
    &)c\                        d dl Z d dlZd dlZddlmZ ddlmZmZmZm	Z	m
Z
mZmZmZmZ 	 d dlZd dlmZ d dlmZ d dlmZmZ d dlmZmZ d d	lmZmZ d d
lmZmZ d dl m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z( d dl)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0 dZ1n# e2$ r dZ1Y nw xY wh dZ3d Z4 G d d          Z5 G d de5          Z6 G d de5          Z7e1r: G d de5          Z8 G d de5          Z9 G d de8          Z: G d de5          Z;dS dS )    N   InvalidKeyError)	base64url_decodebase64url_encodeder_to_raw_signatureforce_bytesfrom_base64url_uintis_pem_format
is_ssh_keyraw_to_der_signatureto_base64url_uint)InvalidSignature)hashes)ecpadding)EllipticCurvePrivateKeyEllipticCurvePublicKey)Ed448PrivateKeyEd448PublicKey)Ed25519PrivateKeyEd25519PublicKey)RSAPrivateKeyRSAPrivateNumbersRSAPublicKeyRSAPublicNumbersrsa_crt_dmp1rsa_crt_dmq1rsa_crt_iqmprsa_recover_prime_factors)EncodingNoEncryptionPrivateFormatPublicFormatload_pem_private_keyload_pem_public_keyload_ssh_public_keyTF>   ES256ES384ES512ES521EdDSAPS256PS384PS512RS256RS384RS512ES256Kc                     t                      t          t          j                  t          t          j                  t          t          j                  d} t
          r+|                     t          t          j                  t          t          j                  t          t          j                  t          t          j                  t          t          j                  t          t          j                  t          t          j                  t          t          j                  t          t          j                  t          t          j                  t          t          j                  t                      d           | S )zE
    Returns the algorithms that are implemented by the library.
    )noneHS256HS384HS512)r0   r1   r2   r(   r3   r)   r+   r*   r-   r.   r/   r,   )NoneAlgorithmHMACAlgorithmSHA256SHA384SHA512
has_cryptoupdateRSAAlgorithmECAlgorithmRSAPSSAlgorithmOKPAlgorithm)default_algorithmss    0/usr/lib/python3/dist-packages/jwt/algorithms.pyget_default_algorithmsrF   K   s   
 }344}344}344	   
!!%l&9::%l&9::%l&9::$[%788%k&899$[%788$[%788$&  ))?@@()?@@()?@@% 	
 	
 	
&     c                   P    e Zd ZdZd Zd Zd Zed             Zed             Z	dS )	AlgorithmzH
    The interface for an algorithm used to sign and verify tokens.
    c                     t           )z
        Performs necessary validation and conversions on the key and returns
        the key value in the proper format for sign() and verify().
        NotImplementedErrorselfkeys     rE   prepare_keyzAlgorithm.prepare_keyr   
    
 "!rG   c                     t           )zn
        Returns a digital signature for the specified message
        using the specified key value.
        rK   rN   msgrO   s      rE   signzAlgorithm.signy   rQ   rG   c                     t           )zz
        Verifies that the specified digital signature is valid
        for the specified message and key values.
        rK   rN   rT   rO   sigs       rE   verifyzAlgorithm.verify   rQ   rG   c                     t           )z7
        Serializes a given RSA key into a JWK
        rK   key_objs    rE   to_jwkzAlgorithm.to_jwk   rQ   rG   c                     t           )zb
        Deserializes a given RSA key from JWK back into a PublicKey or PrivateKey object
        rK   )jwks    rE   from_jwkzAlgorithm.from_jwk   rQ   rG   N)
__name__
__module____qualname____doc__rP   rU   rY   staticmethodr]   r`    rG   rE   rI   rI   m   s         " " "" " "" " " " " \" " " \" " "rG   rI   c                   $    e Zd ZdZd Zd Zd ZdS )r9   zZ
    Placeholder for use when no signing or verification
    operations are required.
    c                 8    |dk    rd }|t          d          |S )N z*When alg = "none", key value must be None.r   rM   s     rE   rP   zNoneAlgorithm.prepare_key   s)    "99C?!"NOOO
rG   c                     dS )NrG   rf   rS   s      rE   rU   zNoneAlgorithm.sign   s    srG   c                     dS )NFrf   rW   s       rE   rY   zNoneAlgorithm.verify   s    urG   N)ra   rb   rc   rd   rP   rU   rY   rf   rG   rE   r9   r9      sK         
        rG   r9   c                       e Zd ZdZej        Zej        Zej	        Z
d Zd Zed             Zed             Zd Zd ZdS )	r:   zf
    Performs signing and verification operations using HMAC
    and the specified hash function.
    c                     || _         d S Nhash_algrN   rp   s     rE   __init__zHMACAlgorithm.__init__   s     rG   c                 ~    t          |          }t          |          st          |          rt          d          |S )NzdThe specified key is an asymmetric key or x509 certificate and should not be used as an HMAC secret.)r	   r   r   r   rM   s     rE   rP   zHMACAlgorithm.prepare_key   sJ    # 	C 	!9  
 
rG   c                     t          j        t          t          |                                                     dd          S )Noct)kkty)jsondumpsr   r	   decoder[   s    rE   r]   zHMACAlgorithm.to_jwk   sB    z%k'&:&:;;BBDD 
 
 	
rG   c                 L   	 t          | t                    rt          j        |           }nt          | t                    r| }nt
          n# t
          $ r t          d          w xY w|                    d          dk    rt          d          t          |d                   S )NKey is not valid JSONrw   ru   zNot an HMAC keyrv   )	
isinstancestrrx   loadsdict
ValueErrorr   getr   )r_   objs     rE   r`   zHMACAlgorithm.from_jwk   s    	;#s## !jooC&& !   	; 	; 	;!"9:::	; 775>>U""!"3444C)))   A	A A&c                 \    t          j        ||| j                                                  S rn   )hmacnewrp   digestrS   s      rE   rU   zHMACAlgorithm.sign   s$    xS$-0077999rG   c                 T    t          j        ||                     ||                    S rn   )r   compare_digestrU   rW   s       rE   rY   zHMACAlgorithm.verify   s#    "3		#s(;(;<<<rG   N)ra   rb   rc   rd   hashlibsha256r;   sha384r<   sha512r=   rr   rP   re   r]   r`   rU   rY   rf   rG   rE   r:   r:      s         
 ^F^F^F! ! !	 	 	 
 
 \
 * * \* : : := = = = =rG   r:   c                       e Zd ZdZej        Zej        Zej        Zd Zd Z	e
d             Ze
d             Zd Zd ZdS )	r@   z~
        Performs signing and verification operations using
        RSASSA-PKCS-v1_5 and the specified hash function.
        c                     || _         d S rn   ro   rq   s     rE   rr   zRSAAlgorithm.__init__       $DMMMrG   c                 d   t          |t          t          f          r|S t          |t          t          f          st          d          t          |          }	 |                    d          rt          |          }nt          |d           }n# t          $ r t          |          }Y nw xY w|S )NExpecting a PEM-formatted key.s   ssh-rsapassword)r}   r   r   bytesr~   	TypeErrorr	   
startswithr'   r%   r   r&   rM   s     rE   rP   zRSAAlgorithm.prepare_key   s    #|<== 
cE3<00 B @AAAc""C/>>*-- C-c22CC.sTBBBC / / /)#../Js   6B B-,B-c                    d }t          | dd           rM|                                 }ddgt          |j        j                                                  t          |j        j                                                  t          |j                                                  t          |j                                                  t          |j	                                                  t          |j
                                                  t          |j                                                  t          |j                                                  d
}nt          | dd           re|                                 }ddgt          |j                                                  t          |j                                                  d}nt          d          t          j        |          S )Nprivate_numbersRSArU   )
rw   key_opsnedpqdpdqqirY   )rw   r   r   r   Not a public or private key)getattrr   r   public_numbersr   rz   r   r   r   r   dmp1dmq1iqmpr   rx   ry   )r\   r   numberss      rE   r]   zRSAAlgorithm.to_jwk  s   Cw 1488 E!1133 ! &x*7+A+CDDKKMM*7+A+CDDKKMM*7955<<>>*7955<<>>*7955<<>>+GL99@@BB+GL99@@BB+GL99@@BB  (D11 E!0022 ! (z*7955<<>>*7955<<>>	  &&CDDD:c??"rG   c                 <  	 	 t          | t                    rt          j        |           	nt          | t                    r| 	nt
          n# t
          $ r t          d          w xY w	                    d          dk    rt          d          d	v rd	v rd	v rd	v rt          d	          g d
}	fd|D             }t          |          }|rt          |          st          d          t          t          	d                   t          	d                             }|rt          t          	d                   t          	d                   t          	d                   t          	d                   t          	d                   t          	d                   |          }nst          	d                   }t          |j        ||j                  \  }}t          |||t!          ||          t#          ||          t%          ||          |          }|                                S d	v rNd	v rJt          t          	d                   t          	d                             }|                                S t          d          )Nr|   rw   r   zNot an RSA keyr   r   r   othz5Unsupported RSA private key: > 2 primes not supported)r   r   r   r   r   c                     g | ]}|v S rf   rf   ).0propr   s     rE   
<listcomp>z)RSAAlgorithm.from_jwk.<locals>.<listcomp>A  s    CCCtts{CCCrG   z@RSA key must include all parameters if any are present besides dr   r   r   r   r   )r   r   r   r   r   r   r   r   )r}   r~   rx   r   r   r   r   r   anyallr   r
   r   r    r   r   r   r   r   private_key
public_key)
r_   other_propsprops_foundany_props_foundr   r   r   r   r   r   s
            @rE   r`   zRSAAlgorithm.from_jwk*  s   ?c3'' %*S//CCT** %CC$$ ? ? ?%&=>>>? wwu~~&&%&6777czzcSjjSCZZC<<)O   ;::CCCC{CCC"%k"2"2" 3{+;+; )Z   "2'C11'C11" "
 # /-c#h77-c#h77-c#h770T;;0T;;0T;;'5  GG ,CH55A4&(!^-= DAq 0)!Q//)!Q//)!Q//'5  G **,,,s

*'C11'C11 
 ))+++%&CDDDs   A	A A'c                 v    |                     |t          j                    |                                           S rn   )rU   r   PKCS1v15rp   rS   s      rE   rU   zRSAAlgorithm.signt  s)    88C!1!3!3T]]__EEErG   c                     	 |                     ||t          j                    |                                            dS # t          $ r Y dS w xY w)NTF)rY   r   r   rp   r   rW   s       rE   rY   zRSAAlgorithm.verifyw  sW    

3W%5%7%7IIIt#   uus   ;? 
AAN)ra   rb   rc   rd   r   r;   r<   r=   rr   rP   re   r]   r`   rU   rY   rf   rG   rE   r@   r@      s        	 	
 	% 	% 	%	 	 	$ 
!	# !	# 
!	#F 
G	E G	E 
G	ER	F 	F 	F	 	 	 	 	rG   r@   c                       e Zd ZdZej        Zej        Zej        Zd Zd Z	d Z
d Zed             Zed             ZdS )	rA   zr
        Performs signing and verification operations using
        ECDSA and the specified hash function
        c                     || _         d S rn   ro   rq   s     rE   rr   zECAlgorithm.__init__  r   rG   c                    t          |t          t          f          r|S t          |t          t          f          st          d          t          |          }	 |                    d          rt          |          }nt          |          }n!# t          $ r t          |d           }Y nw xY wt          |t          t          f          st          d          |S )Nr   s   ecdsa-sha2-r   zcExpecting a EllipticCurvePrivateKey/EllipticCurvePublicKey. Wrong key provided for ECDSA algorithms)r}   r   r   r   r~   r   r	   r   r'   r&   r   r%   r   rM   s     rE   rP   zECAlgorithm.prepare_key  s    # 79OPQQ 
cE3<00 B @AAAc""C
?>>.11 3-c22CC-c22C ? ? ?*3>>>? c$;=S#TUU %y   Js   4B B-,B-c                     |                     |t          j        |                                                     }t	          ||j                  S rn   )rU   r   ECDSArp   r   curve)rN   rT   rO   der_sigs       rE   rU   zECAlgorithm.sign  s9    hhsBHT]]__$=$=>>G';;;rG   c                 B   	 t          ||j                  }n# t          $ r Y dS w xY w	 t          |t                    r|                                }|                    ||t          j        | 	                                                     dS # t          $ r Y dS w xY w)NFT)r   r   r   r}   r   r   rY   r   r   rp   r   )rN   rT   rO   rX   r   s        rE   rY   zECAlgorithm.verify  s    .sCI>>   uuc#:;; +..**C

7C$--//)B)BCCCt#   uus    
&&A$B 
BBc                    t          | t                    r'|                                                                 }n9t          | t                    r|                                 }nt          d          t          | j        t          j                  rd}n}t          | j        t          j	                  rd}n[t          | j        t          j
                  rd}n9t          | j        t          j                  rd}nt          d| j                   d|t          |j                                                  t          |j                                                  d}t          | t                    r;t          |                                 j                                                  |d	<   t%          j        |          S )
Nr   P-256P-384P-521	secp256k1Invalid curve: EC)rw   crvxyr   )r}   r   r   r   r   r   r   r   	SECP256R1	SECP384R1	SECP521R1	SECP256K1r   r   rz   r   r   private_valuerx   ry   )r\   r   r   r   s       rE   r]   zECAlgorithm.to_jwk  s    '#:;; E!(!3!3!5!5!D!D!F!FG%;<< E!(!7!7!9!9%&CDDD'-66 	IGM2<88 IGM2<88 IGM2<88 I!%&G&G&GHHH &~'788??AA&~'788??AA	 C '#:;; ,++--; &(( C :c??"rG   c                    	 t          | t                    rt          j        |           }nt          | t                    r| }nt
          n# t
          $ r t          d          w xY w|                    d          dk    rt          d          d|vsd|vrt          d          t          |                    d                    }t          |                    d                    }|                    d          }|dk    rNt          |          t          |          cxk    rd	k    rn nt          j                    }nt          d
          |dk    rMt          |          t          |          cxk    rdk    rn nt          j                    }nt          d          |dk    rMt          |          t          |          cxk    rdk    rn nt          j                    }ntt          d          |dk    rMt          |          t          |          cxk    rd	k    rn nt          j                    }n!t          d          t          d|           t          j        t                               |d          t                               |d          |          }d|vr|                                S t          |                    d                    }t          |          t          |          k    rt          dt          |          |          t          j        t                               |d          |                                          S )Nr|   rw   r   zNot an Elliptic curve keyr   r   r   r       z)Coords should be 32 bytes for curve P-256r   0   z)Coords should be 48 bytes for curve P-384r   B   z)Coords should be 66 bytes for curve P-521r   z-Coords should be 32 bytes for curve secp256k1r   big)	byteorder)r   r   r   r   z!D should be {} bytes for curve {})r}   r~   rx   r   r   r   r   r   r   lenr   r   r   r   r   EllipticCurvePublicNumbersint
from_bytesr   EllipticCurvePrivateNumbersr   )r_   r   r   r   r   	curve_objr   r   s           rE   r`   zECAlgorithm.from_jwk  sG   ?c3'' %*S//CCT** %CC$$ ? ? ?%&=>>>? wwu~~%%%&ABBB#~~C%&ABBB ..A ..AGGENNEq66SVV))))r))))) "II)*UVVV'!!q66SVV))))r))))) "II)*UVVV'!!q66SVV))))r))))) "II)*UVVV+%%q66SVV))))r))))) "II)G   &&?&?&?@@@:..e.44..e.44  N #~~%00222 ..A1vvQ%7Q   1qE22N kmmr   N)ra   rb   rc   rd   r   r;   r<   r=   rr   rP   rU   rY   re   r]   r`   rf   rG   rE   rA   rA   ~  s        	 	
 	% 	% 	%	 	 	8	< 	< 	<
	 	 	 
 	#  	# 
 	#D 
?	 ?	 
?	 ?	 ?	rG   rA   c                       e Zd ZdZd Zd ZdS )rB   zA
        Performs a signature using RSASSA-PSS with MGF1
        c           	          |                     |t          j        t          j        |                                           | j        j                  |                                           S )Nmgfsalt_length)rU   r   PSSMGF1rp   digest_sizerS   s      rE   rU   zRSAPSSAlgorithm.sign$  sY    88T]]__55 $ 9     rG   c           
         	 |                     ||t          j        t          j        |                                           | j        j                  |                                            dS # t          $ r Y dS w xY w)Nr   TF)rY   r   r   r   rp   r   r   rW   s       rE   rY   zRSAPSSAlgorithm.verify.  s    

K#L99$(M$=   MMOO   t#   uus   A,A0 0
A>=A>N)ra   rb   rc   rd   rU   rY   rf   rG   rE   rB   rB     s<        	 		 	 		 	 	 	 	rG   rB   c                   V    e Zd ZdZd Zd Zd Zd Zed             Z	ed             Z
dS )	rC   z
        Performs signing and verification operations using EdDSA

        This class requires ``cryptography>=2.6`` to be installed.
        c                     d S rn   rf   )rN   kwargss     rE   rr   zOKPAlgorithm.__init__D  s    DrG   c                    t          |t          t          f          rt          |t                    r|                    d          }|                    d          }d|v rt          |          }n3d|v rt          |d           }n|dd         dk    rt          |          }t          |t          t          t          t          f          st          d          |S )	Nutf-8z-----BEGIN PUBLICz-----BEGIN PRIVATEr   r      zssh-zcExpecting a EllipticCurvePrivateKey/EllipticCurvePublicKey. Wrong key provided for EdDSA algorithms)r}   r   r~   encoderz   r&   r%   r'   r   r   r   r   r   )rN   rO   str_keys      rE   rP   zOKPAlgorithm.prepare_keyG  s    #s|,, 
3c3'' .**W--C**W--&'11-c22CC)W44.sTBBBCCQqS\V++-c22C "$4o~V   &y   JrG   c                 |    t          |          t          urt          |d          n|}|                    |          S )aS  
            Sign a message ``msg`` using the EdDSA private key ``key``
            :param str|bytes msg: Message to sign
            :param Ed25519PrivateKey}Ed448PrivateKey key: A :class:`.Ed25519PrivateKey`
                or :class:`.Ed448PrivateKey` isinstance
            :return bytes signature: The signature, as bytes
            r   )typer   rU   rS   s      rE   rU   zOKPAlgorithm.sign_  s8     *.c%)?)?%W%%%SC88C== rG   c                 j   	 t          |          t          urt          |d          n|}t          |          t          urt          |d          n|}t          |t          t          f          r|                                }|                    ||           dS # t          j        j	        $ r Y dS w xY w)a  
            Verify a given ``msg`` against a signature ``sig`` using the EdDSA key ``key``

            :param str|bytes sig: EdDSA signature to check ``msg`` against
            :param str|bytes msg: Message to sign
            :param Ed25519PrivateKey|Ed25519PublicKey|Ed448PrivateKey|Ed448PublicKey key:
                A private or public EdDSA key instance
            :return bool verified: True if signature is valid, False if not.
            r   TF)
r   r   r}   r   r   r   rY   cryptography
exceptionsr   rW   s       rE   rY   zOKPAlgorithm.verifyj  s    	-1#YYe-C-CeC)))-1#YYe-C-CeC)))c$5#GHH +..**C

3$$$t*;   uus   BB B21B2c                    t          | t          t          f          r|                     t          j        t          j                  }t          | t                    rdnd}t          j        t          t          |                                                    d|d          S t          | t          t          f          r|                     t          j        t          j        t!                                }|                                                     t          j        t          j                  }t          | t                    rdnd}t          j        t          t          |                                                    t          t          |                                                    d|d          S t%          d          )	N)encodingformatEd25519Ed448OKP)r   rw   r   )r   r   encryption_algorithm)r   r   rw   r   r   )r}   r   r   public_bytesr!   Rawr$   rx   ry   r   r	   rz   r   r   private_bytesr#   r"   r   r   )rO   r   r   r   s       rE   r]   zOKPAlgorithm.to_jwk  s   # 0.ABB $$%\'+ %   $.c3C#D#DQii'z-k!nn==DDFF$"    # 1?CDD %%%\(,)5 &   NN$$11%\'+ 2  
 $.c3D#E#ERii7z-k!nn==DDFF-k!nn==DDFF$"	    ""?@@@rG   c                 <   	 t          | t                    rt          j        |           }nt          | t                    r| }nt
          n# t
          $ r t          d          w xY w|                    d          dk    rt          d          |                    d          }|dk    r|dk    rt          d|           d	|vrt          d
          t          |                    d	                    }	 d|vr.|dk    rt          j
        |          S t          j
        |          S t          |                    d                    }|dk    rt          j        |          S t          j        |          S # t
          $ r}t          d          |d }~ww xY w)Nr|   rw   r   zNot an Octet Key Pairr   r   r   r   r   zOKP should have "x" parameterr   zInvalid key parameter)r}   r~   rx   r   r   r   r   r   r   r   from_public_bytesr   r   from_private_bytesr   )r_   r   r   r   r   errs         rE   r`   zOKPAlgorithm.from_jwk  s   ?c3'' %*S//CCT** %CC$$ ? ? ?%&=>>>? wwu~~&&%&=>>>GGENNE	!!ew&6&6%&?&?&?@@@#~~%&EFFF ..A
Hc>>	))/A!DDD);A>>>$SWWS\\22I%%,?BBB&9!<<< H H H%&=>>CGHs6   A	A A&:E< E< ,;E< (E< <
FFFN)ra   rb   rc   rd   rr   rP   rU   rY   re   r]   r`   rf   rG   rE   rC   rC   =  s        	 		 	 		 	 	0		! 		! 		!	 	 	* 
%	A %	A 
%	AN 
 	H  	H 
 	H  	H  	HrG   rC   )<r   r   rx   r   r   utilsr   r   r   r	   r
   r   r   r   r   cryptography.exceptionsr   r   cryptography.hazmat.primitivesr   )cryptography.hazmat.primitives.asymmetricr   r   ,cryptography.hazmat.primitives.asymmetric.ecr   r   /cryptography.hazmat.primitives.asymmetric.ed448r   r   1cryptography.hazmat.primitives.asymmetric.ed25519r   r   -cryptography.hazmat.primitives.asymmetric.rsar   r   r   r   r   r   r   r    ,cryptography.hazmat.primitives.serializationr!   r"   r#   r$   r%   r&   r'   r>   ModuleNotFoundErrorrequires_cryptographyrF   rI   r9   r:   r@   rA   rB   rC   rf   rG   rE   <module>r     s      ' ' ' ' ' '
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
'""""888888555555EEEEEEEE                     	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	                  JJ   JJJ      D&" &" &" &" &" &" &" &"R    I   ,6= 6= 6= 6= 6=I 6= 6= 6=r  cHU U U U Uy U U Un_ _ _ _ _i _ _ _B    ,   <KH KH KH KH KHy KH KH KH KH KHq
cH cHs   AB BB