
    +h                   <   d dl mZ d dlZd dlZd dlZd dlZd dlmZ d dlmZm	Z	 d dl
mZmZ d dlmZ d dlmZ d dlmZ d d	lmZmZ d d
lmZmZ d dlmZ d dlmZ d dlmZm Z  d dl!m"Z" d dl#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+ d dl,m-Z-m.Z.m/Z/m0Z0 d dl1m2Z2m3Z3 d dl4m5Z5m6Z6 d dl7m8Z8m9Z9m:Z:m;Z;m<Z<m=Z=m>Z>m?Z?m@Z@mAZAmBZBmCZC d dlDmEZEmFZFmGZGmHZHmIZImJZJmKZKmLZLmMZM d dlNmOZO d dlPmQZQmRZRmSZSmTZTmUZU  ej                  dddg      ZW G d d      ZX G d d      ZY G d d      ZZd!d Z[ eY       Z\y)"    )annotationsN)contextmanager)utilsx509)UnsupportedAlgorithm_Reasons)aead)_CipherContext_CMACContext)_EllipticCurvePrivateKey_EllipticCurvePublicKey)_RSAPrivateKey_RSAPublicKey)openssl)binding)hashesserialization)AsymmetricPadding)dhdsaeced448ed25519rsax448x25519)MGF1OAEPPSSPKCS1v15)PrivateKeyTypesPublicKeyTypes)BlockCipherAlgorithmCipherAlgorithm)AESAES128AES256ARC4SM4CamelliaChaCha20	TripleDES_BlowfishInternal_CAST5Internal_IDEAInternal_SEEDInternal)	CBCCFBCFB8CTRECBGCMOFBXTSMode)ssh)PBESPKCS12CertificatePKCS12KeyAndCertificatesPKCS12PrivateKeyTypes_PKCS12CATypes
_MemoryBIObiochar_ptrc                      e Zd Zy)_RC2N)__name__
__module____qualname__     _/var/www/html/venv/lib/python3.12/site-packages/cryptography/hazmat/backends/openssl/backend.pyrE   rE   \   s    rJ   rE   c                      e Zd ZdZdZh dZefZej                  ej                  ej                  ej                  ej                  ej                  ej                  ej                   ej"                  ej$                  ej&                  ej(                  fZej.                  ej0                  ej2                  ej4                  fZdZdZddz  ZdZdez  Z dwdZ!dxdZ"	 dy	 	 	 	 	 dzd
Z#dwdZ$dxdZ%d{dZ&d|dZ'd|dZ(d}dZ)	 	 	 	 d}dZ*d~dZ+d}dZ,ddZ-dwdZ.dwdZ/	 	 	 	 	 	 ddZ0	 	 	 	 	 	 ddZ1d}dZ2ddZ3d{dZ4ddZ5	 	 	 	 	 	 ddZ6	 	 	 	 	 	 ddZ7	 	 	 	 	 	 ddZ8	 	 	 	 dd Z9d! Z:d" Z;dd#Z<d$ Z=dd%Z>	 	 	 	 dd&Z?dd'Z@d}d(ZAdd)ZBdd*ZCdd+ZD	 	 	 	 dd,ZE	 	 	 	 dd-ZF	 	 	 	 dd.ZG	 	 	 	 dd/ZH	 	 	 	 dd0ZId~d1ZJd}d2ZKd~d3ZLdd4ZM	 	 	 	 	 	 	 	 dd5ZNdd6ZOdd7ZP	 	 	 	 	 	 	 	 dd8ZQd9 ZRdd:ZSdd;ZTdd<ZUdd=ZVdd>ZW	 	 dd?ZXdd@ZYddAZZ	 	 	 	 	 	 ddBZ[	 	 	 	 ddCZ\	 	 	 	 ddDZ]	 	 	 	 ddEZ^	 	 	 	 	 	 ddFZ_	 	 	 	 	 	 ddGZ`ddHZaddIZb	 	 	 	 	 	 ddJZcdK ZdddLZeefdM        Zg	 	 	 	 	 	 ddNZh	 	 	 	 	 	 	 	 ddOZi	 	 ddPZjddQZk	 	 	 	 	 	 ddRZld~dSZm	 	 	 	 	 	 ddTZn	 	 	 	 ddUZo	 	 	 	 	 	 ddVZp	 	 	 	 ddWZq	 	 	 	 ddXZr	 	 	 	 ddYZs	 dy	 	 	 	 	 	 	 ddZZtd~d[Zudd\Zv	 	 	 	 dd]Zwdd^Zxd~d_Zydd`ZzddaZ{ddbZ|d~dcZ}d~ddZ~	 	 	 	 ddeZ	 	 	 	 ddfZddgZd~dhZddiZddjZddkZd~dlZddmZej                  dn        Z	 	 	 	 	 	 ddoZ	 	 	 	 	 	 ddpZ	 	 	 	 	 	 	 	 	 	 	 	 ddqZd~drZd~dsZ	 	 	 	 ddtZ	 	 	 	 dduZddvZy	)Backendz)
    OpenSSL API binding interfaces.
    r   >      aes-128-ccm   aes-128-gcm   aes-192-ccm   aes-192-gcm   aes-256-ccm   aes-256-gcm   i     c                   t        j                         | _        | j                  j                  | _        | j                  j
                  | _        t        j                         | _	        i | _
        | j                          | j                  j                  g| _        | j                  j                  r0| j                  j                  | j                  j                          y y N)r   Binding_bindingffi_ffilib_librust_opensslis_fips_enabled_fips_enabled_cipher_registry_register_default_ciphersEVP_PKEY_DH	_dh_typesCryptography_HAS_EVP_PKEY_DHXappendEVP_PKEY_DHXselfs    rK   __init__zBackend.__init__   s    )MM%%	MM%%	)99;
  	 	&&())//09922NN!!$))"8"89 3rJ   c                    dj                  | j                         | j                  | j                  j                        S )Nz3<OpenSSLBackend(version: {}, FIPS: {}, Legacy: {})>)formatopenssl_version_textr`   rY   _legacy_provider_loadedrh   s    rK   __repr__zBackend.__repr__   s7    DKK%%'MM11
 	
rJ   Nc                F    t        j                  | j                  ||      S )N)errors)r   _openssl_assertr]   )ri   okrq   s      rK   openssl_assertzBackend.openssl_assert   s    
 &&tyy"VDDrJ   c                    | j                   j                          t        j                         sJ t        j                         | _        y rW   )rY   _enable_fipsr^   r_   r`   rh   s    rK   rv   zBackend._enable_fips   s7     	""$++---)99;rJ   c                    | j                   j                  | j                  j                  | j                  j                              j                  d      S )z
        Friendly string name of the loaded OpenSSL library. This is not
        necessarily the same version as it was compiled against.

        Example: OpenSSL 1.1.1d  10 Sep 2019
        ascii)r[   stringr]   OpenSSL_versionOPENSSL_VERSIONdecoderh   s    rK   rm   zBackend.openssl_version_text   s@     yyII%%dii&?&?@

&/	rJ   c                6    | j                   j                         S rW   )r]   OpenSSL_version_numrh   s    rK   openssl_version_numberzBackend.openssl_version_number   s    yy,,..rJ   c                    |j                   dk(  s|j                   dk(  r9dj                  |j                   |j                  dz        j                  d      }n|j                   j                  d      }| j                  j                  |      }|S )Nblake2bblake2sz{}{}   rx   )namerl   digest_sizeencoder]   EVP_get_digestbyname)ri   	algorithmalgevp_mds       rK   _evp_md_from_algorithmzBackend._evp_md_from_algorithm   sv    >>Y&)..I*E--	 5 5 9fWo  ..''0C//4rJ   c                x    | j                  |      }| j                  || j                  j                  k7         |S rW   )r   rt   r[   NULLri   r   r   s      rK   _evp_md_non_null_from_algorithmz'Backend._evp_md_non_null_from_algorithm   s2    ,,Y7Fdiinn45rJ   c                    | j                   rt        || j                        sy| j                  |      }|| j                  j
                  k7  S NF)r`   
isinstance_fips_hashesr   r[   r   r   s      rK   hash_supportedzBackend.hash_supported   s@    jD<M<M&N,,Y7''rJ   c                r    | j                   rt        |t        j                        ry| j	                  |      S r   r`   r   r   SHA1r   ri   r   s     rK   signature_hash_supportedz Backend.signature_hash_supported   s.    
 *Y"D""9--rJ   c                N    | j                   ry| j                  j                  dk(  S NFrU   )r`   r]   Cryptography_HAS_SCRYPTrh   s    rK   scrypt_supportedzBackend.scrypt_supported   s#    994499rJ   c                r    | j                   rt        |t        j                        ry| j	                  |      S )NTr   r   s     rK   hmac_supportedzBackend.hmac_supported   s,    *Y"D""9--rJ   c                    | j                   rt        || j                        sy	 | j                  t	        |      t	        |      f   } || ||      }| j                  j                  |k7  S # t
        $ r Y yw xY wr   )r`   r   _fips_ciphersra   typeKeyErrorr[   r   )ri   ciphermodeadapter
evp_ciphers        rK   cipher_supportedzBackend.cipher_supported   sy     fd&8&89	++DL$t*,DEG T640
yy~~++  		s   #A+ +	A76A7c                |    ||f| j                   v rt        dj                  ||            || j                   ||f<   y )Nz"Duplicate registration for: {} {}.)ra   
ValueErrorrl   )ri   
cipher_clsmode_clsr   s       rK   register_cipher_adapterzBackend.register_cipher_adapter   sL    !T%:%::4;; 
 7>j(23rJ   c           	        t         t        t        fD ]H  }t        t        t
        t        t        t        t        fD ]  }| j                  ||t        d               J t        t        t
        t        t        fD ]"  }| j                  t        |t        d             $ t        t        t        t        fD ]"  }| j                  t        |t        d             $ | j                  t        t
        t        d             | j                  t        t        d       t        d             | j                  t         t         t"               t
        t        t        t        t        fD ]"  }| j                  t$        |t        d             $ | j&                  j(                  s| j*                  j,                  s!t        t        t        t
        fD ]"  }| j                  t.        |t        d             $ t        t        t        t
        fD ]"  }| j                  t0        |t        d             $ t3        j4                  t6        t8        gt        t        t        t
        g      D ]!  \  }}| j                  ||t        d             # | j                  t:        t        d       t        d	             | j                  t<        t        d       t        d
             y y )Nz+{cipher.name}-{cipher.key_size}-{mode.name}zdes-ede3-{mode.name}zdes-ede3chacha20zsm4-{mode.name}zbf-{mode.name}zseed-{mode.name}z{cipher.name}-{mode.name}rc4rc2)r&   r'   r(   r2   r5   r6   r8   r3   r4   r7   r   GetCipherByNamer+   r-   r,   r   r9   _get_xts_cipherr*   rY   rn   r]   #CRYPTOGRAPHY_OPENSSL_300_OR_GREATERr.   r1   	itertoolsproductr/   r0   r)   rE   )ri   r   r   s      rK   rb   z!Backend._register_default_ciphers  sj   / 	J #sCdC@ ,,#E	 c3S1 	H(( MN	 c4- 	H((8_5K%L	 	$$sOJ7	
 	$$d4j/*"=	
 	$$S#?c3S1 	H((X/@A	 MM1199@@ #sC0 ,,%#$45 !#sC0 ,,!#$67 )2(9(9/c3$) $
H ,,#$?@	 ((d4j/%"8 ((d4j/%"87 ArJ   c                :    t        | ||t         j                        S rW   )r
   _ENCRYPTri   r   r   s      rK   create_symmetric_encryption_ctxz'Backend.create_symmetric_encryption_ctxL       dFD.2I2IJJrJ   c                :    t        | ||t         j                        S rW   )r
   _DECRYPTr   s      rK   create_symmetric_decryption_ctxz'Backend.create_symmetric_decryption_ctxQ  r   rJ   c                $    | j                  |      S rW   )r   r   s     rK   pbkdf2_hmac_supportedzBackend.pbkdf2_hmac_supportedV  s    ""9--rJ   c                *    t        j                         S rW   )r^   capture_error_stackrh   s    rK   _consume_errorszBackend._consume_errorsY  s    //11rJ   c                   || j                   j                  k7  sJ | j                  | j                  j	                  |              | j                  j                  |      }| j                   j                  d|      }| j                  j                  ||      }| j                  |dk\         t        j                  | j                   j                  |      d | d      }|S )Nzunsigned char[]r   big)r[   r   rt   r]   BN_is_negativeBN_num_bytesnew	BN_bn2binint
from_bytesbuffer)ri   bnbn_num_bytesbin_ptrbin_lenvals         rK   
_bn_to_intzBackend._bn_to_int\  s    TYY^^###		 8 8 <<=yy--b1))-- 1<@))%%b'2GqL)nnTYY--g6x@%H
rJ   c                (   |j                  t        |j                         dz  dz         d      }| j                  j	                  |t        |      | j                  j                        }| j                  || j                  j                  k7         |S )a
  
        Converts a python integer to a BIGNUM. The returned BIGNUM will not
        be garbage collected (to support adding them to structs that take
        ownership of the object). Be sure to register it for GC if it will
        be discarded after use.
        g       @rU   r   )	to_bytesr   
bit_lengthr]   	BN_bin2bnlenr[   r   rt   )ri   numbinarybn_ptrs       rK   
_int_to_bnzBackend._int_to_bnh  sn     c#.."2S"81"<=uE$$VS[$))..IFdiinn45rJ   c                `   t        j                  ||       | j                  j                         }| j	                  || j
                  j                  k7         | j
                  j                  || j                  j                        }| j                  |      }| j
                  j                  || j                  j                        }| j                  j                  |||| j
                  j                        }| j	                  |dk(         | j                  |      }t        | ||d      S )NrU   Tunsafe_skip_rsa_key_validation)r   _verify_rsa_parametersr]   RSA_newrt   r[   r   gcRSA_freer   BN_freeRSA_generate_key_ex_rsa_cdata_to_evp_pkeyr   )ri   public_exponentkey_size	rsa_cdatar   resevp_pkeys          rK   generate_rsa_private_keyz Backend.generate_rsa_private_keyt  s     	""?H=II%%'	I78IILLDII,>,>?	___-YY\\"dii//0ii++xTYY^^
 	C1H%..y9 )Xd
 	
rJ   c                .    |dk\  xr |dz  dk7  xr |dk\  S )N   rU   r   i   rI   )ri   r   r   s      rK   !generate_rsa_parameters_supportedz)Backend.generate_rsa_parameters_supported  s/     q   !#q( C	
rJ   c           
     (   t        j                  |j                  |j                  |j                  |j
                  |j                  |j                  |j                  j                  |j                  j                         | j                  j                         }| j                  || j                  j                  k7         | j                  j!                  || j                  j"                        }| j%                  |j                        }| j%                  |j                        }| j%                  |j                        }| j%                  |j
                        }| j%                  |j                        }| j%                  |j                        }	| j%                  |j                  j                        }
| j%                  |j                  j                        }| j                  j'                  |||      }| j                  |dk(         | j                  j)                  |||
|      }| j                  |dk(         | j                  j+                  ||||	      }| j                  |dk(         | j-                  |      }t/        | |||      S )NrU   r   )r   _check_private_key_componentspqddmp1dmq1iqmppublic_numbersenr]   r   rt   r[   r   r   r   r   RSA_set0_factorsRSA_set0_keyRSA_set0_crt_paramsr   r   )ri   numbersr   r   r   r   r   r   r   r   r   r   r   r   s                 rK   load_rsa_private_numbersz Backend.load_rsa_private_numbers  s   
 	))IIIIIILLLLLL""$$""$$		
 II%%'	I78IILLDII,>,>?	OOGII&OOGII&OOGII&w||,w||,w||,OOG22445OOG22445ii((Aq9C1H%ii$$Y1a8C1H%ii++ItT4HC1H%..y9+I	
 	
rJ   c                n   t        j                  |j                  |j                         | j                  j                         }| j                  || j                  j                  k7         | j                  j                  || j                  j                        }| j                  |j                        }| j                  |j                        }| j                  j                  |||| j                  j                        }| j                  |dk(         | j                  |      }t        | ||      S NrU   )r   _check_public_key_componentsr   r   r]   r   rt   r[   r   r   r   r   r   r   r   )ri   r   r   r   r   r   r   s          rK   load_rsa_public_numberszBackend.load_rsa_public_numbers  s     	((GII>II%%'	I78IILLDII,>,>?	OOGII&OOGII&ii$$Y1diinnEC1H%..y9T9h77rJ   c                    | j                   j                         }| j                  || j                  j                  k7         | j                  j                  || j                   j                        }|S rW   )r]   EVP_PKEY_newrt   r[   r   r   EVP_PKEY_free)ri   r   s     rK   _create_evp_pkey_gczBackend._create_evp_pkey_gc  sR    99))+H		6799<<$))*A*ABrJ   c                    | j                         }| j                  j                  ||      }| j                  |dk(         |S r   )r  r]   EVP_PKEY_set1_RSArt   )ri   r   r   r   s       rK   r   zBackend._rsa_cdata_to_evp_pkey  s=    ++-ii))(I>C1H%rJ   c                F   | j                   j                  |      }| j                  j                  |t	        |            }| j                  || j                   j                  k7         t        | j                   j                  || j                  j                        |      S )z
        Return a _MemoryBIO namedtuple of (BIO, char*).

        The char* is the storage for the BIO and it must stay alive until the
        BIO is finished with.
        )
r[   from_bufferr]   BIO_new_mem_bufr   rt   r   rA   r   BIO_free)ri   datadata_ptrrB   s       rK   _bytes_to_biozBackend._bytes_to_bio  ss     99((.ii''#d)<C499>>12$)),,sDII,>,>?JJrJ   c                p   | j                   j                         }| j                  || j                  j                  k7         | j                   j                  |      }| j                  || j                  j                  k7         | j                  j                  || j                   j                        }|S )z.
        Creates an empty memory BIO.
        )r]   	BIO_s_memrt   r[   r   BIO_newr   r  )ri   
bio_methodrB   s      rK   _create_mem_bio_gczBackend._create_mem_bio_gc  s     YY((*
J$))..89ii
+C499>>12iill3		 2 23
rJ   c                6   | j                   j                  d      }| j                  j                  ||      }| j	                  |dkD         | j	                  |d   | j                   j
                  k7         | j                   j                  |d   |      dd }|S )zE
        Reads a memory BIO. This only works on memory BIOs.
        zchar **r   N)r[   r   r]   BIO_get_mem_datart   r   r   )ri   rB   bufbuf_lenbio_datas        rK   _read_mem_biozBackend._read_mem_bio  s     iimmI&)),,S#6GaK(CFdiinn4599##CFG4Q7rJ   c                P	   | j                   j                  |      }|| j                   j                  k(  r| j                   j                  |      }| j	                  || j
                  j                  k7         | j
                  j                  || j                   j                        }t        | |||      S || j                   j                  k(  r| j                   j                  s| j                   j                  s| j                   j                  s| j                   j                  |      }| j	                  || j
                  j                  k7         | j
                  j                  || j                   j                        }| j                         }| j                   j                  ||      }| j	                  |dk(         | j!                  | j#                  |      d|      S || j                   j$                  k(  rBt&        j(                  j+                  t-        | j
                  j/                  d|                  S || j                   j0                  k(  r| j                   j3                  |      }| j	                  || j
                  j                  k7         | j
                  j                  || j                   j4                        }t7        | ||      S || j8                  v rBt&        j:                  j+                  t-        | j
                  j/                  d|                  S |t=        | j                   dd      k(  rBt&        j>                  j+                  t-        | j
                  j/                  d|                  S |t=        | j                   dd      k(  rBt&        j@                  j+                  t-        | j
                  j/                  d|                  S || j                   jB                  k(  rBt&        jD                  j+                  t-        | j
                  j/                  d|                  S |t=        | j                   dd      k(  rBt&        jF                  j+                  t-        | j
                  j/                  d|                  S tI        d	      )
zd
        Return the appropriate type of PrivateKey given an evp_pkey cdata
        pointer.
        r   rU   N)passwordr   	uintptr_tEVP_PKEY_ED25519EVP_PKEY_X448EVP_PKEY_ED448Unsupported key type.)%r]   EVP_PKEY_idEVP_PKEY_RSAEVP_PKEY_get1_RSArt   r[   r   r   r   r   EVP_PKEY_RSA_PSSCRYPTOGRAPHY_IS_LIBRESSLCRYPTOGRAPHY_IS_BORINGSSL#CRYPTOGRAPHY_OPENSSL_LESS_THAN_111Er  i2d_RSAPrivateKey_bioload_der_private_keyr  EVP_PKEY_DSAr^   r   private_key_from_ptrr   castEVP_PKEY_ECEVP_PKEY_get1_EC_KEYEC_KEY_freer   rd   r   getattrr   r   EVP_PKEY_X25519r   r   r   )ri   r   r   key_typer   rB   r   ec_cdatas           rK   _evp_pkey_to_private_keyz Backend._evp_pkey_to_private_key  s    99((2tyy---		33H=I	TYY^^ ;<		Y		0B0BCI!/M	  		222II66II77IIAA 		33H=I	TYY^^ ;<		Y		0B0BCI))+C))11#yACq),,""3'/M -  
 ///##88DIINN;9:  ...yy55h?HDIINN :;yy||Hdii.C.CDH+D(HEE'??77DIINN;9:  ,>EE''<<DIINN;9:  OTBB$$99DIINN;9:  222&&;;DIINN;9:  ,<dCC%%::DIINN;9:  ''>??rJ   c                ^	   | j                   j                  |      }|| j                   j                  k(  r| j                   j                  |      }| j	                  || j
                  j                  k7         | j
                  j                  || j                   j                        }t        | ||      S || j                   j                  k(  r| j                   j                  s| j                   j                  s| j                   j                  s| j                   j                  |      }| j	                  || j
                  j                  k7         | j
                  j                  || j                   j                        }| j                         }| j                   j                  ||      }| j	                  |dk(         | j!                  | j#                  |            S || j                   j$                  k(  rBt&        j(                  j+                  t-        | j
                  j/                  d|                  S || j                   j0                  k(  r| j                   j3                  |      }|| j
                  j                  k(  r| j5                         }t7        d|      | j
                  j                  || j                   j8                        }t;        | ||      S || j<                  v rBt&        j>                  j+                  t-        | j
                  j/                  d|                  S |tA        | j                   dd      k(  rBt&        jB                  j+                  t-        | j
                  j/                  d|                  S |tA        | j                   dd      k(  rBt&        jD                  j+                  t-        | j
                  j/                  d|                  S || j                   jF                  k(  rBt&        jH                  j+                  t-        | j
                  j/                  d|                  S |tA        | j                   dd      k(  rBt&        jJ                  j+                  t-        | j
                  j/                  d|                  S tM        d      )	zc
        Return the appropriate type of PublicKey given an evp_pkey cdata
        pointer.
        rU   r  zUnable to load EC keyr  Nr  r   r!  )'r]   r"  r#  r$  rt   r[   r   r   r   r   r%  r&  r'  r(  r  i2d_RSAPublicKey_bioload_der_public_keyr  r+  r^   r   public_key_from_ptrr   r-  r.  r/  r   r   r0  r   rd   r   r1  r   r   r2  r   r   r   )ri   r   r3  r   rB   r   r4  rq   s           rK   _evp_pkey_to_public_keyzBackend._evp_pkey_to_public_keyG  s    99((2tyy---		33H=I	TYY^^ ;<		Y		0B0BCI y(;;		222II66II77IIAA		33H=I	TYY^^ ;<		Y		0B0BCI))+C))00i@Cq)++D,>,>s,CDD///##77DIINN;9:  ...yy55h?H499>>)--/ !8&AAyy||Hdii.C.CDH*48DD'??66DIINN;9:  ,>EE'';;DIINN;9:  OTBB$$88DIINN;9:  222&&::DIINN;9:  ,<dCC%%99DIINN;9:  ''>??rJ   c                    | j                   rt        |t        j                        ryt        |t        j                  t        j                  t        j
                  t        j                  t        j                  f      S r   )r`   r   r   r   SHA224SHA256SHA384SHA512r   s     rK   _oaep_hash_supportedzBackend._oaep_hash_supported  sS    *Y"D	
 		
rJ   c                   t        |t              ryt        |t              rzt        |j                  t              r`| j
                  r/t        |j                  j                  t        j                        ry| j                  |j                  j                        S t        |t              r\t        |j                  t              rB| j                  |j                  j                        xr | j                  |j                        S y)NTF)r   r!   r    _mgfr   r`   
_algorithmr   r   r   r   r@  ri   paddings     rK   rsa_padding_supportedzBackend.rsa_padding_supported  s    gx(%*W\\4*H !!j''' **7<<+B+BCC&:gllD+I,,'' @++G,>,>?@ rJ   c                ^    | j                   rt        |t              ry| j                  |      S r   )r`   r   r!   rF  rD  s     rK   rsa_encryption_supportedz Backend.rsa_encryption_supported  s(    *Wh"?--g66rJ   c                ^    |dvrt        d      t        j                  j                  |      S )N)i   rT   i   i   z0Key size must be 1024, 2048, 3072, or 4096 bits.)r   r^   r   generate_parameters)ri   r   s     rK   generate_dsa_parameterszBackend.generate_dsa_parameters  s4    33B  33H==rJ   c                "    |j                         S rW   generate_private_keyri   
parameterss     rK   generate_dsa_private_keyz Backend.generate_dsa_private_key       ..00rJ   c                F    | j                  |      }| j                  |      S rW   )rK  rQ  )ri   r   rP  s      rK   'generate_dsa_private_key_and_parametersz/Backend.generate_dsa_private_key_and_parameters  s%     11(;
,,Z88rJ   c                j    t        j                  |       t        j                   j                  |      S rW   )r   _check_dsa_private_numbersr^   from_private_numbersri   r   s     rK   load_dsa_private_numbersz Backend.load_dsa_private_numbers  s)     	&&w/44W==rJ   c                ~    t        j                  |j                         t        j                   j	                  |      S rW   )r   _check_dsa_parametersparameter_numbersr^   from_public_numbersrX  s     rK   load_dsa_public_numberszBackend.load_dsa_public_numbers  s/     	!!'";";<33G<<rJ   c                j    t        j                  |       t        j                   j                  |      S rW   )r   r[  r^   from_parameter_numbersrX  s     rK   load_dsa_parameter_numbersz"Backend.load_dsa_parameter_numbers  s)     	!!'*66w??rJ   c                N    | j                   j                   xr | j                   S rW   )r]   r'  r`   rh   s    rK   dsa_supportedzBackend.dsa_supported  s%    		333ND<N<N8N	
rJ   c                F    | j                         sy| j                  |      S r   )rc  r   r   s     rK   dsa_hash_supportedzBackend.dsa_hash_supported  s"    !!#,,Y77rJ   c                R    | j                  |t        d|j                  z              S )N    )r   r2   
block_sizer   s     rK   cmac_algorithm_supportedz Backend.cmac_algorithm_supported  s*    $$s7Y%9%99:
 	
rJ   c                    t        | |      S rW   r   r   s     rK   create_cmac_ctxzBackend.create_cmac_ctx  s    D),,rJ   c                R    | j                  | j                  j                  |||      S rW   )	_load_keyr]   PEM_read_bio_PrivateKey)ri   r  r  r   s       rK   load_pem_private_keyzBackend.load_pem_private_key  s+     ~~II--*	
 	
rJ   c                8   | j                  |      }| j                  j                  d      }| j                  j	                  |j
                  | j                  j                  | j                  j                  | j                  j                  d      |      }|| j                  j                  k7  rA| j                  j                  || j                  j                        }| j                  |      S | j                          | j                  j                  |j
                        }| j                  |dk(         | j                  j                  |j
                  | j                  j                  | j                  j                  | j                  j                  d      |      }|| j                  j                  k7  rN| j                  j                  || j                  j                         }| j#                  |      }t%        | ||      S | j'                          y )NCRYPTOGRAPHY_PASSWORD_DATA *Cryptography_pem_password_cbrU   )r  r[   r   r]   PEM_read_bio_PUBKEYrB   r   	addressof_original_libr   r  r:  r   	BIO_resetrt   PEM_read_bio_RSAPublicKeyr   r   r   _handle_key_loading_error)ri   r  mem_biouserdatar   r   r   s          rK   load_pem_public_keyzBackend.load_pem_public_key  s   $$T* 99==!?@9900KKIINNII		'')G 
 tyy~~%yy||Hdii.E.EFH//99
   "))%%gkk2Cq)		;;				##II++-K I DIINN* IILLDII4F4FG	66yA$T9h??..0rJ   c                @    t         j                  j                  |      S rW   )r^   r   from_pem_parametersri   r  s     rK   load_pem_parameterszBackend.load_pem_parameters      22488rJ   c                    | j                  |      }| j                  ||      }|r| j                  ||      S | j                  | j                  j
                  |||      S rW   )r  "_evp_pkey_from_der_traditional_keyr5  rm  r]   d2i_PKCS8PrivateKey_bio)ri   r  r  r   r  keys         rK   r*  zBackend.load_der_private_key  sk     %%d+55hI003  >>		11.	 rJ   c                H   | j                   j                  |j                  | j                  j                        }|| j                  j                  k7  r?| j                  j                  || j                   j                        }|t        d      |S | j                          y )N4Password was given but private key is not encrypted.)	r]   d2i_PrivateKey_biorB   r[   r   r   r  	TypeErrorr   )ri   r  r  r  s       rK   r  z*Backend._evp_pkey_from_der_traditional_key9  s~    ii**8<<H$)).. )),,sDII$;$;<C#J  J  "rJ   c                B   | j                  |      }| j                  j                  |j                  | j                  j
                        }|| j                  j
                  k7  rA| j                  j                  || j                  j                        }| j                  |      S | j                          | j                  j                  |j                        }| j                  |dk(         | j                  j                  |j                  | j                  j
                        }|| j                  j
                  k7  rN| j                  j                  || j                  j                        }| j                  |      }t        | ||      S | j!                          y r   )r  r]   d2i_PUBKEY_biorB   r[   r   r   r  r:  r   rv  rt   d2i_RSAPublicKey_bior   r   r   rx  )ri   r  ry  r   r   r   s         rK   r8  zBackend.load_der_public_keyG  s+   $$T*99++GKKHtyy~~%yy||Hdii.E.EFH//99
   "))%%gkk2Cq)		66TYY^^I DIINN* IILLDII4F4FG	66yA$T9h??..0rJ   c                @    t         j                  j                  |      S rW   )r^   r   from_der_parametersr~  s     rK   load_der_parameterszBackend.load_der_parameters^  r  rJ   c                   |j                  t        j                  j                        }| j	                  |      }| j
                  j                  |j                  | j                  j                        }| j                  || j                  j                  k7         | j                  j                  || j
                  j                        }|S rW   )public_bytesr   EncodingDERr  r]   d2i_X509_biorB   r[   r   rt   r   	X509_free)ri   certr  ry  r   s        rK   
_cert2osslzBackend._cert2ossla  s      !7!7!;!;<$$T*yy%%gkk499>>BDDIINN23yy||D$))"5"56rJ   c                    | j                         }| j                  j                  ||      }| j                  |dk(         t	        j
                  | j                  |            S r   )r  r]   i2d_X509_biort   r   load_der_x509_certificater  )ri   x509_ptrrB   r   s       rK   
_ossl2certzBackend._ossl2certi  sT    %%'ii$$S(3C1H%--d.@.@.EFFrJ   c                   |j                  t        j                  j                  t        j                  j
                  t        j                               }| j                  |      }| j                  j                  |j                  | j                  j                        }| j                  || j                  j                  k7         | j                  j                  || j                  j                        S rW   )private_bytesr   r  r  PrivateFormatPKCS8NoEncryptionr  r]   r  rB   r[   r   rt   r   r  )ri   r  r  ry  r   s        rK   	_key2osslzBackend._key2osslo  s      ""&&''--&&(

 $$T*99//KKIINN
 	H		67yy||Hdii&=&=>>rJ   c                   | j                  |      }| j                  j                  d      }|Ht        j                  d|       | j                  j                  |      }||_        t        |      |_         ||j                  | j                  j                  | j                  j                  | j                  j                  d      |      }|| j                  j                  k(  r|j                  dk7  rb| j                          |j                  dk(  rt!        d      |j                  dk(  sJ t#        dj%                  |j&                  d	z
              | j)                          | j                  j+                  || j                  j,                        }||j.                  dk(  rt!        d
      ||j.                  d	k(  s|J | j1                  ||      S )Nrq  r  rr  r   z3Password was not given but private key is encryptedzAPasswords longer than {} bytes are not supported by this backend.rU   r  )r  r[   r   r   _check_bytesliker
  r  r   lengthrB   r   rt  r]   ru  errorr   r  r   rl   maxsizerx  r   r  calledr5  )	ri   openssl_read_funcr  r  r   ry  rz  password_ptrr   s	            rK   rm  zBackend._load_key~  s    $$T*99==!?@"":x89900:L ,H!(mHO$KKIINNII		'')G 
 tyy~~%~~"$$&>>R'#M  $>>R///$++16(2B2BQ2F+G 
 ..099<<$))*A*ABHOOq$8F 
  X__%9	  ,,4
 	
rJ   c                D     j                         }|st        d      |d   j                   j                  j                   j                  j
                        s|d   j                   j                  j                   j                  j                        sS j                  j                  rH|d   j                   j                  j                   j                  j                        rt        d      t         fd|D              rt        d      t        d|      )Nz|Could not deserialize key data. The data may be in an incorrect format or it may be encrypted with an unsupported algorithm.r   z Bad decrypt. Incorrect password?c              3     K   | ]>  }|j                  j                  j                  j                  j                         @ y wrW   )_lib_reason_matchr]   ERR_LIB_EVP'EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM).0r  ri   s     rK   	<genexpr>z4Backend._handle_key_loading_error.<locals>.<genexpr>  s@      

 	 ##		%%		AA
s   AAz!Unsupported public key algorithm.zCould not deserialize key data. The data may be in an incorrect format, it may be encrypted with an unsupported algorithm, or it may be an unsupported key type (e.g. EC curves with explicit parameters).)r   r   r  r]   r  EVP_R_BAD_DECRYPTERR_LIB_PKCS12!PKCS12_R_PKCS12_CIPHERFINAL_ERRORCryptography_HAS_PROVIDERSERR_LIB_PROVPROV_R_BAD_DECRYPTany)ri   rq   s   ` rK   rx  z!Backend._handle_key_loading_error  s   %%'  1I''		%%tyy'B'B ay**		((		;;
 		441I//II**II00 ?@@ 

  
 
 @AA 4  rJ   c                   	 | j                  |      }| j                  j	                  |      }|| j
                  j                  k(  r| j                          y| j                  || j                  j                  k7         | j                  j                  |       y# t        $ r | j                  j                  }Y w xY w)NFT)
_elliptic_curve_to_nidr   r]   	NID_undefEC_GROUP_new_by_curve_namer[   r   r   rt   EC_GROUP_free)ri   curve	curve_nidgroups       rK   elliptic_curve_supportedz Backend.elliptic_curve_supported  s    	,33E:I 		44Y?DIINN"  "	TYY-@-@ @AII##E* $ 	,		++I	,s   B B>=B>c                Z    t        |t        j                        sy| j                  |      S r   )r   r   ECDSAr  )ri   signature_algorithmr  s      rK   ,elliptic_curve_signature_algorithm_supportedz4Backend.elliptic_curve_signature_algorithm_supported  s'     -rxx8,,U33rJ   c                0   | j                  |      r^| j                  |      }| j                  j                  |      }| j	                  |dk(         | j                  |      }t        | ||      S t        d|j                   dt        j                        )z@
        Generate a new private key on the named curve.
        rU   z Backend object does not support .)r  _ec_key_new_by_curver]   EC_KEY_generate_keyrt   _ec_cdata_to_evp_pkeyr   r   r   r   UNSUPPORTED_ELLIPTIC_CURVE)ri   r  r4  r   r   s        rK   #generate_elliptic_curve_private_keyz+Backend.generate_elliptic_curve_private_key  s     ((/007H))//9Cq)11(;H+D(HEE&25::,a@33 rJ   c           	     <   |j                   }| j                  |j                        }| j                  j	                  | j                  |j                        | j                  j                        }| j                  j                  ||      }|dk7  r| j                          t        d      | j                         5 }| j                  ||j                  |j                  |       | j                  j!                  |      }| j#                  || j                  j$                  k7         t&        j                  j)                  |      }| j#                  || j                  j$                  k7         | j                  j+                  |      }	| j#                  |	| j                  j$                  k7         | j                  j	                  |	| j                  j,                        }	| j                  j/                  ||	|| j                  j$                  | j                  j$                  |      }| j#                  |dk(         | j                  j1                  |||	|      dk7  rt        d      	 d d d        | j3                  |      }
t5        | ||
      S # 1 sw Y   'xY w)NrU   Invalid EC key.r   )r   r  r  r[   r   r   private_valuer]   BN_clear_freeEC_KEY_set_private_keyr   r   _tmp_bn_ctx)_ec_key_set_public_key_affine_coordinatesxyEC_KEY_get0_grouprt   r   backendEC_KEY_get0_public_keyEC_POINT_newEC_POINT_freeEC_POINT_mulEC_POINT_cmpr  r   )ri   r   publicr4  r  r   bn_ctxr  	set_pointcomputed_pointr   s              rK   #load_elliptic_curve_private_numbersz+Backend.load_elliptic_curve_private_numbers  s#    '',,V\\:		OOG112DII4K4K
 ii..xG!8  ".// 	46::&((FHHf II//9E 78;;HEI	TYY^^ ;<!YY33E:N$)).. @A!YY\\		 7 7N ))((				C q)		&&9nf 
 !!2335	4B --h7'hAAG	4 	4s   =F.JJc                   | j                  |j                        }| j                         5 }| j                  ||j                  |j
                  |       d d d        | j                  |      }t        | ||      S # 1 sw Y   'xY wrW   )r  r  r  r  r  r  r  r   )ri   r   r4  r  r   s        rK   "load_elliptic_curve_public_numbersz*Backend.load_elliptic_curve_public_numbersE  s{     ,,W]]; 	6::'))WYY	 --h7&tXx@@	 	s   )A;;Bc           	        | j                  |      }| j                  j                  |      }| j                  || j                  j
                  k7         | j                  j                  |      }| j                  || j                  j
                  k7         | j                  j                  || j                  j                        }| j                         5 }| j                  j                  |||t        |      |      }|dk7  r| j                          t        d      	 d d d        | j                  j                  ||      }| j                  |dk(         | j                  |      }t!        | ||      S # 1 sw Y   WxY w)NrU   z(Invalid public bytes for the given curve)r  r]   r  rt   r[   r   r  r   r  r  EC_POINT_oct2pointr   r   r   EC_KEY_set_public_keyr  r   )	ri   r  point_bytesr4  r  pointr  r   r   s	            rK    load_elliptic_curve_public_bytesz(Backend.load_elliptic_curve_public_bytesQ  sJ    ,,U3		++H5ETYY^^34		&&u-ETYY^^34		UDII$;$;< 	M6))..uk3{+;VC ax$$& !KLL 		M ii--h>C1H%--h7&tXx@@	M 	Ms   A	E88Fc           	     ~   | j                  |      }| j                  j                  |      }| j                  || j                  j
                  k7         | j                  j                  |      }| j                  || j                  j
                  k7         | j                  j                  || j                  j                        }| j                  |      }| j                  j                  || j                  j                        }| j                         5 }| j                  j                  |||| j                  j
                  | j                  j
                  |      }| j                  |dk(         | j                  j                  |      }	| j                  j                  |      }
| j                  j                  |||	|
|      }|dk7  r| j                          t!        d      	 d d d        | j                  j#                  ||      }| j                  |dk(         | j                  |      }| j                  j                  || j                  j                        }| j                  j%                  ||      }| j                  |dk(         | j'                  |      }t)        | ||      S # 1 sw Y   xY w)NrU   z'Unable to derive key from private_value)r  r]   r  rt   r[   r   r  r   r  r   r  r  r  
BN_CTX_getEC_POINT_get_affine_coordinatesr   r   r  r  r  r   )ri   r  r  r4  r  r  valuer  r   bn_xbn_yprivater   s                rK   !derive_elliptic_curve_private_keyz)Backend.derive_elliptic_curve_private_keyg  s2    ,,U3		++H5ETYY^^34		&&u-ETYY^^34		UDII$;$;<.		UDII$;$;< 	L6))((ueTYY^^TYY^^VC q)99''/D99''/D));;udD&C ax$$& !JKK 	L  ii--h>C1H%//-0)),,w		(?(?@ii..xAC1H%--h7'hAA3	L 	Ls   CJ33J<c                F    | j                  |      }| j                  |      S rW   )r  _ec_key_new_by_curve_nid)ri   r  r  s      rK   r  zBackend._ec_key_new_by_curve  s#    //6	,,Y77rJ   c                    | j                   j                  |      }| j                  || j                  j                  k7         | j                  j                  || j                   j                        S rW   )r]   EC_KEY_new_by_curve_namert   r[   r   r   r0  )ri   r  r4  s      rK   r  z Backend._ec_key_new_by_curve_nid  sP    9955i@H		67yy||Hdii&;&;<<rJ   c                    | j                   rt        || j                        sy| j                  |      xr t        |t        j
                        S r   )r`   r   _fips_ecdh_curvesr  r   ECDH)ri   r   r  s      rK   +elliptic_curve_exchange_algorithm_supportedz3Backend.elliptic_curve_exchange_algorithm_supported  sL     j4))'
 ,,U3 

rww9
 	
rJ   c                    | j                         }| j                  j                  ||      }| j                  |dk(         |S r   )r  r]   EVP_PKEY_set1_EC_KEYrt   )ri   r4  r   r   s       rK   r  zBackend._ec_cdata_to_evp_pkey  s=    ++-ii,,Xx@C1H%rJ   c                .   ddd}|j                  |j                  |j                        }| j                  j                  |j	                               }|| j                  j
                  k(  r't        |j                   dt        j                        |S )z/
        Get the NID for a curve name.
        
prime192v1
prime256v1)	secp192r1	secp256r1z" is not a supported elliptic curve)	getr   r]   
OBJ_sn2nidr   r  r   r   r  )ri   r  curve_aliases
curve_namer  s        rK   r  zBackend._elliptic_curve_to_nid  s    
 '3N"&&uzz5::>
II(():):)<=			+++&::,@A33  rJ   c              #    K   | j                   j                         }| j                  || j                  j                  k7         | j                  j                  || j                   j                        }| j                   j                  |       	 | | j                   j                  |       y # | j                   j                  |       w xY wwrW   )	r]   
BN_CTX_newrt   r[   r   r   BN_CTX_freeBN_CTX_start
BN_CTX_end)ri   r  s     rK   r  zBackend._tmp_bn_ctx  s     %%'Fdiinn45fdii&;&;<		v&	)LII  (DII  (s   BCB1 C1CCc                t   |dk  s|dk  rt        d      | j                  j                  | j                  |      | j                  j
                        }| j                  j                  | j                  |      | j                  j
                        }| j                  j                  |      }| j                  || j                  j                  k7         | j                  j                  |      }| j                  || j                  j                  k7         | j                  j                  || j                  j                        }| j                  j                  |||||      }|dk7  r| j                          t        d      | j                  j                  ||      }| j                  |dk(         y)zg
        Sets the public key point in the EC_KEY context to the affine x and y
        values.
        r   z2Invalid EC key. Both x and y must be non-negative.rU   r  N)r   r[   r   r   r]   r   r  rt   r   r  r  EC_POINT_set_affine_coordinatesr   r  )ri   r4  r  r  r  r  r  r   s           rK   r  z1Backend._ec_key_set_public_key_affine_coordinates  sU    q5AED  IILL+TYY->->?IILL+TYY->->?		++H5ETYY^^34		&&u-ETYY^^34		UDII$;$;<ii775!Q
 !8  ".//ii--h>C1H%rJ   c                   t        |t        j                        st        d      t        |t        j                        st        d      t        |t        j
                        st        d      t        |t        j                        rd}nt        |t        j                        r%|j                  }t        |      dkD  rut        d      t        |t        j                        rE|j                  |cxu rt        j                  j                  u rn t        d      |j                  }nt        d      |t        j                  j                  u r|t        j                  j                  u r| j                   j"                  }n>|t        j                  j$                  u r| j                   j&                  }nt        d      | j)                  |||      S |t        j                  j*                  u r| j,                  r%t        |t        j                        st        d	      | j                   j/                  |      }	|t        j                  j                  u rt|	| j                   j0                  k(  r| j                   j2                  }n1|	| j                   j4                  k(  sJ | j                   j6                  }| j)                  |||      S |t        j                  j$                  u r|rt        d
      |	| j                   j0                  k(  r| j                   j8                  }n1|	| j                   j4                  k(  sJ | j                   j:                  }| j=                  ||      S t        d      |t        j                  j                  u r>|t        j                  j                  u rt?        j@                  |||      S t        d      t        d      )N/encoding must be an item from the Encoding enumz2format must be an item from the PrivateFormat enumzBEncryption algorithm must be a KeySerializationEncryption instancerJ   i  zBPasswords longer than 1023 bytes are not supported by this backendzUnsupported encryption typezUnsupported encoding for PKCS8zCEncrypted traditional OpenSSL format is not supported in FIPS mode.zDEncryption is not supported for DER encoded traditional OpenSSL keysz+Unsupported encoding for TraditionalOpenSSLz=OpenSSH private key format can only be used with PEM encodingformat is invalid with this key)!r   r   r  r  r  KeySerializationEncryptionr  BestAvailableEncryptionr  r   r   _KeySerializationEncryption_formatOpenSSHr  PEMr]   PEM_write_bio_PKCS8PrivateKeyr  i2d_PKCS8PrivateKey_bio_private_key_bytes_via_bioTraditionalOpenSSLr`   r"  r#  PEM_write_bio_RSAPrivateKeyr.  PEM_write_bio_ECPrivateKeyr)  i2d_ECPrivateKey_bio_bio_func_outputr;   _serialize_ssh_private_key)
ri   encodingrl   encryption_algorithmr  r   cdatar  	write_bior3  s
             rK   _private_key_byteszBackend._private_key_bytes  sp    (M$:$:;MNN&-"="=>D   -"J"J
   *M,F,FGH -"G"G
 ,44H8}t# # 
 $m&O&O %,,3**223 :;; ,44H:;; ]00666=11555 IICC	]33777 II==	 !ABB228X 
 ]00CCC!!*$m&@&@+ !.  yy,,X6H=11555tyy555 $		 E EI#tyy'<'<<<< $		 D DI66uh  =11555$3  tyy555 $		 ? ?I#tyy'<'<<<< $		 > >I,,Y>>JKK ]00888=1155555#7  %  :;;rJ   c           	         |s| j                   j                  }n| j                  j                  d      }| j	                  ||||t        |      | j                   j                  | j                   j                        S )Ns   aes-256-cbc)r[   r   r]   EVP_get_cipherbynamer  r   )ri   r"  r   r  r   s        rK   r  z"Backend._private_key_bytes_via_bioY  sf     J 77GJ$$MIINNIINN
 	
rJ   c                ~    | j                         } ||g| }| j                  |dk(         | j                  |      S r   )r  rt   r  )ri   r"  argsrB   r   s        rK   r  zBackend._bio_func_outputl  sB    %%'#d#C1H%!!#&&rJ   c                V   t        |t        j                        st        d      t        |t        j                        st        d      |t        j                  j
                  u r|t        j                  j                  u r| j                  j                  }n>|t        j                  j                  u r| j                  j                  }nt        d      | j                  ||      S |t        j                  j                  u r| j                  j                  |      }|| j                  j                  k7  rt        d      |t        j                  j                  u r| j                  j                   }n>|t        j                  j                  u r| j                  j"                  }nt        d      | j                  ||      S |t        j                  j$                  u r<|t        j                  j$                  u rt'        j(                  |      S t        d      t        d      )Nr  z1format must be an item from the PublicFormat enumz8SubjectPublicKeyInfo works only with PEM or DER encodingz+PKCS1 format is supported only for RSA keysz)PKCS1 works only with PEM or DER encodingz1OpenSSH format must be used with OpenSSH encodingr  )r   r   r  r  PublicFormatSubjectPublicKeyInfor  r]   PEM_write_bio_PUBKEYr  i2d_PUBKEY_bior   r  PKCS1r"  r#  PEM_write_bio_RSAPublicKeyr7  r  r;   serialize_ssh_public_key)ri   r  rl   r  r   r!  r"  r3  s           rK   _public_key_byteszBackend._public_key_bytesr  s    (M$:$:;MNN&-"<"<=C 
 ]//DDD=11555 II::	]33777 II44	 N  ((H== ]//555yy,,X6H499111 !NOO=11555 II@@	]33777 II::	 !LMM((E:: ]//777=1199933C88C  :;;rJ   c                0    | j                   j                   S rW   r]   r'  rh   s    rK   dh_supportedzBackend.dh_supported      996666rJ   c                B    t         j                  j                  ||      S rW   )r^   r   rJ  ri   	generatorr   s      rK   generate_dh_parameterszBackend.generate_dh_parameters  s     229hGGrJ   c                "    |j                         S rW   rM  rO  s     rK   generate_dh_private_keyzBackend.generate_dh_private_key  rR  rJ   c                D    | j                  | j                  ||            S rW   )r:  r8  r6  s      rK   &generate_dh_private_key_and_parametersz.Backend.generate_dh_private_key_and_parameters  s'     ++''	8<
 	
rJ   c                @    t         j                  j                  |      S rW   )r^   r   rW  rX  s     rK   load_dh_private_numberszBackend.load_dh_private_numbers  s     33G<<rJ   c                @    t         j                  j                  |      S rW   )r^   r   r]  rX  s     rK   load_dh_public_numberszBackend.load_dh_public_numbers  s     227;;rJ   c                @    t         j                  j                  |      S rW   )r^   r   r`  rX  s     rK   load_dh_parameter_numbersz!Backend.load_dh_parameter_numbers  s     55g>>rJ   c                    	 t         j                  j                  t        j                  |||             y# t        $ r Y yw xY w)N)r   gr   TF)r^   r   r`  DHParameterNumbersr   )ri   r   rD  r   s       rK   dh_parameters_supportedzBackend.dh_parameters_supported  sD    	OO22%%Q!4   		s   58 	AAc                4    | j                   j                  dk(  S r   )r]   re   rh   s    rK   dh_x942_serialization_supportedz'Backend.dh_x942_serialization_supported  s    yy66!;;rJ   c                @    t         j                  j                  |      S rW   )r^   r   from_public_bytesr~  s     rK   x25519_load_public_bytesz Backend.x25519_load_public_bytes  s    ""44T::rJ   c                @    t         j                  j                  |      S rW   )r^   r   from_private_bytesr~  s     rK   x25519_load_private_bytesz!Backend.x25519_load_private_bytes  s     ""55d;;rJ   c                >    t         j                  j                         S rW   )r^   r   generate_keyrh   s    rK   x25519_generate_keyzBackend.x25519_generate_key  s    ""//11rJ   c                J    | j                   ry| j                  j                   S r   )r`   r]   #CRYPTOGRAPHY_LIBRESSL_LESS_THAN_370rh   s    rK   x25519_supportedzBackend.x25519_supported  s!    99@@@@rJ   c                @    t         j                  j                  |      S rW   )r^   r   rJ  r~  s     rK   x448_load_public_byteszBackend.x448_load_public_bytes  s      22488rJ   c                @    t         j                  j                  |      S rW   )r^   r   rM  r~  s     rK   x448_load_private_byteszBackend.x448_load_private_bytes  s      33D99rJ   c                >    t         j                  j                         S rW   )r^   r   rP  rh   s    rK   x448_generate_keyzBackend.x448_generate_key  s      --//rJ   c                |    | j                   ry| j                  j                   xr | j                  j                   S r   r`   r]   r&  r'  rh   s    rK   x448_supportedzBackend.x448_supported  8    		222 8II777	
rJ   c                H    | j                   ry| j                  j                  S r   )r`   r]    CRYPTOGRAPHY_HAS_WORKING_ED25519rh   s    rK   ed25519_supportedzBackend.ed25519_supported  s    yy999rJ   c                @    t         j                  j                  |      S rW   )r^   r   rJ  r~  s     rK   ed25519_load_public_bytesz!Backend.ed25519_load_public_bytes  s     ##55d;;rJ   c                @    t         j                  j                  |      S rW   )r^   r   rM  r~  s     rK   ed25519_load_private_bytesz"Backend.ed25519_load_private_bytes  s     ##66t<<rJ   c                >    t         j                  j                         S rW   )r^   r   rP  rh   s    rK   ed25519_generate_keyzBackend.ed25519_generate_key  s    ##0022rJ   c                |    | j                   ry| j                  j                   xr | j                  j                   S r   r\  rh   s    rK   ed448_supportedzBackend.ed448_supported  r^  rJ   c                @    t         j                  j                  |      S rW   )r^   r   rJ  r~  s     rK   ed448_load_public_byteszBackend.ed448_load_public_bytes  s    !!33D99rJ   c                @    t         j                  j                  |      S rW   )r^   r   rM  r~  s     rK   ed448_load_private_bytesz Backend.ed448_load_private_bytes  s    !!44T::rJ   c                >    t         j                  j                         S rW   )r^   r   rP  rh   s    rK   ed448_generate_keyzBackend.ed448_generate_key  s    !!..00rJ   c                .    t        j                  | |      S rW   )r	   _aead_cipher_supported)ri   r   s     rK   aead_cipher_supportedzBackend.aead_cipher_supported  s    **488rJ   c                .    t        |      D ]  }d||<   	 y )Nr   )range)ri   r  r  is       rK   
_zero_datazBackend._zero_data"  s      v 	ADG	rJ   c              #    K   || j                   j                   yt        |      }| j                   j                  d|dz         }| j                   j	                  |||       	 | | j                  | j                   j                  d|      |       y# | j                  | j                   j                  d|      |       w xY ww)a  
        This method takes bytes, which can be a bytestring or a mutable
        buffer like a bytearray, and yields a null-terminated version of that
        data. This is required because PKCS12_parse doesn't take a length with
        its password char * and ffi.from_buffer doesn't provide null
        termination. So, to support zeroing the data via bytearray we
        need to build this ridiculous construct that copies the memory, but
        zeroes it after use.
        Nzchar[]rU   z	uint8_t *)r[   r   r   r   memmoverv  r-  )ri   r  data_lenr  s       rK   _zeroed_null_terminated_bufz#Backend._zeroed_null_terminated_buf)  s      <)).. 4yH))--(Q,7CIIc42L	 		{C @(K		{C @(Ks   A#C&B *-C.CCc                    | j                  ||      }|j                  |j                  r|j                  j                  nd |j                  D cg c]  }|j                   c}fS c c}w rW   )load_pkcs12r  r  certificateadditional_certs)ri   r  r  pkcs12r  s        rK   %load_key_and_certificates_from_pkcs12z-Backend.load_key_and_certificates_from_pkcs12@  s\     !!$1JJ'-{{FKK##*0*A*AB$TB
 	
 Cs   A&c                	   |t        j                  d|       | j                  |      }| j                  j	                  |j
                  | j                  j                        }|| j                  j                  k(  r| j                          t        d      | j                  j                  || j                  j                        }| j                  j                  d      }| j                  j                  d      }| j                  j                  d      }| j                  |      5 }| j                  j                  |||||      }	d d d        	dk(  r| j                          t        d      d }
d }g }|d   | j                  j                  k7  rF| j                  j                  |d   | j                  j                        }| j!                  |d	      }|d   | j                  j                  k7  r| j                  j                  |d   | j                  j"                        }| j%                  |      }d }| j                  j'                  || j                  j                        }|| j                  j                  k7  r| j                  j)                  |      }t+        ||      }
|d   | j                  j                  k7  r| j                  j                  |d   | j                  j,                        }| j                  j/                  |d         }| j                  j0                  s| j                  j2                  rt5        |      }nt7        t5        |            }|D ]	  }| j                  j9                  ||      }| j;                  || j                  j                  k7         | j                  j                  || j                  j"                        }| j%                  |      }d }| j                  j'                  || j                  j                        }|| j                  j                  k7  r| j                  j)                  |      }|j=                  t+        ||              t?        ||
|      S # 1 sw Y   :xY w)
Nr  z!Could not deserialize PKCS12 datazEVP_PKEY **zX509 **zCryptography_STACK_OF_X509 **r   zInvalid password or PKCS12 dataFr   ) r   r  r  r]   d2i_PKCS12_biorB   r[   r   r   r   r   PKCS12_freer   rz  PKCS12_parser  r5  r  r  X509_alias_get0ry   r=   sk_X509_freesk_X509_numr   r'  rt  reversedsk_X509_valuert   rf   r>   )ri   r  r  rB   p12evp_pkey_ptrr  sk_x509_ptrpassword_bufr   r  r  additional_certificatesr   r   cert_objr   
maybe_namesk_x509r   indicesru  	addl_cert	addl_names                           rK   r|  zBackend.load_pkcs12N  s    "":x8  &ii&&sww		?$))..   "@AAiill3		 5 56yy}}]399==+iimm$CD--h7 	<))((\<;C	 !8  ">??"$?diinn,yy||LOTYY5L5LMH // 0 C A;$))..(99<<TYY-@-@ADt,HD224HJTYY^^+yy''
3$Xt4Dq>TYY^^+iill;q>4993I3IJG))''A7C 		==9966*"5:. yy..w:##DDIINN$:;yy||D$))*=*=> OOD1	 	!YY66tTYY^^L
/ $		 0 0 <I'..%i; (T3JKKs	 	s   * RRc                   d }|t        j                  d|       t        |t        j                        r d}d}d}	d}
| j
                  j                  }nat        |t        j                        r| j                  j                  r-| j                  j                  }| j                  j                  }n,| j                  j                  }| j                  j                  }d}	d}
| j
                  j                  }|j                  }nt        |t        j                        r|j                  t        j                  j                   u rcd}d}d}	d}
|j                  }|j"                  }|t$        j&                  u r-| j                  j                  }| j                  j                  }nd|t$        j(                  u rN| j                  j                  st+        d      | j                  j                  }| j                  j                  }n|J |j,                  e| j                  j.                  st+        d      | j1                  |j,                        }| j3                  || j
                  j                  k7         n| j
                  j                  }|j4                  |j4                  }	nt7        d      |t9        |      dk(  r| j
                  j                  }nP| j                  j;                         }| j
                  j=                  || j                  j>                        }g }|D ]  }t        |t@              r|jB                  }| jE                  |jF                        }|2| j                  jI                  || j
                  j                  d      }n&| j                  jI                  ||t9        |            }| j3                  |dk(         n| jE                  |      }|jK                  |       | j                  jM                  ||      }tN        j3                  |dk\          | jQ                  |      5 }| jQ                  |      5 }|r| jE                  |      n| j
                  j                  }|| jS                  |      n| j
                  j                  }| j                  jU                  ||||||||	|
d
      }d d d        | j                  j.                  rN|| j
                  j                  k7  r5| j                  jW                  |d| j
                  j                  d|
|       d d d        | j3                  | j
                  j                  k7         | j
                  j=                  || j                  jX                        }| j[                         }| j                  j]                  ||      }| j3                  |dkD         | j_                  |      S # 1 sw Y   xY w# 1 sw Y   xY w)	Nr   r  r   i N  rU   z2PBESv2 is not supported by this version of OpenSSLzBSetting MAC algorithm is not supported by this version of OpenSSL.zUnsupported key encryption type)0r   _check_bytesr   r   r  r[   r   r  r]   r   NID_aes_256_cbc&NID_pbe_WithSHA1And3_Key_TripleDES_CBCr  r  r  r  PKCS12_key_cert_algorithmr<   PBESv1SHA1And3KeyTripleDESCBCPBESv2SHA256AndAES256CBCr   
_hmac_hashCryptography_HAS_PKCS12_SET_MACr   rt   _kdf_roundsr   r   sk_X509_new_nullr   r  r=   friendly_namer  r}  X509_alias_set1rf   sk_X509_pushr  rz  r  PKCS12_createPKCS12_set_macr  r  i2d_PKCS12_bior  )ri   r   r  r  casr   r  nid_certnid_keypkcs12_itermac_itermac_alg
keycertalgr  ossl_cascaca_aliasossl_car   r  name_buf	ossl_cert	ossl_pkeyr  rB   s                            rK   (serialize_key_and_certificates_to_pkcs12z0Backend.serialize_key_and_certificates_to_pkcs12  s     vt,*M,F,FGHGKHiinnG -"G"G
 yy<<9944))3399KK))JJK HiinnG+44H$m&O&O %,,**112
 HGKH+44H-AAJT???99KK))JJt<<<yyDD.L   9944))33!))) $..:yy@@..  >>(33 ##Gtyy~~$=>))..#//;2>> >??;#c(a-iinnGii002Giill7DII,B,BCG H 1b"34!//H"oobnn=G'"ii77#TYY^^R #ii77#Xs8} ''q1"oob1G(ii,,Wg>&&sax0#1& --h7  	<11$7 859DOOD1tyy~~	+.?DNN3'		  ii-- ( 		99tyy~~-		(( IINN1 	D 	C499>>12iill3		 5 56%%'ii&&sC0C!G$!!#&&O  	  	s&   ?W2A7W%A,W2%W/	*W22W;c                N    | j                   ry| j                  j                  dk(  S r   )r`   r]   Cryptography_HAS_POLY1305rh   s    rK   poly1305_supportedzBackend.poly1305_supported7  s#    yy22a77rJ   c                0    | j                   j                   S rW   r2  rh   s    rK   pkcs7_supportedzBackend.pkcs7_supported<  r4  rJ   c                   t        j                  d|       | j                  |      }| j                  j	                  |j
                  | j                  j                  | j                  j                  | j                  j                        }|| j                  j                  k(  r| j                          t        d      | j                  j                  || j                  j                        }| j                  |      S Nr  zUnable to parse PKCS7 data)r   r  r  r]   PEM_read_bio_PKCS7rB   r[   r   r   r   r   
PKCS7_free_load_pkcs7_certificatesri   r  rB   p7s       rK   load_pem_pkcs7_certificatesz#Backend.load_pem_pkcs7_certificates?  s     	64(  &YY))GGTYY^^TYY^^TYY^^
   "9::YY\\"dii223,,R00rJ   c                   t        j                  d|       | j                  |      }| j                  j	                  |j
                  | j                  j                        }|| j                  j                  k(  r| j                          t        d      | j                  j                  || j                  j                        }| j                  |      S r  )r   r  r  r]   d2i_PKCS7_biorB   r[   r   r   r   r   r  r  r  s       rK   load_der_pkcs7_certificatesz#Backend.load_der_pkcs7_certificatesN  s     	64(  &YY$$SWWdiinn=  "9::YY\\"dii223,,R00rJ   c                   | j                   j                  |j                        }| j                  || j                   j                  k7         || j                   j
                  k7  r)t        dj                  |      t        j                        |j                  j                  j                  }| j                   j                  |      }g }t        |      D ]h  }| j                   j                  ||      }| j                  || j                   j"                  k7         | j%                  |      }|j'                  |       j |S )NzNOnly basic signed structures are currently supported. NID for this data was {})r]   OBJ_obj2nidr   rt   r  NID_pkcs7_signedr   rl   r   UNSUPPORTED_SERIALIZATIONr   signr  r  rt  r  r[   r   r  rf   )	ri   r  nidr  r   certsru  r   r  s	            rK   r  z Backend._load_pkcs7_certificates[  s    ii##BGG,C499#6#667$)),,,&((.s22  $$))..ii##G,s 	A99**7A6D		 67??4(DLL		 rJ   )returnNone)r  strrW   )rs   boolrq   z7typing.Optional[typing.List[rust_openssl.OpenSSLError]]r  r  )r  r   )r   hashes.HashAlgorithm)r   r  r  r  )r  r  )r   r%   r   r:   r  r  )r   r%   r   r:   r  r
   )r  z&typing.List[rust_openssl.OpenSSLError])r   r   )r   r   r   r   r  rsa.RSAPrivateKey)r   r   r   r   r  r  )r   zrsa.RSAPrivateNumbersr   r  r  r  )r   zrsa.RSAPublicNumbersr  zrsa.RSAPublicKey)r  bytesr  rA   )r  r  )r   r  r  r"   )r  r#   )rE  r   r  r  )r   r   r  dsa.DSAParameters)rP  r  r  dsa.DSAPrivateKey)r   r   r  r  )r   zdsa.DSAPrivateNumbersr  r  )r   zdsa.DSAPublicNumbersr  zdsa.DSAPublicKey)r   zdsa.DSAParameterNumbersr  r  )r   r$   r  r   )r  r  r  typing.Optional[bytes]r   r  r  r"   )r  r  r  r#   )r  r  r  dh.DHParameters)r  x509.Certificater  
typing.Any)r  r  r  r  )r  r?   r  r  )r  r"   )r  ztyping.NoReturn)r  ec.EllipticCurver  r  )r  z"ec.EllipticCurveSignatureAlgorithmr  r  r  r  )r  r  r  ec.EllipticCurvePrivateKey)r   zec.EllipticCurvePrivateNumbersr  r  )r   zec.EllipticCurvePublicNumbersr  ec.EllipticCurvePublicKey)r  r  r  r  r  r  )r  r   r  r  r  r  )r  r  )r  r   )r   zec.ECDHr  r  r  r  )r  r  r  r   )r  r   r  r   r  r  )r  serialization.Encodingrl   zserialization.PrivateFormatr   (serialization.KeySerializationEncryptionr  r  )r  r  rl   zserialization.PublicFormatr  r  )r7  r   r   r   r  r  )rP  r  r  dh.DHPrivateKey)r7  r   r   r   r  r  )r   zdh.DHPrivateNumbersr  r  )r   zdh.DHPublicNumbersr  zdh.DHPublicKey)r   zdh.DHParameterNumbersr  r  )r   r   rD  r   r   ztyping.Optional[int]r  r  )r  r  r  zx25519.X25519PublicKey)r  r  r  x25519.X25519PrivateKey)r  r  )r  r  r  zx448.X448PublicKey)r  r  r  x448.X448PrivateKey)r  r  )r  r  r  zed25519.Ed25519PublicKey)r  r  r  ed25519.Ed25519PrivateKey)r  r  )r  r  r  zed448.Ed448PublicKey)r  r  r  ed448.Ed448PrivateKey)r  r  )r  r   r  r  )r  r  r  r  r  zptyping.Tuple[typing.Optional[PrivateKeyTypes], typing.Optional[x509.Certificate], typing.List[x509.Certificate]])r  r  r  r  r  r>   )r   r  r  z&typing.Optional[PKCS12PrivateKeyTypes]r  z!typing.Optional[x509.Certificate]r  z,typing.Optional[typing.List[_PKCS12CATypes]]r   r  r  r  )r  r  r  typing.List[x509.Certificate])r  r  )rF   rG   rH   __doc__r   
_fips_aeadr&   r   r   r<  r=  r>  r?  
SHA512_224
SHA512_256SHA3_224SHA3_256SHA3_384SHA3_512SHAKE128SHAKE256r   r   	SECP224R1	SECP256R1	SECP384R1	SECP521R1r  _fips_rsa_min_key_size_fips_rsa_min_public_exponent_fips_dsa_min_modulus_fips_dh_min_key_size_fips_dh_min_modulusrj   ro   rt   rv   rm   r   r   r   r   r   r   r   r   r   rb   r   r   r   r   r   r   r   r   r   r  r  r   r  r  r  r5  r:  r@  rF  rH  rK  rQ  rT  rY  r^  ra  rc  re  ri  rk  ro  r{  r  r*  r  r8  r  r  r  r  rm  rx  r  r  r  r  r  r  r  r  r  r  r  r  r   r  r  r#  r  r  r0  r3  r8  r:  r<  r>  r@  rB  rF  rH  rK  rN  rQ  rT  rV  rX  rZ  r]  ra  rc  re  rg  ri  rk  rm  ro  rr  rv  
contextlibrz  r  r|  r  r  r  r  r  r  rI   rJ   rK   rM   rM   `   s1    DJ FM 	L 	


	 "$)!I  55:
 KOEE HE 
	E<	/	
(.-.	.:.,>BHK%K-1K	K
K%K-1K	K
.2


"
.1
	
.
"
.1
	
'
&'
 )-'
 
	'
R8+8	8K		J@8<J@	J@X=@~
&7>1+1	1
99	9>,>	>=+=	=@.@	@

8


-

 )
 )-	

 

(1T9 ) )-	
 
41.9G?2
	2
h,\ 	4?	4  	4 
		4%	#,2B52B	#2Bh
A4
A	"
AA%A49A	"A,(B (B)9(B	#(BT8=


 

)9

	

" ) )& & 	& 
&Bn<(n< ,n< G	n< 
n<`
	
&'5<(5< +5< 
5<n7HH(+H	H
1)1	1


(+
	
=*=	=
<)<	<
?,?	? 9=


!5
	
<;<<	 <
2A
9:0
:
<<	!<
==	"=
3
:;19 L L,

%;


ILIL%;IL	!ILV\'$\' 4\' 0	\'
 :\' G\' 
\'|8
711	&111	&1rJ   rM   c                      e Zd ZddZddZy)r   c                    || _         y rW   )_fmt)ri   fmts     rK   rj   zGetCipherByName.__init__r  s	    	rJ   c                   | j                   j                  ||      j                         }|j                  j	                  |j                  d            }||j                  j                  k(  rj|j                  j                  rT|j                  j                  |j                  j                  |j                  d      |j                  j                        }|j                          |S )N)r   r   rx   )r  rl   lowerr]   r%  r   r[   r   Cryptography_HAS_300_EVP_CIPHEREVP_CIPHER_fetchr   )ri   r  r   r   cipher_namer   s         rK   __call__zGetCipherByName.__call__u  s    ii&&f4&@FFH\\66w'

 ',,+++<< 66!!""7+!!J 	!rJ   N)r  r  )r  rM   r   r%   r   r:   )rF   rG   rH   rj   r  rI   rJ   rK   r   r   q  s    rJ   r   c                |    d|j                   dz   d}| j                  j                  |j                  d            S )Nzaes-   z-xtsrx   )r   r]   r%  r   )r  r   r   r  s       rK   r   r     s:    A-.d3K<<,,[-?-?-HIIrJ   )r  rM   r   r&   )]
__future__r   collectionsr  r   typingr   cryptographyr   r   cryptography.exceptionsr   r   $cryptography.hazmat.backends.opensslr	   ,cryptography.hazmat.backends.openssl.ciphersr
   )cryptography.hazmat.backends.openssl.cmacr   'cryptography.hazmat.backends.openssl.ecr   r   (cryptography.hazmat.backends.openssl.rsar   r   "cryptography.hazmat.bindings._rustr   r^   $cryptography.hazmat.bindings.opensslr   cryptography.hazmat.primitivesr   r   *cryptography.hazmat.primitives._asymmetricr   )cryptography.hazmat.primitives.asymmetricr   r   r   r   r   r   r   r   1cryptography.hazmat.primitives.asymmetric.paddingr   r   r    r!   /cryptography.hazmat.primitives.asymmetric.typesr"   r#   &cryptography.hazmat.primitives.ciphersr$   r%   1cryptography.hazmat.primitives.ciphers.algorithmsr&   r'   r(   r)   r*   r+   r,   r-   r.   r/   r0   r1   ,cryptography.hazmat.primitives.ciphers.modesr2   r3   r4   r5   r6   r7   r8   r9   r:   ,cryptography.hazmat.primitives.serializationr;   3cryptography.hazmat.primitives.serialization.pkcs12r<   r=   r>   r?   r@   
namedtuplerA   rE   rM   r   r   r  rI   rJ   rK   <module>r     s   
 #     % $ B 5 G B G 8 @ H	 	 	    
 
 
 =  $[##L5*2EF
	 	N Nb8 2J
 )rJ   