+ :i3cs^RIHt^RIt^RIHtHt^RIHtHtH t ^RI H t ^RI H t ^RIHt^RIHt^R IHtHtHt^R IHtHtHtHt^R IHtHtHtHtH t H!t!^R I"H#t#H$t$H%t%H&t&H't'H(t(H)t)H*t*]PV!],4t-^t.^t/^t0^t1^t2^t3^ft4R t5Rt6Rt7]!RR]44t8Rt9]!RR]44t:RRlt;RRRllt<!RR4t=R#)) annotationsN)IntEnumunique)MappingSequencecast)x509)default_backend) serialization)ec)Cipher algorithmsmodes)BadResponseErrorTlvVersion int2bytes)AIDSW ApduError ScpProcessorSmartCardConnectionSmartCardProtocol)INS_EXTERNAL_AUTHENTICATEINS_INITIALIZE_UPDATEINS_INTERNAL_AUTHENTICATEINS_PERFORM_SECURITY_OPERATIONKeyRef ScpKeyParamsScpKid StaticKeysi3i4i!cs&]tRt^1t^t^t^t^tRtR#)KeyTypeN) __name__ __module__ __qualname____firstlineno__AESECC_PUBLIC_KEYECC_PRIVATE_KEYECC_KEY_PARAMS__static_attributes__r!;/usr/lib/python3.14/site-packages/yubikit/securitydomain.pyr r 1s CNONr+r csZ]tRt^rN&&r,__init__ZSecurityDomainSession.__init__gsN)*5  S../ 1a 01 9:r+cr.)r/ key_paramsrr1Noner!r2r3r,r4rOns++|++r+c s<VPPV4R#)zInitialize SCP and authenticate the session. SCP11b does not authenticate the OCE, and will not allow the usage of commands which require authentication of the OCE. N)rPZinit_scp)r>rUrSr, authenticateZ"SecurityDomainSession.authenticatens z*r+cs$V^8dQhRRRRRR/#)r/tagrCrHrDr1r!r2r3r,r4rOvs&TTCTuTuTr+c sdVPP^\V^, V^,V4#)z#Read data from the security domain.)rP send_apdu INS_GET_DATA)r>rXrH&&&r,get_dataZSecurityDomainSession.get_datavs'}}&&q,q#*dSSr+cr;)r/r1z"Mapping[KeyRef, Mapping[int, int]]r!r2r3r,r4rOzs%Gr+c s/p\P!VP\44FPp\P!^V4p\ \ VR,VR,44V\VR,4&KR V#)z0Get information about the currently loaded keys.:r/Nr/:Nr/:Nr/N)r parse_listr\TAG_KEY_INFORMATIONunpackZdictZzipr)r>keysZdrHs& r,get_key_informationZ)SecurityDomainSession.get_key_informationzse .A BCA::dA&D%)#d4j$t**E%FDR! "D r+cr;)r/r1rDr!r2r3r,r4rOsJJ5Jr+c sV\P!^sVP\44#)zGet information about the card.)rr`r\TAG_CARD_RECOGNITION_DATAr=r?r,get_card_recognition_dataZ/SecurityDomainSession.get_card_recognition_dataszz$ .G HIIr+cs$V^8dQhRRRRRR/#)r/klocboolklccr1zMapping[KeyRef, bytes]r!r2r3r,r4rOs$   (,  r+c s.V'g V'gR;r\PRV RV 24RpV\3V\33F'wrEV'gKW0P V4, pK) \P!V4p\^\V4^4Uu/uF6p\Wx^,,P4Wx,PbK8 up# \ d,pTP \P8wdhRp?KRp?ii;iuupi)zGet a list of the CA issuer Subject Key Identifiers for keys. Setting one of kloc or klcc to True will cause only those CAs to be returned. By default, this will get both KLOC and KLCC CAs. :param kloc: Get KLOC CAs. :param klcc: Get KLCC CAs. TzGetting CA identifiers KLOC=z, KLCC=r+N)rQrRTAG_CA_KLOC_IDENTIFIERSTAG_CA_KLCC_IDENTIFIERSr\rswrREFERENCE_DATA_NOT_FOUNDrr^rangelenrrB) r>rergrHZfetchrXeZtlvsZis &&& r,get_supported_ca_identifiersZ2SecurityDomainSession.get_supported_ca_identifierssD D 3D6GH* + * + JEuMM#..D  ~~d#>CAs4yRS>T >TF4A;$$ %tw}} 4>T  !ttr:::; sCr0Zcertrnr9r,get_certificate_bundleZ,SecurityDomainSession.get_certificate_bundles  6se<=  NNMM"7T3tS>9RSD..t4   ttr222  s6ABA<9B<B B8 B3,B82B33B8cr;)r/r1rVr!r2r3r,r4rOs$&$&t$&r+c  s\PR4RpVP4P4FpVP^8Xd\ ^^4p\ pMIVPR9dK:VPR9d\pMVP^8Xd\pM\p\^A4F6pVPP^W2PVPV4K8 K \P)R4R# \dcpTP\ P"\ P$39d Rp?EKTP\ P&8XdRp?KhRp?ii;i)zPerform a factory reset of the Security Domain. This will remove all keys and associated data, as well as restore the default SCP03 static keys, and generate a new (attestable) SCP11b key. zResetting all SCP keysNzSCP keys resets)r/r])ii)rQrRrbrakidrrrrrrlrPrYkvnrrjrZAUTH_METHOD_BLOCKEDZ SECURITY_CONDITION_NOT_SATISFIEDZINCORRECT_PARAMETERSinfo)r>rHr0ZinsZ_rns& r,resetZSecurityDomainSession.resets  -.++-224Cww$Ql+L(L(/D/42Y MM++D#wwN56  $%!tt..;; !8!88 s$52D E3/E.E.-E..E3cr.)r/rHrDr1rVr!r2r3r,r4rOsBBuBBr+c sLVPP^\^^V4R#)z@Stores data in the security domain. Requires OCE verification. N)rPrYINS_STORE_DATA)r>rHrSr, store_dataZ SecurityDomainSession.store_datas >4DAr+c$V^8dQhRRRRRR/#)r/r0r certificatesrpr1rVr!r2r3r,r4rOs$111)C1 1r+c  s\PRV 24VP\^\^V44\\RP RV444,4\P R4R#)zStore the certificate chain for the given key. Requires OCE verification. Certificates should be in order, with the leaf certificate last. zStoring certificate bundle for r+c3sr"TF-qP\PP4xK/ R#5ir<) public_bytesr EncodingZDER).0ZcrFr, ZASecurityDomainSession.store_certificate_bundle..s)HT1NN=#9#9#=#=>> s57zCertificate bundle storedN)rQrRrxrrqjoinru)r>r0rzr[r,store_certificate_bundleZ.SecurityDomainSession.store_certificate_bundlesl  6se<=  c$n %%HT    /0r+cry)r/r0rserialsz Sequence[int]r1rVr!r2r3r,r4rOs! / /6 /M /d /r+c  s\PRV 24VP\^\^V44\^pRP RV444,4\P R4R#)zStore which certificate serial numbers that can be used for a given key. Requires OCE verification. If no allowlist is stored, any certificate signed by the CA can be used. zStoring serial allowlist for r+c3s8"TFp\V4xK R#5ir<)rG)r}srFr,r~Z8SecurityDomainSession.store_allowlist..s ?w!1wszSerial allowlist storedN)rQrRrxrrru)r>r0rr[r,store_allowlistZ%SecurityDomainSession.store_allowlistsb  4SE:;  c$n %$ ?w ??@ A   -.r+cry)r/r0rskirDr1rVr!r2r3r,r4rO s! , ,6 , ,$ ,r+c  s\PRV RVP4 24VP\P \P \P39pTP\^\^V'dRMR4\^BV4,\^V4,44\PR4R#)z^Store the SKI (Subject Key Identifier) for the CA of a given key. Requires OCE verification. zStoring CA issuer SKI for z: srEzCA issuer SKI storedN) rQrRZhexrsrZSCP11aZSCP11bZSCP11crxrru)r>r0rrgrKr,store_ca_issuerZ%SecurityDomainSession.store_ca_issuer s  1#b DEww6==&--GG  D4%U3c$nDs4QT~U   *+r+cs(V^8dQhRRRRRRRR/#)r/rsrCrt delete_lastrfr1rVr!r2r3r,r4rOs)$$c$C$$$SW$r+c sV'gV'g \R4hVR 9dV'd^pM \R4h\PRT;'gR RT;'gR 24RpV'dV\^\ V.44, pV'dV\^\ V.44, pVP P ^\^\V4V4\PR4R#) zDelete one (or more) keys. Requires OCE verification. All keys matching the given KID and/or KVN will be deleted. To delete the final key you must set delete_last = True. z&Must specify at least one of kid, kvn.z%SCP03 keys can only be deleted by KVNzDeleting keys with KID=ZANYz, KVN=r+z Keys deletedN)ir/r]) r8rQrRrrDrPrY INS_DELETErCru)r>rsrtrrHs&&&& r, delete_keyZ SecurityDomainSession.delete_keys3EF F )  !HII .s||enF3<<%.QR  CeSEl+ +D  CeSEl+ +D j!S5EtL N#r+c(V^8dQhRRRRRRRR/#) r/r0rr6r- replace_kvnrCr1zec.EllipticCurvePublicKeyr!r2r3r,r4rO2s2YYY"'YHKY "Yr+c s\PRV 2V'dRV 2MR,4\VP.4\ \ P \V.44,pVPP^\W1PV4p\P!\ PV4p\PR4\PP!VP"V4#)zcGenerate a new SCP11 key. Requires OCE verification. Use replace_kvn to replace an existing key. zGenerating new key for z, replacing KVN=ZzNew key generated)rQrRrDrtrr r)rPrYINS_GENERATE_KEYrsr`r'rur EllipticCurvePublicKeyZfrom_encoded_pointr@)r>r0r6rrHrespZ encoded_points&&&& r,generate_ec_keyZ%SecurityDomainSession.generate_ec_key2s  %cU +3>!+/B H cggY#g&<&VPA\BPDPF\BPHPJ44, pM \MR4hV\'\(PN\\PPSV4.44R,, pVPPU^\VW8V4p W8wd \YR 4h\P[R 4R #) zImport an SCP key. Requires OCE verification. The value of the sk argument should match the SCP type as defined by the KID. Use replace_kvn to replace an existing key. zImporting key into z of type zMust be authenticated!zNo session DEK key availablez"New DEK must be set in static keys:Nr]NzUnsupported key typerEzIncorrect key check valuez Key importedN).rQrRZtyperPZ _processorZ isinstancerr8rDrtZstateZ_keysZkey_dekrsrrrrL_DEFAULT_KCV_IVrr r&rmr ZEllipticCurvePrivateKeyZkey_sizerZprivate_numbersZ private_valuer(rr'r{r r|ZX962Z PublicFormatZUncompressedPointZ TypeErrorr)r-r:rY INS_PUT_KEYrru)r>r0rrZ processorrHZexpectedZdekZp2ZkZkcvZnrrs&&&& r,put_keyZSecurityDomainSession.put_keyGsL  *3%yb CDMM,, )\2256 6cggYoo##++ WW b* % % !?@@::: !EFF $JB(5/2."1o6r:GKKc)=>CzARRUXXX/ "b8899$%CDD[[1_*b002@@!DG33\#5IJJB 9 9::**OO%..33%22DD 677 C..ur7J6K0LMPUU UD}}&&t[+4P  "#>? ? N#r+)rPN)r+)FF)rrF)r)r"r#r$r%Z__doc__rTrWr\rbrdrorrrvrxrrrrr-rArrr*r!r+r,rMrMdse);+TJ  >$$&LB1* / ,$6+0//aY*6$6$r+rMs)s)>Z __future__rZloggingZenumrrZtypingrrrZ cryptographyrZcryptography.hazmat.backendsrZcryptography.hazmat.primitivesr Z)cryptography.hazmat.primitives.asymmetricr Z&cryptography.hazmat.primitives.ciphersr r r ZcorerrrrZcore.smartcardrrrrrrZcore.smartcard.scprrrrrrrrZ getLoggerr"rQrZrrwrrr_rcrhrirqr rr-rGrLrMr!r+r,rs" **888LL;;      8 $       g(G((.9Y$Y$r+