mirror of
https://github.com/PiBrewing/craftbeerpi4.git
synced 2024-11-14 02:58:16 +01:00
984 lines
27 KiB
Python
984 lines
27 KiB
Python
# coding: utf-8
|
|
|
|
"""
|
|
ASN.1 type classes for cryptographic message syntax (CMS). Structures are also
|
|
compatible with PKCS#7. Exports the following items:
|
|
|
|
- AuthenticatedData()
|
|
- AuthEnvelopedData()
|
|
- CompressedData()
|
|
- ContentInfo()
|
|
- DigestedData()
|
|
- EncryptedData()
|
|
- EnvelopedData()
|
|
- SignedAndEnvelopedData()
|
|
- SignedData()
|
|
|
|
Other type classes are defined that help compose the types listed above.
|
|
|
|
Most CMS structures in the wild are formatted as ContentInfo encapsulating one of the other types.
|
|
"""
|
|
|
|
from __future__ import unicode_literals, division, absolute_import, print_function
|
|
|
|
try:
|
|
import zlib
|
|
except (ImportError):
|
|
zlib = None
|
|
|
|
from .algos import (
|
|
_ForceNullParameters,
|
|
DigestAlgorithm,
|
|
EncryptionAlgorithm,
|
|
HmacAlgorithm,
|
|
KdfAlgorithm,
|
|
RSAESOAEPParams,
|
|
SignedDigestAlgorithm,
|
|
)
|
|
from .core import (
|
|
Any,
|
|
BitString,
|
|
Choice,
|
|
Enumerated,
|
|
GeneralizedTime,
|
|
Integer,
|
|
ObjectIdentifier,
|
|
OctetBitString,
|
|
OctetString,
|
|
ParsableOctetString,
|
|
Sequence,
|
|
SequenceOf,
|
|
SetOf,
|
|
UTCTime,
|
|
UTF8String,
|
|
)
|
|
from .crl import CertificateList
|
|
from .keys import PublicKeyInfo
|
|
from .ocsp import OCSPResponse
|
|
from .x509 import Attributes, Certificate, Extensions, GeneralName, GeneralNames, Name
|
|
|
|
|
|
# These structures are taken from
|
|
# ftp://ftp.rsasecurity.com/pub/pkcs/ascii/pkcs-6.asc
|
|
|
|
class ExtendedCertificateInfo(Sequence):
|
|
_fields = [
|
|
('version', Integer),
|
|
('certificate', Certificate),
|
|
('attributes', Attributes),
|
|
]
|
|
|
|
|
|
class ExtendedCertificate(Sequence):
|
|
_fields = [
|
|
('extended_certificate_info', ExtendedCertificateInfo),
|
|
('signature_algorithm', SignedDigestAlgorithm),
|
|
('signature', OctetBitString),
|
|
]
|
|
|
|
|
|
# These structures are taken from https://tools.ietf.org/html/rfc5652,
|
|
# https://tools.ietf.org/html/rfc5083, http://tools.ietf.org/html/rfc2315,
|
|
# https://tools.ietf.org/html/rfc5940, https://tools.ietf.org/html/rfc3274,
|
|
# https://tools.ietf.org/html/rfc3281
|
|
|
|
|
|
class CMSVersion(Integer):
|
|
_map = {
|
|
0: 'v0',
|
|
1: 'v1',
|
|
2: 'v2',
|
|
3: 'v3',
|
|
4: 'v4',
|
|
5: 'v5',
|
|
}
|
|
|
|
|
|
class CMSAttributeType(ObjectIdentifier):
|
|
_map = {
|
|
'1.2.840.113549.1.9.3': 'content_type',
|
|
'1.2.840.113549.1.9.4': 'message_digest',
|
|
'1.2.840.113549.1.9.5': 'signing_time',
|
|
'1.2.840.113549.1.9.6': 'counter_signature',
|
|
# https://tools.ietf.org/html/rfc2633#page-26
|
|
'1.2.840.113549.1.9.16.2.11': 'encrypt_key_pref',
|
|
# https://tools.ietf.org/html/rfc3161#page-20
|
|
'1.2.840.113549.1.9.16.2.14': 'signature_time_stamp_token',
|
|
# https://tools.ietf.org/html/rfc6211#page-5
|
|
'1.2.840.113549.1.9.52': 'cms_algorithm_protection',
|
|
# https://docs.microsoft.com/en-us/previous-versions/hh968145(v%3Dvs.85)
|
|
'1.3.6.1.4.1.311.2.4.1': 'microsoft_nested_signature',
|
|
# Some places refer to this as SPC_RFC3161_OBJID, others szOID_RFC3161_counterSign.
|
|
# https://docs.microsoft.com/en-us/windows/win32/api/wincrypt/ns-wincrypt-crypt_algorithm_identifier
|
|
# refers to szOID_RFC3161_counterSign as "1.2.840.113549.1.9.16.1.4",
|
|
# but that OID is also called szOID_TIMESTAMP_TOKEN. Because of there being
|
|
# no canonical source for this OID, we give it our own name
|
|
'1.3.6.1.4.1.311.3.3.1': 'microsoft_time_stamp_token',
|
|
}
|
|
|
|
|
|
class Time(Choice):
|
|
_alternatives = [
|
|
('utc_time', UTCTime),
|
|
('generalized_time', GeneralizedTime),
|
|
]
|
|
|
|
|
|
class ContentType(ObjectIdentifier):
|
|
_map = {
|
|
'1.2.840.113549.1.7.1': 'data',
|
|
'1.2.840.113549.1.7.2': 'signed_data',
|
|
'1.2.840.113549.1.7.3': 'enveloped_data',
|
|
'1.2.840.113549.1.7.4': 'signed_and_enveloped_data',
|
|
'1.2.840.113549.1.7.5': 'digested_data',
|
|
'1.2.840.113549.1.7.6': 'encrypted_data',
|
|
'1.2.840.113549.1.9.16.1.2': 'authenticated_data',
|
|
'1.2.840.113549.1.9.16.1.9': 'compressed_data',
|
|
'1.2.840.113549.1.9.16.1.23': 'authenticated_enveloped_data',
|
|
}
|
|
|
|
|
|
class CMSAlgorithmProtection(Sequence):
|
|
_fields = [
|
|
('digest_algorithm', DigestAlgorithm),
|
|
('signature_algorithm', SignedDigestAlgorithm, {'implicit': 1, 'optional': True}),
|
|
('mac_algorithm', HmacAlgorithm, {'implicit': 2, 'optional': True}),
|
|
]
|
|
|
|
|
|
class SetOfContentType(SetOf):
|
|
_child_spec = ContentType
|
|
|
|
|
|
class SetOfOctetString(SetOf):
|
|
_child_spec = OctetString
|
|
|
|
|
|
class SetOfTime(SetOf):
|
|
_child_spec = Time
|
|
|
|
|
|
class SetOfAny(SetOf):
|
|
_child_spec = Any
|
|
|
|
|
|
class SetOfCMSAlgorithmProtection(SetOf):
|
|
_child_spec = CMSAlgorithmProtection
|
|
|
|
|
|
class CMSAttribute(Sequence):
|
|
_fields = [
|
|
('type', CMSAttributeType),
|
|
('values', None),
|
|
]
|
|
|
|
_oid_specs = {}
|
|
|
|
def _values_spec(self):
|
|
return self._oid_specs.get(self['type'].native, SetOfAny)
|
|
|
|
_spec_callbacks = {
|
|
'values': _values_spec
|
|
}
|
|
|
|
|
|
class CMSAttributes(SetOf):
|
|
_child_spec = CMSAttribute
|
|
|
|
|
|
class IssuerSerial(Sequence):
|
|
_fields = [
|
|
('issuer', GeneralNames),
|
|
('serial', Integer),
|
|
('issuer_uid', OctetBitString, {'optional': True}),
|
|
]
|
|
|
|
|
|
class AttCertVersion(Integer):
|
|
_map = {
|
|
0: 'v1',
|
|
1: 'v2',
|
|
}
|
|
|
|
|
|
class AttCertSubject(Choice):
|
|
_alternatives = [
|
|
('base_certificate_id', IssuerSerial, {'explicit': 0}),
|
|
('subject_name', GeneralNames, {'explicit': 1}),
|
|
]
|
|
|
|
|
|
class AttCertValidityPeriod(Sequence):
|
|
_fields = [
|
|
('not_before_time', GeneralizedTime),
|
|
('not_after_time', GeneralizedTime),
|
|
]
|
|
|
|
|
|
class AttributeCertificateInfoV1(Sequence):
|
|
_fields = [
|
|
('version', AttCertVersion, {'default': 'v1'}),
|
|
('subject', AttCertSubject),
|
|
('issuer', GeneralNames),
|
|
('signature', SignedDigestAlgorithm),
|
|
('serial_number', Integer),
|
|
('att_cert_validity_period', AttCertValidityPeriod),
|
|
('attributes', Attributes),
|
|
('issuer_unique_id', OctetBitString, {'optional': True}),
|
|
('extensions', Extensions, {'optional': True}),
|
|
]
|
|
|
|
|
|
class AttributeCertificateV1(Sequence):
|
|
_fields = [
|
|
('ac_info', AttributeCertificateInfoV1),
|
|
('signature_algorithm', SignedDigestAlgorithm),
|
|
('signature', OctetBitString),
|
|
]
|
|
|
|
|
|
class DigestedObjectType(Enumerated):
|
|
_map = {
|
|
0: 'public_key',
|
|
1: 'public_key_cert',
|
|
2: 'other_objy_types',
|
|
}
|
|
|
|
|
|
class ObjectDigestInfo(Sequence):
|
|
_fields = [
|
|
('digested_object_type', DigestedObjectType),
|
|
('other_object_type_id', ObjectIdentifier, {'optional': True}),
|
|
('digest_algorithm', DigestAlgorithm),
|
|
('object_digest', OctetBitString),
|
|
]
|
|
|
|
|
|
class Holder(Sequence):
|
|
_fields = [
|
|
('base_certificate_id', IssuerSerial, {'implicit': 0, 'optional': True}),
|
|
('entity_name', GeneralNames, {'implicit': 1, 'optional': True}),
|
|
('object_digest_info', ObjectDigestInfo, {'implicit': 2, 'optional': True}),
|
|
]
|
|
|
|
|
|
class V2Form(Sequence):
|
|
_fields = [
|
|
('issuer_name', GeneralNames, {'optional': True}),
|
|
('base_certificate_id', IssuerSerial, {'explicit': 0, 'optional': True}),
|
|
('object_digest_info', ObjectDigestInfo, {'explicit': 1, 'optional': True}),
|
|
]
|
|
|
|
|
|
class AttCertIssuer(Choice):
|
|
_alternatives = [
|
|
('v1_form', GeneralNames),
|
|
('v2_form', V2Form, {'explicit': 0}),
|
|
]
|
|
|
|
|
|
class IetfAttrValue(Choice):
|
|
_alternatives = [
|
|
('octets', OctetString),
|
|
('oid', ObjectIdentifier),
|
|
('string', UTF8String),
|
|
]
|
|
|
|
|
|
class IetfAttrValues(SequenceOf):
|
|
_child_spec = IetfAttrValue
|
|
|
|
|
|
class IetfAttrSyntax(Sequence):
|
|
_fields = [
|
|
('policy_authority', GeneralNames, {'implicit': 0, 'optional': True}),
|
|
('values', IetfAttrValues),
|
|
]
|
|
|
|
|
|
class SetOfIetfAttrSyntax(SetOf):
|
|
_child_spec = IetfAttrSyntax
|
|
|
|
|
|
class SvceAuthInfo(Sequence):
|
|
_fields = [
|
|
('service', GeneralName),
|
|
('ident', GeneralName),
|
|
('auth_info', OctetString, {'optional': True}),
|
|
]
|
|
|
|
|
|
class SetOfSvceAuthInfo(SetOf):
|
|
_child_spec = SvceAuthInfo
|
|
|
|
|
|
class RoleSyntax(Sequence):
|
|
_fields = [
|
|
('role_authority', GeneralNames, {'implicit': 0, 'optional': True}),
|
|
('role_name', GeneralName, {'implicit': 1}),
|
|
]
|
|
|
|
|
|
class SetOfRoleSyntax(SetOf):
|
|
_child_spec = RoleSyntax
|
|
|
|
|
|
class ClassList(BitString):
|
|
_map = {
|
|
0: 'unmarked',
|
|
1: 'unclassified',
|
|
2: 'restricted',
|
|
3: 'confidential',
|
|
4: 'secret',
|
|
5: 'top_secret',
|
|
}
|
|
|
|
|
|
class SecurityCategory(Sequence):
|
|
_fields = [
|
|
('type', ObjectIdentifier, {'implicit': 0}),
|
|
('value', Any, {'implicit': 1}),
|
|
]
|
|
|
|
|
|
class SetOfSecurityCategory(SetOf):
|
|
_child_spec = SecurityCategory
|
|
|
|
|
|
class Clearance(Sequence):
|
|
_fields = [
|
|
('policy_id', ObjectIdentifier, {'implicit': 0}),
|
|
('class_list', ClassList, {'implicit': 1, 'default': 'unclassified'}),
|
|
('security_categories', SetOfSecurityCategory, {'implicit': 2, 'optional': True}),
|
|
]
|
|
|
|
|
|
class SetOfClearance(SetOf):
|
|
_child_spec = Clearance
|
|
|
|
|
|
class BigTime(Sequence):
|
|
_fields = [
|
|
('major', Integer),
|
|
('fractional_seconds', Integer),
|
|
('sign', Integer, {'optional': True}),
|
|
]
|
|
|
|
|
|
class LeapData(Sequence):
|
|
_fields = [
|
|
('leap_time', BigTime),
|
|
('action', Integer),
|
|
]
|
|
|
|
|
|
class SetOfLeapData(SetOf):
|
|
_child_spec = LeapData
|
|
|
|
|
|
class TimingMetrics(Sequence):
|
|
_fields = [
|
|
('ntp_time', BigTime),
|
|
('offset', BigTime),
|
|
('delay', BigTime),
|
|
('expiration', BigTime),
|
|
('leap_event', SetOfLeapData, {'optional': True}),
|
|
]
|
|
|
|
|
|
class SetOfTimingMetrics(SetOf):
|
|
_child_spec = TimingMetrics
|
|
|
|
|
|
class TimingPolicy(Sequence):
|
|
_fields = [
|
|
('policy_id', SequenceOf, {'spec': ObjectIdentifier}),
|
|
('max_offset', BigTime, {'explicit': 0, 'optional': True}),
|
|
('max_delay', BigTime, {'explicit': 1, 'optional': True}),
|
|
]
|
|
|
|
|
|
class SetOfTimingPolicy(SetOf):
|
|
_child_spec = TimingPolicy
|
|
|
|
|
|
class AttCertAttributeType(ObjectIdentifier):
|
|
_map = {
|
|
'1.3.6.1.5.5.7.10.1': 'authentication_info',
|
|
'1.3.6.1.5.5.7.10.2': 'access_identity',
|
|
'1.3.6.1.5.5.7.10.3': 'charging_identity',
|
|
'1.3.6.1.5.5.7.10.4': 'group',
|
|
'2.5.4.72': 'role',
|
|
'2.5.4.55': 'clearance',
|
|
'1.3.6.1.4.1.601.10.4.1': 'timing_metrics',
|
|
'1.3.6.1.4.1.601.10.4.2': 'timing_policy',
|
|
}
|
|
|
|
|
|
class AttCertAttribute(Sequence):
|
|
_fields = [
|
|
('type', AttCertAttributeType),
|
|
('values', None),
|
|
]
|
|
|
|
_oid_specs = {
|
|
'authentication_info': SetOfSvceAuthInfo,
|
|
'access_identity': SetOfSvceAuthInfo,
|
|
'charging_identity': SetOfIetfAttrSyntax,
|
|
'group': SetOfIetfAttrSyntax,
|
|
'role': SetOfRoleSyntax,
|
|
'clearance': SetOfClearance,
|
|
'timing_metrics': SetOfTimingMetrics,
|
|
'timing_policy': SetOfTimingPolicy,
|
|
}
|
|
|
|
def _values_spec(self):
|
|
return self._oid_specs.get(self['type'].native, SetOfAny)
|
|
|
|
_spec_callbacks = {
|
|
'values': _values_spec
|
|
}
|
|
|
|
|
|
class AttCertAttributes(SequenceOf):
|
|
_child_spec = AttCertAttribute
|
|
|
|
|
|
class AttributeCertificateInfoV2(Sequence):
|
|
_fields = [
|
|
('version', AttCertVersion),
|
|
('holder', Holder),
|
|
('issuer', AttCertIssuer),
|
|
('signature', SignedDigestAlgorithm),
|
|
('serial_number', Integer),
|
|
('att_cert_validity_period', AttCertValidityPeriod),
|
|
('attributes', AttCertAttributes),
|
|
('issuer_unique_id', OctetBitString, {'optional': True}),
|
|
('extensions', Extensions, {'optional': True}),
|
|
]
|
|
|
|
|
|
class AttributeCertificateV2(Sequence):
|
|
# Handle the situation where a V2 cert is encoded as V1
|
|
_bad_tag = 1
|
|
|
|
_fields = [
|
|
('ac_info', AttributeCertificateInfoV2),
|
|
('signature_algorithm', SignedDigestAlgorithm),
|
|
('signature', OctetBitString),
|
|
]
|
|
|
|
|
|
class OtherCertificateFormat(Sequence):
|
|
_fields = [
|
|
('other_cert_format', ObjectIdentifier),
|
|
('other_cert', Any),
|
|
]
|
|
|
|
|
|
class CertificateChoices(Choice):
|
|
_alternatives = [
|
|
('certificate', Certificate),
|
|
('extended_certificate', ExtendedCertificate, {'implicit': 0}),
|
|
('v1_attr_cert', AttributeCertificateV1, {'implicit': 1}),
|
|
('v2_attr_cert', AttributeCertificateV2, {'implicit': 2}),
|
|
('other', OtherCertificateFormat, {'implicit': 3}),
|
|
]
|
|
|
|
def validate(self, class_, tag, contents):
|
|
"""
|
|
Ensures that the class and tag specified exist as an alternative. This
|
|
custom version fixes parsing broken encodings there a V2 attribute
|
|
# certificate is encoded as a V1
|
|
|
|
:param class_:
|
|
The integer class_ from the encoded value header
|
|
|
|
:param tag:
|
|
The integer tag from the encoded value header
|
|
|
|
:param contents:
|
|
A byte string of the contents of the value - used when the object
|
|
is explicitly tagged
|
|
|
|
:raises:
|
|
ValueError - when value is not a valid alternative
|
|
"""
|
|
|
|
super(CertificateChoices, self).validate(class_, tag, contents)
|
|
if self._choice == 2:
|
|
if AttCertVersion.load(Sequence.load(contents)[0].dump()).native == 'v2':
|
|
self._choice = 3
|
|
|
|
|
|
class CertificateSet(SetOf):
|
|
_child_spec = CertificateChoices
|
|
|
|
|
|
class ContentInfo(Sequence):
|
|
_fields = [
|
|
('content_type', ContentType),
|
|
('content', Any, {'explicit': 0, 'optional': True}),
|
|
]
|
|
|
|
_oid_pair = ('content_type', 'content')
|
|
_oid_specs = {}
|
|
|
|
|
|
class SetOfContentInfo(SetOf):
|
|
_child_spec = ContentInfo
|
|
|
|
|
|
class EncapsulatedContentInfo(Sequence):
|
|
_fields = [
|
|
('content_type', ContentType),
|
|
('content', ParsableOctetString, {'explicit': 0, 'optional': True}),
|
|
]
|
|
|
|
_oid_pair = ('content_type', 'content')
|
|
_oid_specs = {}
|
|
|
|
|
|
class IssuerAndSerialNumber(Sequence):
|
|
_fields = [
|
|
('issuer', Name),
|
|
('serial_number', Integer),
|
|
]
|
|
|
|
|
|
class SignerIdentifier(Choice):
|
|
_alternatives = [
|
|
('issuer_and_serial_number', IssuerAndSerialNumber),
|
|
('subject_key_identifier', OctetString, {'implicit': 0}),
|
|
]
|
|
|
|
|
|
class DigestAlgorithms(SetOf):
|
|
_child_spec = DigestAlgorithm
|
|
|
|
|
|
class CertificateRevocationLists(SetOf):
|
|
_child_spec = CertificateList
|
|
|
|
|
|
class SCVPReqRes(Sequence):
|
|
_fields = [
|
|
('request', ContentInfo, {'explicit': 0, 'optional': True}),
|
|
('response', ContentInfo),
|
|
]
|
|
|
|
|
|
class OtherRevInfoFormatId(ObjectIdentifier):
|
|
_map = {
|
|
'1.3.6.1.5.5.7.16.2': 'ocsp_response',
|
|
'1.3.6.1.5.5.7.16.4': 'scvp',
|
|
}
|
|
|
|
|
|
class OtherRevocationInfoFormat(Sequence):
|
|
_fields = [
|
|
('other_rev_info_format', OtherRevInfoFormatId),
|
|
('other_rev_info', Any),
|
|
]
|
|
|
|
_oid_pair = ('other_rev_info_format', 'other_rev_info')
|
|
_oid_specs = {
|
|
'ocsp_response': OCSPResponse,
|
|
'scvp': SCVPReqRes,
|
|
}
|
|
|
|
|
|
class RevocationInfoChoice(Choice):
|
|
_alternatives = [
|
|
('crl', CertificateList),
|
|
('other', OtherRevocationInfoFormat, {'implicit': 1}),
|
|
]
|
|
|
|
|
|
class RevocationInfoChoices(SetOf):
|
|
_child_spec = RevocationInfoChoice
|
|
|
|
|
|
class SignerInfo(Sequence):
|
|
_fields = [
|
|
('version', CMSVersion),
|
|
('sid', SignerIdentifier),
|
|
('digest_algorithm', DigestAlgorithm),
|
|
('signed_attrs', CMSAttributes, {'implicit': 0, 'optional': True}),
|
|
('signature_algorithm', SignedDigestAlgorithm),
|
|
('signature', OctetString),
|
|
('unsigned_attrs', CMSAttributes, {'implicit': 1, 'optional': True}),
|
|
]
|
|
|
|
|
|
class SignerInfos(SetOf):
|
|
_child_spec = SignerInfo
|
|
|
|
|
|
class SignedData(Sequence):
|
|
_fields = [
|
|
('version', CMSVersion),
|
|
('digest_algorithms', DigestAlgorithms),
|
|
('encap_content_info', None),
|
|
('certificates', CertificateSet, {'implicit': 0, 'optional': True}),
|
|
('crls', RevocationInfoChoices, {'implicit': 1, 'optional': True}),
|
|
('signer_infos', SignerInfos),
|
|
]
|
|
|
|
def _encap_content_info_spec(self):
|
|
# If the encap_content_info is version v1, then this could be a PKCS#7
|
|
# structure, or a CMS structure. CMS wraps the encoded value in an
|
|
# Octet String tag.
|
|
|
|
# If the version is greater than 1, it is definite CMS
|
|
if self['version'].native != 'v1':
|
|
return EncapsulatedContentInfo
|
|
|
|
# Otherwise, the ContentInfo spec from PKCS#7 will be compatible with
|
|
# CMS v1 (which only allows Data, an Octet String) and PKCS#7, which
|
|
# allows Any
|
|
return ContentInfo
|
|
|
|
_spec_callbacks = {
|
|
'encap_content_info': _encap_content_info_spec
|
|
}
|
|
|
|
|
|
class OriginatorInfo(Sequence):
|
|
_fields = [
|
|
('certs', CertificateSet, {'implicit': 0, 'optional': True}),
|
|
('crls', RevocationInfoChoices, {'implicit': 1, 'optional': True}),
|
|
]
|
|
|
|
|
|
class RecipientIdentifier(Choice):
|
|
_alternatives = [
|
|
('issuer_and_serial_number', IssuerAndSerialNumber),
|
|
('subject_key_identifier', OctetString, {'implicit': 0}),
|
|
]
|
|
|
|
|
|
class KeyEncryptionAlgorithmId(ObjectIdentifier):
|
|
_map = {
|
|
'1.2.840.113549.1.1.1': 'rsaes_pkcs1v15',
|
|
'1.2.840.113549.1.1.7': 'rsaes_oaep',
|
|
'2.16.840.1.101.3.4.1.5': 'aes128_wrap',
|
|
'2.16.840.1.101.3.4.1.8': 'aes128_wrap_pad',
|
|
'2.16.840.1.101.3.4.1.25': 'aes192_wrap',
|
|
'2.16.840.1.101.3.4.1.28': 'aes192_wrap_pad',
|
|
'2.16.840.1.101.3.4.1.45': 'aes256_wrap',
|
|
'2.16.840.1.101.3.4.1.48': 'aes256_wrap_pad',
|
|
}
|
|
|
|
_reverse_map = {
|
|
'rsa': '1.2.840.113549.1.1.1',
|
|
'rsaes_pkcs1v15': '1.2.840.113549.1.1.1',
|
|
'rsaes_oaep': '1.2.840.113549.1.1.7',
|
|
'aes128_wrap': '2.16.840.1.101.3.4.1.5',
|
|
'aes128_wrap_pad': '2.16.840.1.101.3.4.1.8',
|
|
'aes192_wrap': '2.16.840.1.101.3.4.1.25',
|
|
'aes192_wrap_pad': '2.16.840.1.101.3.4.1.28',
|
|
'aes256_wrap': '2.16.840.1.101.3.4.1.45',
|
|
'aes256_wrap_pad': '2.16.840.1.101.3.4.1.48',
|
|
}
|
|
|
|
|
|
class KeyEncryptionAlgorithm(_ForceNullParameters, Sequence):
|
|
_fields = [
|
|
('algorithm', KeyEncryptionAlgorithmId),
|
|
('parameters', Any, {'optional': True}),
|
|
]
|
|
|
|
_oid_pair = ('algorithm', 'parameters')
|
|
_oid_specs = {
|
|
'rsaes_oaep': RSAESOAEPParams,
|
|
}
|
|
|
|
|
|
class KeyTransRecipientInfo(Sequence):
|
|
_fields = [
|
|
('version', CMSVersion),
|
|
('rid', RecipientIdentifier),
|
|
('key_encryption_algorithm', KeyEncryptionAlgorithm),
|
|
('encrypted_key', OctetString),
|
|
]
|
|
|
|
|
|
class OriginatorIdentifierOrKey(Choice):
|
|
_alternatives = [
|
|
('issuer_and_serial_number', IssuerAndSerialNumber),
|
|
('subject_key_identifier', OctetString, {'implicit': 0}),
|
|
('originator_key', PublicKeyInfo, {'implicit': 1}),
|
|
]
|
|
|
|
|
|
class OtherKeyAttribute(Sequence):
|
|
_fields = [
|
|
('key_attr_id', ObjectIdentifier),
|
|
('key_attr', Any),
|
|
]
|
|
|
|
|
|
class RecipientKeyIdentifier(Sequence):
|
|
_fields = [
|
|
('subject_key_identifier', OctetString),
|
|
('date', GeneralizedTime, {'optional': True}),
|
|
('other', OtherKeyAttribute, {'optional': True}),
|
|
]
|
|
|
|
|
|
class KeyAgreementRecipientIdentifier(Choice):
|
|
_alternatives = [
|
|
('issuer_and_serial_number', IssuerAndSerialNumber),
|
|
('r_key_id', RecipientKeyIdentifier, {'implicit': 0}),
|
|
]
|
|
|
|
|
|
class RecipientEncryptedKey(Sequence):
|
|
_fields = [
|
|
('rid', KeyAgreementRecipientIdentifier),
|
|
('encrypted_key', OctetString),
|
|
]
|
|
|
|
|
|
class RecipientEncryptedKeys(SequenceOf):
|
|
_child_spec = RecipientEncryptedKey
|
|
|
|
|
|
class KeyAgreeRecipientInfo(Sequence):
|
|
_fields = [
|
|
('version', CMSVersion),
|
|
('originator', OriginatorIdentifierOrKey, {'explicit': 0}),
|
|
('ukm', OctetString, {'explicit': 1, 'optional': True}),
|
|
('key_encryption_algorithm', KeyEncryptionAlgorithm),
|
|
('recipient_encrypted_keys', RecipientEncryptedKeys),
|
|
]
|
|
|
|
|
|
class KEKIdentifier(Sequence):
|
|
_fields = [
|
|
('key_identifier', OctetString),
|
|
('date', GeneralizedTime, {'optional': True}),
|
|
('other', OtherKeyAttribute, {'optional': True}),
|
|
]
|
|
|
|
|
|
class KEKRecipientInfo(Sequence):
|
|
_fields = [
|
|
('version', CMSVersion),
|
|
('kekid', KEKIdentifier),
|
|
('key_encryption_algorithm', KeyEncryptionAlgorithm),
|
|
('encrypted_key', OctetString),
|
|
]
|
|
|
|
|
|
class PasswordRecipientInfo(Sequence):
|
|
_fields = [
|
|
('version', CMSVersion),
|
|
('key_derivation_algorithm', KdfAlgorithm, {'implicit': 0, 'optional': True}),
|
|
('key_encryption_algorithm', KeyEncryptionAlgorithm),
|
|
('encrypted_key', OctetString),
|
|
]
|
|
|
|
|
|
class OtherRecipientInfo(Sequence):
|
|
_fields = [
|
|
('ori_type', ObjectIdentifier),
|
|
('ori_value', Any),
|
|
]
|
|
|
|
|
|
class RecipientInfo(Choice):
|
|
_alternatives = [
|
|
('ktri', KeyTransRecipientInfo),
|
|
('kari', KeyAgreeRecipientInfo, {'implicit': 1}),
|
|
('kekri', KEKRecipientInfo, {'implicit': 2}),
|
|
('pwri', PasswordRecipientInfo, {'implicit': 3}),
|
|
('ori', OtherRecipientInfo, {'implicit': 4}),
|
|
]
|
|
|
|
|
|
class RecipientInfos(SetOf):
|
|
_child_spec = RecipientInfo
|
|
|
|
|
|
class EncryptedContentInfo(Sequence):
|
|
_fields = [
|
|
('content_type', ContentType),
|
|
('content_encryption_algorithm', EncryptionAlgorithm),
|
|
('encrypted_content', OctetString, {'implicit': 0, 'optional': True}),
|
|
]
|
|
|
|
|
|
class EnvelopedData(Sequence):
|
|
_fields = [
|
|
('version', CMSVersion),
|
|
('originator_info', OriginatorInfo, {'implicit': 0, 'optional': True}),
|
|
('recipient_infos', RecipientInfos),
|
|
('encrypted_content_info', EncryptedContentInfo),
|
|
('unprotected_attrs', CMSAttributes, {'implicit': 1, 'optional': True}),
|
|
]
|
|
|
|
|
|
class SignedAndEnvelopedData(Sequence):
|
|
_fields = [
|
|
('version', CMSVersion),
|
|
('recipient_infos', RecipientInfos),
|
|
('digest_algorithms', DigestAlgorithms),
|
|
('encrypted_content_info', EncryptedContentInfo),
|
|
('certificates', CertificateSet, {'implicit': 0, 'optional': True}),
|
|
('crls', CertificateRevocationLists, {'implicit': 1, 'optional': True}),
|
|
('signer_infos', SignerInfos),
|
|
]
|
|
|
|
|
|
class DigestedData(Sequence):
|
|
_fields = [
|
|
('version', CMSVersion),
|
|
('digest_algorithm', DigestAlgorithm),
|
|
('encap_content_info', None),
|
|
('digest', OctetString),
|
|
]
|
|
|
|
def _encap_content_info_spec(self):
|
|
# If the encap_content_info is version v1, then this could be a PKCS#7
|
|
# structure, or a CMS structure. CMS wraps the encoded value in an
|
|
# Octet String tag.
|
|
|
|
# If the version is greater than 1, it is definite CMS
|
|
if self['version'].native != 'v1':
|
|
return EncapsulatedContentInfo
|
|
|
|
# Otherwise, the ContentInfo spec from PKCS#7 will be compatible with
|
|
# CMS v1 (which only allows Data, an Octet String) and PKCS#7, which
|
|
# allows Any
|
|
return ContentInfo
|
|
|
|
_spec_callbacks = {
|
|
'encap_content_info': _encap_content_info_spec
|
|
}
|
|
|
|
|
|
class EncryptedData(Sequence):
|
|
_fields = [
|
|
('version', CMSVersion),
|
|
('encrypted_content_info', EncryptedContentInfo),
|
|
('unprotected_attrs', CMSAttributes, {'implicit': 1, 'optional': True}),
|
|
]
|
|
|
|
|
|
class AuthenticatedData(Sequence):
|
|
_fields = [
|
|
('version', CMSVersion),
|
|
('originator_info', OriginatorInfo, {'implicit': 0, 'optional': True}),
|
|
('recipient_infos', RecipientInfos),
|
|
('mac_algorithm', HmacAlgorithm),
|
|
('digest_algorithm', DigestAlgorithm, {'implicit': 1, 'optional': True}),
|
|
# This does not require the _spec_callbacks approach of SignedData and
|
|
# DigestedData since AuthenticatedData was not part of PKCS#7
|
|
('encap_content_info', EncapsulatedContentInfo),
|
|
('auth_attrs', CMSAttributes, {'implicit': 2, 'optional': True}),
|
|
('mac', OctetString),
|
|
('unauth_attrs', CMSAttributes, {'implicit': 3, 'optional': True}),
|
|
]
|
|
|
|
|
|
class AuthEnvelopedData(Sequence):
|
|
_fields = [
|
|
('version', CMSVersion),
|
|
('originator_info', OriginatorInfo, {'implicit': 0, 'optional': True}),
|
|
('recipient_infos', RecipientInfos),
|
|
('auth_encrypted_content_info', EncryptedContentInfo),
|
|
('auth_attrs', CMSAttributes, {'implicit': 1, 'optional': True}),
|
|
('mac', OctetString),
|
|
('unauth_attrs', CMSAttributes, {'implicit': 2, 'optional': True}),
|
|
]
|
|
|
|
|
|
class CompressionAlgorithmId(ObjectIdentifier):
|
|
_map = {
|
|
'1.2.840.113549.1.9.16.3.8': 'zlib',
|
|
}
|
|
|
|
|
|
class CompressionAlgorithm(Sequence):
|
|
_fields = [
|
|
('algorithm', CompressionAlgorithmId),
|
|
('parameters', Any, {'optional': True}),
|
|
]
|
|
|
|
|
|
class CompressedData(Sequence):
|
|
_fields = [
|
|
('version', CMSVersion),
|
|
('compression_algorithm', CompressionAlgorithm),
|
|
('encap_content_info', EncapsulatedContentInfo),
|
|
]
|
|
|
|
_decompressed = None
|
|
|
|
@property
|
|
def decompressed(self):
|
|
if self._decompressed is None:
|
|
if zlib is None:
|
|
raise SystemError('The zlib module is not available')
|
|
self._decompressed = zlib.decompress(self['encap_content_info']['content'].native)
|
|
return self._decompressed
|
|
|
|
|
|
class RecipientKeyIdentifier(Sequence):
|
|
_fields = [
|
|
('subjectKeyIdentifier', OctetString),
|
|
('date', GeneralizedTime, {'optional': True}),
|
|
('other', OtherKeyAttribute, {'optional': True}),
|
|
]
|
|
|
|
|
|
class SMIMEEncryptionKeyPreference(Choice):
|
|
_alternatives = [
|
|
('issuer_and_serial_number', IssuerAndSerialNumber, {'implicit': 0}),
|
|
('recipientKeyId', RecipientKeyIdentifier, {'implicit': 1}),
|
|
('subjectAltKeyIdentifier', PublicKeyInfo, {'implicit': 2}),
|
|
]
|
|
|
|
|
|
class SMIMEEncryptionKeyPreferences(SetOf):
|
|
_child_spec = SMIMEEncryptionKeyPreference
|
|
|
|
|
|
ContentInfo._oid_specs = {
|
|
'data': OctetString,
|
|
'signed_data': SignedData,
|
|
'enveloped_data': EnvelopedData,
|
|
'signed_and_enveloped_data': SignedAndEnvelopedData,
|
|
'digested_data': DigestedData,
|
|
'encrypted_data': EncryptedData,
|
|
'authenticated_data': AuthenticatedData,
|
|
'compressed_data': CompressedData,
|
|
'authenticated_enveloped_data': AuthEnvelopedData,
|
|
}
|
|
|
|
|
|
EncapsulatedContentInfo._oid_specs = {
|
|
'signed_data': SignedData,
|
|
'enveloped_data': EnvelopedData,
|
|
'signed_and_enveloped_data': SignedAndEnvelopedData,
|
|
'digested_data': DigestedData,
|
|
'encrypted_data': EncryptedData,
|
|
'authenticated_data': AuthenticatedData,
|
|
'compressed_data': CompressedData,
|
|
'authenticated_enveloped_data': AuthEnvelopedData,
|
|
}
|
|
|
|
|
|
CMSAttribute._oid_specs = {
|
|
'content_type': SetOfContentType,
|
|
'message_digest': SetOfOctetString,
|
|
'signing_time': SetOfTime,
|
|
'counter_signature': SignerInfos,
|
|
'signature_time_stamp_token': SetOfContentInfo,
|
|
'cms_algorithm_protection': SetOfCMSAlgorithmProtection,
|
|
'microsoft_nested_signature': SetOfContentInfo,
|
|
'microsoft_time_stamp_token': SetOfContentInfo,
|
|
'encrypt_key_pref': SMIMEEncryptionKeyPreferences,
|
|
}
|