a
    !fs                     @   s"  d dl Z d dlZd dlmZmZ d dlmZmZ d dlm	Z	 d dl
mZ d dlmZmZmZ d dlmZ d dlmZ d d	lmZ d d
lmZmZmZ d dlmZ d dlmZ d dlmZmZ d dl m!Z! d dl"m#Z# d dl"m$Z$ d dl"m%Z% d dl"m&Z& d dl"m'Z' d dl"m(Z(m)Z) d dl"m*Z* d dl+m,Z, dZ-G dd dedZ.dd Z/dd Z0dd  Z1d!d" Z2d#d$ Z3G d%d& d&Z4G d'd( d(e4Z5G d)d* d*e4Z6G d+d, d,e4Z7G d-d. d.e4Z8G d/d0 d0e5e.Z9G d1d2 d2e5e.Z:G d3d4 d4e5e.Z;G d5d6 d6e6e.Z<G d7d8 d8e6e.Z=G d9d: d:e6e.Z>G d;d< d<e7e.Z?G d=d> d>e7e.Z@G d?d@ d@e7e.ZAG dAdB dBe7e.ZBG dCdD dDe6e.ZCG dEdF dFe6e.ZDG dGdH dHe6e.ZEG dIdJ dJe8e.ZFG dKdL dLZGG dMdN dNeGZHG dOdP dPeHe.ZIG dQdR dReHe.ZJG dSdT dTeHe.ZKG dUdV dVeGZLG dWdX dXeLe.ZMG dYdZ dZeLe.ZNG d[d\ d\eLe.ZOG d]d^ d^eGZPG d_d` d`ePe.ZQG dadb dbePe.ZRG dcdd ddePe.ZSG dedf dfeGZTG dgdh dheTe.ZUG didj djeTe.ZVG dkdl dleTe.ZWG dmdn dneGe.ZXG dodp dpeGe.ZYG dqdr dreYZZG dsdt dteYZ[G dudv dveYZ\G dwdx dxe4e.Z]G dydz dzZ^G d{d| d|e^Z_G d}d~ d~e_e.Z`G dd de_e.ZaG dd de_e.ZbG dd de^ZcG dd dece.ZdG dd dece.ZeG dd dece.ZfG dd de7e.ZgG dd de7e.ZhG dd de7e.ZiG dd dZjdS )    N)ABCMetaabstractmethod)hexlify	unhexlify)InvalidSignature)default_backend)constant_timehasheshmac)ec)padding)utils)Cipher
algorithmsmodes)ConcatKDFHash)
PBKDF2HMAC)aes_key_unwrapaes_key_wrap)PKCS7)InvalidCEKeyLength)InvalidJWAAlgorithm)InvalidJWEKeyLength)InvalidJWEKeyType)InvalidJWEOperation)base64url_decodebase64url_encode)json_decode)JWKi @  c                   @   sh   e Zd Zeedd Zeedd Zeedd Zeedd Zeed	d
 Z	edd Z
dS )JWAAlgorithmc                 C   s   dS )zThe algorithm NameN selfr    r    M/var/www/html/python-backend/venv/lib/python3.9/site-packages/jwcrypto/jwa.pyname$   s    zJWAAlgorithm.namec                 C   s   dS )zA short descriptionNr    r!   r    r    r#   description)   s    zJWAAlgorithm.descriptionc                 C   s   dS )zThe algorithm key sizeNr    r!   r    r    r#   keysize.   s    zJWAAlgorithm.keysizec                 C   s   dS )zOne of 'alg', 'enc' or 'JWK'Nr    r!   r    r    r#   algorithm_usage_location3   s    z%JWAAlgorithm.algorithm_usage_locationc                 C   s   dS )zOne of 'sig', 'kex', 'enc'Nr    r!   r    r    r#   algorithm_use8   s    zJWAAlgorithm.algorithm_usec                 C   s&   z| j W S  ty    | j Y S 0 dS )zThe input key sizeN)wrap_key_sizeAttributeErrorr&   r!   r    r    r#   input_keysize=   s    zJWAAlgorithm.input_keysizeN)__name__
__module____qualname__propertyr   r$   r%   r&   r'   r(   r+   r    r    r    r#   r   "   s"   r   )	metaclassc                 C   s   t | d S N   )lenxr    r    r#   _bitsizeF   s    r6   c                 C   s   | d S r1   r    r4   r    r    r#   _inbytesJ   s    r7   c                 C   s"   | d dkrt dtt| S )Nr2   r   zlength must be a multiple of 8)
ValueErrorosurandomr7   r4   r    r    r#   _randombitsN   s    r;   c                 C   s2   d | }|d d d }t||dd | S )Nz{:x}   r2      0)formatr   rjust)nbitseZilenr    r    r#   _encode_intU   s    
rD   c                 C   s   t t| dS )N   )intr   )rA   r    r    r#   _decode_int[   s    rG   c                   @   s   e Zd Zdd Zdd ZdS )_RawJWSc                 C   s   t d S NNotImplementedErrorr"   keypayloadr    r    r#   signa   s    z_RawJWS.signc                 C   s   t d S rI   rJ   r"   rM   rN   	signaturer    r    r#   verifyd   s    z_RawJWS.verifyNr,   r-   r.   rO   rR   r    r    r    r#   rH   _   s   rH   c                   @   s,   e Zd Zdd Zdd Zdd Zdd Zd	S )
_RawHMACc                 C   s   t  | _|| _d S rI   )r   backendhashfnr"   rV   r    r    r#   __init__j   s    z_RawHMAC.__init__c                 C   s"   t j|| j| jd}|| |S )NrU   )r
   HMACrV   rU   update)r"   rM   rN   hr    r    r#   _hmac_setupn   s    
z_RawHMAC._hmac_setupc                 C   s"   t |d}| ||}| S NrO   )r   
get_op_keyr]   finalize)r"   rM   rN   skeyr\   r    r    r#   rO   s   s    z_RawHMAC.signc                 C   s(   t |d}| ||}|| d S NrR   )r   r_   r]   rR   )r"   rM   rN   rQ   Zvkeyr\   r    r    r#   rR   x   s    z_RawHMAC.verifyN)r,   r-   r.   rX   r]   rO   rR   r    r    r    r#   rT   h   s   rT   c                   @   s$   e Zd Zdd Zdd Zdd ZdS )_RawRSAc                 C   s   || _ || _d S rI   )padfnrV   )r"   rd   rV   r    r    r#   rX      s    z_RawRSA.__init__c                 C   s   | d}||| j| jS r^   )r_   rO   rd   rV   r"   rM   rN   ra   r    r    r#   rO      s    
z_RawRSA.signc                 C   s"   | d}|||| j| j d S rb   )r_   rR   rd   rV   r"   rM   rN   rQ   pkeyr    r    r#   rR      s    
z_RawRSA.verifyN)r,   r-   r.   rX   rO   rR   r    r    r    r#   rc   ~   s   rc   c                   @   s0   e Zd Zdd Zedd Zdd Zdd Zd	S )
_RawECc                 C   s   || _ || _d S rI   )_curverV   )r"   curverV   r    r    r#   rX      s    z_RawEC.__init__c                 C   s   | j S rI   )ri   r!   r    r    r#   rj      s    z_RawEC.curvec                 C   sJ   | d| j}|j}||t| j}t|\}}t	||t	|| S r^   )
r_   ri   Zkey_sizerO   r   ECDSArV   ec_utilsZdecode_dss_signaturerD   )r"   rM   rN   ra   sizerQ   rsr    r    r#   rO      s
    z_RawEC.signc                 C   sp   | d| j}|d t|d  }|t|d d  }ttt|dtt|d}|||t	| j
 d S )NrR   r=   rE   )r_   ri   r3   rl   Zencode_dss_signaturerF   r   rR   r   rk   rV   )r"   rM   rN   rQ   rg   rn   ro   Zenc_signaturer    r    r#   rR      s    z_RawEC.verifyN)r,   r-   r.   rX   r/   rj   rO   rR   r    r    r    r#   rh      s
   
rh   c                   @   s   e Zd Zdd Zdd ZdS )_RawNonec                 C   s   dS )N r    rL   r    r    r#   rO      s    z_RawNone.signc                 C   s$   |d dks|  dkr tdd S )Nktyoctrq   z'The "none" signature cannot be verified)r_   r   rP   r    r    r#   rR      s    z_RawNone.verifyNrS   r    r    r    r#   rp      s   rp   c                       s0   e Zd ZdZdZdZdZdZ fddZ  Z	S )_HS256HS256zHMAC using SHA-256   algsigc                    s   t t| t  d S rI   )superrt   rX   r	   SHA256r!   	__class__r    r#   rX      s    z_HS256.__init__
r,   r-   r.   r$   r%   r&   r'   r(   rX   __classcell__r    r    r{   r#   rt      s   rt   c                       s0   e Zd ZdZdZdZdZdZ fddZ  Z	S )_HS384HS384zHMAC using SHA-384  rw   rx   c                    s   t t| t  d S rI   )ry   r   rX   r	   SHA384r!   r{   r    r#   rX      s    z_HS384.__init__r}   r    r    r{   r#   r      s   r   c                       s0   e Zd ZdZdZdZdZdZ fddZ  Z	S )_HS512HS512zHMAC using SHA-512   rw   rx   c                    s   t t| t  d S rI   )ry   r   rX   r	   SHA512r!   r{   r    r#   rX      s    z_HS512.__init__r}   r    r    r{   r#   r      s   r   c                       s0   e Zd ZdZdZdZdZdZ fddZ  Z	S )_RS256RS256zRSASSA-PKCS1-v1_5 using SHA-256   rw   rx   c                    s   t t| t t  d S rI   )ry   r   rX   r   PKCS1v15r	   rz   r!   r{   r    r#   rX      s    z_RS256.__init__r}   r    r    r{   r#   r      s   r   c                       s0   e Zd ZdZdZdZdZdZ fddZ  Z	S )_RS384RS384zRSASSA-PKCS1-v1_5 using SHA-384r   rw   rx   c                    s   t t| t t  d S rI   )ry   r   rX   r   r   r	   r   r!   r{   r    r#   rX      s    z_RS384.__init__r}   r    r    r{   r#   r      s   r   c                       s0   e Zd ZdZdZdZdZdZ fddZ  Z	S )_RS512RS512zRSASSA-PKCS1-v1_5 using SHA-512r   rw   rx   c                    s   t t| t t  d S rI   )ry   r   rX   r   r   r	   r   r!   r{   r    r#   rX      s    z_RS512.__init__r}   r    r    r{   r#   r      s   r   c                       s0   e Zd ZdZdZdZdZdZ fddZ  Z	S )_ES256ES256zECDSA using P-256 and SHA-256rv   rw   rx   c                    s   t t| dt  d S )NzP-256)ry   r   rX   r	   rz   r!   r{   r    r#   rX      s    z_ES256.__init__r}   r    r    r{   r#   r      s   r   c                       s0   e Zd ZdZdZdZdZdZ fddZ  Z	S )_ES256KES256Kz'ECDSA using secp256k1 curve and SHA-256rv   rw   rx   c                    s   t t| dt  d S )NZ	secp256k1)ry   r   rX   r	   rz   r!   r{   r    r#   rX     s    z_ES256K.__init__r}   r    r    r{   r#   r     s   r   c                       s0   e Zd ZdZdZdZdZdZ fddZ  Z	S )_ES384ES384zECDSA using P-384 and SHA-384r   rw   rx   c                    s   t t| dt  d S )NzP-384)ry   r   rX   r	   r   r!   r{   r    r#   rX     s    z_ES384.__init__r}   r    r    r{   r#   r     s   r   c                       s0   e Zd ZdZdZdZdZdZ fddZ  Z	S )_ES512ES512zECDSA using P-521 and SHA-512r   rw   rx   c                    s   t t| dt  d S )NzP-521)ry   r   rX   r	   r   r!   r{   r    r#   rX   #  s    z_ES512.__init__r}   r    r    r{   r#   r     s   r   c                       s0   e Zd ZdZdZdZdZdZ fddZ  Z	S )_PS256PS256z.RSASSA-PSS using SHA-256 and MGF1 with SHA-256r   rw   rx   c                    s4   t t t tjj}tt| |t  d S rI   )	r   PSSMGF1r	   rz   digest_sizery   r   rX   r"   rd   r{   r    r#   rX   /  s    z_PS256.__init__r}   r    r    r{   r#   r   '  s   r   c                       s0   e Zd ZdZdZdZdZdZ fddZ  Z	S )_PS384PS384z.RSASSA-PSS using SHA-384 and MGF1 with SHA-384r   rw   rx   c                    s4   t t t tjj}tt| |t  d S rI   )	r   r   r   r	   r   r   ry   r   rX   r   r{   r    r#   rX   =  s    z_PS384.__init__r}   r    r    r{   r#   r   5  s   r   c                       s0   e Zd ZdZdZdZdZdZ fddZ  Z	S )_PS512PS512z.RSASSA-PSS using SHA-512 and MGF1 with SHA-512r   rw   rx   c                    s4   t t t tjj}tt| |t  d S rI   )	r   r   r   r	   r   r   ry   r   rX   r   r{   r    r#   rX   K  s    z_PS512.__init__r}   r    r    r{   r#   r   C  s   r   c                   @   s    e Zd ZdZdZdZdZdZdS )_Nonenonez%No digital signature or MAC performedr   rw   rx   Nr,   r-   r.   r$   r%   r&   r'   r(   r    r    r    r#   r   Q  s
   r   c                   @   s   e Zd Zdd Zdd ZdS )_RawKeyMgmtc                 C   s   t d S rI   rJ   )r"   rM   bitsizecekheadersr    r    r#   wrap\  s    z_RawKeyMgmt.wrapc                 C   s   t d S rI   rJ   )r"   rM   r   ekr   r    r    r#   unwrap_  s    z_RawKeyMgmt.unwrapN)r,   r-   r.   r   r   r    r    r    r#   r   Z  s   r   c                   @   s,   e Zd Zdd Zdd Zdd Zdd Zd	S )
_RSAc                 C   s
   || _ d S rI   )rd   r   r    r    r#   rX   e  s    z_RSA.__init__c                 C   s0   t |tstd|d dkr,td|d d S )Nkey is not a JWK objectrr   ZRSA
isinstancer   r8   r   r"   rM   r    r    r#   
_check_keyh  s    
z_RSA._check_keyc                 C   s8   |  | |st|}|d}||| j}||dS )NwrapKeyr   r   )r   r;   r_   encryptrd   r"   rM   r   r   r   rkr   r    r    r#   r   o  s    

z	_RSA.wrapc                 C   s@   |  | |d}||| j}t||kr<t|t||S )N	unwrapKey)r   r_   decryptrd   r6   r   r"   rM   r   r   r   r   r   r    r    r#   r   w  s    

z_RSA.unwrapN)r,   r-   r.   rX   r   r   r   r    r    r    r#   r   c  s   r   c                       s<   e Zd ZdZdZdZdZdZ fddZ fdd	Z	  Z
S )
_Rsa15RSA1_5zRSAES-PKCS1-v1_5r   rw   kexc                    s   t t| t  d S rI   )ry   r   rX   r   r   r!   r{   r    r#   rX     s    z_Rsa15.__init__c                    sP   |  | t|}z"tt| ||||}tdW n tyJ   | Y S 0 d S )NZDummy)r   r;   ry   r   r   r8   	Exceptionr"   rM   r   r   r   r   r{   r    r#   r     s    
z_Rsa15.unwrap)r,   r-   r.   r$   r%   r&   r'   r(   rX   r   r~   r    r    r{   r#   r     s   r   c                       s0   e Zd ZdZdZdZdZdZ fddZ  Z	S )_RsaOaepRSA-OAEPz#RSAES OAEP using default parametersr   rw   r   c                    s,   t t| ttt t d  d S rI   )ry   r   rX   r   OAEPr   r	   SHA1r!   r{   r    r#   rX     s
    
z_RsaOaep.__init__r}   r    r    r{   r#   r     s   r   c                       s0   e Zd ZdZdZdZdZdZ fddZ  Z	S )_RsaOaep256RSA-OAEP-256z.RSAES OAEP using SHA-256 and MGF1 with SHA-256r   rw   r   c                    s,   t t| ttt t d  d S rI   )ry   r   rX   r   r   r   r	   rz   r!   r{   r    r#   rX     s
    
z_RsaOaep256.__init__r}   r    r    r{   r#   r     s   r   c                   @   s0   e Zd ZdZdd Zdd Zdd Zdd	 ZdS )
_AesKwNc                 C   s   t  | _d S rI   r   rU   r!   r    r    r#   rX     s    z_AesKw.__init__c                 C   s\   t |tstd|d dkr,td|d t||}t|| jkrXt| jt||S Nr   rr   rs   	r   r   r8   r   r   r_   r6   r&   r   r"   rM   opr   r    r    r#   _get_key  s    
z_AesKw._get_keyc                 C   s0   |  |d}|st|}t||t }||dS )Nr   r   )r   r;   r   r   r   r    r    r#   r     s
    z_AesKw.wrapc                 C   s8   |  |d}t||t }t||kr4t|t||S )Nr   )r   r   r   r6   r   r   r    r    r#   r     s
    z_AesKw.unwrapr,   r-   r.   r&   rX   r   r   r   r    r    r    r#   r     s
   
	r   c                   @   s    e Zd ZdZdZdZdZdZdS )_A128KWA128KWzAES Key Wrap using 128-bit key   rw   r   Nr   r    r    r    r#   r     s
   r   c                   @   s    e Zd ZdZdZdZdZdZdS )_A192KWA192KWzAES Key Wrap using 192-bit key   rw   r   Nr   r    r    r    r#   r     s
   r   c                   @   s    e Zd ZdZdZdZdZdZdS )_A256KWA256KWzAES Key Wrap using 256-bit keyrv   rw   r   Nr   r    r    r    r#   r     s
   r   c                   @   s0   e Zd ZdZdd Zdd Zdd Zdd	 ZdS )
	_AesGcmKwNc                 C   s   t  | _d S rI   r   r!   r    r    r#   rX     s    z_AesGcmKw.__init__c                 C   s\   t |tstd|d dkr,td|d t||}t|| jkrXt| jt||S r   r   r   r    r    r#   r     s    
z_AesGcmKw._get_keyc                 C   sv   |  |d}|st|}td}tt|t|| jd}| }|	||
  }	|j}
||	t|t|
ddS )Nr   `   rY   )ivtag)r   r   header)r   r;   r   r   AESr   GCMrU   	encryptorr[   r`   r   r   )r"   rM   r   r   r   r   r   cipherr   r   r   r    r    r#   r     s    z_AesGcmKw.wrapc                 C   s   |  |d}d|vrtdt|d }d|vr8tdt|d }tt|t||| jd}|	 }	|	
||	  }
t|
|krt|t|
|
S )Nr   r   z&Invalid Header, missing "iv" parameterr   z'Invalid Header, missing "tag" parameterrY   )r   r8   r   r   r   r   r   r   rU   	decryptorr[   r`   r6   r   )r"   rM   r   r   r   r   r   r   r   r   r   r    r    r#   r     s    z_AesGcmKw.unwrapr   r    r    r    r#   r     s
   
r   c                   @   s    e Zd ZdZdZdZdZdZdS )
_A128GcmKw	A128GCMKWz+Key wrapping with AES GCM using 128-bit keyr   rw   r   Nr   r    r    r    r#   r   +  s
   r   c                   @   s    e Zd ZdZdZdZdZdZdS )
_A192GcmKw	A192GCMKWz+Key wrapping with AES GCM using 192-bit keyr   rw   r   Nr   r    r    r    r#   r   4  s
   r   c                   @   s    e Zd ZdZdZdZdZdZdS )
_A256GcmKw	A256GCMKWz+Key wrapping with AES GCM using 256-bit keyrv   rw   r   Nr   r    r    r    r#   r   =  s
   r   c                   @   s8   e Zd ZdZdZdZdd Zdd Zdd Zdd	 Z	dS )
_Pbes2HsAesKwNc                 C   s   t  | _tttd| _d S N)r   r   rv   r   rU   r   r   r   aeskwmapr!   r    r    r#   rX   L  s    z_Pbes2HsAesKw.__init__c           
      C   s   |t krtdt|ts6t|tr*|}qB|d}nt| }t| jdd | }| j	dkrnt
 }n0| j	dkrt
 }n| j	dkrt
 }ntdt|t| j||| jd}||}	t|	| jkrt| jt|	td	d
t|	dS )NzInvalid p2c value, too largeutf8    rv   r   r   zUnknown Hash Size)	algorithmlengthsaltZ
iterationsrU   rs   encrr   usek)default_max_pbkdf2_iterationsr8   r   r   bytesencoder   r_   r$   hashsizer	   rz   r   r   r   r7   r&   rU   deriver6   r   r3   r   )
r"   rw   rM   p2sp2cplainr   ZhashalgZkdfr   r    r    r#   r   P  s,    








z_Pbes2HsAesKw._get_keyc                 C   s   i }d|v r.t |d }t|dk rBtdntd}t||d< d|v rT|d }nd}||d< | |d |||}| j| j  }	|	||||}
t|dkr||
d	< |
S )
Nr   r2   z'Invalid Salt, must be 8 or more octectsr   r   i    rw   r   r   )	r   r3   r8   r;   r   r   r   r&   r   )r"   rM   r   r   r   Z
ret_headerr   r   kekaeskwretr    r    r#   r   o  s"    

z_Pbes2HsAesKw.wrapc           	      C   sf   d|vrt dd|vr t dt|d }|d }| |d |||}| j| j  }|||||S )Nr   z'Invalid Header, missing "p2s" parameterr   z'Invalid Header, missing "p2c" parameterrw   )r8   r   r   r   r&   r   )	r"   rM   r   r   r   r   r   r   r   r    r    r#   r     s    z_Pbes2HsAesKw.unwrap)
r,   r-   r.   r$   r&   r   rX   r   r   r   r    r    r    r#   r   F  s   r   c                   @   s$   e Zd ZdZdZdZdZdZdZdS )_Pbes2Hs256A128KwPBES2-HS256+A128KWz-PBES2 with HMAC SHA-256 and "A128KW" wrappingr   rw   r   rv   N	r,   r-   r.   r$   r%   r&   r'   r(   r   r    r    r    r#   r     s   r   c                   @   s$   e Zd ZdZdZdZdZdZdZdS )_Pbes2Hs384A192KwPBES2-HS384+A192KWz-PBES2 with HMAC SHA-384 and "A192KW" wrappingr   rw   r   r   Nr   r    r    r    r#   r     s   r   c                   @   s$   e Zd ZdZdZdZdZdZdZdS )_Pbes2Hs512A256KwPBES2-HS512+A256KWz-PBES2 with HMAC SHA-512 and "A256KW" wrappingrv   rw   r   r   Nr   r    r    r    r#   r    s   r  c                   @   s8   e Zd ZdZdZdZdZdZdd Zdd	 Z	d
d Z
dS )_Directdirz$Direct use of a shared symmetric keyr   rw   r   c                 C   s0   t |tstd|d dkr,td|d d S r   r   r   r    r    r#   r     s    
z_Direct._check_keyc                 C   sF   |  | |r|d fS t|d}t||kr>t|t|d|iS )Nr   r   )r   r   r_   r6   r   )r"   rM   r   r   r   r   r    r    r#   r     s    
z_Direct.wrapc                 C   sF   |  | |dkrtdt|d}t||krBt|t||S )N    zInvalid Encryption Key.r   )r   r8   r   r_   r6   r   r   r    r    r#   r     s    
z_Direct.unwrapN)r,   r-   r.   r$   r%   r&   r'   r(   r   r   r   r    r    r    r#   r    s   	r  c                   @   sH   e Zd ZdZdZdZdZdZdd Zdd	 Z	d
d Z
dd Zdd ZdS )_EcdhEsECDH-ESzECDH-ES using Concat KDFrw   r   Nc                 C   s   t  | _tttd| _d S r   r   r!   r    r    r#   rX     s    z_EcdhEs.__init__c                 C   sV   t |tstd|d dvr,td|d |d dkrR|d dvrRtd|d d S )	Nr   rr   )ZECOKPz	EC or OKPr  crv)ZX25519ZX448zX25519 or X448r   r   r    r    r#   r     s    
z_EcdhEs._check_keyc                 C   s   t dt|}|t|d7 }d|v r6t|d nd}|t dt|7 }||7 }d|v rjt|d nd}|t dt|7 }||7 }|t d|7 }t|tjr|	t
 |}	n
|	|}	tt t||| jd}
|
|	S )Nz>Ir   apur  apv)r   r   	otherinforU   )structpackr3   r   r   r   r   r   ZEllipticCurvePrivateKeyZexchangeZECDHr   r	   rz   r7   rU   r   )r"   ZprivkeyZpubkeyrw   r   r   r  r
  r  Z
shared_keyZckdfr    r    r#   _derive  s$    
z_EcdhEs._derivec                 C   s   |  | | j}| jd u r8|d ur*td|d }|}n|d }tj|d |d d}| |d|d|||}| jd u rd	|i}	n0| j| j  }
td
dt|d}|
	||||}	dt
| i|	d< |	S )Nz"ECDH-ES cannot use an existing CEKr   rw   rr   r	  )rr   r	  r   r   r   rs   r   epkr   )r   r&   r   r   generater  r_   r   r   r   r   Zexport_public)r"   rM   r   r   r   dk_sizerw   r  dkr   r   r   r    r    r#   r   
  s(    



z_EcdhEs.wrapc                 C   s   d|vrt d| | | j}| jd u r8|d }|}n|d }tf i |d }| |d|d|||}| jd u r~|S | j| j  }	tddt|d}
|	|
|||}|S d S )	Nr  z'Invalid Header, missing "epk" parameterr   rw   r   r   rs   r   )	r8   r   r&   r   r  r_   r   r   r   )r"   rM   r   r   r   r  rw   r  r  r   r   r   r    r    r#   r   $  s&    


z_EcdhEs.unwrap)r,   r-   r.   r$   r%   r'   r(   r&   rX   r   r  r   r   r    r    r    r#   r    s   
#r  c                   @   s    e Zd ZdZdZdZdZdZdS )_EcdhEsAes128KwECDH-ES+A128KWz.ECDH-ES using Concat KDF and "A128KW" wrappingr   rw   r   Nr   r    r    r    r#   r  <  s
   r  c                   @   s    e Zd ZdZdZdZdZdZdS )_EcdhEsAes192KwECDH-ES+A192KWz.ECDH-ES using Concat KDF and "A192KW" wrappingr   rw   r   Nr   r    r    r    r#   r  E  s
   r  c                   @   s    e Zd ZdZdZdZdZdZdS )_EcdhEsAes256KwECDH-ES+A256KWz.ECDH-ES using Concat KDF and "A256KW" wrappingrv   rw   r   Nr   r    r    r    r#   r  N  s
   r  c                   @   s0   e Zd ZdZdZdZdZdZdd Zdd	 Z	dS )
_EdDsaEdDSAz'EdDSA using Ed25519 or Ed448 algorithmsrw   rx   Nc                 C   s(   |d dv r | d}||S td S )Nr	  ZEd25519ZEd448rO   )r_   rO   rK   re   r    r    r#   rO   _  s    

z_EdDsa.signc                 C   s*   |d dv r"| d}|||S td S )Nr	  r  rR   )r_   rR   rK   rf   r    r    r#   rR   e  s    
z_EdDsa.verify)
r,   r-   r.   r$   r%   r'   r(   r&   rO   rR   r    r    r    r#   r  W  s   r  c                   @   s   e Zd Zdd Zdd ZdS )_RawJWEc                 C   s   t d S rI   rJ   )r"   r   aadmr    r    r#   r   n  s    z_RawJWE.encryptc                 C   s   t d S rI   rJ   )r"   r   r  r   rC   tr    r    r#   r   q  s    z_RawJWE.decryptN)r,   r-   r.   r   r   r    r    r    r#   r  l  s   r  c                   @   s0   e Zd ZdZdd Zdd Zdd Zdd	 ZdS )
_AesCbcHmacSha2Nc                 C   s(   t  | _|| _tjj| _| jd | _d S )Nr=   )	r   rU   rV   r   r   
block_size	blocksizer&   r)   rW   r    r    r#   rX   y  s    
z_AesCbcHmacSha2.__init__c                 C   sd   t t|d}tj|| j| jd}|| || || || | }|d t| j	 S )N@   rY   )
rD   r6   r
   rZ   rV   rU   r[   r`   r7   r&   )r"   r   r  r   rC   alr\   r  r    r    r#   _mac  s    



z_AesCbcHmacSha2._macc                 C   s   t |t| jkrtd|dt| j }|t| jd }t| j}tt	|t
|| jd}| }t| j }	|	||	  }
||
|  }| ||||}|||fS ) Encrypt according to the selected encryption and hashing
        functions.

        :param k: Encryption key
        :param aad: Additional Authentication Data
        :param m: Plaintext

        Returns a dictionary with the computed data.
        Invalid input key sizeNrY   )r3   r7   r)   r8   r&   r;   r#  r   r   r   r   CBCrU   r   r   padderr[   r`   r&  )r"   r   r  r  hkeyZekeyr   r   r   r*  Zpadded_datarC   r   r    r    r#   r     s    

z_AesCbcHmacSha2.encryptc              	   C   s   t |t| jkrtd|dt| j }|t| jd }t|| ||||s^tdt	t
|t|| jd}| }	|	||	  }
t| j }||
|  S )A   Decrypt according to the selected encryption and hashing
        functions.
        :param k: Encryption key
        :param aad: Additional Authenticated Data
        :param iv: Initialization Vector
        :param e: Ciphertext
        :param t: Authentication Tag

        Returns plaintext or raises an error
        r(  NzFailed to verify MACrY   )r3   r7   r)   r8   r&   r   Zbytes_eqr&  r   r   r   r   r   r)  rU   r   r[   r`   r   r#  unpadder)r"   r   r  r   rC   r   r+  Zdkeyr   r   dr-  r    r    r#   r     s    z_AesCbcHmacSha2.decrypt)r,   r-   r.   r&   rX   r&  r   r   r    r    r    r#   r!  u  s
   r!  c                       s0   e Zd ZdZdZdZdZdZ fddZ  Z	S )_A128CbcHs256A128CBC-HS256z&AES_128_CBC_HMAC_SHA_256 authenticatedr   r   c                    s   t t| t  d S rI   )ry   r/  rX   r	   rz   r!   r{   r    r#   rX     s    z_A128CbcHs256.__init__r}   r    r    r{   r#   r/    s   r/  c                       s0   e Zd ZdZdZdZdZdZ fddZ  Z	S )_A192CbcHs384A192CBC-HS384z&AES_192_CBC_HMAC_SHA_384 authenticatedr   r   c                    s   t t| t  d S rI   )ry   r1  rX   r	   r   r!   r{   r    r#   rX     s    z_A192CbcHs384.__init__r}   r    r    r{   r#   r1    s   r1  c                       s0   e Zd ZdZdZdZdZdZ fddZ  Z	S )_A256CbcHs512A256CBC-HS512z&AES_256_CBC_HMAC_SHA_512 authenticatedrv   r   c                    s   t t| t  d S rI   )ry   r3  rX   r	   r   r!   r{   r    r#   rX     s    z_A256CbcHs512.__init__r}   r    r    r{   r#   r3    s   r3  c                   @   s(   e Zd ZdZdd Zdd Zdd ZdS )_AesGcmNc                 C   s   t  | _| j| _d S rI   )r   rU   r&   r)   r!   r    r    r#   rX     s    z_AesGcm.__init__c                 C   sT   t d}tt|t|| jd}| }|| |	||
  }|||jfS )r'  r   rY   )r;   r   r   r   r   r   rU   r   authenticate_additional_datar[   r`   r   )r"   r   r  r  r   r   r   rC   r    r    r#   r     s    

z_AesGcm.encryptc                 C   sB   t t|t||| jd}| }|| |||	  S )r,  rY   )
r   r   r   r   r   rU   r   r6  r[   r`   )r"   r   r  r   rC   r   r   r   r    r    r#   r     s    
z_AesGcm.decrypt)r,   r-   r.   r&   rX   r   r   r    r    r    r#   r5    s   r5  c                   @   s    e Zd ZdZdZdZdZdZdS )_A128GcmA128GCMzAES GCM using 128-bit keyr   r   Nr   r    r    r    r#   r7    s
   r7  c                   @   s    e Zd ZdZdZdZdZdZdS )_A192GcmA192GCMzAES GCM using 192-bit keyr   r   Nr   r    r    r    r#   r9  !  s
   r9  c                   @   s    e Zd ZdZdZdZdZdZdS )_A256GcmA256GCMzAES GCM using 256-bit keyrv   r   Nr   r    r    r    r#   r;  *  s
   r;  c                       s0   e Zd ZdZdZdZdZdZ fddZ  Z	S )_BP256R1BP256R1zsECDSA using Brainpool256R1 curve and SHA-256 (unregistered, custom-defined in breach of IETF rules by gematik GmbH)rv   rw   rx   c                    s   t t| dt  d S )NzBP-256)ry   r=  rX   r	   rz   r!   r{   r    r#   rX   ?  s    z_BP256R1.__init__r}   r    r    r{   r#   r=  3  s   r=  c                       s0   e Zd ZdZdZdZdZdZ fddZ  Z	S )_BP384R1BP384R1zsECDSA using Brainpool384R1 curve and SHA-384 (unregistered, custom-defined in breach of IETF rules by gematik GmbH)r   rw   rx   c                    s   t t| dt  d S )NzBP-384)ry   r?  rX   r	   r   r!   r{   r    r#   rX   O  s    z_BP384R1.__init__r}   r    r    r{   r#   r?  C  s   r?  c                       s0   e Zd ZdZdZdZdZdZ fddZ  Z	S )_BP512R1BP512R1zsECDSA using Brainpool512R1 curve and SHA-512 (unregistered, custom-defined in breach of IETF rules by gematik GmbH)r   rw   rx   c                    s   t t| dt  d S )NzBP-512)ry   rA  rX   r	   r   r!   r{   r    r#   rX   _  s    z_BP512R1.__init__r}   r    r    r{   r#   rA  S  s   rA  c                *   @   s   e Zd ZdZeeeeee	e
eeeeeeeeeeeeeeeeeeeeee e!e"e#e$e%e&e'e(e)e*e+e,d)Z-e.dddZ/e.dd Z0e.dd	 Z1e.d
d Z2dS )JWAzSJWA Signing Algorithms.

    This class provides access to all JWA algorithms.
    ))ru   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r  r  r  r  r  r  r   r   r   r   r   r  r0  r2  r4  r8  r:  r<  r>  r@  rB  Nc                 C   s&   | j | }|d ur |j|kr t| S rI   )algorithms_registryr(   KeyError)clsr$   r   rw   r    r    r#   instantiate_alg  s    
zJWA.instantiate_algc                 C   s6   z| j |ddW S  ty0   td| d Y n0 d S )Nrx   r   z(%s is not a valid Signing algorithm namerG  rE  r   rF  r$   r    r    r#   signing_alg  s    zJWA.signing_algc                 C   s6   z| j |ddW S  ty0   td| d Y n0 d S )Nr   rH  z/%s is not a valid Key Management algorithm namerI  rJ  r    r    r#   keymgmt_alg  s    zJWA.keymgmt_algc                 C   s6   z| j |ddW S  ty0   td| d Y n0 d S )Nr   rH  z+%s is not a valid Encryption algorithm namerI  rJ  r    r    r#   encryption_alg  s    zJWA.encryption_alg)N)3r,   r-   r.   __doc__rt   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r  r  r  r  r  r  r   r   r   r   r   r  r/  r1  r3  r7  r9  r;  r=  r?  rA  rD  classmethodrG  rK  rL  rM  r    r    r    r#   rC  c  sf   ,

rC  )kr9   r  abcr   r   binasciir   r   Zcryptography.exceptionsr   Zcryptography.hazmat.backendsr   Zcryptography.hazmat.primitivesr   r	   r
   Z)cryptography.hazmat.primitives.asymmetricr   r   r   rl   Z&cryptography.hazmat.primitives.ciphersr   r   r   Z,cryptography.hazmat.primitives.kdf.concatkdfr   Z)cryptography.hazmat.primitives.kdf.pbkdf2r   Z&cryptography.hazmat.primitives.keywrapr   r   Z&cryptography.hazmat.primitives.paddingr   Zjwcrypto.commonr   r   r   r   r   r   r   r   Zjwcrypto.jwkr   r   r   r6   r7   r;   rD   rG   rH   rT   rc   rh   rp   rt   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r  r  r  r  r  r  r  r  r!  r/  r1  r3  r5  r7  r9  r;  r=  r?  rA  rC  r    r    r    r#   <module>   s   $	
		#			4			L


!k				Q.			