o `h/@sdZdZddgZddlTejddkrejddkrddlTddlZdd lm Z m Z m Z dd l m Z Gd ddZd d ZddZddZdddZdS)aRSA digital signature protocol with appendix according to PKCS#1 PSS. See RFC3447__ or the `original RSA Labs specification`__. This scheme is more properly called ``RSASSA-PSS``. For example, a sender may authenticate a message using SHA-1 and PSS like this: >>> from Crypto.Signature import PKCS1_PSS >>> from Crypto.Hash import SHA >>> from Crypto.PublicKey import RSA >>> from Crypto import Random >>> >>> message = 'To be signed' >>> key = RSA.importKey(open('privkey.der').read()) >>> h = SHA.new() >>> h.update(message) >>> signer = PKCS1_PSS.new(key) >>> signature = PKCS1_PSS.sign(key) At the receiver side, verification can be done like using the public part of the RSA key: >>> key = RSA.importKey(open('pubkey.der').read()) >>> h = SHA.new() >>> h.update(message) >>> verifier = PKCS1_PSS.new(key) >>> if verifier.verify(h, signature): >>> print "The signature is authentic." >>> else: >>> print "The signature is not authentic." :undocumented: __revision__, __package__ .. __: http://www.ietf.org/rfc/rfc3447.txt .. __: http://www.rsa.com/rsalabs/node.asp?id=2125 z$Id$new PSS_SigScheme)*N) ceil_shiftceil_div long_to_bytes)strxorc@s0eZdZdZddZddZddZdd Zd S) rzKThis signature scheme can perform PKCS#1 PSS RSA signature or verification.cCs||_||_||_dS)a!Initialize this PKCS#1 PSS signature scheme object. :Parameters: key : an RSA key object If a private half is given, both signature and verification are possible. If a public half is given, only verification is possible. mgfunc : callable A mask generation function that accepts two parameters: a string to use as seed, and the lenth of the mask to generate, in bytes. saltLen : int Length of the salt, in bytes. N)_key_saltLen_mgfunc)selfkeymgfuncsaltLenrL/var/www/html/env/lib/python3.10/site-packages/Crypto/Signature/PKCS1_PSS.py__init__Os  zPSS_SigScheme.__init__cCs |jS)zCReturn True if this cipher object can be used for signing messages.)r has_private)rrrrcan_sign`s zPSS_SigScheme.can_signc s|jj}|jdkr j}n|j}|jr|j}nfdd}tjj|jj }t |d}t |d|||}|j |}t d|t||} | S)aBProduce the PKCS#1 PSS signature of a message. This function is named ``RSASSA-PSS-SIGN``, and is specified in section 8.1.1 of RFC3447. :Parameters: mhash : hash object The hash that was carried out over the message. This is an object belonging to the `Crypto.Hash` module. :Return: The PSS signature encoded as a string. :Raise ValueError: If the RSA key length is not sufficiently long to deal with the given hash algorithm. :Raise TypeError: If the RSA key has no private half. :attention: Modify the salt length and the mask generation function only if you know what you are doing. The receiver must use the same parameters too. Nc t||SNMGF1xymhashrr z$PSS_SigScheme.sign..rr)r _randfuncr digest_sizer CryptoUtilnumbersizenrEMSA_PSS_ENCODEdecryptbchrlen) rrrandfuncsLenmgfmodBitskemmSrrrsignds    zPSS_SigScheme.signc s|jdkr j}n|j}|jr|j}nfdd}tjj|jj}t |d}t ||kr/dS|j |dd}t |dd}t d|t ||}z t ||d||} W| StybYdSw)aVerify that a certain PKCS#1 PSS signature is authentic. This function checks if the party holding the private half of the given RSA key has really signed the message. This function is called ``RSASSA-PSS-VERIFY``, and is specified in section 8.1.2 of RFC3447. :Parameters: mhash : hash object The hash that was carried out over the message. This is an object belonging to the `Crypto.Hash` module. S : string The signature that needs to be validated. :Return: True if verification is correct. False otherwise. Ncrrrrrrrr r!z&PSS_SigScheme.verify..r"Frr)r r$r r%r&r'r(r r)rr-encryptr,EMSA_PSS_VERIFY ValueError) rrr5r/r0r1r2r3emLenresultrrrverifys&     zPSS_SigScheme.verifyN)__name__ __module__ __qualname____doc__rrr6r<rrrrrLs  0cCsZtd}tt||jD]}t|d}||||}q t||ks'J|d|S)z,Mask Generation Function, described in B.2.1N)brangerr$r rdigestr-)mgfSeedmaskLenhashTcountercrrrrs   rcCst|d}d}td||D]}|d?dB}q||j|dkr%tdtd}|r3|dkr3||}|tdd||} td|||jdtd|} || ||jd} t| | } tt | d|@| dd} | | td } | S) a% Implement the ``EMSA-PSS-ENCODE`` function, as defined in PKCS#1 v2.1 (RFC3447, 9.1.1). The original ``EMSA-PSS-ENCODE`` actually accepts the message ``M`` as input, and hash it internally. Here, we expect that the message has already been hashed instead. :Parameters: mhash : hash object The hash object that holds the digest of the message being signed. emBits : int Maximum length of the final encoding, in bits. randFunc : callable An RNG function that accepts as only parameter an int, and returns a string of random bytes, to be used as salt. mgf : callable A mask generation function that accepts two parameters: a string to use as seed, and the lenth of the mask to generate, in bytes. sLen : int Length of the salt, in bytes. :Return: An ``emLen`` byte long string that encodes the hash (with ``emLen = \ceil(emBits/8)``). :Raise ValueError: When digest or salt length are too big. r"rrrz6Digest or salt length are too long for given key size.rAN) rrDr$r9rCrr,rEr bord)remBitsrandFuncr0r/r:lmaskisalthdbdbMaskmaskedDBr3rrrr*s  & "r*cCsVt|d}d}td||D]}|d?dB}q||j|dkr#dSt|ddd kr/dS|d||jd}|||jdd} |t|d@rOdS|| ||jd} t|| } tt| d|@| dd} | td||j|dtdsdStd } |r| | d} | tdd| |  } | | krdSd S) a Implement the ``EMSA-PSS-VERIFY`` function, as defined in PKCS#1 v2.1 (RFC3447, 9.1.2). ``EMSA-PSS-VERIFY`` actually accepts the message ``M`` as input, and hash it internally. Here, we expect that the message has already been hashed instead. :Parameters: mhash : hash object The hash object that holds the digest of the message to be verified. em : string The signature to verify, therefore proving that the sender really signed the message that was received. emBits : int Length of the final encoding (em), in bits. mgf : callable A mask generation function that accepts two parameters: a string to use as seed, and the lenth of the mask to generate, in bytes. sLen : int Length of the salt, in bytes. :Return: 0 if the encoding is consistent, 1 if it is inconsistent. :Raise ValueError: When digest or salt length are too big. r"rrrLrFNrMrAT) rrDr$ordrNr r, startswithrCrrE)rr3rOr0r/r:rQrRrWrTrVrUrShprrrr8 s.  "("r8cCs t|||S)aReturn a signature scheme object `PSS_SigScheme` that can be used to perform PKCS#1 PSS signature or verification. :Parameters: key : RSA key object The key to use to sign or verify the message. This is a `Crypto.PublicKey.RSA` object. Signing is only possible if *key* is a private RSA key. mgfunc : callable A mask generation function that accepts two parameters: a string to use as seed, and the lenth of the mask to generate, in bytes. If not specified, the standard MGF1 is used. saltLen : int Length of the salt, in bytes. If not specified, it matches the output size of the hash function. )r)rrrrrrrQs )NN)r@ __revision____all__Crypto.Util.py3compatsys version_infoCrypto.Util.py21compatCrypto.Util.numberr%rrr Crypto.Util.strxorr rrr*r8rrrrrs+ } ;D