def test_asn1(self):
"""Unit test ASN.1 module"""
for value, data in self.tests:
data = codecs.decode(data, 'hex')
with self.subTest(msg='encode', value=value):
self.assertEqual(der_encode(value), data)
with self.subTest(msg='decode', data=data):
decoded_value = der_decode(data)
self.assertEqual(decoded_value, value)
self.assertEqual(hash(decoded_value), hash(value))
self.assertEqual(repr(decoded_value), repr(value))
self.assertEqual(str(decoded_value), str(value))
for cls, args in self.encode_errors:
with self.subTest(msg='encode error', cls=cls.__name__, args=args):
with self.assertRaises(ASN1EncodeError):
der_encode(cls(*args))
for data in self.decode_errors:
with self.subTest(msg='decode error', data=data):
with self.assertRaises(ASN1DecodeError):
der_decode(codecs.decode(data, 'hex'))
def verify(self, data, sig):
verifier = self._key.verifier(der_encode(sig), SHA1())
verifier.update(data)
try:
verifier.verify()
return True
except InvalidSignature:
return False
def verify(self, data, sig):
verifier = self._key.verifier(der_encode(sig), SHA1())
verifier.update(data)
try:
verifier.verify()
return True
except InvalidSignature:
return False
def _enroll(alg):
"""Enroll a new security key"""
if alg == SSH_SK_ECDSA:
key = ECDSAPrivateKey.generate(b'nistp256')
else:
key = EdDSAPrivateKey.generate(b'ed25519')
key_handle = der_encode((alg, key.public_value, key.private_value))
return key.public_value, key_handle
def check_decode_errors(self):
"""Check error code paths in key decoding"""
private_errors = [
('Non-ASCII', '\xff'), ('Incomplete ASN.1', b''),
('Invalid PKCS#1', der_encode(None)),
('Invalid PKCS#1 params',
der_encode((1, b'', TaggedDERObject(0, b'')))),
('Invalid PKCS#1 EC named curve OID',
der_encode((1, b'', TaggedDERObject(0,
ObjectIdentifier('1.1'))))),
('Invalid PKCS#8',
der_encode((0, (self.privkey.pkcs8_oid, ()), der_encode(None)))),
('Invalid PKCS#8 ASN.1',
der_encode((0, (self.privkey.pkcs8_oid, None), b''))),
('Invalid PKCS#8 params',
der_encode(
(1, (self.privkey.pkcs8_oid, b''), der_encode((1, b''))))),
('Invalid PEM header', b'-----BEGIN XXX-----\n'),
('Missing PEM footer', b'-----BEGIN PRIVATE KEY-----\n'),
('Invalid PEM key type', b'-----BEGIN XXX PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(None)) +
b'-----END XXX PRIVATE KEY-----'),
('Invalid PEM Base64', b'-----BEGIN PRIVATE KEY-----\n'
b'X\n'
b'-----END PRIVATE KEY-----'),
('Missing PKCS#1 passphrase', b'-----BEGIN DSA PRIVATE KEY-----\n'
b'Proc-Type: 4,ENCRYPTED\n'
b'-----END DSA PRIVATE KEY-----'),
('Incomplete PEM ASN.1', b'-----BEGIN PRIVATE KEY-----\n'
b'-----END PRIVATE KEY-----'),
('Missing PEM PKCS#8 passphrase',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(None)) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#1 key', b'-----BEGIN DSA PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(None)) +
b'-----END DSA PRIVATE KEY-----'),
('Invalid PEM PKCS#8 key', b'-----BEGIN PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(None)) +
b'-----END PRIVATE KEY-----'),
('Unknown format OpenSSH key',
b'-----BEGIN OPENSSH PRIVATE KEY-----\n' +
binascii.b2a_base64(b'XXX') +
b'-----END OPENSSH PRIVATE KEY-----'),
('Incomplete OpenSSH key',
b'-----BEGIN OPENSSH PRIVATE KEY-----\n' +
binascii.b2a_base64(b'openssh-key-v1\0') +
b'-----END OPENSSH PRIVATE KEY-----'),
('Invalid OpenSSH nkeys',
b'-----BEGIN OPENSSH PRIVATE KEY-----\n' +
binascii.b2a_base64(b''.join(
(b'openssh-key-v1\0', String(''), String(''), String(''),
UInt32(2), String(''), String('')))) +
b'-----END OPENSSH PRIVATE KEY-----'),
('Missing OpenSSH passphrase',
b'-----BEGIN OPENSSH PRIVATE KEY-----\n' +
binascii.b2a_base64(b''.join(
(b'openssh-key-v1\0', String('xxx'), String(''), String(''),
UInt32(1), String(''), String('')))) +
b'-----END OPENSSH PRIVATE KEY-----'),
('Mismatched OpenSSH check bytes',
b'-----BEGIN OPENSSH PRIVATE KEY-----\n' +
binascii.b2a_base64(b''.join(
(b'openssh-key-v1\0', String('none'), String(''), String(''),
UInt32(1), String(''),
String(b''.join((UInt32(1), UInt32(2))))))) +
b'-----END OPENSSH PRIVATE KEY-----'),
('Invalid OpenSSH algorithm',
b'-----BEGIN OPENSSH PRIVATE KEY-----\n' +
binascii.b2a_base64(b''.join(
(b'openssh-key-v1\0', String('none'), String(''), String(''),
UInt32(1), String(''),
String(b''.join((UInt32(1), UInt32(1), String('xxx'))))))) +
b'-----END OPENSSH PRIVATE KEY-----'),
('Invalid OpenSSH pad', b'-----BEGIN OPENSSH PRIVATE KEY-----\n' +
binascii.b2a_base64(b''.join(
(b'openssh-key-v1\0', String('none'), String(''), String(''),
UInt32(1), String(''),
String(b''.join(
(UInt32(1), UInt32(1), String('ssh-dss'), 5 * MPInt(0),
String(''), b'\0')))))) +
b'-----END OPENSSH PRIVATE KEY-----')
]
decrypt_errors = [
('Invalid PKCS#1', der_encode(None)),
('Invalid PKCS#8',
der_encode((0, (self.privkey.pkcs8_oid, ()), der_encode(None)))),
('Invalid PEM params', b'-----BEGIN DSA PRIVATE KEY-----\n'
b'Proc-Type: 4,ENCRYPTED\n'
b'DEK-Info: XXX\n'
b'-----END DSA PRIVATE KEY-----'),
('Invalid PEM cipher', b'-----BEGIN DSA PRIVATE KEY-----\n'
b'Proc-Type: 4,ENCRYPTED\n'
b'DEK-Info: XXX,00\n'
b'-----END DSA PRIVATE KEY-----'),
('Invalid PEM IV', b'-----BEGIN DSA PRIVATE KEY-----\n'
b'Proc-Type: 4,ENCRYPTED\n'
b'DEK-Info: AES-256-CBC,XXX\n'
b'-----END DSA PRIVATE KEY-----'),
('Invalid PEM PKCS#8 encrypted data',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(None)) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#8 encrypted header',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(
(None, None))) + b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#8 encryption algorithm',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(((None, None), b''))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#8 PBES1 encryption parameters',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(((_ES1_SHA1_DES, None), b''))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#8 PBES1 PKCS#12 encryption parameters',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(((_P12_RC4_40, None), b''))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#8 PBES1 PKCS#12 salt',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(
((_P12_RC4_40,
(b'', 0)), b''))) + b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#8 PBES1 PKCS#12 iteration count',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(((_P12_RC4_40, (b'x', 0)), b''))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#8 PBES2 encryption parameters',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(((_ES2, None), b''))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#8 PBES2 KDF algorithm',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' + binascii.b2a_base64(
der_encode(((_ES2, ((None, None), (None, None))), b''))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#8 PBES2 encryption algorithm',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' + binascii.b2a_base64(
der_encode(
((_ES2, ((_ES2_PBKDF2, None), (None, None))), b''))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#8 PBES2 PBKDF2 parameters',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' + binascii.b2a_base64(
der_encode(((_ES2, ((_ES2_PBKDF2, None),
(_ES2_AES128, None))), b''))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#8 PBES2 PBKDF2 salt',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' + binascii.b2a_base64(
der_encode(((_ES2, ((_ES2_PBKDF2, (None, None)),
(_ES2_AES128, None))), b''))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#8 PBES2 PBKDF2 iteration count',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' + binascii.b2a_base64(
der_encode(((_ES2, ((_ES2_PBKDF2, (b'', None)),
(_ES2_AES128, None))), b''))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#8 PBES2 PBKDF2 PRF',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' + binascii.b2a_base64(
der_encode(((_ES2, ((_ES2_PBKDF2, (b'', 0, None)),
(_ES2_AES128, None))), b''))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Unknown PEM PKCS#8 PBES2 PBKDF2 PRF',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' + binascii.b2a_base64(
der_encode(
((_ES2, ((_ES2_PBKDF2, (b'', 0,
(ObjectIdentifier('1.1'), None))),
(_ES2_AES128, None))), b''))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#8 PBES2 encryption parameters',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' + binascii.b2a_base64(
der_encode(((_ES2, ((_ES2_PBKDF2, (b'', 0)),
(_ES2_AES128, None))), b''))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid length PEM PKCS#8 PBES2 IV',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' + binascii.b2a_base64(
der_encode(((_ES2, ((_ES2_PBKDF2, (b'', 0)),
(_ES2_AES128, b''))), b''))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid OpenSSH cipher',
b'-----BEGIN OPENSSH PRIVATE KEY-----\n' +
binascii.b2a_base64(b''.join(
(b'openssh-key-v1\0', String('xxx'), String(''), String(''),
UInt32(1), String(''), String('')))) +
b'-----END OPENSSH PRIVATE KEY-----'),
('Invalid OpenSSH kdf', b'-----BEGIN OPENSSH PRIVATE KEY-----\n' +
binascii.b2a_base64(b''.join(
(b'openssh-key-v1\0', String('aes256-cbc'), String('xxx'),
String(''), UInt32(1), String(''), String('')))) +
b'-----END OPENSSH PRIVATE KEY-----'),
('Invalid OpenSSH kdf data',
b'-----BEGIN OPENSSH PRIVATE KEY-----\n' +
binascii.b2a_base64(b''.join(
(b'openssh-key-v1\0', String('aes256-cbc'), String('bcrypt'),
String(''), UInt32(1), String(''), String('')))) +
b'-----END OPENSSH PRIVATE KEY-----'),
('Invalid OpenSSH salt', b'-----BEGIN OPENSSH PRIVATE KEY-----\n' +
binascii.b2a_base64(b''.join(
(b'openssh-key-v1\0', String('aes256-cbc'), String('bcrypt'),
String(b''.join(
(String(b''), UInt32(1)))), UInt32(1), String(''),
String('')))) + b'-----END OPENSSH PRIVATE KEY-----'),
('Invalid OpenSSH encrypted data',
b'-----BEGIN OPENSSH PRIVATE KEY-----\n' +
binascii.b2a_base64(b''.join(
(b'openssh-key-v1\0', String('aes256-cbc'), String('bcrypt'),
String(b''.join(
(String(16 * b'\0'), UInt32(1)))), UInt32(1), String(''),
String('')))) + b'-----END OPENSSH PRIVATE KEY-----'),
('Unexpected OpenSSH trailing data',
b'-----BEGIN OPENSSH PRIVATE KEY-----\n' +
binascii.b2a_base64(b''.join(
(b'openssh-key-v1\0', String('aes256-cbc'), String('bcrypt'),
String(b''.join((String(16 * b'\0'), UInt32(1)))), UInt32(1),
String(''), String(''), String('xxx')))) +
b'-----END OPENSSH PRIVATE KEY-----')
]
public_errors = [
('Non-ASCII', '\xff'), ('Incomplete ASN.1', b''),
('Invalid ASN.1', b'\x30'), ('Invalid PKCS#1', der_encode(None)),
('Invalid PKCS#8',
der_encode(
((self.pubkey.pkcs8_oid, ()), BitString(der_encode(None))))),
('Invalid PKCS#8 ASN.1',
der_encode(((self.pubkey.pkcs8_oid, None), BitString(b'')))),
('Invalid PEM header', b'-----BEGIN XXX-----\n'),
('Missing PEM footer', b'-----BEGIN PUBLIC KEY-----\n'),
('Invalid PEM key type', b'-----BEGIN XXX PUBLIC KEY-----\n' +
binascii.b2a_base64(der_encode(None)) +
b'-----END XXX PUBLIC KEY-----'),
('Invalid PEM Base64', b'-----BEGIN PUBLIC KEY-----\n'
b'X\n'
b'-----END PUBLIC KEY-----'),
('Incomplete PEM ASN.1', b'-----BEGIN PUBLIC KEY-----\n'
b'-----END PUBLIC KEY-----'),
('Invalid PKCS#1 key data', b'-----BEGIN DSA PUBLIC KEY-----\n' +
binascii.b2a_base64(der_encode(None)) +
b'-----END DSA PUBLIC KEY-----'),
('Invalid PKCS#8 key data', b'-----BEGIN PUBLIC KEY-----\n' +
binascii.b2a_base64(der_encode(None)) +
b'-----END PUBLIC KEY-----'), ('Invalid OpenSSH', b'xxx'),
('Invalid OpenSSH Base64', b'ssh-dss X'),
('Unknown OpenSSH algorithm',
b'ssh-dss ' + binascii.b2a_base64(String('xxx'))),
('Invalid OpenSSH body',
b'ssh-dss ' + binascii.b2a_base64(String('ssh-dss'))),
('Invalid RFC4716 header', b'---- XXX ----\n'),
('Missing RFC4716 footer', b'---- BEGIN SSH2 PUBLIC KEY ----\n'),
('Invalid RFC4716 header', b'---- BEGIN SSH2 PUBLIC KEY ----\n'
b'XXX:\\\n'
b'---- END SSH2 PUBLIC KEY ----\n'),
('Invalid RFC4716 Base64', b'---- BEGIN SSH2 PUBLIC KEY ----\n'
b'X\n'
b'---- END SSH2 PUBLIC KEY ----\n')
]
for fmt, data in private_errors:
with self.subTest('Decode private (%s)' % fmt):
with self.assertRaises(KeyImportError):
import_private_key(data)
for fmt, data in decrypt_errors:
with self.subTest('Decrypt private (%s)' % fmt):
with self.assertRaises((KeyImportError, KeyEncryptionError)):
import_private_key(data, 'x')
for fmt, data in public_errors:
with self.subTest('Decode public (%s)' % fmt):
with self.assertRaises(KeyImportError):
import_public_key(data)
def check_decode_errors(self):
"""Check error code paths in key decoding"""
private_errors = [
('Non-ASCII', '\xff'),
('Incomplete ASN.1', b''),
('Invalid PKCS#1', der_encode(None)),
('Invalid PKCS#1 params',
der_encode((1, b'', TaggedDERObject(0, b'')))),
('Invalid PKCS#1 EC named curve OID',
der_encode((1, b'',
TaggedDERObject(0, ObjectIdentifier('1.1'))))),
('Invalid PKCS#8',
der_encode((0, (self.privkey.pkcs8_oid, ()), der_encode(None)))),
('Invalid PKCS#8 ASN.1',
der_encode((0, (self.privkey.pkcs8_oid, None), b''))),
('Invalid PKCS#8 params',
der_encode((1, (self.privkey.pkcs8_oid, b''),
der_encode((1, b''))))),
('Invalid PEM header', b'-----BEGIN XXX-----\n'),
('Missing PEM footer', b'-----BEGIN PRIVATE KEY-----\n'),
('Invalid PEM key type',
b'-----BEGIN XXX PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(None)) +
b'-----END XXX PRIVATE KEY-----'),
('Invalid PEM Base64',
b'-----BEGIN PRIVATE KEY-----\n'
b'X\n'
b'-----END PRIVATE KEY-----'),
('Missing PKCS#1 passphrase',
b'-----BEGIN DSA PRIVATE KEY-----\n'
b'Proc-Type: 4,ENCRYPTED\n'
b'-----END DSA PRIVATE KEY-----'),
('Incomplete PEM ASN.1',
b'-----BEGIN PRIVATE KEY-----\n'
b'-----END PRIVATE KEY-----'),
('Missing PEM PKCS#8 passphrase',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(None)) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#1 key',
b'-----BEGIN DSA PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(None)) +
b'-----END DSA PRIVATE KEY-----'),
('Invalid PEM PKCS#8 key',
b'-----BEGIN PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(None)) +
b'-----END PRIVATE KEY-----'),
('Unknown format OpenSSH key',
b'-----BEGIN OPENSSH PRIVATE KEY-----\n' +
binascii.b2a_base64(b'XXX') +
b'-----END OPENSSH PRIVATE KEY-----'),
('Incomplete OpenSSH key',
b'-----BEGIN OPENSSH PRIVATE KEY-----\n' +
binascii.b2a_base64(b'openssh-key-v1\0') +
b'-----END OPENSSH PRIVATE KEY-----'),
('Invalid OpenSSH nkeys',
b'-----BEGIN OPENSSH PRIVATE KEY-----\n' +
binascii.b2a_base64(b''.join(
(b'openssh-key-v1\0', String(''), String(''), String(''),
UInt32(2), String(''), String('')))) +
b'-----END OPENSSH PRIVATE KEY-----'),
('Missing OpenSSH passphrase',
b'-----BEGIN OPENSSH PRIVATE KEY-----\n' +
binascii.b2a_base64(b''.join(
(b'openssh-key-v1\0', String('xxx'), String(''), String(''),
UInt32(1), String(''), String('')))) +
b'-----END OPENSSH PRIVATE KEY-----'),
('Mismatched OpenSSH check bytes',
b'-----BEGIN OPENSSH PRIVATE KEY-----\n' +
binascii.b2a_base64(b''.join(
(b'openssh-key-v1\0', String('none'), String(''), String(''),
UInt32(1), String(''), String(b''.join((UInt32(1),
UInt32(2))))))) +
b'-----END OPENSSH PRIVATE KEY-----'),
('Invalid OpenSSH algorithm',
b'-----BEGIN OPENSSH PRIVATE KEY-----\n' +
binascii.b2a_base64(b''.join(
(b'openssh-key-v1\0', String('none'), String(''), String(''),
UInt32(1), String(''), String(b''.join((UInt32(1), UInt32(1),
String('xxx'))))))) +
b'-----END OPENSSH PRIVATE KEY-----'),
('Invalid OpenSSH pad',
b'-----BEGIN OPENSSH PRIVATE KEY-----\n' +
binascii.b2a_base64(b''.join(
(b'openssh-key-v1\0', String('none'), String(''), String(''),
UInt32(1), String(''), String(b''.join((UInt32(1), UInt32(1),
String('ssh-dss'),
5*MPInt(0),
String(''),
b'\0')))))) +
b'-----END OPENSSH PRIVATE KEY-----')
]
decrypt_errors = [
('Invalid PKCS#1', der_encode(None)),
('Invalid PKCS#8', der_encode((0, (self.privkey.pkcs8_oid, ()),
der_encode(None)))),
('Invalid PEM params', b'-----BEGIN DSA PRIVATE KEY-----\n'
b'Proc-Type: 4,ENCRYPTED\n'
b'DEK-Info: XXX\n'
b'-----END DSA PRIVATE KEY-----'),
('Invalid PEM cipher', b'-----BEGIN DSA PRIVATE KEY-----\n'
b'Proc-Type: 4,ENCRYPTED\n'
b'DEK-Info: XXX,00\n'
b'-----END DSA PRIVATE KEY-----'),
('Invalid PEM IV', b'-----BEGIN DSA PRIVATE KEY-----\n'
b'Proc-Type: 4,ENCRYPTED\n'
b'DEK-Info: AES-256-CBC,XXX\n'
b'-----END DSA PRIVATE KEY-----'),
('Invalid PEM PKCS#8 encrypted data',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(None)) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#8 encrypted header',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode((None, None))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#8 encryption algorithm',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(((None, None), b''))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#8 PBES1 encryption parameters',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(((_ES1_SHA1_DES, None), b''))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#8 PBES1 PKCS#12 encryption parameters',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(((_P12_RC4_40, None), b''))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#8 PBES1 PKCS#12 salt',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(((_P12_RC4_40, (b'', 0)), b''))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#8 PBES1 PKCS#12 iteration count',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(((_P12_RC4_40, (b'x', 0)), b''))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#8 PBES2 encryption parameters',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(((_ES2, None), b''))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#8 PBES2 KDF algorithm',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(
((_ES2, ((None, None), (None, None))), b''))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#8 PBES2 encryption algorithm',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(
((_ES2, ((_ES2_PBKDF2, None), (None, None))), b''))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#8 PBES2 PBKDF2 parameters',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(
((_ES2, ((_ES2_PBKDF2, None), (_ES2_AES128, None))), b''))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#8 PBES2 PBKDF2 salt',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(
((_ES2, ((_ES2_PBKDF2, (None, None)),
(_ES2_AES128, None))), b''))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#8 PBES2 PBKDF2 iteration count',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(
((_ES2, ((_ES2_PBKDF2, (b'', None)),
(_ES2_AES128, None))), b''))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#8 PBES2 PBKDF2 PRF',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(
((_ES2, ((_ES2_PBKDF2, (b'', 0, None)),
(_ES2_AES128, None))), b''))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Unknown PEM PKCS#8 PBES2 PBKDF2 PRF',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(
((_ES2, ((_ES2_PBKDF2, (b'', 0,
(ObjectIdentifier('1.1'), None))),
(_ES2_AES128, None))), b''))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid PEM PKCS#8 PBES2 encryption parameters',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(
((_ES2, ((_ES2_PBKDF2, (b'', 0)),
(_ES2_AES128, None))), b''))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid length PEM PKCS#8 PBES2 IV',
b'-----BEGIN ENCRYPTED PRIVATE KEY-----\n' +
binascii.b2a_base64(der_encode(
((_ES2, ((_ES2_PBKDF2, (b'', 0)),
(_ES2_AES128, b''))), b''))) +
b'-----END ENCRYPTED PRIVATE KEY-----'),
('Invalid OpenSSH cipher',
b'-----BEGIN OPENSSH PRIVATE KEY-----\n' +
binascii.b2a_base64(b''.join(
(b'openssh-key-v1\0', String('xxx'), String(''), String(''),
UInt32(1), String(''), String('')))) +
b'-----END OPENSSH PRIVATE KEY-----'),
('Invalid OpenSSH kdf',
b'-----BEGIN OPENSSH PRIVATE KEY-----\n' +
binascii.b2a_base64(b''.join(
(b'openssh-key-v1\0', String('aes256-cbc'), String('xxx'),
String(''), UInt32(1), String(''), String('')))) +
b'-----END OPENSSH PRIVATE KEY-----'),
('Invalid OpenSSH kdf data',
b'-----BEGIN OPENSSH PRIVATE KEY-----\n' +
binascii.b2a_base64(b''.join(
(b'openssh-key-v1\0', String('aes256-cbc'), String('bcrypt'),
String(''), UInt32(1), String(''), String('')))) +
b'-----END OPENSSH PRIVATE KEY-----'),
('Invalid OpenSSH salt',
b'-----BEGIN OPENSSH PRIVATE KEY-----\n' +
binascii.b2a_base64(b''.join(
(b'openssh-key-v1\0', String('aes256-cbc'), String('bcrypt'),
String(b''.join((String(b''), UInt32(1)))), UInt32(1),
String(''), String('')))) +
b'-----END OPENSSH PRIVATE KEY-----'),
('Invalid OpenSSH encrypted data',
b'-----BEGIN OPENSSH PRIVATE KEY-----\n' +
binascii.b2a_base64(b''.join(
(b'openssh-key-v1\0', String('aes256-cbc'), String('bcrypt'),
String(b''.join((String(16*b'\0'), UInt32(1)))), UInt32(1),
String(''), String('')))) +
b'-----END OPENSSH PRIVATE KEY-----'),
('Unexpected OpenSSH trailing data',
b'-----BEGIN OPENSSH PRIVATE KEY-----\n' +
binascii.b2a_base64(b''.join(
(b'openssh-key-v1\0', String('aes256-cbc'), String('bcrypt'),
String(b''.join((String(16*b'\0'), UInt32(1)))), UInt32(1),
String(''), String(''), String('xxx')))) +
b'-----END OPENSSH PRIVATE KEY-----')
]
public_errors = [
('Non-ASCII', '\xff'),
('Incomplete ASN.1', b''),
('Invalid ASN.1', b'\x30'),
('Invalid PKCS#1', der_encode(None)),
('Invalid PKCS#8', der_encode(((self.pubkey.pkcs8_oid, ()),
BitString(der_encode(None))))),
('Invalid PKCS#8 ASN.1', der_encode(((self.pubkey.pkcs8_oid,
None), BitString(b'')))),
('Invalid PEM header', b'-----BEGIN XXX-----\n'),
('Missing PEM footer', b'-----BEGIN PUBLIC KEY-----\n'),
('Invalid PEM key type',
b'-----BEGIN XXX PUBLIC KEY-----\n' +
binascii.b2a_base64(der_encode(None)) +
b'-----END XXX PUBLIC KEY-----'),
('Invalid PEM Base64',
b'-----BEGIN PUBLIC KEY-----\n'
b'X\n'
b'-----END PUBLIC KEY-----'),
('Incomplete PEM ASN.1',
b'-----BEGIN PUBLIC KEY-----\n'
b'-----END PUBLIC KEY-----'),
('Invalid PKCS#1 key data',
b'-----BEGIN DSA PUBLIC KEY-----\n' +
binascii.b2a_base64(der_encode(None)) +
b'-----END DSA PUBLIC KEY-----'),
('Invalid PKCS#8 key data',
b'-----BEGIN PUBLIC KEY-----\n' +
binascii.b2a_base64(der_encode(None)) +
b'-----END PUBLIC KEY-----'),
('Invalid OpenSSH', b'xxx'),
('Invalid OpenSSH Base64', b'ssh-dss X'),
('Unknown OpenSSH algorithm',
b'ssh-dss ' + binascii.b2a_base64(String('xxx'))),
('Invalid OpenSSH body',
b'ssh-dss ' + binascii.b2a_base64(String('ssh-dss'))),
('Invalid RFC4716 header', b'---- XXX ----\n'),
('Missing RFC4716 footer', b'---- BEGIN SSH2 PUBLIC KEY ----\n'),
('Invalid RFC4716 header',
b'---- BEGIN SSH2 PUBLIC KEY ----\n'
b'XXX:\\\n'
b'---- END SSH2 PUBLIC KEY ----\n'),
('Invalid RFC4716 Base64',
b'---- BEGIN SSH2 PUBLIC KEY ----\n'
b'X\n'
b'---- END SSH2 PUBLIC KEY ----\n')
]
for fmt, data in private_errors:
with self.subTest('Decode private (%s)' % fmt):
with self.assertRaises(KeyImportError):
import_private_key(data)
for fmt, data in decrypt_errors:
with self.subTest('Decrypt private (%s)' % fmt):
with self.assertRaises((KeyImportError, KeyEncryptionError)):
import_private_key(data, 'x')
for fmt, data in public_errors:
with self.subTest('Decode public (%s)' % fmt):
with self.assertRaises(KeyImportError):
import_public_key(data)