o
    <i<                     @   sN  d dl Z d dlZd dlmZmZ d dlmZmZ d dlm	Z	 d dl
mZ d dlmZmZmZ d dlmZ d dlmZ d d	lmZ d d
lmZmZmZ d dlmZ d dlmZ d dlmZmZ d dl m!Z! d dl"m#Z# d dl"m$Z$ d dl"m%Z% d dl"m&Z& d dl"m'Z' d dl"m(Z(m)Z) d dl"m*Z* d dl+m,Z, dZ-	 dZ.	 G dd dedZ/dd Z0dd Z1d d! Z2d"d# Z3d$d% Z4G d&d' d'Z5G d(d) d)e5Z6G d*d+ d+e5Z7G d,d- d-e5Z8G d.d/ d/e5Z9G d0d1 d1e6e/Z:G d2d3 d3e6e/Z;G d4d5 d5e6e/Z<G d6d7 d7e7e/Z=G d8d9 d9e7e/Z>G d:d; d;e7e/Z?G d<d= d=e8e/Z@G d>d? d?e8e/ZAG d@dA dAe8e/ZBG dBdC dCe8e/ZCG dDdE dEe7e/ZDG dFdG dGe7e/ZEG dHdI dIe7e/ZFG dJdK dKe9e/ZGG dLdM dMZHG dNdO dOeHZIG dPdQ dQeIe/ZJG dRdS dSeIe/ZKG dTdU dUeIe/ZLG dVdW dWeHZMG dXdY dYeMe/ZNG dZd[ d[eMe/ZOG d\d] d]eMe/ZPG d^d_ d_eHZQG d`da daeQe/ZRG dbdc dceQe/ZSG ddde deeQe/ZTG dfdg dgeHZUG dhdi dieUe/ZVG djdk dkeUe/ZWG dldm dmeUe/ZXG dndo doeHe/ZYG dpdq dqeHe/ZZG drds dseZZ[G dtdu dueZZ\G dvdw dweZZ]G dxdy dye5e/Z^G dzd{ d{e5e/Z_G d|d} d}e5e/Z`G d~d dZaG dd deaZbG dd debe/ZcG dd debe/ZdG dd debe/ZeG dd deaZfG dd defe/ZgG dd defe/ZhG dd defe/ZiG dd de8e/ZjG dd de8e/ZkG dd de8e/ZlG dd dZmdS )    N)ABCMetaabstractmethod)hexlify	unhexlify)InvalidSignature)default_backend)constant_timehasheshmac)ec)padding)utils)Cipher
algorithmsmodes)ConcatKDFHash)
PBKDF2HMAC)aes_key_unwrapaes_key_wrap)PKCS7)InvalidCEKeyLength)InvalidJWAAlgorithm)InvalidJWEKeyLength)InvalidJWEKeyType)InvalidJWEOperation)base64url_decodebase64url_encode)json_decode)JWKi @  Tc                   @   sh   e Zd Zeedd Zeedd Zeedd Zeedd Zeed	d
 Z	edd Z
dS )JWAAlgorithmc                 C      dS )zThe algorithm NameN selfr!   r!   K/root/parts/websockify/install/lib/python3.10/site-packages/jwcrypto/jwa.pyname7       zJWAAlgorithm.namec                 C   r    )zA short descriptionNr!   r"   r!   r!   r$   description<   r&   zJWAAlgorithm.descriptionc                 C   r    )zThe algorithm key sizeNr!   r"   r!   r!   r$   keysizeA   r&   zJWAAlgorithm.keysizec                 C   r    )zOne of 'alg', 'enc' or 'JWK'Nr!   r"   r!   r!   r$   algorithm_usage_locationF   r&   z%JWAAlgorithm.algorithm_usage_locationc                 C   r    )zOne of 'sig', 'kex', 'enc'Nr!   r"   r!   r!   r$   algorithm_useK   r&   zJWAAlgorithm.algorithm_usec                 C   s"   z| j W S  ty   | j Y S w )zThe input key size)wrap_key_sizeAttributeErrorr(   r"   r!   r!   r$   input_keysizeP   s
   
zJWAAlgorithm.input_keysizeN)__name__
__module____qualname__propertyr   r%   r'   r(   r)   r*   r-   r!   r!   r!   r$   r   5   s$    r   )	metaclassc                 C   s   t | d S N   )lenxr!   r!   r$   _bitsizeY      r8   c                 C   s   | d S r3   r!   r6   r!   r!   r$   _inbytes]   s   r:   c                 C   s"   | d dkr
t dtt| S )Nr4   r   zlength must be a multiple of 8)
ValueErrorosurandomr:   r6   r!   r!   r$   _randombitsa   s   r>   c                 C   s2   d | }|d d d }t||dd | S )Nz{:x}   r4      0)formatr   rjust)nbitseilenr!   r!   r$   _encode_inth   s   
rH   c                 C   s   t t| dS )N   )intr   )rD   r!   r!   r$   _decode_intn   s   rK   c                   @      e Zd Zdd Zdd ZdS )_RawJWSc                 C      t NNotImplementedErrorr#   keypayloadr!   r!   r$   signt      z_RawJWS.signc                 C   rN   rO   rP   r#   rS   rT   	signaturer!   r!   r$   verifyw   rV   z_RawJWS.verifyNr.   r/   r0   rU   rY   r!   r!   r!   r$   rM   r       rM   c                   @   0   e Zd ZdZdd Zdd Zdd Zdd	 ZdS )
_RawHMACNc                 C   s   t  | _|| _d S rO   )r   backendhashfnr#   r_   r!   r!   r$   __init__   s   
z_RawHMAC.__init__c                 C   sD   t rt|| jk rt| jt|tj|| j| jd}|| |S )Nr^   )	default_enforce_hmac_key_lengthr8   r(   r   r
   HMACr_   r^   update)r#   rS   rT   hr!   r!   r$   _hmac_setup   s
   
z_RawHMAC._hmac_setupc                 C   s"   t |d}| ||}| S NrU   )r   
get_op_keyrg   finalize)r#   rS   rT   skeyrf   r!   r!   r$   rU      s   z_RawHMAC.signc                 C   s(   t |d}| ||}|| d S NrY   )r   ri   rg   rY   )r#   rS   rT   rX   vkeyrf   r!   r!   r$   rY      s   z_RawHMAC.verify)r.   r/   r0   r(   ra   rg   rU   rY   r!   r!   r!   r$   r]   {   s    r]   c                   @   s$   e Zd Zdd Zdd Zdd ZdS )_RawRSAc                 C      || _ || _d S rO   )padfnr_   )r#   rp   r_   r!   r!   r$   ra         
z_RawRSA.__init__c                 C   s   | d}||| j| jS rh   )ri   rU   rp   r_   r#   rS   rT   rk   r!   r!   r$   rU      s   
z_RawRSA.signc                 C   s"   | d}|||| j| j d S rl   )ri   rY   rp   r_   r#   rS   rT   rX   pkeyr!   r!   r$   rY      s   
z_RawRSA.verifyN)r.   r/   r0   ra   rU   rY   r!   r!   r!   r$   rn      s    rn   c                   @   s0   e Zd Zdd Zedd Zdd Zdd Zd	S )
_RawECc                 C   ro   rO   )_curver_   )r#   curver_   r!   r!   r$   ra      rq   z_RawEC.__init__c                 C   s   | j S rO   )rv   r"   r!   r!   r$   rw      s   z_RawEC.curvec                 C   sJ   | d| j}|j}||t| j}t|\}}t	||t	|| S rh   )
ri   rv   key_sizerU   r   ECDSAr_   ec_utilsdecode_dss_signaturerH   )r#   rS   rT   rk   sizerX   rsr!   r!   r$   rU      s
   z_RawEC.signc                 C   sp   | d| j}|d t|d  }|t|d d  }ttt|dtt|d}|||t	| j
 d S )NrY   r@   rI   )ri   rv   r5   rz   encode_dss_signaturerJ   r   rY   r   ry   r_   )r#   rS   rT   rX   rt   r}   r~   enc_signaturer!   r!   r$   rY      s   z_RawEC.verifyN)r.   r/   r0   ra   r1   rw   rU   rY   r!   r!   r!   r$   ru      s    
ru   c                   @   rL   )_RawNonec                 C   r    )N r!   rR   r!   r!   r$   rU      rV   z_RawNone.signc                 C   s$   |d dks|  dkrtdd S )Nktyoctr   z'The "none" signature cannot be verified)ri   r   rW   r!   r!   r$   rY      s   z_RawNone.verifyNrZ   r!   r!   r!   r$   r      r[   r   c                       0   e Zd ZdZdZdZdZdZ fddZ  Z	S )_HS256HS256zHMAC using SHA-256   algsigc                       t t| t  d S rO   )superr   ra   r	   SHA256r"   	__class__r!   r$   ra         z_HS256.__init__
r.   r/   r0   r%   r'   r(   r)   r*   ra   __classcell__r!   r!   r   r$   r          r   c                       r   )_HS384HS384zHMAC using SHA-384  r   r   c                    r   rO   )r   r   ra   r	   SHA384r"   r   r!   r$   ra      r   z_HS384.__init__r   r!   r!   r   r$   r      r   r   c                       r   )_HS512HS512zHMAC using SHA-512   r   r   c                    r   rO   )r   r   ra   r	   SHA512r"   r   r!   r$   ra      r   z_HS512.__init__r   r!   r!   r   r$   r      r   r   c                       r   )_RS256RS256zRSASSA-PKCS1-v1_5 using SHA-256   r   r   c                       t t| t t  d S rO   )r   r   ra   r   PKCS1v15r	   r   r"   r   r!   r$   ra         z_RS256.__init__r   r!   r!   r   r$   r      r   r   c                       r   )_RS384RS384zRSASSA-PKCS1-v1_5 using SHA-384r   r   r   c                    r   rO   )r   r   ra   r   r   r	   r   r"   r   r!   r$   ra      r   z_RS384.__init__r   r!   r!   r   r$   r      r   r   c                       r   )_RS512RS512zRSASSA-PKCS1-v1_5 using SHA-512r   r   r   c                    r   rO   )r   r   ra   r   r   r	   r   r"   r   r!   r$   ra     r   z_RS512.__init__r   r!   r!   r   r$   r     r   r   c                       r   )_ES256ES256zECDSA using P-256 and SHA-256r   r   r   c                       t t| dt  d S )NzP-256)r   r   ra   r	   r   r"   r   r!   r$   ra        z_ES256.__init__r   r!   r!   r   r$   r     r   r   c                       r   )_ES256KES256Kz'ECDSA using secp256k1 curve and SHA-256r   r   r   c                    r   )N	secp256k1)r   r   ra   r	   r   r"   r   r!   r$   ra   #  r   z_ES256K.__init__r   r!   r!   r   r$   r     r   r   c                       r   )_ES384ES384zECDSA using P-384 and SHA-384r   r   r   c                    r   )NzP-384)r   r   ra   r	   r   r"   r   r!   r$   ra   /  r   z_ES384.__init__r   r!   r!   r   r$   r   '  r   r   c                       r   )_ES512ES512zECDSA using P-521 and SHA-512r   r   r   c                    r   )NzP-521)r   r   ra   r	   r   r"   r   r!   r$   ra   ;  r   z_ES512.__init__r   r!   r!   r   r$   r   3  r   r   c                       r   )_PS256PS256z.RSASSA-PSS using SHA-256 and MGF1 with SHA-256r   r   r   c                    4   t t t tjj}tt| |t  d S rO   )	r   PSSMGF1r	   r   digest_sizer   r   ra   r#   rp   r   r!   r$   ra   G     z_PS256.__init__r   r!   r!   r   r$   r   ?  r   r   c                       r   )_PS384PS384z.RSASSA-PSS using SHA-384 and MGF1 with SHA-384r   r   r   c                    r   rO   )	r   r   r   r	   r   r   r   r   ra   r   r   r!   r$   ra   U  r   z_PS384.__init__r   r!   r!   r   r$   r   M  r   r   c                       r   )_PS512PS512z.RSASSA-PSS using SHA-512 and MGF1 with SHA-512r   r   r   c                    r   rO   )	r   r   r   r	   r   r   r   r   ra   r   r   r!   r$   ra   c  r   z_PS512.__init__r   r!   r!   r   r$   r   [  r   r   c                   @       e Zd ZdZdZdZdZdZdS )_Nonenonez%No digital signature or MAC performedr   r   r   Nr.   r/   r0   r%   r'   r(   r)   r*   r!   r!   r!   r$   r   i      r   c                   @   rL   )_RawKeyMgmtc                 C   rN   rO   rP   )r#   rS   bitsizecekheadersr!   r!   r$   wrapt  rV   z_RawKeyMgmt.wrapc                 C   rN   rO   rP   )r#   rS   r   ekr   r!   r!   r$   unwrapw  rV   z_RawKeyMgmt.unwrapN)r.   r/   r0   r   r   r!   r!   r!   r$   r   r  r[   r   c                   @   s,   e Zd Zdd Zdd Zdd Zdd Zd	S )
_RSAc                 C   s
   || _ d S rO   )rp   r   r!   r!   r$   ra   }  s   
z_RSA.__init__c                 C   0   t |ts	td|d dkrtd|d d S )Nkey is not a JWK objectr   RSA
isinstancer   r;   r   r#   rS   r!   r!   r$   
_check_key  
   
z_RSA._check_keyc                 C   s8   |  | |st|}|d}||| j}||dS )NwrapKeyr   r   )r   r>   ri   encryptrp   r#   rS   r   r   r   rkr   r!   r!   r$   r     s   


z	_RSA.wrapc                 C   s@   |  | |d}||| j}t||krt|t||S )N	unwrapKey)r   ri   decryptrp   r8   r   r#   rS   r   r   r   r   r   r!   r!   r$   r     s   

z_RSA.unwrapN)r.   r/   r0   ra   r   r   r   r!   r!   r!   r$   r   {  s
    r   c                       s<   e Zd ZdZdZdZdZdZ fddZ fdd	Z	  Z
S )
_Rsa15RSA1_5zRSAES-PKCS1-v1_5r   r   kexc                    r   rO   )r   r   ra   r   r   r"   r   r!   r$   ra     r   z_Rsa15.__init__c                    sH   |  | t|}ztt| ||||}td ty#   | Y S w )NDummy)r   r>   r   r   r   r;   	Exceptionr#   rS   r   r   r   r   r   r!   r$   r     s   
z_Rsa15.unwrap)r.   r/   r0   r%   r'   r(   r)   r*   ra   r   r   r!   r!   r   r$   r     s    r   c                       r   )_RsaOaepRSA-OAEPz#RSAES OAEP using default parametersr   r   r   c                    ,   t t| ttt t d  d S rO   )r   r   ra   r   OAEPr   r	   SHA1r"   r   r!   r$   ra     
   
z_RsaOaep.__init__r   r!   r!   r   r$   r     r   r   c                       r   )_RsaOaep256RSA-OAEP-256z.RSAES OAEP using SHA-256 and MGF1 with SHA-256r   r   r   c                    r   rO   )r   r   ra   r   r   r   r	   r   r"   r   r!   r$   ra     r   z_RsaOaep256.__init__r   r!   r!   r   r$   r     r   r   c                   @   r\   )
_AesKwNc                 C      t  | _d S rO   r   r^   r"   r!   r!   r$   ra     r9   z_AesKw.__init__c                 C   \   t |ts	td|d dkrtd|d t||}t|| jkr,t| jt||S Nr   r   r   	r   r   r;   r   r   ri   r8   r(   r   r#   rS   opr   r!   r!   r$   _get_key     
z_AesKw._get_keyc                 C   s0   |  |d}|st|}t||t }||dS )Nr   r   )r   r>   r   r   r   r!   r!   r$   r     s
   
z_AesKw.wrapc                 C   s8   |  |d}t||t }t||krt|t||S )Nr   )r   r   r   r8   r   r   r!   r!   r$   r     s
   z_AesKw.unwrapr.   r/   r0   r(   ra   r   r   r   r!   r!   r!   r$   r     s    
	r   c                   @   r   )_A128KWA128KWzAES Key Wrap using 128-bit key   r   r   Nr   r!   r!   r!   r$   r     r   r   c                   @   r   )_A192KWA192KWzAES Key Wrap using 192-bit key   r   r   Nr   r!   r!   r!   r$   r     r   r   c                   @   r   )_A256KWA256KWzAES Key Wrap using 256-bit keyr   r   r   Nr   r!   r!   r!   r$   r     r   r   c                   @   r\   )
	_AesGcmKwNc                 C   r   rO   r   r"   r!   r!   r$   ra     r9   z_AesGcmKw.__init__c                 C   r   r   r   r   r!   r!   r$   r     r   z_AesGcmKw._get_keyc                 C   sv   |  |d}|st|}td}tt|t|| jd}| }|	||
  }	|j}
||	t|t|
ddS )Nr   `   rb   )ivtag)r   r   header)r   r>   r   r   AESr   GCMr^   	encryptorre   rj   r   r   )r#   rS   r   r   r   r   r   cipherr  r   r   r!   r!   r$   r      s   z_AesGcmKw.wrapc                 C   s   |  |d}d|vrtdt|d }d|vrtdt|d }tt|t||| jd}|	 }	|	
||	  }
t|
|krKt|t|
|
S )Nr   r   z&Invalid Header, missing "iv" parameterr   z'Invalid Header, missing "tag" parameterrb   )r   r;   r   r   r   r   r   r  r^   	decryptorre   rj   r8   r   )r#   rS   r   r   r   r   r   r   r  r  r   r!   r!   r$   r   0  s   z_AesGcmKw.unwrapr   r!   r!   r!   r$   r     s    
r   c                   @   r   )
_A128GcmKw	A128GCMKWz+Key wrapping with AES GCM using 128-bit keyr   r   r   Nr   r!   r!   r!   r$   r  C  r   r  c                   @   r   )
_A192GcmKw	A192GCMKWz+Key wrapping with AES GCM using 192-bit keyr   r   r   Nr   r!   r!   r!   r$   r  L  r   r  c                   @   r   )
_A256GcmKw	A256GCMKWz+Key wrapping with AES GCM using 256-bit keyr   r   r   Nr   r!   r!   r!   r$   r	  U  r   r	  c                   @   s8   e Zd ZdZdZdZdd Zdd Zdd Zdd	 Z	dS )
_Pbes2HsAesKwNc                 C      t  | _tttd| _d S N)r   r   r   r   r^   r   r   r   aeskwmapr"   r!   r!   r$   ra   d     z_Pbes2HsAesKw.__init__c           
      C   s   |t krtdt|tst|tr|}n|d}nt| }t| jdd | }| j	dkr7t
 }n| j	dkrAt
 }n| j	dkrKt
 }ntdt|t| j||| jd}||}	t|	| jkrpt| jt|	td	d
t|	dS )NzInvalid p2c value, too largeutf8    r   r   r   zUnknown Hash Size)	algorithmlengthsalt
iterationsr^   r   encr   usek)default_max_pbkdf2_iterationsr;   r   r   bytesencoder   ri   r%   hashsizer	   r   r   r   r   r:   r(   r^   deriver8   r   r5   r   )
r#   r   rS   p2sp2cplainr  hashalgkdfr   r!   r!   r$   r   h  s,   








z_Pbes2HsAesKw._get_keyc                 C   s   i }d|v rt |d }t|dk rtdn
td}t||d< d|v r*|d }nd}||d< | |d |||}| j| j  }	|	||||}
t|dkrS||
d	< |
S )
Nr   r4   z'Invalid Salt, must be 8 or more octectsr   r!  i    r   r   r   )	r   r5   r;   r>   r   r   r  r(   r   )r#   rS   r   r   r   
ret_headerr   r!  kekaeskwretr!   r!   r$   r     s$   
z_Pbes2HsAesKw.wrapc           	      C   sf   d|vrt dd|vrt dt|d }|d }| |d |||}| j| j  }|||||S )Nr   z'Invalid Header, missing "p2s" parameterr!  z'Invalid Header, missing "p2c" parameterr   )r;   r   r   r  r(   r   )	r#   rS   r   r   r   r   r!  r&  r'  r!   r!   r$   r     s   z_Pbes2HsAesKw.unwrap)
r.   r/   r0   r%   r(   r  ra   r   r   r   r!   r!   r!   r$   r  ^  s    r  c                   @   $   e Zd ZdZdZdZdZdZdZdS )_Pbes2Hs256A128KwPBES2-HS256+A128KWz-PBES2 with HMAC SHA-256 and "A128KW" wrappingr   r   r   r   N	r.   r/   r0   r%   r'   r(   r)   r*   r  r!   r!   r!   r$   r*        r*  c                   @   r)  )_Pbes2Hs384A192KwPBES2-HS384+A192KWz-PBES2 with HMAC SHA-384 and "A192KW" wrappingr   r   r   r   Nr,  r!   r!   r!   r$   r.    r-  r.  c                   @   r)  )_Pbes2Hs512A256KwPBES2-HS512+A256KWz-PBES2 with HMAC SHA-512 and "A256KW" wrappingr   r   r   r   Nr,  r!   r!   r!   r$   r0    r-  r0  c                   @   s8   e Zd ZdZdZdZdZdZdd Zdd	 Z	d
d Z
dS )_Directdirz$Direct use of a shared symmetric keyr   r   r   c                 C   r   r   r   r   r!   r!   r$   r     r   z_Direct._check_keyc                 C   sF   |  | |r|d fS t|d}t||krt|t|d|iS )Nr   r   )r   r   ri   r8   r   )r#   rS   r   r   r   r  r!   r!   r$   r     s   
z_Direct.wrapc                 C   sF   |  | |dkrtdt|d}t||kr!t|t||S )N    zInvalid Encryption Key.r   )r   r;   r   ri   r8   r   r   r!   r!   r$   r     s   
z_Direct.unwrapN)r.   r/   r0   r%   r'   r(   r)   r*   r   r   r   r!   r!   r!   r$   r2    s    	r2  c                   @   sH   e Zd ZdZdZdZdZdZdd Zdd	 Z	d
d Z
dd Zdd ZdS )_EcdhEsECDH-ESzECDH-ES using Concat KDFr   r   Nc                 C   r  r  r  r"   r!   r!   r$   ra     r  z_EcdhEs.__init__c                 C   sZ   t |ts	td|d dvrtd|d |d dkr)|d dvr+td|d d S d S )	Nr   r   )ECOKPz	EC or OKPr8  crv)X25519X448zX25519 or X448r   r   r!   r!   r$   r     s   
z_EcdhEs._check_keyc                 C   s   t dt|}|t|d7 }d|v rt|d nd}|t dt|7 }||7 }d|v r5t|d nd}|t dt|7 }||7 }|t d|7 }t|tjr\|	t
 |}	n|	|}	tt t||| jd}
|
|	S )Nz>Ir  apur4  apv)r  r  	otherinfor^   )structpackr5   r  r  r   r   r   EllipticCurvePrivateKeyexchangeECDHr   r	   r   r:   r^   r  )r#   privkeypubkeyr   r   r   r>  r<  r=  
shared_keyckdfr!   r!   r$   _derive  s$   

z_EcdhEs._derivec                 C   s   |  | | j}| jd u r|d urtd|d }|}n|d }tj|d |d d}| |d|d|||}| jd u rDd	|i}	n| j| j  }
td
dt|d}|
	||||}	dt
| i|	d< |	S )Nz"ECDH-ES cannot use an existing CEKr  r   r   r9  )r   r9  r   r   r   r   r  epkr   )r   r(   r   r   generaterH  ri   r  r   r   r   export_public)r#   rS   r   r   r   dk_sizer   rI  dkr(  r'  r&  r!   r!   r$   r   "  s(   



z_EcdhEs.wrapc                 C   s   d|vrt d| | | j}| jd u r|d }|}n|d }td	i |d }| |d|d|||}| jd u r?|S | j| j  }	tddt|d}
|	|
|||}|S )
NrI  z'Invalid Header, missing "epk" parameterr  r   r   r   r   r  r!   )	r;   r   r(   r   rH  ri   r  r   r   )r#   rS   r   r   r   rL  r   rI  rM  r'  r&  r   r!   r!   r$   r   <  s&   


z_EcdhEs.unwrap)r.   r/   r0   r%   r'   r)   r*   r(   ra   r   rH  r   r   r!   r!   r!   r$   r5    s    
#r5  c                   @   r   )_EcdhEsAes128KwECDH-ES+A128KWz.ECDH-ES using Concat KDF and "A128KW" wrappingr   r   r   Nr   r!   r!   r!   r$   rN  T  r   rN  c                   @   r   )_EcdhEsAes192KwECDH-ES+A192KWz.ECDH-ES using Concat KDF and "A192KW" wrappingr   r   r   Nr   r!   r!   r!   r$   rP  ]  r   rP  c                   @   r   )_EcdhEsAes256KwECDH-ES+A256KWz.ECDH-ES using Concat KDF and "A256KW" wrappingr   r   r   Nr   r!   r!   r!   r$   rR  f  r   rR  c                   @   0   e Zd ZdZdZdZdZdZdd Zdd	 Z	dS )
_EdDsaEdDSAz'EdDSA using Ed25519 or Ed448 algorithmsr   r   Nc                 C   s$   |d dv r| d}||S t)Nr9  Ed25519Ed448rU   )ri   rU   rQ   rr   r!   r!   r$   rU   w  s   

z_EdDsa.signc                 C   s&   |d dv r| d}|||S t)Nr9  rW  rY   )ri   rY   rQ   rs   r!   r!   r$   rY   }  s   
z_EdDsa.verify
r.   r/   r0   r%   r'   r)   r*   r(   rU   rY   r!   r!   r!   r$   rU  o      rU  c                   @   rT  )
_Ed25519rX  zEdDSA using Ed25519r   r   Nc                 C   .   |d dkrt d|d |d}||S )Nr9  rX  rU   r   ri   rU   rr   r!   r!   r$   rU        

z_Ed25519.signc                 C   0   |d dkrt d|d |d}|||S )Nr9  rX  rY   r   ri   rY   rs   r!   r!   r$   rY        
z_Ed25519.verifyrZ  r!   r!   r!   r$   r\    r[  r\  c                   @   rT  )
_Ed448rY  zEdDSA using Ed448r   r   Nc                 C   r]  )Nr9  rY  rU   r^  rr   r!   r!   r$   rU     r_  z_Ed448.signc                 C   r`  )Nr9  rY  rY   ra  rs   r!   r!   r$   rY     rb  z_Ed448.verifyrZ  r!   r!   r!   r$   rc    r[  rc  c                   @   rL   )_RawJWEc                 C   rN   rO   rP   )r#   r  aadmr!   r!   r$   r     rV   z_RawJWE.encryptc                 C   rN   rO   rP   )r#   r  re  r   rF   tr!   r!   r$   r     rV   z_RawJWE.decryptN)r.   r/   r0   r   r   r!   r!   r!   r$   rd    r[   rd  c                   @   r\   )
_AesCbcHmacSha2Nc                 C   s(   t  | _|| _tjj| _| jd | _d S )Nr@   )	r   r^   r_   r   r   
block_size	blocksizer(   r+   r`   r!   r!   r$   ra     s   
z_AesCbcHmacSha2.__init__c                 C   sd   t t|d}tj|| j| jd}|| || || || | }|d t| j	 S )N@   rb   )
rH   r8   r
   rd   r_   r^   re   rj   r:   r(   )r#   r  re  r   rF   alrf   rf  r!   r!   r$   _mac  s   



z_AesCbcHmacSha2._macc                 C   s   t |t| jkrtd|dt| j }|t| jd }t| j}tt	|t
|| jd}| }t| j }	|	||	  }
||
|  }| ||||}|||fS ) Encrypt according to the selected encryption and hashing
        functions.

        :param k: Encryption key
        :param aad: Additional Authentication Data
        :param m: Plaintext

        Returns a dictionary with the computed data.
        Invalid input key sizeNrb   )r5   r:   r+   r;   r(   r>   rj  r   r   r   r   CBCr^   r  r   padderre   rj   rm  )r#   r  re  rf  hkeyekeyr   r  r  rq  padded_datarF   rg  r!   r!   r$   r     s   


z_AesCbcHmacSha2.encryptc              	   C   s   t |t| jkrtd|dt| j }|t| jd }t|| ||||s/tdt	t
|t|| jd}| }	|	||	  }
t| j }||
|  S )A   Decrypt according to the selected encryption and hashing
        functions.
        :param k: Encryption key
        :param aad: Additional Authenticated Data
        :param iv: Initialization Vector
        :param e: Ciphertext
        :param t: Authentication Tag

        Returns plaintext or raises an error
        ro  NzFailed to verify MACrb   )r5   r:   r+   r;   r(   r   bytes_eqrm  r   r   r   r   r   rp  r^   r  re   rj   r   rj  unpadder)r#   r  re  r   rF   rg  rr  dkeyr  r  drw  r!   r!   r$   r     s   z_AesCbcHmacSha2.decrypt)r.   r/   r0   r(   ra   rm  r   r   r!   r!   r!   r$   rh    s    rh  c                       0   e Zd ZdZdZdZdZdZ fddZ  Z	S )_A128CbcHs256A128CBC-HS256z&AES_128_CBC_HMAC_SHA_256 authenticatedr   r  c                    r   rO   )r   r{  ra   r	   r   r"   r   r!   r$   ra     r   z_A128CbcHs256.__init__r   r!   r!   r   r$   r{    r   r{  c                       rz  )_A192CbcHs384A192CBC-HS384z&AES_192_CBC_HMAC_SHA_384 authenticatedr   r  c                    r   rO   )r   r}  ra   r	   r   r"   r   r!   r$   ra     r   z_A192CbcHs384.__init__r   r!   r!   r   r$   r}    r   r}  c                       rz  )_A256CbcHs512A256CBC-HS512z&AES_256_CBC_HMAC_SHA_512 authenticatedr   r  c                    r   rO   )r   r  ra   r	   r   r"   r   r!   r$   ra   (  r   z_A256CbcHs512.__init__r   r!   r!   r   r$   r     r   r  c                   @   s(   e Zd ZdZdd Zdd Zdd ZdS )_AesGcmNc                 C   s   t  | _| j| _d S rO   )r   r^   r(   r+   r"   r!   r!   r$   ra   0  s   z_AesGcm.__init__c                 C   sT   t d}tt|t|| jd}| }|| |	||
  }|||jfS )rn  r   rb   )r>   r   r   r   r   r  r^   r  authenticate_additional_datare   rj   r   )r#   r  re  rf  r   r  r  rF   r!   r!   r$   r   5  s   

z_AesGcm.encryptc                 C   sB   t t|t||| jd}| }|| |||	  S )ru  rb   )
r   r   r   r   r  r^   r  r  re   rj   )r#   r  re  r   rF   rg  r  r  r!   r!   r$   r   H  s   
z_AesGcm.decrypt)r.   r/   r0   r(   ra   r   r   r!   r!   r!   r$   r  ,  s
    r  c                   @       e Zd ZdZdZdZdZdZdS )_A128GcmA128GCMzAES GCM using 128-bit keyr   r  Nr   r!   r!   r!   r$   r  Z  r   r  c                   @   r  )_A192GcmA192GCMzAES GCM using 192-bit keyr   r  Nr   r!   r!   r!   r$   r  c  r   r  c                   @   r  )_A256GcmA256GCMzAES GCM using 256-bit keyr   r  Nr   r!   r!   r!   r$   r  l  r   r  c                       r   )_BP256R1BP256R1zsECDSA using Brainpool256R1 curve and SHA-256 (unregistered, custom-defined in breach of IETF rules by gematik GmbH)r   r   r   c                    r   )NzBP-256)r   r  ra   r	   r   r"   r   r!   r$   ra     r   z_BP256R1.__init__r   r!   r!   r   r$   r  u      r  c                       r   )_BP384R1BP384R1zsECDSA using Brainpool384R1 curve and SHA-384 (unregistered, custom-defined in breach of IETF rules by gematik GmbH)r   r   r   c                    r   )NzBP-384)r   r  ra   r	   r   r"   r   r!   r$   ra     r   z_BP384R1.__init__r   r!   r!   r   r$   r    r  r  c                       r   )_BP512R1BP512R1zsECDSA using Brainpool512R1 curve and SHA-512 (unregistered, custom-defined in breach of IETF rules by gematik GmbH)r   r   r   c                    r   )NzBP-512)r   r  ra   r	   r   r"   r   r!   r$   ra     r   z_BP512R1.__init__r   r!   r!   r   r$   r    r  r  c                   @   s.  e Zd ZdZi dededededede	de
d	ed
ededededededededei dededededededededededede de!d e"d!e#d"e$d#e%e&e'e(e)e*e+e,e-e.d$	Z/e0d.d&d'Z1e0d(d) Z2e0d*d+ Z3e0d,d- Z4d%S )/JWAzSJWA Signing Algorithms.

    This class provides access to all JWA algorithms.
    r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r3  r6  rO  rQ  rS  rV  r  r  r
  r+  r/  r1  r|  r~  )	r  r  r  r  r  r  r  rX  rY  Nc                 C   s&   | j | }|d ur|j|krt| S rO   )algorithms_registryr*   KeyError)clsr%   r  r   r!   r!   r$   instantiate_alg  s   
zJWA.instantiate_algc                 C   .   z| j |ddW S  ty   td| d w )Nr   r  z(%s is not a valid Signing algorithm namer  r  r   r  r%   r!   r!   r$   signing_alg     zJWA.signing_algc                 C   r  )Nr   r  z/%s is not a valid Key Management algorithm namer  r  r!   r!   r$   keymgmt_alg  r  zJWA.keymgmt_algc                 C   r  )Nr  r  z+%s is not a valid Encryption algorithm namer  r  r!   r!   r$   encryption_alg  r  zJWA.encryption_algrO   )5r.   r/   r0   __doc__r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r2  r5  rN  rP  rR  rU  r  r  r	  r*  r.  r0  r{  r}  r  r  r  r  r  r  r  r\  rc  r  classmethodr  r  r  r  r!   r!   r!   r$   r    s    	
 !"#.

r  )nr<   r?  abcr   r   binasciir   r   cryptography.exceptionsr   cryptography.hazmat.backendsr   cryptography.hazmat.primitivesr   r	   r
   )cryptography.hazmat.primitives.asymmetricr   r   r   rz   &cryptography.hazmat.primitives.ciphersr   r   r   ,cryptography.hazmat.primitives.kdf.concatkdfr   )cryptography.hazmat.primitives.kdf.pbkdf2r   &cryptography.hazmat.primitives.keywrapr   r   &cryptography.hazmat.primitives.paddingr   jwcrypto.commonr   r   r   r   r   r   r   r   jwcrypto.jwkr   r  rc   r   r8   r:   r>   rH   rK   rM   r]   rn   ru   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r  r  r	  r  r*  r.  r0  r2  r5  rN  rP  rR  rU  r\  rc  rd  rh  r{  r}  r  r  r  r  r  r  r  r  r  r!   r!   r!   r$   <module>   s   
$	
		#			4			L


!k				Q.			