def test_cose_usage_examples_cose_mac_direct(self):
mac_key = COSEKey.from_symmetric_key(alg="HS512", kid="01")
r = Recipient.from_jwk({"alg": "direct"})
r.apply(mac_key)
ctx = COSE.new()
encoded = ctx.encode_and_mac(b"Hello world!", mac_key, recipients=[r])
assert b"Hello world!" == ctx.decode(encoded, mac_key)
r2 = Recipient.new(unprotected={"alg": "direct"})
r2.apply(mac_key)
encoded2 = ctx.encode_and_mac(b"Hello world!",
mac_key,
recipients=[r2])
assert b"Hello world!" == ctx.decode(encoded2, mac_key)
r3 = Recipient.new(unprotected={1: -6})
r3.apply(mac_key)
encoded3 = ctx.encode_and_mac(b"Hello world!",
mac_key,
recipients=[r3])
assert b"Hello world!" == ctx.decode(encoded3, mac_key)
assert encoded == encoded2 == encoded3
def test_cose_usage_examples_cose_encrypt(self):
enc_key = COSEKey.from_symmetric_key(alg="ChaCha20/Poly1305", kid="01")
nonce = enc_key.generate_nonce()
r = Recipient.from_jwk({"alg": "direct"})
r.apply(enc_key)
ctx = COSE.new()
encoded = ctx.encode_and_encrypt(
b"Hello world!",
enc_key,
nonce=nonce,
recipients=[r],
)
assert b"Hello world!" == ctx.decode(encoded, enc_key)
r = Recipient.new(unprotected={"alg": "direct"})
r.apply(enc_key)
encoded2 = ctx.encode_and_encrypt(
b"Hello world!",
enc_key,
nonce=nonce,
recipients=[r],
)
assert b"Hello world!" == ctx.decode(encoded2, enc_key)
encoded3 = ctx.encode_and_encrypt(
b"Hello world!",
enc_key,
nonce=nonce,
recipients=[r],
)
assert b"Hello world!" == ctx.decode(encoded3, enc_key)
assert encoded == encoded2 == encoded3
def test_cose_decode_mac_with_multiple_keys_with_verify_kid_and_protected_kid(
self):
ctx = COSE.new(alg_auto_inclusion=True, verify_kid=True)
key = COSEKey.from_symmetric_key(alg="HS256")
material1 = base64.urlsafe_b64encode(token_bytes(16)).decode()
material2 = base64.urlsafe_b64encode(token_bytes(16)).decode()
material3 = base64.urlsafe_b64encode(token_bytes(16)).decode()
shared_key1 = COSEKey.from_jwk({
"kty": "oct",
"alg": "A128KW",
"k": material1
})
shared_key2 = COSEKey.from_jwk({
"kty": "oct",
"alg": "A128KW",
"k": material2
})
shared_key3 = COSEKey.from_jwk({
"kty": "oct",
"alg": "A128KW",
"k": material3
})
r1 = Recipient.new(protected={1: -3, 4: b"01"}, sender_key=shared_key1)
r2 = Recipient.new(protected={1: -3, 4: b"02"}, sender_key=shared_key2)
r1.apply(key)
r2.apply(key)
encoded = ctx.encode_and_mac(b"Hello world!", key, recipients=[r2, r1])
shared_key1 = COSEKey.from_jwk({
"kid": "01",
"kty": "oct",
"alg": "A128KW",
"k": material1
})
shared_key3 = COSEKey.from_jwk({
"kid": "03",
"kty": "oct",
"alg": "A128KW",
"k": material3
})
assert b"Hello world!" == ctx.decode(encoded,
keys=[shared_key3, shared_key1])
def test_recipients_constructor_with_recipient_alg_direct(self):
key = COSEKey.from_symmetric_key("mysecret",
alg="HMAC 256/64",
kid="our-secret")
r = Recipients([Recipient.new(unprotected={1: -6, 4: b"our-secret"})])
key = r.extract([key])
assert key.kty == 4
assert key.alg == 4
assert key.kid == b"our-secret"
def test_cose_wg_examples_rfc8152_c_3_2_with_json(self):
cwt_str = "D8608443A1010AA1054D89F52F65A1C580933B5261A76C581C753548A19B1307084CA7B2056924ED95F2E3B17006DFE931B687B847818343A10129A2335061616262636364646565666667676868044A6F75722D73656372657440"
recipient = Recipient.new({1: -10}, {
-20: b"aabbccddeeffgghh",
4: b"our-secret"
})
context = {
"alg": "AES-CCM-16-64-128",
"apu": {
"id": "lighting-client",
},
"apv": {
"id": "lighting-server",
},
"supp_pub": {
"other": "Encryption Example 02",
},
}
material = COSEKey.from_symmetric_key(
base64url_decode("hJtXIZ2uSN5kbQfbtTNWbpdmhkV8FJG-Onbc6mxCcYg"),
alg="A256GCM",
)
enc_key = recipient.apply(material, context=context)
ctx = COSE.new()
encoded = ctx.encode_and_encrypt(
b"This is the content.",
key=enc_key,
nonce=bytes.fromhex("89F52F65A1C580933B5261A76C"),
protected={1: 10},
recipients=[recipient],
)
assert encoded == bytes.fromhex(cwt_str)
material = COSEKey.from_symmetric_key(
key=base64url_decode(
"hJtXIZ2uSN5kbQfbtTNWbpdmhkV8FJG-Onbc6mxCcYg"),
alg="A256GCM",
kid="our-secret",
)
context = {
"alg": "AES-CCM-16-64-128",
"apu": {
"id": "lighting-client",
},
"apv": {
"id": "lighting-server",
},
"supp_pub": {
"other": "Encryption Example 02",
},
}
res = ctx.decode(encoded, context=context, keys=[material])
assert res == b"This is the content."
def test_recipients_extract_without_context(self, material):
r = Recipients(
[
Recipient.new(unprotected={
"alg": "direct+HKDF-SHA-256",
"kid": "02"
}, )
],
True,
)
with pytest.raises(ValueError) as err:
r.extract(keys=[material])
pytest.fail("extract() should fail.")
assert "context should be set." in str(err.value)
def test_recipient_new_with_invalid_arg(self, protected, unprotected, msg):
with pytest.raises(ValueError) as err:
Recipient.new(protected, unprotected)
pytest.fail("Recipient() should fail.")
assert msg in str(err.value)