o l>jo9@sNUddlZddlmZddlmZmZddlmZmZm Z m Z m Z m Z ddl mZmZddlmZddlmZddlmZmZd d lmZ ed d Gd ddZdedddiZeeefed<dedefddZdededefddZ de de de fddZ!eGd d!d!Z"eGd"d#d#Z#eGd$d%d%Z$eGd&d'd'Z%dS)(N) dataclass)SequenceTuple)ECDH EllipticCurveEllipticCurvePrivateKeyEllipticCurvePublicKeyEllipticCurvePublicNumbersderive_private_key)Hash HashAlgorithm)HMAC)HKDF)Encoding PublicFormat) bytes2intT)frozenc@s"eZdZUdZeed<eed<dS) _CurveParamsz:Weierstrass curve parameters needed for EC point addition.primeaN)__name__ __module__ __qualname____doc__int__annotations__rr?/home/thesage/.local/lib/python3.10/site-packages/fido2/arkg.pyr8s  r secp256r1l?@l?@)rr _CURVE_PARAMScurvereturncCs,zt|jWStytd|jw)zELook up curve parameters, or raise ValueError for unsupported curves.zUnsupported curve: )r nameKeyError ValueError)r!rrr_params_for_curveHs   r&rbcs tfddttDS)Nc3s |] }||AVqdS)Nr).0irr'rr Qsz_strxor..)bytesrangelenr*rr*r_strxorPs r/p1p2c Cs|jj|jjkr tdt|j}|}|}|j|j}}|j|j}}|j} ||krF||krFd|||jt d|d| | } n||t ||d| | } | | ||| } | || || } t | | |j S)zCAdd two EC points. Both points must be on the same supported curve.z'Cannot add points from different curves) r!r#r%r&public_numbersxyrrpowr public_key) r0r1paramsn1n2x1y1x2y2plamx3y3rrr _point_addTs (rEc@s^eZdZUdZeed<eed<eed<eed<dedefdd Zded ed e efd d Z dS)_HTFa/ hash_to_field(msg, count) Parameters: - DST, a domain separation tag (see Section 3.1). - F, a finite field of characteristic p and order q = p^m. - p, the characteristic of F (see immediately above). - m, the extension degree of F, m >= 1 (see immediately above). - L = ceil((ceil(log2(p)) + k) / 8), where k is the security parameter of the suite (e.g., k = 128). - expand_message, a function that expands a byte string and domain separation tag into a uniformly random byte string (see Section 5.3). DSTrALr msg len_in_bytescCs|jj}| | }|dks|dkst|jdkrtd|jtdt|j}|jjdus1Jd|jj}td|}|||d|}t|j} | || } | } t } t d|dD]"} t|j} | | td| || }| |t | |} qat| d|S) a} expand_message_xmd(msg, DST, len_in_bytes) Parameters: - H, a hash function (see requirements above). - b_in_bytes, b / 8 for b the output size of H in bits. For example, for b = 256, b_in_bytes = 32. - s_in_bytes, the input block size of H, measured in bytes (see discussion above). For example, for SHA-256, s_in_bytes = 64. Input: - msg, a byte string. - DST, a byte string of at most 255 bytes. See below for information on using longer DSTs. - len_in_bytes, the length of the requested output in bytes, not greater than the lesser of (255 * b_in_bytes) or 2^16-1. Output: - uniform_bytes, a byte string. Steps: 1. ell = ceil(len_in_bytes / b_in_bytes) 2. ABORT if ell > 255 or len_in_bytes > 65535 or len(DST) > 255 3. DST_prime = DST || I2OSP(len(DST), 1) 4. Z_pad = I2OSP(0, s_in_bytes) 5. l_i_b_str = I2OSP(len_in_bytes, 2) 6. msg_prime = Z_pad || msg || l_i_b_str || I2OSP(0, 1) || DST_prime 7. b_0 = H(msg_prime) 8. b_1 = H(b_0 || I2OSP(1, 1) || DST_prime) 9. for i in (2, ..., ell): 10. b_i = H(strxor(b_0, b_(i - 1)) || I2OSP(i, 1) || DST_prime) 11. uniform_bytes = b_1 || ... || b_ell 12. return substr(uniform_bytes, 0, len_in_bytes) izInvalid size of input/output>BNz>Hr)r digest_sizer.rGr%structpack block_sizeupdatefinalize bytearrayr-extendr/r,)selfrIrJ b_in_bytesell dst_primez_pad l_i_b_str msg_primedb_0b_xor uniform_bytesr)b_irrrexpand_message_xmds*#        z_HTF.expand_message_xmdcountr"c Cs^||||j}t}t|D]}|j|}||||j}t||j}||q|S)a hash_to_field(msg, count) Input: - msg, a byte string containing the message to hash. - count, the number of elements of F to output. Output: - (u_0, ..., u_(count - 1)), a list of field elements. Steps: 1. len_in_bytes = count * m * L 2. uniform_bytes = expand_message(msg, DST, len_in_bytes) 3. for i in (0, ..., count - 1): 4. for j in (0, ..., m - 1): 5. elm_offset = L * (j + i * m) 6. tv = substr(uniform_bytes, elm_offset, L) 7. e_j = OS2IP(tv) mod p 8. u_i = (e_0, ..., e_(m - 1)) 9. return (u_0, ..., u_(count - 1)) )rbrHlistr-rrAappend) rVrIrcr`elementsr)offsettve_jrrr hash_to_fields   z_HTF.hash_to_fieldN) rrrrr,rrr rbrrjrrrrrFms  tau DST_tau = 'ARKG-BL-EC.' || DST_ext || ctx tau = hash_to_field(tau, 1) with the parameters: DST: DST_tau F: GF(N), the scalar field of the prime order subgroup of crv p: N m: 1 L: The L defined in hash-to-crv-suite expand_message: The expand_message function defined in hash-to-crv-suite s ARKG-BL-EC.0rr)rmrFrl group_orderr rj)rVrnrodst_tauhtftaurrrprfsz_BL.prfpkrtcCst||j}t||S)z[ BL-Blind-Public-Key(pk, tau) -> pk_tau pk_tau = pk + tau * G )r rlr9rE)rVrvrttau_grrrblind_public_keys z_BL.blind_public_keyN) rrrrrr r,rrurrxrrrrrks rkc @s|eZdZUeed<eed<eed<dedefddZde ded ede eeffd d Z de ded ede eeffd d Z dS)_KEMrlr rmikmr"cCs6td|j|jjd|j}||dd}t||jS)a Sub-Kem-Derive-Key-Pair(ikm) -> (pk, sk) sk = hash_to_field(ikm, 1) with the parameters: DST: 'ARKG-KEM-ECDH-KG.' || DST_ext F: GF(N), the scalar field of the prime order subgroup of crv p: N m: 1 L: The L defined in hash-to-crv-suite expand_message: The expand_message function defined in hash-to-crv-suite pk = sk * G sARKG-KEM-ECDH-KG.rprr)rFrmrlrqr rjr )rVrzrsskrrrsub_kem_derive_key_pairs z_KEM.sub_kem_derive_key_pairrvrocCs8||}|}|t|}|tjtj}||fS)a ECDH(pk, sk) represents the compact output of ECDH [RFC6090] using public key (curve point) pk and private key (exponent) sk. G is the generator of the prime order subgroup of crv. N is the order of G. Sub-Kem-Encaps(pk, ikm, ctx) -> (k, c) (pk', sk') = Sub-Kem-Derive-Key-Pair(ikm) k = ECDH(pk, sk') c = Elliptic-Curve-Point-to-Octet-String(pk') ) r|r9exchanger public_bytesrX962rUncompressedPoint)rVrvrzrosk_primepk_primekcrrrsub_kem_encaps*s z_KEM.sub_kem_encapsc Csd|j|}||||\}}t|j|jjdd|j||}t||j}|||dd} t|jt |dd|j||} | |} | | fS)a KEM-Encaps(pk, ikm, ctx) -> (k, c) ctx_sub = 'ARKG-KEM-HMAC.' || DST_ext || ctx (k', c') = Sub-Kem-Encaps(pk, ikm, ctx_sub) prk = HKDF-Extract with the arguments: Hash: Hash salt: not set IKM: k' mk = HKDF-Expand with the arguments: Hash: Hash PRK: prk info: 'ARKG-KEM-HMAC-mac.' || DST_ext || ctx L: L t = HMAC-Hash-128(K=mk, text=c') k = HKDF-Expand with the arguments: Hash: Hash PRK: prk info: 'ARKG-KEM-HMAC-shared.' || DST_ext || ctx L: The length of k' in octets. c = t || c' sARKG-KEM-HMAC.NsARKG-KEM-HMAC-mac.sARKG-KEM-HMAC-shared.) rmrrr rNderiver rRrSr.) rVrvrzroctx_subk_primec_primemkhmactrrrrrencapsDs.    z _KEM.encapsN) rrrrrr r,rr|rrrrrrrrry s.    ryc @sHeZdZUdZeed<eed<dedededede eeff d d Z d S) _ARKGz} ARKG instance parameters: BL A key blinding scheme. KEM A key encapsulation mechanism. blkempk_blpk_kemrzror"c Cstt|dkr tdtdt||}d|}d|}|j|||\}} |j||} |j|| } | } | | fS)a& ARKG-Derive-Public-Key((pk_bl, pk_kem), ikm, ctx) -> (pk', kh) ARKG instance parameters: BL A key blinding scheme. KEM A key encapsulation mechanism. Inputs: pk_bl A key blinding public key. pk_kem A key encapsulation public key. ikm Input entropy for KEM encapsulation. ctx An octet string of length at most 64, containing optional context and application specific information (can be a zero-length string). Output: pk' A blinded public key. kh A key handle for deriving the blinded private key sk' corresponding to pk'. The output (pk', kh) is calculated as follows: if LEN(ctx) > 64: Abort with an error. ctx' = I2OSP(LEN(ctx), 1) || ctx ctx_bl = 'ARKG-Derive-Key-BL.' || ctx' ctx_kem = 'ARKG-Derive-Key-KEM.' || ctx' (ikm_tau, c) = KEM-Encaps(pk_kem, ikm, ctx_kem) tau = BL-PRF(ikm_tau, ctx_bl) pk' = BL-Blind-Public-Key(pk_bl, tau) kh = c @z,Context too long, should be at most 64 bytesrLsARKG-Derive-Key-BL.sARKG-Derive-Key-KEM.) r.r%rOrPrrrrurx) rVrrrzro ctx_primectx_blctx_kemrnrrtrkhrrrderive_public_keys *z_ARKG.derive_public_keyN) rrrrrkrryrr,rrrrrrr{s  r)&rO dataclassesrtypingrr,cryptography.hazmat.primitives.asymmetric.ecrrrrr r %cryptography.hazmat.primitives.hashesr r #cryptography.hazmat.primitives.hmacr 'cryptography.hazmat.primitives.kdf.hkdfr,cryptography.hazmat.primitives.serializationrrutilsrrr dictstrrr&r,r/rErFrkryrrrrrsD        u&p