Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
valid_hash_algorithms |= set(['raw'])
if hash_algorithm not in valid_hash_algorithms:
valid_hash_algorithms_error = '"md5", "sha1", "sha224", "sha256", "sha384", "sha512"'
if certificate_or_public_key.algorithm == 'rsa' and not rsa_pss_padding:
valid_hash_algorithms_error += ', "raw"'
raise ValueError(pretty_message(
'''
hash_algorithm must be one of %s, not %s
''',
valid_hash_algorithms_error,
repr(hash_algorithm)
))
if certificate_or_public_key.algorithm != 'rsa' and rsa_pss_padding:
raise ValueError(pretty_message(
'''
PSS padding can only be used with RSA keys - the key provided is a
%s key
''',
certificate_or_public_key.algorithm.upper()
))
if certificate_or_public_key.algorithm == 'rsa' and hash_algorithm == 'raw':
if len(data) > certificate_or_public_key.byte_size - 11:
raise ValueError(pretty_message(
'''
data must be 11 bytes shorter than the key size when
hash_algorithm is "raw" - key size is %s bytes, but data is
%s bytes long
''',
certificate_or_public_key.byte_size,
raise TypeError(pretty_message(
'''
data must be a byte string, not %s
''',
type_name(data)
))
valid_hash_algorithms = set(['md5', 'sha1', 'sha224', 'sha256', 'sha384', 'sha512'])
if certificate_or_public_key.algorithm == 'rsa' and not rsa_pss_padding:
valid_hash_algorithms |= set(['raw'])
if hash_algorithm not in valid_hash_algorithms:
valid_hash_algorithms_error = '"md5", "sha1", "sha224", "sha256", "sha384", "sha512"'
if certificate_or_public_key.algorithm == 'rsa' and not rsa_pss_padding:
valid_hash_algorithms_error += ', "raw"'
raise ValueError(pretty_message(
'''
hash_algorithm must be one of %s, not %s
''',
valid_hash_algorithms_error,
repr(hash_algorithm)
))
if certificate_or_public_key.algorithm != 'rsa' and rsa_pss_padding:
raise ValueError(pretty_message(
'''
PSS padding can only be used with RSA keys - the key provided is a
%s key
''',
certificate_or_public_key.algorithm.upper()
))
''',
repr(hash_algorithm)
))
hash_func = getattr(hashlib, hash_algorithm)
# The maximal bit size of a non-negative integer is one less than the bit
# size of the key since the first bit is used to store sign
em_bits = key_length - 1
em_len = int(math.ceil(em_bits / 8))
message_digest = hash_func(message).digest()
hash_length = len(message_digest)
if em_len < hash_length + salt_length + 2:
raise ValueError(pretty_message(
'''
Key is not long enough to use with specified hash_algorithm and
salt_length
'''
))
if salt_length > 0:
salt = os.urandom(salt_length)
else:
salt = b''
m_prime = (b'\x00' * 8) + message_digest + salt
m_prime_digest = hash_func(m_prime).digest()
padding = b'\x00' * (em_len - salt_length - hash_length - 2)
:param salt_length:
The length of the salt as an integer - typically the same as the length
of the output from the hash_algorithm
:param key_length:
The length of the RSA key, in bits
:param message:
A byte string of the message to pad
:return:
The encoded (passed) message
"""
if _backend != 'winlegacy' and sys.platform != 'darwin':
raise SystemError(pretty_message(
'''
Pure-python RSA PSS signature padding addition code is only for
Windows XP/2003 and OS X
'''
))
if not isinstance(message, byte_cls):
raise TypeError(pretty_message(
'''
message must be a byte string, not %s
''',
type_name(message)
))
if not isinstance(salt_length, int_types):
raise TypeError(pretty_message(
OSError - when an error is returned by OpenSSL
:return:
A byte string of the plaintext
"""
if not isinstance(key, byte_cls):
raise TypeError(pretty_message(
'''
key must be a byte string, not %s
''',
type_name(key)
))
if not isinstance(data, byte_cls):
raise TypeError(pretty_message(
'''
data must be a byte string, not %s
''',
type_name(data)
))
if cipher != 'rc4' and not isinstance(iv, byte_cls):
raise TypeError(pretty_message(
'''
iv must be a byte string, not %s
''',
type_name(iv)
))
if cipher != 'rc4' and padding is None:
raise ValueError('padding must be specified')
:return:
A Certificate object
"""
if isinstance(source, Asn1Certificate):
certificate = source
elif isinstance(source, byte_cls):
certificate = parse_certificate(source)
elif isinstance(source, str_cls):
with open(source, 'rb') as f:
certificate = parse_certificate(f.read())
else:
raise TypeError(pretty_message(
'''
source must be a byte string, unicode string or
asn1crypto.x509.Certificate object, not %s
''',
type_name(source)
))
return _load_x509(certificate)
:return:
A PublicKey object
"""
if isinstance(source, PublicKeyInfo):
public_key = source
elif isinstance(source, byte_cls):
public_key = parse_public(source)
elif isinstance(source, str_cls):
with open(source, 'rb') as f:
public_key = parse_public(f.read())
else:
raise TypeError(pretty_message(
'''
source must be a byte string, unicode string or
asn1crypto.keys.PublicKeyInfo object, not %s
''',
type_name(source)
))
return _load_key(public_key)
''',
repr(algorithm)
))
if algorithm == 'rsa':
if bit_size not in set([1024, 2048, 3072, 4096]):
raise ValueError(pretty_message(
'''
bit_size must be one of 1024, 2048, 3072, 4096, not %s
''',
repr(bit_size)
))
elif algorithm == 'dsa':
if bit_size not in set([1024]):
raise ValueError(pretty_message(
'''
bit_size must be 1024, not %s
''',
repr(bit_size)
))
elif algorithm == 'ec':
if curve not in set(['secp256r1', 'secp384r1', 'secp521r1']):
raise ValueError(pretty_message(
'''
curve must be one of "secp256r1", "secp384r1", "secp521r1", not %s
''',
repr(curve)
))
cf_dict = None
has_asn1 = hasattr(certificate_or_public_key, 'asn1')
valid_types = (PublicKeyInfo, Certificate)
if not has_asn1 or not isinstance(certificate_or_public_key.asn1, valid_types):
raise TypeError(pretty_message(
'''
certificate_or_public_key must be an instance of the
oscrypto.asymmetric.PublicKey or oscrypto.asymmetric.Certificate
classes, not %s
''',
type_name(certificate_or_public_key)
))
algo = certificate_or_public_key.asn1['algorithm']['algorithm'].native
if algo != 'rsa':
raise ValueError(pretty_message(
'''
certificate_or_public_key must be an RSA key, not %s
''',
algo.upper()
))
if not isinstance(data, byte_cls):
raise TypeError(pretty_message(
'''
data must be a byte string, not %s
''',
type_name(data)
))
rsa_public_key = certificate_or_public_key.asn1['public_key'].parsed
transformed_int = pow(
:return:
A tuple of two byte strings (iv, ciphertext)
"""
if len(key) < 5 or len(key) > 16:
raise ValueError(pretty_message(
'''
key must be 5 to 16 bytes (40 to 128 bits) long - is %s
''',
len(key)
))
if not iv:
iv = rand_bytes(8)
elif len(iv) != 8:
raise ValueError(pretty_message(
'''
iv must be 8 bytes long - is %s
''',
len(iv)
))
return (iv, _encrypt('rc2', key, data, iv, True))