# -*- coding: utf-8 -*-##  Cipher/blockalgo.py ## ===================================================================# The contents of this file are dedicated to the public domain.  To# the extent that dedication to the public domain is not available,# everyone is granted a worldwide, perpetual, royalty-free,# non-exclusive license to exercise all rights associated with the# contents of this file for any purpose whatsoever.# No rights are reserved.## THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE# SOFTWARE.# ==================================================================="""Module with definitions common to all block ciphers."""import sysif sys.version_info[0] == 2 and sys.version_info[1] == 1:    from Crypto.Util.py21compat import *from Crypto.Util.py3compat import *#: *Electronic Code Book (ECB)*.#: This is the simplest encryption mode. Each of the plaintext blocks#: is directly encrypted into a ciphertext block, independently of#: any other block. This mode exposes frequency of symbols#: in your plaintext. Other modes (e.g. *CBC*) should be used instead.#:#: See `NIST SP800-38A`_ , Section 6.1 .#:#: .. _`NIST SP800-38A` : http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdfMODE_ECB = 1#: *Cipher-Block Chaining (CBC)*. Each of the ciphertext blocks depends#: on the current and all previous plaintext blocks. An Initialization Vector#: (*IV*) is required.#:#: The *IV* is a data block to be transmitted to the receiver.#: The *IV* can be made public, but it must be authenticated by the receiver and#: it should be picked randomly.#:#: See `NIST SP800-38A`_ , Section 6.2 .#:#: .. _`NIST SP800-38A` : http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdfMODE_CBC = 2#: *Cipher FeedBack (CFB)*. This mode is similar to CBC, but it transforms#: the underlying block cipher into a stream cipher. Plaintext and ciphertext#: are processed in *segments* of **s** bits. The mode is therefore sometimes#: labelled **s**-bit CFB. An Initialization Vector (*IV*) is required.#:#: When encrypting, each ciphertext segment contributes to the encryption of#: the next plaintext segment.#:#: This *IV* is a data block to be transmitted to the receiver.#: The *IV* can be made public, but it should be picked randomly.#: Reusing the same *IV* for encryptions done with the same key lead to#: catastrophic cryptographic failures.#:#: See `NIST SP800-38A`_ , Section 6.3 .#:#: .. _`NIST SP800-38A` : http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdfMODE_CFB = 3#: This mode should not be used.MODE_PGP = 4#: *Output FeedBack (OFB)*. This mode is very similar to CBC, but it#: transforms the underlying block cipher into a stream cipher.#: The keystream is the iterated block encryption of an Initialization Vector (*IV*).#:#: The *IV* is a data block to be transmitted to the receiver.#: The *IV* can be made public, but it should be picked randomly.#:#: Reusing the same *IV* for encryptions done with the same key lead to#: catastrophic cryptograhic failures.#:#: See `NIST SP800-38A`_ , Section 6.4 .#:#: .. _`NIST SP800-38A` : http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdfMODE_OFB = 5#: *CounTeR (CTR)*. This mode is very similar to ECB, in that#: encryption of one block is done independently of all other blocks.#: Unlike ECB, the block *position* contributes to the encryption and no#: information leaks about symbol frequency.#:#: Each message block is associated to a *counter* which must be unique#: across all messages that get encrypted with the same key (not just within#: the same message). The counter is as big as the block size.#:#: Counters can be generated in several ways. The most straightword one is#: to choose an *initial counter block* (which can be made public, similarly#: to the *IV* for the other modes) and increment its lowest **m** bits by#: one (modulo *2^m*) for each block. In most cases, **m** is chosen to be half#: the block size.#: #: Reusing the same *initial counter block* for encryptions done with the same#: key lead to catastrophic cryptograhic failures.#:#: See `NIST SP800-38A`_ , Section 6.5 (for the mode) and Appendix B (for how#: to manage the *initial counter block*).#:#: .. _`NIST SP800-38A` : http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdfMODE_CTR = 6#: OpenPGP. This mode is a variant of CFB, and it is only used in PGP and OpenPGP_ applications.#: An Initialization Vector (*IV*) is required.#: #: Unlike CFB, the IV is not transmitted to the receiver. Instead, the *encrypted* IV is.#: The IV is a random data block. Two of its bytes are duplicated to act as a checksum#: for the correctness of the key. The encrypted IV is therefore 2 bytes longer than#: the clean IV.#:#: .. _OpenPGP: http://tools.ietf.org/html/rfc4880MODE_OPENPGP = 7def _getParameter(name, index, args, kwargs, default=None):    """Find a parameter in tuple and dictionary arguments a function receives"""    param = kwargs.get(name)    if len(args)>index:        if param:            raise ValueError("Parameter ‘%s‘ is specified twice" % name)        param = args[index]    return param or default    class BlockAlgo:    """Class modelling an abstract block cipher."""    def __init__(self, factory, key, *args, **kwargs):        self.mode = _getParameter(‘mode‘, 0, args, kwargs, default=MODE_ECB)        self.block_size = factory.block_size                if self.mode != MODE_OPENPGP:            self._cipher = factory.new(key, *args, **kwargs)            self.IV = self._cipher.IV        else:            # OPENPGP mode. For details, see 13.9 in RCC4880.            #            # A few members are specifically created for this mode:            #  - _encrypted_iv, set in this constructor            #  - _done_first_block, set to True after the first encryption            #  - _done_last_block, set to True after a partial block is processed                        self._done_first_block = False            self._done_last_block = False            self.IV = _getParameter(‘iv‘, 1, args, kwargs)            if not self.IV:                raise ValueError("MODE_OPENPGP requires an IV")                        # Instantiate a temporary cipher to process the IV            IV_cipher = factory.new(key, MODE_CFB,                    b(‘\x00‘)*self.block_size,      # IV for CFB                    segment_size=self.block_size*8)                       # The cipher will be used for...            if len(self.IV) == self.block_size:                # ... encryption                self._encrypted_IV = IV_cipher.encrypt(                    self.IV + self.IV[-2:] +        # Plaintext                    b(‘\x00‘)*(self.block_size-2)   # Padding                    )[:self.block_size+2]            elif len(self.IV) == self.block_size+2:                # ... decryption                self._encrypted_IV = self.IV                self.IV = IV_cipher.decrypt(self.IV +   # Ciphertext                    b(‘\x00‘)*(self.block_size-2)       # Padding                    )[:self.block_size+2]                if self.IV[-2:] != self.IV[-4:-2]:                    raise ValueError("Failed integrity check for OPENPGP IV")                self.IV = self.IV[:-2]            else:                raise ValueError("Length of IV must be %d or %d bytes for MODE_OPENPGP"                    % (self.block_size, self.block_size+2))            # Instantiate the cipher for the real PGP data            self._cipher = factory.new(key, MODE_CFB,                self._encrypted_IV[-self.block_size:],                segment_size=self.block_size*8)    def encrypt(self, plaintext):        """Encrypt data with the key and the parameters set at initialization.                The cipher object is stateful; encryption of a long block        of data can be broken up in two or more calls to `encrypt()`.        That is, the statement:                        >>> c.encrypt(a) + c.encrypt(b)        is always equivalent to:             >>> c.encrypt(a+b)        That also means that you cannot reuse an object for encrypting        or decrypting other data with the same key.        This function does not perform any padding.                - For `MODE_ECB`, `MODE_CBC`, and `MODE_OFB`, *plaintext* length           (in bytes) must be a multiple of *block_size*.         - For `MODE_CFB`, *plaintext* length (in bytes) must be a multiple           of *segment_size*/8.         - For `MODE_CTR`, *plaintext* can be of any length.         - For `MODE_OPENPGP`, *plaintext* must be a multiple of *block_size*,           unless it is the last chunk of the message.        :Parameters:          plaintext : byte string            The piece of data to encrypt.        :Return:            the encrypted data, as a byte string. It is as long as            *plaintext* with one exception: when encrypting the first message            chunk with `MODE_OPENPGP`, the encypted IV is prepended to the            returned ciphertext.        """        if self.mode == MODE_OPENPGP:            padding_length = (self.block_size - len(plaintext) % self.block_size) % self.block_size            if padding_length>0:                # CFB mode requires ciphertext to have length multiple of block size,                # but PGP mode allows the last block to be shorter                if self._done_last_block:                    raise ValueError("Only the last chunk is allowed to have length not multiple of %d bytes",                        self.block_size)                self._done_last_block = True                padded = plaintext + b(‘\x00‘)*padding_length                res = self._cipher.encrypt(padded)[:len(plaintext)]            else:                res = self._cipher.encrypt(plaintext)            if not self._done_first_block:                res = self._encrypted_IV + res                self._done_first_block = True            return res        return self._cipher.encrypt(plaintext)    def decrypt(self, ciphertext):        """Decrypt data with the key and the parameters set at initialization.                The cipher object is stateful; decryption of a long block        of data can be broken up in two or more calls to `decrypt()`.        That is, the statement:                        >>> c.decrypt(a) + c.decrypt(b)        is always equivalent to:             >>> c.decrypt(a+b)        That also means that you cannot reuse an object for encrypting        or decrypting other data with the same key.        This function does not perform any padding.                - For `MODE_ECB`, `MODE_CBC`, and `MODE_OFB`, *ciphertext* length           (in bytes) must be a multiple of *block_size*.         - For `MODE_CFB`, *ciphertext* length (in bytes) must be a multiple           of *segment_size*/8.         - For `MODE_CTR`, *ciphertext* can be of any length.         - For `MODE_OPENPGP`, *plaintext* must be a multiple of *block_size*,           unless it is the last chunk of the message.        :Parameters:          ciphertext : byte string            The piece of data to decrypt.        :Return: the decrypted data (byte string, as long as *ciphertext*).        """        if self.mode == MODE_OPENPGP:            padding_length = (self.block_size - len(ciphertext) % self.block_size) % self.block_size            if padding_length>0:                # CFB mode requires ciphertext to have length multiple of block size,                # but PGP mode allows the last block to be shorter                if self._done_last_block:                    raise ValueError("Only the last chunk is allowed to have length not multiple of %d bytes",                        self.block_size)                self._done_last_block = True                padded = ciphertext + b(‘\x00‘)*padding_length                res = self._cipher.decrypt(padded)[:len(ciphertext)]            else:                res = self._cipher.decrypt(ciphertext)            return res        return self._cipher.decrypt(ciphertext)