U uc@sddlZddlZddlmZmZddlZddlmZmZmZm Z m Z ddl Z ddl m Z ddlmZmZddlmZddlmZddlmZd gZz$dd lmZmZmZdd lmZWnek rd ZYnXd Ze dddZ!ddZ"ddZ#GdddZ$e%e&dddZ'ddZ(ddZ)ddZ*d0d!d"Z+d#d$Z,ereee&ee-e&d%d&d'Z.e&ee&d(d)d*Z/Gd+dde0Z1e2e1Gd,d-d-e0Z3e4dd.d/d-gdS)1N)a2b_hexb2a_hex)CallableOptionalUnionDictAny)util)ISecurityModuleICryptosignKey) Challenge)_URI_PAT_REALM_NAME_ETH) parse_keyfileHAS_CRYPTOSIGN)encodingsigningbindings) SignedMessageFT CryptosignKeycCsRg}|rNtd|ddd}|d|d|d|d}}||q|S)z} Unpack a SSH agent key blob into parts. See: http://blog.oddbit.com/2011/05/08/converting-openssh-public-keys/ >INr)structunpackappend)keydatapartsZdlendatarW/var/www/html/VBACK/school/venv/lib/python3.8/site-packages/autobahn/wamp/cryptosign.py_unpack8s " rcCs8g}|D]$}|tdt|||qd|S)z) Pack parts into a SSH key blob. r)rrpacklenjoin)Zkeypartsrpartrrr_packIs  r%c Cst|tkrtdt||}t|dkr>td|\}}}|dkr^td|t|}zt |d}Wn0tk r}ztd|W5d}~XYnXt|d krtd t|||fS) a Parse an OpenSSH Ed25519 public key from a string into a raw public key. Example input: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJukDU5fqXv/yVhSirsDWsUFyOodZyCSLxyitPPzWJW9 oberstet@office-corei7 :param keydata: The OpenSSH Ed25519 public key data to parse. :type keydata: str :returns: pair of raw public key (32 bytes) and comment :rtype: tuple zinvalid type {} for keydatazinvalid SSH Ed25519 public keyz ssh-ed25519z%not a Ed25519 SSH public key (but {})zcould not parse key ({})N z9invalid length {} for embedded raw key (must be 32 bytes)) typestr Exceptionformatstripsplitr"binascii a2b_base64r)rrZalgocommentblobkeyerrr_read_ssh_ed25519_pubkeyTs        r5c@s8eZdZdZddZddZddZdd Zd d Zd S) _SSHPacketReaderzD Read OpenSSH packet format which is used for key material. cCs||_d|_t||_dSNr)_packet_idxr"_len)selfpacketrrr__init__sz_SSHPacketReader.__init__cCs|j|jdSN)r8r9r;rrrget_remaining_payloadsz&_SSHPacketReader.get_remaining_payloadcCs@|j||jkrtd|j|j|j|}|j|7_|S)Nzincomplete packet)r9r:r+r8)r;sizevaluerrr get_bytess z_SSHPacketReader.get_bytescCstd|ddS)Nrrr)rrrCr?rrr get_uint32sz_SSHPacketReader.get_uint32cCs||Sr>)rCrDr?rrr get_stringsz_SSHPacketReader.get_stringN) __name__ __module__ __qualname____doc__r=r@rCrDrErrrrr6zs r6)rAreturncCs8d|krdksntdddtd|dDS)Nrr css|]}|jdddVqdS)r'big) byteorderN)to_bytes.0xrrr sz_makepad..r')AssertionErrorr#range)rArrr_makepadsrUcCsd}d}d}||r ||s(td||}|t||}ddd|D}t|}|t|d}t |}| }| }| | } | | } | } d } |d krtd |d krtd | d krtd | | rtdt | }| | | } | dkr8td | d| }| }t|tjkr`tdt|tjkrxtd| }| }t|rt|| ks|tt|krtd t||tt||dtj}|d}||fS)a Parse an OpenSSH Ed25519 private key from a string into a raw private key. Example input: -----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW QyNTUxOQAAACCbpA1OX6l7/8lYUoq7A1rFBcjqHWcgki8corTz81iVvQAAAKDWjZ0Y1o2d GAAAAAtzc2gtZWQyNTUxOQAAACCbpA1OX6l7/8lYUoq7A1rFBcjqHWcgki8corTz81iVvQ AAAEArodzIMjH9MOBz0X+HDvL06rEJOMYFhzGQ5zXPM7b7fZukDU5fqXv/yVhSirsDWsUF yOodZyCSLxyitPPzWJW9AAAAFm9iZXJzdGV0QG9mZmljZS1jb3JlaTcBAgMEBQYH -----END OPENSSH PRIVATE KEY----- :param keydata: The OpenSSH Ed25519 private key data to parse. :type keydata: str :returns: pair of raw private key (32 bytes) and comment :rtype: tuple #-----BEGIN OPENSSH PRIVATE KEY-----z!-----END OPENSSH PRIVATE KEY-----sopenssh-key-v1zFinvalid OpenSSH private key (does not start/end with OPENSSH preamble)css|]}|VqdSr>)r-rOrrrrRsz,_read_ssh_ed25519_privkey..Nsnonezjencrypted private keys not supported (please remove the passphrase from your private key or use SSH agent)z/passphrase encrypted private keys not supportedr'zAmultiple private keys in a key file not supported (found {} keys)z=invalid OpenSSH private key (found remaining payload for mac)s ssh-ed25519z6invalid key type: we only support Ed25519 (found "{}")asciizinvalid public key lengthzGinvalid OpenSSH private key (padlen={}, actual_pad={}, expected_pad={})) startswithendswithr+findr"r#r.r/r0r6rErDr@r,decoderZcrypto_sign_PUBLICKEYBYTESZcrypto_sign_SECRETKEYBYTESrUZcrypto_sign_SEEDBYTES)r SSH_BEGINZSSH_ENDZOPENSSH_KEY_V1Zssh_endr2r<Z cipher_nameZkdfnkeyskey_dataZmac block_sizeZalgZvkskr1padseedrrr_read_ssh_ed25519_privkeys\   * rec Cs`t|N}t|ddd}t|dkrFtdt||W5QRSQRXdS)z Read a Ed25519 signature file created with OpenBSD signify. http://man.openbsd.org/OpenBSD-current/man1/signify.1 r' N@zEbogus Ed25519 signature: raw signature length was {}, but expected 64openr/r0read splitlinesr"r+r,)signature_filefsigrrr_read_signify_ed25519_signatures   roc Cs`t|N}t|ddd}t|dkrFtdt||W5QRSQRXdS)z Read a public key from a Ed25519 key pair created with OpenBSD signify. http://man.openbsd.org/OpenBSD-current/man1/signify.1 r'rfNr(z@bogus Ed25519 public key: raw key length was {}, but expected 32rh) pubkey_filermpubkeyrrr_read_signify_ed25519_pubkey s   rrtextc Cs|dks tddl}t|}|d}|jd|jd}|||dkrddl}| 0}|j |dd | W5QRW5QRSQRXn>|d krddl }|j |jjjd }|W5QRStd W5QRXdS) a Usage: 1. Get the OpenBSD 5.7 release public key from here http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/etc/signify/Attic/openbsd-57-base.pub?rev=1.1 2. Generate QR Code and print to terminal print(cryptosign._qrcode_from_signify_ed25519_pubkey('openbsd-57-base.pub')) 3. Compare to (scroll down) QR code here https://www.openbsd.org/papers/bsdcan-signify.html )rssvgrNr'r&)Zbox_sizeZerror_correctionrsT)outinvertrt)Z image_factoryz logic error)rSqrcoderirjrkZQRCodeZERROR_CORRECT_LZadd_dataioStringIOZ print_asciigetvalueZqrcode.image.svgZ make_imageimagertZSvgImageZ to_stringr+) rpmoderwrmrqZqrrxZ data_bufferr{rrr#_qrcode_from_signify_ed25519_pubkeys$    (r}cCs*t|}t|}t|}|||dS)a Verify a Ed25519 signature created with OpenBSD signify. This will raise a `nacl.exceptions.BadSignatureError` if the signature is bad and return silently when the signature is good. Usage: 1. Create a signature: signify-openbsd -S -s ~/.signify/crossbario-trustroot.sec -m .profile 2. Verify the signature from autobahn.wamp import cryptosign with open('.profile', 'rb') as f: message = f.read() cryptosign._verify_signify_ed25519_signature('.signify/crossbario-trustroot.pub', '.profile.sig', message) http://man.openbsd.org/OpenBSD-current/man1/signify.1 N)rrr VerifyKeyroverify)rprlmessagerq verify_keyrnrrr!_verify_signify_ed25519_signatureFs r) challengechannel_id_rawchannel_id_typerJcCst|tstdt|d|jkr.td|jd}t|tkrVtdt|t|dkrttdt|t |}|dkrt|dkst d t|t ||}n |d kr|}nd st d ||S) a Format the challenge based on provided parameters :param challenge: The WAMP-cryptosign challenge object for which a signature should be computed. :param channel_id_raw: The channel ID when channel_id_type is 'tls-unique'. :param channel_id_type: The type of the channel id, currently handles 'tls-unique' and ignores otherwise. zCchallenge must be instance of autobahn.wamp.types.Challenge, not {}rz*missing challenge value in challenge.extraz5invalid type {} for challenge (expected a hex string)rgz:unexpected challenge (hex) length: was {}, but expected 64 tls-uniquer(zDunexpected TLS transport channel ID length (was {}, but expected 32)NFzinvalid channel_id_type "{}") isinstancer r+r,r)extrar*r"r/rrSr xor)rrrZ challenge_hexZ challenge_rawrrrr_format_challengens6       r)r signer_funcrJcs0|}tfdd}t||dS)a Sign the provided data using the provided signer. :param data: challenge to sign :param signer_func: The callable function to use for signing :returns: A Deferred/Future that resolves to the computed signature. :rtype: str cs8t|d}td}||}t|dS)NrY)r/rr]txaioresolve)Z signature_rawZ signature_hexZdata_hexrnd2rrrprocesssz _sign_challenge..processN)r create_futureZ add_callbacks)rrd1rrrr_sign_challenges  rc@seZdZdZd2eeeeeeeddddZ e edddd Z e eedd d Z e eedd d Z e edddZe edddZeedddZd3eeeeeedddZd4eeeefdddZed5eeeddddZed6eeeddd d!Zed7eeedd"d#d$Zeedd%d&d'Zeedd(d)d*Zed8eedd,d-d.Zeedd/d0d1ZdS)9rz A cryptosign private key for signing, and hence usable for authentication or a public key usable for verification (but can't be used for signing). N)can_signsecurity_modulekey_nor1rJcCspt|tjs*t|tjs*tdt||r:t|tjsN|sJt|tjsNt||_||_ ||_ ||_ ||_ dS)Nzinvalid type {} for key) rrr~ SigningKeyr+r,r)rS_key _can_sign_security_module_key_no_comment)r;r3rrrr1rrrr=s$zCryptosignKey.__init__r rJcCs|jS)z[ Implements :meth:`autobahn.wamp.interfaces.IKey.security_module`. )rr?rrrrszCryptosignKey.security_modulecCs|jS)zR Implements :meth:`autobahn.wamp.interfaces.IKey.key_no`. )rr?rrrrszCryptosignKey.key_nocCs|jS)zS Implements :meth:`autobahn.wamp.interfaces.IKey.comment`. )rr?rrrr1szCryptosignKey.commentcCsdS)zT Implements :meth:`autobahn.wamp.interfaces.IKey.key_type`. cryptosignrr?rrrkey_typeszCryptosignKey.key_typecCs|jS)zT Implements :meth:`autobahn.wamp.interfaces.IKey.can_sign`. )rr?rrrrszCryptosignKey.can_signrrJcCs:|jstdt|tkr"td|j|}t|jS)zP Implements :meth:`autobahn.wamp.interfaces.IKey.sign`. za signing key required to signz data to be signed must be binary) rr+r)bytesrsignrZcreate_future_success signature)r;rrnrrrrs   zCryptosignKey.sign)r channel_idrrJcCs2|jdkstd|jt|||}t||jS)zd Implements :meth:`autobahn.wamp.interfaces.ICryptosignKey.sign_challenge`. )rzcryptosign-proxyz0unexpected cryptosign challenge with method "{}")methodrSr,rrr)r;rrrrrrrsign_challenges    zCryptosignKey.sign_challengeF)binaryrJcCsBt|jtjr|jj}n|j}|r*|S|jtjddSdS)z Returns the public key part of a signing key or the (public) verification key. :returns: The public key in Hex encoding. :rtype: str or None encoderrYN) rrrrrencoderZ HexEncoderr])r;rr3rrr public_key s  zCryptosignKey.public_key)rqr1rJcCsv|dks&t|tks&tdt|t|tkrDtdt|t|dkrbtdt||t|d|dS)Ninvalid type {} for comment%invalid key type {} (expected binary)r(#invalid key length {} (expected 32)Fr3rr1)r)r* ValueErrorr,rr"rr~)clsrqr1rrr from_pubkeys  zCryptosignKey.from_pubkey)r3r1rJcCsv|dks&t|tks&tdt|t|tkrDtdt|t|dkrbtdt||t|d|dS)Nrrr(rTr)r)r*rr,rr"rr)rr3r1rrr from_bytes)s  zCryptosignKey.from_bytes)filenamer1rJc Csl|dks&t|tks&tdt|t|tkr@td|t|d}|}W5QRX|j||dS)a Load an Ed25519 (private) signing key (actually, the seed for the key) from a raw file of 32 bytes length. This can be any random byte sequence, such as generated from Python code like os.urandom(32) or from the shell dd if=/dev/urandom of=client02.key bs=1 count=32 :param filename: Filename of the key. :param comment: Comment for key (optional). Nrzinvalid type {} for filenamerb)r1)r)r*r+r,rirjr)rrr1rmr`rrr from_file6s  zCryptosignKey.from_file)rrJc Cs2t|d}|d}W5QRX||S)a  Load an Ed25519 key from a SSH key file. The key file can be a (private) signing key (from a SSH private key file) or a (public) verification key (from a SSH public key file). A private key file must be passphrase-less. rzutf-8)rirjr]r-from_ssh_bytes)rrrmr`rrr from_ssh_filePs zCryptosignKey.from_ssh_file)r`rJcCsXd}||r0t|\}}tj|tjd}d}nt|\}}t|}d}||||dS)a  Load an Ed25519 key from SSH key file. The key file can be a (private) signing key (from a SSH private key file) or a (public) verification key (from a SSH public key file). A private key file must be passphrase-less. rVrTFr)rZrerrrZ RawEncoderr5r~)rr`r^r1r3rrrrr\s    zCryptosignKey.from_ssh_bytesr) seedphraseindexrJc Cszddlm}Wn0tk r@}ztd|W5d}~XYnXd|}|||}t|tksftt|dksvt| |}|S)a Create a private key from the given BIP-39 mnemonic seed phrase and index, which can be used to sign and create signatures. :param seedphrase: The BIP-39 seedphrase ("Mnemonic") from which to derive the account. :param index: The account index in account hierarchy defined by the seedphrase. :return: New instance of :class:`EthereumKey` r)mnemonic_to_private_keyz*package autobahn[xbr] not installed ("{}")Nzm/44'/655'/0'/0/{}r() Zautobahn.xbr._mnemonicr ImportError RuntimeErrorr,r)rrSr"r)rrrrr4Zderivation_pathZkey_rawr3rrrfrom_seedphraseqs     zCryptosignKey.from_seedphrase)keyfilerJcCstj|rtj|s&td|t|}|dd}|dkrx|dd}|dkrftd|qt t |Snt t |SdS)aY Create a public or private key from reading the given public or private key file. Here is an example key file that includes an CryptosignKey private key ``private-key-ed25519``, which is loaded in this function, and other fields, which are ignored by this function: .. code-block:: This is a comment (all lines until the first empty line are comments indeed). creator: oberstet@intel-nuci7 created-at: 2022-07-05T12:29:48.832Z user-id: oberstet@intel-nuci7 public-key-ed25519: 7326d9dc0307681cc6940fde0e60eb31a6e4d642a81e55c434462ce31f95deed public-adr-eth: 0x10848feBdf7f200Ba989CDf7E3eEB3EC03ae7768 private-key-ed25519: f750f42b0430e28a2e272c3cedcae4dcc4a1cf33bc345c35099d3322626ab666 private-key-eth: 4d787714dcb0ae52e1c5d2144648c255d660b9a55eac9deeb80d9f506f501025 :param keyfile: Path (relative or absolute) to a public or private keys file. :return: New instance of :class:`CryptosignKey` zkeyfile "{}" is not a filezprivate-key-ed25519Nzpublic-key-ed25519zJneither "private-key-ed25519" nor "public-key-ed25519" found in keyfile {}) ospathexistsisfilerr,rgetrrr/rr)rrrZprivkey_ed25519_hexZpubkey_ed25519_hexrrr from_keyfiles   zCryptosignKey.from_keyfile)NNN)NN)F)N)N)N)r)rFrGrHrIboolrr intr*r=propertyrrr1rrrrr rrr classmethodrrrrrrrrrrrrsR       c@seZdZdZdddddddd d d d d g Zd=eeeeeeeeeeeeeeeeeeeeeeeed ddZ e eedddZ e j eedddZ e eedddZ e j eedddZ e eedddZej eedddZe eedddZej eedddZe eedd d!Zej eedd"d!Ze eedd#d$Zej eedd%d$Ze eedd&d'Zej eedd(d'Ze eedd)d*Zej eedd+d*Ze eedd,d-Zej eedd.d-Ze eedd/d0Zej eedd1d0Ze eedd2d3Zej eedd4d3Ze eedd5d6Zej eedd7d6Zeeeefdd8d9d:Zeeefdd;d<ZdS)>CryptosignAuthextraz3 WAMP-Cryptosign authextra object. _pubkey _trustroot _challenge_channel_binding _channel_id_realm _chain_id _block_no _delegate_seeder _bandwidth _signatureN) rqrchannel_bindingr trustrootrealmchain_idblock_nodelegateseeder bandwidthrc Cs|rt|dkst|r(t|dks(t|r)rr?rrrrqszCryptosignAuthextra.pubkey)rBcCs"|dkst|dkst||_dSNr)r"rSrr;rBrrrrq scCs|jSr>)rr?rrrrszCryptosignAuthextra.trustrootcCs"|dkst|dkst||_dSr)r"rSrrrrrrscCs|jSr>)rr?rrrrszCryptosignAuthextra.challengecCs"|dkst|dkst||_dSNr()r"rSrrrrrrscCs|jSr>)rr?rrrr!sz#CryptosignAuthextra.channel_bindingcCs|dks|dkst||_dS)Nr)rSrrrrrr%scCs|jSr>)rr?rrrr*szCryptosignAuthextra.channel_idcCs"|dkst|dkst||_dSr)r"rSrrrrrr.scCs|jSr>)rr?rrrr3szCryptosignAuthextra.realmcCs"|dkst|dkst||_dSr)r"rSrrrrrr7scCs|jSr>)rr?rrrr<szCryptosignAuthextra.chain_idcCs|dks|dkst||_dSr7)rSrrrrrr@scCs|jSr>)rr?rrrrEszCryptosignAuthextra.block_nocCs|dks|dkst||_dSr7)rSrrrrrrIscCs|jSr>)rr?rrrrNszCryptosignAuthextra.delegatecCs"|dkst|dkst||_dSr)r"rSrrrrrrRscCs|jSr>)rr?rrrrWszCryptosignAuthextra.seedercCs"|dkst|dkst||_dSr)r"rSrrrrrr[scCs|jSr>)rr?rrrr`szCryptosignAuthextra.bandwidthcCs|dks|dkst||_dSr7)rSrrrrrrdscCs|jSr>)rr?rrrriszCryptosignAuthextra.signaturecCs"|dkst|dkst||_dS)Nr)r"rSrrrrrrmsrcCsRt}|dd}|dk r`t|tkr8tdt|t|dkrVtdt|t||_|dd}|dk rt|tkrtdt|t|dkrtdt|t||_ |dd}|dk r t|tkrtd t||d krtd |||_ |d d}|dk rlt|tkrBtd t|t|dkrbtdt|t||_ |dd}|dk rt|tkrtdt|t |stdt|t|dd|_|dd}|dk rt|tkrtdt||dd}|dk rDt|tkr>tdt|||_|dd} | dk rt| tkrztdt| | |_|dd} | dk rt| tkrtdt| t | stdt| t| dd|_|dd} | dk rLt| tkrtdt| t | s:tdt| t| dd|_|dd} | dk rt| tkrtd t| t | std!t| t| dd|_|d"d} | dk rt| tkrtd#t| | |_|d$d}|dk rNt|tkr$td%t|t|d&krDtd't|t||_|S)(Nrqzinvalid type {} for pubkeyrgzinvalid length {} of pubkeyrzinvalid type {} for challengezinvalid length {} of challengerz#invalid type {} for channel_bindingrz&invalid value "{}" for channel_bindingrzinvalid type {} for channel_idzinvalid length {} of channel_idrz1invalid type {} for trustroot - expected a stringz?invalid value "{}" for trustroot - expected an Ethereum address reservationzinvalid type {} for reservationrz>invalid type {} for reservation.chain_id - expected an integerrz>invalid type {} for reservation.block_no - expected an integerrz9invalid type {} for reservation.realm - expected a stringzGinvalid value "{}" for reservation.realm - expected an Ethereum addressrz||d <|j dk r\t|j |d<|S)Nrqrrr0xrrrrrrrrr)rrr]rrrrrrrrrrr)r;resrrrrmarshals:                zCryptosignAuthextra.marshal) NNNNNNNNNNNN)rFrGrHrI __slots__rrr*rr=rrqsetterrrrrrrrrrrr staticmethodrrrrrrrrrs 4drZformat_challenger)rs)5rr/rrrtypingrrrrrrautobahnr Zautobahn.wamp.interfacesr r Zautobahn.wamp.typesr Zautobahn.wamp.messager Z autobahn.utilr__all__ZnaclrrrZ nacl.signingrrrrrr%r5r6rrrUrerorrr}rr*rrobjectrregisterrextendrrrrsP       &d +&, A