synapse.lib.crypto package

Submodules

synapse.lib.crypto.coin module

synapse.lib.crypto.coin.bch_check(match: Match)

synapse.lib.crypto.coin.btc_base58_check(match: Match)

synapse.lib.crypto.coin.btc_bech32_check(match: Match)

synapse.lib.crypto.coin.cardano_byron_check(match: Match)

synapse.lib.crypto.coin.cardano_shelly_check(match: Match)

synapse.lib.crypto.coin.eth_check(match: Match)

synapse.lib.crypto.coin.ether_eip55(body: str)

synapse.lib.crypto.coin.logger = <Logger synapse.lib.crypto.coin (WARNING)>

synapse.lib.crypto.coin contains functions for verifying whether or not a given regex match containing a valu is valid for a given type of coin.

these functions are intended to be used with synapse.lib.scrape.

synapse.lib.crypto.coin.substrate_check(match: Match)

synapse.lib.crypto.coin.xrp_check(match: Match)

synapse.lib.crypto.ecc module

class synapse.lib.crypto.ecc.PriKey(priv)

Bases: object

A helper class for using ECC private keys.

dump(fmt='der')

Get the private key bytes in PKCS8 format.

Parameters:

fmt (str) – The encoding format, “der” (default) or “pem”.

Returns:

The encoded PKCS8 private key.

Return type:

bytes

exchange(pubkey)

Perform a ECDH key exchange with a public key.

Parameters:

pubkey (PubKey) – A PubKey to perform the ECDH with.

Returns:

The ECDH bytes. This is deterministic for a given pubkey and private key.

Return type:

bytes

static generate(curve='SECP384R1')

Generate a new ECC PriKey instance.

Parameters:

curve (str) – The named curve to use. Defaults to SECP384R1.

Returns:

A new PriKey instance.

Return type:

PriKey

iden()

Return a SHA256 hash for the public key (to be used as a GUID).

Returns:

The SHA256 hash of the public key bytes.

Return type:

str

static load(byts, fmt='der')

Create a PriKey instance from PKCS8 encoded bytes.

Parameters:

• byts (bytes) – Bytes to load.

• fmt (str) – The encoding format, “der” (default) or “pem”.

Returns:

A new PriKey instance.

Return type:

PriKey

public()

Get the PubKey which corresponds to the ECC PriKey.

Returns:

A new PubKey object whose key corresponds to the private key.

Return type:

PubKey

sign(byts, hashalgo='sha256')

Compute the ECC signature for the given bytestream.

Parameters:

• byts (bytes) – The bytes to sign.

• hashalgo (str) – The hash algorithm to use (sha256, sha384, or sha512).

Returns:

The DER encoded ECDSA signature bytes.

Return type:

bytes

class synapse.lib.crypto.ecc.PubKey(publ)

Bases: object

A helper class for using ECC public keys.

dump(fmt='der')

Get the public key bytes in SubjectPublicKeyInfo format.

Parameters:

fmt (str) – The encoding format, “der” (default) or “pem”.

Returns:

The encoded SubjectPublicKeyInfo public key.

Return type:

bytes

iden()

Return a SHA256 hash for the public key (to be used as a GUID).

Returns:

The SHA256 hash of the public key bytes.

Return type:

str

static load(byts, fmt='der')

Create a PubKey instance from SubjectPublicKeyInfo encoded bytes.

Parameters:

• byts (bytes) – Bytes to load.

• fmt (str) – The encoding format, “der” (default) or “pem”.

Returns:

A new PubKey instance.

Return type:

PubKey

verify(byts, sign, hashalgo='sha256')

Verify the signature for the given bytes using the ECC public key.

Parameters:

• byts (bytes) – The data bytes.

• sign (bytes) – The DER encoded signature bytes.

• hashalgo (str) – The hash algorithm to use (sha256, sha384, or sha512).

Returns:

True if the data was verified, False otherwise.

Return type:

bool

synapse.lib.crypto.ecc.doECDHE(statprv_u, statpub_v, ephmprv_u, ephmpub_v, length=64, salt=None, info=None)

Perform one side of an Ecliptic Curve Diffie Hellman Ephemeral key exchange.

Parameters:

• statprv_u (PriKey) – Static Private Key for U

• (PubKey (statpub_v) – Static Public Key for V

• ephmprv_u (PriKey) – Ephemeral Private Key for U

• ephmpub_v (PubKey) – Ephemeral Public Key for V

• length (int) – Number of bytes to return

• salt (bytes) – Salt to use when computing the key.

• info (bytes) – Additional information to use when computing the key.

Notes

This makes no assumption about the reuse of the Ephemeral keys passed to the function. It is the caller’s responsibility to destroy the keys after they are used for doing key generation. This implementation is the dhHybrid1 scheme described in NIST 800-56A Revision 2.

Returns:

The derived key.

Return type:

bytes

synapse.lib.crypto.ecc.loadKey(byts)

Load a single ECC public or private key, auto-detecting the PEM vs DER encoding and whether the key is public or private.

Parameters:

byts (bytes) – The DER or PEM encoded ECC key bytes.

Returns:

The loaded key wrapper.

Return type:

PriKey or PubKey

synapse.lib.crypto.jwk module

synapse.lib.crypto.jwk.jwkThumbprint(jwk)

Compute the RFC 7638 JWK SHA-256 thumbprint and return it as a base64url string.

synapse.lib.crypto.jwk.jwkToKey(jwk)

Convert a JWK (RFC 7517) into a Synapse backend key wrapper.

Parameters:

jwk (dict) – The JWK members.

Returns:

An s_rsa.PriKey/PubKey or s_ecc.PriKey/PubKey for an RSA or EC key. Raises s_exc.BadArg for an unsupported key type, a malformed member, or an off-curve EC point.

synapse.lib.crypto.passwd module

async synapse.lib.crypto.passwd.checkShadowV2(passwd: AnyStr, shadow: Dict) → bool

Check a password against a shadow dictionary.

Parameters:

• passwd (str) – Password to check.

• shadow (dict) – Data to check the password against.

Returns:

True if the password is valid, false otherwise.

Return type:

bool

async synapse.lib.crypto.passwd.generateApiKey(iden=None)

async synapse.lib.crypto.passwd.getPbkdf2(passwd: AnyStr) → Dict

async synapse.lib.crypto.passwd.getShadowV2(passwd: AnyStr) → Dict

Get the shadow dictionary for a given password.

Parameters:

• passwd (str) – Password to hash.

• ptyp (str) – The password hash type.

Returns:

A dictionary containing shadowed password information.

Return type:

dict

synapse.lib.crypto.passwd.parseApiKey(valu)

async synapse.lib.crypto.passwd.verifyPbkdf2(passwd: AnyStr, shadow: Dict) → bool

synapse.lib.crypto.rsa module

class synapse.lib.crypto.rsa.PriKey(priv)

Bases: object

A helper class for using RSA private keys.

Signing methods use RSA-PSS and MFG1 with sha256 hashing.

dump(fmt='der')

Get the private key bytes in PKCS8 format.

Parameters:

fmt (str) – The encoding format, “der” (default) or “pem”.

Returns:

The encoded PKCS8 private key.

Return type:

bytes

static generate(bits=2048)

Generate a new RSA PriKey instance.

Parameters:

bits (int) – The size of the RSA key in bits.

Returns:

A new PriKey instance.

Return type:

PriKey

iden() → str

Return a SHA256 hash for the public key (to be used as a GUID).

Returns:

The SHA256 hash of the public key bytes.

Return type:

str

static load(byts, fmt='der')

Create a PriKey instance from PKCS8 encoded bytes.

Parameters:

• byts (bytes) – Bytes to load.

• fmt (str) – The encoding format, “der” (default) or “pem”.

Returns:

A new PriKey instance.

Return type:

PriKey

public()

Get the PubKey which corresponds to the RSA PriKey.

Returns:

A new PubKey object whose key corresponds to the private key.

Return type:

PubKey

sign(byts, padding='pss', hashalgo='sha256', saltlen=None)

Compute the RSA signature for the given bytestream.

Parameters:

• byts (bytes) – The bytes to sign.

• padding (str) – The padding scheme, “pss” (default) or “pkcs1v15”.

• hashalgo (str) – The hash algorithm name (sha256, sha384, or sha512).

• saltlen – The PSS salt length in bytes, or None for the maximum length.

Returns:

The RSA signature bytes.

Return type:

bytes

signitem(item) → bytes

Compute the RSA signature for the given python primitive.

Parameters:

item – The item to sign. This will be flattened and msgpacked prior to signing.

Returns:

The RSA Signature bytes.

Return type:

bytes

class synapse.lib.crypto.rsa.PubKey(publ)

Bases: object

A helper class for using RSA public keys.

dump(fmt='der')

Get the public key bytes in SubjectPublicKeyInfo format.

Parameters:

fmt (str) – The encoding format, “der” (default) or “pem”.

Returns:

The encoded SubjectPublicKeyInfo public key.

Return type:

bytes

iden()

Return a SHA256 hash for the public key (to be used as a GUID).

Returns:

The SHA256 hash of the public key bytes.

Return type:

str

static load(byts, fmt='der')

Create a PubKey instance from SubjectPublicKeyInfo encoded bytes.

Parameters:

• byts (bytes) – Bytes to load.

• fmt (str) – The encoding format, “der” (default) or “pem”.

Returns:

A new PubKey instance.

Return type:

PubKey

verify(byts, sign, padding='pss', hashalgo='sha256', saltlen=None)

Verify the signature for the given bytes using the RSA public key.

Parameters:

• byts (bytes) – The data bytes.

• sign (bytes) – The signature bytes.

• padding (str) – The padding scheme, “pss” (default) or “pkcs1v15”.

• hashalgo (str) – The hash algorithm name (sha256, sha384, or sha512).

• saltlen – The PSS salt length in bytes, or None for the maximum length.

Returns:

True if the data was verified, False otherwise.

Return type:

bool

verifyitem(item, sign)

Verify the signature for the given item with the RSA public key.

Parameters:

• item – The Python primitive to verify.

• sign (bytes) – The signature bytes.

Returns:

True if the data was verified, False otherwise.

Return type:

bool

synapse.lib.crypto.rsa.loadKey(byts)

Load a single RSA public or private key, auto-detecting the PEM vs DER encoding and whether the key is public or private.

Parameters:

byts (bytes) – The DER or PEM encoded RSA key bytes.

Returns:

The loaded key wrapper.

Return type:

PriKey or PubKey

synapse.lib.crypto.tinfoil module

class synapse.lib.crypto.tinfoil.CryptSeq(rx_key, tx_key, initial_rx_seq=0, initial_tx_seq=0)

Bases: object

Applies and verifies sequence numbers of encrypted messages coming and going

Parameters:

• rx_key (bytes) – TX key (used with TinFoilHat).

• tx_key (bytes) – RX key (used with TinFoilHat).

• initial_rx_seq (int) – Starting rx sequence number.

• initial_tx_seq (int) – Starting tx sequence number.

decrypt(ciphertext)

Decrypt a message, validating its sequence number is as we expect.

Parameters:

ciphertext (bytes) – The message to decrypt and verify.

Returns:

A mesg.

Return type:

mesg

Raises:

s_exc.CryptoErr – If the message decryption fails or the sequence number was unexpected.

encrypt(mesg)

Wrap a message with a sequence number and encrypt it.

Parameters:

mesg – The mesg to encrypt.

Returns:

The encrypted message.

Return type:

bytes

class synapse.lib.crypto.tinfoil.TinFoilHat(ekey)

Bases: object

The TinFoilHat class implements a GCM-AES encryption/decryption class.

Parameters:

• ekey (bytes) – A 32 byte key used for doing encryption & decryption. It

• manner. (is assumed the caller has generated the key in a safe)

dec(byts)

Decode an envelope dict and decrypt the given bytes.

Parameters:

byts (bytes) – Bytes to decrypt.

Returns:

Decrypted message.

Return type:

bytes

enc(byts, asscd=None)

Encrypt the given bytes and return an envelope dict in msgpack form.

Parameters:

• byts (bytes) – The message to be encrypted.

• asscd (bytes) – Extra data that needs to be authenticated (but not encrypted).

Returns:

The encrypted message. This is a msgpacked dictionary containing the IV, ciphertext, and associated data.

Return type:

bytes

synapse.lib.crypto.tinfoil.newkey()

Generate a new, random 32 byte key.

Returns:

32 random bytes

Return type:

bytes

synapse.lib.crypto.utils module

synapse.lib.crypto.utils.debase64url(text)

synapse.lib.crypto.utils.enbase64url(byts)

synapse.lib.crypto.utils.getCurveByName(name)

Get an instantiated cryptography elliptic curve for the given curve name.

Parameters:

name (str) – The named curve (P-256, P-384, or P-521).

Returns:

The instantiated elliptic curve.

synapse.lib.crypto.utils.getEncodingByName(fmt)

Get the cryptography serialization Encoding for the given format name.

Parameters:

fmt (str) – The encoding format, “der” or “pem”.

Returns:

The cryptography Encoding.

synapse.lib.crypto.utils.getHashByName(hashalgo)

Get an instantiated cryptography hash for the given algorithm name.

Parameters:

hashalgo (str) – The hash algorithm name (sha256, sha384, or sha512).

Returns:

The instantiated hash algorithm.

synapse.lib.crypto.utils.getPaddingByName(padding, hashobj, saltlen=None)

Get the cryptography asymmetric padding for the given scheme name.

Parameters:

• padding (str) – The padding scheme, “pss” or “pkcs1v15”.

• hashobj – The instantiated hash used to construct MGF1 for PSS padding.

• saltlen – The PSS salt length in bytes. Defaults to the maximum length; callers that require a specific salt length (e.g. the JWS PS* algorithms, which mandate salt length equal to the digest length) may pass an integer.

Returns:

The cryptography padding object.

synapse.lib.crypto.utils.loadKey(byts)

Load a single public or private key, auto-detecting the PEM vs DER encoding and whether the key is a public or private key.

Parameters:

byts (bytes) – The DER or PEM encoded key bytes.

Returns:

A (isprivate, key) tuple where key is the loaded cryptography key object.