+
    czbF  c                   s   ^ RI t ^ RIt^ RIHtHt ^ RIHtHt ^ RIH	t	 ^ RI
Ht ^ RIHtHtHt ^ RIHt ^ RIHt ^ R	IHt ^ R
IHtHtHt ^ RIHt ^ RIHt ^ RIHtHt ^ RI H!t! ^ RI"H#t# ^ RI"H$t$ ^ RI"H%t% ^ RI"H&t& ^ RI"H't' ^ RI"H(t(H)t) ^ RI"H*t* ^ RI+H,t,  ! R R]R7      t-R t.R t/R t0R t1R t2 ! R R 4      t3 ! R! R"]34      t4 ! R# R$]34      t5 ! R% R&]34      t6 ! R' R(]34      t7 ! R) R*]4]-4      t8 ! R+ R,]4]-4      t9 ! R- R.]4]-4      t: ! R/ R0]5]-4      t; ! R1 R2]5]-4      t< ! R3 R4]5]-4      t= ! R5 R6]6]-4      t> ! R7 R8]6]-4      t? ! R9 R:]6]-4      t@ ! R; R<]6]-4      tA ! R= R>]5]-4      tB ! R? R@]5]-4      tC ! RA RB]5]-4      tD ! RC RD]7]-4      tE ! RE RF4      tF ! RG RH]F4      tG ! RI RJ]G]-4      tH ! RK RL]G]-4      tI ! RM RN]G]-4      tJ ! RO RP]F4      tK ! RQ RR]K]-4      tL ! RS RT]K]-4      tM ! RU RV]K]-4      tN ! RW RX]F4      tO ! RY RZ]O]-4      tP ! R[ R\]O]-4      tQ ! R] R^]O]-4      tR ! R_ R`]F4      tS ! Ra Rb]S]-4      tT ! Rc Rd]S]-4      tU ! Re Rf]S]-4      tV ! Rg Rh]F]-4      tW ! Ri Rj]F]-4      tX ! Rk Rl]X4      tY ! Rm Rn]X4      tZ ! Ro Rp]X4      t[ ! Rq Rr]3]-4      t\ ! Rs Rt4      t] ! Ru Rv]]4      t^ ! Rw Rx]^]-4      t_ ! Ry Rz]^]-4      t` ! R{ R|]^]-4      ta ! R} R~]]4      tb ! R R]b]-4      tc ! R R]b]-4      td ! R R]b]-4      te ! R R4      tfR# )i    N)ABCMetaabstractmethod)hexlify	unhexlify)InvalidSignature)default_backend)constant_timehasheshmac)ec)padding)utils)Cipher
algorithmsmodes)ConcatKDFHash)
PBKDF2HMAC)aes_key_unwrapaes_key_wrap)PKCS7)InvalidCEKeyLength)InvalidJWAAlgorithm)InvalidJWEKeyLength)InvalidJWEKeyType)InvalidJWEOperation)base64url_decodebase64url_encode)json_decode)JWKc                   s   a  ] tR t^ t o ]]R 4       4       t]]R 4       4       t]]R 4       4       t]]R 4       4       t	]]R 4       4       t
RtV tR# )JWAAlgorithmc                    R# )zThe algorithm NameN self   &1/usr/lib/python3.14/site-packages/jwcrypto/jwa.pynameZJWAAlgorithm.name"           c                r   )zA short descriptionNr   r    r"   r#   descriptionZJWAAlgorithm.description'   r%   r&   c                r   )z'The actual/recommended/minimum key sizeNr   r    r"   r#   keysizeZJWAAlgorithm.keysize,   r%   r&   c                r   )zOne of 'alg', 'enc' or 'JWK'Nr   r    r"   r#   algorithm_usage_locationZ%JWAAlgorithm.algorithm_usage_location1   r%   r&   c                r   )zOne of 'sig', 'kex', 'enc'Nr   r    r"   r#   algorithm_useZJWAAlgorithm.algorithm_use6   r%   r&   r   N)__name__
__module____qualname____firstlineno__propertyr   r$   r'   r(   r)   r*   __static_attributes____classdictcell____classdict__   @r#   r   r       s     !  ! "  " 6  6 +  + )  )r&   r   )Z	metaclassc                 s&    \        V 4      ^,          #    )lenZxr"   r#   _bitsizer9   <   s    q6A:r&   c                 s    V ^,          # r5   r   r8   r"   r#   _inbytesr:   @   s    6Mr&   c                 sr    V ^,          ^ 8w  d   \        R4      h\        P                  ! \        V 4      4      # )r6   zlength must be a multiple of 8)
ValueErrorosZurandomr:   r8   r"   r#   _randombitsr=   D   s,    1uz9::::hqk""r&   c                 s    R P                  V 4      pV^,           ^,          ^,          p\        VP                  VR4      RV 4      # )z{:x}Z0N)Zformatr   Zrjust)nZbitseZilens   &&  r#   _encode_intr@   K   s?    aAAX!Oq DQWWT3'.//r&   c                 s,    \        \        V 4      ^4      # )i   )intr   )r>   r"   r#   _decode_intrB   Q   s    wqz2r&   c                   s,   a  ] tR t^Ut o R tR tRtV tR# )_RawJWSc                    \         hNNotImplementedErrorr!   keypayload   &&&r#   signZ_RawJWS.signW       !!r&   c                rD   rE   rF   r!   rI   rJ   	signature   &&&&r#   verifyZ_RawJWS.verifyZ   rM   r&   r   Nr+   r,   r-   r.   rL   rQ   r0   r1   r2   r4   r#   rC   rC   U        "" "r&   rC   c                   s8   a  ] tR t^^t o R tR tR tR tRtV t	R# )_RawHMACc                s0    \        4       V n        Wn        R # rE   )r   backendhashfnr!   rV      &&r#   __init__Z_RawHMAC.__init__`   s    &(r&   c                s    \         P                  ! WP                  V P                  R 7      pVP	                  V4       V# )rU   )r   HMACrV   rU   update)r!   rI   rJ   h   &&& r#   _hmac_setupZ_RawHMAC._hmac_setupd   s+    IIc;;=	r&   c                sx    \        VP                  R 4      4      pV P                  W24      pVP                  4       # rL   )r   
get_op_keyr_   finalize)r!   rI   rJ   skeyr]   s   &&&  r#   rL   Z_RawHMAC.signi   s1    v 67T+zz|r&   c                s~    \        VP                  R 4      4      pV P                  WB4      pVP                  V4       R# rQ   N)r   ra   r_   rQ   )r!   rI   rJ   rO   Zvkeyr]   s   &&&&  r#   rQ   Z_RawHMAC.verifyn   s1    x 89T+	r&   )rU   rV   N)
r+   r,   r-   r.   rY   r_   rL   rQ   r0   r1   r2   r4   r#   rT   rT   ^   s     

 r&   rT   c                   s2   a  ] tR t^tt o R tR tR tRtV tR# )_RawRSAc                    Wn         W n        R # rE   )padfnrV   )r!   rg   rV   rK   r#   rY   Z_RawRSA.__init__u   s    
r&   c                sp    VP                  R 4      pVP                  W P                  V P                  4      # r`   )ra   rL   rg   rV   r!   rI   rJ   rc   r^   r#   rL   Z_RawRSA.signy   s)    ~~f%yy**dkk::r&   c                sv    VP                  R 4      pVP                  W2V P                  V P                  4       R# rd   )ra   rQ   rg   rV   r!   rI   rJ   rO   pkey   &&&& r#   rQ   Z_RawRSA.verify}   s(    ~~h'I

DKK@r&   )rV   rg   N)	r+   r,   r-   r.   rY   rL   rQ   r0   r1   r2   r4   r#   re   re   t   s     ;A Ar&   re   c                   sB   a  ] tR t^t o R t]R 4       tR tR tRt	V t
R# )_RawECc                rf   rE   _curverV   )r!   curverV   rK   r#   rY   Z_RawEC.__init__   s    r&   c                s    V P                   # rE   )rn   r    r"   r#   ro   Z_RawEC.curve   s    {{r&   c                s   VP                  R V P                  4      pVP                  pVP                  V\        P
                  ! V P                  4      4      p\        P                  ! V4      w  rg\        Wd4      \        Wt4      ,           # r`   )
ra   rn   Zkey_sizerL   r	   ECDSArV   ec_utilsZdecode_dss_signaturer@   )r!   rI   rJ   rc   ZsizerO   rss   &&&     r#   rL   Z_RawEC.sign   sc    ~~fdkk2}}IIgrxx'<=	,,Y71#k!&:::r&   c                sl   VP                  R V P                  4      pVR\        V4      ^,           pV\        V4      ^,          R p\        P                  ! \        \        V4      ^4      \        \        V4      ^4      4      pVP                  Wr\        P                  ! V P                  4      4       R# rd   )ra   rn   r7   rq   Zencode_dss_signaturerA   r   rQ   r	   rp   rV   )r!   rI   rJ   rO   rj   rr   rs   Zenc_signature   &&&&    r#   rQ   Z_RawEC.verify   s    ~~h4*s9~*+c)n)*+ 55
BWQZ!46MBHHT[[,ABr&   rm   N)r+   r,   r-   r.   rY   r/   ro   rL   rQ   r0   r1   r2   r4   r#   rl   rl      s/       ;C Cr&   rl   c                   s,   a  ] tR t^t o R tR tRtV tR# )_RawNonec                s    R # ) r   rH   rK   r#   rL   Z_RawNone.sign   s    r&   c                sb    VR ,          R8w  g   VP                  4       R8w  d   \        R4      hR# )ktyoctrv   z'The "none" signature cannot be verifiedN)ra   r   rN   rP   r#   rQ   Z_RawNone.verify   s-    u:#.."2b"8"#LMM #9r&   r   NrR   r2   r4   r#   ru   ru      s     N Nr&   ru   c                   sF   a a ] tR t^t oRtRtRtRtRtV 3R lt	Rt
VtV ;t# )_HS256HS256zHMAC using SHA-256   algsigc                T   < \         \        V `  \        P                  ! 4       4       R # rE   )superry   rY   r   SHA256r!   	__class__   &r#   rY   Z_HS256.__init__       fd$V]]_5r&   r   r+   r,   r-   r.   r$   r'   r(   r)   r*   rY   r0   r1   __classcell__r   r3      @@r#   ry   ry      )     D&KG$M6 6r&   ry   c                   sF   a a ] tR t^t oRtRtRtRtRtV 3R lt	Rt
VtV ;t# )_HS384HS384zHMAC using SHA-384  r|   r}   c                r~   rE   )r   r   rY   r   SHA384r   r   r#   rY   Z_HS384.__init__   r   r&   r   r   r   r   r#   r   r      r   r&   r   c                   sF   a a ] tR t^t oRtRtRtRtRtV 3R lt	Rt
VtV ;t# )_HS512HS512zHMAC using SHA-512   r|   r}   c                r~   rE   )r   r   rY   r   SHA512r   r   r#   rY   Z_HS512.__init__   r   r&   r   r   r   r   r#   r   r      r   r&   r   c                   sF   a a ] tR t^t oRtRtRtRtRtV 3R lt	Rt
VtV ;t# )_RS256RS256zRSASSA-PKCS1-v1_5 using SHA-256   r|   r}   c                |   < \         \        V `  \        P                  ! 4       \
        P                  ! 4       4       R # rE   )r   r   rY   r
   PKCS1v15r   r   r   r   r#   rY   Z_RS256.__init__   #    fd$W%5%5%7Ir&   r   r   r   r   r#   r   r      +     D3KG$MJ Jr&   r   c                   sF   a a ] tR t^t oRtRtRtRtRtV 3R lt	Rt
VtV ;t# )_RS384RS384zRSASSA-PKCS1-v1_5 using SHA-384r   r|   r}   c                r   rE   )r   r   rY   r
   r   r   r   r   r   r#   rY   Z_RS384.__init__   r   r&   r   r   r   r   r#   r   r      r   r&   r   c                   sF   a a ] tR t^t oRtRtRtRtRtV 3R lt	Rt
VtV ;t# )_RS512RS512zRSASSA-PKCS1-v1_5 using SHA-512r   r|   r}   c                r   rE   )r   r   rY   r
   r   r   r   r   r   r#   rY   Z_RS512.__init__   r   r&   r   r   r   r   r#   r   r      r   r&   r   c                   sF   a a ] tR t^t oRtRtRtRtRtV 3R lt	Rt
VtV ;t# )_ES256ES256zECDSA using P-256 and SHA-256r{   r|   r}   c                V   < \         \        V `  R \        P                  ! 4       4       R# )zP-256N)r   r   rY   r   r   r   r   r#   rY   Z_ES256.__init__       fd$Wfmmo>r&   r   r   r   r   r#   r   r      )     D1KG$M? ?r&   r   c                   sF   a a ] tR t^t oRtRtRtRtRtV 3R lt	Rt
VtV ;t# )_ES256KES256Kz'ECDSA using secp256k1 curve and SHA-256r{   r|   r}   c                r   )Z	secp256k1N)r   r   rY   r   r   r   r   r#   rY   Z_ES256K.__init__  s    gt%k6==?Cr&   r   r   r   r   r#   r   r      s+     D;KG$MD Dr&   r   c                   F   a a ] tR tRt oRtRtRtRtRtV 3R lt	Rt
VtV ;t# )	_ES384i  ES384zECDSA using P-384 and SHA-384r   r|   r}   c                r   )zP-384N)r   r   rY   r   r   r   r   r#   rY   Z_ES384.__init__  r   r&   r   r   r   r   r#   r   r     r   r&   r   c                   r   )	_ES512i  ES512zECDSA using P-521 and SHA-512r   r|   r}   c                r   )zP-521N)r   r   rY   r   r   r   r   r#   rY   Z_ES512.__init__  r   r&   r   r   r   r   r#   r   r     r   r&   r   c                   r   )	_PS256i  PS256z.RSASSA-PSS using SHA-256 and MGF1 with SHA-256r   r|   r}   c                  < \         P                  ! \         P                  ! \        P                  ! 4       4      \        P                  P
                  4      p\        \        V `#  V\        P                  ! 4       4       R # rE   )	r
   PSSMGF1r   r   digest_sizer   r   rY   r!   rg   r      & r#   rY   Z_PS256.__init__%  F    GLL9"MM557fd$UFMMO<r&   r   r   r   r   r#   r   r     )     DBKG$M= =r&   r   c                   r   )	_PS384i+  PS384z.RSASSA-PSS using SHA-384 and MGF1 with SHA-384r   r|   r}   c                r   rE   )	r
   r   r   r   r   r   r   r   rY   r   r   r#   rY   Z_PS384.__init__3  r   r&   r   r   r   r   r#   r   r   +  r   r&   r   c                   r   )	_PS512i9  PS512z.RSASSA-PSS using SHA-512 and MGF1 with SHA-512r   r|   r}   c                r   rE   )	r
   r   r   r   r   r   r   r   rY   r   r   r#   rY   Z_PS512.__init__A  r   r&   r   r   r   r   r#   r   r   9  r   r&   r   c                   s*    ] tR tRtRtRt^ tRtRtRt	R# )_NoneiG  nonez%No digital signature or MAC performedr|   r}   r   N
r+   r,   r-   r.   r$   r'   r(   r)   r*   r0   r   r&   r#   r   r   G  s    D9KG$Mr&   r   c                   ,   a  ] tR tRt o R tR tRtV tR# )_RawKeyMgmtiP  c                rD   rE   rF   )r!   rI   bitsizecekheaders   &&&&&r#   wrapZ_RawKeyMgmt.wrapR  rM   r&   c                rD   rE   rF   )r!   rI   r   ekr   r   r#   unwrapZ_RawKeyMgmt.unwrapU  rM   r&   r   N)r+   r,   r-   r.   r   r   r0   r1   r2   r4   r#   r   r   P  rS   r&   r   c                   s8   a  ] tR tRt o R tR tR tR tRtV t	R# )_RSAiY  c                s    Wn         R # rE   rg   )r!   rg   rX   r#   rY   Z_RSA.__init__[  s    
r&   c                    \        V\        4      '       g   \        R 4      hVR,          R8w  d   \        RVR,          4      hR# )key is not a JWK objectrw   ZRSAN
isinstancer   r;   r   r!   rI   rX   r#   
_check_keyZ_RSA._check_key^  =    #s##677u:#E3u:66 r&   c                s    V P                  V4       V'       g   \        V4      pVP                  R 4      pVP                  W0P                  4      pRVRV/# )wrapKeyr   r   )r   r=   ra   encryptrg   r!   rI   r   r   r   rkr      &&&&&  r#   r   Z	_RSA.wrape  sJ    g&C^^I&ZZZZ(sD"%%r&   c                s    V P                  V4       VP                  R 4      pVP                  W0P                  4      p\	        V4      V8w  d   \        V\	        V4      4      hV# )	unwrapKey)r   ra   decryptrg   r9   r   r!   rI   r   r   r   r   r   r   r#   r   Z_RSA.unwrapm  sP    ^^K(jjZZ(C=G#%gx}==
r&   r   N)
r+   r,   r-   r.   rY   r   r   r   r0   r1   r2   r4   r#   r   r   Y  s     7& r&   r   c                   sR   a a ] tR tRt oRtRtRtRtRtV 3R lt	V 3R lt
R	tVtV ;t# )
_Rsa15iv  RSA1_5zRSAES-PKCS1-v1_5r   r|   kexc                r~   rE   )r   r   rY   r
   r   r   r   r#   rY   Z_Rsa15.__init__~  s    fd$W%5%5%78r&   c                s   < V P                  V4       \        V4      p \        \        V `  WW44      p\        R 4      h  \
         d    Tu # i ; i)ZDummy)r   r=   r   r   r   Z	Exception)r!   rI   r   r   r   r   r   s   &&&&& r#   r   Z_Rsa15.unwrap  sT     '"	,S2GC G$$ 	J	s   > AAr   )r+   r,   r-   r.   r$   r'   r(   r)   r*   rY   r   r0   r1   r   r   r   r#   r   r   v  s.     D$KG$M9 r&   r   c                   r   )	_RsaOaepi  RSA-OAEPz#RSAES OAEP using default parametersr   r|   r   c                   < \         \        V `  \        P                  ! \        P
                  ! \        P                  ! 4       4      \        P                  ! 4       R 4      4       R # rE   )r   r   rY   r
   OAEPr   r   ZSHA1r   r   r#   rY   Z_RsaOaep.__init__  s:    h&LLfkkm4.	/r&   r   r   r   r   r#   r   r     s)     D7KG$M/ /r&   r   c                   r   )	_RsaOaep256i  RSA-OAEP-256z.RSAES OAEP using SHA-256 and MGF1 with SHA-256r   r|   r   c                r   rE   )r   r   rY   r
   r   r   r   r   r   r   r#   rY   Z_RsaOaep256.__init__  s:    k4)LLfmmo6$0	1r&   r   r   r   r   r#   r   r     s)     DBKG$M1 1r&   r   c                   <   a  ] tR tRt o RtR tR tR tR tRt	V t
R# )_AesKwi  Nc                $    \        4       V n        R # rE   r   rU   r    r"   r#   rY   Z_AesKw.__init__      &(r&   c                0   \        V\        4      '       g   \        R 4      hVR,          R8w  d   \        RVR,          4      h\	        VP                  V4      4      p\        V4      V P                  8w  d    \        V P                  \        V4      4      hV# r   rw   rx   	r   r   r;   r   r   ra   r9   r(   r   r!   rI   Zopr   r^   r#   _get_keyZ_AesKw._get_key  u    #s##677u:#E3u:66cnnR01B<4<<'%dllHRLAA	r&   c                s    V P                  VR 4      pV'       g   \        V4      p\        WS\        4       4      pRVRV/# )r   r   r   )r   r=   r   r   r   r   r#   r   Z_AesKw.wrap  s=    ]]3	*g&C"?#45sD"%%r&   c                s    V P                  VR 4      p\        WS\        4       4      p\        V4      V8w  d   \	        V\        V4      4      hV# )r   )r   r   r   r9   r   r   r   r#   r   Z_AesKw.unwrap  sC    ]]3	*R_%67C=G#%gx}==
r&   rZ   r+   r,   r-   r.   r(   rY   r   r   r   r0   r1   r2   r4   r#   r   r     s#     G)& r&   r   c                   *    ] tR tRtRtRt^tRtRtRt	R# )_A128KWi  A128KWzAES Key Wrap using 128-bit keyr|   r   r   Nr   r   r&   r#   r   r         D2KG$Mr&   r   c                   *    ] tR tRtRtRt^tRtRtRt	R# )_A192KWi  A192KWzAES Key Wrap using 192-bit keyr|   r   r   Nr   r   r&   r#   r   r     r   r&   r   c                   *    ] tR tRtRtRtRtRtRtRt	R# )	_A256KWi  A256KWzAES Key Wrap using 256-bit keyr{   r|   r   r   Nr   r   r&   r#   r   r     r   r&   r   c                   r   )	_AesGcmKwi  Nc                r   rE   r   r    r"   r#   rY   Z_AesGcmKw.__init__  r   r&   c                r   r   r   r   r^   r#   r   Z_AesGcmKw._get_key  r   r&   c                s   V P                  VR 4      pV'       g   \        V4      p\        ^`4      p\        \        P                  ! V4      \
        P                  ! V4      V P                  R7      pVP                  4       pVP                  V4      VP                  4       ,           p	VP                  p
RVRV	RR\        V4      R\        V
4      //# )r   rZ   r   r   headerivtag)r   r=   r   r   AESr   GCMrU   	encryptorr\   rb   r   r   )r!   rI   r   r   r   r   r   cipherr   r   r      &&&&&      r#   r   Z_AesGcmKw.wrap  s    ]]3	*g&C_
r*EIIbM $.$$&	c"Y%7%7%99mmsD"4!1"!5 "23"79: 	:r&   c                s   V P                  VR 4      pRV9  d   \        R4      h\        VR,          4      pRV9  d   \        R4      h\        VR,          4      p\        \        P
                  ! V4      \        P                  ! Wg4      V P                  R7      pVP                  4       p	V	P                  V4      V	P                  4       ,           p
\        V
4      V8w  d   \        V\        V
4      4      hV
# )r   r   z&Invalid Header, missing "iv" parameterr   z'Invalid Header, missing "tag" parameterrZ   )r   r;   r   r   r   r   r   r   rU   	decryptorr\   rb   r9   r   )r!   rI   r   r   r   r   r   r   r   r   r   r   r#   r   Z_AesGcmKw.unwrap  s    ]]3	*wEFFgdm,FGGwu~.
r*EIIb,> $.$$&	r"Y%7%7%99C=G#%gx}==
r&   rZ   r   r2   r4   r#   r   r     s#     G):  r&   r   c                   r   )
_A128GcmKwi!  	A128GCMKWz+Key wrapping with AES GCM using 128-bit keyr|   r   r   Nr   r   r&   r#   r   r   !      D?KG$Mr&   r   c                   r   )
_A192GcmKwi*  	A192GCMKWz+Key wrapping with AES GCM using 192-bit keyr|   r   r   Nr   r   r&   r#   r   r   *  r   r&   r   c                   r   )	
_A256GcmKwi3  	A256GCMKWz+Key wrapping with AES GCM using 256-bit keyr{   r|   r   r   Nr   r   r&   r#   r  r  3  r   r&   r  c                   sD   a  ] tR tRt o RtRtRtR tR tR t	R t
RtV tR# )_Pbes2HsAesKwi<  Nc                V    \        4       V n        ^\        ^\        R\        /V n        R# i   r{   Nr   rU   r   r   r   aeskwmapr    r"   r#   rY   Z_Pbes2HsAesKw.__init__B       &(gsGS'Br&   c                s4   \        V\        4      '       g,   \        V\        4      '       d   TpM+VP                  R 4      pM\	        VP                  4       4      p\        V P                  P                  R 4      4      R,           V,           pV P                  R8X  d   \        P                  ! 4       pMYV P                  R8X  d   \        P                  ! 4       pM2V P                  R8X  d   \        P                  ! 4       pM\        R4      h\        V\        V P                  4      WdV P                   R7      pVP#                  V4      p	\%        V	4      V P                  8w  d    \'        V P                  \)        V	4      4      h\        RR\+        V	4      R	7      # )
utf8s    r{   r   r   zUnknown Hash Size)	algorithmlengthsaltZ
iterationsrU   rx   encrw   usek)r   r   bytesencoder   ra   r$   hashsizer   r   r   r   r;   r   r:   r(   rU   deriver9   r   r7   r   )
r!   r|   rI   p2sp2cZplainr  ZhashalgZkdfr   s
   &&&&&     r#   r   Z_Pbes2HsAesKw._get_keyF  s   #s###u%%

6*$S^^%56ETYY%%f-.83>==CmmoG]]c!mmoG]]c!mmoG01178DLL3I"DLLJZZB<4<<'%dllCG<<u%+;B+?@@r&   c                s   / pR V9   d/   \        VR ,          4      p\        V4      ^8  d   \        R4      hM\        ^4      p\	        V4      VR &   RV9   d   VR,          pMRpWuR&   V P                  VR,          WV4      pV P                  V P                  ,          ! 4       p	V	P                  WW44      p
\        V4      ^ 8  d   WZR&   V
# )r  z'Invalid Salt, must be 8 or more octectsr  i    r|   r   )	r   r7   r;   r=   r   r   r  r(   r   )r!   rI   r   r   r   Z
ret_headerr  r  kekaeskwretr   r#   r   Z_Pbes2HsAesKw.wrapb  s    
G"75>2C3x!| !JKK  c"C 0 5JuG%.CC #ummGENCc:dll+-jjs4z?Q&M
r&   c                s   R V9  d   \        R4      hRV9  d   \        R4      h\        VR ,          4      pVR,          pV P                  VR,          WV4      pV P                  V P                  ,          ! 4       pVP                  WrW44      # )r  z'Invalid Header, missing "p2s" parameterr  z'Invalid Header, missing "p2c" parameterr|   )r;   r   r   r  r(   r   )	r!   rI   r   r   r   r  r  r  r  s	   &&&&&    r#   r   Z_Pbes2HsAesKw.unwrapx  s}    FGGFGGwu~.enmmGENCc:dll+-||C"66r&   r  rU   )r+   r,   r-   r.   r$   r(   r  rY   r   r   r   r0   r1   r2   r4   r#   r  r  <  s/     DGHCA8,
7 
7r&   r  c                   s.    ] tR tRtRtRt^tRtRtRt	Rt
R# )	_Pbes2Hs256A128Kwi  PBES2-HS256+A128KWz-PBES2 with HMAC SHA-256 and "A128KW" wrappingr|   r   r{   r   Nr+   r,   r-   r.   r$   r'   r(   r)   r*   r  r0   r   r&   r#   r  r    !    DAKG$MHr&   r  c                   s.    ] tR tRtRtRt^tRtRtRt	Rt
R# )	_Pbes2Hs384A192Kwi  PBES2-HS384+A192KWz-PBES2 with HMAC SHA-384 and "A192KW" wrappingr|   r   r   r   Nr  r   r&   r#   r   r     r  r&   r   c                   s.    ] tR tRtRtRtRtRtRtRt	Rt
R	# )
_Pbes2Hs512A256Kwi  PBES2-HS512+A256KWz-PBES2 with HMAC SHA-512 and "A256KW" wrappingr{   r|   r   r   r   Nr  r   r&   r#   r"  r"    r  r&   r"  c                   sF   a  ] tR tRt o RtRt^tRtRtR t	R t
R tR	tV tR
# )_Directi  dirz$Direct use of a shared symmetric keyr|   r   c                r   )r   rw   rx   Nr   r   rX   r#   r   Z_Direct._check_key  r   r&   c                s    V P                  V4       V'       d   VR 3# \        VP                  R4      4      p\        V4      V8w  d   \	        V\        V4      4      hRV/# )Nr   r   )r   r   ra   r9   r   )r!   rI   r   r   r   r     &&&&& r#   r   Z_Direct.wrap  sU    ;S^^I67A;'!$Whqk::qzr&   c                s    V P                  V4       VR 8w  d   \        R4      h\        VP                  R4      4      p\	        V4      V8w  d   \        V\	        V4      4      hV# )r&   zInvalid Encryption Key.r   )r   r;   r   ra   r9   r   )r!   rI   r   r   r   r   r&  r#   r   Z_Direct.unwrap  sV    9677s~~i89C=G#%gx}==
r&   r   N)r+   r,   r-   r.   r$   r'   r(   r)   r*   r   r   r   r0   r1   r2   r4   r#   r$  r$    s3     D8KG$M7 r&   r$  c                   sR   a  ] tR tRt o RtRtRtRtRtR t	R t
R	 tR
 tR tRtV tR# )_EcdhEsi  ECDH-ESzECDH-ES using Concat KDFr|   r   Nc                r  r  r  r    r"   r#   rY   Z_EcdhEs.__init__  r	  r&   c                s    \        V\        4      '       g   \        R 4      hVR,          R9  d   \        RVR,          4      hVR,          R8X  d$   VR,          R9  d   \        RVR,          4      hR# R# )	r   rw   OKPz	EC or OKPcrvzX25519 or X448N)ZECr)  )ZX25519ZX448r   r   rX   r#   r   Z_EcdhEs._check_key  sr    #s##677u:]*#KU<<u:5z!33'(8(+E
4 4 4 r&   c                s"   \         P                  ! R \        V4      4      pV\        VP	                  R4      4      ,          pRV9   d   \        VR,          4      MRpV\         P                  ! R \        V4      4      ,          pWg,          pRV9   d   \        VR,          4      MRpV\         P                  ! R \        V4      4      ,          pWh,          pV\         P                  ! R V4      ,          p\        V\        P                  4      '       d'   VP                  \        P                  ! 4       V4      p	MVP                  V4      p	\        \        P                  ! 4       \        V4      VV P                  R7      p
V
P!                  V	4      # )z>Ir
  apur&   apv)r  r  	otherinforU   )structZpackr7   r  r  r   r   r	   ZEllipticCurvePrivateKeyZexchangeZECDHr   r   r   r:   rU   r  )r!   ZprivkeyZpubkeyr|   r   r   r-  r+  r,  Z
shared_keyZckdfs   &&&&&&     r#   _deriveZ_EcdhEs._derive  s1    KKc#h/	U3::f-..	 3872Bwu~.V[[s3x00		 3872Bwu~.V[[s3x00		 	V[[w//	
 gr99:: ))"'')V<J !))&1Jv}}$,W$5'0%)\\3 {{:&&r&   c                sL   V P                  V4       V P                  pV P                  f   Ve   \        R4      hVR,          pTpM	VR,          p\        P                  ! VR,          VR,          R7      pV P                  VP                  R4      VP                  R4      WeV4      pV P                  f   R	V/p	MKV P                  V P                  ,          ! 4       p
\        R
R\        V4      R7      pV
P                  WW44      p	R\        VP                  4       4      /V	R&   V	# )Nz"ECDH-ES cannot use an existing CEKr  r|   rw   r*  )rw   r*  r   r   r   rx   r  epkr   )r   r(   r   r   Zgenerater/  ra   r  r   r   r   Zexport_public)r!   rI   r   r   r   dk_sizer|   r0  dkr  r  r     &&&&&       r#   r   Z_EcdhEs.wrap  s    ,,<<)*NOO%.CG%.Clls5zs5z:\\#..5..31 <<"+CMM$,,/1E%U.>r.BCC**S38CC,=,=,? @AH
r&   c                s   R V9  d   \        R4      hV P                  V4       V P                  pV P                  f   VR,          pTpM	VR,          p\        R/ VR ,          B pV P	                  VP                  R4      VP                  R4      WeV4      pV P                  f   V# V P                  V P                  ,          ! 4       p	\        RR\        V4      R7      p
V	P                  WW44      pV# )	r0  z'Invalid Header, missing "epk" parameterr  r|   r   r   rx   r  r   )	r;   r   r(   r   r/  ra   r  r   r   )r!   rI   r   r   r   r1  r|   r0  r2  r  r  r   r3  r#   r   Z_EcdhEs.unwrap  s    FGG,,<<%.CG%.C#GEN#\\#..5..31 <<IMM$,,/1E%U.>r.BCC,,sR9CJr&   r  )r+   r,   r-   r.   r$   r'   r)   r*   r(   rY   r   r/  r   r   r0   r1   r2   r4   r#   r'  r'    s?     D,K$MGC4!'F4 r&   r'  c                   r   )_EcdhEsAes128Kwi/  ECDH-ES+A128KWz.ECDH-ES using Concat KDF and "A128KW" wrappingr|   r   r   Nr   r   r&   r#   r4  r4  /      DBKG$Mr&   r4  c                   r   )_EcdhEsAes192Kwi8  ECDH-ES+A192KWz.ECDH-ES using Concat KDF and "A192KW" wrappingr|   r   r   Nr   r   r&   r#   r7  r7  8  r6  r&   r7  c                   r   )	_EcdhEsAes256KwiA  ECDH-ES+A256KWz.ECDH-ES using Concat KDF and "A256KW" wrappingr{   r|   r   r   Nr   r   r&   r#   r9  r9  A  r6  r&   r9  c                   s@   a  ] tR tRt o RtRtRtRtRtR t	R t
R	tV tR# )
_EdDsaiJ  EdDSAz'EdDSA using Ed25519 or Ed448 algorithmsr|   r}   Nc                sn    VR ,          R9   d#   VP                  R4      pVP                  V4      # \        h)r*  rL   ZEd25519ZEd448)ra   rL   rG   rh   r^   r#   rL   Z_EdDsa.signR  s2    u:-->>&)D99W%%!!r&   c                sn    VR ,          R9   d#   VP                  R4      pVP                  W24      # \        h)r*  rQ   r=  )ra   rQ   rG   ri   rk   r#   rQ   Z_EdDsa.verifyX  s2    u:-->>(+D;;y22!!r&   r   )r+   r,   r-   r.   r$   r'   r)   r*   r(   rL   rQ   r0   r1   r2   r4   r#   r;  r;  J  s.     D;K$MG"" "r&   r;  c                   r   )_RawJWEi_  c                rD   rE   rF   )r!   r  amrP   r#   r   Z_RawJWE.encrypta  rM   r&   c                rD   rE   rF   )r!   r  r?  r   r?   ts   &&&&&&r#   r   Z_RawJWE.decryptd  rM   r&   r   N)r+   r,   r-   r.   r   r   r0   r1   r2   r4   r#   r>  r>  _  rS   r&   r>  c                   r   )_AesCbcHmacSha2ih  Nc                s    \        4       V n        Wn        \        P                  P
                  V n        V P                  ^,          V n        R# )i   N)	r   rU   rV   r   r   Z
block_size	blocksizer(   wrap_key_sizerW   rX   r#   rY   Z_AesCbcHmacSha2.__init__l  s3    &(#22!\\A-r&   c                s\   \        \        V4      ^@4      p\        P                  ! WP                  V P
                  R7      pVP                  V4       VP                  V4       VP                  V4       VP                  V4       VP                  4       pVR\        V P                  4       # )i@   rZ   N)
r@   r9   r   r[   rV   rU   r\   rb   r:   r(   )r!   r  r?  r   r?   Zalr]   r@  s   &&&&&   r#   _macZ_AesCbcHmacSha2._macr  sx    !b)IIadll;				JJL((4<<())r&   c                s6   VR\        V P                  4       pV\        V P                  4      R p\        V P                  4      p\	        \
        P                  ! V4      \        P                  ! V4      V P                  R7      pVP                  4       p\        V P                  4      P                  4       p	V	P                  V4      V	P                  4       ,           p
VP                  V
4      VP                  4       ,           pV P                  WBWk4      pWkV3# )zEncrypt according to the selected encryption and hashing
functions.

:param k: Encryption key (optional)
:param a: Additional Authentication Data
:param m: Plaintext

Returns a dictionary with the computed data.
NrZ   )r:   r(   r=   rC  r   r   r   r   CBCrU   r   r   padderr\   rb   rE  )r!   r  r?  r@  hkeyZekeyr   r   r   rG  Zpadded_datar?   rA  s   &&&&         r#   r   Z_AesCbcHmacSha2.encrypt}  s     ((4<<()$,,'() (
t,eiim $.$$&	t~~&--/mmA&)::[)I,>,>,@@ IIdr%qzr&   c           	     sN   VR\        V P                  4       pV\        V P                  4      R p\        P                  ! WPP	                  WbW44      4      '       g   \        R4      h\        \        P                  ! V4      \        P                  ! V4      V P                  R7      pVP                  4       p	V	P                  V4      V	P                  4       ,           p
\        V P                   4      P#                  4       pVP                  V
4      VP                  4       ,           # )a	  Decrypt according to the selected encryption and hashing
functions.
:param k: Encryption key (optional)
:param a: Additional Authenticated Data
:param iv: Initialization Vector
:param e: Ciphertext
:param t: Authentication Tag

Returns plaintext or raises an error
NzFailed to verify MACrZ   )r:   r(   r   Zbytes_eqrE  r   r   r   r   r   rF  rU   r   r\   rb   r   rC  unpadder)r!   r  r?  r   r?   rA  rH  Zdkeyr   r   ZdrI  s   &&&&&&      r#   r   Z_AesCbcHmacSha2.decrypt  s     ((4<<()$,,'() %%a4B)BCC"#9:: 
t,eiim $.$$&	Q)"4"4"66(113q!H$5$5$777r&   )rU   rC  rV   rD  )r+   r,   r-   r.   r(   rY   rE  r   r   r0   r1   r2   r4   r#   rB  rB  h  s#     G.*68 8r&   rB  c                   sF   a a ] tR tRt oRtRt^tRtRtV 3R lt	Rt
VtV ;t# )_A128CbcHs256i  A128CBC-HS256z&AES_128_CBC_HMAC_SHA_256 authenticatedr  c                r~   rE   )r   rJ  rY   r   r   r   r   r#   rY   Z_A128CbcHs256.__init__      mT+FMMO<r&   r   r   r   r   r#   rJ  rJ    )     D:KG$M= =r&   rJ  c                   sF   a a ] tR tRt oRtRt^tRtRtV 3R lt	Rt
VtV ;t# )_A192CbcHs384i  A192CBC-HS384z&AES_192_CBC_HMAC_SHA_384 authenticatedr  c                r~   rE   )r   rN  rY   r   r   r   r   r#   rY   Z_A192CbcHs384.__init__  rL  r&   r   r   r   r   r#   rN  rN    rM  r&   rN  c                   sF   a a ] tR tRt oRtRtRtRtRtV 3R lt	Rt
VtV ;t# )_A256CbcHs512i  A256CBC-HS512z&AES_256_CBC_HMAC_SHA_512 authenticatedr{   r  c                r~   rE   )r   rP  rY   r   r   r   r   r#   rY   Z_A256CbcHs512.__init__  rL  r&   r   r   r   r   r#   rP  rP    rM  r&   rP  c                   s6   a  ] tR tRt o RtR tR tR tRtV t	R# )_AesGcmi  Nc                sF    \        4       V n        V P                  V n        R # rE   )r   rU   r(   rD  r    r"   r#   rY   Z_AesGcm.__init__  s    &(!\\r&   c                sB   \        ^`4      p\        \        P                  ! V4      \        P
                  ! V4      V P                  R7      pVP                  4       pVP                  V4       VP                  V4      VP                  4       ,           pWGVP                  3# )zEncrypt accoriding to the selected encryption and hashing
functions.

:param k: Encryption key (optional)
:param a: Additional Authentication Data
:param m: Plaintext

Returns a dictionary with the computed data.
rZ   )r=   r   r   r   r   r   rU   r   authenticate_additional_datar\   rb   r   )r!   r  r?  r@  r   r   r   r?   rt   r#   r   Z_AesGcm.encrypt  s|     _
q)599R= $.$$&	..q1Q)"4"4"66y}}%%r&   c                s   \        \        P                  ! V4      \        P                  ! W54      V P
                  R7      pVP                  4       pVP                  V4       VP                  V4      VP                  4       ,           # )a
  Decrypt accoriding to the selected encryption and hashing
functions.
:param k: Encryption key (optional)
:param a: Additional Authenticated Data
:param iv: Initialization Vector
:param e: Ciphertext
:param t: Authentication Tag

Returns plaintext or raises an error
rZ   )
r   r   r   r   r   rU   r   rS  r\   rb   )r!   r  r?  r   r?   rA  r   r   s   &&&&&&  r#   r   Z_AesGcm.decrypt  sf     
q)599R+; $.$$&	..q1"Y%7%7%999r&   )rU   rD  )
r+   r,   r-   r.   r(   rY   r   r   r0   r1   r2   r4   r#   rR  rR    s     G*
&&: :r&   rR  c                   s*    ] tR tRtRtRt^tRtRtRt	R# )_A128Gcmi  A128GCMzAES GCM using 128-bit keyr  r   Nr   r   r&   r#   rT  rT        D-KG$Mr&   rT  c                   s*    ] tR tRtRtRt^tRtRtRt	R# )_A192Gcmi  A192GCMzAES GCM using 192-bit keyr  r   Nr   r   r&   r#   rW  rW    rV  r&   rW  c                   s*    ] tR tRtRtRtRtRtRtRt	R# )_A256Gcmi  A256GCMzAES GCM using 256-bit keyr{   r  r   Nr   r   r&   r#   rY  rY    rV  r&   rY  c            	       sP  a  ] tR tRt o Rt/ R]bR]bR]bR]bR]	bR]
bR	]bR
]bR]bR]bR]bR]bR]bR]bR]bR]bR]b/ R]bR]bR]bR]bR]bR]bR]bR]bR]bR]bR] bR]!bR ]"bR!]#bR"]$bR#]%bR$]&bCR%]'R&](R'])R(]*/Ct+],R/R* l4       t-],R+ 4       t.],R, 4       t/],R- 4       t0R.t1V t2R)# )0JWAi   zKJWA Signing Algorithms.

This class provides access to all JWA algorithms.
rz   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r%  r(  r5  r8  r:  r<  r   r  r  r  r!  r#  rK  rO  rQ  rU  rX  rZ  Nc                sl    V P                   V,          pVe   VP                  V8w  d   \        hV! 4       # rE   )algorithms_registryr*   KeyError)clsr$   r  r|   r^   r#   instantiate_algZJWA.instantiate_algO  s0    %%d+?s00C7Nur&   c                n     V P                  VR R7      #   \         d    \        RT,          4      Rhi ; i)r}   r  z(%s is not a valid Signing algorithm nameNr_  r]  r   r^  r$   rX   r#   signing_algZJWA.signing_algV  sM    	@&&t&77 	@% '.04'5 6;?@	@    4c                r`  )r   ra  z/%s is not a valid Key Management algorithm nameNrb  rc  rX   r#   keymgmt_algZJWA.keymgmt_alg^  N    	J&&t&77 	J% '8:>'? @EIJ	Jre  c                r`  )r  ra  z+%s is not a valid Encryption algorithm nameNrb  rc  rX   r#   encryption_algZJWA.encryption_algf  rg  re  r   rE   )3r+   r,   r-   r.   Z__doc__ry   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r$  r'  r4  r7  r9  r;  r   r   r  r  r   r"  rJ  rN  rP  rT  rW  rY  r\  Zclassmethodr_  rd  rf  rh  r0   r1   r2   r4   r#   r[  r[     s#    
''' 	' 		'
 	' 	' 	' 	'' 	' 	' 	' 	' 	' 	' 	&'  	H!'" 	#'$ 	'%'& 	'''( 	')'* 	w+', 	7-'. 	//'0 	/1'2 	/3'4 	5'6 	Z7'8 	Z9': 	Z;'< 	/='> 	/?'@ 	/A'B 	C'D 	E'F 	888M'R   @ @ J J J Jr&   r[  )gr<   r.  Zabcr    r   Zbinasciir   r   Zcryptography.exceptionsr   Zcryptography.hazmat.backendsr   Zcryptography.hazmat.primitivesr   r   r   Z)cryptography.hazmat.primitives.asymmetricr	   r
   r   rq   Z&cryptography.hazmat.primitives.ciphersr   r   r   Z,cryptography.hazmat.primitives.kdf.concatkdfr   Z)cryptography.hazmat.primitives.kdf.pbkdf2r   Z&cryptography.hazmat.primitives.keywrapr   r   Z&cryptography.hazmat.primitives.paddingr   Zjwcrypto.commonr   r   r   r   r   r   r   r   Zjwcrypto.jwkr   r   r9   r:   r=   r@   rB   rC   rT   re   rl   ru   ry   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r  r  r  r   r"  r$  r'  r4  r7  r9  r;  r>  rB  rJ  rN  rP  rR  rT  rW  rY  r[  r   r&   r#   <module>ri     sD   
  ' ' 4 8 F F 8 = G L L F @ O 8 . / / - / > ' 
)W )8#0" "w ,Ag ACW C2Nw N	6X| 	6	6X| 	6	6X| 	6	JWl 	J	JWl 	J	JWl 	J	?V\ 	?	Dfl 	D	?V\ 	?	?V\ 	?=Wl ==Wl ==Wl =Hl " "; :T< :/t\ /1$ 1 [  Ffl fl fl 1 1hL L L F7K F7R| | | k< Bhk< hVg g g "Wl "*" "H8g H8V	=O\ 	=	=O\ 	=	=O\ 	=+:g +:\w w w LJ LJr&   