Ë
|
¬`i!D ã óÜ d dl Z d dlmZ d dlmZ d dlmZ ddlmZm Z ddl
|
m Z m Z m Z d dlmZ d d lmZ d d
|
lmZ d d lmZmZmZ d d lmZmZ G d de« Z G d de« Z G d de « Z G d de « Z ddefddefddefddefddefd Z d e!d e!d e!d e!d!ef
|
d"Z"d#e!d e!d$e!d%e#d e!d!ef d&Z$d'e!d(e!d e!d!efd)Z% G d* d+« Z&ddddd,d-ed.e d/ee! d0ee d1ee'e!e!f d$ee! d2e&fd3Z(y)4é N)ÚIntEnum)Ú
|
ModuleType)ÚOptionalé )Ú _HKDF_extractÚ _HKDF_expand)Ú key_agreementÚimport_x25519_public_keyÚimport_x448_public_key)Ústrxor)ÚECC)ÚEccKey)ÚSHA256ÚSHA384ÚSHA512)ÚAESÚChaCha20_Poly1305c ó e Zd ZdZdZdZdZdZy)ÚMODEz
|
HPKE modesr r é é N)Ú__name__Ú
|
__module__Ú __qualname__Ú__doc__ÚBASEÚPSKÚAUTHÚAUTH_PSK© ó õg H:\项ç®\archive\æµè¯ç»\èæ¬\Change_password\venv_build\Lib\site-packages\Crypto/Protocol/HPKE.pyr r s ÙØ DØ
|
CØ DØHr! r c ó e Zd ZdZdZdZdZy)ÚAEADz>Authenticated Encryption with Associated Data (AEAD) Functionsr r r N)r r r r Ú
|
AES128_GCMÚ
|
AES256_GCMÚCHACHA20_POLY1305r r! r" r$ r$ s ÙHØJØJØ Ñr! r$ c ó e Zd Zy)ÚDeserializeErrorN©r r r r r! r" r) r) ó Ør! r) c ó e Zd Zy)ÚMessageLimitReachedErrorNr* r r! r" r- r- " r+ r! r- é é r é r é é! ©z
|
NIST P-256z
|
NIST P-384z
|
NIST P-521Ú
|
Curve25519ÚCurve448ÚsaltÚlabelÚikmÚsuite_idÚhashmodc ó2 d|z |z |z }t | ||« S )Nó HPKE-v1)r )r6 r7 r8 r9 r: Ú labeled_ikms r" Ú_labeled_extractr> / s' ð
|
xÑ'¨%Ñ/°#Ñ5KÜ {¨GÓ 4Ð4r! ÚprkÚinfoÚLc ób t j d|« dz |z |z |z }t | |||« S )Nú>Hr< )ÚstructÚpackr )r? r7 r@ rA r9 r: Ú labeled_infos r" Ú_labeled_expandrG 8 s? ô ;;t QÓ'¨*Ñ4°xÑ?ØñØ ñ Lä \¨1¨gÓ 6Ð6r! ÚdhÚ kem_contextc ó\ |j }t dd| ||« }t |d||||« }|S )Nr! s eae_prks shared_secret)Ú digest_sizer> rG )rH rI r9 r: ÚNsecretÚeae_prkÚ shared_secrets r" Ú_extract_and_expandrO C sL ð ×!Ñ!Gä sØ )Ø !Ø 'Ø &ó (Gô $ GØ$4Ø$/Ø$+Ø$,Ø$+ó -Mð Ðr! c ó e Zd Zdedee dee deeef dededefdZ e
|
dded
|
e d e dee d ee f
|
d « Z e
|
ddeded
|
e d e dee f
|
d« Ze
|
dedeeef fd« ZdedededefdZd Zddedee fdZddedee fdZy ) Ú HPKE_CipherÚ receiver_keyÚencÚ
|
sender_keyÚpsk_pairr@ Úaead_idÚmodec ó |dn|| _ | j ||« |j | _ || _ || _ t | j \ | _ | _ | _ | j t j k( rdnd| _ d| _ d| _ | j j$ | _ |j) « | _ | j* r>| t d« | j- || j | j |« \ } | _ n6| t d« | j/ ||| j | j |« } d| _ d d
|
| j z z d z
|
| _ | j4 | |g|¢ \ | _ | _ | _ y # t $ r*}t dj | j « « |d }~ww xY w) Nr! z!Curve {} is not supported by HPKEr. r1 é z0Parameter 'enc' cannot be an input when sealingz'Parameter 'enc' required when unsealingr r é ) rS Ú_verify_psk_inputsÚcurveÚ_curveÚ_aead_idÚ_modeÚ _Curve_ConfigÚ_kem_idÚ_kdf_idÚ_hashmodÚKeyErrorÚ
|
ValueErrorÚformatr$ r% Ú_NkÚ_NnÚ_NtrK Ú_NhÚ has_privateÚ_encryptÚ_encapÚ_decapÚ _sequenceÚ _max_sequenceÚ _key_scheduleÚ_keyÚ _base_nonceÚ_export_secret)
|
ÚselfrR rS rT rU r@ rV rW ÚkerN s
|
r" Ú__init__zHPKE_Cipher.__init__Z sµ ð "% #°#Ø+à × Ñ hÔ/à"×(Ñ( Ø Ø
|
ð ^ô +¨4¯;©;Ñ 7ñ DLØ \Ø ]ð ¬$¯/©/Ò92¸rØØØ==×,Ñ,à (× 4Ñ 4Ó 6Ð6 à ==àÜ Ð!SÓTÐTØ&*§k¡k°,Ø26·,±,Ø26·-±-Ø2<ó'>Ñ #M48ð {Ü Ð!JÓKÐKØ KK¨Ø(4Ø(,¯ © Ø(,¯ © Ø(2ó 4Mð Ø A¨¯©¡LÑ 1°QÑ 6Ôð #5 $×"4Ñ"4°]Ø59ð#@à6>ò#@ñ Ø Ô Ø Õ øôC ò ^Ü Ð @× GÑ GÈÏ É Ó TÓUÐ[]Ð ]ûð ^ús ¿&F Æ GÆ %GÇGNÚkem_idr: Úeph_keyc óÜ ||j « sJ ||j « sJ | t j | j ¬« }|j « j d¬« }| j « j d¬« }||z }i }|r'||j « j d¬« z }d|i}dt j d|« z } || |fd}
|
t d || |
|
d|¤} | |fS )
|
N)r\ Úraw©rf Ú static_privó KEMrC c ó t | |||« S ©N©rO ©rH rI r9 r: s r" Úkdfz HPKE_Cipher._encap.<locals>.kdf¬ ó ô ' r¨;¸À'ÓJÐ Jr! )Úeph_privÚ
|
static_pubr r ) rk r Úgenerater\ Ú
|
public_keyÚ
|
export_keyrD rE r ) rR rx r: rT ry rS ÚpkRmrI Ú extra_paramr9 r rN s r" rm zHPKE_Cipher._encap s ð Ð" z×'=Ñ'=Ô'?Ð?Ð?Ø G×$7Ñ$7Ô$9Ð9Ð9à ?Üll¨ ×);Ñ);Ô<GØ× Ñ Ó"×-Ñ-°UÐ-Ó;à×&Ñ&Ó(×3Ñ3¸5Ð3ÓAØDj Ø Ù Ø :×0Ñ0Ó2×=Ñ=ÀUÐ=ÓKÑ KKØ(¨*Ð5KàFKK¨¨fÓ 5Ñ5ð (Ø!Ø ó Kô &ð 5¨wØ1=Ø*-ñ5ð )4ñ5 ð cÐ!Ð!r! c ó |j « sJ |j dk( r t | « }n<|j dk( r t | « }n!t j
|
| |j ¬« }|j « j d¬« }| |z }i } |r'||j « j d¬« z }d|i} dt j d |« z }
|
||
|
|fd
|
} t d ||| d | ¤} | S # t $ r}t d« |d }~ww xY w) Nr4 r5 )Ú
|
curve_namez*'enc' is not a valid encapsulated HPKE keyr{ r| r r~ rC c ó t | |||« S r r r s r" r z HPKE_Cipher._decap.<locals>.kdfÔ r r! )Úeph_pubr} r r ) rk r\ r
|
r r Ú
|
import_keyre r) r r rD rE r ) rS rR rx r: rT ÚpkEÚver rI r r9 r rN s r" rn zHPKE_Cipher._decap¸ s0 ð ×'Ñ'Ô)Ð)Ð)ð YØ×!Ñ! \Ò1Ü.¨sÓ3Ø ×#Ñ# zÒ1Ü,¨SÓ1änn S°\×5GÑ5GÔHð ×&Ñ&Ó(×3Ñ3¸5Ð3ÓAØDj Ø Ù Ø :×0Ñ0Ó2×=Ñ=ÀUÐ=ÓKÑ KKØ'¨Ð4KàFKK¨¨fÓ 5Ñ5ð (Ø!Ø ó Kô &ð 5¨cØ2>Ø*-ñ5ð )4ñ5 ð Ð øô- ò YÜ"Ð#OÓPÐVXÐ Xûð Yús AC, Ã, DÃ5 DÄDc óF |\ }}|dk( |dk( z r t d« |dk( r;| t j t j fv rt d| j « y t |« dk r t d« | t j t j fv r t d« y )Nr! zInconsistent PSK inputszPSK is required with mode r1 z!PSK must be at least 32 byte longz$PSK is not compatible with this mode)re r r r ÚnameÚlenr r )rW rU Úpsk_idÚpsks r" r[ z HPKE_Cipher._verify_psk_inputsà s à à 3J6 S=Ò )Ü Ð 6Ó7Ð 7à 3Jؤ$§-¡-Ð0Ñ0Ü Ð#=¸d¿i¹i¸[Ð!IÓJÐJð 1ô 3x"}Ü Ð!DÓEÐEØ ¤4§9¡9Ð-Ñ-Ü Ð!GÓHÐHð .r! rN r r c ó0 dt j d| j | j | j « z }t dd||| j « }t dd||| j « }| j j dd« |z |z }t |d||| j « } t | d || j || j « }
|
t | d
|
|| j || j « } t | d || j || j « } |
|
| | fS ) Ns HPKEz>HHHr! s psk_id_hashs info_hashr Úbigs secrets keys
|
base_nonces exp) rD rE ra rb r^ r> rc r_ Úto_bytesrG rg rh rj ) ru rN r@ r r r9 Ú psk_id_hashÚ info_hashÚkey_schedule_contextÚsecretÚkeyÚ
|
base_nonceÚexporter_secrets r" rq zHPKE_Cipher._key_scheduleð s) ð V[[¨Ø)-¯ © Ø)-¯ © Ø)-¯ © ó 8ñ 8ô
|
' sØ'5Ø'-Ø'/Ø'+§}¡}ó 6 ô % SØ%1Ø%)Ø%-Ø%)§]¡]ó 4 ð $zz× 2Ñ 2°1°eÓ <¸{Ñ JÈYÑ VÐ ä! -Ø"+Ø"%Ø"*Ø"&§-¡-ó 1ô fØ $Ø 2Ø "hhØ &Ø "mmó -ô % VØ%2Ø%9Ø%)§X¡XØ%-Ø%)§]¡]ó 4
|
ô *¨&Ø*0Ø*>Ø*.¯(©(Ø*2Ø*.¯-©-ó 9ð J Ð/Ð/r! c ój t | j | j j | j d« « }| j
|
t j t j fv r<t j | j t j || j ¬« }nX| j
|
t j k( r"t j | j |¬« }nt! d| j
|
d« | j | j" k\ r
|
t% « | xj dz c_ |S )Nr )ÚnonceÚmac_len)r r£ úUnknown AEAD cipher ID ú#xr )r rs ro r rh r^ r$ r% r& r Únewrr ÚMODE_GCMri r' r re rp r- )ru r£ Úciphers r" Ú _new_cipherzHPKE_Cipher._new_cipher& sÒ Üt×'Ñ'¨¯ © ×)@Ñ)@ÀÇÁÈ5Ó)QÓRØ ==T__¬d¯o©oÐ >Ñ >ÜWWTYY¬¯ © ¸EÈ4Ï8É8ÔTFØ ]]d× 4Ñ 4Ò 4Ü&×*Ñ*¨t¯y©yÀÔFFä Ð 6°t·}±}ÀRÐ6HÐ IÓJÐ JØ >>T× /Ñ /Ò /Ü*Ó,Ð ,Ø !ÑØ r! Ú plaintextÚ auth_datac ó¨ | j s t d« | j « }|r|j |« |j |« \ }}||z S )aæ Encrypt and authenticate a message.
|
|
This method can be invoked multiple times
|
to seal an ordered sequence of messages.
|
|
Arguments:
|
plaintext: bytes
|
The message to seal.
|
auth_data: bytes
|
Optional. Additional Authenticated data (AAD) that is not encrypted
|
but that will be also covered by the authentication tag.
|
|
Returns:
|
The ciphertext concatenated with the authentication tag.
|
z$This cipher can only be used to seal)rl re rª ÚupdateÚencrypt_and_digest)ru r« r¬ r© ÚctÚtags r" ÚsealzHPKE_Cipher.seal3 sQ ð" }}Ü Ð CÓDÐ DØ×!Ñ!Ó#Ù Ø MM)Ô $Ø×+Ñ+¨IÓ6CØCxr! Ú
|
ciphertextc ó | j r t d« t |« | j k r t d« | j « }|r|j |« |j |d| j || j d « }|S # t $ r& | j dk( r t d« t d« w xY w)að Decrypt a message and validate its authenticity.
|
|
This method can be invoked multiple times
|
to unseal an ordered sequence of messages.
|
|
Arguments:
|
cipertext: bytes
|
The message to unseal.
|
auth_data: bytes
|
Optional. Additional Authenticated data (AAD) that
|
was also covered by the authentication tag.
|
|
Returns:
|
The original plaintext.
|
|
Raises: ValueError
|
If the ciphertext (in combination with the AAD) is not valid.
|
|
But if it is the first time you call ``unseal()`` this
|
exception may also mean that any of the parameters or keys
|
used to establish the session is wrong or that one is missing.
|
z&This cipher can only be used to unsealzCiphertext is too smallNr zAIncorrect HPKE keys/parameters or invalid message (wrong MAC tag)z Invalid message (wrong MAC tag))rl re r ri rª r® Údecrypt_and_verifyro )ru r³ r¬ r© Úpts r" ÚunsealzHPKE_Cipher.unsealL sÄ ð0 ==Ü Ð EÓFÐ FÜ z?TXXÒ %Ü Ð 6Ó7Ð 7Ø×!Ñ!Ó#Ù Ø MM)Ô $ð @Ø×*Ñ*¨:°j¸¿¹°yÐ+AØ+5°t·x±x°i°jÐ+AóCBð øô ò @Ø~~ Ò"Ü Ð!dÓeÐeÜ Ð >Ó?Ð ?ð @ús Á .B Â/B>)NNr )r r r r r ÚbytesÚtupler$ r rw Ú staticmethodÚintr rm rn r[ rq rª r² r· r r! r" rQ rQ X s ð9@Ø %ð9@à uoð9@ð & fÑ -ð9@ð ! ¨ Ñ.ð 9@ð
|
ð 9@ð ð 9@ð ó9@ðv ð /3Ø+/ñ "Vð "Øð "à"ð "ð $ FÑ+ð "ð ! Ñ(ò "ó ð "ðD ð
|
/3ñ % Eð % Ø #ð% àð% ð #ð% ð $ FÑ+ò % ó ð% ðN ð I ð I°°u¸e°|Ñ1Dò Ió ð Ið 40Ø%*ð40à !ð40ð $ð40ð !ó 40òl ñeð °¸±ó ñ2' ð '°8¸E±?ô 'r! rQ )rS rT r r@ rR rV rS rT r Úreturnc ó |t vrt d|d« | j }|dvrt d| « |rt | j « « t |j « « z }|dk7 r t d« |j |k7 r%t dj |j |« « |t j nt j }n"|t j nt j }|d}|d }t | ||||||« S )
|
a Create an HPKE context which can be used:
|
|
- by the sender to seal (encrypt) a message or
|
- by the receiver to unseal (decrypt) it.
|
|
As a minimum, the two parties agree on the receiver's asymmetric key
|
(of which the sender will only know the public half).
|
|
Additionally, for authentication purposes, they may also agree on:
|
|
* the sender's asymmetric key (of which the receiver will only know the public half)
|
|
* a shared secret (e.g., a symmetric key derived from a password)
|
|
Args:
|
receiver_key:
|
The ECC key of the receiver.
|
It must be on one of the following curves: ``NIST P-256``,
|
``NIST P-384``, ``NIST P-521``, ``X25519`` or ``X448``.
|
|
If this is a **public** key, the HPKE context can only be used to
|
**seal** (**encrypt**).
|
|
If this is a **private** key, the HPKE context can only be used to
|
**unseal** (**decrypt**).
|
|
aead_id:
|
The HPKE identifier of the symmetric cipher.
|
The possible values are:
|
|
* ``HPKE.AEAD.AES128_GCM``
|
* ``HPKE.AEAD.AES256_GCM``
|
* ``HPKE.AEAD.CHACHA20_POLY1305``
|
|
enc:
|
The encapsulated session key (i.e., the KEM shared secret).
|
|
The receiver must always specify this parameter.
|
|
The sender must always omit this parameter.
|
|
sender_key:
|
The ECC key of the sender.
|
It must be on the same curve as the ``receiver_key``.
|
If the ``receiver_key`` is a public key, ``sender_key`` must be a
|
private key, and vice versa.
|
|
psk:
|
A Pre-Shared Key (PSK) as a 2-tuple of non-empty
|
byte strings: the identifier and the actual secret value.
|
Sender and receiver must use the same PSK (or none).
|
|
The secret value must be at least 32 bytes long,
|
but it must not be a low-entropy password
|
(use a KDF like PBKDF2 or scrypt to derive a secret
|
from a password).
|
|
info:
|
A non-secret parameter that contributes
|
to the generation of all session keys.
|
Sender and receive must use the same **info** parameter (or none).
|
|
Returns:
|
An object that can be used for
|
sealing (if ``receiver_key`` is a public key) or
|
unsealing (if ``receiver_key`` is a private key).
|
In the latter case,
|
correctness of all the keys and parameters will only
|
be assessed with the first call to ``unseal()``.
|
r¥ r¦ r3 zUnsupported curve r z Exactly 1 private key requiredz'Sender key uses {} but recipient key {})r! r! r! ) r$ re r\ r» rk rf r r r r r rQ ) rR rV rS rT r r@ r\ Úcount_private_keysrW s r" r§ r§ v s ðZ dÑÜÐ2°7¸2°,Ð?Ó@Ð@à × Ñ EØ ð /ñ /äÐ-¨e¨WÐ5Ó6Ð6áÜ ×!9Ñ!9Ó!;Ó <Ü ×!7Ñ!7Ó!9Ó :ñ ;Ðà Ò "Ü Ð =Ó>Ð >Ø × Ñ uÒ $Ü Ð Fß #V J×$4Ñ$4°eÓ <ó>ð >à Ktyy¬T¯]©]à Ktyy¬T¯X©Xà
|
{Øà |Øä |ØØ!ØØØ Øó ð r! ))rD Úenumr Útypesr Útypingr ÚKDFr r ÚDHr r
|
r ÚCrypto.Util.strxorr ÚCrypto.PublicKeyr ÚCrypto.PublicKey.ECCr Ú Crypto.Hashr r r Ú Crypto.Cipherr r r r$ re r) r- r` r¸ r> r» rG rO rQ r¹ r§ r r! r" ú<module>rÉ s© ðÛ Ý å Ý ç ,ß OÑ OÝ %Ý Ý 'ß .Ñ .ß 0ô7ô ô 7ô ô zô ô zô ð
|
Ð(Ø Ð(Ø Ð(Ø Ð(Ø Ð(ñ ð55ð 5Ø !ð5à ð5ð %ð5ð )ó 5ð7ð 7Ø ð7à ð7ð ð7ð $ð 7ð
|
(ó 7ðEð Ø%*ðà"'ðð ",ó÷*[ñ [ð@ $Ø'+Ø-1Ø $ò m ð m Øðm à e_ðm ð VÑ$ðm ð eE 5LÑ)Ñ *ð m ð
|
uoð m ð
|
*5ô m r!
|
