def test_wrap_additional_vectors(self, backend, params): wrapping_key = binascii.unhexlify(params["key"]) key_to_wrap = binascii.unhexlify(params["input"]) wrapped_key = keywrap.aes_key_wrap_with_padding( wrapping_key, key_to_wrap, backend ) assert wrapped_key == binascii.unhexlify(params["output"])
def wrap(self, secret): '''Wrap the key and save the further parameters''' # _wrapkey = os.urandom(16) _wrapkey = os.urandom(RANDOM_BYTES) self._wrappedkey = keywrap.aes_key_wrap_with_padding( _wrapkey, secret, default_backend()) return _wrapkey
def test_wrap(self, backend, params): wrapping_key = binascii.unhexlify(params["k"]) key_to_wrap = binascii.unhexlify(params["p"]) wrapped_key = keywrap.aes_key_wrap_with_padding( wrapping_key, key_to_wrap, backend ) assert params["c"] == binascii.hexlify(wrapped_key)
def _CkmRsaAesKeyWrap(self, public_key_bytes, target_key_bytes): try: from cryptography.hazmat.primitives import serialization from cryptography.hazmat.backends import default_backend from cryptography.hazmat.primitives import keywrap from cryptography.hazmat.primitives.asymmetric import padding from cryptography.hazmat.primitives import hashes except ImportError: log.err.Print( 'Cannot load the Pyca cryptography library. Either the ' 'library is not installed, or site packages are not ' 'enabled for the Google Cloud SDK. Please consult ' 'https://cloud.google.com/kms/docs/crypto for further ' 'instructions.') sys.exit(1) public_key = serialization.load_pem_public_key( public_key_bytes, backend=default_backend()) ephem_key = os.urandom(32) wrapped_ephem_key = public_key.encrypt( ephem_key, padding.OAEP(mgf=padding.MGF1(algorithm=hashes.SHA1()), algorithm=hashes.SHA1(), label=None)) wrapped_target_key = keywrap.aes_key_wrap_with_padding( ephem_key, target_key_bytes, default_backend()) return wrapped_ephem_key + wrapped_target_key
def _CkmRsaAesKeyWrap(self, public_key_bytes, target_key_bytes): try: # TODO(b/141249289): Move imports to the top of the file. In the # meantime, until we're sure that all Cloud SDK users have the # cryptography module available, let's not error out if we can't load the # module unless we're actually going down this code path. # pylint: disable=g-import-not-at-top from cryptography.hazmat.primitives import serialization from cryptography.hazmat.backends import default_backend from cryptography.hazmat.primitives import keywrap from cryptography.hazmat.primitives.asymmetric import padding from cryptography.hazmat.primitives import hashes except ImportError: log.err.Print( 'Cannot load the Pyca cryptography library. Either the ' 'library is not installed, or site packages are not ' 'enabled for the Google Cloud SDK. Please consult ' 'https://cloud.google.com/kms/docs/crypto for further ' 'instructions.') sys.exit(1) public_key = serialization.load_pem_public_key( public_key_bytes, backend=default_backend()) ephem_key = os.urandom(32) wrapped_ephem_key = public_key.encrypt( ephem_key, padding.OAEP(mgf=padding.MGF1(algorithm=hashes.SHA1()), algorithm=hashes.SHA1(), label=None)) wrapped_target_key = keywrap.aes_key_wrap_with_padding( ephem_key, target_key_bytes, default_backend()) return wrapped_ephem_key + wrapped_target_key
def test_wrap_additional_vectors(self, backend, subtests): params = _load_all_params("keywrap", ["kwp_botan.txt"], load_nist_vectors) for param in params: with subtests.test(): wrapping_key = binascii.unhexlify(param["key"]) key_to_wrap = binascii.unhexlify(param["input"]) wrapped_key = keywrap.aes_key_wrap_with_padding( wrapping_key, key_to_wrap, backend) assert wrapped_key == binascii.unhexlify(param["output"])
def test_wrap(self, backend, subtests): params = _load_all_params( os.path.join("keywrap", "kwtestvectors"), ["KWP_AE_128.txt", "KWP_AE_192.txt", "KWP_AE_256.txt"], load_nist_vectors, ) for param in params: with subtests.test(): wrapping_key = binascii.unhexlify(param["k"]) key_to_wrap = binascii.unhexlify(param["p"]) wrapped_key = keywrap.aes_key_wrap_with_padding( wrapping_key, key_to_wrap, backend) assert param["c"] == binascii.hexlify(wrapped_key)
def test_keywrap_with_padding(backend, wycheproof): wrapping_key = binascii.unhexlify(wycheproof.testcase["key"]) key_to_wrap = binascii.unhexlify(wycheproof.testcase["msg"]) expected = binascii.unhexlify(wycheproof.testcase["ct"]) result = keywrap.aes_key_wrap_with_padding(wrapping_key, key_to_wrap, backend) if wycheproof.valid or wycheproof.acceptable: assert result == expected if wycheproof.valid or (wycheproof.acceptable and not len(expected) < 16): result = keywrap.aes_key_unwrap_with_padding(wrapping_key, expected, backend) assert result == key_to_wrap else: with pytest.raises(keywrap.InvalidUnwrap): keywrap.aes_key_unwrap_with_padding(wrapping_key, expected, backend)
def test_keywrap_with_padding(backend, wycheproof): wrapping_key = binascii.unhexlify(wycheproof.testcase["key"]) key_to_wrap = binascii.unhexlify(wycheproof.testcase["msg"]) expected = binascii.unhexlify(wycheproof.testcase["ct"]) result = keywrap.aes_key_wrap_with_padding( wrapping_key, key_to_wrap, backend ) if wycheproof.valid or wycheproof.acceptable: assert result == expected if wycheproof.valid or (wycheproof.acceptable and not len(expected) < 16): result = keywrap.aes_key_unwrap_with_padding( wrapping_key, expected, backend ) assert result == key_to_wrap else: with pytest.raises(keywrap.InvalidUnwrap): keywrap.aes_key_unwrap_with_padding( wrapping_key, expected, backend )
def test_wrap_invalid_key_length(self, backend): with pytest.raises(ValueError, match='must be a valid AES key length'): keywrap.aes_key_wrap_with_padding(b"badkey", b"\x00", backend)
def test_wrap_invalid_key_length(self, backend): with pytest.raises(ValueError, match='must be a valid AES key length'): keywrap.aes_key_wrap_with_padding(b"badkey", b"\x00", backend)
def import_manually_wrapped_key(project_id, location_id, key_ring_id, crypto_key_id, import_job_id): """ Generates and imports local key material to Cloud KMS. Args: project_id (string): Google Cloud project ID (e.g. 'my-project'). location_id (string): Cloud KMS location (e.g. 'us-east1'). key_ring_id (string): ID of the Cloud KMS key ring (e.g. 'my-key-ring'). crypto_key_id (string): ID of the key to import (e.g. 'my-asymmetric-signing-key'). import_job_id (string): ID of the import job (e.g. 'my-import-job'). """ # Import the client library and Python standard cryptographic libraries. import os from cryptography.hazmat import backends from cryptography.hazmat.primitives import hashes, keywrap, serialization from cryptography.hazmat.primitives.asymmetric import ec, padding from google.cloud import kms # Generate some key material in Python and format it in PKCS #8 DER as # required by Google Cloud KMS. key = ec.generate_private_key(ec.SECP256R1, backends.default_backend()) formatted_key = key.private_bytes(serialization.Encoding.DER, serialization.PrivateFormat.PKCS8, serialization.NoEncryption()) print('Generated key bytes: {}'.format(formatted_key)) # Create the client. client = kms.KeyManagementServiceClient() # Retrieve the fully-qualified crypto_key and import_job string. crypto_key_name = client.crypto_key_path(project_id, location_id, key_ring_id, crypto_key_id) import_job_name = client.import_job_path(project_id, location_id, key_ring_id, import_job_id) # Generate a temporary 32-byte key for AES-KWP and wrap the key material. kwp_key = os.urandom(32) wrapped_target_key = keywrap.aes_key_wrap_with_padding( kwp_key, formatted_key, backends.default_backend()) # Retrieve the public key from the import job. import_job = client.get_import_job(name=import_job_name) import_job_pub = serialization.load_pem_public_key( bytes(import_job.public_key.pem, 'UTF-8'), backends.default_backend()) # Wrap the KWP key using the import job key. wrapped_kwp_key = import_job_pub.encrypt( kwp_key, padding.OAEP(mgf=padding.MGF1(algorithm=hashes.SHA1()), algorithm=hashes.SHA1(), label=None)) # Import the wrapped key material. client.import_crypto_key_version({ "parent": crypto_key_name, "import_job": import_job_name, "algorithm": kms.CryptoKeyVersion.CryptoKeyVersionAlgorithm.EC_SIGN_P256_SHA256, "rsa_aes_wrapped_key": wrapped_kwp_key + wrapped_target_key, }) print('Imported: {}'.format(import_job.name))