You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
461 lines
15 KiB
461 lines
15 KiB
# Copyright 2011 Sybren A. Stüvel <sybren@stuvel.eu>
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# https://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
"""Functions for PKCS#1 version 1.5 encryption and signing
|
|
|
|
This module implements certain functionality from PKCS#1 version 1.5. For a
|
|
very clear example, read http://www.di-mgt.com.au/rsa_alg.html#pkcs1schemes
|
|
|
|
At least 8 bytes of random padding is used when encrypting a message. This makes
|
|
these methods much more secure than the ones in the ``rsa`` module.
|
|
|
|
WARNING: this module leaks information when decryption fails. The exceptions
|
|
that are raised contain the Python traceback information, which can be used to
|
|
deduce where in the process the failure occurred. DO NOT PASS SUCH INFORMATION
|
|
to your users.
|
|
"""
|
|
|
|
import hashlib
|
|
import os
|
|
import sys
|
|
import typing
|
|
|
|
from . import common, transform, core, key
|
|
|
|
# ASN.1 codes that describe the hash algorithm used.
|
|
HASH_ASN1 = {
|
|
'MD5': b'\x30\x20\x30\x0c\x06\x08\x2a\x86\x48\x86\xf7\x0d\x02\x05\x05\x00\x04\x10',
|
|
'SHA-1': b'\x30\x21\x30\x09\x06\x05\x2b\x0e\x03\x02\x1a\x05\x00\x04\x14',
|
|
'SHA-224': b'\x30\x2d\x30\x0d\x06\x09\x60\x86\x48\x01\x65\x03\x04\x02\x04\x05\x00\x04\x1c',
|
|
'SHA-256': b'\x30\x31\x30\x0d\x06\x09\x60\x86\x48\x01\x65\x03\x04\x02\x01\x05\x00\x04\x20',
|
|
'SHA-384': b'\x30\x41\x30\x0d\x06\x09\x60\x86\x48\x01\x65\x03\x04\x02\x02\x05\x00\x04\x30',
|
|
'SHA-512': b'\x30\x51\x30\x0d\x06\x09\x60\x86\x48\x01\x65\x03\x04\x02\x03\x05\x00\x04\x40',
|
|
}
|
|
|
|
HASH_METHODS = {
|
|
'MD5': hashlib.md5,
|
|
'SHA-1': hashlib.sha1,
|
|
'SHA-224': hashlib.sha224,
|
|
'SHA-256': hashlib.sha256,
|
|
'SHA-384': hashlib.sha384,
|
|
'SHA-512': hashlib.sha512,
|
|
}
|
|
|
|
|
|
if sys.version_info >= (3, 6):
|
|
# Python 3.6 introduced SHA3 support.
|
|
HASH_ASN1.update({
|
|
'SHA3-256': b'\x30\x31\x30\x0d\x06\x09\x60\x86\x48\x01\x65\x03\x04\x02\x08\x05\x00\x04\x20',
|
|
'SHA3-384': b'\x30\x41\x30\x0d\x06\x09\x60\x86\x48\x01\x65\x03\x04\x02\x09\x05\x00\x04\x30',
|
|
'SHA3-512': b'\x30\x51\x30\x0d\x06\x09\x60\x86\x48\x01\x65\x03\x04\x02\x0a\x05\x00\x04\x40',
|
|
})
|
|
|
|
HASH_METHODS.update({
|
|
'SHA3-256': hashlib.sha3_256,
|
|
'SHA3-384': hashlib.sha3_384,
|
|
'SHA3-512': hashlib.sha3_512,
|
|
})
|
|
|
|
|
|
class CryptoError(Exception):
|
|
"""Base class for all exceptions in this module."""
|
|
|
|
|
|
class DecryptionError(CryptoError):
|
|
"""Raised when decryption fails."""
|
|
|
|
|
|
class VerificationError(CryptoError):
|
|
"""Raised when verification fails."""
|
|
|
|
|
|
def _pad_for_encryption(message: bytes, target_length: int) -> bytes:
|
|
r"""Pads the message for encryption, returning the padded message.
|
|
|
|
:return: 00 02 RANDOM_DATA 00 MESSAGE
|
|
|
|
>>> block = _pad_for_encryption(b'hello', 16)
|
|
>>> len(block)
|
|
16
|
|
>>> block[0:2]
|
|
b'\x00\x02'
|
|
>>> block[-6:]
|
|
b'\x00hello'
|
|
|
|
"""
|
|
|
|
max_msglength = target_length - 11
|
|
msglength = len(message)
|
|
|
|
if msglength > max_msglength:
|
|
raise OverflowError('%i bytes needed for message, but there is only'
|
|
' space for %i' % (msglength, max_msglength))
|
|
|
|
# Get random padding
|
|
padding = b''
|
|
padding_length = target_length - msglength - 3
|
|
|
|
# We remove 0-bytes, so we'll end up with less padding than we've asked for,
|
|
# so keep adding data until we're at the correct length.
|
|
while len(padding) < padding_length:
|
|
needed_bytes = padding_length - len(padding)
|
|
|
|
# Always read at least 8 bytes more than we need, and trim off the rest
|
|
# after removing the 0-bytes. This increases the chance of getting
|
|
# enough bytes, especially when needed_bytes is small
|
|
new_padding = os.urandom(needed_bytes + 5)
|
|
new_padding = new_padding.replace(b'\x00', b'')
|
|
padding = padding + new_padding[:needed_bytes]
|
|
|
|
assert len(padding) == padding_length
|
|
|
|
return b''.join([b'\x00\x02',
|
|
padding,
|
|
b'\x00',
|
|
message])
|
|
|
|
|
|
def _pad_for_signing(message: bytes, target_length: int) -> bytes:
|
|
r"""Pads the message for signing, returning the padded message.
|
|
|
|
The padding is always a repetition of FF bytes.
|
|
|
|
:return: 00 01 PADDING 00 MESSAGE
|
|
|
|
>>> block = _pad_for_signing(b'hello', 16)
|
|
>>> len(block)
|
|
16
|
|
>>> block[0:2]
|
|
b'\x00\x01'
|
|
>>> block[-6:]
|
|
b'\x00hello'
|
|
>>> block[2:-6]
|
|
b'\xff\xff\xff\xff\xff\xff\xff\xff'
|
|
|
|
"""
|
|
|
|
max_msglength = target_length - 11
|
|
msglength = len(message)
|
|
|
|
if msglength > max_msglength:
|
|
raise OverflowError('%i bytes needed for message, but there is only'
|
|
' space for %i' % (msglength, max_msglength))
|
|
|
|
padding_length = target_length - msglength - 3
|
|
|
|
return b''.join([b'\x00\x01',
|
|
padding_length * b'\xff',
|
|
b'\x00',
|
|
message])
|
|
|
|
|
|
def encrypt(message: bytes, pub_key: key.PublicKey) -> bytes:
|
|
"""Encrypts the given message using PKCS#1 v1.5
|
|
|
|
:param message: the message to encrypt. Must be a byte string no longer than
|
|
``k-11`` bytes, where ``k`` is the number of bytes needed to encode
|
|
the ``n`` component of the public key.
|
|
:param pub_key: the :py:class:`rsa.PublicKey` to encrypt with.
|
|
:raise OverflowError: when the message is too large to fit in the padded
|
|
block.
|
|
|
|
>>> from rsa import key, common
|
|
>>> (pub_key, priv_key) = key.newkeys(256)
|
|
>>> message = b'hello'
|
|
>>> crypto = encrypt(message, pub_key)
|
|
|
|
The crypto text should be just as long as the public key 'n' component:
|
|
|
|
>>> len(crypto) == common.byte_size(pub_key.n)
|
|
True
|
|
|
|
"""
|
|
|
|
keylength = common.byte_size(pub_key.n)
|
|
padded = _pad_for_encryption(message, keylength)
|
|
|
|
payload = transform.bytes2int(padded)
|
|
encrypted = core.encrypt_int(payload, pub_key.e, pub_key.n)
|
|
block = transform.int2bytes(encrypted, keylength)
|
|
|
|
return block
|
|
|
|
|
|
def decrypt(crypto: bytes, priv_key: key.PrivateKey) -> bytes:
|
|
r"""Decrypts the given message using PKCS#1 v1.5
|
|
|
|
The decryption is considered 'failed' when the resulting cleartext doesn't
|
|
start with the bytes 00 02, or when the 00 byte between the padding and
|
|
the message cannot be found.
|
|
|
|
:param crypto: the crypto text as returned by :py:func:`rsa.encrypt`
|
|
:param priv_key: the :py:class:`rsa.PrivateKey` to decrypt with.
|
|
:raise DecryptionError: when the decryption fails. No details are given as
|
|
to why the code thinks the decryption fails, as this would leak
|
|
information about the private key.
|
|
|
|
|
|
>>> import rsa
|
|
>>> (pub_key, priv_key) = rsa.newkeys(256)
|
|
|
|
It works with strings:
|
|
|
|
>>> crypto = encrypt(b'hello', pub_key)
|
|
>>> decrypt(crypto, priv_key)
|
|
b'hello'
|
|
|
|
And with binary data:
|
|
|
|
>>> crypto = encrypt(b'\x00\x00\x00\x00\x01', pub_key)
|
|
>>> decrypt(crypto, priv_key)
|
|
b'\x00\x00\x00\x00\x01'
|
|
|
|
Altering the encrypted information will *likely* cause a
|
|
:py:class:`rsa.pkcs1.DecryptionError`. If you want to be *sure*, use
|
|
:py:func:`rsa.sign`.
|
|
|
|
|
|
.. warning::
|
|
|
|
Never display the stack trace of a
|
|
:py:class:`rsa.pkcs1.DecryptionError` exception. It shows where in the
|
|
code the exception occurred, and thus leaks information about the key.
|
|
It's only a tiny bit of information, but every bit makes cracking the
|
|
keys easier.
|
|
|
|
>>> crypto = encrypt(b'hello', pub_key)
|
|
>>> crypto = crypto[0:5] + b'X' + crypto[6:] # change a byte
|
|
>>> decrypt(crypto, priv_key)
|
|
Traceback (most recent call last):
|
|
...
|
|
rsa.pkcs1.DecryptionError: Decryption failed
|
|
|
|
"""
|
|
|
|
blocksize = common.byte_size(priv_key.n)
|
|
encrypted = transform.bytes2int(crypto)
|
|
decrypted = priv_key.blinded_decrypt(encrypted)
|
|
cleartext = transform.int2bytes(decrypted, blocksize)
|
|
|
|
# Detect leading zeroes in the crypto. These are not reflected in the
|
|
# encrypted value (as leading zeroes do not influence the value of an
|
|
# integer). This fixes CVE-2020-13757.
|
|
if len(crypto) > blocksize:
|
|
raise DecryptionError('Decryption failed')
|
|
|
|
# If we can't find the cleartext marker, decryption failed.
|
|
if cleartext[0:2] != b'\x00\x02':
|
|
raise DecryptionError('Decryption failed')
|
|
|
|
# Find the 00 separator between the padding and the message
|
|
try:
|
|
sep_idx = cleartext.index(b'\x00', 2)
|
|
except ValueError:
|
|
raise DecryptionError('Decryption failed')
|
|
|
|
return cleartext[sep_idx + 1:]
|
|
|
|
|
|
def sign_hash(hash_value: bytes, priv_key: key.PrivateKey, hash_method: str) -> bytes:
|
|
"""Signs a precomputed hash with the private key.
|
|
|
|
Hashes the message, then signs the hash with the given key. This is known
|
|
as a "detached signature", because the message itself isn't altered.
|
|
|
|
:param hash_value: A precomputed hash to sign (ignores message).
|
|
:param priv_key: the :py:class:`rsa.PrivateKey` to sign with
|
|
:param hash_method: the hash method used on the message. Use 'MD5', 'SHA-1',
|
|
'SHA-224', SHA-256', 'SHA-384' or 'SHA-512'.
|
|
:return: a message signature block.
|
|
:raise OverflowError: if the private key is too small to contain the
|
|
requested hash.
|
|
|
|
"""
|
|
|
|
# Get the ASN1 code for this hash method
|
|
if hash_method not in HASH_ASN1:
|
|
raise ValueError('Invalid hash method: %s' % hash_method)
|
|
asn1code = HASH_ASN1[hash_method]
|
|
|
|
# Encrypt the hash with the private key
|
|
cleartext = asn1code + hash_value
|
|
keylength = common.byte_size(priv_key.n)
|
|
padded = _pad_for_signing(cleartext, keylength)
|
|
|
|
payload = transform.bytes2int(padded)
|
|
encrypted = priv_key.blinded_encrypt(payload)
|
|
block = transform.int2bytes(encrypted, keylength)
|
|
|
|
return block
|
|
|
|
|
|
def sign(message: bytes, priv_key: key.PrivateKey, hash_method: str) -> bytes:
|
|
"""Signs the message with the private key.
|
|
|
|
Hashes the message, then signs the hash with the given key. This is known
|
|
as a "detached signature", because the message itself isn't altered.
|
|
|
|
:param message: the message to sign. Can be an 8-bit string or a file-like
|
|
object. If ``message`` has a ``read()`` method, it is assumed to be a
|
|
file-like object.
|
|
:param priv_key: the :py:class:`rsa.PrivateKey` to sign with
|
|
:param hash_method: the hash method used on the message. Use 'MD5', 'SHA-1',
|
|
'SHA-224', SHA-256', 'SHA-384' or 'SHA-512'.
|
|
:return: a message signature block.
|
|
:raise OverflowError: if the private key is too small to contain the
|
|
requested hash.
|
|
|
|
"""
|
|
|
|
msg_hash = compute_hash(message, hash_method)
|
|
return sign_hash(msg_hash, priv_key, hash_method)
|
|
|
|
|
|
def verify(message: bytes, signature: bytes, pub_key: key.PublicKey) -> str:
|
|
"""Verifies that the signature matches the message.
|
|
|
|
The hash method is detected automatically from the signature.
|
|
|
|
:param message: the signed message. Can be an 8-bit string or a file-like
|
|
object. If ``message`` has a ``read()`` method, it is assumed to be a
|
|
file-like object.
|
|
:param signature: the signature block, as created with :py:func:`rsa.sign`.
|
|
:param pub_key: the :py:class:`rsa.PublicKey` of the person signing the message.
|
|
:raise VerificationError: when the signature doesn't match the message.
|
|
:returns: the name of the used hash.
|
|
|
|
"""
|
|
|
|
keylength = common.byte_size(pub_key.n)
|
|
encrypted = transform.bytes2int(signature)
|
|
decrypted = core.decrypt_int(encrypted, pub_key.e, pub_key.n)
|
|
clearsig = transform.int2bytes(decrypted, keylength)
|
|
|
|
# Get the hash method
|
|
method_name = _find_method_hash(clearsig)
|
|
message_hash = compute_hash(message, method_name)
|
|
|
|
# Reconstruct the expected padded hash
|
|
cleartext = HASH_ASN1[method_name] + message_hash
|
|
expected = _pad_for_signing(cleartext, keylength)
|
|
|
|
if len(signature) != keylength:
|
|
raise VerificationError('Verification failed')
|
|
|
|
# Compare with the signed one
|
|
if expected != clearsig:
|
|
raise VerificationError('Verification failed')
|
|
|
|
return method_name
|
|
|
|
|
|
def find_signature_hash(signature: bytes, pub_key: key.PublicKey) -> str:
|
|
"""Returns the hash name detected from the signature.
|
|
|
|
If you also want to verify the message, use :py:func:`rsa.verify()` instead.
|
|
It also returns the name of the used hash.
|
|
|
|
:param signature: the signature block, as created with :py:func:`rsa.sign`.
|
|
:param pub_key: the :py:class:`rsa.PublicKey` of the person signing the message.
|
|
:returns: the name of the used hash.
|
|
"""
|
|
|
|
keylength = common.byte_size(pub_key.n)
|
|
encrypted = transform.bytes2int(signature)
|
|
decrypted = core.decrypt_int(encrypted, pub_key.e, pub_key.n)
|
|
clearsig = transform.int2bytes(decrypted, keylength)
|
|
|
|
return _find_method_hash(clearsig)
|
|
|
|
|
|
def yield_fixedblocks(infile: typing.BinaryIO, blocksize: int) -> typing.Iterator[bytes]:
|
|
"""Generator, yields each block of ``blocksize`` bytes in the input file.
|
|
|
|
:param infile: file to read and separate in blocks.
|
|
:param blocksize: block size in bytes.
|
|
:returns: a generator that yields the contents of each block
|
|
"""
|
|
|
|
while True:
|
|
block = infile.read(blocksize)
|
|
|
|
read_bytes = len(block)
|
|
if read_bytes == 0:
|
|
break
|
|
|
|
yield block
|
|
|
|
if read_bytes < blocksize:
|
|
break
|
|
|
|
|
|
def compute_hash(message: typing.Union[bytes, typing.BinaryIO], method_name: str) -> bytes:
|
|
"""Returns the message digest.
|
|
|
|
:param message: the signed message. Can be an 8-bit string or a file-like
|
|
object. If ``message`` has a ``read()`` method, it is assumed to be a
|
|
file-like object.
|
|
:param method_name: the hash method, must be a key of
|
|
:py:const:`HASH_METHODS`.
|
|
|
|
"""
|
|
|
|
if method_name not in HASH_METHODS:
|
|
raise ValueError('Invalid hash method: %s' % method_name)
|
|
|
|
method = HASH_METHODS[method_name]
|
|
hasher = method()
|
|
|
|
if isinstance(message, bytes):
|
|
hasher.update(message)
|
|
else:
|
|
assert hasattr(message, 'read') and hasattr(message.read, '__call__')
|
|
# read as 1K blocks
|
|
for block in yield_fixedblocks(message, 1024):
|
|
hasher.update(block)
|
|
|
|
return hasher.digest()
|
|
|
|
|
|
def _find_method_hash(clearsig: bytes) -> str:
|
|
"""Finds the hash method.
|
|
|
|
:param clearsig: full padded ASN1 and hash.
|
|
:return: the used hash method.
|
|
:raise VerificationFailed: when the hash method cannot be found
|
|
"""
|
|
|
|
for (hashname, asn1code) in HASH_ASN1.items():
|
|
if asn1code in clearsig:
|
|
return hashname
|
|
|
|
raise VerificationError('Verification failed')
|
|
|
|
|
|
__all__ = ['encrypt', 'decrypt', 'sign', 'verify',
|
|
'DecryptionError', 'VerificationError', 'CryptoError']
|
|
|
|
if __name__ == '__main__':
|
|
print('Running doctests 1000x or until failure')
|
|
import doctest
|
|
|
|
for count in range(1000):
|
|
(failures, tests) = doctest.testmod()
|
|
if failures:
|
|
break
|
|
|
|
if count % 100 == 0 and count:
|
|
print('%i times' % count)
|
|
|
|
print('Doctests done')
|