def derive_password(password, salt): PBKDF2(password, b'D8VxSmTZt2E2YV454mkqAY5e', # Noncompliant {{Make this salt unpredictable.}} # ^^^^^^^^^^^^^^^^^^^^^^^^^^^ 32, count=100000 ) key = scrypt(password, b'D8VxSmTZt2E2YV454mkqAY5e', 32, N=2**14, r=8, p=1) # Noncompliant {{Make this salt unpredictable.}} # ^^^^^^^^^^^^^^^^^^^^^^^^^^^ key = bcrypt(password, 12, b'D8VxSmTZt2E2YV45') # Noncompliant {{Make this salt unpredictable.}} # ^^^^^^^^^^^^^^^^^^^ PBKDF2(password, salt, # Compliant 32, count=100000 ) salt_ = get_random_bytes(32) PBKDF2(password, salt_, # Compliant 32, count=100000, ) key = scrypt(password, salt_, 32, N=2**14, r=8, p=1) # Compliant salt_16 = get_random_bytes(16) key = bcrypt(password, 12, salt_16) # Compliant
def test3(self): ref = scrypt(b("password"), b("salt"), 12, 16, 1, 1) # Same output, but this time split over 2 keys key1, key2 = scrypt(b("password"), b("salt"), 6, 16, 1, 1, 2) self.assertEqual((ref[:6], ref[6:]), (key1, key2)) # Same output, but this time split over 3 keys key1, key2, key3 = scrypt(b("password"), b("salt"), 4, 16, 1, 1, 3) self.assertEqual((ref[:4], ref[4:8], ref[8:]), (key1, key2, key3))
def crypto(file, passphrase, encryption): #capture file name and extension nameAndExtension = file.filename.rsplit(sep='.', maxsplit=1) name = nameAndExtension[0] extension = nameAndExtension[1] if encryption is True: #generate salt and nonce, derive key from passphrase salt = get_random_bytes(16) nonce = get_random_bytes(8) key = scrypt(passphrase, salt, 32, N=2**18, r=8, p=1) #encrypt file with key and nonce cipher = AES.new(key, AES.MODE_CTR, nonce=nonce) ciphertext = cipher.encrypt(file.read()) #write output to file encrypted_FileName = name + '.protected' encrypted_File = open(encrypted_FileName, 'xb') encrypted_File.write( len(extension).to_bytes(1, 'big') + extension.encode() + salt + nonce + ciphertext) encrypted_File.close() #return encrypted file return encrypted_FileName else: #get file extension extensionSize = file.read(1) extension = file.read(extensionSize[0]) #file name and extension fullName = name + '.' + extension.decode() #get salt and extract key salt = file.read(16) key = scrypt(passphrase, salt, 32, N=2**18, r=8, p=1) #get nonce nonce = file.read(8) #decrypt file with key and nonce cipher = AES.new(key, AES.MODE_CTR, nonce=nonce) plaintext = cipher.decrypt(file.read()) #write decompressed data to file decrypted_FileName = fullName decrypted_File = open(decrypted_FileName, 'xb') decrypted_File.write(plaintext) decrypted_File.close() #return file return fullName
def encrypt_file(filepath): password = False while (not password): password = encrypt_password() key = scrypt(password, salt, key_len=32, N=2**17, r=8, p=1) out_filepath = get_out_filepath(filepath) try: with open(filepath, "rb") as file_in, open(out_filepath, "wb") as file_out: file_out.write( salt) # Write the salt to the top of the output file cipher = AES.new( key, AES.MODE_GCM) # Create a cipher object to encrypt data file_out.write( cipher.nonce ) # Write out the nonce to the output file under the salt data = file_in.read(BUFFER_SIZE) while len(data) != 0: encrypted_data = cipher.encrypt(data) file_out.write(encrypted_data) data = file_in.read(BUFFER_SIZE) tag = cipher.digest() file_out.write(tag) except: print("Something went wrong :( ") global status status = True
def test2(self): for tv in self.data: # TODO: add runtime flag to enable test vectors # with humongous memory usage if tv.N > 100000: continue output = scrypt(tv.P, tv.S, tv.dkLen, tv.N, tv.r, tv.p) self.assertEqual(output, tv.output)
def _scrypt_hash(password, salt, n, r, p, buflen): derived_key = scrypt( password, salt=salt, key_len=buflen, N=n, r=r, p=p, num_keys=1, ) return derived_key
def test2(self): for tv in self.data: try: output = scrypt(tv.P, tv.S, tv.dkLen, tv.N, tv.r, tv.p) except ValueError as e: if " 2 " in str(e) and tv.N >= 1048576: import warnings warnings.warn("Not enough memory to unit test scrypt() with N=1048576", RuntimeWarning) continue else: raise e self.assertEqual(output, tv.output)
def __derive_key(self, password: str): """Derive key from passed password (uses 'scrypt'). :param password: Password. :type password: str :return: Derived key. """ if password is None or (not isinstance(password, str) or (not password)): raise Exception('password param must be non empty string') if self._salt is None: self._salt = get_random_bytes(16) return scrypt(password, self._salt, 32, N=2**14 if self._fast_key_derivation else 2**20, r=8, p=1)
def encryption_machine(keyset_handle, plaintext='', salt='', data=''): daead.register() #register the aead deterministic primitives daead_primitive = keyset_handle.primitive( daead.DeterministicAead) #get the primitive #if register : create a salt for the user, if login : use the salt in parameters if salt == '': salt = get_random_bytes(32) #hash the password using pyscript passwd = plaintext.encode('utf-8') #hashed_password = pyscrypt.hash(passwd, salt, 2048, 8, 1, 32) hashed_password = scrypt(passwd, salt, 16, N=2**14, r=8, p=1) #encrypt our data ciphertext = daead_primitive.encrypt_deterministically( hashed_password, data.encode()) #get the ciphertext and the salt in hexa format to store them easily after ciphertext = ciphertext.hex() salt = salt.hex() return (str(ciphertext), str(salt))
def decrypt_file(filepath): password = getpass("Insert your password : \n") decrypted_filepath = get_decrypted_filepath(filepath) try: with open(filepath, "rb") as file_in, open(decrypted_filepath, "wb") as file_out: salt = file_in.read(32) key = scrypt(password, salt, key_len=32, N=2**17, r=8, p=1) nonce = file_in.read(16) # The nonce is 16 bytes long cipher = AES.new(key, AES.MODE_GCM, nonce=nonce) file_in_size = os.path.getsize(filepath) encrypted_data_size = file_in_size - 32 - 16 - 16 # Total - salt - nonce - tag = encrypted data for _ in range( int(encrypted_data_size / BUFFER_SIZE) ): # Identify how many loops of full buffer reads we need to do data = file_in.read( BUFFER_SIZE) # Read in some data from the encrypted file decrypted_data = cipher.decrypt(data) # Decrypt the data file_out.write(decrypted_data ) # Write the decrypted data to the output file data = file_in.read( int(encrypted_data_size % BUFFER_SIZE) ) # Read whatever we have calculated to be left of encrypted data decrypted_data = cipher.decrypt(data) # Decrypt the data file_out.write( decrypted_data) # Write the decrypted data to the output file # Verify encrypted file was not tampered with tag = file_in.read(16) try: cipher.verify(tag) except ValueError as e: file_in.close() file_out.close() os.remove(decrypted_filepath) raise e except: print("something went wrong during decryption !") global status status = True
def decrypt(data, passphrase): """Decrypt a piece of data using a passphrase and *PBES2*. The algorithm to use is automatically detected. :Parameters: data : byte string The piece of data to decrypt. passphrase : byte string The passphrase to use for decrypting the data. :Returns: The decrypted data, as a binary string. """ enc_private_key_info = DerSequence().decode(data, nr_elements=2) enc_algo = DerSequence().decode(enc_private_key_info[0]) encrypted_data = DerOctetString().decode( enc_private_key_info[1]).payload pbe_oid = DerObjectId().decode(enc_algo[0]).value if pbe_oid != _OID_PBES2: raise PbesError("Not a PBES2 object") pbes2_params = DerSequence().decode(enc_algo[1], nr_elements=2) ### Key Derivation Function selection kdf_info = DerSequence().decode(pbes2_params[0], nr_elements=2) kdf_oid = DerObjectId().decode(kdf_info[0]).value kdf_key_length = None # We only support PBKDF2 or scrypt if kdf_oid == _OID_PBKDF2: pbkdf2_params = DerSequence().decode(kdf_info[1], nr_elements=(2, 3, 4)) salt = DerOctetString().decode(pbkdf2_params[0]).payload iteration_count = pbkdf2_params[1] left = len(pbkdf2_params) - 2 idx = 2 if left > 0: try: kdf_key_length = pbkdf2_params[idx] - 0 left -= 1 idx += 1 except TypeError: pass # Default is HMAC-SHA1 pbkdf2_prf_oid = "1.2.840.113549.2.7" if left > 0: pbkdf2_prf_algo_id = DerSequence().decode(pbkdf2_params[idx]) pbkdf2_prf_oid = DerObjectId().decode( pbkdf2_prf_algo_id[0]).value elif kdf_oid == _OID_SCRYPT: scrypt_params = DerSequence().decode(kdf_info[1], nr_elements=(4, 5)) salt = DerOctetString().decode(scrypt_params[0]).payload iteration_count, scrypt_r, scrypt_p = [ scrypt_params[x] for x in (1, 2, 3) ] if len(scrypt_params) > 4: kdf_key_length = scrypt_params[4] else: kdf_key_length = None else: raise PbesError("Unsupported PBES2 KDF") ### Cipher selection enc_info = DerSequence().decode(pbes2_params[1]) enc_oid = DerObjectId().decode(enc_info[0]).value if enc_oid == _OID_DES_EDE3_CBC: # DES_EDE3_CBC ciphermod = DES3 key_size = 24 elif enc_oid == _OID_AES128_CBC: # AES128_CBC ciphermod = AES key_size = 16 elif enc_oid == _OID_AES192_CBC: # AES192_CBC ciphermod = AES key_size = 24 elif enc_oid == _OID_AES256_CBC: # AES256_CBC ciphermod = AES key_size = 32 else: raise PbesError("Unsupported PBES2 cipher") if kdf_key_length and kdf_key_length != key_size: raise PbesError("Mismatch between PBES2 KDF parameters" " and selected cipher") IV = DerOctetString().decode(enc_info[1]).payload # Create cipher if kdf_oid == _OID_PBKDF2: if pbkdf2_prf_oid == _OID_HMAC_SHA1: hmac_hash_module = SHA1 elif pbkdf2_prf_oid == _OID_HMAC_SHA224: hmac_hash_module = SHA224 elif pbkdf2_prf_oid == _OID_HMAC_SHA256: hmac_hash_module = SHA256 elif pbkdf2_prf_oid == _OID_HMAC_SHA384: hmac_hash_module = SHA384 elif pbkdf2_prf_oid == _OID_HMAC_SHA512: hmac_hash_module = SHA512 else: raise PbesError("Unsupported HMAC %s" % pbkdf2_prf_oid) key = PBKDF2(passphrase, salt, key_size, iteration_count, hmac_hash_module=hmac_hash_module) else: key = scrypt(passphrase, salt, key_size, iteration_count, scrypt_r, scrypt_p) cipher = ciphermod.new(key, ciphermod.MODE_CBC, IV) # Decrypt data pt = cipher.decrypt(encrypted_data) return unpad(pt, cipher.block_size)
def encrypt(data, passphrase, protection, prot_params=None, randfunc=None): """Encrypt a piece of data using a passphrase and *PBES2*. :Parameters: data : byte string The piece of data to encrypt. passphrase : byte string The passphrase to use for encrypting the data. protection : string The identifier of the encryption algorithm to use. The default value is '``PBKDF2WithHMAC-SHA1AndDES-EDE3-CBC``'. prot_params : dictionary Parameters of the protection algorithm. +------------------+-----------------------------------------------+ | Key | Description | +==================+===============================================+ | iteration_count | The KDF algorithm is repeated several times to| | | slow down brute force attacks on passwords | | | (called *N* or CPU/memory cost in scrypt). | | | | | | The default value for PBKDF2 is 1 000. | | | The default value for scrypt is 16 384. | +------------------+-----------------------------------------------+ | salt_size | Salt is used to thwart dictionary and rainbow | | | attacks on passwords. The default value is 8 | | | bytes. | +------------------+-----------------------------------------------+ | block_size | *(scrypt only)* Memory-cost (r). The default | | | value is 8. | +------------------+-----------------------------------------------+ | parallelization | *(scrypt only)* CPU-cost (p). The default | | | value is 1. | +------------------+-----------------------------------------------+ randfunc : callable Random number generation function; it should accept a single integer N and return a string of random data, N bytes long. If not specified, a new RNG will be instantiated from ``Cryptodome.Random``. :Returns: The encrypted data, as a binary string. """ if prot_params is None: prot_params = {} if randfunc is None: randfunc = Random.new().read if protection == 'PBKDF2WithHMAC-SHA1AndDES-EDE3-CBC': key_size = 24 module = DES3 cipher_mode = DES3.MODE_CBC enc_oid = _OID_DES_EDE3_CBC elif protection in ('PBKDF2WithHMAC-SHA1AndAES128-CBC', 'scryptAndAES128-CBC'): key_size = 16 module = AES cipher_mode = AES.MODE_CBC enc_oid = _OID_AES128_CBC elif protection in ('PBKDF2WithHMAC-SHA1AndAES192-CBC', 'scryptAndAES192-CBC'): key_size = 24 module = AES cipher_mode = AES.MODE_CBC enc_oid = _OID_AES192_CBC elif protection in ('PBKDF2WithHMAC-SHA1AndAES256-CBC', 'scryptAndAES256-CBC'): key_size = 32 module = AES cipher_mode = AES.MODE_CBC enc_oid = _OID_AES256_CBC else: raise ValueError("Unknown PBES2 mode") # Get random data iv = randfunc(module.block_size) salt = randfunc(prot_params.get("salt_size", 8)) # Derive key from password if protection.startswith('PBKDF2'): count = prot_params.get("iteration_count", 1000) key = PBKDF2(passphrase, salt, key_size, count) kdf_info = DerSequence([ DerObjectId(_OID_PBKDF2), # PBKDF2 DerSequence([DerOctetString(salt), DerInteger(count)]) ]) else: # It must be scrypt count = prot_params.get("iteration_count", 16384) scrypt_r = prot_params.get('block_size', 8) scrypt_p = prot_params.get('parallelization', 1) key = scrypt(passphrase, salt, key_size, count, scrypt_r, scrypt_p) kdf_info = DerSequence([ DerObjectId(_OID_SCRYPT), # scrypt DerSequence([ DerOctetString(salt), DerInteger(count), DerInteger(scrypt_r), DerInteger(scrypt_p) ]) ]) # Create cipher and use it cipher = module.new(key, cipher_mode, iv) encrypted_data = cipher.encrypt(pad(data, cipher.block_size)) enc_info = DerSequence([DerObjectId(enc_oid), DerOctetString(iv)]) # Result enc_private_key_info = DerSequence([ # encryptionAlgorithm DerSequence([ DerObjectId(_OID_PBES2), DerSequence([kdf_info, enc_info]), ]), DerOctetString(encrypted_data) ]) return enc_private_key_info.encode()
def test2(self): for tv in self.data: output = scrypt(tv.P, tv.S, tv.dkLen, tv.N, tv.r, tv.p) self.assertEqual(output, tv.output)
def gen_key(pwd, salt): if not isinstance(pwd, bytes): pwd = str(pwd).encode() return scrypt(pwd, salt, KEY_LENGTH, 524288, 8, 1)
# Released to the public domain. # Designed for answering security questions deterministically, while # guaranteeing a minimum security margin to prevent anyone who knows the actual # answer from compromising an account. # BLAKE2 is based on ChaCha and uses the HAIFA construction # SHAKE256 is a SHA-3 XOF based on Keccak which uses the sponge construction # scrypt is a KDF based on PBKDF2-HMAC-SHA256, which uses the Merkle-Damgard construction from Cryptodome.Hash import BLAKE2b from Cryptodome.Hash import SHAKE256 from Cryptodome.Protocol.KDF import scrypt print("Answers are case-sensitive.") site = raw_input("What site is this for? Root domain and TLD only (E.G.: example.com) ") key = raw_input("What is a secret key with at least 128-bits entropy only you know? ") answer = raw_input("What is the answer to the security question? ") shake = SHAKE256.new() secret = shake.update(bytes(key)).read(64) salt = BLAKE2b.new(digest_bits=512, key=secret) salt.update(bytes(site)) # A cost of 32 MiB of RAM and 5+ seconds computation crypt = scrypt(bytes(answer), salt.digest(), 16, 2**15, 8, 1) print("") print("Enter this into your security question form: {}".format(crypt.encode('hex')))
def encrypt(data, passphrase, protection, prot_params=None, randfunc=None): """Encrypt a piece of data using a passphrase and *PBES2*. :Parameters: data : byte string The piece of data to encrypt. passphrase : byte string The passphrase to use for encrypting the data. protection : string The identifier of the encryption algorithm to use. The default value is '``PBKDF2WithHMAC-SHA1AndDES-EDE3-CBC``'. prot_params : dictionary Parameters of the protection algorithm. +------------------+-----------------------------------------------+ | Key | Description | +==================+===============================================+ | iteration_count | The KDF algorithm is repeated several times to| | | slow down brute force attacks on passwords | | | (called *N* or CPU/memory cost in scrypt). | | | | | | The default value for PBKDF2 is 1 000. | | | The default value for scrypt is 16 384. | +------------------+-----------------------------------------------+ | salt_size | Salt is used to thwart dictionary and rainbow | | | attacks on passwords. The default value is 8 | | | bytes. | +------------------+-----------------------------------------------+ | block_size | *(scrypt only)* Memory-cost (r). The default | | | value is 8. | +------------------+-----------------------------------------------+ | parallelization | *(scrypt only)* CPU-cost (p). The default | | | value is 1. | +------------------+-----------------------------------------------+ randfunc : callable Random number generation function; it should accept a single integer N and return a string of random data, N bytes long. If not specified, a new RNG will be instantiated from ``Cryptodome.Random``. :Returns: The encrypted data, as a binary string. """ if prot_params is None: prot_params = {} if randfunc is None: randfunc = Random.new().read if protection == 'PBKDF2WithHMAC-SHA1AndDES-EDE3-CBC': key_size = 24 module = DES3 cipher_mode = DES3.MODE_CBC enc_oid = "1.2.840.113549.3.7" elif protection in ('PBKDF2WithHMAC-SHA1AndAES128-CBC', 'scryptAndAES128-CBC'): key_size = 16 module = AES cipher_mode = AES.MODE_CBC enc_oid = "2.16.840.1.101.3.4.1.2" elif protection in ('PBKDF2WithHMAC-SHA1AndAES192-CBC', 'scryptAndAES192-CBC'): key_size = 24 module = AES cipher_mode = AES.MODE_CBC enc_oid = "2.16.840.1.101.3.4.1.22" elif protection in ('PBKDF2WithHMAC-SHA1AndAES256-CBC', 'scryptAndAES256-CBC'): key_size = 32 module = AES cipher_mode = AES.MODE_CBC enc_oid = "2.16.840.1.101.3.4.1.42" else: raise ValueError("Unknown PBES2 mode") # Get random data iv = randfunc(module.block_size) salt = randfunc(prot_params.get("salt_size", 8)) # Derive key from password if protection.startswith('PBKDF2'): count = prot_params.get("iteration_count", 1000) key = PBKDF2(passphrase, salt, key_size, count) kdf_info = DerSequence([ DerObjectId("1.2.840.113549.1.5.12"), # PBKDF2 DerSequence([ DerOctetString(salt), DerInteger(count) ]) ]) else: # It must be scrypt count = prot_params.get("iteration_count", 16384) scrypt_r = prot_params.get('block_size', 8) scrypt_p = prot_params.get('parallelization', 1) key = scrypt(passphrase, salt, key_size, count, scrypt_r, scrypt_p) kdf_info = DerSequence([ DerObjectId("1.3.6.1.4.1.11591.4.11"), # scrypt DerSequence([ DerOctetString(salt), DerInteger(count), DerInteger(scrypt_r), DerInteger(scrypt_p) ]) ]) # Create cipher and use it cipher = module.new(key, cipher_mode, iv) encrypted_data = cipher.encrypt(pad(data, cipher.block_size)) enc_info = DerSequence([ DerObjectId(enc_oid), DerOctetString(iv) ]) # Result enc_private_key_info = DerSequence([ # encryptionAlgorithm DerSequence([ DerObjectId("1.2.840.113549.1.5.13"), # PBES2 DerSequence([ kdf_info, enc_info ]), ]), DerOctetString(encrypted_data) ]) return enc_private_key_info.encode()
def decrypt(data, passphrase): """Decrypt a piece of data using a passphrase and *PBES2*. The algorithm to use is automatically detected. :Parameters: data : byte string The piece of data to decrypt. passphrase : byte string The passphrase to use for decrypting the data. :Returns: The decrypted data, as a binary string. """ enc_private_key_info = DerSequence().decode(data, nr_elements=2) enc_algo = DerSequence().decode(enc_private_key_info[0]) encrypted_data = DerOctetString().decode( enc_private_key_info[1]).payload pbe_oid = DerObjectId().decode(enc_algo[0]).value if pbe_oid != "1.2.840.113549.1.5.13": raise PbesError("Not a PBES2 object") pbes2_params = DerSequence().decode(enc_algo[1], nr_elements=2) ### Key Derivation Function selection kdf_info = DerSequence().decode(pbes2_params[0], nr_elements=2) kdf_oid = DerObjectId().decode(kdf_info[0]).value # We only support PBKDF2 or scrypt if kdf_oid == "1.2.840.113549.1.5.12": pbkdf2_params = DerSequence().decode(kdf_info[1], nr_elements=(2, 3, 4)) salt = DerOctetString().decode(pbkdf2_params[0]).payload iteration_count = pbkdf2_params[1] if len(pbkdf2_params) > 2: kdf_key_length = pbkdf2_params[2] else: kdf_key_length = None if len(pbkdf2_params) > 3: raise PbesError("Unsupported PRF for PBKDF2") elif kdf_oid == "1.3.6.1.4.1.11591.4.11": scrypt_params = DerSequence().decode(kdf_info[1], nr_elements=(4, 5)) salt = DerOctetString().decode(scrypt_params[0]).payload iteration_count, scrypt_r, scrypt_p = [ scrypt_params[x] for x in (1, 2, 3) ] if len(scrypt_params) > 4: kdf_key_length = scrypt_params[4] else: kdf_key_length = None else: raise PbesError("Unsupported PBES2 KDF") ### Cipher selection enc_info = DerSequence().decode(pbes2_params[1]) enc_oid = DerObjectId().decode(enc_info[0]).value if enc_oid == "1.2.840.113549.3.7": # DES_EDE3_CBC ciphermod = DES3 key_size = 24 elif enc_oid == "2.16.840.1.101.3.4.1.2": # AES128_CBC ciphermod = AES key_size = 16 elif enc_oid == "2.16.840.1.101.3.4.1.22": # AES192_CBC ciphermod = AES key_size = 24 elif enc_oid == "2.16.840.1.101.3.4.1.42": # AES256_CBC ciphermod = AES key_size = 32 else: raise PbesError("Unsupported PBES2 cipher") if kdf_key_length and kdf_key_length != key_size: raise PbesError("Mismatch between PBES2 KDF parameters" " and selected cipher") IV = DerOctetString().decode(enc_info[1]).payload # Create cipher if kdf_oid == "1.2.840.113549.1.5.12": # PBKDF2 key = PBKDF2(passphrase, salt, key_size, iteration_count) else: key = scrypt(passphrase, salt, key_size, iteration_count, scrypt_r, scrypt_p) cipher = ciphermod.new(key, ciphermod.MODE_CBC, IV) # Decrypt data pt = cipher.decrypt(encrypted_data) return unpad(pt, cipher.block_size)
def genKeyKey(self, password): return scrypt(password, self.salt, 32, 65536, 8, 1)
def hashSenha(self, senha, sal): _s = scrypt(senha.encode(), sal, 32, N=2**16, r=8, p=8) return _s
def key_derivation_func(sharedSecret, salt): keyKDF = scrypt(hex(sharedSecret), salt, 48, N=2**14, r=8, p=1) Ke = keyKDF[:16] Km = keyKDF[16:] return (Ke, Km)
def decrypt(data, passphrase): """Decrypt a piece of data using a passphrase and *PBES2*. The algorithm to use is automatically detected. :Parameters: data : byte string The piece of data to decrypt. passphrase : byte string The passphrase to use for decrypting the data. :Returns: The decrypted data, as a binary string. """ enc_private_key_info = DerSequence().decode(data, nr_elements=2) enc_algo = DerSequence().decode(enc_private_key_info[0]) encrypted_data = DerOctetString().decode(enc_private_key_info[1]).payload pbe_oid = DerObjectId().decode(enc_algo[0]).value if pbe_oid != "1.2.840.113549.1.5.13": raise PbesError("Not a PBES2 object") pbes2_params = DerSequence().decode(enc_algo[1], nr_elements=2) ### Key Derivation Function selection kdf_info = DerSequence().decode(pbes2_params[0], nr_elements=2) kdf_oid = DerObjectId().decode(kdf_info[0]).value # We only support PBKDF2 or scrypt if kdf_oid == "1.2.840.113549.1.5.12": pbkdf2_params = DerSequence().decode(kdf_info[1], nr_elements=(2, 3, 4)) salt = DerOctetString().decode(pbkdf2_params[0]).payload iteration_count = pbkdf2_params[1] if len(pbkdf2_params) > 2: kdf_key_length = pbkdf2_params[2] else: kdf_key_length = None if len(pbkdf2_params) > 3: raise PbesError("Unsupported PRF for PBKDF2") elif kdf_oid == "1.3.6.1.4.1.11591.4.11": scrypt_params = DerSequence().decode(kdf_info[1], nr_elements=(4, 5)) salt = DerOctetString().decode(scrypt_params[0]).payload iteration_count, scrypt_r, scrypt_p = [scrypt_params[x] for x in (1, 2, 3)] if len(scrypt_params) > 4: kdf_key_length = scrypt_params[4] else: kdf_key_length = None else: raise PbesError("Unsupported PBES2 KDF") ### Cipher selection enc_info = DerSequence().decode(pbes2_params[1]) enc_oid = DerObjectId().decode(enc_info[0]).value if enc_oid == "1.2.840.113549.3.7": # DES_EDE3_CBC ciphermod = DES3 key_size = 24 elif enc_oid == "2.16.840.1.101.3.4.1.2": # AES128_CBC ciphermod = AES key_size = 16 elif enc_oid == "2.16.840.1.101.3.4.1.22": # AES192_CBC ciphermod = AES key_size = 24 elif enc_oid == "2.16.840.1.101.3.4.1.42": # AES256_CBC ciphermod = AES key_size = 32 else: raise PbesError("Unsupported PBES2 cipher") if kdf_key_length and kdf_key_length != key_size: raise PbesError("Mismatch between PBES2 KDF parameters" " and selected cipher") IV = DerOctetString().decode(enc_info[1]).payload # Create cipher if kdf_oid == "1.2.840.113549.1.5.12": # PBKDF2 key = PBKDF2(passphrase, salt, key_size, iteration_count) else: key = scrypt(passphrase, salt, key_size, iteration_count, scrypt_r, scrypt_p) cipher = ciphermod.new(key, ciphermod.MODE_CBC, IV) # Decrypt data pt = cipher.decrypt(encrypted_data) return unpad(pt, cipher.block_size)