Coverage for /pythoncovmergedfiles/medio/medio/usr/local/lib/python3.8/site-packages/cryptography/hazmat/primitives/ciphers/modes.py: 59%
140 statements
« prev ^ index » next coverage.py v7.3.2, created at 2023-12-08 06:05 +0000
« prev ^ index » next coverage.py v7.3.2, created at 2023-12-08 06:05 +0000
1# This file is dual licensed under the terms of the Apache License, Version
2# 2.0, and the BSD License. See the LICENSE file in the root of this repository
3# for complete details.
5from __future__ import annotations
7import abc
8import typing
10from cryptography import utils
11from cryptography.exceptions import UnsupportedAlgorithm, _Reasons
12from cryptography.hazmat.primitives._cipheralgorithm import (
13 BlockCipherAlgorithm,
14 CipherAlgorithm,
15)
16from cryptography.hazmat.primitives.ciphers import algorithms
19class Mode(metaclass=abc.ABCMeta):
20 @property
21 @abc.abstractmethod
22 def name(self) -> str:
23 """
24 A string naming this mode (e.g. "ECB", "CBC").
25 """
27 @abc.abstractmethod
28 def validate_for_algorithm(self, algorithm: CipherAlgorithm) -> None:
29 """
30 Checks that all the necessary invariants of this (mode, algorithm)
31 combination are met.
32 """
35class ModeWithInitializationVector(Mode, metaclass=abc.ABCMeta):
36 @property
37 @abc.abstractmethod
38 def initialization_vector(self) -> bytes:
39 """
40 The value of the initialization vector for this mode as bytes.
41 """
44class ModeWithTweak(Mode, metaclass=abc.ABCMeta):
45 @property
46 @abc.abstractmethod
47 def tweak(self) -> bytes:
48 """
49 The value of the tweak for this mode as bytes.
50 """
53class ModeWithNonce(Mode, metaclass=abc.ABCMeta):
54 @property
55 @abc.abstractmethod
56 def nonce(self) -> bytes:
57 """
58 The value of the nonce for this mode as bytes.
59 """
62class ModeWithAuthenticationTag(Mode, metaclass=abc.ABCMeta):
63 @property
64 @abc.abstractmethod
65 def tag(self) -> typing.Optional[bytes]:
66 """
67 The value of the tag supplied to the constructor of this mode.
68 """
71def _check_aes_key_length(self: Mode, algorithm: CipherAlgorithm) -> None:
72 if algorithm.key_size > 256 and algorithm.name == "AES":
73 raise ValueError(
74 "Only 128, 192, and 256 bit keys are allowed for this AES mode"
75 )
78def _check_iv_length(
79 self: ModeWithInitializationVector, algorithm: BlockCipherAlgorithm
80) -> None:
81 if len(self.initialization_vector) * 8 != algorithm.block_size:
82 raise ValueError(
83 "Invalid IV size ({}) for {}.".format(
84 len(self.initialization_vector), self.name
85 )
86 )
89def _check_nonce_length(
90 nonce: bytes, name: str, algorithm: CipherAlgorithm
91) -> None:
92 if not isinstance(algorithm, BlockCipherAlgorithm):
93 raise UnsupportedAlgorithm(
94 f"{name} requires a block cipher algorithm",
95 _Reasons.UNSUPPORTED_CIPHER,
96 )
97 if len(nonce) * 8 != algorithm.block_size:
98 raise ValueError(f"Invalid nonce size ({len(nonce)}) for {name}.")
101def _check_iv_and_key_length(
102 self: ModeWithInitializationVector, algorithm: CipherAlgorithm
103) -> None:
104 if not isinstance(algorithm, BlockCipherAlgorithm):
105 raise UnsupportedAlgorithm(
106 f"{self} requires a block cipher algorithm",
107 _Reasons.UNSUPPORTED_CIPHER,
108 )
109 _check_aes_key_length(self, algorithm)
110 _check_iv_length(self, algorithm)
113class CBC(ModeWithInitializationVector):
114 name = "CBC"
116 def __init__(self, initialization_vector: bytes):
117 utils._check_byteslike("initialization_vector", initialization_vector)
118 self._initialization_vector = initialization_vector
120 @property
121 def initialization_vector(self) -> bytes:
122 return self._initialization_vector
124 validate_for_algorithm = _check_iv_and_key_length
127class XTS(ModeWithTweak):
128 name = "XTS"
130 def __init__(self, tweak: bytes):
131 utils._check_byteslike("tweak", tweak)
133 if len(tweak) != 16:
134 raise ValueError("tweak must be 128-bits (16 bytes)")
136 self._tweak = tweak
138 @property
139 def tweak(self) -> bytes:
140 return self._tweak
142 def validate_for_algorithm(self, algorithm: CipherAlgorithm) -> None:
143 if isinstance(algorithm, (algorithms.AES128, algorithms.AES256)):
144 raise TypeError(
145 "The AES128 and AES256 classes do not support XTS, please use "
146 "the standard AES class instead."
147 )
149 if algorithm.key_size not in (256, 512):
150 raise ValueError(
151 "The XTS specification requires a 256-bit key for AES-128-XTS"
152 " and 512-bit key for AES-256-XTS"
153 )
156class ECB(Mode):
157 name = "ECB"
159 validate_for_algorithm = _check_aes_key_length
162class OFB(ModeWithInitializationVector):
163 name = "OFB"
165 def __init__(self, initialization_vector: bytes):
166 utils._check_byteslike("initialization_vector", initialization_vector)
167 self._initialization_vector = initialization_vector
169 @property
170 def initialization_vector(self) -> bytes:
171 return self._initialization_vector
173 validate_for_algorithm = _check_iv_and_key_length
176class CFB(ModeWithInitializationVector):
177 name = "CFB"
179 def __init__(self, initialization_vector: bytes):
180 utils._check_byteslike("initialization_vector", initialization_vector)
181 self._initialization_vector = initialization_vector
183 @property
184 def initialization_vector(self) -> bytes:
185 return self._initialization_vector
187 validate_for_algorithm = _check_iv_and_key_length
190class CFB8(ModeWithInitializationVector):
191 name = "CFB8"
193 def __init__(self, initialization_vector: bytes):
194 utils._check_byteslike("initialization_vector", initialization_vector)
195 self._initialization_vector = initialization_vector
197 @property
198 def initialization_vector(self) -> bytes:
199 return self._initialization_vector
201 validate_for_algorithm = _check_iv_and_key_length
204class CTR(ModeWithNonce):
205 name = "CTR"
207 def __init__(self, nonce: bytes):
208 utils._check_byteslike("nonce", nonce)
209 self._nonce = nonce
211 @property
212 def nonce(self) -> bytes:
213 return self._nonce
215 def validate_for_algorithm(self, algorithm: CipherAlgorithm) -> None:
216 _check_aes_key_length(self, algorithm)
217 _check_nonce_length(self.nonce, self.name, algorithm)
220class GCM(ModeWithInitializationVector, ModeWithAuthenticationTag):
221 name = "GCM"
222 _MAX_ENCRYPTED_BYTES = (2**39 - 256) // 8
223 _MAX_AAD_BYTES = (2**64) // 8
225 def __init__(
226 self,
227 initialization_vector: bytes,
228 tag: typing.Optional[bytes] = None,
229 min_tag_length: int = 16,
230 ):
231 # OpenSSL 3.0.0 constrains GCM IVs to [64, 1024] bits inclusive
232 # This is a sane limit anyway so we'll enforce it here.
233 utils._check_byteslike("initialization_vector", initialization_vector)
234 if len(initialization_vector) < 8 or len(initialization_vector) > 128:
235 raise ValueError(
236 "initialization_vector must be between 8 and 128 bytes (64 "
237 "and 1024 bits)."
238 )
239 self._initialization_vector = initialization_vector
240 if tag is not None:
241 utils._check_bytes("tag", tag)
242 if min_tag_length < 4:
243 raise ValueError("min_tag_length must be >= 4")
244 if len(tag) < min_tag_length:
245 raise ValueError(
246 "Authentication tag must be {} bytes or longer.".format(
247 min_tag_length
248 )
249 )
250 self._tag = tag
251 self._min_tag_length = min_tag_length
253 @property
254 def tag(self) -> typing.Optional[bytes]:
255 return self._tag
257 @property
258 def initialization_vector(self) -> bytes:
259 return self._initialization_vector
261 def validate_for_algorithm(self, algorithm: CipherAlgorithm) -> None:
262 _check_aes_key_length(self, algorithm)
263 if not isinstance(algorithm, BlockCipherAlgorithm):
264 raise UnsupportedAlgorithm(
265 "GCM requires a block cipher algorithm",
266 _Reasons.UNSUPPORTED_CIPHER,
267 )
268 block_size_bytes = algorithm.block_size // 8
269 if self._tag is not None and len(self._tag) > block_size_bytes:
270 raise ValueError(
271 "Authentication tag cannot be more than {} bytes.".format(
272 block_size_bytes
273 )
274 )