U ÈZjŽ0ã@srddlmZddlmZmZddlmZmZddlm Z m Z m Z m Z dd„Z dd„ZGd d „d eƒZdd d „Zd S)é)ÚInteger)ÚSHA512ÚSHAKE256)ÚbchrÚis_bytes)ÚEccKeyÚ constructÚ_import_ed25519_public_keyÚ_import_ed448_public_keycCsZt|ƒdkrt|ƒ\}}d}n.t|ƒdkrt|ƒs>tdƒ‚|j}n<|jjdkrzt|t j ƒ}|srt|ƒsrtdƒ‚|j }nt dƒ‚|||ƒS)aJCompute the EdDSA signature of a message. Args: msg_or_hash (bytes or a hash object): The message to sign (``bytes``, in case of *PureEdDSA*) or the hash that was carried out over the message (hash object, for *HashEdDSA*). The hash object must be :class:`Crypto.Hash.SHA512` for Ed25519, and :class:`Crypto.Hash.SHAKE256` object for Ed448. :return: The signature as ``bytes``. It is always 64 bytes for Ed25519, and 114 bytes for Ed448. :raise TypeError: if the EdDSA key has no private half zPrivate key is needed to signr ú-'msg_or_hash' must be bytes of a SHA-512 hashrú.'msg_or_hash' must be bytes of a SHAKE256 hashúIncorrect curve for EdDSA) rr'Ú TypeErrorrÚ isinstancerÚ SHA512HashrÚ _sign_ed25519rÚ SHAKE256_XOFÚ _sign_ed448r)r#Ú msg_or_hashÚphZeddsa_sign_methodrrrÚsign{s       zEdDSASigScheme.signc Csà|js |r4t|ƒ}dt|ƒtt|jƒƒ|j}nd}|rD| ¡n|}t ||jj|¡ ¡}t   |d¡|j }t ||jj jd ¡}t |||j|¡ ¡} t   | d¡|j } || |jj|j } ||  dd¡S)Nó SigEd25519 no Ed25519 collisionsóÚlittle©Úpointr )rÚintrrÚdigestrÚnewrÚ_prefixrÚ from_bytesr"rr ÚGrrÚdÚto_bytes) r#r2r3ÚflagÚdom2ÚPHMÚr_hashÚrÚR_pkÚk_hashÚkÚsrrrr/žs    ÿÿzEdDSASigScheme._sign_ed25519c CsÖt|ƒ}dt|ƒtt|jƒƒ|j}|r6| d¡n|}t ||jj|¡ d¡}t   |d¡|j }t ||jj jd ¡}t |||j|¡ d¡} t   | d¡|j } || |jj|j } ||  dd¡S)NóSigEd448é@érr7r8r )r:rrrÚreadrr<rr=rr>r"rr r?rrr@rA) r#r2r3rBÚdom4rDrErFrGrHrIrJrrrr1¹s  ÿÿzEdDSASigScheme._sign_ed448cCs||jjdkr4t|tjƒ}|s,t|ƒs,tdƒ‚|j}n<|jjdkrht|tj ƒ}|s`t|ƒs`tdƒ‚|j }nt dƒ‚||||ƒS)aCheck if an EdDSA signature is authentic. Args: msg_or_hash (bytes or a hash object): The message to verify (``bytes``, in case of *PureEdDSA*) or the hash that was carried out over the message (hash object, for *HashEdDSA*). The hash object must be :class:`Crypto.Hash.SHA512` object for Ed25519, and :class:`Crypto.Hash.SHAKE256` for Ed448. signature (``bytes``): The signature that needs to be validated. It must be 64 bytes for Ed25519, and 114 bytes for Ed448. :raise ValueError: if the signature is not authentic r r)rr*r+) rrr-rr.rr,Ú_verify_ed25519rr0Ú _verify_ed448r)r#r2Ú signaturer3Zeddsa_verify_methodrrrÚverifyÑs      zEdDSASigScheme.verifyc Cs,t|ƒdkrtdƒ‚|js|rHt|ƒ}dt|ƒtt|jƒƒ|j}nd}|rX| ¡n|}zt|dd…ƒj}Wntk rŽtdƒ‚YnXt  |dd…d¡}||j kr¶tdƒ‚t   ||dd…|j |¡ ¡} t  | d¡|j } |d |jjj} d || d |jj} | | kr(td ƒ‚dS) NrLú'The signature is not authentic (length)r5r6r ú"The signature is not authentic (R)r7ú"The signature is not authentic (S)éúThe signature is not authentic)rrrr:rr;rÚpointQrr>r"rr<rrr r?) r#r2rRr3rBrCrDÚRrJrHrIÚpoint1Úpoint2rrrrPôs0    ÿÿ $ zEdDSASigScheme._verify_ed25519c Cs t|ƒdkrtdƒ‚t|ƒ}dt|ƒtt|jƒƒ|j}|rJ| d¡n|}zt|dd…ƒj}Wntk r€tdƒ‚YnXt  |dd…d¡}||j kr¨tdƒ‚t   ||dd…|j |¡ d¡} t  | d¡|j } |d |jjj} d || d |jj} | | krtd ƒ‚dS) NrMrTrKrLr rUr7rVrWrX)rrr:rrrNrrYrr>r"rr<rrr r?) r#r2rRr3rBrOrDrZrJrHrIr[r\rrrrQs,   ÿÿ & zEdDSASigScheme._verify_ed448N) Ú__name__Ú __module__Ú __qualname__Ú__doc__r&r(r4r/r1rSrPrQrrrrrcs ###rNcCsXt|tƒr|jdkrtdƒ‚|dkr,tdƒ‚|dkr:d}nt|ƒdkrNtdƒ‚t||ƒS) a¥Create a signature object :class:`EdDSASigScheme` that can perform or verify an EdDSA signature. Args: key (:class:`Crypto.PublicKey.ECC` object): The key to use for computing the signature (*private* keys only) or for verifying one. The key must be on the curve ``Ed25519`` or ``Ed448``. mode (string): This parameter must be ``'rfc8032'``. context (bytes): Up to 255 bytes of `context `_, which is a constant byte string to segregate different protocols or different applications of the same key. )r rz&EdDSA can only be used with EdDSA keysZrfc8032zMode must be 'rfc8032'Nr6éÿz3Context for EdDSA must not be longer than 255 bytes)r-rrrrr)r$Úmoder%rrrr<9s r<)N)ZCrypto.Math.NumbersrZ Crypto.HashrrZCrypto.Util.py3compatrrZCrypto.PublicKey.ECCrrr r rrÚobjectrr<rrrrÚs W