VhdZddlmZddlZddlZddlZddlZddlmZm Z m Z ddl m Z m Z ddlmZddlZddlmZmZddlmZdd lmZdd lmZdd lmZmZdd lmZmZm Z m!Z!m"Z"dd l#m$Z$m%Z%m&Z&ddl'm(Z(m)Z)ddl*m+Z+ddl,m-Z-m.Z.ddl/m0Z0ddl1m2Z2ddl3m4Z4m5Z5ddl6m7Z7 ddl8m9Z9m:Z:ej|ej~ejdZAddddZBe jZCe jZDGddeEZFGddeEZGGd d!eEZHGd"d#eEZIGd$d%eZJGd&d'eEZKd(ZLGd)d*ZMd,d+ZNy#e;$r ddl8mr>qr4r0r>ct|trAtd|Dr tt j d|j dS|S)a Normalize a passphrase, which may be Unicode. If the passphrase is Unicode, this follows the requirements of U{NIST 800-63B, section 5.1.1.2} for Unicode characters in memorized secrets: it applies the Normalization Process for Stabilized Strings using NFKC normalization. The passphrase is then encoded using UTF-8. @type passphrase: L{bytes} or L{unicode} or L{None} @param passphrase: The passphrase to normalize. @return: The normalized passphrase, if any. @rtype: L{bytes} or L{None} @raises PassphraseNormalizationError: if the passphrase is Unicode and cannot be normalized using the available Unicode character database. c3LK|]}tj|dk(yw)CnN) unicodedatacategory).0cs r1 z'_normalizePassphrase..s C1{##A&$.Cs"$NFKCzUTF-8) isinstancestranyr>rB normalizeencode passphrases r1_normalizePassphraserOxsM&*c" C C C/0 0$$VZ8??HHr0ceZdZdZed.dZed.dZedZedZedZ edZ ed Z ed Z ed Z ed Zed ZedZed/dZed0dZed0dZed0dZed0dZdZd1dZd2dZdZdZej8fdZd3dZdZdZ dZ!dZ"d4dZ#d Z$d!Z%e&d"d#gd"d$ggd/d%Z'd0d&Z(d.d'Z)d0d(Z*d5d)Z+d*Z,d+Z-d0d6d,Z.d-Z/y)7Keyau An object representing a key. A key can be either a public or private key. A public key can verify a signature; a private key can create or verify a signature. To generate a string that can be stored on disk, use the toString method. If you have a private key, but want the string representation of the public key, use Key.public().toString(). Nct|d5}|j|j||cdddS#1swYyxYw)a Load a key from a file. @param filename: The path to load key data from. @type type: L{str} or L{None} @param type: A string describing the format the key data is in, or L{None} to attempt detection of the type. @type passphrase: L{bytes} or L{None} @param passphrase: The passphrase the key is encrypted with, or L{None} if there is no encryption. @rtype: L{Key} @return: The loaded key. rbN)open fromStringread)clsfilenametyperNfs r1fromFilez Key.fromFiles;$(D ! >Q>>!&&(D*= > > >s !8Acjt|tr|jd}t|}||j |}|t d|t |d|jd}|t d||jjdk(r|r t d||S|||S)a Return a Key object corresponding to the string data. type is optionally the type of string, matching a _fromString_* method. Otherwise, the _guessStringType() classmethod will be used to guess a type. If the key is encrypted, passphrase is used as the decryption key. @type data: L{bytes} @param data: The key data. @type type: L{str} or L{None} @param type: A string describing the format the key data is in, or L{None} to attempt detection of the type. @type passphrase: L{bytes} or L{None} @param passphrase: The passphrase the key is encrypted with, or L{None} if there is no encryption. @rtype: L{Key} @return: The loaded key. utf-8Nzcannot guess the type of _fromString_zno _fromString method for zkey not encrypted) rHrIrLrO_guessStringTyper)getattrupper__code__ co_argcount)rWdatarYrNmethods r1rUzKey.fromStrings. dC ;;w'D)*5 <''-D < 9$BC C TZZ\N;TB > :4&AB B ?? & &! +!"566$< $ + +r0c ^tj|\}}|dk(rMtj|d\}}}|tj||j t S|dk(rftj|d\}}}} }|tj| tj|||j t S|tvrD|tjjt|tj|ddS|dk(r3|jtj|ddd } d | _| S|d vrCtj|\} }|j!| } |j#d rd | _| St%d|)a Return a public key object corresponding to this public key blob. The format of a RSA public key blob is:: string 'ssh-rsa' integer e integer n The format of a DSA public key blob is:: string 'ssh-dss' integer p integer q integer g integer y The format of ECDSA-SHA2-* public key blob is:: string 'ecdsa-sha2-[identifier]' integer x integer y identifier is the standard NIST curve name. The format of an Ed25519 public key blob is:: string 'ssh-ed25519' string a @type blob: L{bytes} @param blob: The key data. @return: A new key. @rtype: L{twisted.conch.ssh.keys.Key} @raises BadKeyError: if the key type (the first string) is unknown. ssh-rsar_ssh-dsspqgyparameter_numbers"sk-ecdsa-sha2-nistp256@openssh.comr') encodedPointcurveT) ssh-ed25519sk-ssh-ed25519@openssh.comssk-ssh-unknown blob type: )rgetNSgetMPrRSAPublicNumbers public_keyrrDSAPublicNumbersDSAParameterNumbers _curveTablerEllipticCurvePublicKeyfrom_encoded_point_fromECEncodedPoint_sk_fromEd25519Components startswithr)) rWblobkeyTyperestenrlrmrnrp keyObjectas r1_fromString_BLOBzKey._fromString_BLOBsD T*  j dA.JAq$s++Aq1<<_=NOP P j %||D!4 Aq!Q$$3+B+BQ!q+Q*_./  k !))<<(&,,tQ*?*B  ; ;//#\\$215,0I!IM  E Ell4(GAt2215I!!*- $  /y9::r0ctj|\}}|dk(r4tj|d\}}}}}} }|j||||| S|dk(r3tj|d\}} } } } }|j | | || | S|t vrt |} tj|d\}} }|t | jjdk7rtd |d |tj|\}}|j| || S|d k(r2tj|d\}}}|d d}|j||Std|)a6 Return a private key object corresponding to this private key blob. The blob formats are as follows: RSA keys:: string 'ssh-rsa' integer n integer e integer d integer u integer p integer q DSA keys:: string 'ssh-dss' integer p integer q integer g integer y integer x EC keys:: string 'ecdsa-sha2-[identifier]' string identifier string q integer privateValue identifier is the standard NIST curve name. Ed25519 keys:: string 'ssh-ed25519' string a string k || a @type blob: L{bytes} @param blob: The key data. @return: A new key. @rtype: L{twisted.conch.ssh.keys.Key} @raises BadKeyError: if * the key type (the first string) is unknown * the curve name of an ECDSA key does not match the key type rhrrdrlrmrirprnrlrmxr_asciizECDSA curve name z does not match key type )rtru privateValuervN )krx) rryrz_fromRSAComponents_fromDSAComponentsr _secToNistnamerLr)rr)rWrrrrrrurlrmrnrprru curveNamerrcombinedrs r1_fromString_PRIVATE_BLOBzKey._fromString_PRIVATE_BLOB$s\ T*  j %+\\$%: "Aq!Q1d))Aa1)B B  ""(,,tQ"7 Aq!Q4))Aa1)B B  #(E!'dA!6 Iq$Juzz'8'8'ABB!!*G5"(d!3 L$**gL+  &!' T1 5 Ax" A--a1-5 5 3G9=> >r0c|jdr|t|tSt|j d}|j |S)a Return a public key object corresponding to this OpenSSH public key string. The format of an OpenSSH public key string is:: @type data: L{bytes} @param data: The key data. @return: A new key. @rtype: L{twisted.conch.ssh.keys.Key} @raises BadKeyError: if the blob type is unknown. s ecdsa-sha2rr)rrrrsplitr)rWrers r1_fromString_PUBLIC_OPENSSHzKey._fromString_PUBLIC_OPENSSHosK ??= )*41BCD D4::<?+##D))r0c |jj}tdj|dd}|j ds t d|t dd}tj|d\}}}}tjd|dd d } | dk7r t d tj|d dd \} } } |d k7r/|s td|dvr&tj} d} t|dddz}| }nt d||dk(rRtj|\}}tjd|dd d }tj ||||z|d}nt d|t | | zd k7r t dt#| |d|t%j&||||zt)j+}|j-| |j/z}n|d k7rt d|d| }tjd|dd d }tjd|d dd }||k7rt d||fz|j1|ddS)a* Return a private key object corresponding to this OpenSSH private key string, in the "openssh-key-v1" format introduced in OpenSSH 6.5. The format of an openssh-key-v1 private key string is:: -----BEGIN OPENSSH PRIVATE KEY----- -----END OPENSSH PRIVATE KEY----- The SSH protocol string is as described in U{PROTOCOL.key}. @type data: L{bytes} @param data: The key data. @type passphrase: L{bytes} or L{None} @param passphrase: The passphrase the key is encrypted with, or L{None} if it is not encrypted. @return: A new key. @rtype: L{twisted.conch.ssh.keys.Key} @raises BadKeyError: if * a passphrase is provided for an unencrypted key * the SSH protocol encoding is incorrect @raises EncryptedKeyError: if * a passphrase is not provided for an encrypted key r0rropenssh-key-v1z"unknown OpenSSH private key formatN!LrjrzDonly OpenSSH private key files containing a single key are supportedr_none0Passphrase must be provided for an encrypted key)s aes128-ctrs aes192-ctr aes256-ctrrzunknown encryption type bcryptT)ignore_few_roundszunknown KDF type z bad paddingbackendzprivate key specifies KDF z but no cipherz#check values do not match: %d != %d)strip splitlinesrjoinrr)lenrrystructunpackr6rAESintbcryptkdfrrCTRr decryptorupdatefinalizer)rWrerNlineskeyListcipherr kdfOptionsrr_encPrivKeyListalgorithmClass blockSizekeySizeivSizesaltroundsdecKeyr privKeyListcheck1check2s r1_fromPrivateOpenSSH_v1zKey._fromPrivateOpenSSH_v1s: '')chhuQr{34!!"56BC C#1245(. Wa(@%Z MM$Ra )! , 6-  &||DHa8>1 W 'IFF!+ fQqk*a/"!$>N#i/A5!-00vhw/0 &7V+;<=')ik  $**>:Y=O=O=QQKg~!GJL)Kt[!_5a8t[1%56q9 V CvvFVVW W++KO< PRIVATE KEY----- [Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,] ------END PRIVATE KEY------ The ASN.1 structure of a RSA key is:: (0, n, e, d, p, q) The ASN.1 structure of a DSA key is:: (0, p, q, g, y, x) The ASN.1 structure of a ECDSA key is:: (ECParameters, OID, NULL) @type data: L{bytes} @param data: The key data. @type passphrase: L{bytes} or L{None} @param passphrase: The passphrase the key is encrypted with, or L{None} if it is not encrypted. @return: A new key. @rtype: L{twisted.conch.ssh.keys.Key} @raises BadKeyError: if * a passphrase is provided for an unencrypted key * the ASN.1 encoding is incorrect @raises EncryptedKeyError: if * a passphrase is not provided for an encrypted key r N)sECsRSAsDSArz&Failed to decode key (Bad Passphrase?)unknown key type )rrrr TypeErrorr6 ValueErrorr))rWrerNrkindkeys r1_fromPrivateOpenSSH_PEMzKey._fromPrivateOpenSSH_PEMsJ '')Qx3J * * L*4_=NOs8O 1$89 9 'F L!"JKK Ls A(Bc|jjddddk(r|j||S|j||S)a Return a private key object corresponding to this OpenSSH private key string. If the key is encrypted, passphrase MUST be provided. Providing a passphrase for an unencrypted key is an error. @type data: L{bytes} @param data: The key data. @type passphrase: L{bytes} or L{None} @param passphrase: The passphrase the key is encrypted with, or L{None} if it is not encrypted. @return: A new key. @rtype: L{twisted.conch.ssh.keys.Key} @raises BadKeyError: if * a passphrase is provided for an unencrypted key * the encoding is incorrect @raises EncryptedKeyError: if * a passphrase is not provided for an encrypted key rrrsOPENSSH)rrrr)rWrerNs r1_fromString_PRIVATE_OPENSSHzKey._fromString_PRIVATE_OPENSSHsO, ::< " " $Q '3 /: =--dJ? ?..tZ@ @r0ctjt|dd}|ddk(sJi}|dddD]3\}}tjtj |d||<5|dddk(r!|j |d|d|d |d  S|ddd k(r|j|d |dStd|dd)a Return a public key corresponding to this LSH public key string. The LSH public key string format is:: , ()+))> The names for a RSA (key type 'rsa-pkcs1-sha1') key are: n, e. The names for a DSA (key type 'dsa') key are: y, g, p, q. @type data: L{bytes} @param data: The key data. @return: A new key. @rtype: L{twisted.conch.ssh.keys.Key} @raises BadKeyError: if the key type is unknown rrrr public-keyNdsaygpqrprnrlrmrsa-pkcs1-sha1nerrunknown lsh key type ) rparserrrzNSrrr)rWresexpkdrs r1_fromString_PUBLIC_LSHzKey._fromString_PUBLIC_LSH3s"{{;tAbz23Aw-''' q'!"+ 8JD$||FIIdO4Q7BtH 8 71: ))T(bh"T(bh* !WQZ, ,))BtH4)A A 5d1gaj\BC Cr0cXtj|}|ddk(sJi}|dddD]3\}}tjtj|d||<5|dddk(rCt |dk(sJt ||j |d|d|d |d |d  S|ddd k(r_t |dk(sJt ||d |d kDr|d |d c|d <|d <|j|d|d|d|d |d Std|dd)a+ Return a private key corresponding to this LSH private key string. The LSH private key string format is:: , (, )+))> The names for a RSA (key type 'rsa-pkcs1-sha1') key are: n, e, d, p, q. The names for a DSA (key type 'dsa') key are: y, g, p, q, x. @type data: L{bytes} @param data: The key data. @return: A new key. @rtype: L{twisted.conch.ssh.keys.Key} @raises BadKeyError: if the key type is unknown r private-keyrrNrrrrrrxr rsa-pkcs1rrrdrr) rrrrzrrrrr)rs r1_fromString_PRIVATE_LSHzKey._fromString_PRIVATE_LSHSsp"{{4 Aw.((( q'!"+ 8JD$||FIIdO4Q7BtH 8 71: r7a< (R (<))T(bh"T(bh"T(* !WQZ< 'r7a< (R (<$x"T("%'Xr$x"4"T())T(bh"T(bh"T(*   5d1gaj\BC Cr0ctj|\}}|dk(rtj|\}}tj|\}}tj|\}}tj|\}}tj|\}}|j|||||S|dk(rtj|\}}tj|\} }tj|\} }tj|\} }tj|\}}tj|\}}|j | || ||| St d|)a Return a private key object corresponsing to the Secure Shell Key Agent v3 format. The SSH Key Agent v3 format for a RSA key is:: string 'ssh-rsa' integer e integer d integer n integer u integer p integer q The SSH Key Agent v3 format for a DSA key is:: string 'ssh-dss' integer p integer q integer g integer y integer x @type data: L{bytes} @param data: The key data. @return: A new key. @rtype: L{twisted.conch.ssh.keys.Key} @raises BadKeyError: if the key type (the first string) is unknown rirrhrrrrlrmrr)rryrzrrr)) rWrerrlrmrnrprrrrrs r1_fromString_AGENTV3zKey._fromString_AGENTV3ys9< T*  j ll4(GAtll4(GAtll4(GAtll4(GAtll4(GAt))Aa1)B B  "ll4(GAtll4(GAtll4(GAtll4(GAtll4(GAtll4(GAt))Aa1Q)G G 1';< $// &C HI I ??4 5 : $ ??= )$ ??4  ??4   OO3 489=>QRLM"LL.MGTE  & T 2 qy Nr0c Ztj||}||jt}nqtj|||tj ||tj ||tj|||} | jt}||S)a Build a key from RSA numerical components. @type n: L{int} @param n: The 'n' RSA variable. @type e: L{int} @param e: The 'e' RSA variable. @type d: L{int} or L{None} @param d: The 'd' RSA variable (optional for a public key). @type p: L{int} or L{None} @param p: The 'p' RSA variable (optional for a public key). @type q: L{int} or L{None} @param q: The 'q' RSA variable (optional for a public key). @type u: L{int} or L{None} @param u: The 'u' RSA variable. Ignored, as its value is determined by p and q. @rtype: L{Key} @return: An RSA key constructed from the values as given. )rr)rlrmrdmp1dmq1iqmppublic_numbers) rr{r|rRSAPrivateNumbers rsa_crt_dmp1 rsa_crt_dmq1 rsa_crt_iqmp private_key) rWrrrrlrmr publicNumbersrprivateNumberss r1rzKey._fromRSAComponentss6,,qA6 9%001BCI 22%%a+%%a+%%a+,N'22?3DEI9~r0ctj|tj|||}||jt }n0tj ||}|j t }||S)a Build a key from DSA numerical components. @type y: L{int} @param y: The 'y' DSA variable. @type p: L{int} @param p: The 'p' DSA variable. @type q: L{int} @param q: The 'q' DSA variable. @type g: L{int} @param g: The 'g' DSA variable. @type x: L{int} or L{None} @param x: The 'x' DSA variable (optional for a public key) @rtype: L{Key} @return: A DSA key constructed from the values as given. rkro)rr)rr}r~r|rDSAPrivateNumbersr ) rWrprlrmrnrr rrs r1rzKey._fromDSAComponents sq.,,3#:#:Q!q#I  9%001BCI 22Q}UN&22?3DEI9~r0ctj||t|}||jt }n0tj ||}|j t }||S)a Build a key from EC components. @param x: The affine x component of the public point used for verifying. @type x: L{int} @param y: The affine y component of the public point used for verifying. @type y: L{int} @param curve: NIST name of elliptic curve. @type curve: L{bytes} @param privateValue: The private value. @type privateValue: L{int} rrpru) private_valuer)rEllipticCurvePublicNumbersrr|rEllipticCurvePrivateNumbersr )rWrrprurr rrs r1_fromECComponentszKey._fromECComponents/so$551K.   %001BCI;;*=N'22?3DEI9~r0c|(tjjt||}n&tj|t|t }||S)aa Build a key from an EC encoded point. @param encodedPoint: The public point encoded as in SEC 1 v2.0 section 2.3.3. @type encodedPoint: L{bytes} @param curve: NIST name of elliptic curve. @type curve: L{bytes} @param privateValue: The private value. @type privateValue: L{int} )rrrrderive_private_keyr)rWrtrurrs r1rzKey._fromECEncodedPointOsW  11DDE"LI--k%0/2CI9~r0ctt td|tj|}ntj |}||S)aBuild a key from Ed25519 components. @param a: The Ed25519 public key, as defined in RFC 8032 section 5.1.5. @type a: L{bytes} @param k: The Ed25519 private key, as defined in RFC 8032 section 5.1.5. @type k: L{bytes} z)Ed25519 keys not supported on this system)Ed25519PublicKeyEd25519PrivateKeyr)from_public_bytesfrom_private_bytes)rWrrrs r1rzKey._fromEd25519ComponentsksK  #'8'@IJ J 9(::1=I)< < z Public Keyz Private Keyz (zattr :Ed25519rj02xr >)rYredecodeisPublicsorteditemsr!sizeappendrMPr ordrr) r reroutrvrbymorEs r1__repr__z Key.__repr__s 99;$ 99;D=''0D}}4T"#YKvF5d23i[Gtzz|, ,1<\$00CRs%s++C  , ;  (!-MMO4 E EIIK Etyy{0023 +1 uQCq\*))+2Q ! QR8H3BABCBA&q\13q6#,a 0011v{crFLL* +b CE"I99U# #r0ct|jtjtj t jtjfS)zl Check if this instance is a public key. @return: C{True} if this is a public key. ) rHrr RSAPublicKeyr DSAPublicKeyrrrrr s r1r4z Key.isPublicsA  OO    ))((    r0cl|jr|St|jjS)z Returns a version of this key containing only the public key data. If this is a public key, this may or may not be the same object as self. @rtype: L{Key} @return: A public key. )r4rQrr|rDs r1publicz Key.publics* ==?Kt1134 4r0c |tjur9ttt |j j S|tjuritdjtt|j j Dcgc]}tj|c}Std|cc}w)aO The fingerprint of a public key consists of the output of the message-digest algorithm in the specified format. Supported formats include L{FingerprintFormats.MD5_HEX} and L{FingerprintFormats.SHA256_BASE64} The input to the algorithm is the public key data as specified by [RFC4253]. The output of sha256[RFC4634] algorithm is presented to the user in the form of base64 encoded sha256 hashes. Example: C{US5jTUa0kgX5ZxdqaGF0yGRu8EgKXHNmoT8jHKo1StM=} The output of the MD5[RFC1321](default) algorithm is presented to the user as a sequence of 16 octets printed as hexadecimal with lowercase letters and separated by colons. Example: C{c1:b1:30:29:d7:b8:de:6c:97:77:10:d7:46:41:63:87} @param format: Format for fingerprint generation. Consists hash function and representation format. Default is L{FingerprintFormats.MD5_HEX} @since: 8.2 @return: the user presentation of this L{Key}'s fingerprint, as a string. @rtype: L{str} :z Unsupported fingerprint format: )r:r<r!rrrdigestr;rr rbinasciihexlifyr8)r formatrs r1 fingerprintzKey.fingerprints: '55 5 &*=*D*D*F GH H )11 1 2;C !==?*^!==?*!==?* 99;) #==? ""(&,mmo&,mmo!'  #tyy{M* +  ,r0c|jy|jdk(r |jjjS|jdk(ry|jjS)zv Return the size of the object we wrap. @return: The size of the key. @rtype: L{int} rr'r-r\)rrYrukey_sizerDs r1r7zKey.sizeisV ?? " YY[D ??((11 1 YY[I %'''r0c R t|jtjr3|jj }|j |j dSt|jtjr|jj}|jj |jj |j|j|jtj|j|jdSt|jtjrg|jj }|j|j j"|j j|j jdSt|jtj$r|jj}|j&|jj|jj j"|jj j|jj jdSt|jt(j*rB|jj }|j&|j|j-dSt|jt(j.ra|jj}|jj&|jj|j0|j-dSt|jt2j4rNd|jj7t8j:j<t8j>j<iSt|jt2j@r|jjCj7t8j:j<t8j>j<|jjEt8j:j<t8jFj<t9jHdStKd |j) z_ Return the values of the public key as a dictionary. @rtype: L{dict} rrr)rrprnrlrmr)rrprrur)rrzUnexpected key type: )&rHrrrBrrrrQprivate_numbersrrlrmr rrCrprqrnrRrrrrVrSrrr public_bytesrEncodingRaw PublicFormatrr| private_bytes PrivateFormat NoEncryptionrT)r rsa_pub_numbersrsa_priv_numbersdsa_pub_numbersdsa_priv_numbersec_pub_numbersec_priv_numberss r1rezKey.dataxsr doos'7'7 8"oo<<>O$&&$&& ):): ;#>>@ %4466%4466%''%''%''%%&6&8&8:J:L:LM )9)9 :"oo<<>O$&&$6688$6688$6688   ):): ;#>>@ %''%4466%44FFHH%44FFHH%44FFHH  )B)B C!__;;=N#%%#%%  )C)C D"oo==?O$3355$3355 / = =   )A)A BT__11!**.. 0J0J0N0N  )B)B C__//1>>!**.. 0J0J0N0N__22!**..!//33!..0  !6t6GHI Ir0c|j}|j}|dk(rGtjdtj|dztj|dzS|dk(rytjdtj|dztj|dztj|d ztj|d zS|d k(r|j j jd zd z}tj|dtj|dddztjdtj|d|ztj|d |zzS|dk(r.tjdtj|dzStd|)a Return the public key blob for this key. The blob is the over-the-wire format for public keys. SECSH-TRANS RFC 4253 Section 6.6. RSA keys:: string 'ssh-rsa' integer e integer n DSA keys:: string 'ssh-dss' integer p integer q integer g integer y EC keys:: string 'ecdsa-sha2-[identifier]' integer x integer y identifier is the standard NIST curve name Ed25519 keys:: string 'ssh-ed25519' string a @rtype: L{bytes} rOrhrrrPrirlrmrnrpr'rruNrr-rvrunknown key type: ) rYrerrr9rrurer rr))r rYre byteLengths r1rzKey.blobs@yy{yy{ 5=99Z(699T#Y+??&))DQTIBVV V U] *%))DI&'))DI&'))DI&'))DI& ' T\////881<BJ $w-())DM"#./0))((cJ?@((cJ?@ Y 99^,vyyc/CC C 24&9: :r0cF|j}|j}|dk(rtj|d|d}t j dt j |dzt j |dzt j |dzt j |zt j |dzt j |dzS|dk(rt j d t j |dzt j |dzt j |d zt j |d zt j |d zS|d k(r|jjjtjjtjj}t j |dt j |dddzt j |zt j |dzS|dk(rMt j dt j |dzt j |d|dzzStd|)a1 Return the private key blob for this key. The blob is the over-the-wire format for private keys: Specification in OpenSSH PROTOCOL.agent RSA keys:: string 'ssh-rsa' integer n integer e integer d integer u integer p integer q DSA keys:: string 'ssh-dss' integer p integer q integer g integer y integer x EC keys:: string 'ecdsa-sha2-[identifier]' integer x integer y integer privateValue identifier is the NIST standard curve name. Ed25519 keys:: string 'ssh-ed25519' string a string k || a rOrlrmrhrrrrPrirnrprr'rurwNrr-rvrrry)rYrerr rrr9rr|rhrriX962rkUncompressedPointr))r rYrerencPubs r1 privateBlobzKey.privateBlobsZRyy{yy{ 5=##DItCy9D *%))DI&'))DI&'))DI&'))D/ " ))DI& ' ))DI& ' U] *%))DI&'))DI&'))DI&'))DI& ' ))DI& ' T\__//1>>&&++**<<F  $w-())DM"#./0))F#$))D012  Y  .)))DI&'))DIS 123   24&9: :r0extracommentrNc2|1tjdtd|jr|}n|}t |t r|j d}t|}t|d|jd}|td|||||S) a Create a string representation of this key. If the key is a private key and you want the representation of its public key, use C{key.public().toString()}. type maps to a _toString_* method. @param type: The type of string to emit. Currently supported values are C{'OPENSSH'}, C{'LSH'}, and C{'AGENTV3'}. @type type: L{str} @param extra: Any extra data supported by the selected format which is not part of the key itself. For public OpenSSH keys, this is a comment. For private OpenSSH keys, this is a passphrase to encrypt with. (Deprecated since Twisted 20.3.0; use C{comment} or C{passphrase} as appropriate instead.) @type extra: L{bytes} or L{unicode} or L{None} @param subtype: A subtype of the requested C{type} to emit. Only supported for private OpenSSH keys, for which the currently supported subtypes are C{'PEM'} and C{'v1'}. If not given, an appropriate default is used. @type subtype: L{str} or L{None} @param comment: A comment to include with the key. Only supported for OpenSSH keys. Present since Twisted 20.3.0. @type comment: L{bytes} or L{unicode} or L{None} @param passphrase: A passphrase to encrypt the key with. Only supported for private OpenSSH keys. Present since Twisted 20.3.0. @type passphrase: L{bytes} or L{unicode} or L{None} @rtype: L{bytes} NzThe 'extra' argument to twisted.conch.ssh.keys.Key.toString was deprecated in Twisted 20.3.0; use 'comment' or 'passphrase' instead.r) stacklevelr] _toString_ry)subtyperrN) warningswarnDeprecationWarningr4rHrIrLrOrarbr))r rYrrrrNrfs r1toStringz Key.toStringSsZ   MMI#  }}" gs #nnW-G)*5 DJJL>:DA > 24&9: :gw:NNr0c|jdk(rd|sd}|jjtjj tj j dz|zjSt|jjdd}|sd}|jdz|zdz|zjS)a Return a public OpenSSH key string. See _fromString_PUBLIC_OPENSSH for the string format. @type comment: L{bytes} or L{None} @param comment: A comment to include with the key, or L{None} to omit the comment. r'r0  ) rYrrhrriOpenSSHrkrrrreplacerV)r rb64Datas r1_toPublicOpenSSHzKey._toPublicOpenSSHs 99;$ ,,!**22M4N4N4V4V  eg  diik*225#>G %/$6@GGIIr0c |rktj}d}d}|jdz}d}|}tj|} d} t j | tjd| z} nd}d}d}d} tjd } | | z|jzt j |xsdz} d }t| |zr&|d z }| t|d zfz } t| |zr&|rtj| zd}t|d |tj ||||zt#j%}|j'| |j)z}n| }dt j |zt j |zt j | ztjdd zt j |j+zt j |z}t-|j/dd}dgt1d t|dDcgc] }|||dz c}zdgz}dj3|dzScc}w)aP Return a private OpenSSH key string, in the "openssh-key-v1" format introduced in OpenSSH 6.5. See _fromPrivateOpenSSH_v1 for the string format. @type passphrase: L{bytes} or L{None} @param passphrase: The passphrase to encrypt the key with, or L{None} if it is not encrypted. rrrrdrrr0rjrrrNrrrs#-----BEGIN OPENSSH PRIVATE KEY-----@s!-----END OPENSSH PRIVATE KEY-----)rr block_sizer secureRandomrrrpackrrbytesrrrrrr encryptorrrrrrranger)r rrNr cipherNamekdfNamerrrrrrcheckrpadByteencKeyrrrrirs r1_toPrivateOpenSSH_v1zKey._toPrivateOpenSSH_v1sq  ^^F&JG))Q.IGF))&1DF46;;tV+DDJ JGIJ&&q)emd&6&6&88699W^PS;TT +* qLG 5'D.!23 3K+* ZZ D'F2BCHFvhw'( &7V+;<=')ik  '--k:Y=O=O=QQN(N ii # $ii  !ii # $kk$"  # ii $  % ii'  ( d#++E37 3 4,1!S\2,FGqwq1r6"G H34 5  zz% 5((HsI/cZ|stj}ntj|}|jdk7rM|jj tj jtjj|S|jdk(sJtd)a, Return a private OpenSSH key string, in the old PEM-based format. See _fromPrivateOpenSSH_PEM for the string format. @type passphrase: L{bytes} or L{None} @param passphrase: The passphrase to encrypt the key with, or L{None} if it is not encrypted. r-zBcannot serialize Ed25519 key to OpenSSH PEM format; use v1 instead) rrnBestAvailableEncryptionrYrrlriPEMrmTraditionalOpenSSLr)r rNrs r1_toPrivateOpenSSH_PEMzKey._toPrivateOpenSSH_PEMs%224I%==jII 99;) #??00&&**++>> 99;)+ ++W r0c|jr|j|S|dk(s|&|jdk(r|j||S||dk(r|j |St d|)ar Return a public or private OpenSSH string. See L{_fromString_PUBLIC_OPENSSH} and L{_fromPrivateOpenSSH_PEM} for the string formats. @param subtype: A subtype to emit. Only supported for private keys, for which the currently supported subtypes are C{'PEM'} and C{'v1'}. If not given, an appropriate default is used. @type subtype: L{str} or L{None} @param comment: Comment for a public key. @type comment: L{bytes} @param passphrase: Passphrase for a private key. @type passphrase: L{bytes} @rtype: L{bytes} )rv1r-)rrNrrMzunknown subtype )r4rrYrrr)r rrrNs r1_toString_OPENSSHzKey._toString_OPENSSH s& ==?(((9 9 _TYY[I5M,,W,T T _5 0---D D/y9: :r0c D|j}|j}|jr|dk(rRtjdddt j |dddgdt j |d ddgggg}n|d k(rtjdd d t j |d ddgdt j |dddgdt j |dddgdt j |dddgggg}ntd|dt|jddzdzS|dk(r|d |d}}tj||}tjdddt j |dddgdt j |d ddgdt j |dddgd t j |ddgdt j |ddgdt j |d|dz zddgdt j |d|dz zddgd t j |ddgg ggS|d k(rtjdd d t j |d ddgdt j |dddgdt j |dddgdt j |dddgd!t j |d"ddggggStd|d#)$z Return a public or private LSH key. See _fromString_PUBLIC_LSH and _fromString_PRIVATE_LSH for the key formats. @rtype: L{bytes} rOrrrrrjNrrrPrrrlrrmrrnrrprrrr0}rrrrarrbcrr') rerYr4rrrr9r)rrrr )r kwargsrerYkeyDatarlrmrs r1 _toString_LSHzKey._toString_LSH&seyy{yy{ ==?u}*** 1!%vyyc';AB'? @!%vyyc';AB'? @  *** &!%vyyc';AB'? @!%vyyc';AB'? @!%vyyc';AB'? @!%vyyc';AB'? @    "$5dV"<==+g.66ucBBTI Iu}Cy$s)1''1-zz+ ,!%vyyc';AB'? @!%vyyc';AB'? @!%vyyc';AB'? @!%vyy|AB'7 8!%vyy|AB'7 8!%vyyca!e1D'Eab'I J!%vyyca!e1D'Eab'I J!%vyyqr': ;  $zz+ &!%vyyc';AB'? @!%vyyc';AB'? @!%vyyc';AB'? @!%vyyc';AB'? @!%vyyc';AB'? @    "$5dV1"=>>r0c |j}|js|jdk(r|d|d|d|d|d|df}n)|jdk(r|d|d|d |d |d f}tj|j d j ttjzSy )z Return a private Secure Shell Agent v3 key. See _fromString_AGENTV3 for the key format. @rtype: L{bytes} rOrrrrrlrmrPrnrprr0N) rer4rYrrrVrmapr9)r rrevaluess r1_toString_AGENTV3zKey._toString_AGENTV3xsyy{}}yy{e#IIIIII %s)T#YS 49d3iP99T\\^,sxxFIIv8N/OO Or0c|j}||j}|j|}|td|d|d|dk(rF|jj |t j|}tj|}nD|dk(rW|jj ||}t|\}}tjt|dt|dz}n|dk(r|jj |tj|} t| \}}t|} t|} | d} | d zrd | z} | d} | d zrd | z} tjtj| tj| z}n3|d k(r.tj|jj |}tj|zS) aM Sign some data with this key. SECSH-TRANS RFC 4253 Section 6.6. @param data: The data to sign. @param signatureType: The SSH public key algorithm name to sign this data with, or L{None} to use a reasonable default for the key. @return: A signature for the given data. zpublic key signature algorithm z is not defined for z keysrOrPr'rr-)rYrVrcr3rsignrPKCS1v15rrr#rrECDSA)r rerbr hashAlgorithmsigretrs signaturerSsbrcompscomps r1rzKey.signs))+  !LLNM..}=  ,1-1BC&iu.  e //&&tW-=-=-?OC))C.C  //&&t];C)#.FQ ))LB/,q"2EEFC _,,T288M3JKI))4FQaBaBqEEt|r\qEEt|r\))FIIbMFIIbM9:C  !))DOO0067Cyy'#--r0ct|dk(rdtj|}}ntj|\}}|j |}|y|j }|dk(r\|j }|js|j}tj|d|tj|f}n|dk(rtj|d}tj|ddd } tj|ddd } t| | }|j }|js|j}|||f}n|d k(rtj|d}tj|d \} } } tj| d } tj| d } t| | }|j }|js|j}||tj|f}nK|d k(rF|j }|js|j}tj|d|f} j y #t"$rYywxYw)a Verify a signature using this key. @type signature: L{bytes} @param signature: The signature to verify. @type data: L{bytes} @param data: The signed data. @rtype: L{bool} @return: C{True} if the signature is valid. (riNFrOrrPrbigr'r_r-T)rrrryrcrYrr4r|rrr from_bytesr$rrverifyr )r rrerbrrrargsconcatenatedSignaturerrrstrsstrrs r1rz Key.verifys$ y>R '1699Y3G9M'-||I'> $M9..}=  ))+ e A==?LLN Y'*  " D  $*LL$;A$> !4Sb95AA4RS95AA,Q2IA==?LLNt]3D _$*LL$;A$> !%||,A1E D$tU+AtU+A,Q2IA==?LLNtRXXm%<=D  !A==?LLNLL+A.5D  AHHdO   sI!! I-,I-)NN)NNNN)N)r$objectreturnbool)rrI)rz&Literal['RSA', 'DSA', 'EC', 'Ed25519'])rzdict[str, Any])NNN)rerrbz bytes | Nonerr)0r+r,r-r. classmethodr[rUrrrrrrrrrr`rrrrrr!r%r@r4rFr:r;rMrYrVrZrcr7rerrr"rrrrrrrrrr/r0r1rQrQs->>(%,%,ND;D;LH?H?T**(V=V=p6:6:pAA8DD>#D#DJ.=.=`22h**X  D>6, "*$X 5"4!;!;&TPO.B $,: (JJX:;xQ;f! i l #  :O  :OxJ4<)|8;:P?dP,?.BDr0rQc0|jjd|jstjd|t }|j tjjtjjtj}|j||jd5}tj|j!dt }t#|cdddS#1swYyxYw) a This function returns a persistent L{Key}. The key is loaded from a PEM file in C{location}. If it does not exist, a key with the key size of C{keySize} is generated and saved. @param location: Where the key is stored. @type location: L{twisted.python.filepath.FilePath} @param keySize: The size of the key, if it needs to be generated. @type keySize: L{int} @returns: A persistent key. @rtype: L{Key} T)ignoreExistingDirectoryi)public_exponentrer)encodingrLencryption_algorithmrSN)passwordr)parentmakedirsexistsrgenerate_private_keyrrlrrirrmrrn setContentrTrrVrQ)locationr privateKeypemkeyFiles r1_getPersistentRSAKeyrs  OOt< ?? --!G_=N &&"++// ..AA!.!;!;!='  C t "77 LLNT?3D : s 9D  D)i)Or. __future__rrJrrBrbase64rrrhashlibrrtypingr r constantlyr r cryptographyr cryptography.exceptionsr cryptography.hazmat.backendsrcryptography.hazmat.primitivesrr)cryptography.hazmat.primitives.asymmetricrrrrr&cryptography.hazmat.primitives.ciphersrrr,cryptography.hazmat.primitives.serializationrrtyping_extensionsrtwisted.conch.sshrrtwisted.conch.ssh.commonrtwisted.pythonrtwisted.python.compatr r!twisted.python.deprecater"/cryptography.hazmat.primitives.asymmetric.utilsr#r$ ImportErrorr%r& SECP256R1 SECP384R1 SECP521R1rrrr Exceptionr)r3r6r8r:r>rOrQrr/r0r1rs9 # 66 +48@TTLL&+1$9@ )BLLN(BLLN(BLLN  ++--) 9 $$"9>||~3(W7s E EE