huaweicloud-encryption-sdk-python 1.2.1__py3-none-any.whl

huaweicloud_encryptionsdk/common/utils.py

@@ -0,0 +1,162 @@
+import os
+import struct
+import hashlib
+import base64
+from io import BytesIO
+
+from huaweicloud_encryptionsdk.common.crypto_factory import CryptoFactory
+
+
+def is_empty(t):
+    if t is None:
+        return True
+    if isinstance(t, (str, list, dict, tuple, set)):
+        return len(t) == 0
+    return False
+
+
+def read_master_key(key_paths):
+    public_key_list = []
+    for path in key_paths:
+        try:
+            with open(path, "rb") as f:
+                data = f.read()
+            cleaned = remove_line_symbol(data)
+            original_key = base64.b64decode(cleaned)
+            public_key_list.append(original_key)
+        except FileNotFoundError:
+            raise Exception("file not exists:" + os.path.basename(path))
+    return public_key_list
+
+
+def long_to_bytes(num):
+    return struct.pack(">q", num)
+
+
+def bytes_to_long(b):
+    return struct.unpack(">q", b)[0]
+
+
+def bytes_to_int(b):
+    return struct.unpack(">i", b)[0]
+
+
+def add_prevent_overflow(a, b):
+    r = a + b
+    if a > 0 and b > 0 and r < a:
+        return (1 << 63) - 1
+    if a < 0 and b < 0 and r > a:
+        return -(1 << 63)
+    return r
+
+
+def common_hash(data, alg):
+    try:
+        md = CryptoFactory.get_message_digest(alg)
+        md.update(data)
+        return md.digest()
+    except Exception:
+        raise Exception("message digest error")
+
+
+def byte_to_string(b):
+    if b is None:
+        return ""
+    return b.decode("utf-8", errors="replace")
+
+
+def remove_line_symbol(b):
+    s = b.decode("utf-8", errors="replace").replace("\r\n", "").replace("\n", "").replace("\\n", "")
+    return s.encode("utf-8")
+
+
+def byte_to_secret_key(b, algorithm):
+    return b
+
+
+def get_public_key(public_key_bytes, alg_flag):
+    from cryptography.hazmat.primitives.serialization import load_der_public_key
+    try:
+        return load_der_public_key(public_key_bytes)
+    except Exception as e:
+        raise Exception("public key parse exception", e)
+
+
+def get_private_key(private_key_bytes, alg_flag):
+    from cryptography.hazmat.primitives.serialization import load_der_private_key
+    try:
+        return load_der_private_key(private_key_bytes, password=None)
+    except Exception as e:
+        raise Exception("private key parse exception", e)
+
+
+def serialize_context(encryption_context):
+    if encryption_context is None or len(encryption_context) == 0:
+        return b""
+    sorted_items = sorted(encryption_context.items(), key=lambda x: x[1])
+    buf = BytesIO()
+    buf.write(struct.pack(">h", len(encryption_context)))
+    for key, value in sorted_items:
+        key_bytes = key.encode("utf-8")
+        buf.write(struct.pack(">h", len(key_bytes)))
+        buf.write(key_bytes)
+        value_bytes = value.encode("utf-8")
+        buf.write(struct.pack(">h", len(value_bytes)))
+        buf.write(value_bytes)
+    return buf.getvalue()
+
+
+def deserialize_context(data):
+    if data is None or len(data) == 0:
+        return {}
+    buf = BytesIO(data)
+    remaining = buf.read(2)
+    if len(remaining) < 2:
+        raise ValueError("insufficient data for context size")
+    context_size = struct.unpack(">h", remaining)[0]
+    result = {}
+    for _ in range(context_size):
+        key_len_data = buf.read(2)
+        if len(key_len_data) < 2:
+            raise ValueError("insufficient data for key length")
+        key_len = struct.unpack(">h", key_len_data)[0]
+        key_bytes = buf.read(key_len)
+        if len(key_bytes) < key_len:
+            raise ValueError("insufficient data for key")
+        value_len_data = buf.read(2)
+        if len(value_len_data) < 2:
+            raise ValueError("insufficient data for value length")
+        value_len = struct.unpack(">h", value_len_data)[0]
+        value_bytes = buf.read(value_len)
+        if len(value_bytes) < value_len:
+            raise ValueError("insufficient data for value")
+        result[key_bytes.decode("utf-8")] = value_bytes.decode("utf-8")
+    return result
+
+
+def hex_to_bytes(hex_string):
+    _HEX_CHARS = set("0123456789abcdefABCDEF")
+    if hex_string is None or len(hex_string) == 0 or len(hex_string) % 2 != 0:
+        raise ValueError("invalid string length.")
+    for c in hex_string:
+        if c not in _HEX_CHARS:
+            raise ValueError("invalid string char. " + c)
+    return bytes.fromhex(hex_string)
+
+
+def bytes_to_hex(b):
+    return b.hex()
+
+
+def get_capsule_kms_config(kms_config_list, key_capsule_config):
+    if is_empty(kms_config_list):
+        raise Exception("config null error")
+    if key_capsule_config is None:
+        raise Exception("KeyCapsuleConfig is required for key capsule mode")
+    kms_config = None
+    for temp_config in kms_config_list:
+        if temp_config.region.lower() == key_capsule_config.region.lower():
+            kms_config = temp_config
+    if kms_config is None:
+        raise Exception("key capsule region not found " + key_capsule_config.region)
+    return kms_config

huaweicloud_encryptionsdk/exception/errors.py

@@ -0,0 +1,109 @@
+from enum import Enum
+
+
+class ErrorMessage(Enum):
+
+    DECRYPT_EXCEPTION = (1000, "process wrong when decrypt data")
+    CIPHER_EXCEPTION = (1001, "process wrong when cipher data")
+    TAMPERED_EXCEPTION = (1002, "Header integrity check failed.")
+    ENCRYPT_EXCEPTION = (1003, "encrypt error")
+    AK_NULL_EXCEPTION = (1004, "ak of kms server should be not null")
+    SK_NULL_EXCEPTION = (1005, "sk of kms server should be not null")
+    DATA_KEY_GENERATE_EXCEPTION = (1006, "The data key generation type is not the specified type")
+    KMS_CREATE_KEY_EXCEPTION = (1007, "create data key from kms error")
+    SERIALIZE_EXCEPTION = (1008, "Failed to serialize cipher text headers")
+    DESERIALIZE_EXCEPTION = (1009, "Failed to deserialize cipher text headers,the cipher header may be changed")
+    PUBLIC_KEY_PARSE_EXCEPTION = (1010, "publicKey can not be parsed")
+    PRIVATE_KEY_PARSE_EXCEPTION = (1011, "privateKey can not be parsed")
+    KEYRING_NULL_EXCEPTION = (1012, "key ring should not be null")
+    KEYRING_NOT_FOUND_EXCEPTION = (1013, "not found such type of Keyring")
+    KEYRING_NOT_MATCH_EXCEPTION = (1014, "there is no master key match when decrypt data key")
+    DATA_EXCEED_LIMIT = (1015, "plaintext data exceed cache limit")
+    MESSAGE_DIGEST_ERROR = (1016, "MessageDigest error")
+    PROCESS_FILE_ERROR = (1017, "process file error when encrypt or decrypt the file")
+    FILE_CHANGED_ERROR = (1018, "the content of the file may be changed")
+    CONFIG_NULL_ERROR = (1019, "the kms config information should not be null")
+    CIPHER_TEXT_CHANGED_ERROR = (1020, "the cipher text may be changed")
+    NOT_FOUND_CIPHER_TEXT_DATA_KEY = (1021, "cipher header may be changed,the count of data key should not less than 0")
+    NOT_SUPPORT_DISCOVERY_DECRYPT = (1022, "the cipher text not support discovery Keyring")
+    ENCRYPT_DATA_KEY_EXCEPTION = (1023, "encrypt data key error,please confirm your information is right")
+    CACHE_PARAM_LESS_THAN_ZERO = (1024, "the param of cache should not less than 0!")
+    MASTER_KEY_SHOULD_NOT_NULL = (1025, "Master Key should not null")
+    SOURCE_FILE_INVALID = (1026, "The length of the source file is insufficient.")
+    KMS_CREATE_KEY_CAPSULE_EXCEPTION = (1027, "create key capsule from KMS error")
+    PARSE_KEY_CAPSULE_EXCEPTION = (1028, "parse key capsule exception")
+    DECRYPT_KEY_CAPSULE_EXCEPTION = (1029, "decrypt key capsule exception")
+    KEY_CAPSULE_NULL = (1030, "key capsule is null")
+    UNSUPPORTED_ACCESS_POINT_TYPE = (1031, "unsupported access point type")
+    CIPHER_TEXT_DATA_KEY_NOT_NULL = (1032, "the cipher text data key should not be null")
+    END_POINT_NOT_NULL = (1033, "the region is not support or endpoint should not be null")
+    KEY_CAPSULE_REGION_NOT_FOUND = (1034, "the region of key capsule is not found, region is ")
+    ACCESS_POINT_KEY_EXCEPTION = (1035, "The access point key material is incorrectly parsed.")
+    COLLECT_PROOF_EXCEPTION = (1036, "Failed to collect the proof document.")
+    GET_PUB_KEY_EXCEPTION = (1037, "Get ecc public key from private key error.")
+
+    def __init__(self, code, message):
+        self._code = code
+        self._message = message
+
+    @property
+    def code(self):
+        return self._code
+
+    @property
+    def message(self):
+        return self._message
+
+    @message.setter
+    def message(self, value):
+        self._message = value
+
+
+class HuaweicloudException(RuntimeError):
+
+    def __init__(self, *args):
+        if len(args) == 0:
+            super().__init__()
+        elif len(args) == 1:
+            if isinstance(args[0], BaseException):
+                super().__init__(args[0])
+            else:
+                super().__init__(args[0])
+        else:
+            super().__init__(args[0], args[1])
+
+
+class KeyringNotFoundException(HuaweicloudException):
+
+    def __init__(self, *args):
+        super().__init__(*args)
+
+
+class KeyringNotMatchException(HuaweicloudException):
+
+    def __init__(self, *args):
+        super().__init__(*args)
+
+
+class KeyParseException(HuaweicloudException):
+
+    def __init__(self, message, cause):
+        super().__init__(message, cause)
+
+
+class EncryptException(HuaweicloudException):
+
+    def __init__(self, *args):
+        super().__init__(*args)
+
+
+class CipherTamperedException(HuaweicloudException):
+
+    def __init__(self, *args):
+        super().__init__(*args)
+
+
+class CipherDataException(HuaweicloudException):
+
+    def __init__(self, *args):
+        super().__init__(*args)

huaweicloud_encryptionsdk/handler/cipher_handler.py

@@ -0,0 +1,294 @@
+import os
+import struct
+from io import BytesIO
+
+from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+from cryptography.hazmat.backends import default_backend
+
+from huaweicloud_encryptionsdk.common.utils import serialize_context
+from huaweicloud_encryptionsdk.model.cipher_header import CipherHeader
+from huaweicloud_encryptionsdk.model.enums.crypto_algorithm import CryptoAlgorithm
+
+
+ENCRYPT_MODE = 1
+DECRYPT_MODE = 2
+
+
+class CipherHandler:
+
+    def __init__(self, algorithm, secret_key, mode):
+        self._mode = mode
+        self._secret_key = secret_key
+        self._algorithm = algorithm
+        self._iv = self._generate_iv(algorithm)
+
+    @staticmethod
+    def _generate_iv(algorithm):
+        return os.urandom(algorithm.iv_len)
+
+    def get_iv(self):
+        return self._iv
+
+    def set_iv(self, iv):
+        self._iv = iv
+
+    def reset_iv(self):
+        self._iv = self._generate_iv(self._algorithm)
+
+    def _get_parameter_spec(self, plain_text=None):
+        crypto_mode = self._algorithm.get_crypto_mode()
+        if crypto_mode.upper() == "CBC":
+            return modes.CBC(self._iv)
+        if self._mode == DECRYPT_MODE and crypto_mode.upper() == "GCM":
+            tag = plain_text[-self._algorithm.tag_len:]
+            return modes.GCM(self._iv, tag, min_tag_length=self._algorithm.tag_len)
+        return modes.GCM(self._iv)
+
+    def _create_cipher(self, mode_spec):
+        alg_name = self._algorithm.crypto_alg.split("/")[0]
+        if alg_name.upper() == "SM4":
+            from cryptography.hazmat.primitives.ciphers import algorithms as _algs
+            return Cipher(_algs.SM4(self._secret_key), mode_spec, backend=default_backend())
+        if alg_name.upper() == "AES":
+            return Cipher(
+                algorithms.AES(self._secret_key), mode_spec, backend=default_backend()
+            )
+        raise Exception("unsupported algorithm: " + alg_name)
+
+    def _do_sm4_cbc(self, data, mode_int):
+        from gmssl.sm4 import CryptSM4, SM4_DECRYPT, SM4_ENCRYPT
+        crypt_sm4 = CryptSM4()
+        if mode_int == ENCRYPT_MODE:
+            crypt_sm4.set_key(self._secret_key, SM4_ENCRYPT)
+        else:
+            crypt_sm4.set_key(self._secret_key, SM4_DECRYPT)
+        return crypt_sm4.crypt_cbc(self._iv, data)
+
+    def _do_sm4_gcm(self, data, aad, mode_int):
+        from cryptography.hazmat.primitives.ciphers import Cipher as _Cipher
+        from cryptography.hazmat.primitives.ciphers import algorithms as _algs, modes as _modes
+
+        sm4_alg = _algs.SM4(self._secret_key)
+
+        if mode_int == ENCRYPT_MODE:
+            gcm = _modes.GCM(self._iv)
+            cipher = _Cipher(sm4_alg, gcm, backend=default_backend())
+            encryptor = cipher.encryptor()
+            if aad:
+                encryptor.authenticate_additional_data(aad)
+            ct = encryptor.update(data) + encryptor.finalize()
+            return ct + encryptor.tag
+        else:
+            if len(data) < self._algorithm.tag_len:
+                raise ValueError("data too short for GCM tag")
+            tag = data[-self._algorithm.tag_len:]
+            ct = data[:-self._algorithm.tag_len]
+            gcm = _modes.GCM(self._iv, tag, min_tag_length=self._algorithm.tag_len)
+            cipher = _Cipher(sm4_alg, gcm, backend=default_backend())
+            decryptor = cipher.decryptor()
+            if aad:
+                decryptor.authenticate_additional_data(aad)
+            return decryptor.update(ct) + decryptor.finalize()
+
+    def cipher_data(self, plain_text, encryption_context, offset, length):
+        try:
+            aad = serialize_context(encryption_context)
+            crypto_mode = self._algorithm.get_crypto_mode()
+            alg_name = self._algorithm.crypto_alg.split("/")[0]
+            data = plain_text[offset: offset + length]
+
+            if self._algorithm == CryptoAlgorithm.SM4_128_CBC_PADDING:
+                from gmssl.sm4 import CryptSM4, SM4_ENCRYPT, SM4_DECRYPT
+                padded = self._pkcs7_pad(data, 16)
+                crypt_sm4 = CryptSM4()
+                if self._mode == ENCRYPT_MODE:
+                    crypt_sm4.set_key(self._secret_key, SM4_ENCRYPT)
+                    return crypt_sm4.crypt_cbc(self._iv, padded)
+                else:
+                    crypt_sm4.set_key(self._secret_key, SM4_DECRYPT)
+                    decrypted = crypt_sm4.crypt_cbc(self._iv, data)
+                    return self._pkcs7_unpad(decrypted)
+
+            if self._algorithm == CryptoAlgorithm.SM4_128_GCM_NOPADDING:
+                return self._do_sm4_gcm(data, aad, self._mode)
+
+            mode_spec = self._get_parameter_spec(plain_text if self._mode == DECRYPT_MODE else None)
+            cipher_obj = self._create_cipher(mode_spec)
+
+            if self._mode == ENCRYPT_MODE:
+                encryptor = cipher_obj.encryptor()
+                if crypto_mode.upper() == "GCM":
+                    if aad:
+                        encryptor.authenticate_additional_data(aad)
+                ct = encryptor.update(data) + encryptor.finalize()
+                if crypto_mode.upper() == "GCM":
+                    ct = ct + encryptor.tag
+                return ct
+            else:
+                if crypto_mode.upper() == "GCM":
+                    gcm_data = data[:-self._algorithm.tag_len]
+                else:
+                    gcm_data = data
+                decryptor = cipher_obj.decryptor()
+                if crypto_mode.upper() == "GCM":
+                    if aad:
+                        decryptor.authenticate_additional_data(aad)
+                return decryptor.update(gcm_data) + decryptor.finalize()
+        except Exception as e:
+            raise Exception("cipher exception: " + str(e)) from e
+
+    def cipher_header_data(self, content, encryption_context, offset, length):
+        try:
+            crypto_mode = self._algorithm.get_crypto_mode()
+            alg_name = self._algorithm.crypto_alg.split("/")[0]
+
+            if self._algorithm == CryptoAlgorithm.SM4_128_CBC_PADDING:
+                from gmssl.sm4 import CryptSM4, SM4_ENCRYPT, SM4_DECRYPT
+                crypt_sm4 = CryptSM4()
+                if self._mode == ENCRYPT_MODE:
+                    crypt_sm4.set_key(self._secret_key, SM4_ENCRYPT)
+                    if length == 0:
+                        digest_data = b"\x00"
+                        padded = self._pkcs7_pad(digest_data, 16)
+                        return crypt_sm4.crypt_cbc(self._iv, padded)
+                    padded = self._pkcs7_pad(content[offset:offset + length], 16)
+                    return crypt_sm4.crypt_cbc(self._iv, padded)
+                else:
+                    crypt_sm4.set_key(self._secret_key, SM4_DECRYPT)
+                    decrypted = crypt_sm4.crypt_cbc(self._iv, content[offset:offset + length])
+                    return self._pkcs7_unpad(decrypted)
+
+            if self._algorithm == CryptoAlgorithm.SM4_128_GCM_NOPADDING:
+                return self._do_sm4_gcm(
+                    content[offset: offset + length] if length > 0 else b"",
+                    encryption_context,
+                    self._mode,
+                )
+
+            if crypto_mode.upper() == "CBC":
+                mode_spec = modes.CBC(self._iv)
+            elif crypto_mode.upper() == "GCM":
+                if self._mode == DECRYPT_MODE:
+                    data = content[offset: offset + length]
+                    tag = data[-self._algorithm.tag_len:]
+                    ct = data[:-self._algorithm.tag_len]
+                    mode_spec = modes.GCM(self._iv, tag, min_tag_length=self._algorithm.tag_len)
+                else:
+                    mode_spec = modes.GCM(self._iv)
+                    ct = None
+            else:
+                raise Exception("unsupported mode: " + crypto_mode)
+
+            cipher_obj = self._create_cipher(mode_spec)
+
+            if self._mode == ENCRYPT_MODE:
+                encryptor = cipher_obj.encryptor()
+                if crypto_mode.upper() == "GCM":
+                    if encryption_context:
+                        encryptor.authenticate_additional_data(encryption_context)
+                ct = encryptor.update(content[offset: offset + length]) + encryptor.finalize()
+                if crypto_mode.upper() == "GCM":
+                    ct = ct + encryptor.tag
+                return ct
+            else:
+                decryptor = cipher_obj.decryptor()
+                if crypto_mode.upper() == "GCM":
+                    if encryption_context:
+                        decryptor.authenticate_additional_data(encryption_context)
+                    return decryptor.update(ct) + decryptor.finalize()
+                return decryptor.update(content[offset: offset + length]) + decryptor.finalize()
+        except Exception as e:
+            raise Exception("cipher exception: " + str(e)) from e
+
+    def process_encrypt_byte(self, read_bytes, read_len, output_stream, aad):
+        try:
+            self._init_cipher()
+            crypto_mode = self._algorithm.get_crypto_mode()
+            data = read_bytes[:read_len]
+
+            if self._algorithm == CryptoAlgorithm.SM4_128_CBC_PADDING:
+                from gmssl.sm4 import CryptSM4, SM4_ENCRYPT
+                padded = self._pkcs7_pad(data, 16)
+                crypt_sm4 = CryptSM4()
+                crypt_sm4.set_key(self._secret_key, SM4_ENCRYPT)
+                encrypted = crypt_sm4.crypt_cbc(self._iv, padded)
+            elif self._algorithm == CryptoAlgorithm.SM4_128_GCM_NOPADDING:
+                encrypted = self._do_sm4_gcm(data, aad, ENCRYPT_MODE)
+            else:
+                if crypto_mode.upper() == "GCM":
+                    mode_spec = modes.GCM(self._iv)
+                else:
+                    mode_spec = modes.CBC(self._iv)
+                cipher_obj = self._create_cipher(mode_spec)
+                encryptor = cipher_obj.encryptor()
+                if crypto_mode.upper() == "GCM" and aad:
+                    encryptor.authenticate_additional_data(aad)
+                ct = encryptor.update(data) + encryptor.finalize()
+                if crypto_mode.upper() == "GCM":
+                    encrypted = ct + encryptor.tag
+                else:
+                    encrypted = ct
+
+            cipher_header = CipherHeader()
+            cipher_header.iv = self._iv
+            cipher_header.content_length = len(encrypted)
+            header_byte = cipher_header.serialize_file_fields()
+            output_stream.write(header_byte)
+            output_stream.write(encrypted)
+            return encrypted
+        except Exception as e:
+            raise Exception("process file error: " + str(e)) from e
+
+    def process_decrypt_byte(self, read_bytes, read_len, output_stream, aad):
+        try:
+            self._init_cipher()
+            crypto_mode = self._algorithm.get_crypto_mode()
+            data = read_bytes[:read_len]
+
+            if self._algorithm == CryptoAlgorithm.SM4_128_CBC_PADDING:
+                from gmssl.sm4 import CryptSM4, SM4_DECRYPT
+                crypt_sm4 = CryptSM4()
+                crypt_sm4.set_key(self._secret_key, SM4_DECRYPT)
+                result = crypt_sm4.crypt_cbc(self._iv, data)
+                decrypted = self._pkcs7_unpad(result)
+            elif self._algorithm == CryptoAlgorithm.SM4_128_GCM_NOPADDING:
+                decrypted = self._do_sm4_gcm(data, aad, DECRYPT_MODE)
+            else:
+                if crypto_mode.upper() == "GCM":
+                    tag = data[-self._algorithm.tag_len:]
+                    gcm_data = data[:-self._algorithm.tag_len]
+                    mode_spec = modes.GCM(self._iv, tag, min_tag_length=self._algorithm.tag_len)
+                else:
+                    mode_spec = modes.CBC(self._iv)
+                    gcm_data = data
+                cipher_obj = self._create_cipher(mode_spec)
+                decryptor = cipher_obj.decryptor()
+                if crypto_mode.upper() == "GCM" and aad:
+                    decryptor.authenticate_additional_data(aad)
+                decrypted = decryptor.update(gcm_data) + decryptor.finalize()
+                if crypto_mode.upper() != "GCM":
+                    decrypted = self._pkcs7_unpad(decrypted)
+
+            output_stream.write(decrypted)
+            return decrypted
+        except Exception as e:
+            raise Exception("process file error: " + str(e)) from e
+
+    def _init_cipher(self):
+        pass
+
+    @staticmethod
+    def _pkcs7_pad(data, block_size):
+        pad_len = block_size - (len(data) % block_size)
+        return data + bytes([pad_len] * pad_len)
+
+    @staticmethod
+    def _pkcs7_unpad(data, block_size=16):
+        if not data or len(data) % block_size != 0:
+            raise ValueError("invalid data length")
+        pad_len = data[-1]
+        if pad_len < 1 or pad_len > block_size:
+            raise ValueError("invalid padding length")
+        if data[-pad_len:] != bytes([pad_len] * pad_len):
+            raise ValueError("invalid padding bytes")
+        return data[:-pad_len]

huaweicloud_encryptionsdk/handler/crypto_handler.py

@@ -0,0 +1,24 @@
+from abc import ABC, abstractmethod
+
+from huaweicloud_encryptionsdk.model.crypto_result import CryptoResult
+from huaweicloud_encryptionsdk.model.data_key_materials import DataKeyMaterials
+from huaweicloud_encryptionsdk.model.request.encrypt_request import EncryptRequest
+
+
+class CryptoHandler(ABC):
+
+    @abstractmethod
+    def encrypt(self, request, data_key_materials):
+        pass
+
+    @abstractmethod
+    def decrypt(self, cipher_text, data_key_materials):
+        pass
+
+    @abstractmethod
+    def encrypt_stream(self, input_stream, output_stream, data_key_materials, encryption_context):
+        pass
+
+    @abstractmethod
+    def decrypt_stream(self, input_stream, output_stream, data_key_materials):
+        pass