a ‚oeÒ,ã@sddlmZddlZddlmZmZmZddlmZm Z ddl m Z ddl m Z ejrbddlmZdd d œd d „Zd ddœdd„Zd dœdd„Zd d dœdd„Zd dddœdd„Zd ddddœdd„Zd d ddd d!œd"d#„ZGd$d„de jƒZGd%d „d e jƒZdS)&é)Ú annotationsN)ÚInvalidSignatureÚUnsupportedAlgorithmÚ_Reasons)Ú_calculate_digest_and_algorithmÚ_evp_pkey_derive)Ú serialization)Úec)ÚBackendú"ec.EllipticCurveSignatureAlgorithmÚNone)Úsignature_algorithmÚreturncCst|tjƒstdtjƒ‚dS)Nz/Unsupported elliptic curve signature algorithm.)Ú isinstancer ZECDSArrZ UNSUPPORTED_PUBLIC_KEY_ALGORITHM)r ©rúHC:\Program Files\Certbot\pkgs\cryptography\hazmat\backends\openssl\ec.pyÚ_check_signature_algorithms  þrr Ústr)ÚbackendrcCs’|j |¡}| ||jjk¡|j |¡}||jjkr>tdƒ‚|jjs^|j  |¡dkr^tdƒ‚|j  |¡}| ||jjk¡|j  |¡  d¡}|S)Nz@ECDSA keys with explicit parameters are unsupported at this timerÚascii) Ú_libÚEC_KEY_get0_groupÚopenssl_assertÚ_ffiÚNULLÚEC_GROUP_get_curve_nameZ NID_undefÚ ValueErrorZCRYPTOGRAPHY_IS_LIBRESSLZEC_GROUP_get_asn1_flagZ OBJ_nid2snÚstringÚdecode)rZec_keyÚgroupZnidZ curve_nameÚsnrrrÚ_ec_key_curve_sn#s$   ÿÿþÿ r!©rcCs|j ||jj¡dS)z¡ Set the named curve flag on the EC_KEY. This causes OpenSSL to serialize EC keys along with their curve OID which makes deserialization easier. N)rZEC_KEY_set_asn1_flagZOPENSSL_EC_NAMED_CURVE)rÚec_cdatarrrÚ_mark_asn1_named_ec_curveAsÿr$cCsV|j |¡}| ||jjk¡|j |¡}| ||jjk¡|j ||¡rRtdƒ‚dS)Nz;Cannot load an EC public key where the point is at infinity)rÚEC_KEY_get0_public_keyrrrrZEC_POINT_is_at_infinityr)rr#ÚpointrrrrÚ_check_key_infinityMs  ÿr'úec.EllipticCurve)rr rcCs8ztj|ƒWSty2t|›d�tjƒ‚Yn0dS)Nz" is not a supported elliptic curve)r Z _CURVE_TYPESÚKeyErrorrrZUNSUPPORTED_ELLIPTIC_CURVE)rr rrrÚ_sn_to_elliptic_curveXs þr*Ú_EllipticCurvePrivateKeyÚbytes)rÚ private_keyÚdatarcCsz|j |j¡}| |dk¡|j d|¡}|j dd¡}|j d|t|ƒ|||j¡}| |dk¡|j |¡d|d…S)Nrzunsigned char[]zunsigned int[]é) rZ ECDSA_sizeÚ_ec_keyrrÚnewZ ECDSA_signÚlenÚbuffer)rr-r.Zmax_sizeZsigbufZ siglen_ptrÚresrrrÚ_ecdsa_sig_signbsÿr5Ú_EllipticCurvePublicKey)rÚ public_keyÚ signaturer.rcCs8|j d|t|ƒ|t|ƒ|j¡}|dkr4| ¡t‚dS)Nrr/)rZ ECDSA_verifyr2r0Z_consume_errorsr)rr7r8r.r4rrrÚ_ecdsa_sig_verifyqs ÿr9c@s’eZdZddœdd„Zeddœdd„ƒZed dœd d „ƒZd d ddœdd„Zd dœdd„Zddœdd„Z dddddœdd„Z ddddœdd „Z d!S)"r+r r"cCs@||_||_||_t||ƒ}t||ƒ|_t||ƒt||ƒdS©N©Ú_backendr0Ú _evp_pkeyr!r*Ú_curver$r'©ÚselfrZ ec_key_cdataÚevp_pkeyr rrrÚ__init__€s   z!_EllipticCurvePrivateKey.__init__r(©rcCs|jSr:©r>©r@rrrÚcurveŠsz_EllipticCurvePrivateKey.curveÚintcCs|jjSr:©rFÚkey_sizerErrrrIŽsz!_EllipticCurvePrivateKey.key_sizezec.ECDHzec.EllipticCurvePublicKeyr,)Ú algorithmÚpeer_public_keyrcCsD|j ||j¡stdtjƒ‚|jj|jjkr4tdƒ‚t|j|j |ƒS)Nz1This backend does not support the ECDH algorithm.z2peer_public_key and self are not on the same curve) r<Z+elliptic_curve_exchange_algorithm_supportedrFrrZUNSUPPORTED_EXCHANGE_ALGORITHMÚnamerrr=)r@rJrKrrrÚexchange’sÿÿþÿz!_EllipticCurvePrivateKey.exchangecCs |jj |j¡}|j ||jjjk¡|jj |¡}|j |¡}|jj  |j¡}|j ||jjjk¡|jj  ||¡}|j |dk¡|j  |¡}t |j||ƒS©Nr/) r<rrr0rrrrZ_ec_key_new_by_curve_nidr%ZEC_KEY_set_public_keyZ_ec_cdata_to_evp_pkeyr6)r@rZ curve_nidZ public_ec_keyr&r4rArrrr7¦s  z#_EllipticCurvePrivateKey.public_keyzec.EllipticCurvePrivateNumberscCs2|jj |j¡}|j |¡}tj|| ¡ ¡d�S)N)Ú private_valueÚpublic_numbers) r<rZEC_KEY_get0_private_keyr0Ú _bn_to_intr ZEllipticCurvePrivateNumbersr7rP)r@ZbnrOrrrÚprivate_numbers·s   þz(_EllipticCurvePrivateKey.private_numbersúserialization.Encodingzserialization.PrivateFormatz(serialization.KeySerializationEncryption)ÚencodingÚformatÚencryption_algorithmrcCs|j |||||j|j¡Sr:)r<Z_private_key_bytesr=r0)r@rTrUrVrrrÚ private_bytes¿súz&_EllipticCurvePrivateKey.private_bytesr )r.r rcCs&t|ƒt||jƒ\}}t|j||ƒSr:)rrrJr5r<)r@r.r Ú_rrrÚsignÎs þz_EllipticCurvePrivateKey.signN) Ú__name__Ú __module__Ú __qualname__rBÚpropertyrFrIrMr7rRrWrYrrrrr+s c@s’eZdZddœdd„Zeddœdd„ƒZed dœd d „ƒZd d dœdd„Zddœdd„Zdddœdd„Z ddddœdd„Z dddddœd d!„Z d"S)#r6r r"cCs@||_||_||_t||ƒ}t||ƒ|_t||ƒt||ƒdSr:r;r?rrrrBÜs   z _EllipticCurvePublicKey.__init__r(rCcCs|jSr:rDrErrrrFæsz_EllipticCurvePublicKey.curverGcCs|jjSr:rHrErrrrIêsz _EllipticCurvePublicKey.key_sizeÚobjectÚbool)ÚotherrcCs&t|tƒstS|jj |j|j¡dkSrN)rr6ÚNotImplementedr<rZ EVP_PKEY_cmpr=)r@r`rrrÚ__eq__îs  ÿÿz_EllipticCurvePublicKey.__eq__zec.EllipticCurvePublicNumbersc Csâ|jj |j¡}|j ||jjjk¡|jj |j¡}|j ||jjjk¡|j ¡�j}|jj  |¡}|jj  |¡}|jj  |||||¡}|j |dk¡|j  |¡}|j  |¡}Wdƒn1sÆ0Yt j |||jd�S)Nr/)ÚxÚyrF)r<rrr0rrrr%Ú _tmp_bn_ctxZ BN_CTX_getZEC_POINT_get_affine_coordinatesrQr ZEllipticCurvePublicNumbersr>) r@rr&Úbn_ctxZbn_xZbn_yr4rcrdrrrrP÷s  ÿ *z&_EllipticCurvePublicKey.public_numberszserialization.PublicFormatr,)rUrc Cs&|tjjur|jjj}n|tjjus(J‚|jjj}|jj |j ¡}|j  ||jj j k¡|jj  |j ¡}|j  ||jj j k¡|j ¡�v}|jj ||||jj j d|¡}|j  |dk¡|jj  d|¡}|jj ||||||¡}|j  ||k¡Wdƒn1�s0Y|jj  |¡dd…S)Nrzchar[])rÚ PublicFormatÚCompressedPointr<rZPOINT_CONVERSION_COMPRESSEDÚUncompressedPointZPOINT_CONVERSION_UNCOMPRESSEDrr0rrrr%reZEC_POINT_point2octr1r3) r@rUÚ conversionrr&rfÚbuflenÚbufr4rrrÚ _encode_point s&    ÿ ÿ0z%_EllipticCurvePublicKey._encode_pointrS)rTrUrcCsp|tjjus$|tjjus$|tjjurV|tjjusD|tjjtjjfvrLtdƒ‚| |¡S|j  ||||j d¡SdS)NzKX962 encoding must be used with CompressedPoint or UncompressedPoint format) rZEncodingZX962rgrhrirrmr<Z_public_key_bytesr=)r@rTrUrrrÚ public_bytes$s" ÿ þ ýþÿ  ÿz$_EllipticCurvePublicKey.public_bytesr r )r8r.r rcCs,t|ƒt||jƒ\}}t|j|||ƒdSr:)rrrJr9r<)r@r8r.r rXrrrÚverify=s þz_EllipticCurvePublicKey.verifyN) rZr[r\rBr]rFrIrbrPrmrnrorrrrr6Ûs  )Z __future__rÚtypingZcryptography.exceptionsrrrZ*cryptography.hazmat.backends.openssl.utilsrrZcryptography.hazmat.primitivesrZ)cryptography.hazmat.primitives.asymmetricr Ú TYPE_CHECKINGZ,cryptography.hazmat.backends.openssl.backendr rr!r$r'r*r5r9ZEllipticCurvePrivateKeyr+ZEllipticCurvePublicKeyr6rrrrÚs        \