PKCS1_OAEP.py 8.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231
  1. # -*- coding: utf-8 -*-
  2. #
  3. # Cipher/PKCS1_OAEP.py : PKCS#1 OAEP
  4. #
  5. # ===================================================================
  6. # The contents of this file are dedicated to the public domain. To
  7. # the extent that dedication to the public domain is not available,
  8. # everyone is granted a worldwide, perpetual, royalty-free,
  9. # non-exclusive license to exercise all rights associated with the
  10. # contents of this file for any purpose whatsoever.
  11. # No rights are reserved.
  12. #
  13. # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  14. # EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  15. # MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  16. # NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
  17. # BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
  18. # ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  19. # CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  20. # SOFTWARE.
  21. # ===================================================================
  22. from Crypto.Signature.pss import MGF1
  23. import Crypto.Hash.SHA1
  24. from Crypto.Util.py3compat import _copy_bytes
  25. import Crypto.Util.number
  26. from Crypto.Util.number import ceil_div, bytes_to_long, long_to_bytes
  27. from Crypto.Util.strxor import strxor
  28. from Crypto import Random
  29. from ._pkcs1_oaep_decode import oaep_decode
  30. class PKCS1OAEP_Cipher:
  31. """Cipher object for PKCS#1 v1.5 OAEP.
  32. Do not create directly: use :func:`new` instead."""
  33. def __init__(self, key, hashAlgo, mgfunc, label, randfunc):
  34. """Initialize this PKCS#1 OAEP cipher object.
  35. :Parameters:
  36. key : an RSA key object
  37. If a private half is given, both encryption and decryption are possible.
  38. If a public half is given, only encryption is possible.
  39. hashAlgo : hash object
  40. The hash function to use. This can be a module under `Crypto.Hash`
  41. or an existing hash object created from any of such modules. If not specified,
  42. `Crypto.Hash.SHA1` is used.
  43. mgfunc : callable
  44. A mask generation function that accepts two parameters: a string to
  45. use as seed, and the lenth of the mask to generate, in bytes.
  46. If not specified, the standard MGF1 consistent with ``hashAlgo`` is used (a safe choice).
  47. label : bytes/bytearray/memoryview
  48. A label to apply to this particular encryption. If not specified,
  49. an empty string is used. Specifying a label does not improve
  50. security.
  51. randfunc : callable
  52. A function that returns random bytes.
  53. :attention: Modify the mask generation function only if you know what you are doing.
  54. Sender and receiver must use the same one.
  55. """
  56. self._key = key
  57. if hashAlgo:
  58. self._hashObj = hashAlgo
  59. else:
  60. self._hashObj = Crypto.Hash.SHA1
  61. if mgfunc:
  62. self._mgf = mgfunc
  63. else:
  64. self._mgf = lambda x, y: MGF1(x, y, self._hashObj)
  65. self._label = _copy_bytes(None, None, label)
  66. self._randfunc = randfunc
  67. def can_encrypt(self):
  68. """Legacy function to check if you can call :meth:`encrypt`.
  69. .. deprecated:: 3.0"""
  70. return self._key.can_encrypt()
  71. def can_decrypt(self):
  72. """Legacy function to check if you can call :meth:`decrypt`.
  73. .. deprecated:: 3.0"""
  74. return self._key.can_decrypt()
  75. def encrypt(self, message):
  76. """Encrypt a message with PKCS#1 OAEP.
  77. :param message:
  78. The message to encrypt, also known as plaintext. It can be of
  79. variable length, but not longer than the RSA modulus (in bytes)
  80. minus 2, minus twice the hash output size.
  81. For instance, if you use RSA 2048 and SHA-256, the longest message
  82. you can encrypt is 190 byte long.
  83. :type message: bytes/bytearray/memoryview
  84. :returns: The ciphertext, as large as the RSA modulus.
  85. :rtype: bytes
  86. :raises ValueError:
  87. if the message is too long.
  88. """
  89. # See 7.1.1 in RFC3447
  90. modBits = Crypto.Util.number.size(self._key.n)
  91. k = ceil_div(modBits, 8) # Convert from bits to bytes
  92. hLen = self._hashObj.digest_size
  93. mLen = len(message)
  94. # Step 1b
  95. ps_len = k - mLen - 2 * hLen - 2
  96. if ps_len < 0:
  97. raise ValueError("Plaintext is too long.")
  98. # Step 2a
  99. lHash = self._hashObj.new(self._label).digest()
  100. # Step 2b
  101. ps = b'\x00' * ps_len
  102. # Step 2c
  103. db = lHash + ps + b'\x01' + _copy_bytes(None, None, message)
  104. # Step 2d
  105. ros = self._randfunc(hLen)
  106. # Step 2e
  107. dbMask = self._mgf(ros, k-hLen-1)
  108. # Step 2f
  109. maskedDB = strxor(db, dbMask)
  110. # Step 2g
  111. seedMask = self._mgf(maskedDB, hLen)
  112. # Step 2h
  113. maskedSeed = strxor(ros, seedMask)
  114. # Step 2i
  115. em = b'\x00' + maskedSeed + maskedDB
  116. # Step 3a (OS2IP)
  117. em_int = bytes_to_long(em)
  118. # Step 3b (RSAEP)
  119. m_int = self._key._encrypt(em_int)
  120. # Step 3c (I2OSP)
  121. c = long_to_bytes(m_int, k)
  122. return c
  123. def decrypt(self, ciphertext):
  124. """Decrypt a message with PKCS#1 OAEP.
  125. :param ciphertext: The encrypted message.
  126. :type ciphertext: bytes/bytearray/memoryview
  127. :returns: The original message (plaintext).
  128. :rtype: bytes
  129. :raises ValueError:
  130. if the ciphertext has the wrong length, or if decryption
  131. fails the integrity check (in which case, the decryption
  132. key is probably wrong).
  133. :raises TypeError:
  134. if the RSA key has no private half (i.e. you are trying
  135. to decrypt using a public key).
  136. """
  137. # See 7.1.2 in RFC3447
  138. modBits = Crypto.Util.number.size(self._key.n)
  139. k = ceil_div(modBits, 8) # Convert from bits to bytes
  140. hLen = self._hashObj.digest_size
  141. # Step 1b and 1c
  142. if len(ciphertext) != k or k < hLen+2:
  143. raise ValueError("Ciphertext with incorrect length.")
  144. # Step 2a (O2SIP)
  145. ct_int = bytes_to_long(ciphertext)
  146. # Step 2b (RSADP) and step 2c (I2OSP)
  147. em = self._key._decrypt_to_bytes(ct_int)
  148. # Step 3a
  149. lHash = self._hashObj.new(self._label).digest()
  150. # y must be 0, but we MUST NOT check it here in order not to
  151. # allow attacks like Manger's (http://dl.acm.org/citation.cfm?id=704143)
  152. maskedSeed = em[1:hLen+1]
  153. maskedDB = em[hLen+1:]
  154. # Step 3c
  155. seedMask = self._mgf(maskedDB, hLen)
  156. # Step 3d
  157. seed = strxor(maskedSeed, seedMask)
  158. # Step 3e
  159. dbMask = self._mgf(seed, k-hLen-1)
  160. # Step 3f
  161. db = strxor(maskedDB, dbMask)
  162. # Step 3b + 3g
  163. res = oaep_decode(em, lHash, db)
  164. if res <= 0:
  165. raise ValueError("Incorrect decryption.")
  166. # Step 4
  167. return db[res:]
  168. def new(key, hashAlgo=None, mgfunc=None, label=b'', randfunc=None):
  169. """Return a cipher object :class:`PKCS1OAEP_Cipher`
  170. that can be used to perform PKCS#1 OAEP encryption or decryption.
  171. :param key:
  172. The key object to use to encrypt or decrypt the message.
  173. Decryption is only possible with a private RSA key.
  174. :type key: RSA key object
  175. :param hashAlgo:
  176. The hash function to use. This can be a module under `Crypto.Hash`
  177. or an existing hash object created from any of such modules.
  178. If not specified, `Crypto.Hash.SHA1` is used.
  179. :type hashAlgo: hash object
  180. :param mgfunc:
  181. A mask generation function that accepts two parameters: a string to
  182. use as seed, and the lenth of the mask to generate, in bytes.
  183. If not specified, the standard MGF1 consistent with ``hashAlgo`` is used (a safe choice).
  184. :type mgfunc: callable
  185. :param label:
  186. A label to apply to this particular encryption. If not specified,
  187. an empty string is used. Specifying a label does not improve
  188. security.
  189. :type label: bytes/bytearray/memoryview
  190. :param randfunc:
  191. A function that returns random bytes.
  192. The default is `Random.get_random_bytes`.
  193. :type randfunc: callable
  194. """
  195. if randfunc is None:
  196. randfunc = Random.get_random_bytes
  197. return PKCS1OAEP_Cipher(key, hashAlgo, mgfunc, label, randfunc)