bk-crypto-python-sdk 3.0.0__tar.gz → 4.0.0__tar.gz

{bk_crypto_python_sdk-3.0.0 → bk_crypto_python_sdk-4.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: bk-crypto-python-sdk
-Version: 3.0.0
+Version: 4.0.0
 Summary: bk-crypto-python-sdk is a lightweight cryptography toolkit for Python applications based on Cryptodome / tongsuopy and other encryption libraries.
 Author: TencentBlueKing
 Author-email: contactus_bk@tencent.com
@@ -10,9 +10,10 @@ Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
+Provides-Extra: gm
 Requires-Dist: dacite (>=1.8.1,<2.0.0)
 Requires-Dist: pycryptodomex (>=3.20.0,<4.0.0)
-Requires-Dist: tongsuopy-crayon (>=1.0.2b5,<2.0.0)
+Requires-Dist: tongsuopy-crayon (>=1.0.2b5,<2.0.0) ; extra == "gm"
 Requires-Dist: wrapt (>=2.2,<3.0)
 Description-Content-Type: text/markdown
 
@@ -52,6 +53,12 @@ Description-Content-Type: text/markdown
 $ pip install bk-crypto-python-sdk
 ```
 
+仅使用 AES、RSA 时无需安装国密依赖。需要 SM2、SM4 时安装 `gm` extra：
+
+```bash
+$ pip install "bk-crypto-python-sdk[gm]"
+```
+
 ### Usage
 
 > 更多用法参考：[使用文档](https://github.com/TencentBlueKing/crypto-python-sdk/blob/main/docs/usage.md)

{bk_crypto_python_sdk-3.0.0 → bk_crypto_python_sdk-4.0.0}/bkcrypto/asymmetric/ciphers/__init__.py

@@ -14,4 +14,11 @@ __all__ = ["BaseAsymmetricCipher", "RSAAsymmetricCipher", "SM2AsymmetricCipher"]
 
 from .base import BaseAsymmetricCipher
 from .rsa import RSAAsymmetricCipher
-from .sm2 import SM2AsymmetricCipher
+
+
+def __getattr__(name):
+    if name == "SM2AsymmetricCipher":
+        from .sm2 import SM2AsymmetricCipher
+
+        return SM2AsymmetricCipher
+    raise AttributeError(f"module {__name__!r} has no attribute {name!r}")

{bk_crypto_python_sdk-3.0.0 → bk_crypto_python_sdk-4.0.0}/bkcrypto/asymmetric/ciphers/base.py

@@ -10,7 +10,6 @@ an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express o
 specific language governing permissions and limitations under the License.
 """
 import abc
-import copy
 import typing
 from dataclasses import dataclass
 
@@ -132,7 +131,7 @@ class BaseAsymmetricCipher:
         **options,
     ):
 
-        options: typing.Dict[str, typing.Any] = copy.deepcopy(options)
+        options: typing.Dict[str, typing.Any] = dict(options)
 
         # init config
         self.config = from_dict(self.CONFIG_DATA_CLASS, options)
@@ -206,6 +205,11 @@ class BaseAsymmetricCipher:
         ciphertext: str = self.config.convertor.to_string(ciphertext_bytes)
         return self.config.interceptor.after_encrypt(ciphertext, cipher=self)
 
+    @key_obj_checker(constants.AsymmetricKeyAttribute.PUBLIC_KEY)
+    def encrypt_bytes(self, plaintext: bytes) -> str:
+        """加密二进制数据，不执行文本编码转换。"""
+        return self.config.convertor.to_string(self._encrypt_bytes(plaintext))
+
     @key_obj_checker(constants.AsymmetricKeyAttribute.PRIVATE_KEY)
     def decrypt(self, ciphertext: str) -> str:
         """
@@ -219,6 +223,17 @@ class BaseAsymmetricCipher:
         plaintext: str = self.config.convertor.decode_plaintext(plaintext_bytes, encoding=self.config.encoding)
         return self.config.interceptor.after_decrypt(plaintext)
 
+    @key_obj_checker(constants.AsymmetricKeyAttribute.PRIVATE_KEY)
+    def decrypt_bytes(self, ciphertext: str) -> bytes:
+        """解密二进制数据，不执行文本编码转换。"""
+        return self._decrypt_bytes(self.config.convertor.from_string(ciphertext))
+
+    def _encrypt_bytes(self, plaintext_bytes: bytes) -> bytes:
+        return self._encrypt(plaintext_bytes)
+
+    def _decrypt_bytes(self, ciphertext_bytes: bytes) -> bytes:
+        return self._decrypt(ciphertext_bytes)
+
     @key_obj_checker(constants.AsymmetricKeyAttribute.PRIVATE_KEY)
     def sign(self, plaintext: str) -> str:
         """

{bk_crypto_python_sdk-3.0.0 → bk_crypto_python_sdk-4.0.0}/bkcrypto/asymmetric/ciphers/rsa.py

@@ -14,9 +14,10 @@ specific language governing permissions and limitations under the License.
 import typing
 from dataclasses import dataclass
 
-from Cryptodome import Util
+from Cryptodome.Cipher import PKCS1_OAEP
 from Cryptodome.Hash import SHA1
 from Cryptodome.PublicKey import RSA
+from Cryptodome.Signature.pss import MGF1
 
 from bkcrypto import constants, types
 
@@ -34,12 +35,22 @@ class RSAAsymmetricRuntimeConfig(configs.BaseRSAAsymmetricConfig, base.BaseAsymm
     sig_scheme_maker: types.RSASigSchemeMaker = None
 
     def __post_init__(self):
-        # TODO(crayon) hashAlgo 哈希算法注入
-        self.cipher_maker = constants.RSACipherPadding.get_cipher_maker_by_member(self.padding)
+        if self.padding == constants.RSACipherPadding.PKCS1_OAEP:
+            self.cipher_maker = self._make_oaep_cipher
+        else:
+            self.cipher_maker = constants.RSACipherPadding.get_cipher_maker_by_member(self.padding)
         self.sig_scheme_maker = constants.RSASigScheme.get_sig_scheme_maker_by_member(self.sig_scheme)
 
         super().__post_init__()
 
+    def _make_oaep_cipher(self, key: RSA.RsaKey) -> types.RSACipher:
+        return PKCS1_OAEP.new(
+            key,
+            hashAlgo=self.oaep_hash,
+            mgfunc=lambda seed, length: MGF1(seed, length, self.mgf1_hash),
+            label=self.oaep_label or b"",
+        )
+
 
 class RSAAsymmetricCipher(base.BaseAsymmetricCipher):
 
@@ -58,33 +69,75 @@ class RSAAsymmetricCipher(base.BaseAsymmetricCipher):
         return self.config.private_key.exportKey().decode(encoding=self.config.encoding)
 
     def _load_public_key(self, public_key_string: types.PublicKeyString) -> RSA.RsaKey:
-        return RSA.importKey(public_key_string)
+        try:
+            public_key: RSA.RsaKey = RSA.import_key(public_key_string)
+        except (IndexError, TypeError, ValueError) as error:
+            raise ValueError("Invalid RSA public key") from error
+        if public_key.has_private():
+            return public_key.publickey()
+        return public_key
 
     def _load_private_key(self, private_key_string: types.PrivateKeyString) -> RSA.RsaKey:
-        return RSA.importKey(private_key_string)
+        try:
+            private_key: RSA.RsaKey = RSA.import_key(private_key_string)
+        except (IndexError, TypeError, ValueError) as error:
+            raise ValueError("Invalid RSA private key") from error
+        if not private_key.has_private():
+            raise ValueError("Expected an RSA private key")
+        return private_key
 
     def generate_key_pair(self) -> typing.Tuple[types.PrivateKeyString, types.PublicKeyString]:
         private_key_obj: RSA.RsaKey = RSA.generate(self.config.pkey_bits)
-        private_key: bytes = private_key_obj.exportKey()
-        public_key: bytes = private_key_obj.publickey().exportKey()
+        private_key: bytes = private_key_obj.export_key(format="PEM", pkcs=1)
+        public_key: bytes = private_key_obj.publickey().export_key(format="PEM")
         return private_key.decode(encoding=self.config.encoding), public_key.decode(encoding=self.config.encoding)
 
     def _encrypt(self, plaintext_bytes: bytes) -> bytes:
-        ciphertext_bytes: bytes = b""
-        block_size: int = self.get_block_size(self.config.public_key)
+        block_size: int = self._get_encrypt_block_size()
+        if not self.config.enable_segmented_encryption:
+            return self._encrypt_bytes(plaintext_bytes)
         cipher: types.RSACipher = self.config.cipher_maker(self.config.public_key)
-        for block in self.block_list(plaintext_bytes, block_size):
-            ciphertext_bytes += cipher.encrypt(block)
-        return ciphertext_bytes
+        return b"".join(cipher.encrypt(block) for block in self.block_list(plaintext_bytes, block_size))
 
     def _decrypt(self, ciphertext_bytes: bytes) -> bytes:
-        plaintext_bytes: bytes = b""
+        if not self.config.enable_segmented_encryption:
+            return self._decrypt_bytes(ciphertext_bytes)
+
+        block_size: int = self.get_block_size(self.config.private_key, is_encrypt=False)
+        if len(ciphertext_bytes) % block_size:
+            raise ValueError("Invalid RSA ciphertext length")
         cipher: types.RSACipher = self.config.cipher_maker(self.config.private_key)
+        return b"".join(self._decrypt_block(cipher, block) for block in self.block_list(ciphertext_bytes, block_size))
+
+    def _encrypt_bytes(self, plaintext_bytes: bytes) -> bytes:
+        if len(plaintext_bytes) > self._get_encrypt_block_size():
+            raise ValueError("RSA plaintext is too long")
+        cipher: types.RSACipher = self.config.cipher_maker(self.config.public_key)
+        return cipher.encrypt(plaintext_bytes)
+
+    def _decrypt_bytes(self, ciphertext_bytes: bytes) -> bytes:
         block_size: int = self.get_block_size(self.config.private_key, is_encrypt=False)
-        for block in self.block_list(ciphertext_bytes, block_size):
-            plaintext_bytes += cipher.decrypt(block, "")
+        if len(ciphertext_bytes) != block_size:
+            raise ValueError("Invalid RSA ciphertext length")
+        cipher: types.RSACipher = self.config.cipher_maker(self.config.private_key)
+        return self._decrypt_block(cipher, ciphertext_bytes)
+
+    def _decrypt_block(self, cipher: types.RSACipher, ciphertext_bytes: bytes) -> bytes:
+        if self.config.padding == constants.RSACipherPadding.PKCS1_OAEP:
+            return cipher.decrypt(ciphertext_bytes)
+
+        plaintext_bytes: typing.Optional[bytes] = cipher.decrypt(ciphertext_bytes, None)
+        if plaintext_bytes is None:
+            raise ValueError("Invalid RSA ciphertext")
         return plaintext_bytes
 
+    def _get_encrypt_block_size(self) -> int:
+        return self.get_block_size(
+            self.config.public_key,
+            padding=self.config.padding,
+            oaep_hash=self.config.oaep_hash,
+        )
+
     def _sign(self, plaintext_bytes: bytes) -> bytes:
         sig_scheme: types.RSASigScheme = self.config.sig_scheme_maker(self.config.private_key)
         sha: SHA1.SHA1Hash = SHA1.new(plaintext_bytes)
@@ -113,18 +166,20 @@ class RSAAsymmetricCipher(base.BaseAsymmetricCipher):
             yield lst[idx : idx + block_size]
 
     @staticmethod
-    def get_block_size(key_obj: RSA.RsaKey, is_encrypt: bool = True) -> int:
+    def get_block_size(
+        key_obj: RSA.RsaKey,
+        is_encrypt: bool = True,
+        padding: constants.RSACipherPadding = constants.RSACipherPadding.PKCS1_v1_5,
+        oaep_hash: typing.Any = SHA1,
+    ) -> int:
         """
         获取加解密最大片长度，用于分割过长的文本，单位：bytes
         :param key_obj:
         :param is_encrypt:
         :return:
         """
-        # TODO(crayon) 区分不同 Cipher 的最大明文长度
-        # PKCS1_v1_5: RSA key length(bytes) - 11
-        # PKCS1_OAEP: RSA密钥长度（字节） - 2 * 哈希（hashAlgo）输出长度（字节） - 2
-        block_size = Util.number.size(key_obj.n) / 8
-        reserve_size = 11
         if not is_encrypt:
-            reserve_size = 0
-        return int(block_size - reserve_size)
+            return key_obj.size_in_bytes()
+        if padding == constants.RSACipherPadding.PKCS1_OAEP:
+            return key_obj.size_in_bytes() - 2 * oaep_hash.digest_size - 2
+        return key_obj.size_in_bytes() - 11

{bk_crypto_python_sdk-3.0.0 → bk_crypto_python_sdk-4.0.0}/bkcrypto/asymmetric/configs.py

@@ -13,6 +13,8 @@ specific language governing permissions and limitations under the License.
 import typing
 from dataclasses import dataclass
 
+from Cryptodome.Hash import SHA1
+
 from bkcrypto import constants, types
 from bkcrypto.utils import convertors
 
@@ -52,6 +54,14 @@ class BaseRSAAsymmetricConfig(BaseAsymmetricConfig):
 
     # 加解密填充方案，默认为 `PKCS1_v1_5`
     padding: constants.RSACipherPadding = constants.RSACipherPadding.PKCS1_v1_5
+    # OAEP 哈希算法，默认保留 PyCryptodome 的 SHA-1 行为
+    oaep_hash: typing.Any = SHA1
+    # MGF1 哈希算法，默认与历史 OAEP 行为一致
+    mgf1_hash: typing.Any = SHA1
+    # OAEP label，None 表示空 label
+    oaep_label: typing.Optional[bytes] = None
+    # 是否按 RSA 最大明文长度分段，默认保留历史行为
+    enable_segmented_encryption: bool = True
     # 签名方案，默认为 `PKCS1_v1_5`
     sig_scheme: constants.RSASigScheme = constants.RSASigScheme.PKCS1_v1_5
     # 密钥长度（bit）

{bk_crypto_python_sdk-3.0.0 → bk_crypto_python_sdk-4.0.0}/bkcrypto/constants.py

@@ -58,6 +58,13 @@ class SymmetricMode(Enum):
     CFB = "CFB"
 
 
+class SymmetricPadding(Enum):
+    """对称加密填充方案"""
+
+    NONE = "NONE"
+    PKCS7 = "PKCS7"
+
+
 class EncryptionMetadataCombinationMode(Enum):
     """iv、tag 携带模式"""
 

{bk_crypto_python_sdk-3.0.0 → bk_crypto_python_sdk-4.0.0}/bkcrypto/contrib/basic/ciphers.py

@@ -12,61 +12,66 @@ specific language governing permissions and limitations under the License.
 
 
 import typing
-from dataclasses import asdict
 
 from bkcrypto import constants
-from bkcrypto.asymmetric.ciphers import BaseAsymmetricCipher, RSAAsymmetricCipher, SM2AsymmetricCipher
+from bkcrypto.asymmetric.ciphers.base import BaseAsymmetricCipher
 from bkcrypto.asymmetric.options import AsymmetricOptions
-from bkcrypto.symmetric.ciphers import AESSymmetricCipher, BaseSymmetricCipher, SM4SymmetricCipher
+from bkcrypto.symmetric.ciphers.base import BaseSymmetricCipher
 from bkcrypto.symmetric.options import SymmetricOptions
+from bkcrypto.utils import module_loding
 
-SYMMETRIC_CIPHER_CLASSES: typing.Dict[str, typing.Type[BaseSymmetricCipher]] = {
-    constants.SymmetricCipherType.AES.value: AESSymmetricCipher,
-    constants.SymmetricCipherType.SM4.value: SM4SymmetricCipher,
+SYMMETRIC_CIPHER_CLASSES: typing.Dict[str, str] = {
+    constants.SymmetricCipherType.AES.value: "bkcrypto.symmetric.ciphers.aes.AESSymmetricCipher",
+    constants.SymmetricCipherType.SM4.value: "bkcrypto.symmetric.ciphers.sm4.SM4SymmetricCipher",
 }
 
 
-ASYMMETRIC_CIPHER_CLASSES: typing.Dict[str, typing.Type[BaseAsymmetricCipher]] = {
-    constants.AsymmetricCipherType.RSA.value: RSAAsymmetricCipher,
-    constants.AsymmetricCipherType.SM2.value: SM2AsymmetricCipher,
+ASYMMETRIC_CIPHER_CLASSES: typing.Dict[str, str] = {
+    constants.AsymmetricCipherType.RSA.value: "bkcrypto.asymmetric.ciphers.rsa.RSAAsymmetricCipher",
+    constants.AsymmetricCipherType.SM2.value: "bkcrypto.asymmetric.ciphers.sm2.SM2AsymmetricCipher",
 }
 
 
+def _load_cipher_class(cipher_type: str, cipher_classes: typing.Dict[str, typing.Any]) -> typing.Type:
+    cipher_class_or_path: typing.Any = cipher_classes[cipher_type]
+    if isinstance(cipher_class_or_path, str):
+        return module_loding.import_string(cipher_class_or_path)
+    return cipher_class_or_path
+
+
 def get_asymmetric_cipher(
     cipher_type: typing.Optional[str] = None,
     common: typing.Optional[typing.Dict[str, typing.Any]] = None,
     cipher_options: typing.Optional[typing.Dict[str, typing.Optional[AsymmetricOptions]]] = None,
-    asymmetric__cipher_classes: typing.Optional[typing.Dict[str, BaseAsymmetricCipher]] = None,
+    asymmetric__cipher_classes: typing.Optional[typing.Dict[str, typing.Any]] = None,
 ) -> BaseAsymmetricCipher:
     cipher_type: str = cipher_type or constants.AsymmetricCipherType.RSA.value
-    asymmetric__cipher_classes: typing.Optional[typing.Dict[str, typing.Type[BaseAsymmetricCipher]]] = (
-        asymmetric__cipher_classes or ASYMMETRIC_CIPHER_CLASSES
+    asymmetric__cipher_classes = asymmetric__cipher_classes or ASYMMETRIC_CIPHER_CLASSES
+    asymmetric_cipher_class: typing.Type[BaseAsymmetricCipher] = _load_cipher_class(
+        cipher_type, asymmetric__cipher_classes
     )
-    asymmetric_cipher_class: typing.Type[BaseAsymmetricCipher] = asymmetric__cipher_classes[cipher_type]
 
     common = common or {}
     cipher_options: typing.Dict[str, typing.Optional[AsymmetricOptions]] = cipher_options or {}
     options: AsymmetricOptions = cipher_options.get(cipher_type) or asymmetric_cipher_class.OPTIONS_DATA_CLASS()
 
     # 同参数优先级：common > options
-    return asymmetric_cipher_class(**{**asdict(options), **common})
+    return asymmetric_cipher_class(**{**vars(options), **common})
 
 
 def get_symmetric_cipher(
     cipher_type: typing.Optional[str] = None,
     common: typing.Optional[typing.Dict[str, typing.Any]] = None,
     cipher_options: typing.Optional[typing.Dict[str, typing.Optional[SymmetricOptions]]] = None,
-    symmetric_cipher_classes: typing.Optional[typing.Dict[str, BaseSymmetricCipher]] = None,
+    symmetric_cipher_classes: typing.Optional[typing.Dict[str, typing.Any]] = None,
 ) -> BaseSymmetricCipher:
     cipher_type: str = cipher_type or constants.SymmetricCipherType.AES.value
-    symmetric_cipher_classes: typing.Optional[typing.Dict[str, typing.Type[BaseSymmetricCipher]]] = (
-        symmetric_cipher_classes or SYMMETRIC_CIPHER_CLASSES
-    )
-    symmetric_cipher_class: typing.Type[BaseSymmetricCipher] = symmetric_cipher_classes[cipher_type]
+    symmetric_cipher_classes = symmetric_cipher_classes or SYMMETRIC_CIPHER_CLASSES
+    symmetric_cipher_class: typing.Type[BaseSymmetricCipher] = _load_cipher_class(cipher_type, symmetric_cipher_classes)
 
     common = common or {}
     cipher_options: typing.Dict[str, typing.Optional[SymmetricOptions]] = cipher_options or {}
     options: SymmetricOptions = cipher_options.get(cipher_type) or symmetric_cipher_class.OPTIONS_DATA_CLASS()
 
     # 同参数优先级：common > options
-    return symmetric_cipher_class(**{**asdict(options), **common})
+    return symmetric_cipher_class(**{**vars(options), **common})

{bk_crypto_python_sdk-3.0.0 → bk_crypto_python_sdk-4.0.0}/bkcrypto/contrib/django/settings.py

@@ -16,22 +16,15 @@ from django.conf import settings
 from django.test.signals import setting_changed
 
 from bkcrypto import constants
-from bkcrypto.asymmetric.ciphers import RSAAsymmetricCipher, SM2AsymmetricCipher
+from bkcrypto.contrib.basic import ciphers as basic_ciphers
 from bkcrypto.contrib.django.init_configs import AsymmetricCipherInitConfig, CipherInitConfig, SymmetricCipherInitConfig
-from bkcrypto.symmetric.ciphers import AESSymmetricCipher, SM4SymmetricCipher
 from bkcrypto.utils import module_loding
 
 DEFAULTS = {
     "SYMMETRIC_CIPHER_TYPE": constants.SymmetricCipherType.AES.value,
     "ASYMMETRIC_CIPHER_TYPE": constants.AsymmetricCipherType.RSA.value,
-    "SYMMETRIC_CIPHER_CLASSES": {
-        constants.SymmetricCipherType.AES.value: module_loding.get_import_path(AESSymmetricCipher),
-        constants.SymmetricCipherType.SM4.value: module_loding.get_import_path(SM4SymmetricCipher),
-    },
-    "ASYMMETRIC_CIPHER_CLASSES": {
-        constants.AsymmetricCipherType.RSA.value: module_loding.get_import_path(RSAAsymmetricCipher),
-        constants.AsymmetricCipherType.SM2.value: module_loding.get_import_path(SM2AsymmetricCipher),
-    },
+    "SYMMETRIC_CIPHER_CLASSES": dict(basic_ciphers.SYMMETRIC_CIPHER_CLASSES),
+    "ASYMMETRIC_CIPHER_CLASSES": dict(basic_ciphers.ASYMMETRIC_CIPHER_CLASSES),
     "SYMMETRIC_CIPHERS": {
         "default": {
             # 可选，用于在 settings 没法直接获取 key 的情况
@@ -112,12 +105,6 @@ class CryptoSettings:
             # Fall back to defaults
             val = self.defaults[attr]
 
-        if attr in ["SYMMETRIC_CIPHER_CLASSES", "ASYMMETRIC_CIPHER_CLASSES"]:
-            val = {
-                cipher_type: module_loding.import_string(cipher_import_path)
-                for cipher_type, cipher_import_path in val.items()
-            }
-
         if attr in ["SYMMETRIC_CIPHERS", "ASYMMETRIC_CIPHERS"]:
             using__init_config_map: typing.Dict[str, CipherInitConfig] = {}
             for using, init_config_params in val.items():

{bk_crypto_python_sdk-3.0.0 → bk_crypto_python_sdk-4.0.0}/bkcrypto/symmetric/ciphers/__init__.py

@@ -14,4 +14,11 @@ __all__ = ["BaseSymmetricCipher", "AESSymmetricCipher", "SM4SymmetricCipher"]
 
 from .aes import AESSymmetricCipher
 from .base import BaseSymmetricCipher
-from .sm4 import SM4SymmetricCipher
+
+
+def __getattr__(name):
+    if name == "SM4SymmetricCipher":
+        from .sm4 import SM4SymmetricCipher
+
+        return SM4SymmetricCipher
+    raise AttributeError(f"module {__name__!r} has no attribute {name!r}")

{bk_crypto_python_sdk-3.0.0 → bk_crypto_python_sdk-4.0.0}/bkcrypto/symmetric/ciphers/aes.py

@@ -14,6 +14,7 @@ from dataclasses import dataclass
 
 from Cryptodome.Cipher import AES
 from Cryptodome.Util import Counter
+from Cryptodome.Util.Padding import pad, unpad
 
 from bkcrypto import constants, types
 
@@ -22,7 +23,7 @@ from . import base
 
 
 @dataclass
-class AESSymmetricRuntimeConfig(configs.BaseSM4SymmetricConfig, base.BaseSymmetricRuntimeConfig):
+class AESSymmetricRuntimeConfig(configs.BaseAESSymmetricConfig, base.BaseSymmetricRuntimeConfig):
 
     mode_class: types.AESModeClass = None
 
@@ -32,6 +33,9 @@ class AESSymmetricRuntimeConfig(configs.BaseSM4SymmetricConfig, base.BaseSymmetr
         if self.key_size not in AES.key_size:
             raise ValueError(f"Optional key sizes are {AES.key_size}, but got {self.key_size}")
 
+        if self.mode in [constants.SymmetricMode.CBC, constants.SymmetricMode.CTR] and self.iv_size != AES.block_size:
+            raise ValueError(f"AES {self.mode.value} IV must be exactly {AES.block_size} bytes")
+
         try:
             self.mode_class = {
                 constants.SymmetricMode.CTR: AES.MODE_CTR,
@@ -54,14 +58,28 @@ class AESSymmetricCipher(base.BaseSymmetricCipher):
 
     config: AESSymmetricRuntimeConfig = None
 
+    def __init__(self, key: typing.Optional[typing.Union[bytes, str]] = None, **options):
+        key_bytes: typing.Optional[bytes] = (
+            key.encode(options.get("encoding", "utf-8")) if isinstance(key, str) else key
+        )
+        key_size: int = options.get("key_size", 16)
+        if key_bytes is not None and len(key_bytes) != key_size:
+            raise ValueError(f"AES key must be exactly {key_size} bytes")
+        super().__init__(key, **options)
+
     def get_block_size(self) -> int:
-        return self.config.key_size
+        return AES.block_size
 
     def init_ctx(self, encryption_metadata: base.EncryptionMetadata):
         mode_init_args: typing.List[bytes] = []
         mode_init_kwargs: typing.Dict[str : typing.Any] = {}
 
         if self.config.enable_iv:
+            if (
+                self.config.mode in [constants.SymmetricMode.CBC, constants.SymmetricMode.CTR]
+                and len(encryption_metadata.iv) != AES.block_size
+            ):
+                raise ValueError(f"AES {self.config.mode.value} IV must be exactly {AES.block_size} bytes")
             if self.config.mode == constants.SymmetricMode.CTR:
                 # Size of the counter block must match block size
                 mode_init_kwargs["counter"] = Counter.new(
@@ -80,6 +98,9 @@ class AESSymmetricCipher(base.BaseSymmetricCipher):
 
         cipher_ctx = self.init_ctx(encryption_metadata)
 
+        if self.config.mode == constants.SymmetricMode.CBC and self.config.padding == constants.SymmetricPadding.PKCS7:
+            plaintext_bytes = pad(plaintext_bytes, AES.block_size, style="pkcs7")
+
         if self.config.mode == constants.SymmetricMode.GCM:
             ciphertext_bytes, tag = cipher_ctx.encrypt_and_digest(plaintext_bytes)
             encryption_metadata.tag = tag
@@ -89,10 +110,21 @@ class AESSymmetricCipher(base.BaseSymmetricCipher):
 
     def _decrypt(self, ciphertext_bytes: bytes, encryption_metadata: base.EncryptionMetadata) -> bytes:
 
+        if self.config.mode == constants.SymmetricMode.CBC and (
+            not ciphertext_bytes or len(ciphertext_bytes) % AES.block_size
+        ):
+            raise ValueError("AES CBC ciphertext must be non-empty and block-aligned")
+
         cipher_ctx = self.init_ctx(encryption_metadata)
 
         if self.config.mode == constants.SymmetricMode.GCM:
             plaintext_bytes: bytes = cipher_ctx.decrypt_and_verify(ciphertext_bytes, encryption_metadata.tag)
             return plaintext_bytes
         else:
-            return cipher_ctx.decrypt(ciphertext_bytes)
+            plaintext_bytes: bytes = cipher_ctx.decrypt(ciphertext_bytes)
+            if (
+                self.config.mode == constants.SymmetricMode.CBC
+                and self.config.padding == constants.SymmetricPadding.PKCS7
+            ):
+                return unpad(plaintext_bytes, AES.block_size, style="pkcs7")
+            return plaintext_bytes

{bk_crypto_python_sdk-3.0.0 → bk_crypto_python_sdk-4.0.0}/bkcrypto/symmetric/ciphers/base.py

@@ -246,6 +246,31 @@ class BaseSymmetricCipher:
         plaintext: str = self.config.interceptor.before_encrypt(plaintext, cipher=self)
         plaintext_bytes: bytes = self.config.convertor.encode_plaintext(plaintext, encoding=self.config.encoding)
 
+        ciphertext: str = self._encrypt_bytes(plaintext_bytes)
+        return self.config.interceptor.after_encrypt(ciphertext, cipher=self)
+
+    def encrypt_bytes(self, plaintext: bytes) -> str:
+        """加密二进制数据，不执行文本编码转换。"""
+        return self._encrypt_bytes(plaintext)
+
+    def decrypt(self, ciphertext: str) -> str:
+        """
+        解密
+        :param ciphertext: 密文
+        :return: 解密后的信息
+        """
+
+        ciphertext: str = self.config.interceptor.before_decrypt(ciphertext, cipher=self)
+        plaintext_bytes: bytes = self.decrypt_bytes(ciphertext)
+        plaintext: str = self.config.convertor.decode_plaintext(plaintext_bytes, encoding=self.config.encoding)
+        return self.config.interceptor.after_decrypt(plaintext, cipher=self)
+
+    def decrypt_bytes(self, ciphertext: str) -> bytes:
+        """解密二进制数据，不执行文本编码转换。"""
+        ciphertext_bytes, encryption_metadata = self.extract_encryption_metadata(ciphertext)
+        return self._decrypt(ciphertext_bytes, encryption_metadata)
+
+    def _encrypt_bytes(self, plaintext_bytes: bytes) -> str:
         if not self.config.enable_iv:
             iv = None
         elif self.config.iv:
@@ -261,19 +286,5 @@ class BaseSymmetricCipher:
             aad = self.generate_aad()
 
         encryption_metadata: EncryptionMetadata = EncryptionMetadata(iv=iv, aad=aad)
-        ciphertext_bytes = self._encrypt(plaintext_bytes, encryption_metadata)
-        ciphertext: str = self.combine_encryption_metadata(ciphertext_bytes, encryption_metadata)
-        return self.config.interceptor.after_encrypt(ciphertext, cipher=self)
-
-    def decrypt(self, ciphertext: str) -> str:
-        """
-        解密
-        :param ciphertext: 密文
-        :return: 解密后的信息
-        """
-
-        ciphertext: str = self.config.interceptor.before_decrypt(ciphertext, cipher=self)
-        ciphertext_bytes, encryption_metadata = self.extract_encryption_metadata(ciphertext)
-        plaintext_bytes: bytes = self._decrypt(ciphertext_bytes, encryption_metadata)
-        plaintext: str = self.config.convertor.decode_plaintext(plaintext_bytes, encoding=self.config.encoding)
-        return self.config.interceptor.after_decrypt(plaintext, cipher=self)
+        ciphertext_bytes: bytes = self._encrypt(plaintext_bytes, encryption_metadata)
+        return self.combine_encryption_metadata(ciphertext_bytes, encryption_metadata)

{bk_crypto_python_sdk-3.0.0 → bk_crypto_python_sdk-4.0.0}/bkcrypto/symmetric/configs.py

@@ -68,7 +68,8 @@ class BaseSymmetricConfig:
 
 @dataclass
 class BaseAESSymmetricConfig(BaseSymmetricConfig):
-    pass
+    # 填充方案，默认不填充以兼容历史行为
+    padding: constants.SymmetricPadding = constants.SymmetricPadding.NONE
 
 
 @dataclass

{bk_crypto_python_sdk-3.0.0 → bk_crypto_python_sdk-4.0.0}/bkcrypto/types.py

@@ -15,7 +15,6 @@ from Cryptodome.Cipher.PKCS1_OAEP import PKCS1OAEP_Cipher
 from Cryptodome.Cipher.PKCS1_v1_5 import PKCS115_Cipher
 from Cryptodome.PublicKey.RSA import RsaKey
 from Cryptodome.Signature import pkcs1_15, pss
-from tongsuopy.crypto.ciphers import modes
 
 T = typing.TypeVar("T")
 
@@ -51,8 +50,6 @@ SymmetricTag = bytes
 
 SymmetricAad = bytes
 
-SM4ModeClass = typing.Union[
-    typing.Type[modes.CBC], typing.Type[modes.CTR], typing.Type[modes.CFB], typing.Type[modes.GCM]
-]
+SM4ModeClass = typing.Any
 
 AESModeClass = typing.Any

{bk_crypto_python_sdk-3.0.0 → bk_crypto_python_sdk-4.0.0}/bkcrypto/utils/convertors.py

@@ -42,7 +42,7 @@ class Base64Convertor(BaseConvertor):
 
     @classmethod
     def from_string(cls, string: str, **kwargs) -> bytes:
-        return base64.b64decode(string)
+        return base64.b64decode(string, validate=True)
 
 
 class HexConvertor(BaseConvertor):

{bk_crypto_python_sdk-3.0.0 → bk_crypto_python_sdk-4.0.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "bk-crypto-python-sdk"
-version = "3.0.0"
+version = "4.0.0"
 description = "bk-crypto-python-sdk is a lightweight cryptography toolkit for Python applications based on Cryptodome / tongsuopy and other encryption libraries."
 authors = ["TencentBlueKing <contactus_bk@tencent.com>"]
 readme = "readme.md"
@@ -10,11 +10,14 @@ packages = [
 
 [tool.poetry.dependencies]
 python = ">=3.9,<3.15"
-tongsuopy-crayon = "^1.0.2b5"
+tongsuopy-crayon = { version = "^1.0.2b5", optional = true }
 pycryptodomex = "^3.20.0"
 dacite = "^1.8.1"
 wrapt = "^2.2"
 
+[tool.poetry.extras]
+gm = ["tongsuopy-crayon"]
+
 [tool.poetry.dev-dependencies]
 ipython = { version = "^7.34.0", python = ">=3.7" }
 pytest = { version = "^7.4.0", python = ">=3.7" }
@@ -23,7 +26,7 @@ isort = "^5.5.4"
 black = "22.3.0"
 pre-commit = "^2.16.0"
 codecov = "^2.1.13"
-Django = "^3"
+Django = "^4"
 
 [build-system]
 requires = ["poetry-core>=1.0.0"]
@@ -71,3 +74,8 @@ exclude = '''
 profile = "black"
 line_length = 120
 skip_glob = ["*/migrations/*", "*/node_modules/*"]
+
+[tool.pytest.ini_options]
+markers = [
+    "compatibility: tests migrated from dist/local that must pass before and after issue #37",
+]

{bk_crypto_python_sdk-3.0.0 → bk_crypto_python_sdk-4.0.0}/readme.md

@@ -34,6 +34,12 @@
 $ pip install bk-crypto-python-sdk
 ```
 
+仅使用 AES、RSA 时无需安装国密依赖。需要 SM2、SM4 时安装 `gm` extra：
+
+```bash
+$ pip install "bk-crypto-python-sdk[gm]"
+```
+
 ### Usage
 
 > 更多用法参考：[使用文档](https://github.com/TencentBlueKing/crypto-python-sdk/blob/main/docs/usage.md)