kryptools 0.9.14__tar.gz → 1.0__tar.gz

{kryptools-0.9.14 → kryptools-1.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.2
 Name: kryptools
-Version: 0.9.14
+Version: 1.0
 Summary: Implemenation of same basic algorithms used in cryptography.
 Author-email: Gerald Teschl <gerald.teschl@univie.ac.at>
 License: MIT
@@ -44,5 +44,9 @@ The tools contained are:
 * Zmod: a class for the ring of integers modulo an integer
 * GF2: a class for Galois fields GF(2^n)
 
+* BlockCipher: a class implementing the usual modes of operation (ECB, CBC, GCM, etc.)
+* AESCipher: individual AES operations
+* DESCipher: individual DES operations
+
 Documentation can be found in the jupyter notebook
 (mostly done, but might not contain everything: use the force, read the source).

{kryptools-0.9.14 → kryptools-1.0}/README.md

@@ -27,5 +27,9 @@ The tools contained are:
 * Zmod: a class for the ring of integers modulo an integer
 * GF2: a class for Galois fields GF(2^n)
 
+* BlockCipher: a class implementing the usual modes of operation (ECB, CBC, GCM, etc.)
+* AESCipher: individual AES operations
+* DESCipher: individual DES operations
+
 Documentation can be found in the jupyter notebook
 (mostly done, but might not contain everything: use the force, read the source).

{kryptools-0.9.14 → kryptools-1.0}/kryptools/GF2.py

@@ -241,6 +241,32 @@ class GF2_aes(GF_2):
 aes_sbox = list(map(GF2_aes, aes_sbox))
 aes_sbox_inv = list(map(GF2_aes, aes_sbox_inv))
 
+#
+# Mini-AES
+#
+
+# sbox for Mini-AES
+miniaes_sbox = [14, 4, 13, 1, 2, 15, 11, 8, 3, 10, 6, 12, 5, 9, 0, 7]
+
+# inverse sbox for MiniAES
+miniaes_sbox_inv = [ 0 for i in range(16) ]
+for i in range(16):
+    miniaes_sbox_inv[miniaes_sbox[i]] = i
+
+class GF2_miniaes(GF_2):
+    "Represents a point in the Mini-AES Galois field GF(2^4)."
+    modulus: int = 0b10011  # x^4 + x + 1 = Mini-AES
+    power: int = 4  # n
+    order: int = 16  # 2**n
+
+    def sbox(self, inv: bool = False) -> "GF2_miniaes":
+        if inv:
+            return miniaes_sbox_inv[self.x]
+        return miniaes_sbox[self.x]
+
+miniaes_sbox = list(map(GF2_miniaes, miniaes_sbox))
+miniaes_sbox_inv = list(map(GF2_miniaes, miniaes_sbox_inv))
+
 #
 # GHASH
 #

{kryptools-0.9.14 → kryptools-1.0}/kryptools/__init__.py

@@ -5,7 +5,7 @@ Implemenation of same basic algorithms used in cryptography.
 __author__ = "Gerald Teschl"
 __copyright__ = "Copyright 2024, Gerald Teschl"
 __license__ = "MIT License"
-__version__ = "0.9.14"
+__version__ = "0.9.15"
 __email__ = "Gerald.Teschl@univie.ac.at"
 
 from .nt import egcd, cf, convergents, legendre_symbol, jacobi_symbol, sqrt_mod, euler_phi, carmichael_lambda, moebius_mu, is_carmichael_number, order, crt
@@ -18,4 +18,7 @@ from .la import Matrix, zeros, eye
 from .lat import gram_det, hadamard_ratio, hermite_nf, gram_schmidt, babai_round_cvp, babai_round_bnd, babai_plane_cvp, babai_plane_bnd, lagrange_lr, lll, random_unimodular_matrix
 from .poly import Poly
 from .Zmod import Zmod
-from .GF2 import GF2, GF2_aes, GF2_ghash
+from .GF2 import GF2, GF2_aes, GF2_miniaes, GF2_ghash
+from .blockcipher import BlockCipher, bytexor
+from .aes import AESKeySchedule, AESCipher, AESBlockCipher
+from .des import list2int, SDESKeySchedule, SDESCipher, DESKeySchedule, DESCipher, DESBlockCipher

kryptools-1.0/kryptools/aes.py

@@ -0,0 +1,177 @@
+"""
+AES cipher
+"""
+
+from .GF2 import GF2_aes
+from .la import Matrix, zeros
+from .blockcipher import BlockCipher
+
+
+def rotate_left(l: list, n: int) -> list:
+    "Rotate a list cyclically n places to the left."
+    n %= len(l)
+    return l[n:] + l[:n]
+
+aes_mix_matrix = Matrix([ rotate_left([2, 3, 1, 1], -n) for n in range(4) ], ring=GF2_aes)
+aes_mix_matrix_inv = aes_mix_matrix.inv()
+
+class AESCipher:
+    "AES state matrix"
+    def __init__(self, key: bytes = None):
+        self.keys = []
+        self.state = zeros(4, zero=GF2_aes(0))
+        self.set_key(key)
+
+    def __call__(self, s: bytes):
+        if isinstance(s, bytes|bytearray) and len(s) == 16:
+            self.state = zeros(4)
+            for l in range(16):
+                i, j = divmod(l, 4)
+                self.state[j, i] = GF2_aes(s[l])
+        elif isinstance(s, list|tuple) and len(s) == 4:
+            self.state = Matrix(s, ring=GF2_aes)
+        else:
+            raise ValueError("Plaintext must be 16 bytes or 4x4 list of bytes.")
+        return self
+
+    def __repr__(self):
+        return str(self.state)
+
+    def __bytes__(self):
+        tmp = bytearray()
+        for i in range(4):
+            for j in range(4):
+                tmp.append(int(self.state[j, i]))
+        return bytes(tmp)
+
+    def set_key(self, key: bytes):
+        "Set a new key."
+        if key is not None:
+            self.keys = AESKeySchedule(key).gen_keys()
+
+    def sub_bytes(self, inv: bool = False) -> None:
+        "Apply SubBytes to the state."
+        if inv:
+            self.state.map(lambda x: x.sbox(inv=True))
+        else:
+            self.state.map(lambda x: x.sbox())
+
+    def shift_rows(self, inv: bool = False) -> None:
+        "Apply ShiftRows to the state."
+        if inv:
+            inv = -1
+        else:
+            inv = 1
+        for i in range(self.state.rows):
+            self.state.matrix[i] = rotate_left(self.state.matrix[i], inv * i)
+
+    def mix_columns(self, inv = False) -> None:
+        "Apply MixColumns to the state."
+        if inv:
+            self.state.matrix = (aes_mix_matrix_inv * self.state).matrix
+        else:
+            self.state.matrix = (aes_mix_matrix * self.state).matrix
+
+    def add_key(self, key: "Matrix") -> None:
+        "Add the key to the state."
+        self.state += key
+
+    def round(self, k: "Matrix", last = False, inv = False) -> None:
+        "Apply one round to the state."
+        if inv:
+            self.add_key(k)
+            if not last:
+                self.mix_columns(inv = True)
+            self.shift_rows(inv = True)
+            self.sub_bytes(inv = True)
+        else:
+            self.sub_bytes()
+            self.shift_rows()
+            if not last:
+                self.mix_columns()
+            self.add_key(k)
+
+    def encrypt(self, x: bytes = None) -> bytes:
+        "Do a full encryption of a given block (or the current state)."
+        if x is not None:
+            self(x)
+        self.add_key(self.keys[0])
+        for k in self.keys[1:-1]:
+            self.round(k)
+        self.round(self.keys[-1], last = True)
+        return bytes(self)
+
+    def decrypt(self, x: bytes = None) -> bytes:
+        "Do a full decryption of a given block (or the current state)."
+        if x is not None:
+            self(x)
+        self.round(self.keys[-1], last = True, inv = True)
+        for k in reversed(self.keys[1:-1]):
+            self.round(k, inv = True)
+        self.add_key(self.keys[0])
+        return bytes(self)
+
+
+class AESKeySchedule:
+    "AES key matrix"
+    def __init__(self, key: bytes):
+        assert len(key) == 16
+        self.round = 0
+        self.showtmp = False  # print intermediate results
+        if isinstance(key, bytes|bytearray) and len(key) == 16:
+            self.key = zeros(4)
+            for l in range(16):
+                i, j = divmod(l, 4)
+                self.key[j, i] = GF2_aes(key[l])
+        elif isinstance(key, list|tuple) and len(key) == 4:
+            self.key = Matrix(key, ring=GF2_aes)
+        else:
+            raise NotImplementedError("Object must be 16 bytes or 4x4 list of bytes.")
+
+    def __repr__(self):
+        return str(self.key)
+
+    def __bytes__(self):
+        tmp = bytearray()
+        for i in range(4):
+            for j in range(4):
+                tmp.append(int(self.key[j, i]))
+        return bytes(tmp)
+            
+    def next(self) -> None:
+        "Apply one round of the key shedule and return the next key."
+        self.round += 1
+        #RotWord
+        tmp = list(self.key[:,3])
+        if self.showtmp: print("Start    :" + str(tmp))
+        tmp = rotate_left(tmp, 1)
+        if self.showtmp: print("RotWord  :" + str(tmp))
+        #SubWord
+        tmp = list(map(lambda x: x.sbox(), tmp))
+        if self.showtmp: print("SubWord  :" + str(tmp))
+        #AddRound constant
+        tmp[0] += GF2_aes(2)**(self.round - 1)
+        if self.showtmp: print("AddConst :" + str(tmp))
+        tmp = Matrix(tmp)
+        self.key[:,0] += tmp
+        self.key[:,1] += self.key[:,0]
+        self.key[:,2] += self.key[:,1]
+        self.key[:,3] += self.key[:,2]
+
+    def gen_keys(self) -> list:
+        "Generate all round keys."
+        if self.round:
+            raise ValueError('Some keys have already been generated!')
+        keys = [ GF2_aes(1) * self.key ]  # we multiply with one to get a copy
+        for _ in range(10):
+            self.next()
+            keys.append(GF2_aes(1) * self.key)
+        return keys
+
+class AESBlockCipher(BlockCipher):
+    blocksize = 16
+    def set_key(self, key: bytes):
+        if not isinstance(key, bytes) and len(key) != self.__class__.blocksize:
+            raise ValueError(f"Key must be {self.__class__.blocksize} bytes.")
+        self.key = key
+        self.cipher = AESCipher(key)

kryptools-1.0/kryptools/blockcipher.py

@@ -0,0 +1,331 @@
+"""
+Generic class for a block cipher.
+"""
+
+from secrets import token_bytes as randbytes
+
+def bytexor(a: bytes, b: bytes) -> bytes:
+    "Xor two byte strings."
+    return bytes([x ^ y for (x, y) in zip(a, b)])
+
+class BlockCipher:
+    "Generic class for a block cipher."
+    
+    blocksize: int = 1 # blocksize in bytes
+    
+    def __init__(self, key: bytes|int = None, mode: str|None = None):
+        self.key = None  # here we store the key (if any)
+        self.cipher = None  # here we can store an instance of the cipher initialized with the key
+        self.mode = mode # here we store the default en/decryption mode
+        if key:
+            self.set_key(key)
+
+    def set_key(self, key: bytes|int):
+        "Store a new key and initialize the cipher with this key."
+        if key is not None:
+            if isinstance(key, bytes) and len(key) != self.__class__.blocksize:
+                raise ValueError(f"Key must be {self.__class__.blocksize} bytes.")
+            self.key = key
+
+    def encrypt_block(self, b: bytes) -> bytes:
+        "Decrypt one block."
+        return self.cipher.encrypt(b)
+
+    def decrypt_block(self, b: bytes) -> bytes:
+        "Encrypt one block."
+        return self.cipher.decrypt(b)
+
+    def blocksplit(self, text: bytes, padding: bool):
+        "Split a byte string according to the blocksize. Pad (PKCS#7) if requested."
+        if padding and self.__class__.blocksize > 1:  # padding according to PKCS#7
+            pad = -len(text) % self.__class__.blocksize
+            if pad == 0:
+                pad = self.__class__.blocksize
+            text = bytearray(text)
+            text.extend([pad]*pad)  # pad
+            text = bytes(text)
+        return [text[i:i+self.__class__.blocksize] for i in range(0, len(text), self.__class__.blocksize)]
+
+    def encrypt(self, text: bytes, key: bytes|int|None=None, mode=None):
+        "Encrypt using the given mode."
+        if mode is None:
+            mode = self.mode
+        try:
+            method = getattr(self, "encrypt_" + mode.lower())
+        except:
+            raise ValueError("Unsupported encryption mode: ",mode.lower())
+        if key:
+            self.set_key(key)
+        return method(text)
+
+    def decrypt(self, ctext: bytes, key: bytes|int|None=None, mode=None):
+        "Decrypt using the given mode."
+        if mode is None:
+            mode = self.mode
+        try:
+            method = getattr(self, "decrypt_" + mode)
+        except:
+            raise ValueError("Unsupported encryption mode: ",mode)
+        if key:
+            self.set_key(key)
+        return method(ctext)
+
+    def encrypt_ecb(self, text: bytes, padding: bool = True) -> bytes:
+        "Encrypt using ECB mode."
+        ctext = bytearray(b'')
+        for b in self.blocksplit(text, padding):
+            ctext.extend(self.encrypt_block(b))
+        return bytes(ctext)
+
+    def decrypt_ecb(self, ctext: bytes, padding: bool = True) -> bytes:
+        "Decrypt using ECB mode."
+        text = bytearray(b'')
+        for b in self.blocksplit(ctext, False):
+            text.extend(self.decrypt_block(b))
+        if padding and self.__class__.blocksize > 1:
+            return bytes(text[:-text[-1]])  # unpad
+        return bytes(text)
+
+    def encrypt_cbc(self, text: bytes, iv: bytes | None = None, padding: bool = True) -> bytes:
+        "Encrypt using CBC mode."
+        ctext = bytearray(b'')
+        if iv == None:
+            bb = randbytes(self.__class__.blocksize)  # iv
+        else:
+            bb = iv
+        ctext.extend(bb)
+        for b in self.blocksplit(text, padding):
+            bb = self.encrypt_block(bytexor(bb, b))
+            ctext.extend(bb)
+        return bytes(ctext)
+
+    def decrypt_cbc(self, ctext: bytes, padding: bool = True) -> bytes:
+        "Decrypt using CBC mode."
+        text = bytearray(b'')
+        bb = ctext[:self.__class__.blocksize]  # iv
+        ctext = ctext[self.__class__.blocksize:]  # remove iv
+        for b in self.blocksplit(ctext, False):
+            text.extend(bytexor(bb, self.decrypt_block(b)))
+            bb = b
+        if padding and self.__class__.blocksize > 1:
+            return bytes(text[:-text[-1]])  # unpad
+        return bytes(text)
+
+    def encrypt_cfb(self, text: bytes, iv: bytes | None = None) -> bytes:
+        "Encrypt using CFB mode."
+        ctext = bytearray(b'')
+        if iv == None:
+            bb = randbytes(self.__class__.blocksize)  # iv
+        else:
+            bb = iv
+        ctext.extend(bb)  # add iv as first block of the cipher text
+        for b in self.blocksplit(text, False):
+            z = self.encrypt_block(bb)
+            bb = bytexor(b, z)
+            ctext.extend(bb)
+        return bytes(ctext)
+
+    def decrypt_cfb(self, ctext: bytes) -> bytes:
+        "Decrypt using CFB mode."
+        text = bytearray(b'')
+        bb = ctext[:self.__class__.blocksize]  # iv
+        ctext = ctext[self.__class__.blocksize:]  # remove iv
+        for b in self.blocksplit(ctext, False):
+            z = self.encrypt_block(bb)
+            text.extend(bytexor(b, z))
+            bb = b
+        return bytes(text)
+
+    def encrypt_ofb(self, text: bytes, iv: bytes | None = None) -> bytes:
+        "Encrypt using OFB mode."
+        ctext = bytearray(b'')
+        if iv == None:
+            z = randbytes(self.__class__.blocksize)  # iv
+        else:
+            z = iv
+        ctext.extend(z)  # add iv as first block of the cipher text
+        for b in self.blocksplit(text, False):
+            z = self.encrypt_block(z)
+            ctext.extend(bytexor(b, z))
+        return bytes(ctext)
+
+    def decrypt_ofb(self, ctext: bytes) -> bytes:
+        "Decrypt using OFB mode."
+        text = bytearray(b'')
+        z = ctext[:self.__class__.blocksize]  # iv
+        ctext = ctext[self.__class__.blocksize:]  # remove iv
+        for b in self.blocksplit(ctext, False):
+            z = self.encrypt_block(z)
+            text.extend(bytexor(b, z)) 
+        return bytes(text)
+
+    def adv_ctr(self, z: bytes, s: int) -> bytes:
+        "Advance the counter."
+        zz = bytearray(z)
+        for i in range(self.__class__.blocksize-1, self.__class__.blocksize-s-1, -1):
+            c = z[i]+1
+            if (c < 256):
+                zz[i] = c
+                break
+            else:
+                zz[i] = 0
+        return zz
+
+    def encrypt_ctr(self, text: bytes, iv: bytes | None = None) -> bytes:
+        "Encrypt using CTR mode."
+        ctext = bytearray(b'')
+        if iv == None:
+            ctr = randbytes(self.__class__.blocksize)  # iv
+        else:
+            ctr = iv
+        ctext.extend(ctr)  # add iv as first block of the cipher text
+        for b in self.blocksplit(text, False):
+            z = self.encrypt_block(ctr)
+            ctext.extend(bytexor(b, z))
+            ctr = self.adv_ctr(ctr, self.__class__.blocksize)
+        return bytes(ctext)
+
+    def decrypt_ctr(self, ctext: bytes) -> bytes:
+        "Decrypt using CTR mode."
+        text = bytearray(b'')
+        ctr = ctext[:self.__class__.blocksize]  # iv
+        ctext = ctext[self.__class__.blocksize:]  # remove iv
+        for b in self.blocksplit(ctext, False):
+            z = self.encrypt_block(ctr)
+            text.extend(bytexor(b, z))
+            ctr = self.adv_ctr(ctr, self.__class__.blocksize)
+        return bytes(text)
+
+    def mac_cbc(self, text: bytes, padding: bool = True) -> bytes:
+        "CBC-MAC of a bytestring."
+        bb = b'\x00' * self.__class__.blocksize
+        for b in self.blocksplit(text, padding = padding):
+            bb = self.encrypt_block(bytexor(bb, b))
+        return bytes(bb)
+
+    def mac_cmac(self, text: bytes) -> bytes:
+        "CMAC of a bytestring."
+        R_b = {16: 0b10000111, 8: 0b11011, 4: 0b10001101,
+               2: 0b101011, 1: 0b11011}[self.__class__.blocksize]
+
+        bb = b'\x00' * self.__class__.blocksize
+        # Compute key K1
+        key_extra = self.encrypt_block(bb)
+        key_extra = int.from_bytes(key_extra, byteorder='big')
+        msb = key_extra >> (self.__class__.blocksize * 8 - 1)
+        key_extra <<= 1
+        if msb:
+            key_extra ^= 1 << self.__class__.blocksize * 8
+            key_extra ^= R_b
+
+        pad = len(text) % self.__class__.blocksize
+        if pad or not len(text):
+            # Compute key K2
+            text += b'\x80' + b'\x00' * (self.__class__.blocksize - pad - 1)
+            msb = key_extra >> (self.__class__.blocksize * 8 - 1)
+            key_extra <<= 1
+            if msb:
+                key_extra ^= 1 << self.__class__.blocksize * 8
+                key_extra ^= R_b
+        key_extra = key_extra.to_bytes(self.__class__.blocksize, byteorder='big')  # K1 or K2 depending on padding
+        last_block = bytexor(text[-self.__class__.blocksize:], key_extra)  # Xor extra key to the last block
+        text = text[:-self.__class__.blocksize] + last_block
+        for i in range(0, len(text), self.__class__.blocksize):
+            bb = self.encrypt_block(bytexor(bb, text[i:i+self.__class__.blocksize]))
+        return bytes(bb)
+
+    def gf_mult(self, x: int, y: int) -> int:
+        "Muliplication in GF(2^128)."
+        # r = 0b11011 << 27  # 1 + x + x^3 + x^4 (+ x^32)
+        # r = 0b11100001 << 56  # 1 + x + x^2 + x^7 (+ x^64)
+        r = 0b11100001 << 120  # 1 + x + x^2 + x^7 (+ x^128)
+        z = 0
+        v = y
+        for d in bin(x)[2:].zfill(128):
+            if int(d):
+                z ^= v
+            if v % 2:
+                v >>= 1
+                v ^= r
+            else:
+                v >>= 1
+        return z
+
+    def ghash(self, text: bytes, h: int, init: int = 0) -> bytes:
+        "Compute GHASH of a given byte string."
+        assert self.__class__.blocksize == 16, "GCTR mode requires a blocksize of 128 bit."
+        pad = len(text) % self.__class__.blocksize
+        if pad > 0:
+            text += b"\x00" * (self.__class__.blocksize - pad)
+        y = init
+        for i in range(len(text) // self.__class__.blocksize):
+            x = int.from_bytes(
+                text[i * self.__class__.blocksize: (i + 1) * self.__class__.blocksize], byteorder="big")
+            y = self.gf_mult(h, x ^ y)
+        return y
+
+    def _aad_helper(self, len_text:int, aad: bytes | None):
+        "Compute the tag for the additional authenticated data."
+        zero = b'\x00' * self.__class__.blocksize
+        h = int.from_bytes(self.encrypt_block(zero), byteorder="big")
+        len_text *= 8
+        assert len_text.bit_length() <= 4 * self.__class__.blocksize, "Message too long!"
+        len_block = len_text.to_bytes((self.__class__.blocksize // 2), byteorder="big")
+        if aad is not None:
+            len_aad = len(aad) * 8
+            assert len_aad.bit_length() <= 4 * self.__class__.blocksize, "Additional authenticated data too long!"
+            len_block = len_aad.to_bytes(
+                (self.__class__.blocksize // 2), byteorder="big") + len_block
+            tag = self.ghash(aad, h)
+        else:
+            len_block = b'\x00' * (self.__class__.blocksize // 2) + len_block
+            tag = 0
+        return h, len_block, tag
+    
+    
+    def encrypt_gcm(self, text: bytes, iv: bytes | None = None, aad: bytes | None = None) -> bytes:
+        "Encrypt using Galois CTR mode."
+        assert self.__class__.blocksize == 16, "GHASH requires a blocksize of 16 bytes."
+        ctext = bytearray(b'')
+        len_ctr = self.__class__.blocksize // 4
+        if iv == None:
+            iv = randbytes(self.__class__.blocksize - len_ctr)
+        else:
+            assert len(iv) + \
+                len_ctr == self.__class__.blocksize, "IV has inappropriate length!"
+        ctr = iv + (len_ctr - 1) * b'\x00' + b'\x01'
+        ctr0 = ctr
+        ctext.extend(iv)
+        h, len_block, tag = self._aad_helper(len(text), aad)
+        for b in self.blocksplit(text, 0):
+            ctr = self.adv_ctr(ctr, len_ctr)
+            z = self.encrypt_block(ctr)
+            ctext.extend(bytexor(b, z))
+        tag = self.ghash(ctext[self.__class__.blocksize - len_ctr:], h, init=tag)
+        tag = self.ghash(len_block, h, init=tag).to_bytes(
+            self.__class__.blocksize, byteorder="big")
+        z = self.encrypt_block(ctr0)
+        ctext.extend(bytexor(tag, z))
+        return bytes(ctext)
+
+    def decrypt_gcm(self, ctext: bytes, aad: bytes | None = None) -> bytes:
+        "Decrypt using Galois CTR mode."
+        assert self.__class__.blocksize == 16, "GHASH requires a blocksize of 16 bytes."
+        text = bytearray(b'')
+        len_ctr = self.__class__.blocksize // 4
+        iv = ctext[:self.__class__.blocksize - len_ctr]  # iv
+        ctr = iv + (len_ctr - 1) * b'\x00' + b'\x01'
+        mac = ctext[-self.__class__.blocksize:]  # mac
+        ctext = ctext[self.__class__.blocksize - len_ctr:-self.__class__.blocksize]
+        h, len_block, tag = self._aad_helper(len(ctext), aad)
+        tag = self.ghash(ctext, h, init=tag)
+        tag = self.ghash(len_block, h, init=tag).to_bytes(
+            self.__class__.blocksize, byteorder="big")
+        z = self.encrypt_block(ctr)
+        tag = bytexor(tag, z)
+        assert tag == mac, "Incorrect MAC!"
+        for b in self.blocksplit(ctext, 0):
+            ctr = self.adv_ctr(ctr, len_ctr)
+            z = self.encrypt_block(ctr)
+            text.extend(bytexor(b, z))
+        return bytes(text)