o
    h Žib‹  ã                   @  sH  U d dl mZ d dlZd dlZd dlZd dlZd dlmZmZ d dl	m
Z
mZmZmZmZmZmZmZ ddlmZ ddlmZmZ ddlmZmZmZmZmZmZmZmZm Z  zød d	l!m"Z"m#Z# d d
l$m%Z% d dl&m'Z' d dl(m)Z) d dl*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4 d dl5m6Z6m7Z7 d dl8m9Z9m:Z: d dl;m<Z<m=Z=m>Z>m?Z?m@Z@mAZAmBZBmCZC d dlDmEZEmFZFmGZGmHZHmIZImJZJmKZK e<e>fZLe1e3fZMe9e:e6e7fZNeLeM eN ZOe<e1e9e6fZPe>e3e:e7fZQe
sëeRe Sdd¡ƒ�rLd dlTZTeTjUdkrûd dl	mVZV nd dlWmVZV d dlXmYZYmZZZ ee<e>f Z[de\d< ee1e3f Z]de\d< ee9e:e6e7f Z^de\d< ee[e]e^f Z_de\d< ee<e1e9e6f Z`de\d< ee>e3e:e7f Zade\d< dZbW n ec�y[   dZbY nw h d £Zdd3d#d$„ZeG d%d&„ d&eƒZfG d'd(„ d(efƒZgG d)d*„ d*efƒZheb�r¢G d+d,„ d,efƒZiG d-d.„ d.efƒZjG d/d0„ d0eiƒZkG d1d2„ d2efƒZldS dS )4é    )ÚannotationsN)ÚABCÚabstractmethod)ÚTYPE_CHECKINGÚAnyÚClassVarÚLiteralÚNoReturnÚUnionÚcastÚoverloadé   ©ÚInvalidKeyError)ÚHashlibHashÚJWKDict)	Úbase64url_decodeÚbase64url_encodeÚder_to_raw_signatureÚforce_bytesÚfrom_base64url_uintÚis_pem_formatÚ
is_ssh_keyÚraw_to_der_signatureÚto_base64url_uint)ÚInvalidSignatureÚUnsupportedAlgorithm)Údefault_backend)Úhashes)Úpadding)
ÚECDSAÚ	SECP256K1Ú	SECP256R1Ú	SECP384R1Ú	SECP521R1ÚEllipticCurveÚEllipticCurvePrivateKeyÚEllipticCurvePrivateNumbersÚEllipticCurvePublicKeyÚEllipticCurvePublicNumbers)ÚEd448PrivateKeyÚEd448PublicKey)ÚEd25519PrivateKeyÚEd25519PublicKey)ÚRSAPrivateKeyÚRSAPrivateNumbersÚRSAPublicKeyÚRSAPublicNumbersÚrsa_crt_dmp1Úrsa_crt_dmq1Úrsa_crt_iqmpÚrsa_recover_prime_factors)ÚEncodingÚNoEncryptionÚPrivateFormatÚPublicFormatÚload_pem_private_keyÚload_pem_public_keyÚload_ssh_public_keyZSPHINX_BUILDÚ )é   é
   )Ú	TypeAlias)ÚPrivateKeyTypesÚPublicKeyTypesr@   ÚAllowedRSAKeysÚAllowedECKeysÚAllowedOKPKeysÚAllowedKeysÚAllowedPrivateKeysÚAllowedPublicKeysTF>   ÚES512ÚPS256ÚRS384ÚES256KÚPS384ÚES256ÚRS256ÚPS512ÚEdDSAÚRS512ÚES384ÚES521Úreturnúdict[str, Algorithm]c                  C  sœ   t ƒ ttjƒttjƒttjƒdœ} trL|  ttjƒttjƒttjƒttjt	ƒttjt
ƒttjtƒttjtƒttjtƒttjƒttjƒttjƒtƒ dœ¡ | S )zE
    Returns the algorithms that are implemented by the library.
    )ÚnoneZHS256ZHS384ZHS512)rO   rK   rR   rN   rL   rS   rT   rI   rJ   rM   rP   rQ   N)ÚNoneAlgorithmÚHMACAlgorithmÚSHA256ÚSHA384ÚSHA512Ú
has_cryptoÚupdateÚRSAAlgorithmÚECAlgorithmr"   r!   r#   r$   ÚRSAPSSAlgorithmÚOKPAlgorithm)Zdefault_algorithms© rc   úXC:\Users\psant\Downloads\Anu Raj Backend\school\venv\Lib\site-packages\jwt/algorithms.pyÚget_default_algorithms�   s0   ü



ÿòÿre   c                   @  s¼   e Zd ZU dZdZded< d,dd	„Zd-dd„Zed.dd„ƒZ	ed/dd„ƒZ
ed0dd„ƒZeeed1dd„ƒƒƒZeee	d2d3d"d„ƒƒƒZeed2d4d$d„ƒƒZeed5d'd(„ƒƒZd6d*d+„ZdS )7Ú	AlgorithmzH
    The interface for an algorithm used to sign and verify tokens.
    Nz$tuple[type[AllowedKeys], ...] | NoneÚ_crypto_key_typesÚbytestrÚbytesrU   c                 C  sj   t | ddƒ}|du rt‚tr-t|tƒr-t|tjƒr-tj|ƒ t	ƒ d�}| 
|¡ t| ¡ ƒS t||ƒ ¡ ƒS )z�
        Compute a hash digest using the specified algorithm's hash algorithm.

        If there is no hash algorithm, raises a NotImplementedError.
        Úhash_algN)Úbackend)ÚgetattrÚNotImplementedErrorr]   Ú
isinstanceÚtypeÚ
issubclassr   ZHashAlgorithmZHashr   r^   ri   ÚfinalizeÚdigest)Úselfrh   rj   rr   rc   rc   rd   Úcompute_hash_digestÇ   s   ÿþ
ý
zAlgorithm.compute_hash_digestÚkeyú PublicKeyTypes | PrivateKeyTypesÚNonec                 C  s`   t r| jdu rtdƒ‚t|| jƒs.dd„ | jD ƒ}|jj}| jj}td|› d|› d|› �ƒ‚dS )ac  Check that the key belongs to the right cryptographic family.

        Note that this method only works when ``cryptography`` is installed.

        :param key: Potentially a cryptography key
        :type key: :py:data:`PublicKeyTypes <cryptography.hazmat.primitives.asymmetric.types.PublicKeyTypes>` | :py:data:`PrivateKeyTypes <cryptography.hazmat.primitives.asymmetric.types.PrivateKeyTypes>`
        :raises ValueError: if ``cryptography`` is not installed, or this method is called by a non-cryptography algorithm
        :raises InvalidKeyError: if the key doesn't match the expected key classes
        NzhThis method requires the cryptography library, and should only be used by cryptography-based algorithms.c                 s  s   � | ]}|j V  qd S ©N)Ú__name__)Ú.0Úclsrc   rc   rd   Ú	<genexpr>í   s   € z2Algorithm.check_crypto_key_type.<locals>.<genexpr>zExpected one of z, got: z. Invalid Key type for )r]   rg   Ú
ValueErrorrn   Ú	__class__ry   r   )rs   ru   Zvalid_classesZactual_classZ
self_classrc   rc   rd   Úcheck_crypto_key_typeÝ   s   
ÿÿüzAlgorithm.check_crypto_key_typer   c                 C  ó   dS )zš
        Performs necessary validation and conversions on the key and returns
        the key value in the proper format for sign() and verify().
        Nrc   ©rs   ru   rc   rc   rd   Úprepare_keyô   ó    zAlgorithm.prepare_keyÚmsgc                 C  r€   )zn
        Returns a digital signature for the specified message
        using the specified key value.
        Nrc   ©rs   r„   ru   rc   rc   rd   Úsignû   rƒ   zAlgorithm.signÚsigÚboolc                 C  r€   )zz
        Verifies that the specified digital signature is valid
        for the specified message and key values.
        Nrc   ©rs   r„   ru   r‡   rc   rc   rd   Úverify  rƒ   zAlgorithm.verifyÚkey_objÚas_dictúLiteral[True]r   c                 C  ó   d S rx   rc   ©r‹   rŒ   rc   rc   rd   Úto_jwk	  s   zAlgorithm.to_jwkFúLiteral[False]Ústrc                 C  rŽ   rx   rc   r�   rc   rc   rd   r�     ó   úJWKDict | strc                 C  r€   )z3
        Serializes a given key into a JWK
        Nrc   r�   rc   rc   rd   r�     rƒ   Újwkústr | JWKDictc                 C  r€   )zJ
        Deserializes a given key from JWK back into a key object
        Nrc   ©r•   rc   rc   rd   Úfrom_jwk  rƒ   zAlgorithm.from_jwkú
str | Nonec                 C  r€   )zŽ
        Return a warning message if the key is below the minimum
        recommended length for this algorithm, or None if adequate.
        Nrc   r�   rc   rc   rd   Úcheck_key_length#  r“   zAlgorithm.check_key_length)rh   ri   rU   ri   )ru   rv   rU   rw   )ru   r   rU   r   )r„   ri   ru   r   rU   ri   )r„   ri   ru   r   r‡   ri   rU   rˆ   )r‹   r   rŒ   r�   rU   r   ©F)r‹   r   rŒ   r‘   rU   r’   )r‹   r   rŒ   rˆ   rU   r”   )r•   r–   rU   r   )ru   r   rU   r™   )ry   Ú
__module__Ú__qualname__Ú__doc__rg   Ú__annotations__rt   r   r   r‚   r†   rŠ   r   Ústaticmethodr�   r˜   rš   rc   rc   rc   rd   rf   ¿   s6   
 

ÿrf   c                   @  sL   e Zd ZdZddd„Zdd
d„Zddd„Zedd dd„ƒZed!dd„ƒZ	dS )"rX   zZ
    Placeholder for use when no signing or verification
    operations are required.
    ru   r™   rU   rw   c                 C  s    |dkrd }|d urt dƒ‚|S )Nr=   z*When alg = "none", key value must be None.r   r�   rc   rc   rd   r‚   1  s
   zNoneAlgorithm.prepare_keyr„   ri   c                 C  r€   )Nó    rc   r…   rc   rc   rd   r†   :  ó   zNoneAlgorithm.signr‡   rˆ   c                 C  r€   )NFrc   r‰   rc   rc   rd   rŠ   =  r¢   zNoneAlgorithm.verifyFr‹   r   rŒ   r	   c                 C  ó   t ƒ ‚rx   ©rm   r�   rc   rc   rd   r�   @  ó   zNoneAlgorithm.to_jwkr•   r–   c                 C  r£   rx   r¤   r—   rc   rc   rd   r˜   D  r¥   zNoneAlgorithm.from_jwkN)ru   r™   rU   rw   )r„   ri   ru   rw   rU   ri   )r„   ri   ru   rw   r‡   ri   rU   rˆ   r›   )r‹   r   rŒ   rˆ   rU   r	   )r•   r–   rU   r	   )
ry   rœ   r�   rž   r‚   r†   rŠ   r    r�   r˜   rc   rc   rc   rd   rX   +  s    

	
rX   c                   @  s²   e Zd ZU dZejZded< ejZ	ded< ej
Zded< d,d
d„Zd-dd„Zeed.dd„ƒƒZeed/d0dd„ƒƒZed/d1dd„ƒZed2d d!„ƒZd3d#d$„Zd4d&d'„Zd5d)d*„Zd+S )6rY   zf
    Performs signing and verification operations using HMAC
    and the specified hash function.
    zClassVar[HashlibHash]rZ   r[   r\   rj   r   rU   rw   c                 C  ó
   || _ d S rx   ©rj   ©rs   rj   rc   rc   rd   Ú__init__S  ó   
zHMACAlgorithm.__init__ru   ústr | bytesri   c                 C  s$   t |ƒ}t|ƒst|ƒrtdƒ‚|S )NzdThe specified key is an asymmetric key or x509 certificate and should not be used as an HMAC secret.)r   r   r   r   )rs   ru   Ú	key_bytesrc   rc   rd   r‚   V  s   ÿzHMACAlgorithm.prepare_keyr‹   rŒ   r�   r   c                 C  rŽ   rx   rc   r�   rc   rc   rd   r�   a  ó   zHMACAlgorithm.to_jwkFr‘   r’   c                 C  rŽ   rx   rc   r�   rc   rc   rd   r�   e  r­   rˆ   r”   c                 C  s(   t t| ƒƒ ¡ ddœ}|r|S t |¡S )NÚoct)ÚkÚkty)r   r   ÚdecodeÚjsonÚdumps)r‹   rŒ   r•   rc   rc   rd   r�   i  s   þ
r•   r–   c                 C  sj   zt | tƒrt | ¡}n
t | tƒr| }nt‚W n ty#   tdƒd ‚w | d¡dkr/tdƒ‚t|d ƒS )NúKey is not valid JSONr°   r®   zNot an HMAC keyr¯   )	rn   r’   r²   ÚloadsÚdictr}   r   Úgetr   )r•   Úobjrc   rc   rd   r˜   u  s   

€
ÿzHMACAlgorithm.from_jwkr™   c                 C  s@   |   ¡ j}t|ƒ|k rdt|ƒ› d|› d|   ¡ j ¡ › d�S d S )NzThe HMAC key is z> bytes long, which is below the minimum recommended length of z bytes for z. See RFC 7518 Section 3.2.)rj   Údigest_sizeÚlenÚnameÚupper)rs   ru   Z
min_lengthrc   rc   rd   rš   †  s   
ÿþÿzHMACAlgorithm.check_key_lengthr„   c                 C  s   t  ||| j¡ ¡ S rx   )ÚhmacÚnewrj   rr   r…   rc   rc   rd   r†   ‘  ó   zHMACAlgorithm.signr‡   c                 C  s   t  ||  ||¡¡S rx   )r½   Úcompare_digestr†   r‰   rc   rc   rd   rŠ   ”  r¿   zHMACAlgorithm.verifyN)rj   r   rU   rw   )ru   r«   rU   ri   )r‹   r«   rŒ   r�   rU   r   r›   )r‹   r«   rŒ   r‘   rU   r’   )r‹   r«   rŒ   rˆ   rU   r”   )r•   r–   rU   ri   )ru   ri   rU   r™   )r„   ri   ru   ri   rU   ri   )r„   ri   ru   ri   r‡   ri   rU   rˆ   )ry   rœ   r�   rž   ÚhashlibÚsha256rZ   rŸ   Úsha384r[   Úsha512r\   r©   r‚   r   r    r�   r˜   rš   r†   rŠ   rc   rc   rc   rd   rY   I  s(   
 



rY   c                   @  sÂ   e Zd ZU dZejZded< ejZded< ejZded< e	Z
dZded< d2dd„Zd3dd„Zd4dd„Zeed5dd„ƒƒZeed6d7d d„ƒƒZed6d8d#d„ƒZed9d&d'„ƒZd:d+d,„Zd;d/d0„Zd1S )<r_   z~
        Performs signing and verification operations using
        RSASSA-PKCS-v1_5 and the specified hash function.
        ú$ClassVar[type[hashes.HashAlgorithm]]rZ   r[   r\   i   zClassVar[int]Ú_MIN_KEY_SIZErj   útype[hashes.HashAlgorithm]rU   rw   c                 C  r¦   rx   r§   r¨   rc   rc   rd   r©   §  rª   zRSAAlgorithm.__init__ru   rC   r™   c                 C  s&   |j | jk rd|j › d| j› d�S d S )NzThe RSA key is z; bits long, which is below the minimum recommended size of z bits. See NIST SP 800-131A.)Úkey_sizerÆ   r�   rc   rc   rd   rš   ª  s   
ÿÿzRSAAlgorithm.check_key_lengthúAllowedRSAKeys | str | bytesc                 C  sÈ   t || jƒr|S t |ttfƒstdƒ‚t|ƒ}z%| d¡r,t|ƒ}|  |¡ t	t
|ƒW S t|d d�}|  |¡ t	t|ƒW S  tyc   zt|ƒ}|  |¡ t	t
|ƒW  Y S  ttfyb   tdƒd ‚w w )NúExpecting a PEM-formatted key.s   ssh-rsa©Úpasswordz(Could not parse the provided public key.)rn   rg   ri   r’   Ú	TypeErrorr   Ú
startswithr<   r   r   r0   r:   r.   r}   r;   r   r   )rs   ru   r¬   Ú
public_keyÚprivate_keyrc   rc   rd   r‚   ³  s8   

ÿ

ÿþÿûzRSAAlgorithm.prepare_keyr‹   rŒ   r�   r   c                 C  rŽ   rx   rc   r�   rc   rc   rd   r�   Ñ  r­   zRSAAlgorithm.to_jwkFr‘   r’   c                 C  rŽ   rx   rc   r�   rc   rc   rd   r�   Õ  r­   rˆ   r”   c                 C  sÚ   d }t | dƒrD|  ¡ }ddgt|jjƒ ¡ t|jjƒ ¡ t|jƒ ¡ t|jƒ ¡ t|j	ƒ ¡ t|j
ƒ ¡ t|jƒ ¡ t|jƒ ¡ dœ
}n t | dƒr`|  ¡ }ddgt|jƒ ¡ t|jƒ ¡ dœ}ntdƒ‚|rh|S t |¡S )NÚprivate_numbersÚRSAr†   )
r°   Úkey_opsÚnÚeÚdÚpÚqÚdpÚdqÚqirŠ   )r°   rÓ   rÔ   rÕ   úNot a public or private key)ÚhasattrrÑ   r   Úpublic_numbersrÔ   r±   rÕ   rÖ   r×   rØ   Údmp1Údmq1Úiqmpr   r²   r³   )r‹   rŒ   r¸   Únumbersrc   rc   rd   r�   Ù  s2   
ö
ü
r•   r–   c           	   	     s²  zt | tƒrt | ¡‰ n
t | tƒr| ‰ nt‚W n ty#   tdƒd ‚w ˆ  d¡dkr0tdƒd ‚dˆ v r¾dˆ v r¾dˆ v r¾dˆ v rDtd	ƒ‚g d
¢}‡ fdd„|D ƒ}t|ƒ}|r`t	|ƒs`tdƒd ‚t
tˆ d ƒtˆ d ƒƒ}|r–ttˆ d ƒtˆ d ƒtˆ d ƒtˆ d ƒtˆ d ƒtˆ d ƒ|d�}| ¡ S tˆ d ƒ}t|j||jƒ\}}t|||t||ƒt||ƒt||ƒ|d�}| ¡ S dˆ v rÕdˆ v rÕt
tˆ d ƒtˆ d ƒƒ ¡ S tdƒ‚)Nr´   r°   rÒ   zNot an RSA keyrÖ   rÕ   rÔ   Zothz5Unsupported RSA private key: > 2 primes not supported)r×   rØ   rÙ   rÚ   rÛ   c                   s   g | ]}|ˆ v ‘qS rc   rc   )rz   Úprop©r¸   rc   rd   Ú
<listcomp>  s    z)RSAAlgorithm.from_jwk.<locals>.<listcomp>z@RSA key must include all parameters if any are present besides dr×   rØ   rÙ   rÚ   rÛ   )rÖ   r×   rØ   rß   rà   rá   rÞ   rÜ   )rn   r’   r²   rµ   r¶   r}   r   r·   ÚanyÚallr1   r   r/   r5   rÔ   rÕ   r2   r3   r4   rÐ   rÏ   )	r•   Zother_propsZprops_foundZany_props_foundrÞ   râ   rÖ   r×   rØ   rc   rä   rd   r˜      s~   

€
ÿ
ÿÿþ

þ





ùñ
ÿù


þýzRSAAlgorithm.from_jwkr„   ri   r.   c                 C  s   |  |t ¡ |  ¡ ¡}|S rx   )r†   r   ÚPKCS1v15rj   ©rs   r„   ru   Ú	signaturerc   rc   rd   r†   H  s   zRSAAlgorithm.signr0   r‡   c                 C  s4   z|  ||t ¡ |  ¡ ¡ W dS  ty   Y dS w )NTF)rŠ   r   rè   rj   r   r‰   rc   rc   rd   rŠ   L  s   ÿzRSAAlgorithm.verifyN)rj   rÇ   rU   rw   )ru   rC   rU   r™   )ru   rÉ   rU   rC   )r‹   rC   rŒ   r�   rU   r   r›   )r‹   rC   rŒ   r‘   rU   r’   )r‹   rC   rŒ   rˆ   rU   r”   )r•   r–   rU   rC   ©r„   ri   ru   r.   rU   ri   ©r„   ri   ru   r0   r‡   ri   rU   rˆ   )ry   rœ   r�   rž   r   rZ   rŸ   r[   r\   ÚALLOWED_RSA_KEY_TYPESrg   rÆ   r©   rš   r‚   r   r    r�   r˜   r†   rŠ   rc   rc   rc   rd   r_   š  s,   
 


	&
Gr_   c                   @  sº   e Zd ZU dZejZded< ejZded< ejZded< e	Z
	d/d0dd„Zd1dd„Zd2dd„Zd3dd„Zd4dd„Zeed5d#d$„ƒƒZeed6d7d(d$„ƒƒZed6d8d*d$„ƒZed9d-d.„ƒZdS ):r`   zr
        Performs signing and verification operations using
        ECDSA and the specified hash function
        rÅ   rZ   r[   r\   Nrj   rÇ   Úexpected_curveútype[EllipticCurve] | NonerU   rw   c                 C  s   || _ || _d S rx   )rj   rî   )rs   rj   rî   rc   rc   rd   r©   _  s   
zECAlgorithm.__init__ru   rD   c                 C  s>   | j du rdS t|j| j ƒstd|jj› d| j j› d�ƒ‚dS )z9Validate that the key's curve matches the expected curve.NzThe key's curve 'z%' does not match the expected curve 'z' for this algorithm)rî   rn   Úcurver   r»   r�   rc   rc   rd   Ú_validate_curveg  s   
ÿÿÿzECAlgorithm._validate_curveúAllowedECKeys | str | bytesc                 C  sº   t || jƒr|  |¡ |S t |ttfƒstdƒ‚t|ƒ}z | d¡r't|ƒ}nt	|ƒ}|  
|¡ tt|ƒ}|  |¡ |W S  ty\   t|d d�}|  
|¡ tt|ƒ}|  |¡ | Y S w )NrÊ   s   ecdsa-sha2-rË   )rn   rg   rñ   ri   r’   rÍ   r   rÎ   r<   r;   r   r   r(   r}   r:   r&   )rs   ru   r¬   rÏ   Zec_public_keyrÐ   Zec_private_keyrc   rc   rd   r‚   r  s*   








ûzECAlgorithm.prepare_keyr„   ri   r&   c                 C  s    |  |t|  ¡ ƒ¡}t||jƒS rx   )r†   r    rj   r   rð   )rs   r„   ru   Úder_sigrc   rc   rd   r†   ‘  s   zECAlgorithm.signr‡   rˆ   c                 C  sn   zt ||jƒ}W n
 ty   Y dS w zt|tƒr| ¡ n|}| ||t|  ¡ ƒ¡ W dS  t	y6   Y dS w )NFT)
r   rð   r}   rn   r&   rÏ   rŠ   r    rj   r   )rs   r„   ru   r‡   ró   rÏ   rc   rc   rd   rŠ   –  s   ÿ
ÿýÿzECAlgorithm.verifyr‹   rŒ   r�   r   c                 C  rŽ   rx   rc   r�   rc   rc   rd   r�   §  r­   zECAlgorithm.to_jwkFr‘   r’   c                 C  rŽ   rx   rc   r�   rc   rc   rd   r�   «  r­   r”   c                 C  sø   t | tƒr|  ¡  ¡ }nt | tƒr|  ¡ }ntdƒ‚t | jtƒr#d}n#t | jtƒr,d}nt | jt	ƒr5d}nt | jt
ƒr>d}ntd| j› �ƒ‚d|t|j| jjd� ¡ t|j| jjd� ¡ d	œ}t | tƒrst|  ¡ j| jjd� ¡ |d
< |rw|S t |¡S )NrÜ   úP-256úP-384úP-521Ú	secp256k1úInvalid curve: ÚEC)Ú
bit_length)r°   ÚcrvÚxÚyrÖ   )rn   r&   rÏ   rÞ   r(   r   rð   r"   r#   r$   r!   r   rü   rÈ   r±   rý   rÑ   Zprivate_valuer²   r³   )r‹   rŒ   rÞ   rû   r¸   rc   rc   rd   r�   ¯  sJ   


þþö
þý
r•   r–   c                 C  s  zt | tƒrt | ¡}n
t | tƒr| }nt‚W n ty#   tdƒd ‚w | d¡dkr0tdƒd ‚d|vs8d|vr=tdƒd ‚t| d¡ƒ}t| d¡ƒ}| d¡}|dkrmt	|ƒt	|ƒ  krbd	krhn nt
ƒ }netd
ƒd ‚|dkrŠt	|ƒt	|ƒ  krdkr…n ntƒ }nHtdƒd ‚|dkr§t	|ƒt	|ƒ  krœdkr¢n ntƒ }n+tdƒd ‚|dkrÆt	|ƒt	|ƒ  kr¹d	krÂn tdƒ‚tƒ }ntdƒ‚td|› �ƒ‚ttj|dd�tj|dd�|d�}d|vræ| ¡ S t| d¡ƒ}t	|ƒt	|ƒkrýtdt	|ƒ|ƒ‚ttj|dd�|ƒ ¡ S )Nr´   r°   rù   zNot an Elliptic curve keyrü   rý   rû   rô   é    z)Coords should be 32 bytes for curve P-256rõ   é0   z)Coords should be 48 bytes for curve P-384rö   éB   z)Coords should be 66 bytes for curve P-521r÷   z-Coords should be 32 bytes for curve secp256k1rø   Úbig)Ú	byteorder)rü   rý   rð   rÖ   z!D should be {} bytes for curve {})rn   r’   r²   rµ   r¶   r}   r   r·   r   rº   r"   r#   r$   r!   r)   ÚintÚ
from_bytesrÏ   r'   rÐ   )r•   r¸   rü   rý   rð   Z	curve_objrÞ   rÖ   rc   rc   rd   r˜   Û  sˆ   

€
ÿ


 ÿþ ÿþ ÿþÿþÿý
ÿÿþzECAlgorithm.from_jwkrx   )rj   rÇ   rî   rï   rU   rw   )ru   rD   rU   rw   )ru   rò   rU   rD   )r„   ri   ru   r&   rU   ri   )r„   ri   ru   rD   r‡   ri   rU   rˆ   )r‹   rD   rŒ   r�   rU   r   r›   )r‹   rD   rŒ   r‘   rU   r’   )r‹   rD   rŒ   rˆ   rU   r”   )r•   r–   rU   rD   )ry   rœ   r�   rž   r   rZ   rŸ   r[   r\   ÚALLOWED_EC_KEY_TYPESrg   r©   rñ   r‚   r†   rŠ   r   r    r�   r˜   rc   rc   rc   rd   r`   S  s,   
 ý



+r`   c                   @  s$   e Zd ZdZddd„Zddd„ZdS )ra   zA
        Performs a signature using RSASSA-PSS with MGF1
        r„   ri   ru   r.   rU   c                 C  s0   |  |tjt |  ¡ ¡|  ¡ jd�|  ¡ ¡}|S )N©ZmgfZsalt_length)r†   r   ÚPSSÚMGF1rj   r¹   ré   rc   rc   rd   r†   *  s   þúzRSAPSSAlgorithm.signr0   r‡   rˆ   c              	   C  sJ   z|  ||tjt |  ¡ ¡|  ¡ jd�|  ¡ ¡ W dS  ty$   Y dS w )Nr  TF)rŠ   r   r  r  rj   r¹   r   r‰   rc   rc   rd   rŠ   5  s   þù	ÿzRSAPSSAlgorithm.verifyNrë   rì   )ry   rœ   r�   rž   r†   rŠ   rc   rc   rc   rd   ra   %  s    
ra   c                   @  s€   e Zd ZdZeZd'dd„Zd(dd„Zd)dd„Zd*dd„Z	e
ed+dd„ƒƒZe
ed,d-dd„ƒƒZed,d.d!d„ƒZed/d$d%„ƒZd&S )0rb   zŽ
        Performs signing and verification operations using EdDSA

        This class requires ``cryptography>=2.6`` to be installed.
        Úkwargsr   rU   rw   c                 K  rŽ   rx   rc   )rs   r	  rc   rc   rd   r©   M  r¢   zOKPAlgorithm.__init__ru   úAllowedOKPKeys | str | bytesrE   c                 C  sª   t |ttfƒs|  |¡ |S t |tƒr| d¡n|}t |tƒr$| d¡n|}d|v r/t|ƒ}nd|v r:t|d d�}n|dd… dkrGt|ƒ}nt	dƒ‚|  |¡ t
d	|ƒS )
Núutf-8z-----BEGIN PUBLICz-----BEGIN PRIVATErË   r   é   zssh-rÜ   rE   )rn   r’   ri   r   r±   Úencoder;   r:   r<   r   r   )rs   ru   Zkey_strr¬   Z
loaded_keyrc   rc   rd   r‚   P  s   




zOKPAlgorithm.prepare_keyr„   r«   ú#Ed25519PrivateKey | Ed448PrivateKeyri   c                 C  s&   t |tƒr
| d¡n|}| |¡}|S )aS  
            Sign a message ``msg`` using the EdDSA private key ``key``
            :param str|bytes msg: Message to sign
            :param Ed25519PrivateKey}Ed448PrivateKey key: A :class:`.Ed25519PrivateKey`
                or :class:`.Ed448PrivateKey` isinstance
            :return bytes signature: The signature, as bytes
            r  N)rn   r’   r  r†   )rs   r„   ru   Ú	msg_bytesrê   rc   rc   rd   r†   f  s   

zOKPAlgorithm.signr‡   rˆ   c                 C  sr   z.t |tƒr| d¡n|}t |tƒr| d¡n|}t |ttfƒr$| ¡ n|}| ||¡ W dS  ty8   Y dS w )aÄ  
            Verify a given ``msg`` against a signature ``sig`` using the EdDSA key ``key``

            :param str|bytes sig: EdDSA signature to check ``msg`` against
            :param str|bytes msg: Message to sign
            :param Ed25519PrivateKey|Ed25519PublicKey|Ed448PrivateKey|Ed448PublicKey key:
                A private or public EdDSA key instance
            :return bool verified: True if signature is valid, False if not.
            r  TFN)rn   r’   r  r,   r*   rÏ   rŠ   r   )rs   r„   ru   r‡   r  Z	sig_bytesrÏ   rc   rc   rd   rŠ   t  s   
ÿýÿzOKPAlgorithm.verifyrŒ   r�   r   c                 C  rŽ   rx   rc   ©ru   rŒ   rc   rc   rd   r�   Ž  r­   zOKPAlgorithm.to_jwkFr‘   r’   c                 C  rŽ   rx   rc   r  rc   rc   rd   r�   ’  r­   r”   c                 C  sè   t | ttfƒr.| jtjtjd�}t | tƒrdnd}tt|ƒƒ 	¡ d|dœ}|r)|S t
 |¡S t | ttfƒrp| jtjtjtƒ d�}|  ¡ jtjtjd�}t | tƒrRdnd}tt|ƒƒ 	¡ tt|ƒƒ 	¡ d|dœ}|rk|S t
 |¡S tdƒ‚)	N)ÚencodingÚformatÚEd25519ÚEd448ÚOKP)rü   r°   rû   )r  r  Zencryption_algorithm)rü   rÖ   r°   rû   rÜ   )rn   r-   r+   Úpublic_bytesr6   ZRawr9   r   r   r±   r²   r³   r,   r*   Zprivate_bytesr8   r7   rÏ   r   )ru   rŒ   rü   rû   r¸   rÖ   rc   rc   rd   r�   –  sB   þý
ýþü
r•   r–   c              
   C  s  zt | tƒrt | ¡}n
t | tƒr| }nt‚W n ty#   tdƒd ‚w | d¡dkr/tdƒ‚| d¡}|dkrC|dkrCtd|› �ƒ‚d	|vrKtd
ƒ‚t| d	¡ƒ}z+d|vrg|dkrat	 
|¡W S t 
|¡W S t| d¡ƒ}|dkrxt |¡W S t |¡W S  tyŽ } ztdƒ|‚d }~ww )Nr´   r°   r  zNot an Octet Key Pairrû   r  r  rø   rü   zOKP should have "x" parameterrÖ   zInvalid key parameter)rn   r’   r²   rµ   r¶   r}   r   r·   r   r-   Zfrom_public_bytesr+   r,   Zfrom_private_bytesr*   )r•   r¸   rð   rü   rÖ   Úerrrc   rc   rd   r˜   Å  s>   

€
ÿ

€ÿzOKPAlgorithm.from_jwkN)r	  r   rU   rw   )ru   r
  rU   rE   )r„   r«   ru   r  rU   ri   )r„   r«   ru   rE   r‡   r«   rU   rˆ   )ru   rE   rŒ   r�   rU   r   r›   )ru   rE   rŒ   r‘   rU   r’   )ru   rE   rŒ   rˆ   rU   r”   )r•   r–   rU   rE   )ry   rœ   r�   rž   ÚALLOWED_OKP_KEY_TYPESrg   r©   r‚   r†   rŠ   r   r    r�   r˜   rc   rc   rc   rd   rb   D  s"    



.rb   )rU   rV   )mÚ
__future__r   rÁ   r½   r²   ÚosÚabcr   r   Útypingr   r   r   r   r	   r
   r   r   Ú
exceptionsr   Útypesr   r   Úutilsr   r   r   r   r   r   r   r   r   Zcryptography.exceptionsr   r   Zcryptography.hazmat.backendsr   Zcryptography.hazmat.primitivesr   Z)cryptography.hazmat.primitives.asymmetricr   Z,cryptography.hazmat.primitives.asymmetric.ecr    r!   r"   r#   r$   r%   r&   r'   r(   r)   Z/cryptography.hazmat.primitives.asymmetric.ed448r*   r+   Z1cryptography.hazmat.primitives.asymmetric.ed25519r,   r-   Z-cryptography.hazmat.primitives.asymmetric.rsar.   r/   r0   r1   r2   r3   r4   r5   Z,cryptography.hazmat.primitives.serializationr6   r7   r8   r9   r:   r;   r<   rí   r  r  ZALLOWED_KEY_TYPESZALLOWED_PRIVATE_KEY_TYPESZALLOWED_PUBLIC_KEY_TYPESrˆ   ÚgetenvÚsysÚversion_infor@   Ztyping_extensionsZ/cryptography.hazmat.primitives.asymmetric.typesrA   rB   rC   rŸ   rD   rE   rF   rG   rH   r]   ÚModuleNotFoundErrorZrequires_cryptographyre   rf   rX   rY   r_   r`   ra   rb   rc   rc   rc   rd   Ú<module>   sž    (,0($
ü
ÿüü
ÿ
ÿ
ÿ
ÿÿ
"lO : S � � �Ñ