Source Code for Module paramiko.dsskey

  1  # Copyright (C) 2003-2007  Robey Pointer <robeypointer@gmail.com> 
  2  # 
  3  # This file is part of paramiko. 
  4  # 
  5  # Paramiko is free software; you can redistribute it and/or modify it under the 
  6  # terms of the GNU Lesser General Public License as published by the Free 
  7  # Software Foundation; either version 2.1 of the License, or (at your option) 
  8  # any later version. 
  9  # 
 10  # Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY 
 11  # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR 
 12  # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more 
 13  # details. 
 14  # 
 15  # You should have received a copy of the GNU Lesser General Public License 
 16  # along with Paramiko; if not, write to the Free Software Foundation, Inc., 
 17  # 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA. 
 18   
 19  """ 
 20  L{DSSKey} 
 21  """ 
 22   
 23  from Crypto.PublicKey import DSA 
 24  from Crypto.Hash import SHA 
 25   
 26  from paramiko.common import * 
 27  from paramiko import util 
 28  from paramiko.ssh_exception import SSHException 
 29  from paramiko.message import Message 
 30  from paramiko.ber import BER, BERException 
 31  from paramiko.pkey import PKey 
 32   
 33   
 34 -class DSSKey (PKey): 
 35      """ 
 36      Representation of a DSS key which can be used to sign an verify SSH2 
 37      data. 
 38      """ 
 39   
 40 -    def __init__(self, msg=None, data=None, filename=None, password=None, vals=None, file_obj=None): 
 41          self.p = None 
 42          self.q = None 
 43          self.g = None 
 44          self.y = None 
 45          self.x = None 
 46          if file_obj is not None: 
 47              self._from_private_key(file_obj, password) 
 48              return 
 49          if filename is not None: 
 50              self._from_private_key_file(filename, password) 
 51              return 
 52          if (msg is None) and (data is not None): 
 53              msg = Message(data) 
 54          if vals is not None: 
 55              self.p, self.q, self.g, self.y = vals 
 56          else: 
 57              if msg is None: 
 58                  raise SSHException('Key object may not be empty') 
 59              if msg.get_string() != 'ssh-dss': 
 60                  raise SSHException('Invalid key') 
 61              self.p = msg.get_mpint() 
 62              self.q = msg.get_mpint() 
 63              self.g = msg.get_mpint() 
 64              self.y = msg.get_mpint() 
 65          self.size = util.bit_length(self.p) 
 66   
 67 -    def __str__(self): 
 68          m = Message() 
 69          m.add_string('ssh-dss') 
 70          m.add_mpint(self.p) 
 71          m.add_mpint(self.q) 
 72          m.add_mpint(self.g) 
 73          m.add_mpint(self.y) 
 74          return str(m) 
 75   
 76 -    def __hash__(self): 
 77          h = hash(self.get_name()) 
 78          h = h * 37 + hash(self.p) 
 79          h = h * 37 + hash(self.q) 
 80          h = h * 37 + hash(self.g) 
 81          h = h * 37 + hash(self.y) 
 82          # h might be a long by now... 
 83          return hash(h) 
 84   
 85 -    def get_name(self): 
 86          return 'ssh-dss' 
 87   
 88 -    def get_bits(self): 
 89          return self.size 
 90           
 91 -    def can_sign(self): 
 92          return self.x is not None 
 93   
 94 -    def sign_ssh_data(self, rpool, data): 
 95          digest = SHA.new(data).digest() 
 96          dss = DSA.construct((long(self.y), long(self.g), long(self.p), long(self.q), long(self.x))) 
 97          # generate a suitable k 
 98          qsize = len(util.deflate_long(self.q, 0)) 
 99          while True: 
100              k = util.inflate_long(rpool.get_bytes(qsize), 1) 
101              if (k > 2) and (k < self.q): 
102                  break 
103          r, s = dss.sign(util.inflate_long(digest, 1), k) 
104          m = Message() 
105          m.add_string('ssh-dss') 
106          # apparently, in rare cases, r or s may be shorter than 20 bytes! 
107          rstr = util.deflate_long(r, 0) 
108          sstr = util.deflate_long(s, 0) 
109          if len(rstr) < 20: 
110              rstr = '\x00' * (20 - len(rstr)) + rstr 
111          if len(sstr) < 20: 
112              sstr = '\x00' * (20 - len(sstr)) + sstr 
113          m.add_string(rstr + sstr) 
114          return m 
115   
116 -    def verify_ssh_sig(self, data, msg): 
117          if len(str(msg)) == 40: 
118              # spies.com bug: signature has no header 
119              sig = str(msg) 
120          else: 
121              kind = msg.get_string() 
122              if kind != 'ssh-dss': 
123                  return 0 
124              sig = msg.get_string() 
125   
126          # pull out (r, s) which are NOT encoded as mpints 
127          sigR = util.inflate_long(sig[:20], 1) 
128          sigS = util.inflate_long(sig[20:], 1) 
129          sigM = util.inflate_long(SHA.new(data).digest(), 1) 
130   
131          dss = DSA.construct((long(self.y), long(self.g), long(self.p), long(self.q))) 
132          return dss.verify(sigM, (sigR, sigS)) 
133   
134 -    def _encode_key(self): 
135          if self.x is None: 
136              raise SSHException('Not enough key information') 
137          keylist = [ 0, self.p, self.q, self.g, self.y, self.x ] 
138          try: 
139              b = BER() 
140              b.encode(keylist) 
141          except BERException: 
142              raise SSHException('Unable to create ber encoding of key') 
143          return str(b) 
144   
145 -    def write_private_key_file(self, filename, password=None): 
146          self._write_private_key_file('DSA', filename, self._encode_key(), password) 
147   
148 -    def write_private_key(self, file_obj, password=None): 
149          self._write_private_key('DSA', file_obj, self._encode_key(), password) 
150   
151 -    def generate(bits=1024, progress_func=None): 
152          """ 
153          Generate a new private DSS key.  This factory function can be used to 
154          generate a new host key or authentication key. 
155   
156          @param bits: number of bits the generated key should be. 
157          @type bits: int 
158          @param progress_func: an optional function to call at key points in 
159              key generation (used by C{pyCrypto.PublicKey}). 
160          @type progress_func: function 
161          @return: new private key 
162          @rtype: L{DSSKey} 
163          """ 
164          randpool.stir() 
165          dsa = DSA.generate(bits, randpool.get_bytes, progress_func) 
166          key = DSSKey(vals=(dsa.p, dsa.q, dsa.g, dsa.y)) 
167          key.x = dsa.x 
168          return key 
169      generate = staticmethod(generate) 
170   
171   
172      ###  internals... 
173   
174   
175 -    def _from_private_key_file(self, filename, password): 
176          data = self._read_private_key_file('DSA', filename, password) 
177          self._decode_key(data) 
178       
179 -    def _from_private_key(self, file_obj, password): 
180          data = self._read_private_key('DSA', file_obj, password) 
181          self._decode_key(data) 
182       
183 -    def _decode_key(self, data): 
184          # private key file contains: 
185          # DSAPrivateKey = { version = 0, p, q, g, y, x } 
186          try: 
187              keylist = BER(data).decode() 
188          except BERException, x: 
189              raise SSHException('Unable to parse key file: ' + str(x)) 
190          if (type(keylist) is not list) or (len(keylist) < 6) or (keylist[0] != 0): 
191              raise SSHException('not a valid DSA private key file (bad ber encoding)') 
192          self.p = keylist[1] 
193          self.q = keylist[2] 
194          self.g = keylist[3] 
195          self.y = keylist[4] 
196          self.x = keylist[5] 
197          self.size = util.bit_length(self.p) 
198