o l>j;S@sdZddlmZddlZddlZddlZddlZddlmZddl m Z ddl m Z ddl mZdd d d d Zd ZdZdZdZdZdZeddZedeZeddZeddZeddZeddZdZdZddiZeddGdd d Z e ddZ!e eeZ"dcddd'd(Z#ded*d+Z$dfd,d-Z%dgd/d0Z&dhd1d2Z'did4d5Z(djd6d7Z)dkd:d;Z*dld=d>Z+dmd@dAZ,dndEdFZ-dodHdIZ.dpdqdJdKZ/drdNdOZ0eddGdPdQdQZ1eddGdRdSdSZ2GdTdUdUZ3GdVdWdWZ4dsd[d\Z5dtd]d^Z6Gd_d`d`Z7GdadbdbZ8dS)uz?Pure-Python bridge prover for Apple's trusted-device HSA2 flow.) annotationsN) dataclass)Optional) InvalidTag)AESGCMi@@)nrpdklenscom.apple.security.webproverscom.apple.security.webverifiers SPAKE2Web s webVerifiers webProver@FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF@5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B@FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551@6B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296@4FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5B02886e2f97ace46e55ba9dd7242579f2993b64e16ef3dcab95afd497333d8fa12fB03d8bbd6c639c62937b04d997f38c3770719c629d7014d49a24b4f98baa1292b49) rT)frozenc@s0eZdZUdZded<ded<ed ddZd S) _Pointz:Affine P-256 point used by the bridge SPAKE2 math helpers. Optional[int]xyreturnboolcCs|jdup |jduS)z3Return whether this point is the point at infinity.N)rrselfr"P/home/thesage/.local/lib/python3.10/site-packages/pyicloud/hsa2_bridge_prover.py is_infinity0sz_Point.is_infinityNrr)__name__ __module__ __qualname____doc____annotations__propertyr$r"r"r"r#r)s rvalueintlengthrrbytescCs*|durtd|dd}||dS)z)Encode an integer using big-endian bytes.Nrrbig)max bit_lengthto_bytes)r,r.r"r"r# _int_to_bytes:s r5strcCst|dS)z&Decode a base64 string into raw bytes.ascii)base64 b64decodeencoder,r"r"r# _b64_to_bytesAr<cCst|dS)z+Encode raw bytes as an ASCII base64 string.r7)r8 b64encodedecoder;r"r"r# _bytes_to_b64Fr=r@pointcCs2|jrtddt|jdt|jdS)z:Encode a P-256 point using SEC1 uncompressed point format.z$Cannot encode the point at infinity.04r)r$ ValueErrorr5rhexrrAr"r"r# _encode_pointKs$rFcCst|}t|dkr'|ddkr'tt|dddt|ddd}nGt|dkrj|ddvrjt|ddd}t|d tt|t t}t|tddt}|d@|dd@krd| t}t||}nt d t |svt d |S) zGDecode a compressed or uncompressed SEC1 point into affine coordinates.Arr!r1)rNrz!Unsupported P-256 point encoding.zInvalid P-256 point.) r/fromhexlenrr- from_bytespow_P256_P_P256_A_P256_BrC _is_on_curve)r,rawrAx_coordrhsy_coordr"r"r# _decode_pointRs"   rWrcCsT|jrdS|jdur|jdusJt|jdtt|jdtt|jttdkS)z:Return whether a point lies on the configured P-256 curve.FNrJrr)r$rrrNrOrPrQrEr"r"r#rRis rRcCs6|jr|S|jdur|jdusJt|j|j tS)z-Return the additive inverse of a P-256 point.N)r$rrrrOrEr"r"r#_negatetsrXleftrightcCs|jr|S|jr |S|jdur|jdusJ|jdur |jdus"J|j|jkr4|j|jtdkr4tS|j|jkr]|j|jkr]|jdkrGtSd|j|jttd|jdtt}n|j|jt|j|jdtt}|||j|jt}||j||jt}t||S)zAdd two affine P-256 points.NrrrJ)r$rrrO _INFINITYrPrNr)rYrZsloperTrVr"r"r# _add_points|s$  $$ r^scalarcCs@|t;}t}|}|r|d@rt||}t||}|dL}|s |S)z8Multiply a P-256 point by a scalar using double-and-add.r) _P256_ORDERr\r^)rAr_resultaddendr"r"r#_multiply_points  rcpartscGs8t}|D]}|t|dd||qt|S)zGConcatenate transcript parts using the bridge's length-prefixed format.rlittle) bytearrayextendrLr4r/)rdoutputpartr"r"r#_concat_length_prefixeds  rjikmsaltinfoc Cstj}|s d|}t||tj}t}d}d}t||krBt|||t|gtj}| ||d7}t||ks"t|d|S)zBDerive key material using the bridge worker's HKDF-like expansion.rN) hashlibsha256 digest_sizehmacnewdigestrfrLr/rg) rkrlrmr.hash_lenprkblockspreviouscounterr"r"r# _hkdf_likes&    r{requested_lengthcCsd|vrdS|S)zEReturn the bridge-specific output length for a given HKDF info label.ConfirmationKeysr r")rmr|r"r"r#_confirmation_key_lengthsr~cCst|d|t||dS)z:Derive one bridge sub-key from raw shared-secret material.ro)rkrlrmr.)r{r~)rkrmr.r"r"r# _derive_keys r raw_key_hextuple[str, str]cCs2t|}t|tt}t|tt}||fS)z@Split the raw bridge key into prover and verifier AES/HMAC keys.)r/rKr_VERIFIER_KEY_INFO _KEY_LENGTH_PROVER_KEY_INFOrD)rraw_key verifier_key prover_keyr"r"r# _derive_prover_and_verifier_keyss   rc@HeZdZUdZded<ded<ded<dd d Zdd d ZdddZdS)_ClientSharedSecretzCClient-side shared-secret transcript and derived confirmation keys.r/ transcriptr6share_pshare_vrNonecCstt|j}t|d|t|dd}t|d|ddt|d|ddt|dt}t|d |dS) FDerive confirmation keys and the final shared key from the transcript._hash_transcriptr}r _confirm_clientNr_confirm_server SharedKey _shared_key)rprqrruobject __setattr__rr)r!ru confirmations shared_keyr"r"r# __post_init__s  z!_ClientSharedSecret.__post_init__cCt|jt|jtjS)z.Return the prover's HMAC confirmation message.) rsrtrr/rKrrprq hexdigestr r"r"r#get_confirmation z$_ClientSharedSecret.get_confirmation message_hexcC4t|jt|jtj}||krt d|j S)z?Verify the server confirmation and return the shared key bytes.z invalid confirmation from server) rsrtrr/rKrrprqrrCrr!rexpectedr"r"r#verify z_ClientSharedSecret.verifyNrrrr6rr6rr/r&r'r(r)r*rrrr"r"r"r#rs   rc@r)_ServerSharedSecretzCServer-side shared-secret transcript and derived confirmation keys.r/rr6rrrrcCsbt|j}t|dd}t|d|ddt|d|ddt|dt|dtdS) rr}r rNrrrr)rprqrrurrrr)r!rurr"r"r#rs  z!_ServerSharedSecret.__post_init__cCr)z0Return the verifier's HMAC confirmation message.) rsrtrr/rKrrprqrr r"r"r#rrz$_ServerSharedSecret.get_confirmationrcCr)z?Verify the prover confirmation and return the shared key bytes.z invalid confirmation from client) rsrtrr/rKrrprqrrCrrr"r"r#rrz_ServerSharedSecret.verifyNrrrrr"r"r"r#rs   rc@s.eZdZdZddd Zdd d ZdddZdS)_ClientHandshakez=Client-side SPAKE2 handshake state for Apple's bridge prover.x_scalarr-w0w1rrcC"||_||_||_d|_d|_dS)z@Initialize the prover handshake with the derived SPAKE2 scalars.N)_x_w0_w1_message1_pointr)r!rrrr"r"r#__init__+  z_ClientHandshake.__init__r6cC4ttt|jttt|j}||_t||_ |j S)z)Return the prover's first SPAKE2 message.) r^rc _GENERATORrrW _SPAKE2_MrrrFrr!rAr"r"r# get_message9  z_ClientHandshake.get_messageserver_message_hexrc Cs|jdus |jdurtdt|}|jrtdt|tttt|j }t||j }t||j }t t tttttttttttt|jtt|tt|tt|t|j  }t||j|dS)z8Finish the handshake using the verifier's first message.N(get_message must be called before finishinvalid curve pointrrr)rrrCrWr$r^rXrc _SPAKE2_Nrrrrj_SPAKE2_CONTEXT_CLIENT_IDENTITY_SERVER_IDENTITYr/rKrFrr5r)r!r server_pointadjustedy_pointv_pointrr"r"r#finishCs8      z_ClientHandshake.finishN)rr-rr-rr-rrr)rr6rrr&r'r(r)rrrr"r"r"r#r(    rc@s.eZdZdZdd d Zdd d ZdddZdS)_ServerHandshakezAServer-side SPAKE2 handshake state used by the local test helper.y_scalarr-rverifier_pointrrrcCr)zEInitialize the verifier handshake with its scalar and verifier point.N)_yr_verifier_pointrr)r!rrrr"r"r#rhrz_ServerHandshake.__init__r6cCr)z+Return the verifier's first SPAKE2 message.) r^rcrrrWrrrrFrrr"r"r#rvrz_ServerHandshake.get_messageclient_message_hexrc Cs|jdus |jdurtdt|}|jrtdt|tttt|j }t||j }t|j |j }t t tttttttttttt|tt|jtt|tt|t|j  }t|||jdS)z?Finish the verifier handshake using the prover's first message.Nrrr)rrrCrWr$r^rXrcrrrrrjrrrr/rKrFrr5r)r!r client_pointrrverifier_sharerr"r"r#rs8     z_ServerHandshake.finishN)rr-rr-rrrrr)rr6rrrr"r"r"r#rerrpasswordsalt_b64tuple[int, int]cCsTtj|dfdt|it}t|d}t|d|dt||ddfS)z=Derive the SPAKE2 scalars from the user code and bridge salt.utf-8rlrJNr1)rpscryptr:r<_SCRYPT_PARAMSrLr-rM)rrderivedmidpointr"r"r#_compute_w0_w1s rcCs"d}|dkrtt}|dks|S)zReturn whether the bridge confirmation exchange has completed.)rr r"r"r# is_verifiedsz%TrustedDeviceBridgeProver.is_verifiedcCs|jdur td|jS)z0Return the raw shared bridge key as hexadecimal.NzNo bridge key is available yet.)rrCr r"r"r#get_keys z!TrustedDeviceBridgeProver.get_keyciphertext_b64c Cs|jdur tdzDt|}|d}t|\}}|dd|}|d|d||}|d||d}tt|j|||t|g} | dWSt t t t fyb} ztd| d} ~ ww)z0Decrypt Apple's final encrypted validation code.N%Bridge verifier key is not available.rrrzMalformed bridge payload) rrCr<_AES_GCM_LAYOUTSrr/rKdecryptr? IndexErrorKeyErrorrUnicodeDecodeError) r!rpayloadversion iv_length tag_lengthivtag ciphertext plaintextexcr"r"r#decrypt_messages&    z)TrustedDeviceBridgeProver.decrypt_messageNr)rr6rr6rrrrr6rr6)rr6rrr%)rr6rr6) r&r'r(r)rrrrrrrrrr"r"r"r#rs      rc@sLeZdZdZdddZdd d Zdd d ZdddZdddZdddZ dS) _TrustedDeviceBridgeServerProverz?Internal test helper mirroring Apple's server-side bridge flow.rr6rrrcCsFt||\}}tt|}tt||d|_d|_d|_d|_d|_ dS)zEInitialize the local verifier helper with the same password and salt.)rrrN) rrcrrr_serverrrrr)r!rrrrrr"r"r#rs  z)_TrustedDeviceBridgeServerProver.__init__cCs |jS)z+Return the verifier's first bridge message.)rrr r"r"r#rs z-_TrustedDeviceBridgeServerProver.get_message1rcCs|j||_|S)z@Process the prover message and return the verifier confirmation.)rrrr)r!rr"r"r#r#sz1_TrustedDeviceBridgeServerProver.process_message1cCr)zFReturn the verifier confirmation generated from the shared transcript.Nrrr r"r"r#r(rz-_TrustedDeviceBridgeServerProver.get_message2rcCs<|jdur td|j|}||_t|\|_|_|S)zCVerify the prover confirmation and persist the derived bridge keys.Nz6process_message1 must be called before verify_message2)rrCrrDrrrrrr"r"r#verify_message2.s z0_TrustedDeviceBridgeServerProver.verify_message2rc Cs|jdur tdd}t|\}}t|}tt|j|| dt|g}|d| }|| d}t|g|||} t | S)zIEncrypt a plaintext validation code using Apple's AES-GCM payload layout.Nrrr) rrCrr token_bytesrr/rKencryptr:r@) r!rrrrr encryptedrrrr"r"r#encrypt_message7s   z0_TrustedDeviceBridgeServerProver.encrypt_messageN)rr6rr6rrr)rr6rr6r)rr6rr6) r&r'r(r)rrrrrr r"r"r"r#rs      r)N)r,r-r.rrr/)r,r6rr/)r,r/rr6)rArrr6)r,r6rr)rArrr)rArrr)rYrrZrrr)rArr_r-rr)rdr/rr/) rkr/rlr/rmr/r.r-rr/)rmr/r|r-rr-)r )rkr/rmr/r.r-rr/)rr6rr)rr6rr6rr)rr-)9r) __future__rr8rprsr dataclassesrtypingrcryptography.exceptionsr+cryptography.hazmat.primitives.ciphers.aeadrrrrrrrrr-rOrPrQr`_P256_GX_P256_GYrrrrr\rr5r<r@rFrWrRrXr^rcrjr{r~rrrrrrrrrrr"r"r"r#sx                      %'= = V