
    mg#                        d Z ddlmZ ddlZddlZddlmZmZmZm	Z	m
Z
 ddlmZmZmZmZ  ed      Zeeeeef   ZdZdZd	Zd
ZdZdedeeef   defdZdededef   dedefdZdddededeeef   fdZdddededede
e   dedeeef   fdZdddedededeeeef   f
dZ dddededed edeeeef   fd!Z!dededede
e   dedeeef   fd"Z"dededed#edeeeef   f
d$Z#dede
e   dedee   fd%Z$	 dd&l%m&Z& dd'l'm(Z( dd(l)m*Z*m+Z+m,Z, dd)l-m.Z.m/Z/m0Z0 dd*l-m1Z1 d+Z2y# e3e4e5f$ r d,Z2ded-ede	fd.Z6e6Z"e6Z#e6Z$Y yw xY w)/zU2F security key handler    )sha256N)CallableListMappingNoReturnOptional)SequenceTupleTypeVarcast_PollResultg?s                                       iialg
public_keyreturnc                 p    t        t        |d         }| t        k(  r|S d|z   t        t        |d         z   S )z8Decode algorithm and public value from a CTAP public key   )r   bytesSSH_SK_ED25519)r   r   results      +lib/python3.12/site-packages/asyncssh/sk.py_decode_public_keyr   .   s<     %B(F
n& 4z"~#>>>    poll_intervalfunc.argsc                     	 	  || S # t         $ r=}|j                  t        j                  k7  r t	        j
                  |        Y d}~nd}~ww xY wP)z'Poll until a CTAP1 response is receivedN)	ApduErrorcodeAPDUUSE_NOT_SATISFIEDtimesleep)r   r   r   excs       r   _ctap1_pollr'   9   sO     	&; 	&xx4111JJ}%%		& s    	A3A		AdevCtapHidDeviceapplicationc                     t        |       }|t        k7  rt        d      t        |      j	                         }t        t        |j                  t        |      }|j                  |j                  fS )z.Enroll a new security key using CTAP version 1zUnsupported algorithm)Ctap1SSH_SK_ECDSA
ValueErrorr   digestr'   _CTAP1_POLL_INTERVALregister_dummy_hashr   
key_handle)r(   r   r*   ctap1app_hashregistrations         r   _ctap1_enrollr7   G   se     #JE
l011k"))+H3U^^*H6L ""L$;$;;;r   userpinresidentc           	          t        |       }|j                  d      }||d}|j                  d      |d}d|dg}	d|i}
|rVt               }t	        ||      j                  |      }t        j                  |t        t              j                         dd }nd}d}|r|j                  nd}|j                  t        |||	|
||      }|j                  j                  }t        ||j                         |j"                  fS )	z.Enroll a new security key using CTAP version 2utf-8)idname
public-key)typer   rkN   )optionspin_uv_parampin_uv_protocol)Ctap2decodeencodePinProtocolV1	ClientPinget_pin_tokenhmacnewr2   r   r/   VERSIONmake_credential	auth_datacredential_datar   r   credential_id)r(   r   r*   r8   r9   r:   ctap2rp	user_cred
key_paramsrC   pin_protocol	pin_tokenpin_authpin_versioncredcdatas                    r   _ctap2_enrollr]   W   s   
 #JE$$W-K[	1B{{7+T:I'45JXG
 $e\2@@E	88I{F;BBDSbI*6,&&DK  b)Z)0x1< ! >D NN**E c5#3#34e6I6IIIr   message_hashr3   c                     t        |       }t        |      j                         }t        t        |j
                  |||      }|d   }t        j                  |dd d      }|dd }	|||	fS )z7Sign a message with a security key using CTAP version 1r   r      bigN)r,   r   r/   r'   r0   authenticateint
from_bytes)
r(   r^   r*   r3   r4   r5   auth_responseflagscountersigs
             r   _ctap1_signri   y   sy     #JEk"))+H 4e6H6H ,h
DM !Enn]1Q/7G

C'3r   touch_requiredc                     t        |       }|j                  d      }d|dg}d|i}|j                  ||||      d   }|j                  }	|	j                  |	j
                  |j                  fS )z7Sign a message with a security key using CTAP version 2r<   r?   )r@   r=   up)rC   r   )rF   rG   get_assertionsrP   rf   rg   	signature)
r(   r^   r*   r3   rj   rS   allow_credsrC   	assertionrP   s
             r   _ctap2_signrq      s    
 #JE$$W-K(
;<K^$G$$[,-4 % 6679I ##I??I--y/B/BBBr   c                    	 t        t        j                               }	 t        || ||||      |j                          S # t        $ r t	        d      dw xY w# t        $ r}|j                  t        j                  j                  k(  rt	        d      d|j                  t        j                  j                  k(  rt	        d      dt	        t        |            dd}~wt        $ rN}	 t        || |      cY d}~|j                          S # t        $ r}t	        t        |            dd}~ww xY wd}~ww xY w# |j                          w xY w)zEnroll a new security keyzNo security key foundNzPIN requiredInvalid PIN)nextr)   list_devicesStopIterationr.   r]   close	CtapErrorr!   ERRPUAT_REQUIREDPIN_INVALIDstrr7   r    )r   r*   r8   r9   r:   r(   r&   s          r   	sk_enrollr}      s   <=--/0S#{D#xH 			%  <01t;<
  188y}}222^,$6XX222]+5SX&D0 1	1 c;77 			  	1SX&D0	11 			s_   A  A  A	D7"A;CD7*D6D77D: 	D/D**D//D22D77D: :Erf   c                    t        |t        z        }t        j                         D ]#  }	 t	        || |||      |j                          c S  t        d      # t        $ rF}|j                  t        j                  j                  k7  rt        t        |            dY d}~n}d}~wt        $ rn 	 t        || ||      cY |j                          c S # t        $ r<}|j                  t        j                  k7  rt        t        |            dY d}~nd}~ww xY wY nw xY w|j                          
# |j                          w xY w)z"Sign a message with a security keyNz!Security key credential not found)boolSSH_SK_USER_PRESENCE_REQDr)   ru   rq   rw   rx   r!   ry   NO_CREDENTIALSr.   r|   ri   r    r"   
WRONG_DATA)r^   r*   r3   rf   rj   r(   r&   s          r   sk_signr      s    %";;<N))+	sL+)>; IIK ,  8
99  	5xx9==777 S*4 8 	99"3k:NN
 IIK	  988t.$SX.D8 /9.		9 IIKCIIKse   A	D!<B"D1"D/C<D=D1	D2DDDDD1DD11Ec                    t        |       j                         }g }t        j                         D ]t  }	 t	        |      }t               }t        ||      j                  |      }t        |||      }	|	j                  |      D ]  }
t        t        t        t        f   |
t        j                  j                           }t        t        |d         }|r||k7  rWt        t        t        t        f   |
t        j                  j                            }t        t"        |d         }t        t        t$        t        f   |
t        j                  j&                           }t        t$        |d         }t)        ||      }|j+                  ||||f        	 |j5                          w |S # t,        $ r}|j.                  t,        j0                  j2                  k(  rY d}~|j5                          |j.                  t,        j0                  j6                  k(  rt9        d      d|j.                  t,        j0                  j:                  k(  rt9        d      dt9        t        |            dd}~ww xY w# |j5                          w xY w)z#Get keys resident on a security keyr>   r=      Nrs   zPIN not set)r   r/   r)   ru   rF   rI   rJ   rK   CredentialManagementenumerate_credsr   r   r|   objectRESULTUSERCREDENTIAL_IDr   rc   
PUBLIC_KEYr   appendrx   r!   ry   r   rw   r{   r.   PIN_NOT_SET)r*   r8   r9   r5   r   r(   rS   rW   rX   	cred_mgmtr[   	user_infor>   cred_idr3   r   r   public_valuer&   s                      r   sk_get_residentr      s    k"))+H#%F))+$	#JE(?L!%6DDSII,UL)LI!11(; f!5!%&:&A&A&F&F!GI	C6!23DDLwsF{3#$8$?$?$M$MNP!%7
!'#v+"6"&';'B'B'M'M"NP
 3
1.1#zBsD,
CD% <: IIKK ,N M  	5xx9==777 IIK Y]]666 /T9Y]]666 /T9 S*4	5 IIKs1   EF**	I03'I+I30A;I++I00I33J)r)   )rx   )r,   r"   r    )rF   rJ   rI   )r   TFkwargsc                      t        d      )z/Report that security key support is unavailablez"Security key support not available)r.   )r   r   s     r   _sk_not_availabler     s     =>>r   )7__doc__hashlibr   rL   r$   typingr   r   r   r   r   r	   r
   r   r   r   rc   r|   r   _SKResidentKeyr0   r2   r   r-   r   r   r   floatr'   r7   r   r]   ri   rq   r}   r   r   	fido2.hidr)   
fido2.ctaprx   fido2.ctap1r,   r"   r    fido2.ctap2rF   rJ   rI   r   sk_availableImportErrorOSErrorAttributeErrorr    r   r   <module>r      s  *     > > 1 1 m$sC-.   !  ?C ?WS&[-A ?e ?&u &HS+5E,F &&"-&< <S <$<).ue|)<< J JS Ju JJ"*3-J J%*5%<%8JD_ E  !&+CeO&<$C_ CE C"C05C $C).sC)?C&3 U # C=,05:5%<5H6:% :e : :: c51:2. .hsm ..!).!9.b('$22;;0LWn- 
(L? ?6 ?h ?
 "IG'O
(s   :(D# #E ?E 