+
     h L  c                  s  a  0 t $ ^ RIHt ^ RIt^ RIHt ^ RIHtHt ^ RI	H
t
Ht ^ RIHt ^ RIHt ^ RIHt ^ R	IHt ^ R
IHtHt ^RIHt ^RIHtHt ^RIHtHtH t H!t!HtH"t"H#t# ^t$]PJ                  ! R4      t&] ! R R]4      4       t'] ! R R]4      4       t(] ! R R]4      4       t)] ! R R4      4       t*Rt+Rt,] ! R R4      4       t-] ! R R4      4       t. ! R R]/4      t0] ! R R ]4      4       t1] ! R! R"]4      4       t2] ! R# R$4      4       t3] ! R% R&4      4       t4] ! R' R(]4      4       t5]Pl                  ]Pn                  ,          t8R)]9R*&   ].]3,          t:]0]4,          t;] ! R+ R,4      4       t<R- t= ! R. R/]4      t>R# )0    )annotationsN)	dataclass)IntEnumunique)	TypeAliascast)x509)InvalidSignature)default_backend)hashes)ecrsa)CoseKey)
ByteBuffer	bytes2int)AttestationAttestationResultAttestationTypeInvalidDatar   _validate_cert_commoncatch_builtinsz2.23.133.8.3c                  s&    ] tR t^;t^t^t^t^tRtR# )TpmRsaScheme N)	__name__
__module____qualname____firstlineno__RSASSARSAPSSOAEPRSAES__static_attributes__r       :/usr/lib/python3.14/site-packages/fido2/attestation/tpm.pyr   r   ;   s    FFDEr!   r   c                  s    ] tR t^Ct^t^#tRtR# )
TpmAlgAsymr   N)r   r   r   r   RSAECCr    r   r!   r"   r#   r#   C   s    
C
Cr!   r#   c                  s2    ] tR t^It^t^t^t^tR R ltRt	R# )
TpmAlgHashc                   V ^8  d   QhRR/# )   returnzhashes.HashAlgorithmr   Zformat   "r"   __annotate__ZTpmAlgHash.__annotate__P   s     
P 
P/ 
Pr!   c                	sp   V \         P                  8X  d   \        P                  ! 4       # V \         P                  8X  d   \        P                  ! 4       # V \         P                  8X  d   \        P                  ! 4       # V \         P
                  8X  d   \        P
                  ! 4       # \        R V : 24      h)z!_hash_alg is not implemented for )r&   SHA1r
   SHA256SHA384SHA512NotImplementedErrorself   &r"   	_hash_algZTpmAlgHash._hash_algP   s{    :??";;= Z&&&==?"Z&&&==?"Z&&&==?"!$EdX"NOOr!   r   N)
r   r   r   r   r-   r.   r/   r0   r5   r    r   r!   r"   r&   r&   I   s"    DFFF
P 
Pr!   r&   c                  s,    ] tR t^]t$ R]R&   R]R&   RtR# )TpmsCertifyInfobytesnamequalified_namer   N)r   r   r   r   __annotations__r    r   r!   r"   r6   r6   ]   s    
Kr!   r6   s   TCGs   c                  sd    ] tR t^gt$ RtR]R&   R]R&   R]R&   R]R&   R	]R
&   ]R R l4       tRtR# )TpmAttestationFormatuE  the signature data is defined by [TPMv2-Part2] Section 10.12.8 (TPMS_ATTEST)
as:
  TPM_GENERATED_VALUE (0xff544347 aka "ÿTCG")
  TPMI_ST_ATTEST - always TPM_ST_ATTEST_CERTIFY (0x8017)
    because signing procedure defines it should call TPM_Certify
    [TPMv2-Part3] Section 18.2
  TPM2B_NAME
    size (uint16)
    name (size long)
  TPM2B_DATA
    size (uint16)
    name (size long)
  TPMS_CLOCK_INFO
    clock (uint64)
    resetCount (uint32)
    restartCount (uint32)
    safe (byte) 1 yes, 0 no
  firmwareVersion uint64
  attested TPMS_CERTIFY_INFO (because TPM_ST_ATTEST_CERTIFY)
    name TPM2B_NAME
    qualified_name TPM2B_NAME
See:
  https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf
  https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-3-Commands-01.38.pdf
r7   r8   dataztuple[int, int, int, bool]
clock_infointfirmware_versionr6   attestedc                    V ^8  d   QhRRRR/# )r(   r<   r7   r)   r;   r   r*   r+   r"   r,   Z!TpmAttestationFormat.__annotate__   s     ,
 ,
 ,
#7 ,
r!   c                	s   \        V4      pVP                  ^4      pV\        8w  d   \        R4      hVP                  ^4      pV\        8w  d   \        R4      h VP                  VP                  R4      4      pVP                  VP                  R4      4      pVP                  R4      pVP                  R4      pVP                  R4      pVP                  R4      p	V	R9  d   \        RV	R R	24      hV	^8H  p
VP                  R4      pVP                  VP                  R4      4      pVP                  VP                  R4      4      pT ! TTYgY3T\        YR7      R7      #   \        P                   d   p\        T4      hR
p?ii ; i)i   z generated value field is invalidztpmi_st_attest field is invalid!Hz!Q!LZBzinvalid value 0xxz for booleanN)r8   r9   )r8   r<   r=   r?   r@   )r    i   )	r   readTPM_GENERATED_VALUE
ValueErrorTPM_ST_ATTEST_CERTIFYunpackstructZerrorr6   )clsr<   readerZgenerated_valueZtpmi_st_attestr8   ZclockZreset_countZrestart_countZ
safe_valueZsafer?   Zattested_nameZattested_qualified_namees   &&             r"   parseZTpmAttestationFormat.parse   sp   D! ++a.
 11?@@
  Q22>??	 ;;v}}T23D;;v}}T23DMM$'E ---K"MM$/Ms+J' #3Jq>!NOO?D%}}T2"KKd(;<M&,kk&--2E&F# M@-$"
 	
 || 	 Q-	 s   C1E% %F
:FF
r   N	r   r   r   r   __doc__r:   classmethodrN   r    r   r!   r"   r;   r;   g   s7    4 K
K**,
 ,
r!   r;   c                  sT    ] tR t^t$ RtR]R&   R]R&   R]R&   R]R&   ]R 4       tRtR	# )
TpmsRsaParmszParse TPMS_RSA_PARMS struct

See:
https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf
section 12.2.3.5
r>   	symmetricschemekey_bitsexponentc                	s(   VP                  R 4      pV\        P                  \        P                  ,          ,          pV\        P                  \        P                  ,          8H  pV'       g   V\        8w  d   \        R4      hVP                  R 4      pV\        P                  \        P                  ,          ,          pV\        P                  8H  pV'       d6   V\        \        P                  \        P                  39  d   \        R4      hV\        P                  \        P                  ,          8H  p	V	'       d1   V\        P                  \        P                  39  d   \        R4      hV\        P                  8H  p
V
'       d6   V\        P                  \        P                  \        39  d   \        R4      hV'       d   V\        39  d   \        R4      hVP                  R 4      pVP                  R4      pV^ 8X  d   RpV ! W6W4      # )rB    symmetric is expected to be NULLzlkey is an unrestricted signing key, scheme is expected to be TPM_ALG_RSAPSS, TPM_ALG_RSASSA, or TPM_ALG_NULLz[key is a restricted signing key, scheme is expected to be TPM_ALG_RSAPSS, or TPM_ALG_RSASSAzlkey is an unrestricted decryption key, scheme is expected to be TPM_ALG_RSAES, TPM_ALG_OAEP, or TPM_ALG_NULLzJkey is an restricted decryption key, scheme is expected to be TPM_ALG_NULLrC   i  )rI   
ATTRIBUTES
RESTRICTEDDECRYPTTPM_ALG_NULLrG   SIGN_ENCRYPTr   r   r   r   r   )rK   rL   
attributesrS   Zrestricted_decryptionZis_restricted_decryption_keyrT   Zrestricted_signZis_unrestricted_signing_keyZis_restricted_signing_keyZis_unrestricted_decryption_keyrU   rV   s   &&&          r"   rN   ZTpmsRsaParms.parse   s   MM$'	 *!!J$6$66!
 (=!6!66(
$ ,	\0I ?@@ t$$
(=(=
@W@W(WX&59P9P&P#&6:
 ,

 "  %4!!J$;$;;%
! %8
 *
 C 
 *?*BTBT)T&)f=
 /

   (F</,I. 
 ==&==&q="H9h99r!   r   NrO   r   r!   r"   rR   rR      s1     NKMMC: C:r!   rR   c                  s,    ] tR tRt]R R l4       tRtR# )Tpm2bPublicKeyRsai  c               rA   )r(   rL   r   r)   r^   r   r*   r+   r"   r,   ZTpm2bPublicKeyRsa.__annotate__  s     5 5: 5*; 5r!   c                	sN    V ! VP                  VP                  R 4      4      4      # rB   rE   rI   )rK   rL   s   &&r"   rN   ZTpm2bPublicKeyRsa.parse  s    6;;v}}T2344r!   r   N)r   r   r   r   rQ   rN   r    r   r!   r"   r^   r^     s    5 5r!   r^   c                  sJ    ] tR tRtRt^ t^t^t^t^t	^t
^t^t^ tR R ltRtR# )TpmEccCurvei  z{TPM_ECC_CURVE
https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf
section 6.4
c               r'   )r(   r)   zec.EllipticCurver   r*   r+   r"   r,   ZTpmEccCurve.__annotate__%  s     9 9* 9r!   c                	s   V \         P                  8X  d   \        R 4      hV \         P                  8X  d   \        P
                  ! 4       # V \         P                  8X  d   \        P                  ! 4       # V \         P                  8X  d   \        P                  ! 4       # V \         P                  8X  d   \        P                  ! 4       # V \         P                  8X  d   \        P                  ! 4       # \        RV 4      h)zNo such curvezcurve is not supported)ra   NONErG   	NIST_P192r   Z	SECP192R1	NIST_P224Z	SECP224R1	NIST_P256Z	SECP256R1	NIST_P384Z	SECP384R1	NIST_P521Z	SECP521R1r2   r4   r"   to_curveZTpmEccCurve.to_curve%  s    ;###_--[***<<>![***<<>![***<<>![***<<>![***<<>!1488r!   r   N)r   r   r   r   rP   rb   rc   rd   re   rf   rg   ZBN_P256ZBN_P638ZSM2_P256rh   r    r   r!   r"   ra   ra     s@    
 DIIIIIGGH9 9r!   ra   c                  s*    ] tR tRtRt]t^ t^!t^"t	Rt
R# )
TpmiAlgKdfi6  z{TPMI_ALG_KDF
https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf
section 9.28
r   N)r   r   r   r   rP   r[   ZNULLZKDF1_SP800_56AZKDF2ZKDF1_SP800_108r    r   r!   r"   ri   ri   6  s    
 DNDNr!   ri   c                  sV    ] tR tRt$ R]R&   R]R&   R]R&   R]R&   ]R	 R
 l4       tRtR# )TpmsEccParmsiC  r>   rS   rT   ra   curve_idri   Zkdfc               rA   )r(   rL   r   r)   rj   r   r*   r+   r"   r,   ZTpmsEccParms.__annotate__K  s     < <: <, <r!   c                	s   VP                  R 4      pVP                  R 4      pV\        8w  d   \        R4      hV\        8w  d   \        R4      h\        VP                  R 4      4      p\	        VP                  R 4      4      pV ! W#WE4      # )rB   rW   zscheme is expected to be NULL)rI   r[   rG   ra   ri   )rK   rL   rS   rT   rk   Z
kdf_schemes   &&    r"   rN   ZTpmsEccParms.parseJ  sy    MM$'	t$$?@@\!<==v}}T23d 34
9h;;r!   r   N)r   r   r   r   r:   rQ   rN   r    r   r!   r"   rj   rj   C  s)    NK	O< <r!   rj   c                  sF    ] tR tRt$ RtR]R&   R]R&   ]R R l4       tRtR	# )
TpmsEccPointiY  zTPMS_ECC_POINT
https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf
Section 11.2.5.2
r7   rD   yc               rA   )r(   rL   r   r)   rl   r   r*   r+   r"   r,   ZTpmsEccPoint.__annotate__d  s      : , r!   c                	s    VP                  VP                  R 4      4      pVP                  VP                  R 4      4      pV ! W#4      # r_   r`   )rK   rL   rD   rm   s   &&  r"   rN   ZTpmsEccPoint.parsec  s:    KKd+,KKd+,1yr!   r   NrO   r   r!   r"   rl   rl   Y  s%    
 HH r!   rl   c                  sJ    ] tR tRtRt^t^t^t^ t^@t	^t
RtRtRtRtR	tR
tRtR# )rX   ik  zObject attributes
see section 8.3
  https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf
r   Ni   i   i   i   i   l   	s )r   r   r   r   rP   Z	FIXED_TPMZST_CLEARZFIXED_PARENTZSENSITIVE_DATA_ORIGINZUSER_WITH_AUTHZADMIN_WITH_POLICYZNO_DAZENCRYPTED_DUPLICATIONrY   rZ   r\   SHALL_BE_ZEROr    r   r!   r"   rX   rX   k  sM    
 IHL"NE#JGL	- r!   rX   r   
_PublicKeyc                  s    ] tR tRt$ RtR]R&   R]R&   R]R&   R	]R
&   R]R&   R]R&   R	]R&   ]R R l4       tR R ltR R lt	Rt
R# )TpmPublicFormati  a  the public area structure is defined by [TPMv2-Part2] Section 12.2.4
(TPMT_PUBLIC)
as:
  TPMI_ALG_PUBLIC - type
  TPMI_ALG_HASH - nameAlg
    or + to indicate TPM_ALG_NULL
  TPMA_OBJECT - objectAttributes
  TPM2B_DIGEST - authPolicy
  TPMU_PUBLIC_PARMS - type parameters
  TPMU_PUBLIC_ID - uniq
See:
  https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf
r#   sign_algr&   name_algr>   r]   r7   auth_policy_Parameters
parameters_Uniquer   r<   c               rA   )r(   r<   r7   r)   rp   r   r*   r+   r"   r,   TpmPublicFormat.__annotate__  s     
 
 
? 
r!   c           	     	s   \        V4      p\        VP                  R 4      4      p\        VP                  R 4      4      pVP                  R4      pV\        P
                  ,          ^ 8w  d   \        RVR 24      hVP                  VP                  R 4      4      pV\        P                  8X  d,   \        P                  W%4      p\        P                  V4      pMPV\        P                  8X  d,   \        P                  V4      p\        P                  V4      pM\        RVR R24      hVP                  4       p	\!        V	4      ^ 8w  d   \        R4      hV ! W4WVWxV4      # )rB   rC   z(attributes is not formated correctly: 0xrD   z	sign alg z is not supportedz+there should not be any data left in buffer)r   r#   rI   r&   rX   rn   rG   rE   r$   rR   rN   r^   r%   rj   rl   r1   Zlen)
rK   r<   rL   rq   rr   r]   rs   ru   r   Zrests
   &&        r"   rN   ZTpmPublicFormat.parse  s'   D!fmmD12fmmD12]]4(

000A5G
ST~VWWkk&--"56z~~%&2&8&8&LJ/55f=F'%++F3J!''/F%	(1=N&OPP{{}t9>JKK
T
 	
r!   c               r'   )r(   r)   ro   r   r*   r+   r"   r,   rw     s     W WJ Wr!   c                	s   V P                   \        P                  8X  du   \        \        V P
                  4      P                  p\        \        \        V P                  4      4      p\        P                  ! W4      P                  \        4       4      # V P                   \        P                  8X  d   \        \        V P                  4      p\         P"                  ! \        VP$                  4      \        VP&                  4      \        \(        V P
                  4      P*                  P-                  4       4      P                  \        4       4      # \/        R V P                   : 24      h)zpublic_key not implemented for )rq   r#   r$   r   rR   ru   rV   r   r^   r   r   ZRSAPublicNumbers
public_keyr	   r%   rl   r   ZEllipticCurvePublicNumbersrD   rm   rj   rk   rh   r1   )r3   rV   Zmodulusr   s   &   r"   rx   ZTpmPublicFormat.public_key  s    ==JNN*L$//:CCH%6 DEG'':EEoFWXX]]jnn,,4F00&((#&((#\4??3<<EEG j*+	, "$CDMMCT"UVVr!   c               r'   )r(   r)   r7   r   r*   r+   r"   r,   rw     s      e r!   c                s   \         P                  ! RV P                  4      p\        P                  ! V P                  P                  4       \        4       R7      pVP                  V P                  4       WP                  4       ,          pV# )u  
Computing Entity Names

see:
  https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf
section 16 Names

Name ≔ nameAlg || HnameAlg (handle→nvPublicArea)
  where
    nameAlg algorithm used to compute Name
    HnameAlg hash using the nameAlg parameter in the NV Index location
             associated with handle
    nvPublicArea contents of the TPMS_NV_PUBLIC associated with handle
rB   Zbackend)
rJ   Zpackrr   r
   Hashr5   r	   updater<   finalize)r3   Zoutputdigests   &  r"   r8   ZTpmPublicFormat.name  s\     T4==1T]]446@QRdii //##r!   r   N)r   r   r   r   rP   r:   rQ   rN   rx   r8   r    r   r!   r"   rp   rp     sR     OO
K
 
8W r!   rp   c                s   \        V 4       V P                  P                  \        P                  4      pV'       d   \        R 4      hV P                  P                  \        P                  4      pV'       g   \        R4      hV P                  P                  \        P                  4      pVP                   Uu. uF  q3\        8H  NK  	  ppRV9  d   \        R4      hR# u upi )z#Certificate should not have Subjectz.Certificate should have SubjectAlternativeNameTzExtended key usage MUST contain the "joint-iso-itu-t(2) internationalorganizations(23) 133 tcg-kp(8) tcg-kp-AIKCertificate(3)" OID.N)r   ZsubjectZget_attributes_for_oidr   ZNameOIDr   Z
extensionsZget_extension_for_classZSubjectAlternativeNameZExtendedKeyUsageZvalueOID_AIK_CERTIFICATE)certZsZextrD   Zhas_aiks   &    r"   _validate_tpm_certr     s    $++DLL9A?@@//0K0KLAJKK
//
1
1$2G2G
HC14;A''G;7-
 	
  <s   ;C"c                  s*    ] tR tRtRt]R 4       tRtR# )TpmAttestationi  tpmc                	sX   R V9   d   \        R4      hVR,          pVR,          pVR,          p\        P                  ! V^ ,          \        4       4      p\	        V4       \
        P                  ! V4      P                  VP                  4       4      p \        P                  VR,          4      p	TP                  P                  P                  T	P                  4       4      TP                  P                  8w  d   \        R4      h \        P                  T4      pY#,           pTP                   p\"        P$                  ! T\        4       R	7      pTP'                  T4       TP)                  4       pTP*                  T8w  d   \        R
4      hTP,                  P.                  T	P/                  4       8w  d   \        R4      hTP1                  YaR,          4       \3        \4        P6                  T4      #   \         d   p
\        RT
4      hRp
?
ii ; i  \8         d    \        R4      hi ; i)Z
ecdaaKeyIdzECDAA not implementedalgx5cZcertInfoZpubAreazunable to parse pubAreaNz9attestation pubArea does not match attestedCredentialDatary   z5attestation does not sign for authData and ClientDataz;TPMS_CERTIFY_INFO does not include a valid name for pubAreaZsigz$signature of certInfo does not match)r1   r   Zload_der_x509_certificater	   r   r   Zfor_algZfrom_cryptography_keyrx   rp   rN   Z	Exceptionr   Zcredential_datar   r;   Z	_HASH_ALGr
   rz   r{   r|   r<   r@   r8   verifyr   r   ZATT_CA_InvalidSignature)r3   Z	statementZ	auth_dataZclient_data_hashr   r   Z	cert_infor   Zpub_keyZpub_arearM   r   Zatt_to_be_signedZhash_algr}   r<   s   &&&&            r"   r   ZTpmAttestation.verify   s   9$%&=>>j)	--c!fo6GH4 //#&<<T__=NO	<&,,Yy-ABH %%00FF##% ((334
 #K $	K ',,Y7C  );((H[[?3DEFMM*+??$Dxx4&K  ||  HMMO3!Q  NN9&67$_%;%;SAAe  	<7;;	<f ! 	K"#IJJ	Ks%   G3 C+H 3H>H

HH)r   N)r   r   r   r   ZFORMATr   r   r    r   r!   r"   r   r     s    FAK AKr!   r   )?__conditional_annotations__Z
__future__r   rJ   Zdataclassesr   Zenumr   r   Ztypingr   r   Zcryptographyr   Zcryptography.exceptionsr   r   Zcryptography.hazmat.backendsr	   Zcryptography.hazmat.primitivesr
   Z)cryptography.hazmat.primitives.asymmetricr   r   Zcoser   Zutilsr   r   Zbaser   r   r   r   r   r   r[   ZObjectIdentifierr~   r   r#   r&   r6   rF   rH   r;   rR   r7   r^   ra   ri   rj   rl   rX   ZRSAPublicKeyZEllipticCurvePublicKeyro   r:   rt   rv   rp   r   r   )r   s   @r"   <module>r      s  < # "  !   "  I 8 1 =  )   ++N;  7     
 P P P&   
 ! #  N
 N
 N
b Q: Q: Q:h5 5 9' 9 9B 	 	 	 < < <*   "   6 ((2+D+DD
I D\)
l
* X X Xv
*EK[ EKr!   