Djo9UddlZddlmZddlmZmZddlmZmZm Z m Z m Z m Z ddl mZmZddlmZddlmZddlmZmZd d lmZ ed Gd dZdeddiZeeefed<dedefdZdededefdZ de de de fdZ!eGddZ"eGdd Z#eGd!d"Z$eGd#d$Z%dS)%N) dataclass)SequenceTuple)ECDH EllipticCurveEllipticCurvePrivateKeyEllipticCurvePublicKeyEllipticCurvePublicNumbersderive_private_key)Hash HashAlgorithm)HMAC)HKDF)Encoding PublicFormat) bytes2intT)frozenc(eZdZUdZeed<eed<dS) _CurveParamsz:Weierstrass curve parameters needed for EC point addition.primeaN)__name__ __module__ __qualname____doc__int__annotations__E/home/thesage/.hermes/venv/lib/python3.11/site-packages/fido2/arkg.pyrr8s(DD JJJ FFFFFr r secp256r1l?@l?@)rr _CURVE_PARAMScurvereturncr t|jS#t$rtd|jwxYw)zELook up curve parameters, or raise ValueError for unsupported curves.zUnsupported curve: )r#nameKeyError ValueError)r$s r!_params_for_curver*HsH=UZ(( ===;uz;;<<<=s"6rbcrtfdttDS)Nc3:K|]}||z VdS)Nr).0irr+s r! z_strxor..Qs/441!444444r )bytesrangelen)rr+s``r!_strxorr4Ps6 44444eCFFmm444 4 44r p1p2c>|jj|jjkrtdt|j}|}|}|j|j}}|j|j}}|j} ||kr/||kr)d|z|z|jztd|zd| z| z} n||z t||z d| z| z} | | z|z |z | z} | || z z|z | z} t| | |j S)zCAdd two EC points. Both points must be on the same supported curve.z'Cannot add points from different curves) r$r'r)r*public_numbersxyrrpowr public_key) r5r6paramsn1n2x1y1x2y2plamx3y3s r! _point_addrKTs* x} %%BCCC rx ( (F    B    B T24B T24B A RxxB"HH2v{VX%QVR););;a?Bw#b2gr1---1 )b.2  "B b/B ! #B %b"bh 7 7 B B D DDr cleZdZUdZeed<eed<eed<eed<dedefdZded ed e efd Z d S) _HTFa/ hash_to_field(msg, count) Parameters: - DST, a domain separation tag (see Section 3.1). - F, a finite field of characteristic p and order q = p^m. - p, the characteristic of F (see immediately above). - m, the extension degree of F, m >= 1 (see immediately above). - L = ceil((ceil(log2(p)) + k) / 8), where k is the security parameter of the suite (e.g., k = 128). - expand_message, a function that expands a byte string and domain separation tag into a uniformly random byte string (see Section 5.3). DSTrGLr msg len_in_bytescV|jj}| |z }|dks|dkst|jdkrt d|jt jdt|jz}|jjJd|jjz}t jd|}||z|zdz|z}t|j} | || } | } t} td|dzD]}} t|j} | | t jd| z|z| }| |t| |} ~t| d|S) a} expand_message_xmd(msg, DST, len_in_bytes) Parameters: - H, a hash function (see requirements above). - b_in_bytes, b / 8 for b the output size of H in bits. For example, for b = 256, b_in_bytes = 32. - s_in_bytes, the input block size of H, measured in bytes (see discussion above). For example, for SHA-256, s_in_bytes = 64. Input: - msg, a byte string. - DST, a byte string of at most 255 bytes. See below for information on using longer DSTs. - len_in_bytes, the length of the requested output in bytes, not greater than the lesser of (255 * b_in_bytes) or 2^16-1. Output: - uniform_bytes, a byte string. Steps: 1. ell = ceil(len_in_bytes / b_in_bytes) 2. ABORT if ell > 255 or len_in_bytes > 65535 or len(DST) > 255 3. DST_prime = DST || I2OSP(len(DST), 1) 4. Z_pad = I2OSP(0, s_in_bytes) 5. l_i_b_str = I2OSP(len_in_bytes, 2) 6. msg_prime = Z_pad || msg || l_i_b_str || I2OSP(0, 1) || DST_prime 7. b_0 = H(msg_prime) 8. b_1 = H(b_0 || I2OSP(1, 1) || DST_prime) 9. for i in (2, ..., ell): 10. b_i = H(strxor(b_0, b_(i - 1)) || I2OSP(i, 1) || DST_prime) 11. uniform_bytes = b_1 || ... || b_ell 12. return substr(uniform_bytes, 0, len_in_bytes) izInvalid size of input/output>BNz>Hr)r digest_sizer3rNr)structpack block_sizeupdatefinalize bytearrayr2extendr4r1)selfrPrQ b_in_bytesell dst_primez_pad l_i_b_str msg_primedb_0b_xor uniform_bytesr/b_is r!expand_message_xmdz_HTF.expand_message_xmdsFY*  +, 99 u,,DH 0C0C;<< <Hv{4TX??? y#///$)..Kl33 CK)+g5 A OO jjll! q#'"" & &ATYA HHUV[q111I= > > >**,,C   % % %C%%EE]=L=1222r countr%c||||jz}t}t|D]J}|j|z}||||jz}t ||jz}||K|S)a hash_to_field(msg, count) Input: - msg, a byte string containing the message to hash. - count, the number of elements of F to output. Output: - (u_0, ..., u_(count - 1)), a list of field elements. Steps: 1. len_in_bytes = count * m * L 2. uniform_bytes = expand_message(msg, DST, len_in_bytes) 3. for i in (0, ..., count - 1): 4. for j in (0, ..., m - 1): 5. elm_offset = L * (j + i * m) 6. tv = substr(uniform_bytes, elm_offset, L) 7. e_j = OS2IP(tv) mod p 8. u_i = (e_0, ..., e_(m - 1)) 9. return (u_0, ..., u_(count - 1)) )rjrOlistr2rrGappend) r^rPrkrhelementsr/offsettve_js r! hash_to_fieldz_HTF.hash_to_fields.//UTV^DD 66u ! !AVaZFv78BB--$&(C OOC r N) rrrrr1rrr rjrrsrr r!rMrMms   JJJ FFF FFF :3e:33:3:3:3:3xsx}r rMcVeZdZUeed<eed<eed<dededefdZde d ede fd Z d S) _BLcrvr DST_extikm_tauctxr%cd|jz|z}t||jjd|j}||dd}|S)a BL-PRF(ikm_tau, ctx) -> tau DST_tau = 'ARKG-BL-EC.' || DST_ext || ctx tau = hash_to_field(tau, 1) with the parameters: DST: DST_tau F: GF(N), the scalar field of the prime order subgroup of crv p: N m: 1 L: The L defined in hash-to-crv-suite expand_message: The expand_message function defined in hash-to-crv-suite s ARKG-BL-EC.0rr)rwrMrv group_orderr rs)r^rxrydst_tauhtftaus r!prfz_BL.prfsN!4</#57DH0"di@@++A. r pkrcpt||j}t||S)z[ BL-Blind-Public-Key(pk, tau) -> pk_tau pk_tau = pk + tau * G )r rvr?rK)r^rrtau_gs r!blind_public_keyz_BL.blind_public_keys1#311<<>>"e$$$r N) rrrrrr r1rrr rrr r!rurus   NNN5u* %( %/2 %  % % % % % %r ruc eZdZUeed<eed<eed<dedefdZde dedede eeffd Z de dedede eeffd Z d S) _KEMrvr rwikmr%ctd|jz|jjd|j}||dd}t ||jS)a Sub-Kem-Derive-Key-Pair(ikm) -> (pk, sk) sk = hash_to_field(ikm, 1) with the parameters: DST: 'ARKG-KEM-ECDH-KG.' || DST_ext F: GF(N), the scalar field of the prime order subgroup of crv p: N m: 1 L: The L defined in hash-to-crv-suite expand_message: The expand_message function defined in hash-to-crv-suite pk = sk * G sARKG-KEM-ECDH-KG.r{rr)rMrwrvr|r rsr )r^rr~sks r!sub_kem_derive_key_pairz_KEM.sub_kem_derive_key_pairs[  4< / H  I      sA & &q )!"dh///r rryc||}|}|t|}|t jtj}||fS)a ECDH(pk, sk) represents the compact output of ECDH [RFC6090] using public key (curve point) pk and private key (exponent) sk. G is the generator of the prime order subgroup of crv. N is the order of G. Sub-Kem-Encaps(pk, ikm, ctx) -> (k, c) (pk', sk') = Sub-Kem-Derive-Key-Pair(ikm) k = ECDH(pk, sk') c = Elliptic-Curve-Point-to-Octet-String(pk') ) rr?exchanger public_bytesrX962rUncompressedPoint)r^rrrysk_primepk_primekcs r!sub_kem_encapsz_KEM.sub_kem_encaps*sd$//44&&((   dffb ) )  ! !(-1O P P!t r cd|jz|z}||||\}}t|j|jjdd|jz|z|}t ||j}|||dd} t|jt|dd|jz|z|} | |z} | | fS)a KEM-Encaps(pk, ikm, ctx) -> (k, c) ctx_sub = 'ARKG-KEM-HMAC.' || DST_ext || ctx (k', c') = Sub-Kem-Encaps(pk, ikm, ctx_sub) prk = HKDF-Extract with the arguments: Hash: Hash salt: not set IKM: k' mk = HKDF-Expand with the arguments: Hash: Hash PRK: prk info: 'ARKG-KEM-HMAC-mac.' || DST_ext || ctx L: L t = HMAC-Hash-128(K=mk, text=c') k = HKDF-Expand with the arguments: Hash: Hash PRK: prk info: 'ARKG-KEM-HMAC-shared.' || DST_ext || ctx L: The length of k' in octets. c = t || c' sARKG-KEM-HMAC.NsARKG-KEM-HMAC-mac.sARKG-KEM-HMAC-shared.) rwrrr rVderiverrZr[r3) r^rrryctx_subk_primec_primemkhmactrrs r!encapsz _KEM.encapsDs:$dl2S8..r3@@  I I !  !DL 03 6   &// B "" G MMOOCRC   I LL  $t| 3c 9   &//  K!t r N) rrrrrr r1rrr rrrrr r!rr s   NNN0505L00004(/4;@ ue| 44(4/44;@4 ue| 444444r rc TeZdZUdZeed<eed<dedededede eeff d Z d S) _ARKGz} ARKG instance parameters: BL A key blinding scheme. KEM A key encapsulation mechanism. blkempk_blpk_kemrryr%cZt|dkrtdtjdt||z}d|z}d|z}|j|||\}} |j||} |j|| } | } | | fS)a& ARKG-Derive-Public-Key((pk_bl, pk_kem), ikm, ctx) -> (pk', kh) ARKG instance parameters: BL A key blinding scheme. KEM A key encapsulation mechanism. Inputs: pk_bl A key blinding public key. pk_kem A key encapsulation public key. ikm Input entropy for KEM encapsulation. ctx An octet string of length at most 64, containing optional context and application specific information (can be a zero-length string). Output: pk' A blinded public key. kh A key handle for deriving the blinded private key sk' corresponding to pk'. The output (pk', kh) is calculated as follows: if LEN(ctx) > 64: Abort with an error. ctx' = I2OSP(LEN(ctx), 1) || ctx ctx_bl = 'ARKG-Derive-Key-BL.' || ctx' ctx_kem = 'ARKG-Derive-Key-KEM.' || ctx' (ikm_tau, c) = KEM-Encaps(pk_kem, ikm, ctx_kem) tau = BL-PRF(ikm_tau, ctx_bl) pk' = BL-Blind-Public-Key(pk_bl, tau) kh = c @z,Context too long, should be at most 64 bytesrTsARKG-Derive-Key-BL.sARKG-Derive-Key-KEM.) r3r)rWrXrrrrr) r^rrrry ctx_primectx_blctx_kemrxrrrkhs r!derive_public_keyz_ARKG.derive_public_keysT s88b==KLL LKc#hh//#5 ')3)I5X__VS':: gkk'6**7++E377 |r N) rrrrrurrr r1rrrr r!rr{s GGG III7%7'7 7  7 %u, - 777777r r)&rW dataclassesrtypingrr,cryptography.hazmat.primitives.asymmetric.ecrrrr r r %cryptography.hazmat.primitives.hashesr r #cryptography.hazmat.primitives.hmacr'cryptography.hazmat.primitives.kdf.hkdfr,cryptography.hazmat.primitives.serializationrrutilsrrr#dictstrrr*r1r4rKrMrurrrr r!rs8 !!!!!!""""""""FEEEEEEE444444888888OOOOOOOO $        P L* tC%&=]=|====5u5555555EE$:EEEEE2 rrrrrrr rj #%#%#%#%#%#%#% #%L mmmmmmm m` AAAAAAA AAAr