File: //usr/lib/python3.6/site-packages/jwcrypto/__pycache__/jwe.cpython-36.opt-1.pyc
3
��Nf�L � @ s� d dl Z d dlmZ d dlmZ d dlmZmZ d dlmZmZ d dl m
Z
d4Z d5d6d7d8d9d:d;d<d=d>d?d@dAd�
Z dddd d d d d d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/gZ
G d0d1� d1e�ZejZejZejZejZG d2d3� d3e�ZdS )B� N)�common)� JWException)�base64url_decode�base64url_encode)� json_decode� json_encode)�JWA� i � AlgorithmT�Encryption Algorithm�Compression Algorithm� JWK Set URLF� JSON Web Key�Key ID� X.509 URL�X.509 Certificate Chain�"X.509 Certificate SHA-1 Thumbprint�$X.509 Certificate SHA-256 Thumbprint�Type� Content Type�Critical)
�alg�enc�zipZjkuZjwkZkidZx5uZx5cZx5tzx5t#S256�typZcty�critZRSA1_5zRSA-OAEPz RSA-OAEP-256ZA128KWZA192KWZA256KW�dirzECDH-ESzECDH-ES+A128KWzECDH-ES+A192KWzECDH-ES+A256KWZ A128GCMKWZ A192GCMKWZ A256GCMKWzPBES2-HS256+A128KWzPBES2-HS384+A192KWzPBES2-HS512+A256KWz
A128CBC-HS256z
A192CBC-HS384z
A256CBC-HS512ZA128GCMZA192GCMZA256GCMc s" e Zd ZdZd� fdd� Z� ZS )�InvalidJWEDatazvInvalid JWE Object.
This exception is raised when the JWE Object is invalid and/or
improperly formatted.
Nc s: d }|r|}nd}|r&|dt |� 7 }tt| �j|� d S )Nz!Unknown Data Verification Failurez {%s})�str�superr �__init__)�self�messageZ exception�msg)� __class__� �/usr/lib/python3.6/jwe.pyr 6 s zInvalidJWEData.__init__)NN)�__name__�
__module__� __qualname__�__doc__r �
__classcell__r% r% )r$ r& r / s r c @ s� e Zd ZdZd%dd�Zdd� Zdd� Zed d
� �Zej d d
� �Zd d
� Z
d&dd�Z dd� Z dd� Z
d'dd�Zd(dd�Zdd� Zdd � Zd d � Zd)d d �Zed!d"� �Zed#d$� �ZdS )*�JWEzGJSON Web Encryption object
This object represent a JWE token.
Nc C s� d| _ t� | _d| _|dk r:t|t�r.|| _n |jd�| _d| _d| _|rT|| jd< |r~t|t�rlt |�}nt
|� || jd< |r�t|t�r�t |�}nt
|� || jd< |r�|| _ |r�| j ||d� n |r�t
d��dS )a� Creates a JWE token.
:param plaintext(bytes): An arbitrary plaintext to be encrypted.
:param protected: A JSON string with the protected header.
:param unprotected: A JSON string with the shared unprotected header.
:param aad(bytes): Arbitrary additional authenticated data
:param algs: An optional list of allowed algorithms
:param recipient: An optional, default recipient key
:param header: An optional header for the default recipient
Nzutf-8�aad� protected� unprotected)�headerz-Header is allowed only with default recipient)�
_allowed_algs�dict�objects� plaintext�
isinstance�bytes�encode�cek�
decryptlogr r � allowed_algs�
add_recipient�
ValueError)r! r4 r. r/ r- �algsZ recipientr0 r% r% r& r N s6
z JWE.__init__c C s$ | j pt}||krtd��tj|�S )NzAlgorithm not allowed)r1 �default_allowed_algs�InvalidJWEOperationr Z keymgmt_alg)r! �name�allowedr% r% r& � _jwa_keymgmtz s
zJWE._jwa_keymgmtc C s$ | j pt}||krtd��tj|�S )NzAlgorithm not allowed)r1 r> r? r Zencryption_alg)r! r@ rA r% r% r& �_jwa_enc� s
z JWE._jwa_encc C s | j r | j S tS dS )z�Allowed algorithms.
The list of allowed algorithms.
Can be changed by setting a list of algorithm names.
N)r1 r> )r! r% r% r& r: � s zJWE.allowed_algsc C s t |t�std��|| _d S )NzAllowed Algs must be a list)r5 �list� TypeErrorr1 )r! r= r% r% r& r: � s
c C s8 x(t |j� �D ]}||krtd| ��qW |j|� |S )NzDuplicate header: "%s")rD �keysr �update)r! Zh1Zh2�kr% r% r& �_merge_headers� s
zJWE._merge_headersc C sj t � }d| jkr*t| jd �}| j||�}d| jkrNt| jd �}| j||�}|rft|�}| j||�}|S )Nr. r/ )r2 r3 r rI )r! r0 �jh�phZuhZrhr% r% r& �_get_jose_header� s
zJWE._get_jose_headerc C sT |j dd �}|d kr td��| j|�}|j dd �}|d krBtd��| j|�}||fS )Nr zMissing "alg" from headersr zMissing "enc" from headers)�getr rB rC )r! rJ Zalgnamer Zencnamer r% r% r& �_get_alg_enc_from_headers� s
z JWE._get_alg_enc_from_headersc
C s� t | jjdd��}d| jkr2|dt | jd � 7 }|jd�}|jdd �}|dkrftj| j�dd� }n|d krv| j}ntd
��|j| j ||�\}}} || jd < || jd < | | jd
< d S )Nr. � r- �.zutf-8r �DEF� � zUnknown compression�iv�
ciphertext�tag���)
r r3 rM r7 �zlib�compressr4 r< Zencryptr8 )
r! r r rJ r- rY �datarT rU rV r% r% r& �_encrypt� s
z JWE._encryptc C s� | j dkrtd��t| j t�s&td��t|t�r8t|�}| j|�}| j|�\}}t� }|rb||d< |j||j | j
|�}|d | _
d|kr�|d |d< d|kr�t |j dd��}| j
||d �} t| �|d< d | jkr�| j|||� d
| jkr�| jd
j|� n�d| jk�sd| jk�r�t� | jd
< t� }
d| jk�rB| jjd�|
d< d| jk�r^| jjd�|
d< | jd
j|
� | jd
j|� n | jj|� dS ) a Encrypt the plaintext with the given key.
:param key: A JWK key or password of appropriate type for the 'alg'
provided in the JOSE Headers.
:param header: A JSON string representing the per-recipient header.
:raises ValueError: if the plaintext is missing or not of type bytes.
:raises ValueError: if the compression type is unknown.
:raises InvalidJWAAlgorithm: if the 'alg' provided in the JOSE
headers is missing or unknown, or otherwise not implemented.
NzMissing plaintextzPlaintext must be 'bytes'r0 r8 Zek�
encrypted_keyz{}rU �
recipients)r4 r< r5 r6 r2 r rL rN Zwrap�
wrap_key_sizer8 r rM rI r3 r[ �appendrD �poprG ) r! �keyr0 rJ r r �rec�wrapped�hZnh�nr% r% r& r; � sB
zJWE.add_recipientFc
C s� d| j krtd��|�rjx"dD ]}|| j kr td| ��q W d| j krPtd��n0t| j d �}x dD ]}||krdtd
| ��qdW d | j kr�t| j d �d kr�td
��| j d d }n| j }d|k�r"t|d �}t| j d �}| j||�}t|�| j d< | j� }| j|�\} }
| j| |
|� |d= dj t
| j d �t
|j dd��t
| j d �t
| j d �t
| j d �g�S | j } t
| d �t
| d �t
| j d �d�}
d| k�r�t
| d �|
d< d| k�r�t| d �|
d< d| k�r�t
| d �|
d< d | k�rVt � |
d < x�| d D ]N}t
� } d|k�r&t
|d �| d< d|k�r@t|d �| d< |
d j| � �qW n4d| k�rpt
| d �|
d< d| k�r�t| d �|
d< t|
�S dS )a� Serializes the object into a JWE token.
:param compact(boolean): if True generates the compact
representation, otherwise generates a standard JSON format.
:raises InvalidJWEOperation: if the object cannot serialized
with the compact representation and `compact` is True.
:raises InvalidJWEOperation: if no recipients have been added
to the object.
rU zNo available ciphertextr- r/ z8Can't use compact encoding when the '%s' parameteris setr. z3Can't use compat encoding without protected headersr r z?Can't use compat encoding, '%s' must be in the protected headerr] � z Invalid number of recipientsr r0 rP r\ rO rT rV )rU rT rV N)r- r/ )r r )r3 r? r �lenrI r rL rN r[ �joinr rM rD r2 r_ )
r! ZcompactZinvalidrK Zrequiredrb rd ZnphrJ r r �obj�er% r% r& � serialize sx
z
JWE.serializec C s@ x:|D ]2}|t kr td| ��qt | d std| ��qW d S )Nz Unknown critical header: "%s"rf z!Unsupported critical header: "%s")�JWEHeaderRegistryr )r! r rH r% r% r& � _check_critW s
zJWE._check_critc
C s< | j |jdd ��}| j|jdt� �� | j|jdd ��}| j|jdd ��}t| jjdd��}d| jkr||dt| jd � 7 }|j||j |jd d
�|�}|j
||j d �| jd | jd
| jd �}| j j
d� || _|jdd �} | dk�r t|�tk�r
tddt� d� ��tj|tj �| _n| d k�r0|| _ntd��d S )Nr0 r r r r. rO r- rP r\ � zutf-8rT rU rV ZSuccessr rQ z+Compressed data exceeds maximum allowedsizez (�)zUnknown compression)rL rM rm r2 rB rC r r3 Zunwrapr^ �decryptr7 r9 r_ r8 rg �default_max_compressed_sizer rX Z
decompressZ MAX_WBITSr4 r< )
r! ra ZpperJ r r r- r8 rZ rY r% r% r& �_decrypta s2
z JWE._decryptc C s� d| j krtd��t� | _d| j kr�x�| j d D ]L}y| j||� W q0 tk
rz } z| jjdt|� � W Y dd}~X q0X q0W nJy| j|| j � W n6 tk
r� } z| jjdt|� � W Y dd}~X nX | js�t dt| j� ��dS )a� Decrypt a JWE token.
:param key: The (:class:`jwcrypto.jwk.JWK`) decryption key.
:param key: A (:class:`jwcrypto.jwk.JWK`) decryption key or a password
string (optional).
:raises InvalidJWEOperation: if the key is not a JWK object.
:raises InvalidJWEData: if the ciphertext can't be decrypted or
the object is otherwise malformed.
rU zNo available ciphertextr] z Failed: [%s]Nz%No recipient matched the provided key)
r3 r? rD r9 rr � Exceptionr_ �reprr4 r )r! ra rb rj r% r% r& rp � s
,&z JWE.decryptc
C sF t � | _d| _d| _t � }�y�y0t|�}t|d �|d< t|d �|d< t|d �|d< d|kr|t|d �}|jd�|d< d|kr�t|d �|d< d|kr�t|d �|d< d |k�rt� |d < x�|d D ]J}t � }d
|kr�t|d
�|d
< d |k�rt|d �|d < |d j |� q�W n4d
|k�r4t|d
�|d
< d |k�rNt|d �|d < W n� t
k
�r� |j d �}t |�d
k�r�t
� �t|d �}|jd�|d< t|d �} | dk�r�t|d �|d
< t|d �|d< t|d �|d< t|d �|d< Y nX || _W n2 tk
�r0 } zt
dt|���W Y dd}~X nX |�rB| j|� dS )aK Deserialize a JWE token.
NOTE: Destroys any current status and tries to import the raw
JWE provided.
:param raw_jwe: a 'raw' JWE token (JSON Encoded or Compact
notation) string.
:param key: A (:class:`jwcrypto.jwk.JWK`) decryption key or a password
string (optional).
If a key is provided a decryption step will be attempted after
the object is successfully deserialized.
:raises InvalidJWEData: if the raw object is an invaid JWE token.
:raises InvalidJWEOperation: if the decryption fails.
NrT rU rV r. zutf-8r/ r- r] r\ r0 rP � r rf rn rR � rS zInvalid format)r2 r3 r4 r8 r r �decoder rD r_ r< �splitrg r rs rt rp )
r! Zraw_jwera �oZdjwe�prb rj �cZekeyr% r% r& � deserialize� s^
zJWE.deserializec C s | j std��| j S )NzPlaintext not available)r4 r? )r! r% r% r& �payload� s z JWE.payloadc C s | j � }t|�dkr td��|S )Nr zJOSE Header not available)rL rg r? )r! rJ r% r% r& � jose_header� s zJWE.jose_header)NNNNNNN)N)N)F)N)r' r( r) r* r rB rC �propertyr: �setterrI rL rN r[ r; rk rm rr rp r| r} r~ r% r% r% r& r, H s&
+
7
U
$
I r, i )r
T)r T)r T)r
F)r F)r T)r F)r F)r F)r F)r T)r T)r T)rX Zjwcryptor Zjwcrypto.commonr r r r r Z jwcrypto.jwar rq rl r> r ZInvalidCEKeyLengthZInvalidJWEKeyLengthZInvalidJWEKeyTyper? �objectr, r% r% r% r& �<module> sD