swarmauri_crypto_paramiko 0.3.0.dev3__py3-none-any.whl

swarmauri_crypto_paramiko/ParamikoCrypto.py

@@ -0,0 +1,405 @@
+"""Paramiko-backed crypto provider with sealing support.
+
+Implements the ICrypto contract using:
+- AES-256-GCM for symmetric encrypt/decrypt
+- RSA-OAEP(SHA-256) for:
+    • wrapping the session key to many recipients (KEM+AEAD mode)
+    • sealing/unsealing (direct public-key encryption of plaintext) for small payloads
+
+Notes
+-----
+- This provider expects RSA public keys in OpenSSH format via ``KeyRef.public``.
+- For unwrap/unseal, a PEM-encoded RSA private key is expected in ``KeyRef.material``.
+- Sealing has a size limit: len(plaintext) <= (modulus_bytes - 2*hash_len - 2).
+  For larger payloads, use AES-GCM + RSA-OAEP key-wrap (encrypt_for_many with enc_alg="AES-256-GCM").
+"""
+
+from __future__ import annotations
+
+import secrets
+from typing import Any, Dict, Iterable, Literal, Optional
+from enum import Enum
+
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import padding, rsa
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+
+from swarmauri_core.crypto.types import (
+    AEADCiphertext,
+    Alg,
+    MultiRecipientEnvelope,
+    RecipientInfo,
+    UnsupportedAlgorithm,
+    WrappedKey,
+    KeyRef,
+    IntegrityError,
+)
+
+from swarmauri_base.crypto.CryptoBase import CryptoBase
+from swarmauri_base.ComponentBase import ComponentBase
+
+
+_SEAL_ALG = "RSA-OAEP-SHA256-SEAL"
+_WRAP_ALG = "RSA-OAEP-SHA256"
+_AEAD_DEFAULT = "AES-256-GCM"
+
+
+@ComponentBase.register_type(CryptoBase, "ParamikoCrypto")
+class ParamikoCrypto(CryptoBase):
+    """Concrete implementation of the ICrypto contract using AES-GCM and RSA-OAEP."""
+
+    type: Literal["ParamikoCrypto"] = "ParamikoCrypto"
+
+    def supports(self) -> Dict[str, Iterable[Alg]]:
+        return {
+            "encrypt": (_AEAD_DEFAULT,),
+            "decrypt": (_AEAD_DEFAULT,),
+            "wrap": (_WRAP_ALG,),
+            "unwrap": (_WRAP_ALG,),
+            # NEW:
+            "seal": (_SEAL_ALG,),
+            "unseal": (_SEAL_ALG,),
+        }
+
+    # ────────────────────────── helpers ──────────────────────────
+
+    def _normalize_aead_alg(self, alg: Any) -> Alg:
+        if isinstance(alg, Enum):
+            alg = alg.value
+        alg = alg or _AEAD_DEFAULT
+        if alg == "AES256_GCM":
+            alg = _AEAD_DEFAULT
+        return alg
+
+    @staticmethod
+    def _load_rsa_pub_ssh(pub_bytes: bytes):
+        return serialization.load_ssh_public_key(pub_bytes)
+
+    @staticmethod
+    def _load_rsa_priv_pem(pem_bytes: bytes):
+        return serialization.load_pem_private_key(pem_bytes, password=None)
+
+    @staticmethod
+    def _seal_size_check(pubkey, pt_len: int):
+        # RSA OAEP max input: k - 2*hLen - 2
+        if not isinstance(pubkey, rsa.RSAPublicKey):
+            raise UnsupportedAlgorithm("Sealing requires an RSA public key")
+        k = (pubkey.key_size + 7) // 8
+        hlen = hashes.SHA256().digest_size
+        max_in = k - 2 * hlen - 2
+        if pt_len > max_in:
+            raise IntegrityError(
+                f"Plaintext too large for {_SEAL_ALG}: {pt_len} > {max_in}. "
+                f"Use encrypt_for_many(enc_alg='{_AEAD_DEFAULT}') instead."
+            )
+
+    # ────────────────────────── symmetric AEAD ──────────────────────────
+
+    async def encrypt(
+        self,
+        key: KeyRef,
+        pt: bytes,
+        *,
+        alg: Optional[Alg] = None,
+        aad: Optional[bytes] = None,
+        nonce: Optional[bytes] = None,
+    ) -> AEADCiphertext:
+        alg = self._normalize_aead_alg(alg)
+        if alg != _AEAD_DEFAULT:
+            raise UnsupportedAlgorithm(f"Unsupported AEAD algorithm: {alg}")
+
+        if key.material is None:
+            raise ValueError(
+                "KeyRef.material must contain symmetric key bytes for AEAD"
+            )
+        if len(key.material) not in (16, 24, 32):
+            raise ValueError("KeyRef.material must be 16/24/32 bytes for AES-GCM")
+
+        nonce = nonce or secrets.token_bytes(12)
+        aead = AESGCM(key.material)
+        ct_with_tag = aead.encrypt(nonce, pt, aad)
+        ct, tag = ct_with_tag[:-16], ct_with_tag[-16:]
+        return AEADCiphertext(
+            kid=key.kid,
+            version=key.version,
+            alg=alg,
+            nonce=nonce,
+            ct=ct,
+            tag=tag,
+            aad=aad,
+        )
+
+    async def decrypt(
+        self,
+        key: KeyRef,
+        ct: AEADCiphertext,
+        *,
+        aad: Optional[bytes] = None,
+    ) -> bytes:
+        if self._normalize_aead_alg(ct.alg) != _AEAD_DEFAULT:
+            raise UnsupportedAlgorithm(f"Unsupported AEAD algorithm: {ct.alg}")
+        if key.material is None:
+            raise ValueError(
+                "KeyRef.material must contain symmetric key bytes for AEAD"
+            )
+
+        aead = AESGCM(key.material)
+        blob = ct.ct + ct.tag
+        return aead.decrypt(ct.nonce, blob, aad or ct.aad)
+
+    # ─────────────────────────── sealing ───────────────────────────
+    # (direct RSA-OAEP of plaintext; for small payloads only)
+
+    async def seal(
+        self,
+        recipient: KeyRef,
+        pt: bytes,
+        *,
+        alg: Optional[Alg] = _SEAL_ALG,
+    ) -> bytes:
+        if alg != _SEAL_ALG:
+            raise UnsupportedAlgorithm(f"Unsupported seal alg: {alg}")
+        if recipient.public is None:
+            raise ValueError("KeyRef.public must contain OpenSSH RSA public key bytes")
+
+        rsa_pub = self._load_rsa_pub_ssh(recipient.public)
+        self._seal_size_check(rsa_pub, len(pt))
+
+        sealed = rsa_pub.encrypt(
+            pt,
+            padding.OAEP(
+                mgf=padding.MGF1(algorithm=hashes.SHA256()),
+                algorithm=hashes.SHA256(),
+                label=None,
+            ),
+        )
+        return sealed
+
+    async def unseal(
+        self,
+        recipient_priv: KeyRef,
+        sealed: bytes,
+        *,
+        alg: Optional[Alg] = _SEAL_ALG,
+    ) -> bytes:
+        if alg != _SEAL_ALG:
+            raise UnsupportedAlgorithm(f"Unsupported seal alg: {alg}")
+        if recipient_priv.material is None:
+            raise ValueError(
+                "KeyRef.material must contain PEM-encoded RSA private key bytes"
+            )
+
+        priv = self._load_rsa_priv_pem(recipient_priv.material)
+        return priv.decrypt(
+            sealed,
+            padding.OAEP(
+                mgf=padding.MGF1(algorithm=hashes.SHA256()),
+                algorithm=hashes.SHA256(),
+                label=None,
+            ),
+        )
+
+    # ───────────── hybrid encrypt-for-many via RSA-OAEP (KEM+AEAD) ─────────────
+
+    async def encrypt_for_many(
+        self,
+        recipients: Iterable[KeyRef],
+        pt: bytes,
+        *,
+        enc_alg: Optional[Alg] = None,
+        recipient_wrap_alg: Optional[Alg] = None,
+        aad: Optional[bytes] = None,
+        nonce: Optional[bytes] = None,
+    ) -> MultiRecipientEnvelope:
+        # 1) Sealed-style variant (per-recipient ciphertext; no shared ct)
+        if enc_alg == _SEAL_ALG:
+            recip_infos: list[RecipientInfo] = []
+            for r in recipients:
+                if r.public is None:
+                    raise ValueError(
+                        "Recipient KeyRef.public must contain OpenSSH RSA public key bytes"
+                    )
+                rsa_pub = self._load_rsa_pub_ssh(r.public)
+                self._seal_size_check(rsa_pub, len(pt))
+                sealed = rsa_pub.encrypt(
+                    pt,
+                    padding.OAEP(
+                        mgf=padding.MGF1(algorithm=hashes.SHA256()),
+                        algorithm=hashes.SHA256(),
+                        label=None,
+                    ),
+                )
+                recip_infos.append(
+                    RecipientInfo(
+                        kid=r.kid,
+                        version=r.version,
+                        wrap_alg=_SEAL_ALG,
+                        wrapped_key=sealed,
+                        nonce=None,
+                    )
+                )
+
+            # Shared fields empty for sealed variant
+            return MultiRecipientEnvelope(
+                enc_alg=_SEAL_ALG,
+                nonce=b"",
+                ct=b"",
+                tag=b"",
+                recipients=tuple(recip_infos),
+                aad=None,  # AAD is not bound in RSA-seal mode
+            )
+
+        # 2) Default KEM+AEAD path (shared AES-GCM ct + RSA-wrapped CEK)
+        enc_alg = self._normalize_aead_alg(enc_alg)
+        if enc_alg != _AEAD_DEFAULT:
+            raise UnsupportedAlgorithm(f"Unsupported enc_alg: {enc_alg}")
+        wrap_alg = recipient_wrap_alg or _WRAP_ALG
+        if wrap_alg != _WRAP_ALG:
+            raise UnsupportedAlgorithm(f"Unsupported wrap_alg: {wrap_alg}")
+
+        k = secrets.token_bytes(32)  # 256-bit session key
+        iv = nonce or secrets.token_bytes(12)
+        aead = AESGCM(k)
+        ct_with_tag = aead.encrypt(iv, pt, aad)
+        ct, tag = ct_with_tag[:-16], ct_with_tag[-16:]
+
+        recip_infos: list[RecipientInfo] = []
+        for r in recipients:
+            if r.public is None:
+                raise ValueError(
+                    "Recipient KeyRef.public must contain OpenSSH RSA public key bytes"
+                )
+            rsa_pub = self._load_rsa_pub_ssh(r.public)
+            enc_k = rsa_pub.encrypt(
+                k,
+                padding.OAEP(
+                    mgf=padding.MGF1(algorithm=hashes.SHA256()),
+                    algorithm=hashes.SHA256(),
+                    label=None,
+                ),
+            )
+            recip_infos.append(
+                RecipientInfo(
+                    kid=r.kid,
+                    version=r.version,
+                    wrap_alg=wrap_alg,
+                    wrapped_key=enc_k,
+                )
+            )
+
+        return MultiRecipientEnvelope(
+            enc_alg=enc_alg,
+            nonce=iv,
+            ct=ct,
+            tag=tag,
+            recipients=tuple(recip_infos),
+            aad=aad,
+        )
+
+    # ────────────────────────── raw RSA wrap/unwrap ─────────────────────
+
+    async def wrap(
+        self,
+        kek: KeyRef,
+        *,
+        dek: Optional[bytes] = None,
+        wrap_alg: Optional[Alg] = None,
+        nonce: Optional[bytes] = None,
+        aad: Optional[bytes] = None,
+    ) -> WrappedKey:
+        """Wrap a DEK with the given KEK.
+
+        Supports two modes:
+        * RSA-OAEP when ``wrap_alg`` is ``_WRAP_ALG`` (the legacy behaviour)
+        * AES-GCM when ``wrap_alg`` matches the default AEAD algorithm. In
+          this mode ``kek.material`` must provide the symmetric key bytes and
+          a random nonce will be generated when one isn't supplied.
+        """
+
+        wrap_alg = wrap_alg or _WRAP_ALG
+        if wrap_alg == _WRAP_ALG:
+            if kek.public is None:
+                raise ValueError(
+                    "KeyRef.public must contain OpenSSH RSA public key bytes"
+                )
+            rsa_pub = self._load_rsa_pub_ssh(kek.public)
+            if dek is None:
+                dek = secrets.token_bytes(32)
+            wrapped = rsa_pub.encrypt(
+                dek,
+                padding.OAEP(
+                    mgf=padding.MGF1(algorithm=hashes.SHA256()),
+                    algorithm=hashes.SHA256(),
+                    label=None,
+                ),
+            )
+            return WrappedKey(
+                kek_kid=kek.kid,
+                kek_version=kek.version,
+                wrap_alg=wrap_alg,
+                nonce=nonce,
+                wrapped=wrapped,
+            )
+
+        alg = self._normalize_aead_alg(wrap_alg)
+        if alg != _AEAD_DEFAULT:
+            raise UnsupportedAlgorithm(f"Unsupported wrap_alg: {wrap_alg}")
+        if kek.material is None:
+            raise ValueError(
+                "KeyRef.material must contain symmetric key bytes for AES-GCM wrap"
+            )
+        if len(kek.material) not in (16, 24, 32):
+            raise ValueError("KeyRef.material must be 16/24/32 bytes for AES-GCM")
+        if dek is None:
+            dek = secrets.token_bytes(32)
+        nonce = nonce or secrets.token_bytes(12)
+        aead = AESGCM(kek.material)
+        ct_with_tag = aead.encrypt(nonce, dek, aad)
+        ct, tag = ct_with_tag[:-16], ct_with_tag[-16:]
+        return WrappedKey(
+            kek_kid=kek.kid,
+            kek_version=kek.version,
+            wrap_alg=wrap_alg,
+            nonce=nonce,
+            wrapped=ct,
+            tag=tag,
+        )
+
+    async def unwrap(
+        self,
+        kek: KeyRef,
+        wrapped: WrappedKey,
+        *,
+        aad: Optional[bytes] = None,
+    ) -> bytes:
+        """Unwrap a previously wrapped key."""
+
+        if wrapped.wrap_alg == _WRAP_ALG:
+            if kek.material is None:
+                raise ValueError(
+                    "KeyRef.material must contain PEM-encoded RSA private key bytes"
+                )
+            priv = self._load_rsa_priv_pem(kek.material)
+            return priv.decrypt(
+                wrapped.wrapped,
+                padding.OAEP(
+                    mgf=padding.MGF1(algorithm=hashes.SHA256()),
+                    algorithm=hashes.SHA256(),
+                    label=None,
+                ),
+            )
+
+        alg = self._normalize_aead_alg(wrapped.wrap_alg)
+        if alg != _AEAD_DEFAULT:
+            raise UnsupportedAlgorithm(f"Unsupported wrap_alg: {wrapped.wrap_alg}")
+        if kek.material is None:
+            raise ValueError(
+                "KeyRef.material must contain symmetric key bytes for AES-GCM unwrap"
+            )
+        if wrapped.nonce is None:
+            raise ValueError("WrappedKey.nonce required for AES-GCM unwrap")
+        if wrapped.tag is None:
+            raise ValueError("WrappedKey.tag required for AES-GCM unwrap")
+        aead = AESGCM(kek.material)
+        blob = wrapped.wrapped + wrapped.tag
+        return aead.decrypt(wrapped.nonce, blob, aad)

swarmauri_crypto_paramiko/__init__.py

@@ -0,0 +1,3 @@
+from .ParamikoCrypto import ParamikoCrypto
+
+__all__ = ["ParamikoCrypto"]

swarmauri_crypto_paramiko-0.3.0.dev3.dist-info/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [2025] [Jacob Stewart @ Swarmauri]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

swarmauri_crypto_paramiko-0.3.0.dev3.dist-info/METADATA

@@ -0,0 +1,118 @@
+Metadata-Version: 2.3
+Name: swarmauri_crypto_paramiko
+Version: 0.3.0.dev3
+Summary: Paramiko-backed RSA + AES-GCM crypto provider for Swarmauri
+License: Apache-2.0
+Author: Swarmauri
+Author-email: opensource@swarmauri.com
+Requires-Python: >=3.10,<3.13
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Natural Language :: English
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Development Status :: 3 - Alpha
+Classifier: Topic :: Security :: Cryptography
+Classifier: Intended Audience :: Developers
+Requires-Dist: cryptography (>=41)
+Requires-Dist: paramiko (>=3.4)
+Requires-Dist: swarmauri_base
+Requires-Dist: swarmauri_core
+Description-Content-Type: text/markdown
+
+![Swamauri Logo](https://res.cloudinary.com/dbjmpekvl/image/upload/v1730099724/Swarmauri-logo-lockup-2048x757_hww01w.png)
+
+<p align="center">
+    <a href="https://pypi.org/project/swarmauri_crypto_paramiko/">
+        <img src="https://img.shields.io/pypi/dm/swarmauri_crypto_paramiko" alt="PyPI - Downloads"/></a>
+    <a href="https://hits.sh/github.com/swarmauri/swarmauri-sdk/tree/master/pkgs/standards/swarmauri_crypto_paramiko/">
+        <img alt="Hits" src="https://hits.sh/github.com/swarmauri/swarmauri-sdk/tree/master/pkgs/standards/swarmauri_crypto_paramiko.svg"/></a>
+    <a href="https://pypi.org/project/swarmauri_crypto_paramiko/">
+        <img src="https://img.shields.io/pypi/pyversions/swarmauri_crypto_paramiko" alt="PyPI - Python Version"/></a>
+    <a href="https://pypi.org/project/swarmauri_crypto_paramiko/">
+        <img src="https://img.shields.io/pypi/l/swarmauri_crypto_paramiko" alt="PyPI - License"/></a>
+    <a href="https://pypi.org/project/swarmauri_crypto_paramiko/">
+        <img src="https://img.shields.io/pypi/v/swarmauri_crypto_paramiko?label=swarmauri_crypto_paramiko&color=green" alt="PyPI - swarmauri_crypto_paramiko"/></a>
+</p>
+
+---
+
+## Swarmauri Crypto Paramiko
+
+Paramiko-backed crypto provider implementing the `ICrypto` contract via `CryptoBase`.
+
+- AES-256-GCM symmetric encrypt/decrypt
+- RSA-OAEP(SHA-256) wrap/unwrap
+- Multi-recipient hybrid envelopes using OpenSSH public keys
+
+## Installation
+
+```bash
+pip install swarmauri_crypto_paramiko
+```
+
+## Usage
+
+### Symmetric AEAD Encryption
+
+```python
+from swarmauri_crypto_paramiko import ParamikoCrypto
+from swarmauri_core.crypto.types import KeyRef, KeyType, KeyUse, ExportPolicy
+
+crypto = ParamikoCrypto()
+
+sym = KeyRef(
+    kid="sym1",
+    version=1,
+    type=KeyType.SYMMETRIC,
+    uses=(KeyUse.ENCRYPT, KeyUse.DECRYPT),
+    export_policy=ExportPolicy.SECRET_WHEN_ALLOWED,
+    material=b"\x00" * 32,
+)
+
+ct = await crypto.encrypt(sym, b"hello")
+pt = await crypto.decrypt(sym, ct)
+```
+
+### RSA Key Wrapping/Unwrapping
+
+```python
+import paramiko
+from cryptography.hazmat.primitives import serialization
+from swarmauri_core.crypto.types import KeyRef, KeyType, KeyUse, ExportPolicy
+
+crypto = ParamikoCrypto()
+
+key = paramiko.RSAKey.generate(2048)
+pub_line = f"{key.get_name()} {key.get_base64()}\n".encode()
+priv_pem = key.key.private_bytes(
+    encoding=serialization.Encoding.PEM,
+    format=serialization.PrivateFormat.PKCS8,
+    encryption_algorithm=serialization.NoEncryption(),
+)
+
+recipient = KeyRef(
+    kid="rsa1",
+    version=1,
+    type=KeyType.RSA,
+    uses=(KeyUse.WRAP, KeyUse.UNWRAP),
+    export_policy=ExportPolicy.PUBLIC_ONLY,
+    public=pub_line,
+    material=priv_pem,
+)
+
+wrapped = await crypto.wrap(recipient)
+unwrapped = await crypto.unwrap(recipient, wrapped)
+```
+
+### Hybrid Envelope for Multiple Recipients
+
+```python
+env = await crypto.encrypt_for_many([recipient], b"secret")
+```
+
+## Entry point
+
+The provider is registered under the `swarmauri.cryptos` entry-point as `ParamikoCrypto`.
+

swarmauri_crypto_paramiko-0.3.0.dev3.dist-info/RECORD

@@ -0,0 +1,7 @@
+swarmauri_crypto_paramiko/ParamikoCrypto.py,sha256=6MvCKQXsRK9d0OZjwrWqpsEokPdtv8ljmAaQoZHvcu4,14287
+swarmauri_crypto_paramiko/__init__.py,sha256=SYZFBZCXIQnNkjmA4nmzbNgdRnoKQ9I80NJ9AgPBwfc,73
+swarmauri_crypto_paramiko-0.3.0.dev3.dist-info/LICENSE,sha256=djUXOlCxLVszShEpZXshZ7v33G-2qIC_j9KXpWKZSzQ,11359
+swarmauri_crypto_paramiko-0.3.0.dev3.dist-info/METADATA,sha256=dKbtnQSDUWI7c7JsG0V6AkdrXFGlBpXa3Rhw6QGNsRQ,3866
+swarmauri_crypto_paramiko-0.3.0.dev3.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
+swarmauri_crypto_paramiko-0.3.0.dev3.dist-info/entry_points.txt,sha256=fJd3ojGFXXguIVn5QupZW-tn3v_E6EYYRyottnEE1zs,160
+swarmauri_crypto_paramiko-0.3.0.dev3.dist-info/RECORD,,

swarmauri_crypto_paramiko-0.3.0.dev3.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: poetry-core 2.1.3
+Root-Is-Purelib: true
+Tag: py3-none-any

swarmauri_crypto_paramiko-0.3.0.dev3.dist-info/entry_points.txt

@@ -0,0 +1,6 @@
+[peagen.plugins.cryptos]
+paramiko_crypto=swarmauri_crypto_paramiko:ParamikoCrypto
+
+[swarmauri.cryptos]
+ParamikoCrypto=swarmauri_crypto_paramiko:ParamikoCrypto
+