j fi |¤j# d « }t | j « d k( r| j dz }ndt | j « dz z
|
dz dz } | j d| z z t% dt | j « z d« z }
|
t' ||« j) |
|
« j+ « }|d d } t- |« dz dz } |j || j j. f| | d|¤| _ t' ||« | _ |j || j j. f|dd|¤| _ d| _ t8 j: | _ y )Nr= zFGCM mode is only available for ciphers that operate on 128 bits blocksr zNonce cannot be emptyz,Nonce must be bytes, bytearray or memoryviewì ÿÿÿÿ z Nonce exceeds maximum lengthé z.Parameter 'mac_len' must be in the range 4..16©rJ ÚencryptÚdecryptrN ÚverifyFs é s é ó rX l ÿÿ )Ú initial_valueÚnoncer4 ) Ú
|
block_sizerB r> r Ú TypeErrorr rh Ú_factoryÚ_keyÚ_tagÚ_mac_lenÚ_nextÚ_no_more_assoc_dataÚ _auth_lenÚ_msg_lenÚnewÚMODE_ECBra r r; rJ rN r ÚMODE_CTRÚ_cipherÚ_signerÚ _tag_cipherÚ_cacheÚ MacStatusrZ Ú_status) rE ÚfactoryÚkeyrh Úmac_lenÚ cipher_paramsr? Ú hash_subkeyÚj0ÚfillÚghash_inÚ nonce_ctrÚiv_ctrs r) rG zGcmMode.__init__´ s à!×,Ñ,Ø ??bÒ Ü ð @ó Að Aô u:?Ü Ð 4Ó5Ð 5äÔ ÜÐ JÓKÐ Kô u: Ò !Ü Ð ;Ó<Ð <ô ! t¨UÓ3
|
Øà Ü d¨CÓ0 Ø à ØWÔ" Ò"Ü Ð MÓNÐ Nð #Ü Ð MÓNÐ Nò*
|
ð $)Ô ð ð ð "gkk #Ø"&§-¡-×"8Ñ"8ñ$à$1ñ$÷ %,¡G¨LÓ$9ð ô tzz?bÒ ØÐ 1Ñ1Bà#djj/¨BÑ.Ñ/°2Ñ5¸Ñ9DØ
|
|
Ø $ñ'ä% a¬#¨d¯j©j«/Ñ&9¸1Ó=ñ>Hô WÓ-×4Ñ4°XÓ>×EÑEÓGBð sG Ü Ó# aÑ'¨:Ñ5Ø"w{{ 3Ø#'§=¡=×#9Ñ#9ð4à17Ø)2ñ4ð &3ñ 4 ô k¨7Ó3 ð '7;; sØ'+§}¡}×'=Ñ'=ð 8à57Ø-0ñ 8ð *7ñ 8Ôð ä ×5Ñ5 r4 c óÜ d| j vr t d« g d¢| _ | j |« | xj t |« z c_ | j dkD r t d« | S )ax Protect associated data
|
|
If there is any associated data, the caller has to invoke
|
this function one or more times, before using
|
``decrypt`` or ``encrypt``.
|
|
By *associated data* it is meant any data (e.g. packet headers) that
|
will not be encrypted and will be transmitted in the clear.
|
However, the receiver is still able to detect any modification to it.
|
In GCM, the *associated data* is also called
|
*additional authenticated data* (AAD).
|
|
If there is no associated data, this method must not be called.
|
|
The caller may split associated data in segments of any size, and
|
invoke this method multiple times, each time with the next segment.
|
|
:Parameters:
|
assoc_data : bytes/bytearray/memoryview
|
A piece of associated data. There are no restrictions on its size.
|
rJ z<update() can only be called immediately after initializationr` r^ z4Additional Authenticated Data exceeds maximum length)ro rj Ú_updaterq r> rB )rE Ú
|
assoc_datas r) rJ zGcmMode.update sm ð. 4::Ñ %Üð @ó Að Aò*
|
ð ZÔ Ø #j/Ñ)ð >>IÒ %Ü Ð SÓTÐ Tà r4 c ó t | j « dk sJ t | j « dkD rt dt | j « z
|
t |« « }| xj t d ||« z c_ ||d }t | j « dk ry | j j | j « d| _ t |« dz dz }t |d |« | _ |dkD r | j j |d | « y y )Nr= r r4 )r> ry Úminr rw rJ )rE ÚdataÚfillerÚ
|
update_lens r) r zGcmMode._update- sä Ü4;;Ó "Ò$Ð%Ð$ä t{{Ó aÒ Üc $§+¡+Ó .Ñ.´°D³ Ó:FØ KK; t¨V°TÓ:Ñ :KØ=Dä4;;Ó "Ò$Øð LL× Ñ § ¡ Ô ,Ø DKäY "_ rÑ)
|
Ü! *¨d°DÓ9 Ø >Ø LL× Ñ [ jÐ 1Õ 2ð r4 c ó t | j « dk sJ t | j « }|dkD r| j dd|z
|
z « y y )Nr= r rf )r> ry r )rE Ú len_caches r) Ú_pad_cache_and_updatez GcmMode._pad_cache_and_updateA sJ Ü4;;Ó "Ò$Ð%Ð$ô Ó$ Ø q=Ø LL B¨¡NÑ3Õ 4ð r4 Nc ó¢ d| j vr t d« ddg| _ | j j ||¬« }| j t
|
j k( r%| j « t
|
j | _ | j ||n|« | xj t |« z c_
|
| j dkD r t d« |S )aé Encrypt data with the key and the parameters set at initialization.
|
|
A cipher object is stateful: once you have encrypted a message
|
you cannot encrypt (or decrypt) another message using the same
|
object.
|
|
The data to encrypt can be broken up in two or
|
more pieces and `encrypt` can be called multiple times.
|
|
That is, the statement:
|
|
>>> c.encrypt(a) + c.encrypt(b)
|
|
is equivalent to:
|
|
>>> c.encrypt(a+b)
|
|
This function does not add any padding to the plaintext.
|
|
:Parameters:
|
plaintext : bytes/bytearray/memoryview
|
The piece of data to encrypt.
|
It can be of any length.
|
:Keywords:
|
output : bytearray/memoryview
|
The location where the ciphertext must be written to.
|
If ``None``, the ciphertext is returned.
|
:Return:
|
If ``output`` is ``None``, the ciphertext as ``bytes``.
|
Otherwise, ``None``.
|
ra z@encrypt() can only be called after initialization or an update()rN ©Úoutputl ÿÿz Plaintext exceeds maximum length) ro rj rv ra r{ rz rZ r r[ r rr r> rB )rE Ú plaintextr Ú
|
ciphertexts r) ra zGcmMode.encryptN s· ðB DJJÑ &Üð =ó >ð >à Ð*
|
à\\×)Ñ)¨)¸FÐ)ÓC
|
à <<9×9Ñ9Ò 9Ø × &Ñ &Ô (Ü$×:Ñ:DLà 6 >Z°vÔ>Ø Y Ñ' ð ==;Ò &Ü Ð ?Ó@Ð @àÐr4 c ób d| j vr t d« ddg| _ | j t j k( r%| j « t j | _ | j |« | xj t |« z c_ | j j ||¬« S )aë Decrypt data with the key and the parameters set at initialization.
|
|
A cipher object is stateful: once you have decrypted a message
|
you cannot decrypt (or encrypt) another message with the same
|
object.
|
|
The data to decrypt can be broken up in two or
|
more pieces and `decrypt` can be called multiple times.
|
|
That is, the statement:
|
|
>>> c.decrypt(a) + c.decrypt(b)
|
|
is equivalent to:
|
|
>>> c.decrypt(a+b)
|
|
This function does not remove any padding from the plaintext.
|
|
:Parameters:
|
ciphertext : bytes/bytearray/memoryview
|
The piece of data to decrypt.
|
It can be of any length.
|
:Keywords:
|
output : bytearray/memoryview
|
The location where the plaintext must be written to.
|
If ``None``, the plaintext is returned.
|
:Return:
|
If ``output`` is ``None``, the plaintext as ``bytes``.
|
Otherwise, ``None``.
|
rb z@decrypt() can only be called after initialization or an update()rc r ) ro rj r{ rz rZ r r[ r rr r> rv rb )rE r r s r) rb zGcmMode.decrypt s ðB DJJÑ &Üð Có Dð Dà Ð*
|
à <<9×9Ñ9Ò 9Ø × &Ñ &Ô (Ü$×:Ñ:DLà ZÔ Ø Z Ñ( à||×#Ñ# J°vÐ#Ó>Ð>r4 c ód d| j vr t d« dg| _ | j « S )a Compute the *binary* MAC tag in an AEAD mode.
|
|
The caller invokes this function at the very end.
|
|
This method returns the MAC that shall be sent to the receiver,
|
together with the ciphertext.
|
|
:Return: the MAC, as a byte string.
|
rN zAdigest() cannot be called when decrypting or validating a message)ro rj Ú _compute_macrM s r) rN zGcmMode.digest² s: ð 4::Ñ %Üð 7ó 8ð 8à Z
|
à× Ñ Ó"Ð"r4 c ó | j r | j S | j « | j t d| j z d« « | j t d| j
|
z d« « | j j « }| j j |« d| j | _ | j S )z#Compute MAC without any FSM checks.re N) rm r r r rq rr rw rN rx ra rn )rE Ús_tags r) r zGcmMode._compute_macÄ s ð 99Ø99Ð ð ×"Ñ"Ô$Ø ] 1 t§~¡~Ñ#5°qÓ9Ô:Ø ] 1 t§}¡}Ñ#4°aÓ8Ô9Ø ×#Ñ#Ó%ð ×$Ñ$×,Ñ,¨UÓ3°N°T·]±]ÐC àyyÐr4 c ó~ dj | j « D cg c] }dt |« z c}« S c c}w )zCompute the *printable* MAC tag.
|
|
This method is like `digest`.
|
|
:Return: the MAC, as a hexadecimal string.
|
Ú z%02x)ÚjoinrN r )rE r& s r) Ú hexdigestzGcmMode.hexdigestÕ s0 ð ww°$·+±+³-Ö@¨Q¤ a£Ó(Ò@ÓAÐAùÒ@s :c ó0 d| j vr t d« dg| _ t d« }t j d|| j « ¬« }t j d||¬« }|j « |j « k7 r t d« y)a( Validate the *binary* MAC tag.
|
|
The caller invokes this function at the very end.
|
|
This method checks if the decrypted message is indeed valid
|
(that is, if the key is correct) and it has not been
|
tampered with while in transit.
|
|
:Parameters:
|
received_mac_tag : bytes/bytearray/memoryview
|
This is the *binary* MAC, as received from the sender.
|
:Raises ValueError:
|
if the MAC does not match. The message has been tampered with
|
or the key is incorrect.
|
rc z3verify() cannot be called when encrypting a messager= é )Ú digest_bitsr} r zMAC check failedN)ro rj r r
|
rs r rN rB )rE Úreceived_mac_tagÚsecretÚmac1Úmac2s r) rc zGcmMode.verifyÞ s ð" 4::Ñ %Üð 9ó :ð :à Z
|
ä! "Ó%ä{{ s°Ø $× 1Ñ 1Ó 3ô5ä{{ s°Ø 0ô2ð ;;=DKKMÒ )Ü Ð /Ó0Ð 0ð *r4 c ó8 | j t |« « y)aW Validate the *printable* MAC tag.
|
|
This method is like `verify`.
|
|
:Parameters:
|
hex_mac_tag : string
|
This is the *printable* MAC, as received from the sender.
|
:Raises ValueError:
|
if the MAC does not match. The message has been tampered with
|
or the key is incorrect.
|
N)rc r )rE Ú hex_mac_tags r) Ú hexverifyzGcmMode.hexverifyþ s ð IkÓ*Õ+r4 c óH | j ||¬« | j « fS )a\ Perform encrypt() and digest() in one step.
|
|
:Parameters:
|
plaintext : bytes/bytearray/memoryview
|
The piece of data to encrypt.
|
:Keywords:
|
output : bytearray/memoryview
|
The location where the ciphertext must be written to.
|
If ``None``, the ciphertext is returned.
|
:Return:
|
a tuple with two items:
|
|
- the ciphertext, as ``bytes``
|
- the MAC tag, as ``bytes``
|
|
The first item becomes ``None`` when the ``output`` parameter
|
specified a location for the result.
|
r )ra rN )rE r r s r) Úencrypt_and_digestzGcmMode.encrypt_and_digest s" ð( ||I¨f|Ó5°t·{±{³}ÐDÐDr4 c óN | j ||¬« }| j |« |S )aÔ Perform decrypt() and verify() in one step.
|
|
:Parameters:
|
ciphertext : bytes/bytearray/memoryview
|
The piece of data to decrypt.
|
received_mac_tag : byte string
|
This is the *binary* MAC, as received from the sender.
|
:Keywords:
|
output : bytearray/memoryview
|
The location where the plaintext must be written to.
|
If ``None``, the plaintext is returned.
|
:Return: the plaintext as ``bytes`` or ``None`` when the ``output``
|
parameter specified a location for the result.
|
:Raises ValueError:
|
if the MAC does not match. The message has been tampered with
|
or the key is incorrect.
|
r )rb rc )rE r r¢ r r s r) Údecrypt_and_verifyzGcmMode.decrypt_and_verify# s) ð& LL °FLÓ; Ø Ð$Ô%ØÐr4 rL )rO rP rQ rR rG rJ r r ra rb rN r r rc r¨ rª r¬ r r4 r) r r sP ñò0P6òd%òN3ò( 5ó3ój-?ò^#ò$ò"Bò 1ò@ ,ó Eô,r4 c óF |j d« }|j dd« }| t d« }|j dd« }|j dd« }|r t
|
rt
|
}nt }t | |||||« S # t $ r }t dt |« z « d}~ww xY w) a! Create a new block cipher, configured in Galois Counter Mode (GCM).
|
|
:Parameters:
|
factory : module
|
A block cipher module, taken from `Crypto.Cipher`.
|
The cipher must have block length of 16 bytes.
|
GCM has been only defined for `Crypto.Cipher.AES`.
|
|
:Keywords:
|
key : bytes/bytearray/memoryview
|
The secret key to use in the symmetric cipher.
|
It must be 16 (e.g. *AES-128*), 24 (e.g. *AES-192*)
|
or 32 (e.g. *AES-256*) bytes long.
|
|
nonce : bytes/bytearray/memoryview
|
A value that must never be reused for any other encryption.
|
|
There are no restrictions on its length,
|
but it is recommended to use at least 16 bytes.
|
|
The nonce shall never repeat for two
|
different messages encrypted with the same key,
|
but it does not need to be random.
|
|
If not provided, a 16 byte nonce will be randomly created.
|
|
mac_len : integer
|
Length of the MAC, in bytes.
|
It must be no larger than 16 bytes (which is the default).
|
r} zMissing parameter:Nrh r= r~ Ú use_clmulT)ÚpopÚKeyErrorrj Ústrr Ú _ghash_clmulÚ_ghash_portabler )r| Úkwargsr} Úerh r~ r® r? s r) Ú_create_gcm_cipherr¶ ; s¤ ð@7ØjjÓ ð JJw Ó %EØ }Ü Ó$Øjj BÓ'Gð
|
|
;¨Ó-IÙ\Ü ä!ä 7C ¨°¸Ó AÐAøô ò 7ÜÐ,¬s°1«vÑ5Ó6Ð6ûð7ús A; Á; B ÂBÂB N)%rR Ú__all__Úbinasciir ÚCrypto.Util.py3compatr r ÚCrypto.Util._raw_apir ÚCrypto.Util.numberr r Ú Crypto.Hashr
|
Ú Crypto.Randomr r r r r r r r Ú Crypto.Utilr r. r* r3 r³ r9 r² Úobjectr; rW rz r r¶ r r4 r) ú<module>rÀ s ðñ>ð +å ç 3å *ç ;Ý Ý *÷G÷ Gñ Gõ &ð Ð ò
|
òñ
|
&Ó'ò ñ Ó! ô+,Vô +,ò\#ñ a¸qÔ A ô]fô ]ó@ 1Br4
|
