<s> from __future__ import absolute_import , division , print_function <EOL> import calendar <EOL> import collections <EOL> import itertools <EOL> from contextlib import contextmanager <EOL> import six <EOL> from cryptography import utils , x509 <EOL> from cryptography . exceptions import UnsupportedAlgorithm , _Reasons <EOL> from cryptography . hazmat . backends . interfaces import ( <EOL> CMACBackend , CipherBackend , DERSerializationBackend , DSABackend , <EOL> EllipticCurveBackend , HMACBackend , HashBackend , PBKDF2HMACBackend , <EOL> PEMSerializationBackend , RSABackend , X509Backend <EOL> ) <EOL> from cryptography . hazmat . backends . openssl . ciphers import ( <EOL> _AESCTRCipherContext , _CipherContext <EOL> ) <EOL> from cryptography . hazmat . backends . openssl . cmac import _CMACContext <EOL> from cryptography . hazmat . backends . openssl . dsa import ( <EOL> _DSAParameters , _DSAPrivateKey , _DSAPublicKey <EOL> ) <EOL> from cryptography . hazmat . backends . openssl . ec import ( <EOL> _EllipticCurvePrivateKey , _EllipticCurvePublicKey <EOL> ) <EOL> from cryptography . hazmat . backends . openssl . encode_asn1 import ( <EOL> _CRL_ENTRY_EXTENSION_ENCODE_HANDLERS , <EOL> _CRL_EXTENSION_ENCODE_HANDLERS , _EXTENSION_ENCODE_HANDLERS , <EOL> _encode_asn1_int_gc , _encode_asn1_str_gc , _encode_name_gc , _txt2obj_gc , <EOL> ) <EOL> from cryptography . hazmat . backends . openssl . hashes import _HashContext <EOL> from cryptography . hazmat . backends . openssl . hmac import _HMACContext <EOL> from cryptography . hazmat . backends . openssl . rsa import ( <EOL> _RSAPrivateKey , _RSAPublicKey <EOL> ) <EOL> from cryptography . hazmat . backends . openssl . x509 import ( <EOL> _Certificate , _CertificateRevocationList , <EOL> _CertificateSigningRequest , _RevokedCertificate <EOL> ) <EOL> from cryptography . hazmat . bindings . _openssl import ffi as _ffi <EOL> from cryptography . hazmat . bindings . openssl import binding <EOL> from cryptography . hazmat . primitives import hashes , serialization <EOL> from cryptography . hazmat . primitives . asymmetric import dsa , ec , rsa <EOL> from cryptography . hazmat . primitives . asymmetric . padding import ( <EOL> MGF1 , OAEP , PKCS1v15 , PSS <EOL> ) <EOL> from cryptography . hazmat . primitives . ciphers . algorithms import ( <EOL> AES , ARC4 , Blowfish , CAST5 , Camellia , IDEA , SEED , TripleDES <EOL> ) <EOL> from cryptography . hazmat . primitives . ciphers . modes import ( <EOL> CBC , CFB , CFB8 , CTR , ECB , GCM , OFB <EOL> ) <EOL> _MemoryBIO = collections . namedtuple ( "<STR_LIT>" , [ "<STR_LIT>" , "<STR_LIT>" ] ) <EOL> class _PasswordUserdata ( object ) : <EOL> def __init__ ( self , password ) : <EOL> self . password = password <EOL> self . called = <NUM_LIT:0> <EOL> self . exception = None <EOL> @ binding . ffi_callback ( "<STR_LIT>" , <EOL> name = "<STR_LIT>" ) <EOL> def _pem_password_cb ( buf , size , writing , userdata_handle ) : <EOL> """<STR_LIT>""" <EOL> ud = _ffi . from_handle ( userdata_handle ) <EOL> ud . called += <NUM_LIT:1> <EOL> if not ud . password : <EOL> ud . exception = TypeError ( <EOL> "<STR_LIT>" <EOL> ) <EOL> return - <NUM_LIT:1> <EOL> elif len ( ud . password ) < size : <EOL> pw_buf = _ffi . buffer ( buf , size ) <EOL> pw_buf [ : len ( ud . password ) ] = ud . password <EOL> return len ( ud . password ) <EOL> else : <EOL> ud . exception = ValueError ( <EOL> "<STR_LIT>" <EOL> "<STR_LIT>" . format ( size - <NUM_LIT:1> ) <EOL> ) <EOL> return <NUM_LIT:0> <EOL> @ utils . register_interface ( CipherBackend ) <EOL> @ utils . register_interface ( CMACBackend ) <EOL> @ utils . register_interface ( DERSerializationBackend ) <EOL> @ utils . register_interface ( DSABackend ) <EOL> @ utils . register_interface ( EllipticCurveBackend ) <EOL> @ utils . register_interface ( HashBackend ) <EOL> @ utils . register_interface ( HMACBackend ) <EOL> @ utils . register_interface ( PBKDF2HMACBackend ) <EOL> @ utils . register_interface ( RSABackend ) <EOL> @ utils . register_interface ( PEMSerializationBackend ) <EOL> @ utils . register_interface ( X509Backend ) <EOL> class Backend ( object ) : <EOL> """<STR_LIT>""" <EOL> name = "<STR_LIT>" <EOL> def __init__ ( self ) : <EOL> self . _binding = binding . Binding ( ) <EOL> self . _ffi = self . _binding . ffi <EOL> self . _lib = self . _binding . lib <EOL> res = self . _lib . ASN1_STRING_set_default_mask_asc ( b"<STR_LIT>" ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> self . _cipher_registry = { } <EOL> self . _register_default_ciphers ( ) <EOL> self . activate_osrandom_engine ( ) <EOL> def openssl_assert ( self , ok ) : <EOL> return binding . _openssl_assert ( self . _lib , ok ) <EOL> def activate_builtin_random ( self ) : <EOL> e = self . _lib . ENGINE_get_default_RAND ( ) <EOL> if e != self . _ffi . NULL : <EOL> self . _lib . ENGINE_unregister_RAND ( e ) <EOL> self . _lib . RAND_cleanup ( ) <EOL> res = self . _lib . ENGINE_finish ( e ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> def activate_osrandom_engine ( self ) : <EOL> self . activate_builtin_random ( ) <EOL> e = self . _lib . ENGINE_by_id ( self . _binding . _osrandom_engine_id ) <EOL> self . openssl_assert ( e != self . _ffi . NULL ) <EOL> res = self . _lib . ENGINE_init ( e ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> res = self . _lib . ENGINE_set_default_RAND ( e ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> res = self . _lib . ENGINE_free ( e ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> res = self . _lib . ENGINE_finish ( e ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> self . _lib . RAND_cleanup ( ) <EOL> def openssl_version_text ( self ) : <EOL> """<STR_LIT>""" <EOL> return self . _ffi . string ( <EOL> self . _lib . OpenSSL_version ( self . _lib . OPENSSL_VERSION ) <EOL> ) . decode ( "<STR_LIT:ascii>" ) <EOL> def create_hmac_ctx ( self , key , algorithm ) : <EOL> return _HMACContext ( self , key , algorithm ) <EOL> def hash_supported ( self , algorithm ) : <EOL> digest = self . _lib . EVP_get_digestbyname ( algorithm . name . encode ( "<STR_LIT:ascii>" ) ) <EOL> return digest != self . _ffi . NULL <EOL> def hmac_supported ( self , algorithm ) : <EOL> return self . hash_supported ( algorithm ) <EOL> def create_hash_ctx ( self , algorithm ) : <EOL> return _HashContext ( self , algorithm ) <EOL> def cipher_supported ( self , cipher , mode ) : <EOL> if self . _evp_cipher_supported ( cipher , mode ) : <EOL> return True <EOL> elif isinstance ( mode , CTR ) and isinstance ( cipher , AES ) : <EOL> return True <EOL> else : <EOL> return False <EOL> def _evp_cipher_supported ( self , cipher , mode ) : <EOL> try : <EOL> adapter = self . _cipher_registry [ type ( cipher ) , type ( mode ) ] <EOL> except KeyError : <EOL> return False <EOL> evp_cipher = adapter ( self , cipher , mode ) <EOL> return self . _ffi . NULL != evp_cipher <EOL> def register_cipher_adapter ( self , cipher_cls , mode_cls , adapter ) : <EOL> if ( cipher_cls , mode_cls ) in self . _cipher_registry : <EOL> raise ValueError ( "<STR_LIT>" . format ( <EOL> cipher_cls , mode_cls ) <EOL> ) <EOL> self . _cipher_registry [ cipher_cls , mode_cls ] = adapter <EOL> def _register_default_ciphers ( self ) : <EOL> for mode_cls in [ CBC , CTR , ECB , OFB , CFB , CFB8 ] : <EOL> self . register_cipher_adapter ( <EOL> AES , <EOL> mode_cls , <EOL> GetCipherByName ( "<STR_LIT>" ) <EOL> ) <EOL> for mode_cls in [ CBC , CTR , ECB , OFB , CFB ] : <EOL> self . register_cipher_adapter ( <EOL> Camellia , <EOL> mode_cls , <EOL> GetCipherByName ( "<STR_LIT>" ) <EOL> ) <EOL> for mode_cls in [ CBC , CFB , CFB8 , OFB ] : <EOL> self . register_cipher_adapter ( <EOL> TripleDES , <EOL> mode_cls , <EOL> GetCipherByName ( "<STR_LIT>" ) <EOL> ) <EOL> self . register_cipher_adapter ( <EOL> TripleDES , <EOL> ECB , <EOL> GetCipherByName ( "<STR_LIT>" ) <EOL> ) <EOL> for mode_cls in [ CBC , CFB , OFB , ECB ] : <EOL> self . register_cipher_adapter ( <EOL> Blowfish , <EOL> mode_cls , <EOL> GetCipherByName ( "<STR_LIT>" ) <EOL> ) <EOL> for mode_cls in [ CBC , CFB , OFB , ECB ] : <EOL> self . register_cipher_adapter ( <EOL> SEED , <EOL> mode_cls , <EOL> GetCipherByName ( "<STR_LIT>" ) <EOL> ) <EOL> for cipher_cls , mode_cls in itertools . product ( <EOL> [ CAST5 , IDEA ] , <EOL> [ CBC , OFB , CFB , ECB ] , <EOL> ) : <EOL> self . register_cipher_adapter ( <EOL> cipher_cls , <EOL> mode_cls , <EOL> GetCipherByName ( "<STR_LIT>" ) <EOL> ) <EOL> self . register_cipher_adapter ( <EOL> ARC4 , <EOL> type ( None ) , <EOL> GetCipherByName ( "<STR_LIT>" ) <EOL> ) <EOL> self . register_cipher_adapter ( <EOL> AES , <EOL> GCM , <EOL> GetCipherByName ( "<STR_LIT>" ) <EOL> ) <EOL> def create_symmetric_encryption_ctx ( self , cipher , mode ) : <EOL> if ( isinstance ( mode , CTR ) and isinstance ( cipher , AES ) and <EOL> not self . _evp_cipher_supported ( cipher , mode ) ) : <EOL> return _AESCTRCipherContext ( self , cipher , mode ) <EOL> else : <EOL> return _CipherContext ( self , cipher , mode , _CipherContext . _ENCRYPT ) <EOL> def create_symmetric_decryption_ctx ( self , cipher , mode ) : <EOL> if ( isinstance ( mode , CTR ) and isinstance ( cipher , AES ) and <EOL> not self . _evp_cipher_supported ( cipher , mode ) ) : <EOL> return _AESCTRCipherContext ( self , cipher , mode ) <EOL> else : <EOL> return _CipherContext ( self , cipher , mode , _CipherContext . _DECRYPT ) <EOL> def pbkdf2_hmac_supported ( self , algorithm ) : <EOL> if self . _lib . Cryptography_HAS_PBKDF2_HMAC : <EOL> return self . hmac_supported ( algorithm ) <EOL> else : <EOL> return isinstance ( algorithm , hashes . SHA1 ) <EOL> def derive_pbkdf2_hmac ( self , algorithm , length , salt , iterations , <EOL> key_material ) : <EOL> buf = self . _ffi . new ( "<STR_LIT>" , length ) <EOL> if self . _lib . Cryptography_HAS_PBKDF2_HMAC : <EOL> evp_md = self . _lib . EVP_get_digestbyname ( <EOL> algorithm . name . encode ( "<STR_LIT:ascii>" ) ) <EOL> self . openssl_assert ( evp_md != self . _ffi . NULL ) <EOL> res = self . _lib . PKCS5_PBKDF2_HMAC ( <EOL> key_material , <EOL> len ( key_material ) , <EOL> salt , <EOL> len ( salt ) , <EOL> iterations , <EOL> evp_md , <EOL> length , <EOL> buf <EOL> ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> else : <EOL> if not isinstance ( algorithm , hashes . SHA1 ) : <EOL> raise UnsupportedAlgorithm ( <EOL> "<STR_LIT>" <EOL> "<STR_LIT>" , <EOL> _Reasons . UNSUPPORTED_HASH <EOL> ) <EOL> res = self . _lib . PKCS5_PBKDF2_HMAC_SHA1 ( <EOL> key_material , <EOL> len ( key_material ) , <EOL> salt , <EOL> len ( salt ) , <EOL> iterations , <EOL> length , <EOL> buf <EOL> ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> return self . _ffi . buffer ( buf ) [ : ] <EOL> def _consume_errors ( self ) : <EOL> return binding . _consume_errors ( self . _lib ) <EOL> def _bn_to_int ( self , bn ) : <EOL> assert bn != self . _ffi . NULL <EOL> if six . PY3 : <EOL> bn_num_bytes = self . _lib . BN_num_bytes ( bn ) <EOL> bin_ptr = self . _ffi . new ( "<STR_LIT>" , bn_num_bytes ) <EOL> bin_len = self . _lib . BN_bn2bin ( bn , bin_ptr ) <EOL> self . openssl_assert ( bin_len >= <NUM_LIT:0> ) <EOL> return int . from_bytes ( self . _ffi . buffer ( bin_ptr ) [ : bin_len ] , "<STR_LIT>" ) <EOL> else : <EOL> hex_cdata = self . _lib . BN_bn2hex ( bn ) <EOL> self . openssl_assert ( hex_cdata != self . _ffi . NULL ) <EOL> hex_str = self . _ffi . string ( hex_cdata ) <EOL> self . _lib . OPENSSL_free ( hex_cdata ) <EOL> return int ( hex_str , <NUM_LIT:16> ) <EOL> def _int_to_bn ( self , num , bn = None ) : <EOL> """<STR_LIT>""" <EOL> assert bn is None or bn != self . _ffi . NULL <EOL> if bn is None : <EOL> bn = self . _ffi . NULL <EOL> if six . PY3 : <EOL> binary = num . to_bytes ( int ( num . bit_length ( ) / <NUM_LIT> + <NUM_LIT:1> ) , "<STR_LIT>" ) <EOL> bn_ptr = self . _lib . BN_bin2bn ( binary , len ( binary ) , bn ) <EOL> self . openssl_assert ( bn_ptr != self . _ffi . NULL ) <EOL> return bn_ptr <EOL> else : <EOL> hex_num = hex ( num ) . rstrip ( "<STR_LIT:L>" ) . lstrip ( "<STR_LIT>" ) . encode ( "<STR_LIT:ascii>" ) or b"<STR_LIT:0>" <EOL> bn_ptr = self . _ffi . new ( "<STR_LIT>" ) <EOL> bn_ptr [ <NUM_LIT:0> ] = bn <EOL> res = self . _lib . BN_hex2bn ( bn_ptr , hex_num ) <EOL> self . openssl_assert ( res != <NUM_LIT:0> ) <EOL> self . openssl_assert ( bn_ptr [ <NUM_LIT:0> ] != self . _ffi . NULL ) <EOL> return bn_ptr [ <NUM_LIT:0> ] <EOL> def generate_rsa_private_key ( self , public_exponent , key_size ) : <EOL> rsa . _verify_rsa_parameters ( public_exponent , key_size ) <EOL> rsa_cdata = self . _lib . RSA_new ( ) <EOL> self . openssl_assert ( rsa_cdata != self . _ffi . NULL ) <EOL> rsa_cdata = self . _ffi . gc ( rsa_cdata , self . _lib . RSA_free ) <EOL> bn = self . _int_to_bn ( public_exponent ) <EOL> bn = self . _ffi . gc ( bn , self . _lib . BN_free ) <EOL> res = self . _lib . RSA_generate_key_ex ( <EOL> rsa_cdata , key_size , bn , self . _ffi . NULL <EOL> ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> evp_pkey = self . _rsa_cdata_to_evp_pkey ( rsa_cdata ) <EOL> return _RSAPrivateKey ( self , rsa_cdata , evp_pkey ) <EOL> def generate_rsa_parameters_supported ( self , public_exponent , key_size ) : <EOL> return ( public_exponent >= <NUM_LIT:3> and public_exponent & <NUM_LIT:1> != <NUM_LIT:0> and <EOL> key_size >= <NUM_LIT> ) <EOL> def load_rsa_private_numbers ( self , numbers ) : <EOL> rsa . _check_private_key_components ( <EOL> numbers . p , <EOL> numbers . q , <EOL> numbers . d , <EOL> numbers . dmp1 , <EOL> numbers . dmq1 , <EOL> numbers . iqmp , <EOL> numbers . public_numbers . e , <EOL> numbers . public_numbers . n <EOL> ) <EOL> rsa_cdata = self . _lib . RSA_new ( ) <EOL> self . openssl_assert ( rsa_cdata != self . _ffi . NULL ) <EOL> rsa_cdata = self . _ffi . gc ( rsa_cdata , self . _lib . RSA_free ) <EOL> rsa_cdata . p = self . _int_to_bn ( numbers . p ) <EOL> rsa_cdata . q = self . _int_to_bn ( numbers . q ) <EOL> rsa_cdata . d = self . _int_to_bn ( numbers . d ) <EOL> rsa_cdata . dmp1 = self . _int_to_bn ( numbers . dmp1 ) <EOL> rsa_cdata . dmq1 = self . _int_to_bn ( numbers . dmq1 ) <EOL> rsa_cdata . iqmp = self . _int_to_bn ( numbers . iqmp ) <EOL> rsa_cdata . e = self . _int_to_bn ( numbers . public_numbers . e ) <EOL> rsa_cdata . n = self . _int_to_bn ( numbers . public_numbers . n ) <EOL> res = self . _lib . RSA_blinding_on ( rsa_cdata , self . _ffi . NULL ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> evp_pkey = self . _rsa_cdata_to_evp_pkey ( rsa_cdata ) <EOL> return _RSAPrivateKey ( self , rsa_cdata , evp_pkey ) <EOL> def load_rsa_public_numbers ( self , numbers ) : <EOL> rsa . _check_public_key_components ( numbers . e , numbers . n ) <EOL> rsa_cdata = self . _lib . RSA_new ( ) <EOL> self . openssl_assert ( rsa_cdata != self . _ffi . NULL ) <EOL> rsa_cdata = self . _ffi . gc ( rsa_cdata , self . _lib . RSA_free ) <EOL> rsa_cdata . e = self . _int_to_bn ( numbers . e ) <EOL> rsa_cdata . n = self . _int_to_bn ( numbers . n ) <EOL> res = self . _lib . RSA_blinding_on ( rsa_cdata , self . _ffi . NULL ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> evp_pkey = self . _rsa_cdata_to_evp_pkey ( rsa_cdata ) <EOL> return _RSAPublicKey ( self , rsa_cdata , evp_pkey ) <EOL> def _create_evp_pkey_gc ( self ) : <EOL> evp_pkey = self . _lib . EVP_PKEY_new ( ) <EOL> self . openssl_assert ( evp_pkey != self . _ffi . NULL ) <EOL> evp_pkey = self . _ffi . gc ( evp_pkey , self . _lib . EVP_PKEY_free ) <EOL> return evp_pkey <EOL> def _rsa_cdata_to_evp_pkey ( self , rsa_cdata ) : <EOL> evp_pkey = self . _create_evp_pkey_gc ( ) <EOL> res = self . _lib . EVP_PKEY_set1_RSA ( evp_pkey , rsa_cdata ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> return evp_pkey <EOL> def _bytes_to_bio ( self , data ) : <EOL> """<STR_LIT>""" <EOL> data_char_p = self . _ffi . new ( "<STR_LIT>" , data ) <EOL> bio = self . _lib . BIO_new_mem_buf ( <EOL> data_char_p , len ( data ) <EOL> ) <EOL> self . openssl_assert ( bio != self . _ffi . NULL ) <EOL> return _MemoryBIO ( self . _ffi . gc ( bio , self . _lib . BIO_free ) , data_char_p ) <EOL> def _create_mem_bio_gc ( self ) : <EOL> """<STR_LIT>""" <EOL> bio_method = self . _lib . BIO_s_mem ( ) <EOL> self . openssl_assert ( bio_method != self . _ffi . NULL ) <EOL> bio = self . _lib . BIO_new ( bio_method ) <EOL> self . openssl_assert ( bio != self . _ffi . NULL ) <EOL> bio = self . _ffi . gc ( bio , self . _lib . BIO_free ) <EOL> return bio <EOL> def _read_mem_bio ( self , bio ) : <EOL> """<STR_LIT>""" <EOL> buf = self . _ffi . new ( "<STR_LIT>" ) <EOL> buf_len = self . _lib . BIO_get_mem_data ( bio , buf ) <EOL> self . openssl_assert ( buf_len > <NUM_LIT:0> ) <EOL> self . openssl_assert ( buf [ <NUM_LIT:0> ] != self . _ffi . NULL ) <EOL> bio_data = self . _ffi . buffer ( buf [ <NUM_LIT:0> ] , buf_len ) [ : ] <EOL> return bio_data <EOL> def _evp_pkey_to_private_key ( self , evp_pkey ) : <EOL> """<STR_LIT>""" <EOL> key_type = self . _lib . Cryptography_EVP_PKEY_id ( evp_pkey ) <EOL> if key_type == self . _lib . EVP_PKEY_RSA : <EOL> rsa_cdata = self . _lib . EVP_PKEY_get1_RSA ( evp_pkey ) <EOL> self . openssl_assert ( rsa_cdata != self . _ffi . NULL ) <EOL> rsa_cdata = self . _ffi . gc ( rsa_cdata , self . _lib . RSA_free ) <EOL> return _RSAPrivateKey ( self , rsa_cdata , evp_pkey ) <EOL> elif key_type == self . _lib . EVP_PKEY_DSA : <EOL> dsa_cdata = self . _lib . EVP_PKEY_get1_DSA ( evp_pkey ) <EOL> self . openssl_assert ( dsa_cdata != self . _ffi . NULL ) <EOL> dsa_cdata = self . _ffi . gc ( dsa_cdata , self . _lib . DSA_free ) <EOL> return _DSAPrivateKey ( self , dsa_cdata , evp_pkey ) <EOL> elif ( self . _lib . Cryptography_HAS_EC == <NUM_LIT:1> and <EOL> key_type == self . _lib . EVP_PKEY_EC ) : <EOL> ec_cdata = self . _lib . EVP_PKEY_get1_EC_KEY ( evp_pkey ) <EOL> self . openssl_assert ( ec_cdata != self . _ffi . NULL ) <EOL> ec_cdata = self . _ffi . gc ( ec_cdata , self . _lib . EC_KEY_free ) <EOL> return _EllipticCurvePrivateKey ( self , ec_cdata , evp_pkey ) <EOL> else : <EOL> raise UnsupportedAlgorithm ( "<STR_LIT>" ) <EOL> def _evp_pkey_to_public_key ( self , evp_pkey ) : <EOL> """<STR_LIT>""" <EOL> key_type = self . _lib . Cryptography_EVP_PKEY_id ( evp_pkey ) <EOL> if key_type == self . _lib . EVP_PKEY_RSA : <EOL> rsa_cdata = self . _lib . EVP_PKEY_get1_RSA ( evp_pkey ) <EOL> self . openssl_assert ( rsa_cdata != self . _ffi . NULL ) <EOL> rsa_cdata = self . _ffi . gc ( rsa_cdata , self . _lib . RSA_free ) <EOL> return _RSAPublicKey ( self , rsa_cdata , evp_pkey ) <EOL> elif key_type == self . _lib . EVP_PKEY_DSA : <EOL> dsa_cdata = self . _lib . EVP_PKEY_get1_DSA ( evp_pkey ) <EOL> self . openssl_assert ( dsa_cdata != self . _ffi . NULL ) <EOL> dsa_cdata = self . _ffi . gc ( dsa_cdata , self . _lib . DSA_free ) <EOL> return _DSAPublicKey ( self , dsa_cdata , evp_pkey ) <EOL> elif ( self . _lib . Cryptography_HAS_EC == <NUM_LIT:1> and <EOL> key_type == self . _lib . EVP_PKEY_EC ) : <EOL> ec_cdata = self . _lib . EVP_PKEY_get1_EC_KEY ( evp_pkey ) <EOL> self . openssl_assert ( ec_cdata != self . _ffi . NULL ) <EOL> ec_cdata = self . _ffi . gc ( ec_cdata , self . _lib . EC_KEY_free ) <EOL> return _EllipticCurvePublicKey ( self , ec_cdata , evp_pkey ) <EOL> else : <EOL> raise UnsupportedAlgorithm ( "<STR_LIT>" ) <EOL> def _pem_password_cb ( self , password ) : <EOL> """<STR_LIT>""" <EOL> userdata = _PasswordUserdata ( password = password ) <EOL> return _pem_password_cb , userdata <EOL> def _mgf1_hash_supported ( self , algorithm ) : <EOL> if self . _lib . Cryptography_HAS_MGF1_MD : <EOL> return self . hash_supported ( algorithm ) <EOL> else : <EOL> return isinstance ( algorithm , hashes . SHA1 ) <EOL> def rsa_padding_supported ( self , padding ) : <EOL> if isinstance ( padding , PKCS1v15 ) : <EOL> return True <EOL> elif isinstance ( padding , PSS ) and isinstance ( padding . _mgf , MGF1 ) : <EOL> return self . _mgf1_hash_supported ( padding . _mgf . _algorithm ) <EOL> elif isinstance ( padding , OAEP ) and isinstance ( padding . _mgf , MGF1 ) : <EOL> return isinstance ( padding . _mgf . _algorithm , hashes . SHA1 ) <EOL> else : <EOL> return False <EOL> def generate_dsa_parameters ( self , key_size ) : <EOL> if key_size not in ( <NUM_LIT> , <NUM_LIT> , <NUM_LIT> ) : <EOL> raise ValueError ( "<STR_LIT>" ) <EOL> if ( self . _lib . OPENSSL_VERSION_NUMBER < <NUM_LIT> and <EOL> key_size > <NUM_LIT> ) : <EOL> raise ValueError ( <EOL> "<STR_LIT>" <EOL> "<STR_LIT>" ) <EOL> ctx = self . _lib . DSA_new ( ) <EOL> self . openssl_assert ( ctx != self . _ffi . NULL ) <EOL> ctx = self . _ffi . gc ( ctx , self . _lib . DSA_free ) <EOL> res = self . _lib . DSA_generate_parameters_ex ( <EOL> ctx , key_size , self . _ffi . NULL , <NUM_LIT:0> , <EOL> self . _ffi . NULL , self . _ffi . NULL , self . _ffi . NULL <EOL> ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> return _DSAParameters ( self , ctx ) <EOL> def generate_dsa_private_key ( self , parameters ) : <EOL> ctx = self . _lib . DSA_new ( ) <EOL> self . openssl_assert ( ctx != self . _ffi . NULL ) <EOL> ctx = self . _ffi . gc ( ctx , self . _lib . DSA_free ) <EOL> ctx . p = self . _lib . BN_dup ( parameters . _dsa_cdata . p ) <EOL> ctx . q = self . _lib . BN_dup ( parameters . _dsa_cdata . q ) <EOL> ctx . g = self . _lib . BN_dup ( parameters . _dsa_cdata . g ) <EOL> self . _lib . DSA_generate_key ( ctx ) <EOL> evp_pkey = self . _dsa_cdata_to_evp_pkey ( ctx ) <EOL> return _DSAPrivateKey ( self , ctx , evp_pkey ) <EOL> def generate_dsa_private_key_and_parameters ( self , key_size ) : <EOL> parameters = self . generate_dsa_parameters ( key_size ) <EOL> return self . generate_dsa_private_key ( parameters ) <EOL> def load_dsa_private_numbers ( self , numbers ) : <EOL> dsa . _check_dsa_private_numbers ( numbers ) <EOL> parameter_numbers = numbers . public_numbers . parameter_numbers <EOL> dsa_cdata = self . _lib . DSA_new ( ) <EOL> self . openssl_assert ( dsa_cdata != self . _ffi . NULL ) <EOL> dsa_cdata = self . _ffi . gc ( dsa_cdata , self . _lib . DSA_free ) <EOL> dsa_cdata . p = self . _int_to_bn ( parameter_numbers . p ) <EOL> dsa_cdata . q = self . _int_to_bn ( parameter_numbers . q ) <EOL> dsa_cdata . g = self . _int_to_bn ( parameter_numbers . g ) <EOL> dsa_cdata . pub_key = self . _int_to_bn ( numbers . public_numbers . y ) <EOL> dsa_cdata . priv_key = self . _int_to_bn ( numbers . x ) <EOL> evp_pkey = self . _dsa_cdata_to_evp_pkey ( dsa_cdata ) <EOL> return _DSAPrivateKey ( self , dsa_cdata , evp_pkey ) <EOL> def load_dsa_public_numbers ( self , numbers ) : <EOL> dsa . _check_dsa_parameters ( numbers . parameter_numbers ) <EOL> dsa_cdata = self . _lib . DSA_new ( ) <EOL> self . openssl_assert ( dsa_cdata != self . _ffi . NULL ) <EOL> dsa_cdata = self . _ffi . gc ( dsa_cdata , self . _lib . DSA_free ) <EOL> dsa_cdata . p = self . _int_to_bn ( numbers . parameter_numbers . p ) <EOL> dsa_cdata . q = self . _int_to_bn ( numbers . parameter_numbers . q ) <EOL> dsa_cdata . g = self . _int_to_bn ( numbers . parameter_numbers . g ) <EOL> dsa_cdata . pub_key = self . _int_to_bn ( numbers . y ) <EOL> evp_pkey = self . _dsa_cdata_to_evp_pkey ( dsa_cdata ) <EOL> return _DSAPublicKey ( self , dsa_cdata , evp_pkey ) <EOL> def load_dsa_parameter_numbers ( self , numbers ) : <EOL> dsa . _check_dsa_parameters ( numbers ) <EOL> dsa_cdata = self . _lib . DSA_new ( ) <EOL> self . openssl_assert ( dsa_cdata != self . _ffi . NULL ) <EOL> dsa_cdata = self . _ffi . gc ( dsa_cdata , self . _lib . DSA_free ) <EOL> dsa_cdata . p = self . _int_to_bn ( numbers . p ) <EOL> dsa_cdata . q = self . _int_to_bn ( numbers . q ) <EOL> dsa_cdata . g = self . _int_to_bn ( numbers . g ) <EOL> return _DSAParameters ( self , dsa_cdata ) <EOL> def _dsa_cdata_to_evp_pkey ( self , dsa_cdata ) : <EOL> evp_pkey = self . _create_evp_pkey_gc ( ) <EOL> res = self . _lib . EVP_PKEY_set1_DSA ( evp_pkey , dsa_cdata ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> return evp_pkey <EOL> def dsa_hash_supported ( self , algorithm ) : <EOL> if self . _lib . OPENSSL_VERSION_NUMBER < <NUM_LIT> : <EOL> return isinstance ( algorithm , hashes . SHA1 ) <EOL> else : <EOL> return self . hash_supported ( algorithm ) <EOL> def dsa_parameters_supported ( self , p , q , g ) : <EOL> if self . _lib . OPENSSL_VERSION_NUMBER < <NUM_LIT> : <EOL> return utils . bit_length ( p ) <= <NUM_LIT> and utils . bit_length ( q ) <= <NUM_LIT> <EOL> else : <EOL> return True <EOL> def cmac_algorithm_supported ( self , algorithm ) : <EOL> return ( <EOL> self . _lib . Cryptography_HAS_CMAC == <NUM_LIT:1> and <EOL> self . cipher_supported ( <EOL> algorithm , CBC ( b"<STR_LIT:\x00>" * algorithm . block_size ) <EOL> ) <EOL> ) <EOL> def create_cmac_ctx ( self , algorithm ) : <EOL> return _CMACContext ( self , algorithm ) <EOL> def create_x509_csr ( self , builder , private_key , algorithm ) : <EOL> if not isinstance ( algorithm , hashes . HashAlgorithm ) : <EOL> raise TypeError ( '<STR_LIT>' ) <EOL> if self . _lib . OPENSSL_VERSION_NUMBER <= <NUM_LIT> : <EOL> if isinstance ( private_key , _DSAPrivateKey ) : <EOL> raise NotImplementedError ( <EOL> "<STR_LIT>" <EOL> "<STR_LIT>" <EOL> ) <EOL> if isinstance ( private_key , _EllipticCurvePrivateKey ) : <EOL> raise NotImplementedError ( <EOL> "<STR_LIT>" <EOL> "<STR_LIT>" <EOL> ) <EOL> evp_md = self . _lib . EVP_get_digestbyname ( <EOL> algorithm . name . encode ( '<STR_LIT:ascii>' ) <EOL> ) <EOL> self . openssl_assert ( evp_md != self . _ffi . NULL ) <EOL> x509_req = self . _lib . X509_REQ_new ( ) <EOL> self . openssl_assert ( x509_req != self . _ffi . NULL ) <EOL> x509_req = self . _ffi . gc ( x509_req , self . _lib . X509_REQ_free ) <EOL> res = self . _lib . X509_REQ_set_version ( x509_req , x509 . Version . v1 . value ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> res = self . _lib . X509_REQ_set_subject_name ( <EOL> x509_req , _encode_name_gc ( self , builder . _subject_name ) <EOL> ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> public_key = private_key . public_key ( ) <EOL> res = self . _lib . X509_REQ_set_pubkey ( <EOL> x509_req , public_key . _evp_pkey <EOL> ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> sk_extension = self . _lib . sk_X509_EXTENSION_new_null ( ) <EOL> self . openssl_assert ( sk_extension != self . _ffi . NULL ) <EOL> sk_extension = self . _ffi . gc ( <EOL> sk_extension , self . _lib . sk_X509_EXTENSION_free <EOL> ) <EOL> self . _create_x509_extensions ( <EOL> extensions = builder . _extensions , <EOL> handlers = _EXTENSION_ENCODE_HANDLERS , <EOL> x509_obj = sk_extension , <EOL> add_func = self . _lib . sk_X509_EXTENSION_insert , <EOL> gc = False <EOL> ) <EOL> res = self . _lib . X509_REQ_add_extensions ( x509_req , sk_extension ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> res = self . _lib . X509_REQ_sign ( <EOL> x509_req , private_key . _evp_pkey , evp_md <EOL> ) <EOL> if res == <NUM_LIT:0> : <EOL> errors = self . _consume_errors ( ) <EOL> self . openssl_assert ( errors [ <NUM_LIT:0> ] [ <NUM_LIT:1> ] == self . _lib . ERR_LIB_RSA ) <EOL> self . openssl_assert ( <EOL> errors [ <NUM_LIT:0> ] [ <NUM_LIT:3> ] == self . _lib . RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY <EOL> ) <EOL> raise ValueError ( "<STR_LIT>" ) <EOL> return _CertificateSigningRequest ( self , x509_req ) <EOL> def create_x509_certificate ( self , builder , private_key , algorithm ) : <EOL> if not isinstance ( builder , x509 . CertificateBuilder ) : <EOL> raise TypeError ( '<STR_LIT>' ) <EOL> if not isinstance ( algorithm , hashes . HashAlgorithm ) : <EOL> raise TypeError ( '<STR_LIT>' ) <EOL> if self . _lib . OPENSSL_VERSION_NUMBER <= <NUM_LIT> : <EOL> if isinstance ( private_key , _DSAPrivateKey ) : <EOL> raise NotImplementedError ( <EOL> "<STR_LIT>" <EOL> "<STR_LIT>" <EOL> ) <EOL> if isinstance ( private_key , _EllipticCurvePrivateKey ) : <EOL> raise NotImplementedError ( <EOL> "<STR_LIT>" <EOL> "<STR_LIT>" <EOL> ) <EOL> evp_md = self . _lib . EVP_get_digestbyname ( <EOL> algorithm . name . encode ( '<STR_LIT:ascii>' ) <EOL> ) <EOL> self . openssl_assert ( evp_md != self . _ffi . NULL ) <EOL> x509_cert = self . _lib . X509_new ( ) <EOL> x509_cert = self . _ffi . gc ( x509_cert , backend . _lib . X509_free ) <EOL> res = self . _lib . X509_set_version ( x509_cert , builder . _version . value ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> res = self . _lib . X509_set_subject_name ( <EOL> x509_cert , _encode_name_gc ( self , list ( builder . _subject_name ) ) <EOL> ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> res = self . _lib . X509_set_pubkey ( <EOL> x509_cert , builder . _public_key . _evp_pkey <EOL> ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> serial_number = _encode_asn1_int_gc ( self , builder . _serial_number ) <EOL> res = self . _lib . X509_set_serialNumber ( x509_cert , serial_number ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> res = self . _lib . ASN1_TIME_set ( <EOL> self . _lib . X509_get_notBefore ( x509_cert ) , <EOL> calendar . timegm ( builder . _not_valid_before . timetuple ( ) ) <EOL> ) <EOL> self . openssl_assert ( res != self . _ffi . NULL ) <EOL> res = self . _lib . ASN1_TIME_set ( <EOL> self . _lib . X509_get_notAfter ( x509_cert ) , <EOL> calendar . timegm ( builder . _not_valid_after . timetuple ( ) ) <EOL> ) <EOL> self . openssl_assert ( res != self . _ffi . NULL ) <EOL> self . _create_x509_extensions ( <EOL> extensions = builder . _extensions , <EOL> handlers = _EXTENSION_ENCODE_HANDLERS , <EOL> x509_obj = x509_cert , <EOL> add_func = self . _lib . X509_add_ext , <EOL> gc = True <EOL> ) <EOL> res = self . _lib . X509_set_issuer_name ( <EOL> x509_cert , _encode_name_gc ( self , list ( builder . _issuer_name ) ) <EOL> ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> res = self . _lib . X509_sign ( <EOL> x509_cert , private_key . _evp_pkey , evp_md <EOL> ) <EOL> if res == <NUM_LIT:0> : <EOL> errors = self . _consume_errors ( ) <EOL> self . openssl_assert ( errors [ <NUM_LIT:0> ] [ <NUM_LIT:1> ] == self . _lib . ERR_LIB_RSA ) <EOL> self . openssl_assert ( <EOL> errors [ <NUM_LIT:0> ] [ <NUM_LIT:3> ] == self . _lib . RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY <EOL> ) <EOL> raise ValueError ( "<STR_LIT>" ) <EOL> return _Certificate ( self , x509_cert ) <EOL> def create_x509_crl ( self , builder , private_key , algorithm ) : <EOL> if not isinstance ( builder , x509 . CertificateRevocationListBuilder ) : <EOL> raise TypeError ( '<STR_LIT>' ) <EOL> if not isinstance ( algorithm , hashes . HashAlgorithm ) : <EOL> raise TypeError ( '<STR_LIT>' ) <EOL> if self . _lib . OPENSSL_VERSION_NUMBER <= <NUM_LIT> : <EOL> if isinstance ( private_key , _DSAPrivateKey ) : <EOL> raise NotImplementedError ( <EOL> "<STR_LIT>" <EOL> "<STR_LIT>" <EOL> ) <EOL> if isinstance ( private_key , _EllipticCurvePrivateKey ) : <EOL> raise NotImplementedError ( <EOL> "<STR_LIT>" <EOL> "<STR_LIT>" <EOL> ) <EOL> evp_md = self . _lib . EVP_get_digestbyname ( <EOL> algorithm . name . encode ( '<STR_LIT:ascii>' ) <EOL> ) <EOL> self . openssl_assert ( evp_md != self . _ffi . NULL ) <EOL> x509_crl = self . _lib . X509_CRL_new ( ) <EOL> x509_crl = self . _ffi . gc ( x509_crl , backend . _lib . X509_CRL_free ) <EOL> res = self . _lib . X509_CRL_set_version ( x509_crl , <NUM_LIT:1> ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> res = self . _lib . X509_CRL_set_issuer_name ( <EOL> x509_crl , _encode_name_gc ( self , list ( builder . _issuer_name ) ) <EOL> ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> last_update = self . _lib . ASN1_TIME_set ( <EOL> self . _ffi . NULL , calendar . timegm ( builder . _last_update . timetuple ( ) ) <EOL> ) <EOL> self . openssl_assert ( last_update != self . _ffi . NULL ) <EOL> last_update = self . _ffi . gc ( last_update , self . _lib . ASN1_TIME_free ) <EOL> res = self . _lib . X509_CRL_set_lastUpdate ( x509_crl , last_update ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> next_update = self . _lib . ASN1_TIME_set ( <EOL> self . _ffi . NULL , calendar . timegm ( builder . _next_update . timetuple ( ) ) <EOL> ) <EOL> self . openssl_assert ( next_update != self . _ffi . NULL ) <EOL> next_update = self . _ffi . gc ( next_update , self . _lib . ASN1_TIME_free ) <EOL> res = self . _lib . X509_CRL_set_nextUpdate ( x509_crl , next_update ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> self . _create_x509_extensions ( <EOL> extensions = builder . _extensions , <EOL> handlers = _CRL_EXTENSION_ENCODE_HANDLERS , <EOL> x509_obj = x509_crl , <EOL> add_func = self . _lib . X509_CRL_add_ext , <EOL> gc = True <EOL> ) <EOL> for revoked_cert in builder . _revoked_certificates : <EOL> revoked = self . _lib . Cryptography_X509_REVOKED_dup ( <EOL> revoked_cert . _x509_revoked <EOL> ) <EOL> self . openssl_assert ( revoked != self . _ffi . NULL ) <EOL> res = self . _lib . X509_CRL_add0_revoked ( x509_crl , revoked ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> res = self . _lib . X509_CRL_sign ( <EOL> x509_crl , private_key . _evp_pkey , evp_md <EOL> ) <EOL> if res == <NUM_LIT:0> : <EOL> errors = self . _consume_errors ( ) <EOL> self . openssl_assert ( errors [ <NUM_LIT:0> ] [ <NUM_LIT:1> ] == self . _lib . ERR_LIB_RSA ) <EOL> self . openssl_assert ( <EOL> errors [ <NUM_LIT:0> ] [ <NUM_LIT:3> ] == self . _lib . RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY <EOL> ) <EOL> raise ValueError ( "<STR_LIT>" ) <EOL> return _CertificateRevocationList ( self , x509_crl ) <EOL> def _create_x509_extensions ( self , extensions , handlers , x509_obj , <EOL> add_func , gc ) : <EOL> for i , extension in enumerate ( extensions ) : <EOL> x509_extension = self . _create_x509_extension ( <EOL> handlers , extension <EOL> ) <EOL> self . openssl_assert ( x509_extension != self . _ffi . NULL ) <EOL> if gc : <EOL> x509_extension = self . _ffi . gc ( <EOL> x509_extension , self . _lib . X509_EXTENSION_free <EOL> ) <EOL> res = add_func ( x509_obj , x509_extension , i ) <EOL> self . openssl_assert ( res >= <NUM_LIT:1> ) <EOL> def _create_x509_extension ( self , handlers , extension ) : <EOL> if isinstance ( extension . value , x509 . UnrecognizedExtension ) : <EOL> obj = _txt2obj_gc ( self , extension . oid . dotted_string ) <EOL> value = _encode_asn1_str_gc ( <EOL> self , extension . value . value , len ( extension . value . value ) <EOL> ) <EOL> return self . _lib . X509_EXTENSION_create_by_OBJ ( <EOL> self . _ffi . NULL , <EOL> obj , <EOL> <NUM_LIT:1> if extension . critical else <NUM_LIT:0> , <EOL> value <EOL> ) <EOL> else : <EOL> try : <EOL> encode = handlers [ extension . oid ] <EOL> except KeyError : <EOL> raise NotImplementedError ( <EOL> '<STR_LIT>' . format ( extension . oid ) <EOL> ) <EOL> ext_struct = encode ( self , extension . value ) <EOL> nid = self . _lib . OBJ_txt2nid ( <EOL> extension . oid . dotted_string . encode ( "<STR_LIT:ascii>" ) <EOL> ) <EOL> backend . openssl_assert ( nid != self . _lib . NID_undef ) <EOL> x509_extension = self . _lib . X509V3_EXT_i2d ( <EOL> nid , <NUM_LIT:1> if extension . critical else <NUM_LIT:0> , ext_struct <EOL> ) <EOL> if ( <EOL> x509_extension == self . _ffi . NULL and <EOL> extension . oid == x509 . OID_CERTIFICATE_ISSUER <EOL> ) : <EOL> self . _consume_errors ( ) <EOL> pp = backend . _ffi . new ( "<STR_LIT>" ) <EOL> r = self . _lib . i2d_GENERAL_NAMES ( ext_struct , pp ) <EOL> backend . openssl_assert ( r > <NUM_LIT:0> ) <EOL> pp = backend . _ffi . gc ( <EOL> pp , <EOL> lambda pointer : backend . _lib . OPENSSL_free ( pointer [ <NUM_LIT:0> ] ) <EOL> ) <EOL> obj = _txt2obj_gc ( self , extension . oid . dotted_string ) <EOL> return self . _lib . X509_EXTENSION_create_by_OBJ ( <EOL> self . _ffi . NULL , <EOL> obj , <EOL> <NUM_LIT:1> if extension . critical else <NUM_LIT:0> , <EOL> _encode_asn1_str_gc ( self , pp [ <NUM_LIT:0> ] , r ) <EOL> ) <EOL> return x509_extension <EOL> def create_x509_revoked_certificate ( self , builder ) : <EOL> if not isinstance ( builder , x509 . RevokedCertificateBuilder ) : <EOL> raise TypeError ( '<STR_LIT>' ) <EOL> x509_revoked = self . _lib . X509_REVOKED_new ( ) <EOL> self . openssl_assert ( x509_revoked != self . _ffi . NULL ) <EOL> x509_revoked = self . _ffi . gc ( x509_revoked , self . _lib . X509_REVOKED_free ) <EOL> serial_number = _encode_asn1_int_gc ( self , builder . _serial_number ) <EOL> res = self . _lib . X509_REVOKED_set_serialNumber ( <EOL> x509_revoked , serial_number <EOL> ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> rev_date = self . _lib . ASN1_TIME_set ( <EOL> self . _ffi . NULL , <EOL> calendar . timegm ( builder . _revocation_date . timetuple ( ) ) <EOL> ) <EOL> self . openssl_assert ( rev_date != self . _ffi . NULL ) <EOL> rev_date = self . _ffi . gc ( rev_date , self . _lib . ASN1_TIME_free ) <EOL> res = self . _lib . X509_REVOKED_set_revocationDate ( x509_revoked , rev_date ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> self . _create_x509_extensions ( <EOL> extensions = builder . _extensions , <EOL> handlers = _CRL_ENTRY_EXTENSION_ENCODE_HANDLERS , <EOL> x509_obj = x509_revoked , <EOL> add_func = self . _lib . X509_REVOKED_add_ext , <EOL> gc = True <EOL> ) <EOL> return _RevokedCertificate ( self , None , x509_revoked ) <EOL> def load_pem_private_key ( self , data , password ) : <EOL> return self . _load_key ( <EOL> self . _lib . PEM_read_bio_PrivateKey , <EOL> self . _evp_pkey_to_private_key , <EOL> data , <EOL> password , <EOL> ) <EOL> def load_pem_public_key ( self , data ) : <EOL> mem_bio = self . _bytes_to_bio ( data ) <EOL> evp_pkey = self . _lib . PEM_read_bio_PUBKEY ( <EOL> mem_bio . bio , self . _ffi . NULL , self . _ffi . NULL , self . _ffi . NULL <EOL> ) <EOL> if evp_pkey != self . _ffi . NULL : <EOL> evp_pkey = self . _ffi . gc ( evp_pkey , self . _lib . EVP_PKEY_free ) <EOL> return self . _evp_pkey_to_public_key ( evp_pkey ) <EOL> else : <EOL> self . _consume_errors ( ) <EOL> res = self . _lib . BIO_reset ( mem_bio . bio ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> rsa_cdata = self . _lib . PEM_read_bio_RSAPublicKey ( <EOL> mem_bio . bio , self . _ffi . NULL , self . _ffi . NULL , self . _ffi . NULL <EOL> ) <EOL> if rsa_cdata != self . _ffi . NULL : <EOL> rsa_cdata = self . _ffi . gc ( rsa_cdata , self . _lib . RSA_free ) <EOL> evp_pkey = self . _rsa_cdata_to_evp_pkey ( rsa_cdata ) <EOL> return _RSAPublicKey ( self , rsa_cdata , evp_pkey ) <EOL> else : <EOL> self . _handle_key_loading_error ( ) <EOL> def load_der_private_key ( self , data , password ) : <EOL> bio_data = self . _bytes_to_bio ( data ) <EOL> key = self . _evp_pkey_from_der_traditional_key ( bio_data , password ) <EOL> if not key : <EOL> res = self . _lib . BIO_reset ( bio_data . bio ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> key = self . _evp_pkey_from_der_unencrypted_pkcs8 ( bio_data , password ) <EOL> if key : <EOL> return self . _evp_pkey_to_private_key ( key ) <EOL> else : <EOL> return self . _load_key ( <EOL> self . _lib . d2i_PKCS8PrivateKey_bio , <EOL> self . _evp_pkey_to_private_key , <EOL> data , <EOL> password , <EOL> ) <EOL> def _evp_pkey_from_der_traditional_key ( self , bio_data , password ) : <EOL> key = self . _lib . d2i_PrivateKey_bio ( bio_data . bio , self . _ffi . NULL ) <EOL> if key != self . _ffi . NULL : <EOL> key = self . _ffi . gc ( key , self . _lib . EVP_PKEY_free ) <EOL> if password is not None : <EOL> raise TypeError ( <EOL> "<STR_LIT>" <EOL> ) <EOL> return key <EOL> else : <EOL> self . _consume_errors ( ) <EOL> return None <EOL> def _evp_pkey_from_der_unencrypted_pkcs8 ( self , bio_data , password ) : <EOL> info = self . _lib . d2i_PKCS8_PRIV_KEY_INFO_bio ( <EOL> bio_data . bio , self . _ffi . NULL <EOL> ) <EOL> info = self . _ffi . gc ( info , self . _lib . PKCS8_PRIV_KEY_INFO_free ) <EOL> if info != self . _ffi . NULL : <EOL> key = self . _lib . EVP_PKCS82PKEY ( info ) <EOL> self . openssl_assert ( key != self . _ffi . NULL ) <EOL> key = self . _ffi . gc ( key , self . _lib . EVP_PKEY_free ) <EOL> if password is not None : <EOL> raise TypeError ( <EOL> "<STR_LIT>" <EOL> ) <EOL> return key <EOL> else : <EOL> self . _consume_errors ( ) <EOL> return None <EOL> def load_der_public_key ( self , data ) : <EOL> mem_bio = self . _bytes_to_bio ( data ) <EOL> evp_pkey = self . _lib . d2i_PUBKEY_bio ( mem_bio . bio , self . _ffi . NULL ) <EOL> if evp_pkey != self . _ffi . NULL : <EOL> evp_pkey = self . _ffi . gc ( evp_pkey , self . _lib . EVP_PKEY_free ) <EOL> return self . _evp_pkey_to_public_key ( evp_pkey ) <EOL> else : <EOL> self . _consume_errors ( ) <EOL> res = self . _lib . BIO_reset ( mem_bio . bio ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> rsa_cdata = self . _lib . d2i_RSAPublicKey_bio ( <EOL> mem_bio . bio , self . _ffi . NULL <EOL> ) <EOL> if rsa_cdata != self . _ffi . NULL : <EOL> rsa_cdata = self . _ffi . gc ( rsa_cdata , self . _lib . RSA_free ) <EOL> evp_pkey = self . _rsa_cdata_to_evp_pkey ( rsa_cdata ) <EOL> return _RSAPublicKey ( self , rsa_cdata , evp_pkey ) <EOL> else : <EOL> self . _handle_key_loading_error ( ) <EOL> def load_pem_x509_certificate ( self , data ) : <EOL> mem_bio = self . _bytes_to_bio ( data ) <EOL> x509 = self . _lib . PEM_read_bio_X509 ( <EOL> mem_bio . bio , self . _ffi . NULL , self . _ffi . NULL , self . _ffi . NULL <EOL> ) <EOL> if x509 == self . _ffi . NULL : <EOL> self . _consume_errors ( ) <EOL> raise ValueError ( "<STR_LIT>" ) <EOL> x509 = self . _ffi . gc ( x509 , self . _lib . X509_free ) <EOL> return _Certificate ( self , x509 ) <EOL> def load_der_x509_certificate ( self , data ) : <EOL> mem_bio = self . _bytes_to_bio ( data ) <EOL> x509 = self . _lib . d2i_X509_bio ( mem_bio . bio , self . _ffi . NULL ) <EOL> if x509 == self . _ffi . NULL : <EOL> self . _consume_errors ( ) <EOL> raise ValueError ( "<STR_LIT>" ) <EOL> x509 = self . _ffi . gc ( x509 , self . _lib . X509_free ) <EOL> return _Certificate ( self , x509 ) <EOL> def load_pem_x509_crl ( self , data ) : <EOL> mem_bio = self . _bytes_to_bio ( data ) <EOL> x509_crl = self . _lib . PEM_read_bio_X509_CRL ( <EOL> mem_bio . bio , self . _ffi . NULL , self . _ffi . NULL , self . _ffi . NULL <EOL> ) <EOL> if x509_crl == self . _ffi . NULL : <EOL> self . _consume_errors ( ) <EOL> raise ValueError ( "<STR_LIT>" ) <EOL> x509_crl = self . _ffi . gc ( x509_crl , self . _lib . X509_CRL_free ) <EOL> return _CertificateRevocationList ( self , x509_crl ) <EOL> def load_der_x509_crl ( self , data ) : <EOL> mem_bio = self . _bytes_to_bio ( data ) <EOL> x509_crl = self . _lib . d2i_X509_CRL_bio ( mem_bio . bio , self . _ffi . NULL ) <EOL> if x509_crl == self . _ffi . NULL : <EOL> self . _consume_errors ( ) <EOL> raise ValueError ( "<STR_LIT>" ) <EOL> x509_crl = self . _ffi . gc ( x509_crl , self . _lib . X509_CRL_free ) <EOL> return _CertificateRevocationList ( self , x509_crl ) <EOL> def load_pem_x509_csr ( self , data ) : <EOL> mem_bio = self . _bytes_to_bio ( data ) <EOL> x509_req = self . _lib . PEM_read_bio_X509_REQ ( <EOL> mem_bio . bio , self . _ffi . NULL , self . _ffi . NULL , self . _ffi . NULL <EOL> ) <EOL> if x509_req == self . _ffi . NULL : <EOL> self . _consume_errors ( ) <EOL> raise ValueError ( "<STR_LIT>" ) <EOL> x509_req = self . _ffi . gc ( x509_req , self . _lib . X509_REQ_free ) <EOL> return _CertificateSigningRequest ( self , x509_req ) <EOL> def load_der_x509_csr ( self , data ) : <EOL> mem_bio = self . _bytes_to_bio ( data ) <EOL> x509_req = self . _lib . d2i_X509_REQ_bio ( mem_bio . bio , self . _ffi . NULL ) <EOL> if x509_req == self . _ffi . NULL : <EOL> self . _consume_errors ( ) <EOL> raise ValueError ( "<STR_LIT>" ) <EOL> x509_req = self . _ffi . gc ( x509_req , self . _lib . X509_REQ_free ) <EOL> return _CertificateSigningRequest ( self , x509_req ) <EOL> def _load_key ( self , openssl_read_func , convert_func , data , password ) : <EOL> mem_bio = self . _bytes_to_bio ( data ) <EOL> password_cb , userdata = self . _pem_password_cb ( password ) <EOL> userdata_handle = self . _ffi . new_handle ( userdata ) <EOL> evp_pkey = openssl_read_func ( <EOL> mem_bio . bio , <EOL> self . _ffi . NULL , <EOL> password_cb , <EOL> userdata_handle , <EOL> ) <EOL> if evp_pkey == self . _ffi . NULL : <EOL> if userdata . exception is not None : <EOL> errors = self . _consume_errors ( ) <EOL> self . openssl_assert ( errors ) <EOL> raise userdata . exception <EOL> else : <EOL> self . _handle_key_loading_error ( ) <EOL> evp_pkey = self . _ffi . gc ( evp_pkey , self . _lib . EVP_PKEY_free ) <EOL> if password is not None and userdata . called == <NUM_LIT:0> : <EOL> raise TypeError ( <EOL> "<STR_LIT>" ) <EOL> assert ( <EOL> ( password is not None and userdata . called == <NUM_LIT:1> ) or <EOL> password is None <EOL> ) <EOL> return convert_func ( evp_pkey ) <EOL> def _handle_key_loading_error ( self ) : <EOL> errors = self . _consume_errors ( ) <EOL> if not errors : <EOL> raise ValueError ( "<STR_LIT>" ) <EOL> elif errors [ <NUM_LIT:0> ] [ <NUM_LIT:1> : ] in ( <EOL> ( <EOL> self . _lib . ERR_LIB_EVP , <EOL> self . _lib . EVP_F_EVP_DECRYPTFINAL_EX , <EOL> self . _lib . EVP_R_BAD_DECRYPT <EOL> ) , <EOL> ( <EOL> self . _lib . ERR_LIB_PKCS12 , <EOL> self . _lib . PKCS12_F_PKCS12_PBE_CRYPT , <EOL> self . _lib . PKCS12_R_PKCS12_CIPHERFINAL_ERROR , <EOL> ) <EOL> ) : <EOL> raise ValueError ( "<STR_LIT>" ) <EOL> elif errors [ <NUM_LIT:0> ] [ <NUM_LIT:1> : ] in ( <EOL> ( <EOL> self . _lib . ERR_LIB_PEM , <EOL> self . _lib . PEM_F_PEM_GET_EVP_CIPHER_INFO , <EOL> self . _lib . PEM_R_UNSUPPORTED_ENCRYPTION <EOL> ) , <EOL> ( <EOL> self . _lib . ERR_LIB_EVP , <EOL> self . _lib . EVP_F_EVP_PBE_CIPHERINIT , <EOL> self . _lib . EVP_R_UNKNOWN_PBE_ALGORITHM <EOL> ) <EOL> ) : <EOL> raise UnsupportedAlgorithm ( <EOL> "<STR_LIT>" , <EOL> _Reasons . UNSUPPORTED_CIPHER <EOL> ) <EOL> elif any ( <EOL> error [ <NUM_LIT:1> : ] == ( <EOL> self . _lib . ERR_LIB_EVP , <EOL> self . _lib . EVP_F_EVP_PKCS82PKEY , <EOL> self . _lib . EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM <EOL> ) <EOL> for error in errors <EOL> ) : <EOL> raise UnsupportedAlgorithm ( <EOL> "<STR_LIT>" , <EOL> _Reasons . UNSUPPORTED_PUBLIC_KEY_ALGORITHM <EOL> ) <EOL> else : <EOL> assert errors [ <NUM_LIT:0> ] [ <NUM_LIT:1> ] in ( <EOL> self . _lib . ERR_LIB_EVP , <EOL> self . _lib . ERR_LIB_PEM , <EOL> self . _lib . ERR_LIB_ASN1 , <EOL> ) <EOL> raise ValueError ( "<STR_LIT>" ) <EOL> def elliptic_curve_supported ( self , curve ) : <EOL> if self . _lib . Cryptography_HAS_EC != <NUM_LIT:1> : <EOL> return False <EOL> try : <EOL> curve_nid = self . _elliptic_curve_to_nid ( curve ) <EOL> except UnsupportedAlgorithm : <EOL> curve_nid = self . _lib . NID_undef <EOL> ctx = self . _lib . EC_GROUP_new_by_curve_name ( curve_nid ) <EOL> if ctx == self . _ffi . NULL : <EOL> errors = self . _consume_errors ( ) <EOL> self . openssl_assert ( <EOL> curve_nid == self . _lib . NID_undef or <EOL> errors [ <NUM_LIT:0> ] [ <NUM_LIT:1> : ] == ( <EOL> self . _lib . ERR_LIB_EC , <EOL> self . _lib . EC_F_EC_GROUP_NEW_BY_CURVE_NAME , <EOL> self . _lib . EC_R_UNKNOWN_GROUP <EOL> ) <EOL> ) <EOL> return False <EOL> else : <EOL> self . openssl_assert ( curve_nid != self . _lib . NID_undef ) <EOL> self . _lib . EC_GROUP_free ( ctx ) <EOL> return True <EOL> def elliptic_curve_signature_algorithm_supported ( <EOL> self , signature_algorithm , curve <EOL> ) : <EOL> if self . _lib . Cryptography_HAS_EC != <NUM_LIT:1> : <EOL> return False <EOL> if not isinstance ( signature_algorithm , ec . ECDSA ) : <EOL> return False <EOL> if ( <EOL> self . _lib . OPENSSL_VERSION_NUMBER < <NUM_LIT> and <EOL> curve . key_size < signature_algorithm . algorithm . digest_size * <NUM_LIT:8> <EOL> ) : <EOL> return False <EOL> return self . elliptic_curve_supported ( curve ) <EOL> def generate_elliptic_curve_private_key ( self , curve ) : <EOL> """<STR_LIT>""" <EOL> if self . elliptic_curve_supported ( curve ) : <EOL> curve_nid = self . _elliptic_curve_to_nid ( curve ) <EOL> ec_cdata = self . _lib . EC_KEY_new_by_curve_name ( curve_nid ) <EOL> self . openssl_assert ( ec_cdata != self . _ffi . NULL ) <EOL> ec_cdata = self . _ffi . gc ( ec_cdata , self . _lib . EC_KEY_free ) <EOL> res = self . _lib . EC_KEY_generate_key ( ec_cdata ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> res = self . _lib . EC_KEY_check_key ( ec_cdata ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> evp_pkey = self . _ec_cdata_to_evp_pkey ( ec_cdata ) <EOL> return _EllipticCurvePrivateKey ( self , ec_cdata , evp_pkey ) <EOL> else : <EOL> raise UnsupportedAlgorithm ( <EOL> "<STR_LIT>" . format ( curve . name ) , <EOL> _Reasons . UNSUPPORTED_ELLIPTIC_CURVE <EOL> ) <EOL> def load_elliptic_curve_private_numbers ( self , numbers ) : <EOL> public = numbers . public_numbers <EOL> curve_nid = self . _elliptic_curve_to_nid ( public . curve ) <EOL> ec_cdata = self . _lib . EC_KEY_new_by_curve_name ( curve_nid ) <EOL> self . openssl_assert ( ec_cdata != self . _ffi . NULL ) <EOL> ec_cdata = self . _ffi . gc ( ec_cdata , self . _lib . EC_KEY_free ) <EOL> ec_cdata = self . _ec_key_set_public_key_affine_coordinates ( <EOL> ec_cdata , public . x , public . y ) <EOL> res = self . _lib . EC_KEY_set_private_key ( <EOL> ec_cdata , self . _int_to_bn ( numbers . private_value ) ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> evp_pkey = self . _ec_cdata_to_evp_pkey ( ec_cdata ) <EOL> return _EllipticCurvePrivateKey ( self , ec_cdata , evp_pkey ) <EOL> def load_elliptic_curve_public_numbers ( self , numbers ) : <EOL> curve_nid = self . _elliptic_curve_to_nid ( numbers . curve ) <EOL> ec_cdata = self . _lib . EC_KEY_new_by_curve_name ( curve_nid ) <EOL> self . openssl_assert ( ec_cdata != self . _ffi . NULL ) <EOL> ec_cdata = self . _ffi . gc ( ec_cdata , self . _lib . EC_KEY_free ) <EOL> ec_cdata = self . _ec_key_set_public_key_affine_coordinates ( <EOL> ec_cdata , numbers . x , numbers . y ) <EOL> evp_pkey = self . _ec_cdata_to_evp_pkey ( ec_cdata ) <EOL> return _EllipticCurvePublicKey ( self , ec_cdata , evp_pkey ) <EOL> def elliptic_curve_exchange_algorithm_supported ( self , algorithm , curve ) : <EOL> return ( <EOL> self . elliptic_curve_supported ( curve ) and <EOL> self . _lib . Cryptography_HAS_ECDH == <NUM_LIT:1> and <EOL> isinstance ( algorithm , ec . ECDH ) <EOL> ) <EOL> def _ec_cdata_to_evp_pkey ( self , ec_cdata ) : <EOL> evp_pkey = self . _create_evp_pkey_gc ( ) <EOL> res = self . _lib . EVP_PKEY_set1_EC_KEY ( evp_pkey , ec_cdata ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> return evp_pkey <EOL> def _elliptic_curve_to_nid ( self , curve ) : <EOL> """<STR_LIT>""" <EOL> curve_aliases = { <EOL> "<STR_LIT>" : "<STR_LIT>" , <EOL> "<STR_LIT>" : "<STR_LIT>" <EOL> } <EOL> curve_name = curve_aliases . get ( curve . name , curve . name ) <EOL> curve_nid = self . _lib . OBJ_sn2nid ( curve_name . encode ( ) ) <EOL> if curve_nid == self . _lib . NID_undef : <EOL> raise UnsupportedAlgorithm ( <EOL> "<STR_LIT>" . format ( curve . name ) , <EOL> _Reasons . UNSUPPORTED_ELLIPTIC_CURVE <EOL> ) <EOL> return curve_nid <EOL> @ contextmanager <EOL> def _tmp_bn_ctx ( self ) : <EOL> bn_ctx = self . _lib . BN_CTX_new ( ) <EOL> self . openssl_assert ( bn_ctx != self . _ffi . NULL ) <EOL> bn_ctx = self . _ffi . gc ( bn_ctx , self . _lib . BN_CTX_free ) <EOL> self . _lib . BN_CTX_start ( bn_ctx ) <EOL> try : <EOL> yield bn_ctx <EOL> finally : <EOL> self . _lib . BN_CTX_end ( bn_ctx ) <EOL> def _ec_key_determine_group_get_set_funcs ( self , ctx ) : <EOL> """<STR_LIT>""" <EOL> self . openssl_assert ( ctx != self . _ffi . NULL ) <EOL> nid_two_field = self . _lib . OBJ_sn2nid ( b"<STR_LIT>" ) <EOL> self . openssl_assert ( nid_two_field != self . _lib . NID_undef ) <EOL> group = self . _lib . EC_KEY_get0_group ( ctx ) <EOL> self . openssl_assert ( group != self . _ffi . NULL ) <EOL> method = self . _lib . EC_GROUP_method_of ( group ) <EOL> self . openssl_assert ( method != self . _ffi . NULL ) <EOL> nid = self . _lib . EC_METHOD_get_field_type ( method ) <EOL> self . openssl_assert ( nid != self . _lib . NID_undef ) <EOL> if nid == nid_two_field and self . _lib . Cryptography_HAS_EC2M : <EOL> set_func = self . _lib . EC_POINT_set_affine_coordinates_GF2m <EOL> get_func = self . _lib . EC_POINT_get_affine_coordinates_GF2m <EOL> else : <EOL> set_func = self . _lib . EC_POINT_set_affine_coordinates_GFp <EOL> get_func = self . _lib . EC_POINT_get_affine_coordinates_GFp <EOL> assert set_func and get_func <EOL> return set_func , get_func , group <EOL> def _ec_key_set_public_key_affine_coordinates ( self , ctx , x , y ) : <EOL> """<STR_LIT>""" <EOL> if x < <NUM_LIT:0> or y < <NUM_LIT:0> : <EOL> raise ValueError ( <EOL> "<STR_LIT>" <EOL> ) <EOL> set_func , get_func , group = ( <EOL> self . _ec_key_determine_group_get_set_funcs ( ctx ) <EOL> ) <EOL> point = self . _lib . EC_POINT_new ( group ) <EOL> self . openssl_assert ( point != self . _ffi . NULL ) <EOL> point = self . _ffi . gc ( point , self . _lib . EC_POINT_free ) <EOL> bn_x = self . _int_to_bn ( x ) <EOL> bn_y = self . _int_to_bn ( y ) <EOL> with self . _tmp_bn_ctx ( ) as bn_ctx : <EOL> check_x = self . _lib . BN_CTX_get ( bn_ctx ) <EOL> check_y = self . _lib . BN_CTX_get ( bn_ctx ) <EOL> res = set_func ( group , point , bn_x , bn_y , bn_ctx ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> res = get_func ( group , point , check_x , check_y , bn_ctx ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> res = self . _lib . BN_cmp ( bn_x , check_x ) <EOL> if res != <NUM_LIT:0> : <EOL> self . _consume_errors ( ) <EOL> raise ValueError ( "<STR_LIT>" ) <EOL> res = self . _lib . BN_cmp ( bn_y , check_y ) <EOL> if res != <NUM_LIT:0> : <EOL> self . _consume_errors ( ) <EOL> raise ValueError ( "<STR_LIT>" ) <EOL> res = self . _lib . EC_KEY_set_public_key ( ctx , point ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> res = self . _lib . EC_KEY_check_key ( ctx ) <EOL> if res != <NUM_LIT:1> : <EOL> self . _consume_errors ( ) <EOL> raise ValueError ( "<STR_LIT>" ) <EOL> return ctx <EOL> def _private_key_bytes ( self , encoding , format , encryption_algorithm , <EOL> evp_pkey , cdata ) : <EOL> if not isinstance ( format , serialization . PrivateFormat ) : <EOL> raise TypeError ( <EOL> "<STR_LIT>" <EOL> ) <EOL> if not isinstance ( encryption_algorithm , <EOL> serialization . KeySerializationEncryption ) : <EOL> raise TypeError ( <EOL> "<STR_LIT>" <EOL> "<STR_LIT>" <EOL> ) <EOL> if isinstance ( encryption_algorithm , serialization . NoEncryption ) : <EOL> password = b"<STR_LIT>" <EOL> passlen = <NUM_LIT:0> <EOL> evp_cipher = self . _ffi . NULL <EOL> elif isinstance ( encryption_algorithm , <EOL> serialization . BestAvailableEncryption ) : <EOL> evp_cipher = self . _lib . EVP_get_cipherbyname ( <EOL> b"<STR_LIT>" <EOL> ) <EOL> password = encryption_algorithm . password <EOL> passlen = len ( password ) <EOL> if passlen > <NUM_LIT> : <EOL> raise ValueError ( <EOL> "<STR_LIT>" <EOL> "<STR_LIT>" <EOL> ) <EOL> else : <EOL> raise ValueError ( "<STR_LIT>" ) <EOL> key_type = self . _lib . Cryptography_EVP_PKEY_id ( evp_pkey ) <EOL> if encoding is serialization . Encoding . PEM : <EOL> if format is serialization . PrivateFormat . PKCS8 : <EOL> write_bio = self . _lib . PEM_write_bio_PKCS8PrivateKey <EOL> key = evp_pkey <EOL> else : <EOL> assert format is serialization . PrivateFormat . TraditionalOpenSSL <EOL> if key_type == self . _lib . EVP_PKEY_RSA : <EOL> write_bio = self . _lib . PEM_write_bio_RSAPrivateKey <EOL> elif key_type == self . _lib . EVP_PKEY_DSA : <EOL> write_bio = self . _lib . PEM_write_bio_DSAPrivateKey <EOL> else : <EOL> assert self . _lib . Cryptography_HAS_EC == <NUM_LIT:1> <EOL> assert key_type == self . _lib . EVP_PKEY_EC <EOL> write_bio = self . _lib . PEM_write_bio_ECPrivateKey <EOL> key = cdata <EOL> elif encoding is serialization . Encoding . DER : <EOL> if format is serialization . PrivateFormat . TraditionalOpenSSL : <EOL> if not isinstance ( <EOL> encryption_algorithm , serialization . NoEncryption <EOL> ) : <EOL> raise ValueError ( <EOL> "<STR_LIT>" <EOL> "<STR_LIT>" <EOL> ) <EOL> return self . _private_key_bytes_traditional_der ( key_type , cdata ) <EOL> else : <EOL> assert format is serialization . PrivateFormat . PKCS8 <EOL> write_bio = self . _lib . i2d_PKCS8PrivateKey_bio <EOL> key = evp_pkey <EOL> else : <EOL> raise TypeError ( "<STR_LIT>" ) <EOL> bio = self . _create_mem_bio_gc ( ) <EOL> res = write_bio ( <EOL> bio , <EOL> key , <EOL> evp_cipher , <EOL> password , <EOL> passlen , <EOL> self . _ffi . NULL , <EOL> self . _ffi . NULL <EOL> ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> return self . _read_mem_bio ( bio ) <EOL> def _private_key_bytes_traditional_der ( self , key_type , cdata ) : <EOL> if key_type == self . _lib . EVP_PKEY_RSA : <EOL> write_bio = self . _lib . i2d_RSAPrivateKey_bio <EOL> elif ( self . _lib . Cryptography_HAS_EC == <NUM_LIT:1> and <EOL> key_type == self . _lib . EVP_PKEY_EC ) : <EOL> write_bio = self . _lib . i2d_ECPrivateKey_bio <EOL> else : <EOL> self . openssl_assert ( key_type == self . _lib . EVP_PKEY_DSA ) <EOL> write_bio = self . _lib . i2d_DSAPrivateKey_bio <EOL> bio = self . _create_mem_bio_gc ( ) <EOL> res = write_bio ( bio , cdata ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> return self . _read_mem_bio ( bio ) <EOL> def _public_key_bytes ( self , encoding , format , evp_pkey , cdata ) : <EOL> if not isinstance ( encoding , serialization . Encoding ) : <EOL> raise TypeError ( "<STR_LIT>" ) <EOL> if format is serialization . PublicFormat . SubjectPublicKeyInfo : <EOL> if encoding is serialization . Encoding . PEM : <EOL> write_bio = self . _lib . PEM_write_bio_PUBKEY <EOL> else : <EOL> assert encoding is serialization . Encoding . DER <EOL> write_bio = self . _lib . i2d_PUBKEY_bio <EOL> key = evp_pkey <EOL> elif format is serialization . PublicFormat . PKCS1 : <EOL> assert self . _lib . Cryptography_EVP_PKEY_id ( <EOL> evp_pkey <EOL> ) == self . _lib . EVP_PKEY_RSA <EOL> if encoding is serialization . Encoding . PEM : <EOL> write_bio = self . _lib . PEM_write_bio_RSAPublicKey <EOL> else : <EOL> assert encoding is serialization . Encoding . DER <EOL> write_bio = self . _lib . i2d_RSAPublicKey_bio <EOL> key = cdata <EOL> else : <EOL> raise TypeError ( <EOL> "<STR_LIT>" <EOL> ) <EOL> bio = self . _create_mem_bio_gc ( ) <EOL> res = write_bio ( bio , key ) <EOL> self . openssl_assert ( res == <NUM_LIT:1> ) <EOL> return self . _read_mem_bio ( bio ) <EOL> class GetCipherByName ( object ) : <EOL> def __init__ ( self , fmt ) : <EOL> self . _fmt = fmt <EOL> def __call__ ( self , backend , cipher , mode ) : <EOL> cipher_name = self . _fmt . format ( cipher = cipher , mode = mode ) . lower ( ) <EOL> return backend . _lib . EVP_get_cipherbyname ( cipher_name . encode ( "<STR_LIT:ascii>" ) ) <EOL> backend = Backend ( ) </s>
