o jRB@sddlZddlmZddlmZddlmZddlmZm Z ddl m Z m Z m Z ddlmZdd lmZdd lmZdd lmZmZmZdd lmZmZGd ddeZGdddeZGdddeZGdddeZddefddefddefddefddefdZ de!de!de!d e!d!ef d"d#Z"d$e!de!d%e!d&e#d e!d!ef d'd(Z$d)e!d*e!d e!d!efd+d,Z%Gd-d.d.Z&ddddd/d0ed1ed2ee!d3eed4ee'e!e!fd%ee!d5e&fd6d7Z(dS)8N)IntEnum) ModuleType)Optional) _HKDF_extract _HKDF_expand) key_agreementimport_x25519_public_keyimport_x448_public_key)strxor)ECC)EccKey)SHA256SHA384SHA512)AESChaCha20_Poly1305c@s eZdZdZdZdZdZdZdS)MODEz HPKE modesrrN)__name__ __module__ __qualname____doc__BASEPSKAUTHAUTH_PSKrr/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/Cryptodome/Protocol/HPKE.pyrs rc@seZdZdZdZdZdZdS)AEADz>Authenticated Encryption with Associated Data (AEAD) FunctionsrrrN)rrrr AES128_GCM AES256_GCMCHACHA20_POLY1305rrrrr s r c@ eZdZdS)DeserializeErrorNrrrrrrrr%r%c@r$)MessageLimitReachedErrorNr&rrrrr("r'r(rr !z NIST P-256z NIST P-384z NIST P-521 Curve25519Curve448saltlabelikmsuite_idhashmodcCsd|||}t|||S)NHPKE-v1)r)r1r2r3r4r5 labeled_ikmrrr_labeled_extract/s r8prkinfoLcCs*td|d|||}t||||S)N>Hr6)structpackr)r9r2r:r;r4r5 labeled_inforrr_labeled_expand8s r@dh kem_contextcCs,|j}tdd|||}t|d||||}|S)Nseae_prks shared_secret) digest_sizer8r@)rArBr4r5Nsecreteae_prk shared_secretrrr_extract_and_expandCsrHc@s eZdZdedeedeedeeefdededefdd Z e d"ded e d e deed eef ddZ e d#deded e d e deef ddZe dedeeeffddZdedededefddZddZd#dedeefddZd#dedeefd d!Zd S)$ HPKE_Cipher receiver_keyenc sender_keypsk_pairr:aead_idmodec CsH|durdn||_ ||||j|_||_||_z t|j\|_|_|_ Wnt y<}z t d |j|d}~ww|jt jkrEdnd|_d|_d|_|j j|_| |_|jrr|durdt d|||j|j |\} |_n|durzt d||||j|j |} d|_d d |j>d |_|j| |g|R\|_|_|_dS) NrCz!Curve {} is not supported by HPKEr)r, z0Parameter 'enc' cannot be an input when sealingz'Parameter 'enc' required when unsealingrr)rK_verify_psk_inputscurve_curve_aead_id_mode _Curve_Config_kem_id_kdf_id_hashmodKeyError ValueErrorformatr r!_Nk_Nn_NtrD_Nh has_private_encrypt_encap_decap _sequence _max_sequence _key_schedule_key _base_nonce_export_secret) selfrJrKrLrMr:rNrOkerGrrr__init__Zs\     zHPKE_Cipher.__init__Nkem_idr5eph_keyc Cs|dus |s J|dus|sJ|durtj|jd}|jdd}|jdd}||}i}|rE||jdd7}d|i}dtd|} || |fdd} td ||| d |} | |fS) N)rSrawr] static_privKEMr<cSt||||SNrHrArBr4r5rrrkdfzHPKE_Cipher._encap..kdf)eph_priv static_pubryr) rbr generaterS public_key export_keyr=r>r) rJror5rLrprKpkRmrB extra_paramr4ryrGrrrrds. zHPKE_Cipher._encapc Cs|sJz|jdkrt|}n|jdkrt|}ntj||jd}Wnty5}ztd|d}~ww|j dd}||}i} |rT||j dd7}d|i} dt d |} || |fd d } t d ||| d | } | S)Nr/r0) curve_namez*'enc' is not a valid encapsulated HPKE keyrqrrr|rtr<cSrurvrwrxrrrryrzzHPKE_Cipher._decap..kdf)eph_pubrsryr) rbrSr r r import_keyr\r%r~rr=r>r) rKrJror5rLpkEverrBrr4ryrGrrrres<       zHPKE_Cipher._decapcCs||\}}|dk|dkArtd|dkr&|tjtjfvr$td|jdSt|dkr0td|tjtjfvrHHHrCs psk_id_hashs info_hashrbigssecretskeys base_noncesexp) r=r>rXrYrUr8rZrVto_bytesr@r^r_ra) rlrGr:rrr4 psk_id_hash info_hashkey_schedule_contextsecretkey base_nonceexporter_secretrrrrhs\ zHPKE_Cipher._key_schedulecCst|j|j|jd}|jtjtjfvr"t j |j t j ||j d}n|jtjkr1tj |j |d}n td|jd|j|jkrCt|jd7_|S)Nr)noncemac_len)rrUnknown AEAD cipher ID #xr)r rjrfrr_rUr r!r"rnewriMODE_GCMr`r#rr\rgr()rlrcipherrrr _new_cipher&s  zHPKE_Cipher._new_cipher plaintext auth_datacCs:|jstd|}|r||||\}}||S)aEncrypt and authenticate a message. This method can be invoked multiple times to seal an ordered sequence of messages. Arguments: plaintext: bytes The message to seal. auth_data: bytes Optional. Additional Authenticated data (AAD) that is not encrypted but that will be also covered by the authentication tag. Returns: The ciphertext concatenated with the authentication tag. z$This cipher can only be used to seal)rcr\rupdateencrypt_and_digest)rlrrrcttagrrrseal3s zHPKE_Cipher.seal ciphertextcCs|jrtdt||jkrtd|}|r||z||d|j ||j d}W|StyF|jdkrBtdtdw)aDecrypt a message and validate its authenticity. This method can be invoked multiple times to unseal an ordered sequence of messages. Arguments: cipertext: bytes The message to unseal. auth_data: bytes Optional. Additional Authenticated data (AAD) that was also covered by the authentication tag. Returns: The original plaintext. Raises: ValueError If the ciphertext (in combination with the AAD) is not valid. But if it is the first time you call ``unseal()`` this exception may also mean that any of the parameters or keys used to establish the session is wrong or that one is missing. z&This cipher can only be used to unsealzCiphertext is too smallNrzAIncorrect HPKE keys/parameters or invalid message (wrong MAC tag)zInvalid message (wrong MAC tag))rcr\rr`rrdecrypt_and_verifyrf)rlrrrptrrrunsealLs"  zHPKE_Cipher.unseal)NNrv)rrrr rbytestupler rrn staticmethodintrrdrerRrhrrrrrrrrIXsj  ; " ' 6 rI)rKrLrr:rJrNrKrLrreturnc Cs|tvr td|d|j}|dvrtd||rIt|t|}|dkr0td|j|kr>td|j||durEtjntj}n |durPtj ntj }|durYd }|dur_d }t |||||||S) a Create an HPKE context which can be used: - by the sender to seal (encrypt) a message or - by the receiver to unseal (decrypt) it. As a minimum, the two parties agree on the receiver's asymmetric key (of which the sender will only know the public half). Additionally, for authentication purposes, they may also agree on: * the sender's asymmetric key (of which the receiver will only know the public half) * a shared secret (e.g., a symmetric key derived from a password) Args: receiver_key: The ECC key of the receiver. It must be on one of the following curves: ``NIST P-256``, ``NIST P-384``, ``NIST P-521``, ``X25519`` or ``X448``. If this is a **public** key, the HPKE context can only be used to **seal** (**encrypt**). If this is a **private** key, the HPKE context can only be used to **unseal** (**decrypt**). aead_id: The HPKE identifier of the symmetric cipher. The possible values are: * ``HPKE.AEAD.AES128_GCM`` * ``HPKE.AEAD.AES256_GCM`` * ``HPKE.AEAD.CHACHA20_POLY1305`` enc: The encapsulated session key (i.e., the KEM shared secret). The receiver must always specify this parameter. The sender must always omit this parameter. sender_key: The ECC key of the sender. It must be on the same curve as the ``receiver_key``. If the ``receiver_key`` is a public key, ``sender_key`` must be a private key, and vice versa. psk: A Pre-Shared Key (PSK) as a 2-tuple of non-empty byte strings: the identifier and the actual secret value. Sender and receiver must use the same PSK (or none). The secret value must be at least 32 bytes long, but it must not be a low-entropy password (use a KDF like PBKDF2 or scrypt to derive a secret from a password). info: A non-secret parameter that contributes to the generation of all session keys. Sender and receive must use the same **info** parameter (or none). Returns: An object that can be used for sealing (if ``receiver_key`` is a public key) or unsealing (if ``receiver_key`` is a private key). In the latter case, correctness of all the keys and parameters will only be assessed with the first call to ``unseal()``. rrr.zUnsupported curve rzExactly 1 private key requiredz'Sender key uses {} but recipient key {}N)rCrCrC) r r\rSrrbr]rrrrrrI) rJrNrKrLrr:rScount_private_keysrOrrrrvs:M    r))r=enumrtypesrtypingrKDFrrDHrr r Cryptodome.Util.strxorr Cryptodome.PublicKeyr Cryptodome.PublicKey.ECCr Cryptodome.HashrrrCryptodome.Cipherrrrr r\r%r(rWrr8rr@rHrIrrrrrrs            "