HEX

File: //opt/saltstack/salt/lib/python3.10/site-packages/Cryptodome/IO/__pycache__/_PBES.cpython-310.pyc
o

�N�g�?�@s�ddlmZddlmZmZmZmZddlmZm	Z	ddl
mZmZm
Z
mZmZmZddlmZmZmZmZddlmZmZmZdZdZd	Zd
ZdZdZd
Z dZ!dZ"dZ#dZ$dZ%dZ&dZ'dZ(dZ)Gdd�de*�Z+Gdd�de,�Z-Gdd�de,�Z.dS)�)�Random)�DerSequence�DerOctetString�DerObjectId�
DerInteger)�pad�unpad)�MD5�SHA1�SHA224�SHA256�SHA384�SHA512)�DES�ARC2�DES3�AES)�PBKDF1�PBKDF2�scryptz1.2.840.113549.1.5.3z1.2.840.113549.1.5.6z1.2.840.113549.1.5.10z1.2.840.113549.1.5.11z1.2.840.113549.1.5.13z1.2.840.113549.1.5.12z1.3.6.1.4.1.11591.4.11�1.2.840.113549.2.7z1.2.840.113549.2.8z1.2.840.113549.2.9z1.2.840.113549.2.10z1.2.840.113549.2.11z1.2.840.113549.3.7z2.16.840.1.101.3.4.1.2z2.16.840.1.101.3.4.1.22z2.16.840.1.101.3.4.1.42c@seZdZdS)�	PbesErrorN)�__name__�
__module__�__qualname__�rr�G/opt/saltstack/salt/lib/python3.10/site-packages/Cryptodome/IO/_PBES.pyrCsrc@seZdZdZedd��ZdS)�PBES1z�Deprecated encryption scheme with password-based key derivation
    (originally defined in PKCS#5 v1.5, but still present in `v2.0`__).

    .. __: http://www.ietf.org/rfc/rfc2898.txt
    cCs*t��|�}t��|d�}t��|d�j}t��|d�j}i}|tkr+t}t}n'|t	kr8t}t
}d|d<n|tkrAt}t}n|t
krNt}t
}d|d<ntd��t�j|ddd�}	t��|	d�j}
|	d}t||
d||�}|d	d
�|d
d	�}
}|j|
|j|fi|��}|�|�}t||j�S)axDecrypt a piece of data using a passphrase and *PBES1*.

        The algorithm to use is automatically detected.

        :Parameters:
          data : byte string
            The piece of data to decrypt.
          passphrase : byte string
            The passphrase to use for decrypting the data.
        :Returns:
          The decrypted data, as a binary string.
        r��@Zeffective_keylenzUnknown OID for PBES1��Znr_elements�N�)r�decoder�payloadr�value�_OID_PBE_WITH_MD5_AND_DES_CBCr	r�_OID_PBE_WITH_MD5_AND_RC2_CBCr�_OID_PBE_WITH_SHA1_AND_DES_CBCr
�_OID_PBE_WITH_SHA1_AND_RC2_CBCrr�new�MODE_CBC�decryptr�
block_size)�data�
passphrase�enc_private_key_infoZencrypted_algorithm�encrypted_data�pbe_oidZ
cipher_paramsZhashmod�	ciphermodZ
pbe_params�saltZ
iterationsZkey_iv�key�iv�cipher�ptrrrr-ys8


z
PBES1.decryptN)rrr�__doc__�staticmethodr-rrrrrrsrc@s*eZdZdZeddd��Zedd��ZdS)�PBES2z�Encryption scheme with password-based key derivation
    (defined in `PKCS#5 v2.0`__).

    .. __: http://www.ietf.org/rfc/rfc2898.txt.NcCs�|duri}|durt��j}|dkrd}t}tj}t}n.|dvr+d}t}tj}t}n |dvr9d}t}tj}t}n|dvrGd}t}tj}t	}nt
d	��||j�}	||�d
d��}
|�
d�r{|�d
d�}t||
||�}ttt�tt|
�t|�g�g�}
n1|�d
d�}|�dd�}|�dd�}t||
||||�}ttt�tt|
�t|�t|�t|�g�g�}
|�|||	�}|�t||j��}tt|�t|	�g�}tttt�t|
|g�g�t|�g�}|��S)a�	Encrypt a piece of data using a passphrase and *PBES2*.

        :Parameters:
          data : byte string
            The piece of data to encrypt.
          passphrase : byte string
            The passphrase to use for encrypting the data.
          protection : string
            The identifier of the encryption algorithm to use.
            The default value is '``PBKDF2WithHMAC-SHA1AndDES-EDE3-CBC``'.
          prot_params : dictionary
            Parameters of the protection algorithm.

            +------------------+-----------------------------------------------+
            | Key              | Description                                   |
            +==================+===============================================+
            | iteration_count  | The KDF algorithm is repeated several times to|
            |                  | slow down brute force attacks on passwords    |
            |                  | (called *N* or CPU/memory cost in scrypt).    |
            |                  |                                               |
            |                  | The default value for PBKDF2 is 1 000.        |
            |                  | The default value for scrypt is 16 384.       |
            +------------------+-----------------------------------------------+
            | salt_size        | Salt is used to thwart dictionary and rainbow |
            |                  | attacks on passwords. The default value is 8  |
            |                  | bytes.                                        |
            +------------------+-----------------------------------------------+
            | block_size       | *(scrypt only)* Memory-cost (r). The default  |
            |                  | value is 8.                                   |
            +------------------+-----------------------------------------------+
            | parallelization  | *(scrypt only)* CPU-cost (p). The default     |
            |                  | value is 1.                                   |
            +------------------+-----------------------------------------------+


          randfunc : callable
            Random number generation function; it should accept
            a single integer N and return a string of random data,
            N bytes long. If not specified, a new RNG will be
            instantiated from ``Cryptodome.Random``.

        :Returns:
          The encrypted data, as a binary string.
        Nz"PBKDF2WithHMAC-SHA1AndDES-EDE3-CBC�)z PBKDF2WithHMAC-SHA1AndAES128-CBCzscryptAndAES128-CBCr")z PBKDF2WithHMAC-SHA1AndAES192-CBCzscryptAndAES192-CBC)z PBKDF2WithHMAC-SHA1AndAES256-CBCzscryptAndAES256-CBC� zUnknown PBES2 modeZ	salt_sizer#r�iteration_counti�i@r.Zparallelizationr)rr+�readrr,�_OID_DES_EDE3_CBCr�_OID_AES128_CBC�_OID_AES192_CBC�_OID_AES256_CBC�
ValueErrorr.�get�
startswithrrr�_OID_PBKDF2rrr�_OID_SCRYPT�encryptr�
_OID_PBES2�encode)r/r0Z
protectionZprot_paramsZrandfunc�key_size�moduleZcipher_mode�enc_oidr7r5�countr6�kdf_info�scrypt_r�scrypt_pr8r2�enc_infor1rrrrJ�s�/


��	�������z
PBES2.encryptcst�j|dd�}t��|d�}t��|d�j}t��|d�j}|tkr*td��t�j|ddd�}t�j|ddd�}t��|d�j}d}	|tkr�t�j|ddd�}
t��|
d�j}|
d}t	|
�d}
d}|
dkr�z|
|d}	|
d8}
|d7}Wn	t
y�Ynwd}|
dkr�t��|
|�}t��|d�j}n5|tkr�t�j|dd	d��t���d�j}�fd
d�dD�\}}}t	��d
krЈd
}	nd}	ntd��t��|d�}t��|d�j}|tkr�t
}d}n!|tkr�t}d}n|tk�rt}d}n|tk�rt}d}ntd��|	�r|	|k�rtd��t��|d�j}|tk�rd|tk�r4t}n&|tk�r<t}n|tk�rDt}n|tk�rLt}n|tk�rTt}ntd|��t|||||d�}n	t||||||�}|�||j|�}|� |�}t!||j"�S)axDecrypt a piece of data using a passphrase and *PBES2*.

        The algorithm to use is automatically detected.

        :Parameters:
          data : byte string
            The piece of data to decrypt.
          passphrase : byte string
            The passphrase to use for decrypting the data.
        :Returns:
          The decrypted data, as a binary string.
        r r!rrzNot a PBES2 objectN)r ��r)rV�csg|]}�|�qSrr)�.0�x�Z
scrypt_paramsrr�
<listcomp>us�z!PBES2.decrypt.<locals>.<listcomp>)rr rUrVzUnsupported PBES2 KDFr=r"r>zUnsupported PBES2 cipherz9Mismatch between PBES2 KDF parameters and selected cipherzUnsupported HMAC %s)�hmac_hash_module)#rr$rr%rr&rKrrH�len�	TypeErrorrIrArrBrrCrD�_OID_HMAC_SHA1r
�_OID_HMAC_SHA224r�_OID_HMAC_SHA256r�_OID_HMAC_SHA384r
�_OID_HMAC_SHA512rrrr+r,r-rr.)r/r0r1Zenc_algor2r3Zpbes2_paramsrQZkdf_oidZkdf_key_lengthZ
pbkdf2_paramsr5r?�left�idxZpbkdf2_prf_oidZpbkdf2_prf_algo_idrRrSrTrOr4rMZIVr\r6r8r9rrZrr-:s���
�









�
�
z
PBES2.decrypt)NN)rrrr:r;rJr-rrrrr<�sr<N)/Z
CryptodomerZCryptodome.Util.asn1rrrrZCryptodome.Util.PaddingrrZCryptodome.Hashr	r
rrr
rZCryptodome.CipherrrrrZCryptodome.Protocol.KDFrrrr'r(r)r*rKrHrIr_r`rarbrcrArBrCrDrEr�objectrr<rrrr�<module>s2! /=