ʏe]ddlZddlmZddlmZmZddlmZmZddlmZm Z ddlm Z m Z ddl m Z ddlmZed d d ded d d ded d d dedd d dedd d dedd d dedd d dedd d dedd d dedd d dedd d dedd d dedd d dd Z gdZ GddeZej&Zej(Zej*Zej,ZGddZy)N)common) JWException JWKeyNotFound)JWSEHeaderParameterJWSEHeaderRegistry)base64url_decodebase64url_encode) json_decode json_encode)JWA)JWKSet AlgorithmFTzEncryption AlgorithmzCompression Algorithmz JWK Set URLz JSON Web KeyzKey IDz X.509 URLzX.509 Certificate Chainz"X.509 Certificate SHA-1 Thumbprintz$X.509 Certificate SHA-256 ThumbprintTypez Content TypeCritical) algenczipjkujwkkidx5ux5cx5tzx5t#S256typctycrit)zRSA-OAEPz RSA-OAEP-256A128KWA192KWA256KWdirzECDH-ESzECDH-ES+A128KWzECDH-ES+A192KWzECDH-ES+A256KW A128GCMKW A192GCMKW A256GCMKWzPBES2-HS256+A128KWzPBES2-HS384+A192KWzPBES2-HS512+A256KWz A128CBC-HS256z A192CBC-HS384z A256CBC-HS512A128GCMA192GCMA256GCMc$eZdZdZdfd ZxZS)InvalidJWEDatazvInvalid JWE Object. This exception is raised when the JWE Object is invalid and/or improperly formatted. cdd}|r|}nd}|r|dt|zz }tt||y)Nz!Unknown Data Verification Failurez {%s})strsuperr(__init__)selfmessage exceptionmsg __class__s ./usr/lib/python3/dist-packages/jwcrypto/jwe.pyr,zInvalidJWEData.__init__8s: C5C  7S^+ +C nd,S1)NN)__name__ __module__ __qualname____doc__r, __classcell__)r1s@r2r(r(1s 22r3r(ceZdZdZ ddZdZdZedZejdZdZ dd Z d Z d Z dd Zdd ZdZdZdZdZddZedZedZedZdZdZdZy)JWEzGJSON Web Encryption object This object represent a JWE token. Nc fd|_i|_d|_tt|_|r|j j ||.t|tr||_n|jd|_d|_ d|_ |r||jd<|r6t|tr t|}n t|||jd<|r6t|tr t|}n t|||jd<|r||_|r|j||y|r t!dy)aBCreates a JWE token. :param plaintext(bytes): An arbitrary plaintext to be encrypted. :param protected: A JSON string with the protected header. :param unprotected: A JSON string with the shared unprotected header. :param aad(bytes): Arbitrary additional authenticated data :param algs: An optional list of allowed algorithms :param recipient: An optional, default recipient key :param header: An optional header for the default recipient :param header_registry: Optional additions to the header registry Nutf-8aad protected unprotected)headerz-Header is allowed only with default recipient) _allowed_algsobjects plaintextrJWEHeaderRegistryheader_registryupdate isinstancebytesencodecek decryptlogdictr r add_recipient ValueError) r-rCr>r?r=algs recipientr@rEs r2r,z JWE.__init__Ps" 12CD   ' ' 8  )U+!*!*!1!1'!: "%DLL  )T*' 2 I&(1DLL % +t,)+6 K(*5DLL ' !%D     y  8 LM Mr3cr|jxst}||vr tdtj|SNzAlgorithm not allowed)rAdefault_allowed_algsInvalidJWEOperationr keymgmt_algr-namealloweds r2 _jwa_keymgmtzJWE._jwa_keymgmts6$$<(< w %&=> >t$$r3cr|jxst}||vr tdtj|SrR)rArSrTr encryption_algrVs r2_jwa_encz JWE._jwa_encs8$$<(< w %&=> >!!$''r3c>|jr |jStS)zAllowed algorithms. The list of allowed algorithms. Can be changed by setting a list of algorithm names. )rArSr-s r2 allowed_algszJWE.allowed_algss   %% %' 'r3cHt|ts td||_y)NzAllowed Algs must be a list)rGlist TypeErrorrA)r-rOs r2r_zJWE.allowed_algss $%9: :!r3ct|jD]}||vstd|z|j||S)NzDuplicate header: "%s")rakeysr(rF)r-h1h2ks r2_merge_headerszJWE._merge_headerssGbggi CABw$%=%ABB C "  r3c(i}d|jvr*t|jd}|j||}d|jvr*t|jd}|j||}|rt|}|j||}|S)Nr>r?)rBr rh)r-r@jhphuhrhs r2_get_jose_headerzJWE._get_jose_headers  $,, &T\\+67B$$R,B DLL (T\\-89B$$R,B V$B$$R,B r3c|jdd}| td|j|}|jdd}| td|j|}||fS)NrzMissing "alg" from headersrzMissing "enc" from headers)getr(rYr\)r-rjalgnamerencnamers r2_get_alg_enc_from_headerszJWE._get_alg_enc_from_headerssk&&% ? !=> >(&&% ? !=> >mmG$Cxr3c t|jjdd}d|jvr|dt|jdzz }|jd}|jdd}|dk(r#t j |j dd }n| |j }n td |j|j||\}}} ||jd <||jd <| |jd <y)Nr>r=.r<rDEFUnknown compressioniv ciphertexttag) r rBrprIzlibcompressrCrNencryptrJ) r-rrrjr=rdatar{r|r}s r2_encryptz JWE._encryptst||// R@A DLL 3)$,,u*=>> >Cjj!66%& u ==026D  >>D23 3!kk$((C>J T%/ \"! Ur3cd|j tdt|jts tdt|tr t |}|j |}|j|\}}i}|r||d<|j||j|j|}|d|_ d|vr|d|d<d|vr>t|jdd}|j||d} t | |d<d |jvr|j|||d |jvr|jd j!|yd|jvsd|jvrg|jd <i} d|jvr|jj#d| d<d|jvr|jj#d| d<|jd j!| |jd j!|y|jj%|y) aEncrypt the plaintext with the given key. :param key: A JWK key or password of appropriate type for the 'alg' provided in the JOSE Headers. :param header: A JSON string representing the per-recipient header. :raises ValueError: if the plaintext is missing or not of type bytes. :raises ValueError: if the compression type is unknown. :raises InvalidJWAAlgorithm: if the 'alg' provided in the JOSE headers is missing or unknown, or otherwise not implemented. NzMissing plaintextzPlaintext must be 'bytes'r@rJek encrypted_keyz{}r| recipients)rCrNrGrHrLr rnrswrap wrap_key_sizerJr rprhrBrappendpoprF) r-keyr@rjrrrecwrappedhnhns r2rMzJWE.add_recipients >> !01 1$..%089 9 fd # (F  " "6 *11"5S "CM((3 1 1488R@5> 7?#*4=C w CGGHd34A$$Q(9:B'OCM t|| + MM#sB ' 4<< ' LL & - -c 2  ,DLL0H)+DLL &A$,,.%)\\%5%5o%F/"4<<'"ll..x8( LL & - -a 0 LL & - -c 2 LL   $r3c d|jvr td|rdD]}||jvstd|zd|jvr tdt|jd}dD]}||vstd|zd |jvr9t|jd d k7r td |jd d }n |j}d |vrt|d }t|jd}|j ||}t ||jd<|j }|j|\} } |j| | ||d =djt|jdt|jddt|jdt|jdt|jdgS|j} t| dt| dt|jdd} d| vrt| d| d<d| vrt| d| d<d| vrt| d| d<d | vrZg| d <| d D]B}i} d|vrt|d| d<d |vrt|d | d <| d j| Dt | Sd| vrt| d| d<d | vrt| d | d <t | S)aSerializes the object into a JWE token. :param compact(boolean): if True generates the compact representation, otherwise generates a standard JSON format. :raises InvalidJWEOperation: if the object cannot be serialized with the compact representation and `compact` is True. :raises InvalidJWEOperation: if no recipients have been added to the object. :return: A json formatted string or a compact representation string :rtype: `str` r|No available ciphertext)r=r?z9Can't use compact encoding when the '%s' parameter is setr>z4Can't use compact encoding without protected headers)rrz@Can't use compact encoding, '%s' must be in the protected headerrzInvalid number of recipientsrr@rvrrur{r})r|r{r}r?r=) rBrTr lenrhr rnrsrjoinr rpr) r-compactinvalidrkrequiredrrnphrjrrobjes r2 serializez JWE.serialize sV t|| +%&?@ @ / ,dll*-!#*+,, , $,,.)JLL!k!:; ,;Hr)1/19:;;; t||+t||L12a7-.LMMll<03ll3  H . k!:;))!R0,7,< [)**,99"=S c3+M88-dll;.GH-cggor.JK-dll4.@A-dll<.HI-dll5.AB DE E ,,C!1#l2C!D)#d)4*4<<+>?ACc!#3C 4D#EK #%0]1C%DM"|-c%j9E s"$&L!|,0CA&#-,S-AB/*3&1#h-&@(  %,,Q/0s# # #c)(_)=>(s?$/H $>CMs# #r3c|D]E}||jvrtd|z|j|jr9td|zy)NzUnknown critical header: "%s"z!Unsupported critical header: "%s")rEr( supported)r-rrgs r2 _check_critzJWE._check_critas^ 5A,,,$%Dq%HII++A.88(*023*455  5r3c |j||j||} |j| |||| } |jj d| |_| S)NSuccess)unwraprdecryptrKrrJ) r-rrrenckeyr@r=r{r|r}rJrs r2_unwrap_decryptzJWE._unwrap_decryptjsPjjc//@{{3RS9 y) r3c X|j|jdd}|j|jdi|D]8}||jvs|jj ||r/t d|j |jdd}|j|jdd}t|jjdd}d|jvr|d t|jdzz }|jd }t|tr|}d |jvrI|j|jd } | s'td j!|jd | }|D]o} |j#||| |jd d|||jd|jd|jd } |j$j'dnd|j$vr[td|j#||||jd d|||jd|jd|jd } |jdd}|dk(r+t/j0 t.j2 |_y| |_yt7d#t($r_} | jd | j+} |j$j'dj!| t-| Yd} ~ d} ~ wwxYw)Nr@rzFailed header checkrrr>rur=rvr<rzKey ID {} not in key setrr3r{r|r}rzKey [{}] failed: [{}]zNo working key found in key setrrwrz)rnrprrE check_headerr(rYr\r rBrIrGr jose_headerget_keysrformatrrKr Exception thumbprintreprr~ decompress MAX_WBITSrCrN)r-rpperjhdrrrr=rdkid_keysrgrrkeyidrs r2_decryptz JWE._decryptss  " "3778T#: ; +, @Cd***++88dC()>?? @ ud 34mmBFF5$/0t||// R@A DLL 3)$,,u*=>> >Cjj! c6 "D(((<<(8(8(?@'(B(I(I(,(8(8(?)ABB < <//S!030M02Cd9K04 \0J04 U0C ED OO**95 </#$EFF''S#(+(E(*Cd1C(, \(B(, U(; =D 66%& u !__TDNN?CDN  !DN23 3)!<EE%8EOO**+B+I+I+0$q',;<<> "')-doo)>"?@ @!E!!]3%) OO**>DG+CDDE Aa/!%J&&~Q'?@@ As0B1D1 C=:9C88C= E  9EE cDi|_d|_d|_i} t|}t |d|d<t |d|d<t |d|d<d|vr"t |d}|j d|d<d|vrt |d|d<d|vrt |d|d<d |vrPg|d <|d D]B}i}d |vrt |d |d <d |vrt |d |d <|d j|Dn*d |vrt |d |d <d |vrt |d |d <||_|r|j|yy#t$r}|jd }t|d k7r t|t |d}|j d|d<t |d} | dk7rt |d|d <t |d|d<t |d|d<t |d|d<Yd}~d}~wwxYw#t$r}tdt||d}~wwxYw)aDeserialize a JWE token. NOTE: Destroys any current status and tries to import the raw JWE provided. If a key is provided a decryption step will be attempted after the object is successfully deserialized. :param raw_jwe: a 'raw' JWE token (JSON Encoded or Compact notation) string. :param key: A (:class:`jwcrypto.jwk.JWK`) decryption key, or a (:class:`jwcrypto.jwk.JWKSet`) that contains a key indexed by the 'kid' header or (deprecated) a string containing a password (optional). :raises InvalidJWEData: if the raw object is an invalid JWE token. :raises InvalidJWEOperation: if the decryption fails. Nr{r|r}r>r<r?r=rrr@rvrrr3rxzInvalid format)rBrCrJr rdecoder rrNsplitrr(rrr) r-raw_jwerodjweprrrekeys r2 deserializezJWE.deserializesq(  . C( 5"7+*4:6$"24 3E"F,+DK8%$&(k):;A%&XXg%6AkN D('24 3F'GAm$D=/U (*1$T!W-!"'!2+'Q03;)9$q')BAo&*473$"247";,+DG4% 5 C !147; B Cs=D E&G; G8 B#G3.G;3G88G;; HHHcH|js td|jS)NzPlaintext not available)rCrTr^s r2payloadz JWE.payload$s~~%&?@ @~~r3c|j|jjd}t|dk(r t d|S)Nr@rzJOSE Header not available)rnrBrprrT)r-rjs r2rzJWE.jose_header*s=  " "4<<#3#3H#= > r7a<%&AB B r3c6|}|j||S)aCreates a JWE object from a serialized JWE token. :param token: A string with the json or compat representation of the token. :raises InvalidJWEData: if the raw object is an invalid JWE token. :return: A JWE token :rtype: JWE )r)clstokenrs r2from_jose_tokenzJWE.from_jose_token1se  r3c4t|tsy |j|jk(S#t$rZd|ji}|j |j d|ji}|j |j ||k(cYSwxYw)NFrC)rGr:rrrCrFrB)r-otherdata1data2s r2__eq__z JWE.__eq__Bs%% ">>#u'88 8 " $..1E LL & %//2E LL 'E> !  "s 4A BBcb |jS#t$r|jcYSwxYwN)rr__repr__r^s r2__str__z JWE.__str__Ns/ #>># # #==? " #s ..cj d|jdS#t$rt|j}|jj d}|jj d}|jj d}|j }d|dd|dzd |dzd |d |d zcYSwxYw) NzJWE.from_json_token("z")r>r?r=zJWE(plaintext=z, z protected=z unprotected=zaad=z, algs=))rrrrCrBrprA)r-rCr>r?r=rOs r2rz JWE.__repr__Ts .*4>>+;*rsF 6C>4 {E4 > 5udD I 6tT J }eUD A ~ueT B xd ; {E5$ ? 8% M CU$d ,#$J$)5$8 vudD 9 ~udD A  D$ ="* %!2[2&..00,,00V.V.r3