python-pkcs11 0.9.2__tar.gz → 0.9.4__tar.gz

{python_pkcs11-0.9.2 → python_pkcs11-0.9.4}/.github/actions/test-setup/action.yml

@@ -34,7 +34,7 @@ runs:
   using: "composite"
   steps:
     - name: Setup Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: ${{ inputs.python-version }}
     - uses: ./.github/actions/install-softhsm
@@ -78,7 +78,7 @@ runs:
       env:
         PLATFORM: ${{ inputs.pkcs11-platform }}
     - name: Install uv
-      uses: astral-sh/setup-uv@v4
+      uses: astral-sh/setup-uv@v7
       with:
         enable-cache: true
         python-version: ${{ inputs.python-version }}

{python_pkcs11-0.9.2 → python_pkcs11-0.9.4}/.github/workflows/coverage.yml

@@ -23,7 +23,7 @@ jobs:
           - opencryptoki
     steps:
       - name: Acquire sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Arm coverage-only compiler directives
         # Unfortunately, it doesn't seem to be possible to pass directives
         # to Cython through environment variables: https://github.com/cython/cython/issues/3930
@@ -56,7 +56,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Acquire sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - uses: ./.github/actions/test-setup
         id: setup
         with:
@@ -85,7 +85,7 @@ jobs:
     needs: [pytest-coverage,pytest-coverage-multilib]
     steps:
       # checkout necessary to ensure the uploaded report contains the correct paths
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Retrieve coverage reports
         uses: actions/download-artifact@v4
         with:

{python_pkcs11-0.9.2 → python_pkcs11-0.9.4}/.github/workflows/quality.yml

@@ -10,15 +10,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Acquire sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.13"
           architecture: x64
@@ -30,4 +30,10 @@ jobs:
         run: uv run ruff format --diff .
 
       - name: ruff check
-        run: uv run ruff check --diff .
+        run: uv run ruff check --diff .
+
+      - name: Install project dependencies for type checking
+        run: uv pip install asn1crypto
+
+      - name: ty type check
+        run: uv run ty check pkcs11/

{python_pkcs11-0.9.2 → python_pkcs11-0.9.4}/.github/workflows/release.yml

@@ -51,7 +51,7 @@ jobs:
             echo "Tag $VERSION does not follow v<version> naming scheme"
             exit 1
           fi
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Generate release body
         run: |
           sed "s/:VERSION/$VERSION/g" < .github/release-template.md > release.md
@@ -75,9 +75,9 @@ jobs:
           - windows-latest
           - macos-14
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
       - name: Build wheels
         uses: pypa/cibuildwheel@v3.3.0
       - uses: actions/upload-artifact@v4
@@ -88,11 +88,11 @@ jobs:
     runs-on: ubuntu-latest
     needs: [extract-params]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
       - name: Build source distribution

{python_pkcs11-0.9.2 → python_pkcs11-0.9.4}/.github/workflows/tests.yml

@@ -40,7 +40,7 @@ jobs:
             os: macos-14
     steps:
       - name: Acquire sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - uses: ./.github/actions/test-setup
         id: setup
         with:
@@ -69,7 +69,7 @@ jobs:
           - "3.14"
     steps:
       - name: Acquire sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - uses: ./.github/actions/test-setup
         id: setup
         with:

python_pkcs11-0.9.4/MANIFEST.in

@@ -0,0 +1,3 @@
+graft extern/
+include pkcs11/*.pxd
+include pkcs11/py.typed

{python_pkcs11-0.9.2 → python_pkcs11-0.9.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-pkcs11
-Version: 0.9.2
+Version: 0.9.4
 Summary: PKCS#11 support for Python
 Author-email: Andrey Kislyuk <kislyuk@gmail.com>, Danielle Madeley <danielle@madeley.id.au>
 Maintainer-email: Andrey Kislyuk <kislyuk@gmail.com>

{python_pkcs11-0.9.2 → python_pkcs11-0.9.4}/pkcs11/__init__.py

@@ -2,16 +2,24 @@
 :mod:`pkcs11` defines a high-level, "Pythonic" interface to PKCS#11.
 """
 
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any
+
 from pkcs11.constants import *  # noqa: F403
 from pkcs11.exceptions import *  # noqa: F403
 from pkcs11.mechanisms import *  # noqa: F403
 from pkcs11.types import *  # noqa: F403
 from pkcs11.util import dh, dsa, ec, rsa, x509  # noqa: F401
 
-_loaded = {}
+if TYPE_CHECKING:
+    from pkcs11._pkcs11 import lib as _lib_type
+
+
+_loaded: dict[str, Any] = {}
 
 
-def lib(so):
+def lib(so: str) -> _lib_type:
     """
     Wrap the main library call coming from Cython with a preemptive
     dynamic loading.
@@ -34,7 +42,7 @@ def lib(so):
     return _lib
 
 
-def unload(so):
+def unload(so: str) -> None:
     global _loaded
     try:
         loaded_lib = _loaded[so]

python_pkcs11-0.9.4/pkcs11/_pkcs11.pyi

@@ -0,0 +1,38 @@
+"""Type stubs for the _pkcs11 Cython extension module."""
+
+from __future__ import annotations
+
+from typing import Any, Iterator
+
+from pkcs11.types import Slot, Token
+
+class lib:
+    """Main entry point for PKCS#11 library."""
+
+    so: str
+    manufacturer_id: str
+    library_description: str
+    initialized: bool
+
+    def __init__(self, so: str) -> None: ...
+    @property
+    def library_version(self) -> tuple[int, int]: ...
+    @property
+    def cryptoki_version(self) -> tuple[int, int]: ...
+    def initialize(self) -> None: ...
+    def finalize(self) -> None: ...
+    def reinitialize(self) -> None: ...
+    def unload(self) -> None: ...
+    def get_slots(self, token_present: bool = False) -> list[Slot]: ...
+    def get_tokens(
+        self,
+        token_label: str | None = None,
+        token_serial: bytes | None = None,
+        token_flags: Any | None = None,
+        slot_flags: Any | None = None,
+        mechanisms: Any | None = None,
+    ) -> Iterator[Token]: ...
+    def get_token(self, **kwargs: Any) -> Token: ...
+    def wait_for_slot_event(self, blocking: bool = True) -> Slot: ...
+    def __str__(self) -> str: ...
+    def __repr__(self) -> str: ...

{python_pkcs11-0.9.2 → python_pkcs11-0.9.4}/pkcs11/_pkcs11.pyx

@@ -1366,8 +1366,15 @@ cdef object make_object(Session session, CK_OBJECT_HANDLE handle) with gil:
         # Determine a list of base classes to manufacture our class with
         try:
             attributes = wrapper.get_attribute_list(&attr_keys[0], 8)
-        except (AttributeTypeInvalid, FunctionFailed) as e:
+        except PKCS11Error:
+            # retry fetching the flags one by one, some tokens do not implement error handling
+            # on bulk fetches correctly.
             attributes = {}
+            for key in attr_keys:
+                try:
+                    attributes[key] = wrapper[key]
+                except (AttributeTypeInvalid, AttributeSensitive, FunctionFailed):
+                    continue
 
         object_class = attributes.get(Attribute.CLASS, session.attribute_mapper)
         bases = (_CLASS_MAP[object_class],)

{python_pkcs11-0.9.2 → python_pkcs11-0.9.4}/pkcs11/attributes.py

@@ -1,36 +1,46 @@
+from __future__ import annotations
+
 from datetime import datetime
+from enum import IntEnum
 from struct import Struct
+from typing import Any, Callable, Final
 
-from pkcs11.constants import (
-    Attribute,
-    CertificateType,
-    MechanismFlag,
-    ObjectClass,
-)
+from pkcs11.constants import Attribute, CertificateType, MechanismFlag, ObjectClass
 from pkcs11.mechanisms import KeyType, Mechanism
 
+# Type aliases for pack/unpack function pairs
+PackFunc = Callable[[Any], bytes]
+UnpackFunc = Callable[[bytes], Any]
+Handler = tuple[PackFunc, UnpackFunc]
+
 # (Pack Function, Unpack Function) functions
-handle_bool = (Struct("?").pack, lambda v: False if len(v) == 0 else Struct("?").unpack(v)[0])
-handle_ulong = (Struct("L").pack, lambda v: Struct("L").unpack(v)[0])
-handle_str = (lambda s: s.encode("utf-8"), lambda b: b.decode("utf-8"))
-handle_date = (
+_bool_struct = Struct("?")
+_ulong_struct = Struct("L")
+
+handle_bool: Handler = (
+    _bool_struct.pack,
+    lambda v: False if len(v) == 0 else _bool_struct.unpack(v)[0],
+)
+handle_ulong: Handler = (_ulong_struct.pack, lambda v: _ulong_struct.unpack(v)[0])
+handle_str: Handler = (lambda s: s.encode("utf-8"), lambda b: b.decode("utf-8"))
+handle_date: Handler = (
     lambda s: s.strftime("%Y%m%d").encode("ascii"),
     lambda s: datetime.strptime(s.decode("ascii"), "%Y%m%d").date(),
 )
-handle_bytes = (bytes, bytes)
+handle_bytes: Handler = (bytes, bytes)
 # The PKCS#11 biginteger type is an array of bytes in network byte order.
 # If you have an int type, wrap it in biginteger()
-handle_biginteger = handle_bytes
+handle_biginteger: Handler = handle_bytes
 
 
-def _enum(type_):
+def _enum(type_: type[IntEnum]) -> Handler:
     """Factory to pack/unpack ints into IntEnums."""
     pack, unpack = handle_ulong
 
     return (lambda v: pack(int(v)), lambda v: type_(unpack(v)))
 
 
-ATTRIBUTE_TYPES = {
+ATTRIBUTE_TYPES: dict[Attribute, Handler] = {
     Attribute.ALWAYS_AUTHENTICATE: handle_bool,
     Attribute.ALWAYS_SENSITIVE: handle_bool,
     Attribute.APPLICATION: handle_str,
@@ -96,7 +106,7 @@ ATTRIBUTE_TYPES = {
 Map of attributes to (serialize, deserialize) functions.
 """
 
-ALL_CAPABILITIES = (
+ALL_CAPABILITIES: Final[tuple[Attribute, ...]] = (
     Attribute.ENCRYPT,
     Attribute.DECRYPT,
     Attribute.WRAP,
@@ -107,7 +117,12 @@ ALL_CAPABILITIES = (
 )
 
 
-def _apply_common(template, id_, label, store):
+def _apply_common(
+    template: dict[Attribute, Any],
+    id_: bytes | None,
+    label: str | None,
+    store: bool,
+) -> None:
     if id_:
         template[Attribute.ID] = id_
     if label:
@@ -115,12 +130,16 @@ def _apply_common(template, id_, label, store):
     template[Attribute.TOKEN] = bool(store)
 
 
-def _apply_capabilities(template, possible_capas, capabilities):
+def _apply_capabilities(
+    template: dict[Attribute, Any],
+    possible_capas: tuple[Attribute, ...],
+    capabilities: MechanismFlag | int,
+) -> None:
     for attr in possible_capas:
         template[attr] = _capa_attr_to_mechanism_flag[attr] & capabilities
 
 
-_capa_attr_to_mechanism_flag = {
+_capa_attr_to_mechanism_flag: Final[dict[Attribute, MechanismFlag]] = {
     Attribute.ENCRYPT: MechanismFlag.ENCRYPT,
     Attribute.DECRYPT: MechanismFlag.DECRYPT,
     Attribute.WRAP: MechanismFlag.WRAP,
@@ -136,7 +155,12 @@ class AttributeMapper:
     Class mapping PKCS#11 attributes to and from Python values.
     """
 
-    def __init__(self):
+    attribute_types: dict[Attribute, Handler]
+    default_secret_key_template: dict[Attribute, Any]
+    default_public_key_template: dict[Attribute, Any]
+    default_private_key_template: dict[Attribute, Any]
+
+    def __init__(self) -> None:
         self.attribute_types = dict(ATTRIBUTE_TYPES)
         self.default_secret_key_template = {
             Attribute.CLASS: ObjectClass.SECRET_KEY,
@@ -158,21 +182,21 @@ class AttributeMapper:
             Attribute.SENSITIVE: True,
         }
 
-    def register_handler(self, key, pack, unpack):
+    def register_handler(self, key: Attribute, pack: PackFunc, unpack: UnpackFunc) -> None:
         self.attribute_types[key] = (pack, unpack)
 
-    def _handler(self, key):
+    def _handler(self, key: Attribute) -> Handler:
         try:
             return self.attribute_types[key]
         except KeyError as e:
             raise NotImplementedError(f"Can't handle attribute type {hex(key)}.") from e
 
-    def pack_attribute(self, key, value):
+    def pack_attribute(self, key: Attribute, value: Any) -> bytes:
         """Pack a Attribute value into a bytes array."""
         pack, _ = self._handler(key)
         return pack(value)
 
-    def unpack_attributes(self, key, value):
+    def unpack_attributes(self, key: Attribute, value: bytes) -> Any:
         """Unpack a Attribute bytes array into a Python value."""
         _, unpack = self._handler(key)
         return unpack(value)
@@ -180,12 +204,12 @@ class AttributeMapper:
     def public_key_template(
         self,
         *,
-        capabilities,
-        id_,
-        label,
-        store,
-    ):
-        template = self.default_public_key_template
+        capabilities: MechanismFlag | int,
+        id_: bytes | None,
+        label: str | None,
+        store: bool,
+    ) -> dict[Attribute, Any]:
+        template = dict(self.default_public_key_template)
         _apply_capabilities(
             template, (Attribute.ENCRYPT, Attribute.WRAP, Attribute.VERIFY), capabilities
         )
@@ -195,12 +219,12 @@ class AttributeMapper:
     def private_key_template(
         self,
         *,
-        capabilities,
-        id_,
-        label,
-        store,
-    ):
-        template = self.default_private_key_template
+        capabilities: MechanismFlag | int,
+        id_: bytes | None,
+        label: str | None,
+        store: bool,
+    ) -> dict[Attribute, Any]:
+        template = dict(self.default_private_key_template)
         _apply_capabilities(
             template,
             (Attribute.DECRYPT, Attribute.UNWRAP, Attribute.SIGN, Attribute.DERIVE),
@@ -212,11 +236,11 @@ class AttributeMapper:
     def secret_key_template(
         self,
         *,
-        capabilities,
-        id_,
-        label,
-        store,
-    ):
+        capabilities: MechanismFlag | int,
+        id_: bytes | None,
+        label: str | None,
+        store: bool,
+    ) -> dict[Attribute, Any]:
         return self.generic_key_template(
             self.default_secret_key_template,
             capabilities=capabilities,
@@ -227,13 +251,13 @@ class AttributeMapper:
 
     def generic_key_template(
         self,
-        base_template,
+        base_template: dict[Attribute, Any],
         *,
-        capabilities,
-        id_,
-        label,
-        store,
-    ):
+        capabilities: MechanismFlag | int,
+        id_: bytes | None,
+        label: str | None,
+        store: bool,
+    ) -> dict[Attribute, Any]:
         template = dict(base_template)
         _apply_capabilities(template, ALL_CAPABILITIES, capabilities)
         _apply_common(template, id_, label, store)

{python_pkcs11-0.9.2 → python_pkcs11-0.9.4}/pkcs11/constants.py

@@ -5,9 +5,12 @@ See the Python :mod:`enum` documentation for more information on how to
 use these classes.
 """
 
+from __future__ import annotations
+
 from enum import IntEnum, IntFlag, unique
+from typing import Final
 
-DEFAULT = object()
+DEFAULT: Final[object] = object()
 """Sentinel value used in templates.
 
 Not all pkcs11 attribute sets are accepted by HSMs.
@@ -55,11 +58,11 @@ class ObjectClass(IntEnum):
 
     _VENDOR_DEFINED = 0x80000000
 
-    def __repr__(self):
+    def __repr__(self) -> str:
         return "<ObjectClass.%s>" % self.name
 
 
-_ARRAY_ATTRIBUTE = 0x40000000
+_ARRAY_ATTRIBUTE: Final[int] = 0x40000000
 """Attribute consists of an array of values."""
 
 
@@ -343,7 +346,7 @@ class Attribute(IntEnum):
 
     _VENDOR_DEFINED = 0x80000000
 
-    def __repr__(self):
+    def __repr__(self) -> str:
         return "<Attribute.%s>" % self.name
 
 

{python_pkcs11-0.9.2 → python_pkcs11-0.9.4}/pkcs11/defaults.py

@@ -5,12 +5,14 @@ None of this is provided for in PKCS#11 and its correctness should not be
 assumed.
 """
 
-from pkcs11.constants import (
-    MechanismFlag,
-)
+from __future__ import annotations
+
+from typing import Final
+
+from pkcs11.constants import MechanismFlag
 from pkcs11.mechanisms import MGF, KeyType, Mechanism
 
-DEFAULT_GENERATE_MECHANISMS = {
+DEFAULT_GENERATE_MECHANISMS: Final[dict[KeyType, Mechanism]] = {
     KeyType.AES: Mechanism.AES_KEY_GEN,
     KeyType.DES2: Mechanism.DES2_KEY_GEN,
     KeyType.DES3: Mechanism.DES3_KEY_GEN,
@@ -26,11 +28,11 @@ DEFAULT_GENERATE_MECHANISMS = {
 Default mechanisms for generating keys.
 """
 
-_ENCRYPTION = MechanismFlag.ENCRYPT | MechanismFlag.DECRYPT
-_SIGNING = MechanismFlag.SIGN | MechanismFlag.VERIFY
-_WRAPPING = MechanismFlag.WRAP | MechanismFlag.UNWRAP
+_ENCRYPTION: Final[MechanismFlag] = MechanismFlag.ENCRYPT | MechanismFlag.DECRYPT
+_SIGNING: Final[MechanismFlag] = MechanismFlag.SIGN | MechanismFlag.VERIFY
+_WRAPPING: Final[MechanismFlag] = MechanismFlag.WRAP | MechanismFlag.UNWRAP
 
-DEFAULT_KEY_CAPABILITIES = {
+DEFAULT_KEY_CAPABILITIES: Final[dict[KeyType, MechanismFlag | int]] = {
     KeyType.AES: _ENCRYPTION | _SIGNING | _WRAPPING,
     KeyType.DES2: _ENCRYPTION | _SIGNING | _WRAPPING,
     KeyType.DES3: _ENCRYPTION | _SIGNING | _WRAPPING,
@@ -45,7 +47,7 @@ DEFAULT_KEY_CAPABILITIES = {
 Default capabilities for generating keys.
 """
 
-DEFAULT_ENCRYPT_MECHANISMS = {
+DEFAULT_ENCRYPT_MECHANISMS: Final[dict[KeyType, Mechanism]] = {
     KeyType.AES: Mechanism.AES_CBC_PAD,
     KeyType.DES2: Mechanism.DES3_CBC_PAD,
     KeyType.DES3: Mechanism.DES3_CBC_PAD,
@@ -55,7 +57,7 @@ DEFAULT_ENCRYPT_MECHANISMS = {
 Default mechanisms for encrypt/decrypt.
 """
 
-DEFAULT_SIGN_MECHANISMS = {
+DEFAULT_SIGN_MECHANISMS: Final[dict[KeyType, Mechanism]] = {
     KeyType.AES: Mechanism.AES_MAC,
     KeyType.DES2: Mechanism.DES3_MAC,
     KeyType.DES3: Mechanism.DES3_MAC,
@@ -68,7 +70,7 @@ DEFAULT_SIGN_MECHANISMS = {
 Default mechanisms for sign/verify.
 """
 
-DEFAULT_WRAP_MECHANISMS = {
+DEFAULT_WRAP_MECHANISMS: Final[dict[KeyType, Mechanism]] = {
     KeyType.AES: Mechanism.AES_KEY_WRAP,
     KeyType.DES2: Mechanism.DES3_ECB,
     KeyType.DES3: Mechanism.DES3_ECB,
@@ -78,7 +80,7 @@ DEFAULT_WRAP_MECHANISMS = {
 Default mechanism for wrap/unwrap.
 """
 
-DEFAULT_DERIVE_MECHANISMS = {
+DEFAULT_DERIVE_MECHANISMS: Final[dict[KeyType, Mechanism]] = {
     KeyType.DH: Mechanism.DH_PKCS_DERIVE,
     KeyType.EC: Mechanism.ECDH1_DERIVE,
     KeyType.X9_42_DH: Mechanism.X9_42_DH_DERIVE,
@@ -87,7 +89,7 @@ DEFAULT_DERIVE_MECHANISMS = {
 Default mechanisms for key derivation
 """
 
-DEFAULT_PARAM_GENERATE_MECHANISMS = {
+DEFAULT_PARAM_GENERATE_MECHANISMS: Final[dict[KeyType, Mechanism]] = {
     KeyType.DH: Mechanism.DH_PKCS_PARAMETER_GEN,
     KeyType.DSA: Mechanism.DSA_PARAMETER_GEN,
     KeyType.X9_42_DH: Mechanism.X9_42_DH_PARAMETER_GEN,
@@ -97,7 +99,9 @@ Default mechanisms for domain parameter generation
 """
 
 
-DEFAULT_MECHANISM_PARAMS = {
+DEFAULT_MECHANISM_PARAMS: Final[
+    dict[Mechanism, tuple[Mechanism, MGF, None] | tuple[Mechanism, MGF, int]]
+] = {
     Mechanism.RSA_PKCS_OAEP: (Mechanism.SHA_1, MGF.SHA1, None),
     Mechanism.RSA_PKCS_PSS: (Mechanism.SHA_1, MGF.SHA1, 20),
 }

{python_pkcs11-0.9.2 → python_pkcs11-0.9.4}/pkcs11/exceptions.py

@@ -3,6 +3,8 @@ PKCS#11 return codes are exposed as Python exceptions inheriting from
 :class:`PKCS11Error`.
 """
 
+from __future__ import annotations
+
 
 class PKCS11Error(RuntimeError):
     """

{python_pkcs11-0.9.2 → python_pkcs11-0.9.4}/pkcs11/mechanisms.py

@@ -1,3 +1,5 @@
+from __future__ import annotations
+
 from enum import IntEnum
 
 from pkcs11.exceptions import ArgumentsBad
@@ -107,7 +109,7 @@ class KeyType(IntEnum):
 
     _VENDOR_DEFINED = 0x80000000
 
-    def __repr__(self):
+    def __repr__(self) -> str:
         return "<KeyType.%s>" % self.name
 
 
@@ -751,7 +753,7 @@ class Mechanism(IntEnum):
 
     _VENDOR_DEFINED = 0x80000000
 
-    def __repr__(self):
+    def __repr__(self) -> str:
         return "<Mechanism.%s>" % self.name
 
 
@@ -775,7 +777,7 @@ class KDF(IntEnum):
     SHA3_384_KDF = 0x0000000C
     SHA3_512_KDF = 0x0000000D
 
-    def __repr__(self):
+    def __repr__(self) -> str:
         return "<KDF.%s>" % self.name
 
 
@@ -794,12 +796,18 @@ class MGF(IntEnum):
     SHA3_384 = 0x00000008
     SHA3_512 = 0x00000009
 
-    def __repr__(self):
+    def __repr__(self) -> str:
         return "<MGF.%s>" % self.name
 
 
 class GCMParams:
-    def __init__(self, nonce, aad=None, tag_bits=128):
+    """Parameters for AES-GCM mode."""
+
+    nonce: bytes
+    aad: bytes | None
+    tag_bits: int
+
+    def __init__(self, nonce: bytes, aad: bytes | None = None, tag_bits: int = 128) -> None:
         if len(nonce) > 12:
             raise ArgumentsBad("IV must be less than 12 bytes")
         self.nonce = nonce
@@ -808,7 +816,11 @@ class GCMParams:
 
 
 class CTRParams:
-    def __init__(self, nonce):
+    """Parameters for AES-CTR mode."""
+
+    nonce: bytes
+
+    def __init__(self, nonce: bytes) -> None:
         if len(nonce) >= 16:
             raise ArgumentsBad(
                 f"{nonce.hex()} is too long to serve as a CTR nonce, must be 15 bytes or less "