paramiko.pkey

37 """ + 38 Base class for public keys. + 39 """ + 40 + 41 # known encryption types for private key files: + 42 _CIPHER_TABLE = { + 43 'DES-EDE3-CBC': { 'cipher': DES3, 'keysize': 24, 'blocksize': 8, 'mode': DES3.MODE_CBC } + 44 } + 45 + 46 +

47 - def __init__(self, msg=None, data=None): +

48 """ + 49 Create a new instance of this public key type. If C{msg} is given, + 50 the key's public part(s) will be filled in from the message. If + 51 C{data} is given, the key's public part(s) will be filled in from + 52 the string. + 53 + 54 @param msg: an optional SSH L{Message} containing a public key of this + 55 type. + 56 @type msg: L{Message} + 57 @param data: an optional string containing a public key of this type + 58 @type data: str + 59 + 60 @raise SSHException: if a key cannot be created from the C{data} or + 61 C{msg} given, or no key was passed in. + 62 """ + 63 pass +

64 +

65 - def __str__(self): +

66 """ + 67 Return a string of an SSH L{Message} made up of the public part(s) of + 68 this key. This string is suitable for passing to L{__init__} to + 69 re-create the key object later. + 70 + 71 @return: string representation of an SSH key message. + 72 @rtype: str + 73 """ + 74 return '' +

75 +

76 - def __cmp__(self, other): +

77 """ + 78 Compare this key to another. Returns 0 if this key is equivalent to + 79 the given key, or non-0 if they are different. Only the public parts + 80 of the key are compared, so a public key will compare equal to its + 81 corresponding private key. + 82 + 83 @param other: key to compare to. + 84 @type other: L{PKey} + 85 @return: 0 if the two keys are equivalent, non-0 otherwise. + 86 @rtype: int + 87 """ + 88 hs = hash(self) + 89 ho = hash(other) + 90 if hs != ho: + 91 return cmp(hs, ho) + 92 return cmp(str(self), str(other)) +

93 +

94 - def get_name(self): +

95 """ + 96 Return the name of this private key implementation. + 97 + 98 @return: name of this private key type, in SSH terminology (for + 99 example, C{"ssh-rsa"}). +100 @rtype: str +101 """ +102 return '' +

103 +

104 - def get_bits(self): +

105 """ +106 Return the number of significant bits in this key. This is useful +107 for judging the relative security of a key. +108 +109 @return: bits in the key. +110 @rtype: int +111 """ +112 return 0 +

113 +

114 - def can_sign(self): +

115 """ +116 Return C{True} if this key has the private part necessary for signing +117 data. +118 +119 @return: C{True} if this is a private key. +120 @rtype: bool +121 """ +122 return False +

123 +

124 - def get_fingerprint(self): +

125 """ +126 Return an MD5 fingerprint of the public part of this key. Nothing +127 secret is revealed. +128 +129 @return: a 16-byte string (binary) of the MD5 fingerprint, in SSH +130 format. +131 @rtype: str +132 """ +133 return MD5.new(str(self)).digest() +

134 +

135 - def get_base64(self): +

136 """ +137 Return a base64 string containing the public part of this key. Nothing +138 secret is revealed. This format is compatible with that used to store +139 public key files or recognized host keys. +140 +141 @return: a base64 string containing the public part of the key. +142 @rtype: str +143 """ +144 return base64.encodestring(str(self)).replace('\n', '') +

145 +

146 - def sign_ssh_data(self, randpool, data): +

147 """ +148 Sign a blob of data with this private key, and return a L{Message} +149 representing an SSH signature message. +150 +151 @param randpool: a secure random number generator. +152 @type randpool: L{Crypto.Util.randpool.RandomPool} +153 @param data: the data to sign. +154 @type data: str +155 @return: an SSH signature message. +156 @rtype: L{Message} +157 """ +158 return '' +

159 +

160 - def verify_ssh_sig(self, data, msg): +

161 """ +162 Given a blob of data, and an SSH message representing a signature of +163 that data, verify that it was signed with this key. +164 +165 @param data: the data that was signed. +166 @type data: str +167 @param msg: an SSH signature message +168 @type msg: L{Message} +169 @return: C{True} if the signature verifies correctly; C{False} +170 otherwise. +171 @rtype: boolean +172 """ +173 return False +

174 +

175 - def from_private_key_file(cls, filename, password=None): +

176 """ +177 Create a key object by reading a private key file. If the private +178 key is encrypted and C{password} is not C{None}, the given password +179 will be used to decrypt the key (otherwise L{PasswordRequiredException} +180 is thrown). Through the magic of python, this factory method will +181 exist in all subclasses of PKey (such as L{RSAKey} or L{DSSKey}), but +182 is useless on the abstract PKey class. +183 +184 @param filename: name of the file to read +185 @type filename: str +186 @param password: an optional password to use to decrypt the key file, +187 if it's encrypted +188 @type password: str +189 @return: a new key object based on the given private key +190 @rtype: L{PKey} +191 +192 @raise IOError: if there was an error reading the file +193 @raise PasswordRequiredException: if the private key file is +194 encrypted, and C{password} is C{None} +195 @raise SSHException: if the key file is invalid +196 """ +197 key = cls(filename=filename, password=password) +198 return key +

199 from_private_key_file = classmethod(from_private_key_file) +200 +

201 - def from_private_key(cls, file_obj, password=None): +

202 """ +203 Create a key object by reading a private key from a file (or file-like) +204 object. If the private key is encrypted and C{password} is not C{None}, +205 the given password will be used to decrypt the key (otherwise +206 L{PasswordRequiredException} is thrown). +207 +208 @param file_obj: the file to read from +209 @type file_obj: file +210 @param password: an optional password to use to decrypt the key, if it's +211 encrypted +212 @type password: str +213 @return: a new key object based on the given private key +214 @rtype: L{PKey} +215 +216 @raise IOError: if there was an error reading the key +217 @raise PasswordRequiredException: if the private key file is encrypted, +218 and C{password} is C{None} +219 @raise SSHException: if the key file is invalid +220 """ +221 key = cls(file_obj=file_obj, password=password) +222 return key +

223 from_private_key = classmethod(from_private_key) +224 +

225 - def write_private_key_file(self, filename, password=None): +

226 """ +227 Write private key contents into a file. If the password is not +228 C{None}, the key is encrypted before writing. +229 +230 @param filename: name of the file to write +231 @type filename: str +232 @param password: an optional password to use to encrypt the key file +233 @type password: str +234 +235 @raise IOError: if there was an error writing the file +236 @raise SSHException: if the key is invalid +237 """ +238 raise Exception('Not implemented in PKey') +

239 +

240 - def write_private_key(self, file_obj, password=None): +

241 """ +242 Write private key contents into a file (or file-like) object. If the +243 password is not C{None}, the key is encrypted before writing. +244 +245 @param file_obj: the file object to write into +246 @type file_obj: file +247 @param password: an optional password to use to encrypt the key +248 @type password: str +249 +250 @raise IOError: if there was an error writing to the file +251 @raise SSHException: if the key is invalid +252 """ +253 raise Exception('Not implemented in PKey') +

254 +

255 - def _read_private_key_file(self, tag, filename, password=None): +

256 """ +257 Read an SSH2-format private key file, looking for a string of the type +258 C{"BEGIN xxx PRIVATE KEY"} for some C{xxx}, base64-decode the text we +259 find, and return it as a string. If the private key is encrypted and +260 C{password} is not C{None}, the given password will be used to decrypt +261 the key (otherwise L{PasswordRequiredException} is thrown). +262 +263 @param tag: C{"RSA"} or C{"DSA"}, the tag used to mark the data block. +264 @type tag: str +265 @param filename: name of the file to read. +266 @type filename: str +267 @param password: an optional password to use to decrypt the key file, +268 if it's encrypted. +269 @type password: str +270 @return: data blob that makes up the private key. +271 @rtype: str +272 +273 @raise IOError: if there was an error reading the file. +274 @raise PasswordRequiredException: if the private key file is +275 encrypted, and C{password} is C{None}. +276 @raise SSHException: if the key file is invalid. +277 """ +278 f = open(filename, 'r') +279 data = self._read_private_key(tag, f, password) +280 f.close() +281 return data +

282 +

283 - def _read_private_key(self, tag, f, password=None): +

284 lines = f.readlines() +285 start = 0 +286 while (start < len(lines)) and (lines[start].strip() != '-----BEGIN ' + tag + ' PRIVATE KEY-----'): +287 start += 1 +288 if start >= len(lines): +289 raise SSHException('not a valid ' + tag + ' private key file') +290 # parse any headers first +291 headers = {} +292 start += 1 +293 while start < len(lines): +294 l = lines[start].split(': ') +295 if len(l) == 1: +296 break +297 headers[l[0].lower()] = l[1].strip() +298 start += 1 +299 # find end +300 end = start +301 while (lines[end].strip() != '-----END ' + tag + ' PRIVATE KEY-----') and (end < len(lines)): +302 end += 1 +303 # if we trudged to the end of the file, just try to cope. +304 try: +305 data = base64.decodestring(''.join(lines[start:end])) +306 except base64.binascii.Error, e: +307 raise SSHException('base64 decoding error: ' + str(e)) +308 if 'proc-type' not in headers: +309 # unencryped: done +310 return data +311 # encrypted keyfile: will need a password +312 if headers['proc-type'] != '4,ENCRYPTED': +313 raise SSHException('Unknown private key structure "%s"' % headers['proc-type']) +314 try: +315 encryption_type, saltstr = headers['dek-info'].split(',') +316 except: +317 raise SSHException('Can\'t parse DEK-info in private key file') +318 if encryption_type not in self._CIPHER_TABLE: +319 raise SSHException('Unknown private key cipher "%s"' % encryption_type) +320 # if no password was passed in, raise an exception pointing out that we need one +321 if password is None: +322 raise PasswordRequiredException('Private key file is encrypted') +323 cipher = self._CIPHER_TABLE[encryption_type]['cipher'] +324 keysize = self._CIPHER_TABLE[encryption_type]['keysize'] +325 mode = self._CIPHER_TABLE[encryption_type]['mode'] +326 salt = unhexlify(saltstr) +327 key = util.generate_key_bytes(MD5, salt, password, keysize) +328 return cipher.new(key, mode, salt).decrypt(data) +

329 +

330 - def _write_private_key_file(self, tag, filename, data, password=None): +

331 """ +332 Write an SSH2-format private key file in a form that can be read by +333 paramiko or openssh. If no password is given, the key is written in +334 a trivially-encoded format (base64) which is completely insecure. If +335 a password is given, DES-EDE3-CBC is used. +336 +337 @param tag: C{"RSA"} or C{"DSA"}, the tag used to mark the data block. +338 @type tag: str +339 @param filename: name of the file to write. +340 @type filename: str +341 @param data: data blob that makes up the private key. +342 @type data: str +343 @param password: an optional password to use to encrypt the file. +344 @type password: str +345 +346 @raise IOError: if there was an error writing the file. +347 """ +348 f = open(filename, 'w', 0600) +349 # grrr... the mode doesn't always take hold +350 os.chmod(filename, 0600) +351 self._write_private_key(tag, f, data, password) +352 f.close() +

353 +

354 - def _write_private_key(self, tag, f, data, password=None): +

355 f.write('-----BEGIN %s PRIVATE KEY-----\n' % tag) +356 if password is not None: +357 # since we only support one cipher here, use it +358 cipher_name = self._CIPHER_TABLE.keys()[0] +359 cipher = self._CIPHER_TABLE[cipher_name]['cipher'] +360 keysize = self._CIPHER_TABLE[cipher_name]['keysize'] +361 blocksize = self._CIPHER_TABLE[cipher_name]['blocksize'] +362 mode = self._CIPHER_TABLE[cipher_name]['mode'] +363 salt = randpool.get_bytes(8) +364 key = util.generate_key_bytes(MD5, salt, password, keysize) +365 if len(data) % blocksize != 0: +366 n = blocksize - len(data) % blocksize +367 #data += randpool.get_bytes(n) +368 # that would make more sense ^, but it confuses openssh. +369 data += '\0' * n +370 data = cipher.new(key, mode, salt).encrypt(data) +371 f.write('Proc-Type: 4,ENCRYPTED\n') +372 f.write('DEK-Info: %s,%s\n' % (cipher_name, hexlify(salt).upper())) +373 f.write('\n') +374 s = base64.encodestring(data) +375 # re-wrap to 64-char lines +376 s = ''.join(s.split('\n')) +377 s = '\n'.join([s[i : i+64] for i in range(0, len(s), 64)]) +378 f.write(s) +379 f.write('\n') +380 f.write('-----END %s PRIVATE KEY-----\n' % tag) +

Source Code for Module paramiko.pkey