File: //usr/lib/python3.9/site-packages/jwcrypto/__pycache__/jwk.cpython-39.pyc
a
���f�� � @ s� d dl Z d dlmZmZ d dlmZ d dlmZ d dlm Z d dl
m Z d dl m
Z
mZ d dlmZ d d lmZ zd d
lmZ W n ey� d d � ZY n0 d d
lmZ d dlmZmZ d dlmZmZ G dd� d�Zg Z z d dl m Z m Z e � d� W n e�y eZ eZ Y n0 z d dl!m"Z"m#Z# e � d� W n e�yP eZ"eZ#Y n0 z8d dl$m%Z%m&Z& e'e&dd�Z(e(du �r~e�e � d� W n e�y� eZ%eZ&Y n0 z d dl)m*Z*m+Z+ e � d� W n e�y� eZ*eZ+Y n0 edd�Z,edd�Z-edd�Z.edd�Z/e,e e �e-e"e#�e.e%e&�e/e*e+�d �Z0d d d d d!�Z1G d"d#� d#e�Z2ed$d%�Z3e3d&d'd'e2j4�e3d(d'd'e2j5�e3d)d'd'e2j5�e3d*d+d+e2j5�d,�e3d-d'd'e2j5�e3d.d'd'e2j6�e3d/d+d+e2j6�e3d0d+d+e2j6�e3d1d+d+e2j6�e3d2d+d+e2j6�e3d3d+d+e2j6�e3d4d+d+e2j6�e3d5d+d+e2j7�d6� d7e3d8d+d'e2j5�ie3d&d'd'e2j4�e3d9d'd'e2j5�e3d:d+d+e2j5�d;�d!�Z8e3d<d'dd�e3d=d'dd�e3d>d'dd�e3d?d'dd�e3d@d'dd�e3dAd'dd�e3dBd'dd�e3dCd'dd�e3dDd'dd�dE� Z9dFdGdHdIdJdKdLdMdNdOdPdQ� Z:dRdSdT�Z;dUdVdWdXdYdZd[d\d]�Z<d^d_d`dadbdcddde�Z=e
�>� ddddde
�?� e
�@� e
�A� e
�B� e
�C� e
�D� e
�Edf�de
�Fdg�dh�ZGG didj� dje�ZHG dkdl� dle�ZIG dmdn� dne�ZJG dodp� dpe�ZKG dqdr� dreL�ZMG dsdt� dteN�ZOG dudv� dveL�ZPdS )w� N)�hexlify� unhexlify)�
namedtuple)�Enum)�x509)�default_backend)�hashes�
serialization)�ec)�rsa)�
deprecatedc G s dd� }|S )Nc S s | S �N� )�funcr r �0/usr/lib/python3.9/site-packages/jwcrypto/jwk.py�inner s zdeprecated.<locals>.innerr )Z_fn�argsr r r r r s r )� JWException)�base64url_decode�base64url_encode)� json_decode� json_encodec @ s0 e Zd Zedd� �Zedd� �Zedd� �ZdS )�UnimplementedOKPCurveKeyc C s t �d S r
��NotImplementedError)�clsr r r �generate s z!UnimplementedOKPCurveKey.generatec G s t �d S r
r �r r r r r �from_public_bytes" s z*UnimplementedOKPCurveKey.from_public_bytesc G s t �d S r
r r r r r �from_private_bytes& s z+UnimplementedOKPCurveKey.from_private_bytesN)�__name__�
__module__� __qualname__� classmethodr r r r r r r r s
r )�Ed25519PublicKey�Ed25519PrivateKey�Ed25519)�Ed448PublicKey�Ed448PrivateKey�Ed448)�X25519PublicKey�X25519PrivateKeyr �X25519)�
X448PublicKey�X448PrivateKey�X448zpubkey privkey)r& r) r, r/ zElliptic Curve�RSAzOctet sequencezOctet Key Pair)�ECr0 �oct�OKPc @ s e Zd ZdZdZdZdZdS )�ParmTypezA string with a namezBase64url EncodedzBase64urlUint EncodedzUnsupported ParameterN)r r! r" �name�b64�b64u� unsupportedr r r r r4 l s r4 Z Parameterz description public required typeZCurveTz X Coordinatez Y CoordinatezECC Private KeyF)�crv�x�y�dZModulus�ExponentzPrivate ExponentzFirst Prime FactorzSecond Prime FactorzFirst Factor CRT ExponentzSecond Factor CRT ExponentzFirst CRT CoefficientzOther Primes Info) �n�er< �p�q�dp�dq�qiZoth�kz Key Valuez
Public Keyz Private Key)r9 r: r< zKey TypezPublic Key UsezKey OperationsZ AlgorithmzKey IDz X.509 URLzX.509 Certificate Chainz"X.509 Certificate SHA-1 Thumbprintz$X.509 Certificate SHA-256 Thumbprint) �kty�use�key_ops�alg�kidZx5uZx5cZx5tzx5t#S256z P-256 curvez P-384 curvez P-521 curvezSECG secp256k1 curvez%Ed25519 signature algorithm key pairsz#Ed448 signature algorithm key pairszX25519 function key pairszX448 function key pairsz\BrainpoolP256R1 curve (unregistered, custom-defined in breach of IETF rules by gematik GmbH)z\BrainpoolP384R1 curve (unregistered, custom-defined in breach of IETF rules by gematik GmbH)z\BrainpoolP512R1 curve (unregistered, custom-defined in breach of IETF rules by gematik GmbH)) �P-256�P-384�P-521� secp256k1r& r) r, r/ �BP-256�BP-384�BP-512zDigital Signature or MACZ
Encryption)�sig�encz Compute digital Signature or MACz Verify digital signature or MACzEncrypt contentz6Decrypt content and validate decryption, if applicablez Encrypt keyz2Decrypt key and validate decryption, if applicablez
Derive keyz#Derive bits not to be used as a key)�sign�verify�encrypt�decrypt�wrapKey� unwrapKey� deriveKey�
deriveBitsrK rL rM rN rO rP rQ )Z secp256r1Z secp384r1Z secp521r1rN ZbrainpoolP256r1ZbrainpoolP384r1ZbrainpoolP512r1� �@ )�sha-256z sha-256-128z sha-256-120z
sha-256-96z
sha-256-64z
sha-256-32zsha-384zsha-512zsha3-224zsha3-256zsha3-384zsha3-512z blake2s-256z blake2b-256z blake2b-512c s* e Zd ZdZd� fdd� Zdd� Z� ZS )�InvalidJWKTypezfInvalid JWK Type Exception.
This exception is raised when an invalid parameter type is used.
Nc s t t| ��� || _d S r
)�superr_ �__init__�value)�selfrb �� __class__r r ra � s zInvalidJWKType.__init__c C s d| j tt�� �f S )Nz&Unknown type "%s", valid types are: %s)rb �list�JWKTypesRegistry�keys�rc r r r �__str__� s �zInvalidJWKType.__str__)N�r r! r" �__doc__ra rj �
__classcell__r r rd r r_ � s r_ c s( e Zd ZdZ� fdd�Zdd� Z� ZS )�InvalidJWKUsagez�Invalid JWK usage Exception.
This exception is raised when an invalid key usage is requested,
based on the key type and declared usage constraints.
c s t t| ��� || _|| _d S r
)r` rn ra rb rG )rc rG rb rd r r ra � s zInvalidJWKUsage.__init__c C s\ | j tt�� �v r t| j }n
d| j }| jtt�� �v rFt| j }n
d| j }d||f S )N� Unknown(%s)z.Invalid usage requested: "%s". Valid for: "%s")rG rf �JWKUseRegistryrh rb )rc �usage�validr r r rj s
�zInvalidJWKUsage.__str__rk r r rd r rn � s rn c s( e Zd ZdZ� fdd�Zdd� Z� ZS )�InvalidJWKOperationz�Invalid JWK Operation Exception.
This exception is raised when an invalid key operation is requested,
based on the key type and declared usage constraints.
c s t t| ��� || _|| _d S r
)r` rs ra �op�values)rc � operationru rd r r ra s z InvalidJWKOperation.__init__c C sr | j tt�� �v r t| j }n
d| j }g }| jD ]2}|tt�� �v rV|�t| � q2|�d| � q2d||f S )Nro z2Invalid operation requested: "%s". Valid for: "%s")rt rf �JWKOperationsRegistryrh ru �append)rc rt rr �vr r r rj s
�zInvalidJWKOperation.__str__rk r r rd r rs s rs c @ s e Zd ZdZdS )�InvalidJWKValuez�Invalid JWK Value Exception.
This exception is raised when an invalid/unknown value is used in the
context of an operation that requires specific values to be used based
on the key type or other constraints.
N)r r! r" rl r r r r rz * s rz c s� e Zd ZdZ� fdd�Zedd� �Zdd� Zd�d d
�Zd d � Z d�d
d�Z
dd� Z dd� Z dd� Z
d�dd�Zdd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zd%d&� Zed'd(� �Zd�d+d,�Zd�d-d.�Zd/d0� Zd�d1d2�Zd�d3d4�Z d�d5d6�Z d7d8� Z e d9d:� �Z e d;d<� �Z!e d=d>� �Z"e e#d?�d@dA� ��Z$e e#d?�dBdC� ��Z%e e#d?�dDdE� ��Z&e#d?�dFdG� �Z'dHdI� Z(dJdK� Z)dLdM� Z*dNdO� Z+dPdQ� Z,dRdS� Z-dTdU� Z.dVdW� Z/dXdY� Z0dZd[� Z1d\d]� Z2d^d_� Z3d�d`da�Z4d�dbdc�Z5d�ddde�Z6dfdg� Z7d�dhdi�Z8d�djdk�Z9edldm� �Z:ed�dndo��Z;e<�=� fdpdq�Z>d�dsdt�Z?� fdudv�Z@dwdx� ZAd�dydz�ZB� fd{d|�ZCd}d~� ZDdd�� ZEd�d�� ZF� fd�d��ZGed�d�� �ZHd�d�� ZI� ZJS )��JWKz�JSON Web Key object
This object represents a Key.
It must be instantiated by using the standard defined key/value pairs
as arguments of the initialization function.
c sL t t| ��� d| _d| _d|v r4| jf i |�� n|rH| jf i |�� dS )a� Creates a new JWK object.
The function arguments must be valid parameters as defined in the
'IANA JSON Web Key Set Parameters registry' and specified in
the :data:`JWKParamsRegistry` variable. The 'kty' parameter must
always be provided and its value must be a valid one as defined
by the 'IANA JSON Web Key Types registry' and specified in the
:data:`JWKTypesRegistry` variable. The valid key parameters per
key type are defined in the :data:`JWKValuesRegistry` variable.
To generate a new random key call the class method generate() with
the appropriate 'kty' parameter, and other parameters as needed (key
size, public exponents, curve types, etc..)
Valid options per type, when generating new keys:
* oct: size(int)
* RSA: public_exponent(int), size(int)
* EC: crv(str) (one of P-256, P-384, P-521, secp256k1)
* OKP: crv(str) (one of Ed25519, Ed448, X25519, X448)
Deprecated:
Alternatively if the 'generate' parameter is provided with a
valid key type as value then a new key will be generated according
to the defaults or provided key strength options (type specific).
:param \**kwargs: parameters (optional).
:raises InvalidJWKType: if the key type is invalid
:raises InvalidJWKValue: if incorrect or inconsistent parameters
are provided.
Nr )r` r{ ra � _cache_pub_k� _cache_pri_k� generate_key�
import_key)rc �kwargsrd r r ra ; s z JWK.__init__c
K sd | � }d }z|d }t |d| �}W n2 ttfyV } zt|�|�W Y d }~n
d }~0 0 ||� |S )NrF � _generate_%s)�getattr�KeyError�AttributeErrorr_ )r r� �objrF �genr? r r r r d s z JWK.generatec
K s` d }z |� d�}t| d| �}W n2 ttfyR } zt|�|�W Y d }~n
d }~0 0 ||� d S )Nr r� )�popr� r� r� r_ )rc �paramsrF r� r? r r r r~ p s
zJWK.generate_keyNc
C sx |}d|v r|� d�}n\d|v rtz ddlm} |�|d �}W n. tyl } ztd�|�W Y d }~n
d }~0 0 |j}|S )N�sizerI r )�JWAzInvalid 'alg' parameter)r� Z jwcrypto.jwar� Zinstantiate_algr� �
ValueErrorZ
input_keysize)rc r� Z default_sizer� r� rI r? r r r �
_get_gen_sizez s zJWK._get_gen_sizec C sB | � |d�}t�|d �}d|d< t|�|d< | jf i |�� d S )N� � r2 rF rE )r� �os�urandomr r )rc r� r� �keyr r r �
_generate_oct� s
zJWK._generate_octc C sf d}|d ur |d d d }t |��d��d�}t|�}||krJ||8 }n|d }tt|d | ��S )Nr � r� � �L�0x�0)�hex�rstrip�lstrip�lenr r )rc �iZbit_size�extendZhexiZhexlr r r � _encode_int� s
zJWK._encode_intc C sH d}| � |d�}d|v r"|�d�}t�||t� �}| j|fi |�� d S )Ni i Zpublic_exponent)r� r� r �generate_private_keyr �_import_pyca_pri_rsa)rc r� Zpubexpr� r� r r r �
_generate_RSA� s
zJWK._generate_RSAc K s| |� � }|jd| �|jj�| �|jj�| �|j�| �|j�| �|j�| �|j �| �|j
�| �|j �d� | j f i |�� d S )Nr0 ) rF r> r? r< r@ rA rB rC rD )
�private_numbers�updater� �public_numbersr> r? r< r@ rA Zdmp1Zdmq1Ziqmpr �rc r� r� �pnr r r r� � s
� zJWK._import_pyca_pri_rsac K s< |� � }|jd| �|j�| �|j�d� | jf i |�� d S )Nr0 )rF r> r? )r� r� r� r> r? r r� r r r �_import_pyca_pub_rsa� s
�zJWK._import_pyca_pub_rsac C s | � d�}|d u r|}n|dkr&d}n|}|rV|}|dkr>d}||krVtd||f ��| � d�}|d ur�|d ur�||kr�td||f ��|dkr�t�� S |dkr�t�� S |d kr�t�� S |dkr�t�� S |d
kr�t�� S |d kr�t� � S |d k� r�t�
� S |t v �r t | S td
| ��d S )Nr9 zP-256KrN z.Curve requested is "%s", but key curve is "%s"rF z>Curve Requested is of type "%s", but key curve is of type "%s"rK rL rM rO rP rQ zUnknown Curve Name [%s]) �getrz r_ r
Z SECP256R1Z SECP384R1Z SECP521R1Z SECP256K1ZBrainpoolP256R1ZBrainpoolP384R1ZBrainpoolP512R1�_OKP_CURVES_TABLE)rc r5 �ctyper9 ZcnameZccrvrF r r r �_get_curve_by_name� sH
�
�
zJWK._get_curve_by_namec C sX d}d|v r|� d�}d|v r(|� d�}| �|d�}t�|t� �}| j|fi |�� d S )NrK �curver9 r1 )r� r� r
r� r �_import_pyca_pri_ec)rc r� r� �curve_fnr� r r r � _generate_EC� s
zJWK._generate_ECc K sd |� � }|jjj}|jdt|jj | �|jj|�| �|jj |�| �|j
|�d� | j f i |�� d S )Nr1 )rF r9 r: r; r< ) r� r� r� �key_sizer� �JWKpycaCurveMapr5 r� r: r; Z
private_valuer �rc r� r� r� r� r r r r� � s
�zJWK._import_pyca_pri_ecc K sR |� � }|jj}|jdt|jj | �|j|�| �|j|�d� | j f i |�� d S )Nr1 )rF r9 r: r; )
r� r� r� r� r� r5 r� r: r; r r� r r r �_import_pyca_pub_ec s
�zJWK._import_pyca_pub_ecc C s@ d|vrt d��| �|d d�}|j�� }| j|fi |�� d S )Nr9 z)Must specify "crv" for OKP key generationr3 )rz r� �privkeyr �_import_pyca_pri_okp)rc r� r� r� r r r �
_generate_OKP s
zJWK._generate_OKPc C s< t �� D ]"\}}t||j|jf�r| S qtd| ��d S )NzInvalid OKP Key object %r)r� �items�
isinstance�pubkeyr� rz )rc r� r5 �valr r r �_okp_curve_from_pyca_key s
z JWK._okp_curve_from_pyca_keyc
K s^ |j d| �|�t|�tjjtjjt�� ��t|� � �
tjjtj j��d� | j f i |�� d S )Nr3 )rF r9 r< r: )
r� r� r �
private_bytesr �Encoding�Raw�
PrivateFormat� NoEncryption�
public_key� public_bytes� PublicFormatr �rc r� r� r r r r� s �
�� zJWK._import_pyca_pri_okpc K s> |j d| �|�t|�tjjtjj��d� | jf i |�� d S )Nr3 )rF r9 r: ) r� r� r r� r r� r� r� r r� r r r �_import_pyca_pub_okp& s ��zJWK._import_pyca_pub_okpc K s� i }d}d | _ d | _t|�� �}tt�� �D ],}||v r,|| ||< ||v r,|�|� qDq,|�d�}|tvrtt|��tt | �� �D ]4}||v r�|| ||< |d7 }||v r�|�|� q�q�t | �
� D �] \}}|j r�||vr�t d| ��|j
tjk�r||v �rt d| ��|j
tjk�rl||v �rlzt|| � W n4 t�yj } zt d| �|�W Y d }~n
d }~0 0 |j
tjkr�||v r�z| �|| � W q� t�y� } zt d| �|�W Y d }~q�d }~0 0 q�|D ]}|| ||< �q�|dk�r�t d��d |v �rF|d D ]>} d}
|d D ]} | | k�r|
d7 }
�q|
dk�rt d
���qd |v �r�d |v �r�d d
g} g d�}
|d dk�r�|
D ] }||d v �r|t d���q|n0|d dk�r�| D ] }||d v �r�t d���q�| �� | �d|d � | �|� d S )Nr rF � zMissing required value %szUnsupported parameter %s� "%s" is not base64url encoded�!"%s" is not Base64urlUInt encodedzNo Key Values foundrH z Duplicate values in "key_ops"rG rT rU )rV rW rX rY rZ r[ rR zBIncompatible "use" and "key_ops" values specified at the same timerS )r| r} rf rh �JWKParamsRegistry�remover� rg r_ �JWKValuesRegistryr� �requiredrz �typer4 r8 r6 r � Exceptionr7 � _decode_int�clear� __setitem__r� )rc r� ZnewkeyZkey_vals�namesr5 rF r� r? �koZcntZckoZsiglZenclrt r r r r 0 s�
����
zJWK.import_keyc
C sR | � }z t |�}W n* ty< } zt|�W Y d}~n
d}~0 0 |jf i |�� |S )z�Creates a RFC 7517 JWK from the standard JSON format.
:param key: The RFC 7517 representation of a JWK.
:return: A JWK object that holds the json key.
:rtype: JWK
N)r r� rz r )r r� r� Zjkeyr? r r r � from_json� s z
JWK.from_jsonTFc C s |du r| � |�S | �|�S )a� Exports the key in the standard JSON format.
Exports the key regardless of type, if private_key is False
and the key is_symmetric an exception is raised.
:param private_key(bool): Whether to export the private key.
Defaults to True.
:return: A portable representation of the key.
If as_dict is True then a dictionary is returned.
By default a json string
:rtype: `str` or `dict`
T)� _export_all�
export_public)rc � private_key�as_dictr r r �export� s
z
JWK.exportc C s | � � }|du r|S t|�S )a� Exports the public key in the standard JSON format.
It fails if one is not available like when this function
is called on a symmetric key.
:param as_dict(bool): If set to True export as python dict not JSON
:return: A portable representation of the public key only.
If as_dict is True then a dictionary is returned.
By default a json string
:rtype: `str` or `dict`
T)�_public_paramsr )rc r� �pubr r r r� � s zJWK.export_publicc C sx | j std��i }t}|D ](}|| jr|| �� v r| �|�||< qt| �d� }|D ] }|| jrV| �|�||< qV|S )N�No public key availablerF )�
has_publicr_ r� �publicrh r� r� )rc r� �regr5 r r r r� � s
zJWK._public_paramsc C s" i }|� | � |du r|S t|�S )NT)r� r )rc r� r< r r r r� � s
zJWK._export_allc C s | j r| �|�S td��dS )a� Export the private key in the standard JSON format.
It fails for a JWK that has only a public key or is symmetric.
:param as_dict(bool): If set to True export as python dict not JSON
:return: A portable representation of a private key.
If as_dict is True then a dictionary is returned.
By default a json string
:rtype: `str` or `dict`
�No private key availableN)� has_privater� r_ �rc r� r r r �export_private� s
zJWK.export_privatec C s | j r| �|�S td��d S )NzNot a symmetric key)� is_symmetricr� r_ r� r r r �export_symmetric� s
zJWK.export_symmetricc C s | � � }tf i |��S r
)r� r{ )rc r� r r r r� � s z
JWK.publicc C sB | j r
dS t| �d� }|D ] }|| jr || �� v r dS q dS )z4Whether this JWK has an asymmetric Public key value.FrF T�r� r� r� r� rh �rc r� r5 r r r r� � s zJWK.has_publicc C sB | j r
dS t| �d� }|D ] }|| js || �� v r dS q dS )z5Whether this JWK has an asymmetric Private key value.FrF Tr� r� r r r r� � s zJWK.has_privatec C s | � d�dkS )z$Whether this JWK is a symmetric key.rF r2 �r� ri r r r r� s zJWK.is_symmetric� c C s
| � d�S )z The Key typerF r� ri r r r �key_type s z JWK.key_typec C s
| � d�S )z^The Key ID.
Provided by the kid parameter if present, otherwise returns None.
rJ r� ri r r r �key_id s z
JWK.key_idc C s | � d�dvrtd��| � d�S )zThe Curve Name.rF )r1 r3 zNot an EC or OKP keyr9 )r� r_ ri r r r � key_curve s z
JWK.key_curvec C s
| � |�S )a0 Gets the Elliptic Curve associated with the key.
:param arg: an optional curve name
:raises InvalidJWKType: the key is not an EC or OKP key.
:raises InvalidJWKValue: if the curve name is invalid.
:return: An EllipticCurve object
:rtype: `EllipticCurve`
)r� )rc �argr r r � get_curve s z
JWK.get_curvec C sT | � d�}|r ||kr t||��| � d�}|rPt|t�s>|g}||vrPt||��d S )NrG rH )r� rn r� rf rs )rc rq rv rG �opsr r r �_check_constraints* s
zJWK._check_constraintsc C s t tt|��d�S )N� )�intr r )rc r> r r r r� 6 s zJWK._decode_intc C s, | � | �d��}| � | �d��}t�||�S )Nr? r> )r� r� r ZRSAPublicNumbers)rc r? r> r r r �
_rsa_pub_n9 s zJWK._rsa_pub_nc
C sz | � | �d��}| � | �d��}| � | �d��}| � | �d��}| � | �d��}| � | �d��}t�||||||| �� �S )Nr@ rA r< rB rC rD )r� r� r ZRSAPrivateNumbersr� )rc r@ rA r< rB rC rD r r r �
_rsa_pri_n> s zJWK._rsa_pri_nc C s( | j }|d u r$| �� �t� �}|| _ |S r
)r| r� r� r �rc rE r r r �_rsa_pubG s
z JWK._rsa_pubc C s( | j }|d u r$| �� �t� �}|| _ |S r
)r} r� r� r r� r r r �_rsa_priN s
z JWK._rsa_pric C s< | � | �d��}| � | �d��}| j|dd�}t�|||�S )Nr: r; r1 )r� )r� r� r� r
ZEllipticCurvePublicNumbers)rc r� r: r; r� r r r � _ec_pub_nU s z
JWK._ec_pub_nc C s" | � | �d��}t�|| �|��S )Nr< )r� r� r
ZEllipticCurvePrivateNumbersr� )rc r� r< r r r � _ec_pri_n[ s z
JWK._ec_pri_nc C s* | j }|d u r&| �|��t� �}|| _ |S r
)r| r� r� r �rc r� rE r r r �_ec_pub_ s
z JWK._ec_pubc C s* | j }|d u r&| �|��t� �}|| _ |S r
)r} r� r� r r� r r r �_ec_prif s
z JWK._ec_pric
C s| | j }|d u rx| �d�}zt| j}W n2 tyX } ztd| �|�W Y d }~n
d }~0 0 t| �d��}|�|�}|| _ |S )Nr9 �Unknown curve "%s"r: )r| r� r� r� r� rz r r )rc rE r9 r� r? r: r r r �_okp_pubm s
$
z JWK._okp_pubc
C s| | j }|d u rx| �d�}zt| j}W n2 tyX } ztd| �|�W Y d }~n
d }~0 0 t| �d��}|�|�}|| _ |S )Nr9 r� r< )r} r� r� r� r� rz r r )rc rE r9 r� r? r< r r r �_okp_pri{ s
$
z JWK._okp_pric C sV | � d�}|dkr | � d�S |dkr,| �� S |dkr>| �|�S |dkrN| �� S t�d S �NrF r2 rE r0 r1 r3 )r� r� r� r� r �rc r� Zktyper r r �_get_public_key� s
zJWK._get_public_keyc C sV | � d�}|dkr | � d�S |dkr,| �� S |dkr>| �|�S |dkrN| �� S t�d S r )r� r� r� r� r r r r r �_get_private_key� s
zJWK._get_private_keyc C s� | � dtt�� ��}|tur"|g}|du rN| � d�dkrB| � d�S t||��n�|dkrl| �d|� | �|�S |dkr�| �d|� | �|�S |d ks�|d
kr�| �d |� | �|�S |d ks�|d
kr�| �d |� | �|�S t�dS )a Get the key object associated to the requested operation.
For example the public RSA key for the 'verify' operation or
the private EC key for the 'decrypt' operation.
:param operation: The requested operation.
The valid set of operations is available in the
:data:`JWKOperationsRegistry` registry.
:param arg: An optional, context specific, argument.
For example a curve name.
:raises InvalidJWKOperation: if the operation is unknown or
not permitted with this key.
:raises InvalidJWKUsage: if the use constraints do not permit
the operation.
:return: A Python Cryptography key object for asymmetric keys
or a baseurl64_encoded octet string for symmetric keys
rH NrF r2 rE rT rR rU rV rX rS rW rY ) r� rf rw rh rs r� r r r )rc rv r� Zvalidopsr r r �
get_op_key� s,
�
zJWK.get_op_keyc C s� t |tj�r| �|� n�t |tj�r0| �|� ntt |tj�rH| �|� n\t |tj �r`| �
|� nDt |t t t
f�r|| �|� n(t |tttf�r�| �|� n td| ��d S )NzUnknown key object %r)r� r Z
RSAPrivateKeyr� Z RSAPublicKeyr� r
ZEllipticCurvePrivateKeyr� ZEllipticCurvePublicKeyr� r% r( r+ r� r$ r' r* r� rz �rc r� r r r �import_from_pyca� s& � � zJWK.import_from_pycac C s� zt j||t� d�}W n� ty� } zt|dur2|�zt j|t� d�}W nF ty� z tj|t� d�}|�� }W n ty� |�Y n0 Y n0 W Y d}~n
d}~0 0 | �|� |du r�| � � }| �
d|� dS )at Imports a key from data loaded from a PEM file.
The key may be encrypted with a password.
Private keys (PKCS#8 format), public keys, and X509 certificate's
public keys can be imported with this interface.
:param data(bytes): The data contained in a PEM file.
:param password(bytes): An optional password to unwrap the key.
)�password�backendN�r rJ ) r Zload_pem_private_keyr r� Zload_pem_public_keyr Zload_pem_x509_certificater� r �
thumbprintr� )rc �datar rJ r� r? Zcertr r r �import_from_pem� s.
�
�
� &
zJWK.import_from_pemc C s� t jj}|rx| jstd��t jj}|du r4t �� }n0t|t �rJt �
|�}n|du r\t d��nt d��| �
� j|||d�S | js�td��t jj}| �� j||d�S dS ) aq Exports keys to a data buffer suitable to be stored as a PEM file.
Either the public or the private key can be exported to a PEM file.
For private keys the PKCS#8 format is used. If a password is provided
the best encryption method available as determined by the cryptography
module is used to wrap the key.
:param private_key: Whether the private key should be exported.
Defaults to `False` which means the public key is exported by default.
:param password(bytes): A password for wrapping the private key.
Defaults to False which will cause the operation to fail. To avoid
encryption the user must explicitly pass None, otherwise the user
needs to provide a password in a bytes buffer.
:return: A serialized bytes buffer containing a PEM formatted key.
:rtype: `bytes`
r� NFz+The password must be None or a bytes stringz!The password string must be bytes)�encoding�formatZencryption_algorithmr� )r
r )r r� ZPEMr� r_ r� ZPKCS8r� r� �bytesZBestAvailableEncryptionr� � TypeErrorr r� r� r� ZSubjectPublicKeyInfor r� )rc r� r rS �fZenc_algr r r �
export_to_pem s&
�zJWK.export_to_pemc C s | � }|� |� |S r
)r )r r� r� r r r � from_pyca( s
z
JWK.from_pycac C s | � }|� ||� |S )a? Creates a key from PKCS#8 formatted data loaded from a PEM file.
See the function `import_from_pem` for details.
:param data(bytes): The data contained in a PEM file.
:param password(bytes): An optional password to unwrap the key.
:return: A JWK object.
:rtype: JWK
)r )r r r r� r r r �from_pem. s z JWK.from_pemc C sp d| � d�i}t|d �� D ] \}}|jr | � |�||< q tj|t� d�}|�tt |��
d��� t |� � �S )z�Returns the key thumbprint as specified by RFC 7638.
:param hashalg: A hash function (defaults to SHA256)
:return: A base64url encoded digest of the key
:rtype: `str`
rF r �utf8)
r� r� r� r� r ZHashr r� r r �encoder �finalize)rc Zhashalg�tr5 r� Zdigestr r r r
= s zJWK.thumbprintr^ c
C sn z t | }W n4 ty@ } z td�|��|�W Y d}~n
d}~0 0 |du rXtd�|���| �|�}d�||�S )ad Returns the key thumbprint URI as specified by RFC 9278.
:param hname: A hash function name as specified in IANA's
Named Information registry:
https://www.iana.org/assignments/named-information/
Values from `IANANamedInformationHashAlgorithmRegistry`
:return: A JWK Thumbprint URI
:rtype: `str`
zUnknown hash "{}"NzUnsupported hash "{}"z*urn:ietf:params:oauth:jwk-thumbprint:{}:{})�)IANANamedInformationHashAlgorithmRegistryr� rz r r
)rc Zhname�hr? r r r r �thumbprint_uriN s &
zJWK.thumbprint_uric
s� | � d�}|dkrP|d u r@|tvr*t|��tt| ��||� d S ||krPtd��|tt| � � �v �rTd | _
d | _ t| | j t
jkr�z(t|�}|dkr�|dkr�|dkr�t�W n2 ty� } ztd| �|�W Y d }~n
d }~0 0 nZt| | j t
jk�r>z| �|� W n4 t�y< } ztd| �|�W Y d }~n
d }~0 0 tt| ��||� d S |tt� � �v �r|tt| ��||� d S tt� � �D ]:}||k�r��q�|tt| � � �v �r�td�||����q�tt| ��||� d S ) NrF zCannot change key type� r2 rE r� r� z Cannot set '{}' on '{}' key type)r� rg r_ r` r{ r� r� rf r� rh r| r} r� r4 r6 r r� rz r7 r� r� r� r )rc �itemrb rF ry r? r5 rd r r r� e sZ
����
�
zJWK.__setitem__c O s, t |i |���� D ]\}}| �||� qdS �zV
:param \*args: arguments
:param \**kwargs: keyword arguments
N��dictr� r� �rc r r� rE ry r r r r� � s z
JWK.updatec C s" || � � vr| �||� | �|�S r
�rh r� r� �rc r� �defaultr r r �
setdefault� s zJWK.setdefaultc s� | � |�}|d u rt|��|dkrNtt| �� �D ]}| � |�d ur2td��q2| � d�}|d ur�|tt| �� �v r�d | _d | _tt| �� |� d S )NrF z#Cannot remove 'kty', values present)
r� r� rf r� rh r| r} r` r{ � __delitem__)rc r Zparamr5 rF rd r r r& � s
zJWK.__delitem__c C s2 t |t�stS | �� |�� ko0| �d�|�d�kS �NrJ )r� r{ �NotImplementedr
r� )rc �otherr r r �__eq__� s
�z
JWK.__eq__c C s t | �� | �d�f�S r' )�hashr
r� ri r r r �__hash__� s z JWK.__hash__c C s� zj|t �� v r&|| �� v r&| �|�W S | �d�}|d urd|tt| �� �v rd|| �� v rd| �|�W S t�W n ty� t|�d �Y n0 d S )NrF )r� rh r� rf r� r� r� )rc r rF r r r � __getattr__� s
zJWK.__getattr__c s� z`|t �� v r| �||� tt�� �D ]$}|tt| �� �v r&| �||� q&tt| ��||� W n t y| t
|�d �Y n0 d S r
) r� rh r� rf rg r� r` r{ � __setattr__r� r� )rc r rb r5 rd r r r. � s zJWK.__setattr__c
C sd | � }ddi}zt |�d��|d< W n* tyN } zt|�W Y d}~n
d}~0 0 |jf i |�� |S )z�Creates a symmetric JWK key from a user password.
:param password: A password in utf8 format.
:return: a JWK object
:rtype: JWK
rF r2 r rE N)r r r� rz r )r r r� r� r? r r r �
from_password� s zJWK.from_passwordc C s( i }| � dd�|d< | �� |d< t|�S )NrJ zMissing Key IDr
)r� r
r )rc � repr_dictr r r �__repr__� s z JWK.__repr__)N)N)N)TF)F)F)F)F)N)N)NN)NN)FF)N)r^ )N)Kr r! r" rl ra r# r r~ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r� r� r� r� r� r� r� r� �propertyr� r� r� r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r r r r r �SHA256r
r r� r� r% r& r* r, r- r. r/ r1 rm r r rd r r{ 3 s� )
.
W
*
!
&
9
r{ c @ s e Zd Zdd� ZdS )�_JWKkeysc C s" t |t�std��t�| |� dS )z�Adds a JWK object to the set
:param elem: the JWK object to add.
:raises TypeError: if the object is not a JWK.
z#Only JWK objects are valid elementsN)r� r{ r �set�add�rc �elemr r r r6 � s
z _JWKkeys.addN)r r! r" r6 r r r r r4 � s r4 c s� e Zd ZdZ� fdd�Zdd� Zdd� Z� fdd �Zd
d � Zd d
d�Z dd� Z
d dd�Z dd� Z e
dd� �Zdd� Zdd � Zd d � Z� ZS )!�JWKSetz�A set of JWK objects.
Inherits from the standard 'dict' builtin type.
Creates a special key 'keys' that is of a type derived from 'set'
The 'keys' attribute accepts only :class:`jwcrypto.jwk.JWK` elements.
c s6 t t| ��� t t| ��dt� � | j|i |�� d S �Nrh )r` r9 ra r� r4 r� )rc r r� rd r r ra s zJWKSet.__init__c C s | d � � S r: )�__iter__ri r r r r; s zJWKSet.__iter__c C s | d � |�S r: )� __contains__r r r r r< s zJWKSet.__contains__c s8 |dkr"t |t�s"| d �|� ntt| ��||� d S r: )r� r4 r6 r` r9 r� )rc r� r� rd r r r� s zJWKSet.__setitem__c O s, t |i |���� D ]\}}| �||� qdS r r r! r r r r� ! s z
JWKSet.updateNc C s" || � � vr| �||� | �|�S r
r" r# r r r r% ) s zJWKSet.setdefaultc C s | d � |� d S r: )r6 r7 r r r r6 . s z
JWKSet.addTFc C s` i }| � � D ]>\}}|dkrBg }|D ]}|�|j|dd�� q$|}|||< q |du rX|S t|�S )a Exports a RFC 7517 key set.
Exports as json by default, or as dict if requested.
:param private_key(bool): Whether to export private keys.
Defaults to True.
:param as_dict(bool): Whether to return a dict instead of
a JSON object
:return: A portable representation of the key set.
If as_dict is True then a dictionary is returned.
By default a json string
:rtype: `str` or `dict`
rh T)r� )r� rx r� r )rc Z private_keysr� Zexp_dictrE ry rh �jwkr r r r� 1 s
z
JWKSet.exportc
C s� z t |�}W n* ty6 } zt|�W Y d}~n
d}~0 0 d|vrDt�|�� D ]<\}}|dkr�|D ] }| d �tf i |��� q`qL|| |< qLdS )z�Imports a RFC 7517 key set using the standard JSON format.
:param keyset: The RFC 7517 representation of a JOSE key set.
Nrh )r r� rz r� r6 r{ )rc �keysetZjwksetr? rE ry r= r r r �
import_keysetK s zJWKSet.import_keysetc C s | � }|� |� |S )z�Creates a RFC 7517 key set from the standard JSON format.
:param keyset: The RFC 7517 representation of a JOSE key set.
:return: A JWKSet object.
:rtype: JWKSet
)r? )r r> r� r r r r� _ s
zJWKSet.from_jsonc C sF | � |�}t|�dkr td��zt|�d W S ty@ Y dS 0 dS )z�Gets a key from the set.
:param kid: the 'kid' key identifier.
:return: A JWK from the set
:rtype: JWK
r� z3Duplicate keys found with requested kid: 1 expectedr N)�get_keysr� rz �tuple�
IndexError)rc rJ rh r r r �get_keyl s
� zJWKSet.get_keyc s � fdd�| d D �S )z�Gets keys from the set with matching kid.
:param kid: the 'kid' key identifier.
:return: a List of keys
:rtype: `list`
c s h | ]}|� d �� kr|�qS �rJ r� )�.0r� rD r r � <setcomp>� r z"JWKSet.get_keys.<locals>.<setcomp>rh r )rc rJ r rD r r@ | s zJWKSet.get_keysc C sN i }| � � D ]8\}}|dkr<g }|D ]}|�t|�� q$|}|||< q t|�S r: )r� rx �reprr )rc r0 rE ry rh r= r r r r1 � s
zJWKSet.__repr__)N)TF)r r! r" rl ra r; r< r� r� r% r6 r� r? r# r� rC r@ r1 rm r r rd r r9 s
r9 )Qr� Zbinasciir r � collectionsr �enumr Z cryptographyr Z cryptography.hazmat.backendsr Z cryptography.hazmat.primitivesr r Z)cryptography.hazmat.primitives.asymmetricr
r Ztyping_extensionsr � ImportErrorZjwcrypto.commonr r r r r r ZImplementedOkpCurvesZ1cryptography.hazmat.primitives.asymmetric.ed25519r$ r% rx Z/cryptography.hazmat.primitives.asymmetric.ed448r' r( Z0cryptography.hazmat.primitives.asymmetric.x25519r* r+ r� Z
priv_bytesZ.cryptography.hazmat.primitives.asymmetric.x448r- r. Z_Ed25519_CURVEZ _Ed448_CURVEZ
_X25519_CURVEZ _X448_CURVEr� rg r4 Z JWKParameterr5 r6 r7 r8 r� r� ZJWKEllipticCurveRegistryrp rw r� r3 ZSHA384ZSHA512ZSHA3_224ZSHA3_256ZSHA3_384ZSHA3_512ZBLAKE2sZBLAKE2br r_ rn rs rz r r{ r5 r4 r9 r r r r �<module> sL
� �
���������" ������ � � N