moving to scripts

asq-env/lib/python3.9/site-packages/cryptography/hazmat/__init__.py

@@ -0,0 +1,10 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+"""
+Hazardous Materials
+
+This is a "Hazardous Materials" module. You should ONLY use it if you're
+100% absolutely sure that you know what you're doing because this module
+is full of land mines, dragons, and dinosaurs with laser guns.
+"""

asq-env/lib/python3.9/site-packages/cryptography/hazmat/_oid.py

@@ -0,0 +1,339 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+import typing
+
+from cryptography.hazmat.primitives import hashes
+
+
+class ObjectIdentifier(object):
+    def __init__(self, dotted_string: str) -> None:
+        self._dotted_string = dotted_string
+
+        nodes = self._dotted_string.split(".")
+        intnodes = []
+
+        # There must be at least 2 nodes, the first node must be 0..2, and
+        # if less than 2, the second node cannot have a value outside the
+        # range 0..39.  All nodes must be integers.
+        for node in nodes:
+            try:
+                node_value = int(node, 10)
+            except ValueError:
+                raise ValueError(
+                    "Malformed OID: %s (non-integer nodes)"
+                    % (self._dotted_string)
+                )
+            if node_value < 0:
+                raise ValueError(
+                    "Malformed OID: %s (negative-integer nodes)"
+                    % (self._dotted_string)
+                )
+            intnodes.append(node_value)
+
+        if len(nodes) < 2:
+            raise ValueError(
+                "Malformed OID: %s (insufficient number of nodes)"
+                % (self._dotted_string)
+            )
+
+        if intnodes[0] > 2:
+            raise ValueError(
+                "Malformed OID: %s (first node outside valid range)"
+                % (self._dotted_string)
+            )
+
+        if intnodes[0] < 2 and intnodes[1] >= 40:
+            raise ValueError(
+                "Malformed OID: %s (second node outside valid range)"
+                % (self._dotted_string)
+            )
+
+    def __eq__(self, other: typing.Any) -> bool:
+        if not isinstance(other, ObjectIdentifier):
+            return NotImplemented
+
+        return self.dotted_string == other.dotted_string
+
+    def __ne__(self, other: typing.Any) -> bool:
+        return not self == other
+
+    def __repr__(self) -> str:
+        return "<ObjectIdentifier(oid={}, name={})>".format(
+            self.dotted_string, self._name
+        )
+
+    def __hash__(self) -> int:
+        return hash(self.dotted_string)
+
+    @property
+    def _name(self) -> str:
+        return _OID_NAMES.get(self, "Unknown OID")
+
+    @property
+    def dotted_string(self) -> str:
+        return self._dotted_string
+
+
+class ExtensionOID(object):
+    SUBJECT_DIRECTORY_ATTRIBUTES = ObjectIdentifier("2.5.29.9")
+    SUBJECT_KEY_IDENTIFIER = ObjectIdentifier("2.5.29.14")
+    KEY_USAGE = ObjectIdentifier("2.5.29.15")
+    SUBJECT_ALTERNATIVE_NAME = ObjectIdentifier("2.5.29.17")
+    ISSUER_ALTERNATIVE_NAME = ObjectIdentifier("2.5.29.18")
+    BASIC_CONSTRAINTS = ObjectIdentifier("2.5.29.19")
+    NAME_CONSTRAINTS = ObjectIdentifier("2.5.29.30")
+    CRL_DISTRIBUTION_POINTS = ObjectIdentifier("2.5.29.31")
+    CERTIFICATE_POLICIES = ObjectIdentifier("2.5.29.32")
+    POLICY_MAPPINGS = ObjectIdentifier("2.5.29.33")
+    AUTHORITY_KEY_IDENTIFIER = ObjectIdentifier("2.5.29.35")
+    POLICY_CONSTRAINTS = ObjectIdentifier("2.5.29.36")
+    EXTENDED_KEY_USAGE = ObjectIdentifier("2.5.29.37")
+    FRESHEST_CRL = ObjectIdentifier("2.5.29.46")
+    INHIBIT_ANY_POLICY = ObjectIdentifier("2.5.29.54")
+    ISSUING_DISTRIBUTION_POINT = ObjectIdentifier("2.5.29.28")
+    AUTHORITY_INFORMATION_ACCESS = ObjectIdentifier("1.3.6.1.5.5.7.1.1")
+    SUBJECT_INFORMATION_ACCESS = ObjectIdentifier("1.3.6.1.5.5.7.1.11")
+    OCSP_NO_CHECK = ObjectIdentifier("1.3.6.1.5.5.7.48.1.5")
+    TLS_FEATURE = ObjectIdentifier("1.3.6.1.5.5.7.1.24")
+    CRL_NUMBER = ObjectIdentifier("2.5.29.20")
+    DELTA_CRL_INDICATOR = ObjectIdentifier("2.5.29.27")
+    PRECERT_SIGNED_CERTIFICATE_TIMESTAMPS = ObjectIdentifier(
+        "1.3.6.1.4.1.11129.2.4.2"
+    )
+    PRECERT_POISON = ObjectIdentifier("1.3.6.1.4.1.11129.2.4.3")
+    SIGNED_CERTIFICATE_TIMESTAMPS = ObjectIdentifier("1.3.6.1.4.1.11129.2.4.5")
+
+
+class OCSPExtensionOID(object):
+    NONCE = ObjectIdentifier("1.3.6.1.5.5.7.48.1.2")
+
+
+class CRLEntryExtensionOID(object):
+    CERTIFICATE_ISSUER = ObjectIdentifier("2.5.29.29")
+    CRL_REASON = ObjectIdentifier("2.5.29.21")
+    INVALIDITY_DATE = ObjectIdentifier("2.5.29.24")
+
+
+class NameOID(object):
+    COMMON_NAME = ObjectIdentifier("2.5.4.3")
+    COUNTRY_NAME = ObjectIdentifier("2.5.4.6")
+    LOCALITY_NAME = ObjectIdentifier("2.5.4.7")
+    STATE_OR_PROVINCE_NAME = ObjectIdentifier("2.5.4.8")
+    STREET_ADDRESS = ObjectIdentifier("2.5.4.9")
+    ORGANIZATION_NAME = ObjectIdentifier("2.5.4.10")
+    ORGANIZATIONAL_UNIT_NAME = ObjectIdentifier("2.5.4.11")
+    SERIAL_NUMBER = ObjectIdentifier("2.5.4.5")
+    SURNAME = ObjectIdentifier("2.5.4.4")
+    GIVEN_NAME = ObjectIdentifier("2.5.4.42")
+    TITLE = ObjectIdentifier("2.5.4.12")
+    GENERATION_QUALIFIER = ObjectIdentifier("2.5.4.44")
+    X500_UNIQUE_IDENTIFIER = ObjectIdentifier("2.5.4.45")
+    DN_QUALIFIER = ObjectIdentifier("2.5.4.46")
+    PSEUDONYM = ObjectIdentifier("2.5.4.65")
+    USER_ID = ObjectIdentifier("0.9.2342.19200300.100.1.1")
+    DOMAIN_COMPONENT = ObjectIdentifier("0.9.2342.19200300.100.1.25")
+    EMAIL_ADDRESS = ObjectIdentifier("1.2.840.113549.1.9.1")
+    JURISDICTION_COUNTRY_NAME = ObjectIdentifier("1.3.6.1.4.1.311.60.2.1.3")
+    JURISDICTION_LOCALITY_NAME = ObjectIdentifier("1.3.6.1.4.1.311.60.2.1.1")
+    JURISDICTION_STATE_OR_PROVINCE_NAME = ObjectIdentifier(
+        "1.3.6.1.4.1.311.60.2.1.2"
+    )
+    BUSINESS_CATEGORY = ObjectIdentifier("2.5.4.15")
+    POSTAL_ADDRESS = ObjectIdentifier("2.5.4.16")
+    POSTAL_CODE = ObjectIdentifier("2.5.4.17")
+    INN = ObjectIdentifier("1.2.643.3.131.1.1")
+    OGRN = ObjectIdentifier("1.2.643.100.1")
+    SNILS = ObjectIdentifier("1.2.643.100.3")
+    UNSTRUCTURED_NAME = ObjectIdentifier("1.2.840.113549.1.9.2")
+
+
+class SignatureAlgorithmOID(object):
+    RSA_WITH_MD5 = ObjectIdentifier("1.2.840.113549.1.1.4")
+    RSA_WITH_SHA1 = ObjectIdentifier("1.2.840.113549.1.1.5")
+    # This is an alternate OID for RSA with SHA1 that is occasionally seen
+    _RSA_WITH_SHA1 = ObjectIdentifier("1.3.14.3.2.29")
+    RSA_WITH_SHA224 = ObjectIdentifier("1.2.840.113549.1.1.14")
+    RSA_WITH_SHA256 = ObjectIdentifier("1.2.840.113549.1.1.11")
+    RSA_WITH_SHA384 = ObjectIdentifier("1.2.840.113549.1.1.12")
+    RSA_WITH_SHA512 = ObjectIdentifier("1.2.840.113549.1.1.13")
+    RSASSA_PSS = ObjectIdentifier("1.2.840.113549.1.1.10")
+    ECDSA_WITH_SHA1 = ObjectIdentifier("1.2.840.10045.4.1")
+    ECDSA_WITH_SHA224 = ObjectIdentifier("1.2.840.10045.4.3.1")
+    ECDSA_WITH_SHA256 = ObjectIdentifier("1.2.840.10045.4.3.2")
+    ECDSA_WITH_SHA384 = ObjectIdentifier("1.2.840.10045.4.3.3")
+    ECDSA_WITH_SHA512 = ObjectIdentifier("1.2.840.10045.4.3.4")
+    DSA_WITH_SHA1 = ObjectIdentifier("1.2.840.10040.4.3")
+    DSA_WITH_SHA224 = ObjectIdentifier("2.16.840.1.101.3.4.3.1")
+    DSA_WITH_SHA256 = ObjectIdentifier("2.16.840.1.101.3.4.3.2")
+    ED25519 = ObjectIdentifier("1.3.101.112")
+    ED448 = ObjectIdentifier("1.3.101.113")
+    GOSTR3411_94_WITH_3410_2001 = ObjectIdentifier("1.2.643.2.2.3")
+    GOSTR3410_2012_WITH_3411_2012_256 = ObjectIdentifier("1.2.643.7.1.1.3.2")
+    GOSTR3410_2012_WITH_3411_2012_512 = ObjectIdentifier("1.2.643.7.1.1.3.3")
+
+
+_SIG_OIDS_TO_HASH: typing.Dict[
+    ObjectIdentifier, typing.Optional[hashes.HashAlgorithm]
+] = {
+    SignatureAlgorithmOID.RSA_WITH_MD5: hashes.MD5(),
+    SignatureAlgorithmOID.RSA_WITH_SHA1: hashes.SHA1(),
+    SignatureAlgorithmOID._RSA_WITH_SHA1: hashes.SHA1(),
+    SignatureAlgorithmOID.RSA_WITH_SHA224: hashes.SHA224(),
+    SignatureAlgorithmOID.RSA_WITH_SHA256: hashes.SHA256(),
+    SignatureAlgorithmOID.RSA_WITH_SHA384: hashes.SHA384(),
+    SignatureAlgorithmOID.RSA_WITH_SHA512: hashes.SHA512(),
+    SignatureAlgorithmOID.ECDSA_WITH_SHA1: hashes.SHA1(),
+    SignatureAlgorithmOID.ECDSA_WITH_SHA224: hashes.SHA224(),
+    SignatureAlgorithmOID.ECDSA_WITH_SHA256: hashes.SHA256(),
+    SignatureAlgorithmOID.ECDSA_WITH_SHA384: hashes.SHA384(),
+    SignatureAlgorithmOID.ECDSA_WITH_SHA512: hashes.SHA512(),
+    SignatureAlgorithmOID.DSA_WITH_SHA1: hashes.SHA1(),
+    SignatureAlgorithmOID.DSA_WITH_SHA224: hashes.SHA224(),
+    SignatureAlgorithmOID.DSA_WITH_SHA256: hashes.SHA256(),
+    SignatureAlgorithmOID.ED25519: None,
+    SignatureAlgorithmOID.ED448: None,
+    SignatureAlgorithmOID.GOSTR3411_94_WITH_3410_2001: None,
+    SignatureAlgorithmOID.GOSTR3410_2012_WITH_3411_2012_256: None,
+    SignatureAlgorithmOID.GOSTR3410_2012_WITH_3411_2012_512: None,
+}
+
+
+class ExtendedKeyUsageOID(object):
+    SERVER_AUTH = ObjectIdentifier("1.3.6.1.5.5.7.3.1")
+    CLIENT_AUTH = ObjectIdentifier("1.3.6.1.5.5.7.3.2")
+    CODE_SIGNING = ObjectIdentifier("1.3.6.1.5.5.7.3.3")
+    EMAIL_PROTECTION = ObjectIdentifier("1.3.6.1.5.5.7.3.4")
+    TIME_STAMPING = ObjectIdentifier("1.3.6.1.5.5.7.3.8")
+    OCSP_SIGNING = ObjectIdentifier("1.3.6.1.5.5.7.3.9")
+    ANY_EXTENDED_KEY_USAGE = ObjectIdentifier("2.5.29.37.0")
+    SMARTCARD_LOGON = ObjectIdentifier("1.3.6.1.4.1.311.20.2.2")
+    KERBEROS_PKINIT_KDC = ObjectIdentifier("1.3.6.1.5.2.3.5")
+
+
+class AuthorityInformationAccessOID(object):
+    CA_ISSUERS = ObjectIdentifier("1.3.6.1.5.5.7.48.2")
+    OCSP = ObjectIdentifier("1.3.6.1.5.5.7.48.1")
+
+
+class SubjectInformationAccessOID(object):
+    CA_REPOSITORY = ObjectIdentifier("1.3.6.1.5.5.7.48.5")
+
+
+class CertificatePoliciesOID(object):
+    CPS_QUALIFIER = ObjectIdentifier("1.3.6.1.5.5.7.2.1")
+    CPS_USER_NOTICE = ObjectIdentifier("1.3.6.1.5.5.7.2.2")
+    ANY_POLICY = ObjectIdentifier("2.5.29.32.0")
+
+
+class AttributeOID(object):
+    CHALLENGE_PASSWORD = ObjectIdentifier("1.2.840.113549.1.9.7")
+    UNSTRUCTURED_NAME = ObjectIdentifier("1.2.840.113549.1.9.2")
+
+
+_OID_NAMES = {
+    NameOID.COMMON_NAME: "commonName",
+    NameOID.COUNTRY_NAME: "countryName",
+    NameOID.LOCALITY_NAME: "localityName",
+    NameOID.STATE_OR_PROVINCE_NAME: "stateOrProvinceName",
+    NameOID.STREET_ADDRESS: "streetAddress",
+    NameOID.ORGANIZATION_NAME: "organizationName",
+    NameOID.ORGANIZATIONAL_UNIT_NAME: "organizationalUnitName",
+    NameOID.SERIAL_NUMBER: "serialNumber",
+    NameOID.SURNAME: "surname",
+    NameOID.GIVEN_NAME: "givenName",
+    NameOID.TITLE: "title",
+    NameOID.GENERATION_QUALIFIER: "generationQualifier",
+    NameOID.X500_UNIQUE_IDENTIFIER: "x500UniqueIdentifier",
+    NameOID.DN_QUALIFIER: "dnQualifier",
+    NameOID.PSEUDONYM: "pseudonym",
+    NameOID.USER_ID: "userID",
+    NameOID.DOMAIN_COMPONENT: "domainComponent",
+    NameOID.EMAIL_ADDRESS: "emailAddress",
+    NameOID.JURISDICTION_COUNTRY_NAME: "jurisdictionCountryName",
+    NameOID.JURISDICTION_LOCALITY_NAME: "jurisdictionLocalityName",
+    NameOID.JURISDICTION_STATE_OR_PROVINCE_NAME: (
+        "jurisdictionStateOrProvinceName"
+    ),
+    NameOID.BUSINESS_CATEGORY: "businessCategory",
+    NameOID.POSTAL_ADDRESS: "postalAddress",
+    NameOID.POSTAL_CODE: "postalCode",
+    NameOID.INN: "INN",
+    NameOID.OGRN: "OGRN",
+    NameOID.SNILS: "SNILS",
+    NameOID.UNSTRUCTURED_NAME: "unstructuredName",
+    SignatureAlgorithmOID.RSA_WITH_MD5: "md5WithRSAEncryption",
+    SignatureAlgorithmOID.RSA_WITH_SHA1: "sha1WithRSAEncryption",
+    SignatureAlgorithmOID.RSA_WITH_SHA224: "sha224WithRSAEncryption",
+    SignatureAlgorithmOID.RSA_WITH_SHA256: "sha256WithRSAEncryption",
+    SignatureAlgorithmOID.RSA_WITH_SHA384: "sha384WithRSAEncryption",
+    SignatureAlgorithmOID.RSA_WITH_SHA512: "sha512WithRSAEncryption",
+    SignatureAlgorithmOID.RSASSA_PSS: "RSASSA-PSS",
+    SignatureAlgorithmOID.ECDSA_WITH_SHA1: "ecdsa-with-SHA1",
+    SignatureAlgorithmOID.ECDSA_WITH_SHA224: "ecdsa-with-SHA224",
+    SignatureAlgorithmOID.ECDSA_WITH_SHA256: "ecdsa-with-SHA256",
+    SignatureAlgorithmOID.ECDSA_WITH_SHA384: "ecdsa-with-SHA384",
+    SignatureAlgorithmOID.ECDSA_WITH_SHA512: "ecdsa-with-SHA512",
+    SignatureAlgorithmOID.DSA_WITH_SHA1: "dsa-with-sha1",
+    SignatureAlgorithmOID.DSA_WITH_SHA224: "dsa-with-sha224",
+    SignatureAlgorithmOID.DSA_WITH_SHA256: "dsa-with-sha256",
+    SignatureAlgorithmOID.ED25519: "ed25519",
+    SignatureAlgorithmOID.ED448: "ed448",
+    SignatureAlgorithmOID.GOSTR3411_94_WITH_3410_2001: (
+        "GOST R 34.11-94 with GOST R 34.10-2001"
+    ),
+    SignatureAlgorithmOID.GOSTR3410_2012_WITH_3411_2012_256: (
+        "GOST R 34.10-2012 with GOST R 34.11-2012 (256 bit)"
+    ),
+    SignatureAlgorithmOID.GOSTR3410_2012_WITH_3411_2012_512: (
+        "GOST R 34.10-2012 with GOST R 34.11-2012 (512 bit)"
+    ),
+    ExtendedKeyUsageOID.SERVER_AUTH: "serverAuth",
+    ExtendedKeyUsageOID.CLIENT_AUTH: "clientAuth",
+    ExtendedKeyUsageOID.CODE_SIGNING: "codeSigning",
+    ExtendedKeyUsageOID.EMAIL_PROTECTION: "emailProtection",
+    ExtendedKeyUsageOID.TIME_STAMPING: "timeStamping",
+    ExtendedKeyUsageOID.OCSP_SIGNING: "OCSPSigning",
+    ExtendedKeyUsageOID.SMARTCARD_LOGON: "msSmartcardLogin",
+    ExtendedKeyUsageOID.KERBEROS_PKINIT_KDC: "pkInitKDC",
+    ExtensionOID.SUBJECT_DIRECTORY_ATTRIBUTES: "subjectDirectoryAttributes",
+    ExtensionOID.SUBJECT_KEY_IDENTIFIER: "subjectKeyIdentifier",
+    ExtensionOID.KEY_USAGE: "keyUsage",
+    ExtensionOID.SUBJECT_ALTERNATIVE_NAME: "subjectAltName",
+    ExtensionOID.ISSUER_ALTERNATIVE_NAME: "issuerAltName",
+    ExtensionOID.BASIC_CONSTRAINTS: "basicConstraints",
+    ExtensionOID.PRECERT_SIGNED_CERTIFICATE_TIMESTAMPS: (
+        "signedCertificateTimestampList"
+    ),
+    ExtensionOID.SIGNED_CERTIFICATE_TIMESTAMPS: (
+        "signedCertificateTimestampList"
+    ),
+    ExtensionOID.PRECERT_POISON: "ctPoison",
+    CRLEntryExtensionOID.CRL_REASON: "cRLReason",
+    CRLEntryExtensionOID.INVALIDITY_DATE: "invalidityDate",
+    CRLEntryExtensionOID.CERTIFICATE_ISSUER: "certificateIssuer",
+    ExtensionOID.NAME_CONSTRAINTS: "nameConstraints",
+    ExtensionOID.CRL_DISTRIBUTION_POINTS: "cRLDistributionPoints",
+    ExtensionOID.CERTIFICATE_POLICIES: "certificatePolicies",
+    ExtensionOID.POLICY_MAPPINGS: "policyMappings",
+    ExtensionOID.AUTHORITY_KEY_IDENTIFIER: "authorityKeyIdentifier",
+    ExtensionOID.POLICY_CONSTRAINTS: "policyConstraints",
+    ExtensionOID.EXTENDED_KEY_USAGE: "extendedKeyUsage",
+    ExtensionOID.FRESHEST_CRL: "freshestCRL",
+    ExtensionOID.INHIBIT_ANY_POLICY: "inhibitAnyPolicy",
+    ExtensionOID.ISSUING_DISTRIBUTION_POINT: ("issuingDistributionPoint"),
+    ExtensionOID.AUTHORITY_INFORMATION_ACCESS: "authorityInfoAccess",
+    ExtensionOID.SUBJECT_INFORMATION_ACCESS: "subjectInfoAccess",
+    ExtensionOID.OCSP_NO_CHECK: "OCSPNoCheck",
+    ExtensionOID.CRL_NUMBER: "cRLNumber",
+    ExtensionOID.DELTA_CRL_INDICATOR: "deltaCRLIndicator",
+    ExtensionOID.TLS_FEATURE: "TLSFeature",
+    AuthorityInformationAccessOID.OCSP: "OCSP",
+    AuthorityInformationAccessOID.CA_ISSUERS: "caIssuers",
+    SubjectInformationAccessOID.CA_REPOSITORY: "caRepository",
+    CertificatePoliciesOID.CPS_QUALIFIER: "id-qt-cps",
+    CertificatePoliciesOID.CPS_USER_NOTICE: "id-qt-unotice",
+    OCSPExtensionOID.NONCE: "OCSPNonce",
+    AttributeOID.CHALLENGE_PASSWORD: "challengePassword",
+}

asq-env/lib/python3.9/site-packages/cryptography/hazmat/backends/__init__.py

@@ -0,0 +1,27 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+import typing
+
+from cryptography.hazmat.backends.interfaces import Backend
+
+_default_backend: typing.Optional[Backend] = None
+
+
+def default_backend() -> Backend:
+    global _default_backend
+
+    if _default_backend is None:
+        from cryptography.hazmat.backends.openssl.backend import backend
+
+        _default_backend = backend
+
+    return _default_backend
+
+
+def _get_backend(backend: typing.Optional[Backend]) -> Backend:
+    if backend is None:
+        return default_backend()
+    else:
+        return backend

asq-env/lib/python3.9/site-packages/cryptography/hazmat/backends/interfaces.py

@@ -0,0 +1,449 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+import abc
+import typing
+
+
+if typing.TYPE_CHECKING:
+    from cryptography.hazmat.primitives.asymmetric.types import (
+        PRIVATE_KEY_TYPES,
+    )
+    from cryptography.hazmat.primitives import hashes
+    from cryptography.x509.base import (
+        Certificate,
+        CertificateBuilder,
+        CertificateRevocationList,
+        CertificateRevocationListBuilder,
+        CertificateSigningRequest,
+        CertificateSigningRequestBuilder,
+        RevokedCertificate,
+        RevokedCertificateBuilder,
+    )
+    from cryptography.x509.name import Name
+
+
+class CipherBackend(metaclass=abc.ABCMeta):
+    @abc.abstractmethod
+    def cipher_supported(self, cipher, mode):
+        """
+        Return True if the given cipher and mode are supported.
+        """
+
+    @abc.abstractmethod
+    def create_symmetric_encryption_ctx(self, cipher, mode):
+        """
+        Get a CipherContext that can be used for encryption.
+        """
+
+    @abc.abstractmethod
+    def create_symmetric_decryption_ctx(self, cipher, mode):
+        """
+        Get a CipherContext that can be used for decryption.
+        """
+
+
+class HashBackend(metaclass=abc.ABCMeta):
+    @abc.abstractmethod
+    def hash_supported(self, algorithm):
+        """
+        Return True if the hash algorithm is supported by this backend.
+        """
+
+    @abc.abstractmethod
+    def create_hash_ctx(self, algorithm):
+        """
+        Create a HashContext for calculating a message digest.
+        """
+
+
+class HMACBackend(metaclass=abc.ABCMeta):
+    @abc.abstractmethod
+    def hmac_supported(self, algorithm):
+        """
+        Return True if the hash algorithm is supported for HMAC by this
+        backend.
+        """
+
+    @abc.abstractmethod
+    def create_hmac_ctx(self, key, algorithm):
+        """
+        Create a context for calculating a message authentication code.
+        """
+
+
+class CMACBackend(metaclass=abc.ABCMeta):
+    @abc.abstractmethod
+    def cmac_algorithm_supported(self, algorithm):
+        """
+        Returns True if the block cipher is supported for CMAC by this backend
+        """
+
+    @abc.abstractmethod
+    def create_cmac_ctx(self, algorithm):
+        """
+        Create a context for calculating a message authentication code.
+        """
+
+
+class PBKDF2HMACBackend(metaclass=abc.ABCMeta):
+    @abc.abstractmethod
+    def pbkdf2_hmac_supported(self, algorithm):
+        """
+        Return True if the hash algorithm is supported for PBKDF2 by this
+        backend.
+        """
+
+    @abc.abstractmethod
+    def derive_pbkdf2_hmac(
+        self, algorithm, length, salt, iterations, key_material
+    ):
+        """
+        Return length bytes derived from provided PBKDF2 parameters.
+        """
+
+
+class RSABackend(metaclass=abc.ABCMeta):
+    @abc.abstractmethod
+    def generate_rsa_private_key(self, public_exponent, key_size):
+        """
+        Generate an RSAPrivateKey instance with public_exponent and a modulus
+        of key_size bits.
+        """
+
+    @abc.abstractmethod
+    def rsa_padding_supported(self, padding):
+        """
+        Returns True if the backend supports the given padding options.
+        """
+
+    @abc.abstractmethod
+    def generate_rsa_parameters_supported(self, public_exponent, key_size):
+        """
+        Returns True if the backend supports the given parameters for key
+        generation.
+        """
+
+    @abc.abstractmethod
+    def load_rsa_private_numbers(self, numbers):
+        """
+        Returns an RSAPrivateKey provider.
+        """
+
+    @abc.abstractmethod
+    def load_rsa_public_numbers(self, numbers):
+        """
+        Returns an RSAPublicKey provider.
+        """
+
+
+class DSABackend(metaclass=abc.ABCMeta):
+    @abc.abstractmethod
+    def generate_dsa_parameters(self, key_size):
+        """
+        Generate a DSAParameters instance with a modulus of key_size bits.
+        """
+
+    @abc.abstractmethod
+    def generate_dsa_private_key(self, parameters):
+        """
+        Generate a DSAPrivateKey instance with parameters as a DSAParameters
+        object.
+        """
+
+    @abc.abstractmethod
+    def generate_dsa_private_key_and_parameters(self, key_size):
+        """
+        Generate a DSAPrivateKey instance using key size only.
+        """
+
+    @abc.abstractmethod
+    def dsa_hash_supported(self, algorithm):
+        """
+        Return True if the hash algorithm is supported by the backend for DSA.
+        """
+
+    @abc.abstractmethod
+    def dsa_parameters_supported(self, p, q, g):
+        """
+        Return True if the parameters are supported by the backend for DSA.
+        """
+
+    @abc.abstractmethod
+    def load_dsa_private_numbers(self, numbers):
+        """
+        Returns a DSAPrivateKey provider.
+        """
+
+    @abc.abstractmethod
+    def load_dsa_public_numbers(self, numbers):
+        """
+        Returns a DSAPublicKey provider.
+        """
+
+    @abc.abstractmethod
+    def load_dsa_parameter_numbers(self, numbers):
+        """
+        Returns a DSAParameters provider.
+        """
+
+
+class EllipticCurveBackend(metaclass=abc.ABCMeta):
+    @abc.abstractmethod
+    def elliptic_curve_signature_algorithm_supported(
+        self, signature_algorithm, curve
+    ):
+        """
+        Returns True if the backend supports the named elliptic curve with the
+        specified signature algorithm.
+        """
+
+    @abc.abstractmethod
+    def elliptic_curve_supported(self, curve):
+        """
+        Returns True if the backend supports the named elliptic curve.
+        """
+
+    @abc.abstractmethod
+    def generate_elliptic_curve_private_key(self, curve):
+        """
+        Return an object conforming to the EllipticCurvePrivateKey interface.
+        """
+
+    @abc.abstractmethod
+    def load_elliptic_curve_public_numbers(self, numbers):
+        """
+        Return an EllipticCurvePublicKey provider using the given numbers.
+        """
+
+    @abc.abstractmethod
+    def load_elliptic_curve_private_numbers(self, numbers):
+        """
+        Return an EllipticCurvePrivateKey provider using the given numbers.
+        """
+
+    @abc.abstractmethod
+    def elliptic_curve_exchange_algorithm_supported(self, algorithm, curve):
+        """
+        Returns whether the exchange algorithm is supported by this backend.
+        """
+
+    @abc.abstractmethod
+    def derive_elliptic_curve_private_key(self, private_value, curve):
+        """
+        Compute the private key given the private value and curve.
+        """
+
+
+class PEMSerializationBackend(metaclass=abc.ABCMeta):
+    @abc.abstractmethod
+    def load_pem_private_key(self, data, password):
+        """
+        Loads a private key from PEM encoded data, using the provided password
+        if the data is encrypted.
+        """
+
+    @abc.abstractmethod
+    def load_pem_public_key(self, data):
+        """
+        Loads a public key from PEM encoded data.
+        """
+
+    @abc.abstractmethod
+    def load_pem_parameters(self, data):
+        """
+        Load encryption parameters from PEM encoded data.
+        """
+
+
+class DERSerializationBackend(metaclass=abc.ABCMeta):
+    @abc.abstractmethod
+    def load_der_private_key(self, data, password):
+        """
+        Loads a private key from DER encoded data. Uses the provided password
+        if the data is encrypted.
+        """
+
+    @abc.abstractmethod
+    def load_der_public_key(self, data):
+        """
+        Loads a public key from DER encoded data.
+        """
+
+    @abc.abstractmethod
+    def load_der_parameters(self, data):
+        """
+        Load encryption parameters from DER encoded data.
+        """
+
+
+class X509Backend(metaclass=abc.ABCMeta):
+    @abc.abstractmethod
+    def create_x509_csr(
+        self,
+        builder: "CertificateSigningRequestBuilder",
+        private_key: "PRIVATE_KEY_TYPES",
+        algorithm: typing.Optional["hashes.HashAlgorithm"],
+    ) -> "CertificateSigningRequest":
+        """
+        Create and sign an X.509 CSR from a CSR builder object.
+        """
+
+    @abc.abstractmethod
+    def create_x509_certificate(
+        self,
+        builder: "CertificateBuilder",
+        private_key: "PRIVATE_KEY_TYPES",
+        algorithm: typing.Optional["hashes.HashAlgorithm"],
+    ) -> "Certificate":
+        """
+        Create and sign an X.509 certificate from a CertificateBuilder object.
+        """
+
+    @abc.abstractmethod
+    def create_x509_crl(
+        self,
+        builder: "CertificateRevocationListBuilder",
+        private_key: "PRIVATE_KEY_TYPES",
+        algorithm: typing.Optional["hashes.HashAlgorithm"],
+    ) -> "CertificateRevocationList":
+        """
+        Create and sign an X.509 CertificateRevocationList from a
+        CertificateRevocationListBuilder object.
+        """
+
+    @abc.abstractmethod
+    def create_x509_revoked_certificate(
+        self, builder: "RevokedCertificateBuilder"
+    ) -> "RevokedCertificate":
+        """
+        Create a RevokedCertificate object from a RevokedCertificateBuilder
+        object.
+        """
+
+    @abc.abstractmethod
+    def x509_name_bytes(self, name: "Name") -> bytes:
+        """
+        Compute the DER encoded bytes of an X509 Name object.
+        """
+
+
+class DHBackend(metaclass=abc.ABCMeta):
+    @abc.abstractmethod
+    def generate_dh_parameters(self, generator, key_size):
+        """
+        Generate a DHParameters instance with a modulus of key_size bits.
+        Using the given generator. Often 2 or 5.
+        """
+
+    @abc.abstractmethod
+    def generate_dh_private_key(self, parameters):
+        """
+        Generate a DHPrivateKey instance with parameters as a DHParameters
+        object.
+        """
+
+    @abc.abstractmethod
+    def generate_dh_private_key_and_parameters(self, generator, key_size):
+        """
+        Generate a DHPrivateKey instance using key size only.
+        Using the given generator. Often 2 or 5.
+        """
+
+    @abc.abstractmethod
+    def load_dh_private_numbers(self, numbers):
+        """
+        Load a DHPrivateKey from DHPrivateNumbers
+        """
+
+    @abc.abstractmethod
+    def load_dh_public_numbers(self, numbers):
+        """
+        Load a DHPublicKey from DHPublicNumbers.
+        """
+
+    @abc.abstractmethod
+    def load_dh_parameter_numbers(self, numbers):
+        """
+        Load DHParameters from DHParameterNumbers.
+        """
+
+    @abc.abstractmethod
+    def dh_parameters_supported(self, p, g, q=None):
+        """
+        Returns whether the backend supports DH with these parameter values.
+        """
+
+    @abc.abstractmethod
+    def dh_x942_serialization_supported(self):
+        """
+        Returns True if the backend supports the serialization of DH objects
+        with subgroup order (q).
+        """
+
+
+class ScryptBackend(metaclass=abc.ABCMeta):
+    @abc.abstractmethod
+    def derive_scrypt(self, key_material, salt, length, n, r, p):
+        """
+        Return bytes derived from provided Scrypt parameters.
+        """
+
+    @abc.abstractmethod
+    def scrypt_supported(self):
+        """
+        Return True if Scrypt is supported.
+        """
+
+
+# This is the catch-all for future backend methods and inherits all the
+# other interfaces as well so we can just use Backend for typing.
+class Backend(
+    CipherBackend,
+    CMACBackend,
+    DERSerializationBackend,
+    DHBackend,
+    DSABackend,
+    EllipticCurveBackend,
+    HashBackend,
+    HMACBackend,
+    PBKDF2HMACBackend,
+    RSABackend,
+    PEMSerializationBackend,
+    ScryptBackend,
+    X509Backend,
+    metaclass=abc.ABCMeta,
+):
+    @abc.abstractmethod
+    def load_pem_pkcs7_certificates(self, data):
+        """
+        Returns a list of x509.Certificate
+        """
+
+    @abc.abstractmethod
+    def load_der_pkcs7_certificates(self, data):
+        """
+        Returns a list of x509.Certificate
+        """
+
+    @abc.abstractmethod
+    def pkcs7_sign(self, builder, encoding, options):
+        """
+        Returns bytes
+        """
+
+    @abc.abstractmethod
+    def load_key_and_certificates_from_pkcs12(self, data, password):
+        """
+        Returns a tuple of (key, cert, [certs])
+        """
+
+    @abc.abstractmethod
+    def serialize_key_and_certificates_to_pkcs12(
+        self, name, key, cert, cas, encryption_algorithm
+    ):
+        """
+        Returns bytes
+        """

asq-env/lib/python3.9/site-packages/cryptography/hazmat/backends/openssl/__init__.py

@@ -0,0 +1,9 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+from cryptography.hazmat.backends.openssl.backend import backend
+
+
+__all__ = ["backend"]

asq-env/lib/python3.9/site-packages/cryptography/hazmat/backends/openssl/aead.py

@@ -0,0 +1,165 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+from cryptography.exceptions import InvalidTag
+
+
+_ENCRYPT = 1
+_DECRYPT = 0
+
+
+def _aead_cipher_name(cipher):
+    from cryptography.hazmat.primitives.ciphers.aead import (
+        AESCCM,
+        AESGCM,
+        ChaCha20Poly1305,
+    )
+
+    if isinstance(cipher, ChaCha20Poly1305):
+        return b"chacha20-poly1305"
+    elif isinstance(cipher, AESCCM):
+        return "aes-{}-ccm".format(len(cipher._key) * 8).encode("ascii")
+    else:
+        assert isinstance(cipher, AESGCM)
+        return "aes-{}-gcm".format(len(cipher._key) * 8).encode("ascii")
+
+
+def _aead_setup(backend, cipher_name, key, nonce, tag, tag_len, operation):
+    evp_cipher = backend._lib.EVP_get_cipherbyname(cipher_name)
+    backend.openssl_assert(evp_cipher != backend._ffi.NULL)
+    ctx = backend._lib.EVP_CIPHER_CTX_new()
+    ctx = backend._ffi.gc(ctx, backend._lib.EVP_CIPHER_CTX_free)
+    res = backend._lib.EVP_CipherInit_ex(
+        ctx,
+        evp_cipher,
+        backend._ffi.NULL,
+        backend._ffi.NULL,
+        backend._ffi.NULL,
+        int(operation == _ENCRYPT),
+    )
+    backend.openssl_assert(res != 0)
+    res = backend._lib.EVP_CIPHER_CTX_set_key_length(ctx, len(key))
+    backend.openssl_assert(res != 0)
+    res = backend._lib.EVP_CIPHER_CTX_ctrl(
+        ctx,
+        backend._lib.EVP_CTRL_AEAD_SET_IVLEN,
+        len(nonce),
+        backend._ffi.NULL,
+    )
+    backend.openssl_assert(res != 0)
+    if operation == _DECRYPT:
+        res = backend._lib.EVP_CIPHER_CTX_ctrl(
+            ctx, backend._lib.EVP_CTRL_AEAD_SET_TAG, len(tag), tag
+        )
+        backend.openssl_assert(res != 0)
+    elif cipher_name.endswith(b"-ccm"):
+        res = backend._lib.EVP_CIPHER_CTX_ctrl(
+            ctx, backend._lib.EVP_CTRL_AEAD_SET_TAG, tag_len, backend._ffi.NULL
+        )
+        backend.openssl_assert(res != 0)
+
+    nonce_ptr = backend._ffi.from_buffer(nonce)
+    key_ptr = backend._ffi.from_buffer(key)
+    res = backend._lib.EVP_CipherInit_ex(
+        ctx,
+        backend._ffi.NULL,
+        backend._ffi.NULL,
+        key_ptr,
+        nonce_ptr,
+        int(operation == _ENCRYPT),
+    )
+    backend.openssl_assert(res != 0)
+    return ctx
+
+
+def _set_length(backend, ctx, data_len):
+    intptr = backend._ffi.new("int *")
+    res = backend._lib.EVP_CipherUpdate(
+        ctx, backend._ffi.NULL, intptr, backend._ffi.NULL, data_len
+    )
+    backend.openssl_assert(res != 0)
+
+
+def _process_aad(backend, ctx, associated_data):
+    outlen = backend._ffi.new("int *")
+    res = backend._lib.EVP_CipherUpdate(
+        ctx, backend._ffi.NULL, outlen, associated_data, len(associated_data)
+    )
+    backend.openssl_assert(res != 0)
+
+
+def _process_data(backend, ctx, data):
+    outlen = backend._ffi.new("int *")
+    buf = backend._ffi.new("unsigned char[]", len(data))
+    res = backend._lib.EVP_CipherUpdate(ctx, buf, outlen, data, len(data))
+    backend.openssl_assert(res != 0)
+    return backend._ffi.buffer(buf, outlen[0])[:]
+
+
+def _encrypt(backend, cipher, nonce, data, associated_data, tag_length):
+    from cryptography.hazmat.primitives.ciphers.aead import AESCCM
+
+    cipher_name = _aead_cipher_name(cipher)
+    ctx = _aead_setup(
+        backend, cipher_name, cipher._key, nonce, None, tag_length, _ENCRYPT
+    )
+    # CCM requires us to pass the length of the data before processing anything
+    # However calling this with any other AEAD results in an error
+    if isinstance(cipher, AESCCM):
+        _set_length(backend, ctx, len(data))
+
+    _process_aad(backend, ctx, associated_data)
+    processed_data = _process_data(backend, ctx, data)
+    outlen = backend._ffi.new("int *")
+    res = backend._lib.EVP_CipherFinal_ex(ctx, backend._ffi.NULL, outlen)
+    backend.openssl_assert(res != 0)
+    backend.openssl_assert(outlen[0] == 0)
+    tag_buf = backend._ffi.new("unsigned char[]", tag_length)
+    res = backend._lib.EVP_CIPHER_CTX_ctrl(
+        ctx, backend._lib.EVP_CTRL_AEAD_GET_TAG, tag_length, tag_buf
+    )
+    backend.openssl_assert(res != 0)
+    tag = backend._ffi.buffer(tag_buf)[:]
+
+    return processed_data + tag
+
+
+def _decrypt(backend, cipher, nonce, data, associated_data, tag_length):
+    from cryptography.hazmat.primitives.ciphers.aead import AESCCM
+
+    if len(data) < tag_length:
+        raise InvalidTag
+    tag = data[-tag_length:]
+    data = data[:-tag_length]
+    cipher_name = _aead_cipher_name(cipher)
+    ctx = _aead_setup(
+        backend, cipher_name, cipher._key, nonce, tag, tag_length, _DECRYPT
+    )
+    # CCM requires us to pass the length of the data before processing anything
+    # However calling this with any other AEAD results in an error
+    if isinstance(cipher, AESCCM):
+        _set_length(backend, ctx, len(data))
+
+    _process_aad(backend, ctx, associated_data)
+    # CCM has a different error path if the tag doesn't match. Errors are
+    # raised in Update and Final is irrelevant.
+    if isinstance(cipher, AESCCM):
+        outlen = backend._ffi.new("int *")
+        buf = backend._ffi.new("unsigned char[]", len(data))
+        res = backend._lib.EVP_CipherUpdate(ctx, buf, outlen, data, len(data))
+        if res != 1:
+            backend._consume_errors()
+            raise InvalidTag
+
+        processed_data = backend._ffi.buffer(buf, outlen[0])[:]
+    else:
+        processed_data = _process_data(backend, ctx, data)
+        outlen = backend._ffi.new("int *")
+        res = backend._lib.EVP_CipherFinal_ex(ctx, backend._ffi.NULL, outlen)
+        if res == 0:
+            backend._consume_errors()
+            raise InvalidTag
+
+    return processed_data

asq-env/lib/python3.9/site-packages/cryptography/hazmat/backends/openssl/ciphers.py

@@ -0,0 +1,272 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+from cryptography import utils
+from cryptography.exceptions import InvalidTag, UnsupportedAlgorithm, _Reasons
+from cryptography.hazmat.primitives import ciphers
+from cryptography.hazmat.primitives.ciphers import modes
+
+
+@utils.register_interface(ciphers.CipherContext)
+@utils.register_interface(ciphers.AEADCipherContext)
+@utils.register_interface(ciphers.AEADEncryptionContext)
+@utils.register_interface(ciphers.AEADDecryptionContext)
+class _CipherContext(object):
+    _ENCRYPT = 1
+    _DECRYPT = 0
+    _MAX_CHUNK_SIZE = 2 ** 30 - 1
+
+    def __init__(self, backend, cipher, mode, operation):
+        self._backend = backend
+        self._cipher = cipher
+        self._mode = mode
+        self._operation = operation
+        self._tag = None
+
+        if isinstance(self._cipher, ciphers.BlockCipherAlgorithm):
+            self._block_size_bytes = self._cipher.block_size // 8
+        else:
+            self._block_size_bytes = 1
+
+        ctx = self._backend._lib.EVP_CIPHER_CTX_new()
+        ctx = self._backend._ffi.gc(
+            ctx, self._backend._lib.EVP_CIPHER_CTX_free
+        )
+
+        registry = self._backend._cipher_registry
+        try:
+            adapter = registry[type(cipher), type(mode)]
+        except KeyError:
+            raise UnsupportedAlgorithm(
+                "cipher {} in {} mode is not supported "
+                "by this backend.".format(
+                    cipher.name, mode.name if mode else mode
+                ),
+                _Reasons.UNSUPPORTED_CIPHER,
+            )
+
+        evp_cipher = adapter(self._backend, cipher, mode)
+        if evp_cipher == self._backend._ffi.NULL:
+            msg = "cipher {0.name} ".format(cipher)
+            if mode is not None:
+                msg += "in {0.name} mode ".format(mode)
+            msg += (
+                "is not supported by this backend (Your version of OpenSSL "
+                "may be too old. Current version: {}.)"
+            ).format(self._backend.openssl_version_text())
+            raise UnsupportedAlgorithm(msg, _Reasons.UNSUPPORTED_CIPHER)
+
+        if isinstance(mode, modes.ModeWithInitializationVector):
+            iv_nonce = self._backend._ffi.from_buffer(
+                mode.initialization_vector
+            )
+        elif isinstance(mode, modes.ModeWithTweak):
+            iv_nonce = self._backend._ffi.from_buffer(mode.tweak)
+        elif isinstance(mode, modes.ModeWithNonce):
+            iv_nonce = self._backend._ffi.from_buffer(mode.nonce)
+        elif isinstance(cipher, modes.ModeWithNonce):
+            iv_nonce = self._backend._ffi.from_buffer(cipher.nonce)
+        else:
+            iv_nonce = self._backend._ffi.NULL
+        # begin init with cipher and operation type
+        res = self._backend._lib.EVP_CipherInit_ex(
+            ctx,
+            evp_cipher,
+            self._backend._ffi.NULL,
+            self._backend._ffi.NULL,
+            self._backend._ffi.NULL,
+            operation,
+        )
+        self._backend.openssl_assert(res != 0)
+        # set the key length to handle variable key ciphers
+        res = self._backend._lib.EVP_CIPHER_CTX_set_key_length(
+            ctx, len(cipher.key)
+        )
+        self._backend.openssl_assert(res != 0)
+        if isinstance(mode, modes.GCM):
+            res = self._backend._lib.EVP_CIPHER_CTX_ctrl(
+                ctx,
+                self._backend._lib.EVP_CTRL_AEAD_SET_IVLEN,
+                len(iv_nonce),
+                self._backend._ffi.NULL,
+            )
+            self._backend.openssl_assert(res != 0)
+            if mode.tag is not None:
+                res = self._backend._lib.EVP_CIPHER_CTX_ctrl(
+                    ctx,
+                    self._backend._lib.EVP_CTRL_AEAD_SET_TAG,
+                    len(mode.tag),
+                    mode.tag,
+                )
+                self._backend.openssl_assert(res != 0)
+                self._tag = mode.tag
+
+        # pass key/iv
+        res = self._backend._lib.EVP_CipherInit_ex(
+            ctx,
+            self._backend._ffi.NULL,
+            self._backend._ffi.NULL,
+            self._backend._ffi.from_buffer(cipher.key),
+            iv_nonce,
+            operation,
+        )
+
+        # Check for XTS mode duplicate keys error
+        errors = self._backend._consume_errors()
+        lib = self._backend._lib
+        if res == 0 and (
+            (
+                lib.CRYPTOGRAPHY_OPENSSL_111D_OR_GREATER
+                and errors[0]._lib_reason_match(
+                    lib.ERR_LIB_EVP, lib.EVP_R_XTS_DUPLICATED_KEYS
+                )
+            )
+            or (
+                lib.Cryptography_HAS_PROVIDERS
+                and errors[0]._lib_reason_match(
+                    lib.ERR_LIB_PROV, lib.PROV_R_XTS_DUPLICATED_KEYS
+                )
+            )
+        ):
+            raise ValueError("In XTS mode duplicated keys are not allowed")
+
+        self._backend.openssl_assert(res != 0, errors=errors)
+
+        # We purposely disable padding here as it's handled higher up in the
+        # API.
+        self._backend._lib.EVP_CIPHER_CTX_set_padding(ctx, 0)
+        self._ctx = ctx
+
+    def update(self, data: bytes) -> bytes:
+        buf = bytearray(len(data) + self._block_size_bytes - 1)
+        n = self.update_into(data, buf)
+        return bytes(buf[:n])
+
+    def update_into(self, data: bytes, buf) -> int:
+        total_data_len = len(data)
+        if len(buf) < (total_data_len + self._block_size_bytes - 1):
+            raise ValueError(
+                "buffer must be at least {} bytes for this "
+                "payload".format(len(data) + self._block_size_bytes - 1)
+            )
+
+        data_processed = 0
+        total_out = 0
+        outlen = self._backend._ffi.new("int *")
+        baseoutbuf = self._backend._ffi.from_buffer(buf)
+        baseinbuf = self._backend._ffi.from_buffer(data)
+
+        while data_processed != total_data_len:
+            outbuf = baseoutbuf + total_out
+            inbuf = baseinbuf + data_processed
+            inlen = min(self._MAX_CHUNK_SIZE, total_data_len - data_processed)
+
+            res = self._backend._lib.EVP_CipherUpdate(
+                self._ctx, outbuf, outlen, inbuf, inlen
+            )
+            if res == 0 and isinstance(self._mode, modes.XTS):
+                self._backend._consume_errors()
+                raise ValueError(
+                    "In XTS mode you must supply at least a full block in the "
+                    "first update call. For AES this is 16 bytes."
+                )
+            else:
+                self._backend.openssl_assert(res != 0)
+            data_processed += inlen
+            total_out += outlen[0]
+
+        return total_out
+
+    def finalize(self) -> bytes:
+        if (
+            self._operation == self._DECRYPT
+            and isinstance(self._mode, modes.ModeWithAuthenticationTag)
+            and self.tag is None
+        ):
+            raise ValueError(
+                "Authentication tag must be provided when decrypting."
+            )
+
+        buf = self._backend._ffi.new("unsigned char[]", self._block_size_bytes)
+        outlen = self._backend._ffi.new("int *")
+        res = self._backend._lib.EVP_CipherFinal_ex(self._ctx, buf, outlen)
+        if res == 0:
+            errors = self._backend._consume_errors()
+
+            if not errors and isinstance(self._mode, modes.GCM):
+                raise InvalidTag
+
+            self._backend.openssl_assert(
+                errors[0]._lib_reason_match(
+                    self._backend._lib.ERR_LIB_EVP,
+                    self._backend._lib.EVP_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH,
+                )
+                or (
+                    self._backend._lib.Cryptography_HAS_PROVIDERS
+                    and errors[0]._lib_reason_match(
+                        self._backend._lib.ERR_LIB_PROV,
+                        self._backend._lib.PROV_R_WRONG_FINAL_BLOCK_LENGTH,
+                    )
+                ),
+                errors=errors,
+            )
+            raise ValueError(
+                "The length of the provided data is not a multiple of "
+                "the block length."
+            )
+
+        if (
+            isinstance(self._mode, modes.GCM)
+            and self._operation == self._ENCRYPT
+        ):
+            tag_buf = self._backend._ffi.new(
+                "unsigned char[]", self._block_size_bytes
+            )
+            res = self._backend._lib.EVP_CIPHER_CTX_ctrl(
+                self._ctx,
+                self._backend._lib.EVP_CTRL_AEAD_GET_TAG,
+                self._block_size_bytes,
+                tag_buf,
+            )
+            self._backend.openssl_assert(res != 0)
+            self._tag = self._backend._ffi.buffer(tag_buf)[:]
+
+        res = self._backend._lib.EVP_CIPHER_CTX_reset(self._ctx)
+        self._backend.openssl_assert(res == 1)
+        return self._backend._ffi.buffer(buf)[: outlen[0]]
+
+    def finalize_with_tag(self, tag: bytes) -> bytes:
+        tag_len = len(tag)
+        if tag_len < self._mode._min_tag_length:
+            raise ValueError(
+                "Authentication tag must be {} bytes or longer.".format(
+                    self._mode._min_tag_length
+                )
+            )
+        elif tag_len > self._block_size_bytes:
+            raise ValueError(
+                "Authentication tag cannot be more than {} bytes.".format(
+                    self._block_size_bytes
+                )
+            )
+        res = self._backend._lib.EVP_CIPHER_CTX_ctrl(
+            self._ctx, self._backend._lib.EVP_CTRL_AEAD_SET_TAG, len(tag), tag
+        )
+        self._backend.openssl_assert(res != 0)
+        self._tag = tag
+        return self.finalize()
+
+    def authenticate_additional_data(self, data: bytes) -> None:
+        outlen = self._backend._ffi.new("int *")
+        res = self._backend._lib.EVP_CipherUpdate(
+            self._ctx,
+            self._backend._ffi.NULL,
+            outlen,
+            self._backend._ffi.from_buffer(data),
+            len(data),
+        )
+        self._backend.openssl_assert(res != 0)
+
+    tag = utils.read_only_property("_tag")

asq-env/lib/python3.9/site-packages/cryptography/hazmat/backends/openssl/cmac.py

@@ -0,0 +1,80 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+from cryptography import utils
+from cryptography.exceptions import (
+    InvalidSignature,
+    UnsupportedAlgorithm,
+    _Reasons,
+)
+from cryptography.hazmat.primitives import constant_time
+from cryptography.hazmat.primitives.ciphers.modes import CBC
+
+
+class _CMACContext(object):
+    def __init__(self, backend, algorithm, ctx=None):
+        if not backend.cmac_algorithm_supported(algorithm):
+            raise UnsupportedAlgorithm(
+                "This backend does not support CMAC.",
+                _Reasons.UNSUPPORTED_CIPHER,
+            )
+
+        self._backend = backend
+        self._key = algorithm.key
+        self._algorithm = algorithm
+        self._output_length = algorithm.block_size // 8
+
+        if ctx is None:
+            registry = self._backend._cipher_registry
+            adapter = registry[type(algorithm), CBC]
+
+            evp_cipher = adapter(self._backend, algorithm, CBC)
+
+            ctx = self._backend._lib.CMAC_CTX_new()
+
+            self._backend.openssl_assert(ctx != self._backend._ffi.NULL)
+            ctx = self._backend._ffi.gc(ctx, self._backend._lib.CMAC_CTX_free)
+
+            key_ptr = self._backend._ffi.from_buffer(self._key)
+            res = self._backend._lib.CMAC_Init(
+                ctx,
+                key_ptr,
+                len(self._key),
+                evp_cipher,
+                self._backend._ffi.NULL,
+            )
+            self._backend.openssl_assert(res == 1)
+
+        self._ctx = ctx
+
+    algorithm = utils.read_only_property("_algorithm")
+
+    def update(self, data: bytes) -> None:
+        res = self._backend._lib.CMAC_Update(self._ctx, data, len(data))
+        self._backend.openssl_assert(res == 1)
+
+    def finalize(self) -> bytes:
+        buf = self._backend._ffi.new("unsigned char[]", self._output_length)
+        length = self._backend._ffi.new("size_t *", self._output_length)
+        res = self._backend._lib.CMAC_Final(self._ctx, buf, length)
+        self._backend.openssl_assert(res == 1)
+
+        self._ctx = None
+
+        return self._backend._ffi.buffer(buf)[:]
+
+    def copy(self) -> "_CMACContext":
+        copied_ctx = self._backend._lib.CMAC_CTX_new()
+        copied_ctx = self._backend._ffi.gc(
+            copied_ctx, self._backend._lib.CMAC_CTX_free
+        )
+        res = self._backend._lib.CMAC_CTX_copy(copied_ctx, self._ctx)
+        self._backend.openssl_assert(res == 1)
+        return _CMACContext(self._backend, self._algorithm, ctx=copied_ctx)
+
+    def verify(self, signature: bytes) -> None:
+        digest = self.finalize()
+        if not constant_time.bytes_eq(digest, signature):
+            raise InvalidSignature("Signature did not match digest.")

asq-env/lib/python3.9/site-packages/cryptography/hazmat/backends/openssl/decode_asn1.py

@@ -0,0 +1,34 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+from cryptography import x509
+
+_DISTPOINT_TYPE_FULLNAME = 0
+_DISTPOINT_TYPE_RELATIVENAME = 1
+
+#    CRLReason ::= ENUMERATED {
+#        unspecified             (0),
+#        keyCompromise           (1),
+#        cACompromise            (2),
+#        affiliationChanged      (3),
+#        superseded              (4),
+#        cessationOfOperation    (5),
+#        certificateHold         (6),
+#             -- value 7 is not used
+#        removeFromCRL           (8),
+#        privilegeWithdrawn      (9),
+#        aACompromise           (10) }
+_CRL_ENTRY_REASON_ENUM_TO_CODE = {
+    x509.ReasonFlags.unspecified: 0,
+    x509.ReasonFlags.key_compromise: 1,
+    x509.ReasonFlags.ca_compromise: 2,
+    x509.ReasonFlags.affiliation_changed: 3,
+    x509.ReasonFlags.superseded: 4,
+    x509.ReasonFlags.cessation_of_operation: 5,
+    x509.ReasonFlags.certificate_hold: 6,
+    x509.ReasonFlags.remove_from_crl: 8,
+    x509.ReasonFlags.privilege_withdrawn: 9,
+    x509.ReasonFlags.aa_compromise: 10,
+}

asq-env/lib/python3.9/site-packages/cryptography/hazmat/backends/openssl/dh.py

@@ -0,0 +1,293 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+from cryptography.exceptions import UnsupportedAlgorithm, _Reasons
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import dh
+
+
+def _dh_params_dup(dh_cdata, backend):
+    lib = backend._lib
+    ffi = backend._ffi
+
+    param_cdata = lib.DHparams_dup(dh_cdata)
+    backend.openssl_assert(param_cdata != ffi.NULL)
+    param_cdata = ffi.gc(param_cdata, lib.DH_free)
+    if lib.CRYPTOGRAPHY_IS_LIBRESSL:
+        # In libressl DHparams_dup don't copy q
+        q = ffi.new("BIGNUM **")
+        lib.DH_get0_pqg(dh_cdata, ffi.NULL, q, ffi.NULL)
+        q_dup = lib.BN_dup(q[0])
+        res = lib.DH_set0_pqg(param_cdata, ffi.NULL, q_dup, ffi.NULL)
+        backend.openssl_assert(res == 1)
+
+    return param_cdata
+
+
+def _dh_cdata_to_parameters(dh_cdata, backend):
+    param_cdata = _dh_params_dup(dh_cdata, backend)
+    return _DHParameters(backend, param_cdata)
+
+
+class _DHParameters(dh.DHParameters):
+    def __init__(self, backend, dh_cdata):
+        self._backend = backend
+        self._dh_cdata = dh_cdata
+
+    def parameter_numbers(self) -> dh.DHParameterNumbers:
+        p = self._backend._ffi.new("BIGNUM **")
+        g = self._backend._ffi.new("BIGNUM **")
+        q = self._backend._ffi.new("BIGNUM **")
+        self._backend._lib.DH_get0_pqg(self._dh_cdata, p, q, g)
+        self._backend.openssl_assert(p[0] != self._backend._ffi.NULL)
+        self._backend.openssl_assert(g[0] != self._backend._ffi.NULL)
+        if q[0] == self._backend._ffi.NULL:
+            q_val = None
+        else:
+            q_val = self._backend._bn_to_int(q[0])
+        return dh.DHParameterNumbers(
+            p=self._backend._bn_to_int(p[0]),
+            g=self._backend._bn_to_int(g[0]),
+            q=q_val,
+        )
+
+    def generate_private_key(self) -> dh.DHPrivateKey:
+        return self._backend.generate_dh_private_key(self)
+
+    def parameter_bytes(
+        self,
+        encoding: serialization.Encoding,
+        format: serialization.ParameterFormat,
+    ) -> bytes:
+        if format is not serialization.ParameterFormat.PKCS3:
+            raise ValueError("Only PKCS3 serialization is supported")
+        if not self._backend._lib.Cryptography_HAS_EVP_PKEY_DHX:
+            q = self._backend._ffi.new("BIGNUM **")
+            self._backend._lib.DH_get0_pqg(
+                self._dh_cdata,
+                self._backend._ffi.NULL,
+                q,
+                self._backend._ffi.NULL,
+            )
+            if q[0] != self._backend._ffi.NULL:
+                raise UnsupportedAlgorithm(
+                    "DH X9.42 serialization is not supported",
+                    _Reasons.UNSUPPORTED_SERIALIZATION,
+                )
+
+        return self._backend._parameter_bytes(encoding, format, self._dh_cdata)
+
+
+def _get_dh_num_bits(backend, dh_cdata) -> int:
+    p = backend._ffi.new("BIGNUM **")
+    backend._lib.DH_get0_pqg(dh_cdata, p, backend._ffi.NULL, backend._ffi.NULL)
+    backend.openssl_assert(p[0] != backend._ffi.NULL)
+    return backend._lib.BN_num_bits(p[0])
+
+
+class _DHPrivateKey(dh.DHPrivateKey):
+    def __init__(self, backend, dh_cdata, evp_pkey):
+        self._backend = backend
+        self._dh_cdata = dh_cdata
+        self._evp_pkey = evp_pkey
+        self._key_size_bytes = self._backend._lib.DH_size(dh_cdata)
+
+    @property
+    def key_size(self) -> int:
+        return _get_dh_num_bits(self._backend, self._dh_cdata)
+
+    def private_numbers(self) -> dh.DHPrivateNumbers:
+        p = self._backend._ffi.new("BIGNUM **")
+        g = self._backend._ffi.new("BIGNUM **")
+        q = self._backend._ffi.new("BIGNUM **")
+        self._backend._lib.DH_get0_pqg(self._dh_cdata, p, q, g)
+        self._backend.openssl_assert(p[0] != self._backend._ffi.NULL)
+        self._backend.openssl_assert(g[0] != self._backend._ffi.NULL)
+        if q[0] == self._backend._ffi.NULL:
+            q_val = None
+        else:
+            q_val = self._backend._bn_to_int(q[0])
+        pub_key = self._backend._ffi.new("BIGNUM **")
+        priv_key = self._backend._ffi.new("BIGNUM **")
+        self._backend._lib.DH_get0_key(self._dh_cdata, pub_key, priv_key)
+        self._backend.openssl_assert(pub_key[0] != self._backend._ffi.NULL)
+        self._backend.openssl_assert(priv_key[0] != self._backend._ffi.NULL)
+        return dh.DHPrivateNumbers(
+            public_numbers=dh.DHPublicNumbers(
+                parameter_numbers=dh.DHParameterNumbers(
+                    p=self._backend._bn_to_int(p[0]),
+                    g=self._backend._bn_to_int(g[0]),
+                    q=q_val,
+                ),
+                y=self._backend._bn_to_int(pub_key[0]),
+            ),
+            x=self._backend._bn_to_int(priv_key[0]),
+        )
+
+    def exchange(self, peer_public_key: dh.DHPublicKey) -> bytes:
+        if not isinstance(peer_public_key, _DHPublicKey):
+            raise TypeError("peer_public_key must be a DHPublicKey")
+
+        ctx = self._backend._lib.EVP_PKEY_CTX_new(
+            self._evp_pkey, self._backend._ffi.NULL
+        )
+        self._backend.openssl_assert(ctx != self._backend._ffi.NULL)
+        ctx = self._backend._ffi.gc(ctx, self._backend._lib.EVP_PKEY_CTX_free)
+        res = self._backend._lib.EVP_PKEY_derive_init(ctx)
+        self._backend.openssl_assert(res == 1)
+        res = self._backend._lib.EVP_PKEY_derive_set_peer(
+            ctx, peer_public_key._evp_pkey
+        )
+        # Invalid kex errors here in OpenSSL 3.0 because checks were moved
+        # to EVP_PKEY_derive_set_peer
+        self._exchange_assert(res == 1)
+        keylen = self._backend._ffi.new("size_t *")
+        res = self._backend._lib.EVP_PKEY_derive(
+            ctx, self._backend._ffi.NULL, keylen
+        )
+        # Invalid kex errors here in OpenSSL < 3
+        self._exchange_assert(res == 1)
+        self._backend.openssl_assert(keylen[0] > 0)
+        buf = self._backend._ffi.new("unsigned char[]", keylen[0])
+        res = self._backend._lib.EVP_PKEY_derive(ctx, buf, keylen)
+        self._backend.openssl_assert(res == 1)
+
+        key = self._backend._ffi.buffer(buf, keylen[0])[:]
+        pad = self._key_size_bytes - len(key)
+
+        if pad > 0:
+            key = (b"\x00" * pad) + key
+
+        return key
+
+    def _exchange_assert(self, ok):
+        if not ok:
+            errors_with_text = self._backend._consume_errors_with_text()
+            raise ValueError(
+                "Error computing shared key.",
+                errors_with_text,
+            )
+
+    def public_key(self) -> dh.DHPublicKey:
+        dh_cdata = _dh_params_dup(self._dh_cdata, self._backend)
+        pub_key = self._backend._ffi.new("BIGNUM **")
+        self._backend._lib.DH_get0_key(
+            self._dh_cdata, pub_key, self._backend._ffi.NULL
+        )
+        self._backend.openssl_assert(pub_key[0] != self._backend._ffi.NULL)
+        pub_key_dup = self._backend._lib.BN_dup(pub_key[0])
+        self._backend.openssl_assert(pub_key_dup != self._backend._ffi.NULL)
+
+        res = self._backend._lib.DH_set0_key(
+            dh_cdata, pub_key_dup, self._backend._ffi.NULL
+        )
+        self._backend.openssl_assert(res == 1)
+        evp_pkey = self._backend._dh_cdata_to_evp_pkey(dh_cdata)
+        return _DHPublicKey(self._backend, dh_cdata, evp_pkey)
+
+    def parameters(self) -> dh.DHParameters:
+        return _dh_cdata_to_parameters(self._dh_cdata, self._backend)
+
+    def private_bytes(
+        self,
+        encoding: serialization.Encoding,
+        format: serialization.PrivateFormat,
+        encryption_algorithm: serialization.KeySerializationEncryption,
+    ) -> bytes:
+        if format is not serialization.PrivateFormat.PKCS8:
+            raise ValueError(
+                "DH private keys support only PKCS8 serialization"
+            )
+        if not self._backend._lib.Cryptography_HAS_EVP_PKEY_DHX:
+            q = self._backend._ffi.new("BIGNUM **")
+            self._backend._lib.DH_get0_pqg(
+                self._dh_cdata,
+                self._backend._ffi.NULL,
+                q,
+                self._backend._ffi.NULL,
+            )
+            if q[0] != self._backend._ffi.NULL:
+                raise UnsupportedAlgorithm(
+                    "DH X9.42 serialization is not supported",
+                    _Reasons.UNSUPPORTED_SERIALIZATION,
+                )
+
+        return self._backend._private_key_bytes(
+            encoding,
+            format,
+            encryption_algorithm,
+            self,
+            self._evp_pkey,
+            self._dh_cdata,
+        )
+
+
+class _DHPublicKey(dh.DHPublicKey):
+    def __init__(self, backend, dh_cdata, evp_pkey):
+        self._backend = backend
+        self._dh_cdata = dh_cdata
+        self._evp_pkey = evp_pkey
+        self._key_size_bits = _get_dh_num_bits(self._backend, self._dh_cdata)
+
+    @property
+    def key_size(self) -> int:
+        return self._key_size_bits
+
+    def public_numbers(self) -> dh.DHPublicNumbers:
+        p = self._backend._ffi.new("BIGNUM **")
+        g = self._backend._ffi.new("BIGNUM **")
+        q = self._backend._ffi.new("BIGNUM **")
+        self._backend._lib.DH_get0_pqg(self._dh_cdata, p, q, g)
+        self._backend.openssl_assert(p[0] != self._backend._ffi.NULL)
+        self._backend.openssl_assert(g[0] != self._backend._ffi.NULL)
+        if q[0] == self._backend._ffi.NULL:
+            q_val = None
+        else:
+            q_val = self._backend._bn_to_int(q[0])
+        pub_key = self._backend._ffi.new("BIGNUM **")
+        self._backend._lib.DH_get0_key(
+            self._dh_cdata, pub_key, self._backend._ffi.NULL
+        )
+        self._backend.openssl_assert(pub_key[0] != self._backend._ffi.NULL)
+        return dh.DHPublicNumbers(
+            parameter_numbers=dh.DHParameterNumbers(
+                p=self._backend._bn_to_int(p[0]),
+                g=self._backend._bn_to_int(g[0]),
+                q=q_val,
+            ),
+            y=self._backend._bn_to_int(pub_key[0]),
+        )
+
+    def parameters(self) -> dh.DHParameters:
+        return _dh_cdata_to_parameters(self._dh_cdata, self._backend)
+
+    def public_bytes(
+        self,
+        encoding: serialization.Encoding,
+        format: serialization.PublicFormat,
+    ) -> bytes:
+        if format is not serialization.PublicFormat.SubjectPublicKeyInfo:
+            raise ValueError(
+                "DH public keys support only "
+                "SubjectPublicKeyInfo serialization"
+            )
+
+        if not self._backend._lib.Cryptography_HAS_EVP_PKEY_DHX:
+            q = self._backend._ffi.new("BIGNUM **")
+            self._backend._lib.DH_get0_pqg(
+                self._dh_cdata,
+                self._backend._ffi.NULL,
+                q,
+                self._backend._ffi.NULL,
+            )
+            if q[0] != self._backend._ffi.NULL:
+                raise UnsupportedAlgorithm(
+                    "DH X9.42 serialization is not supported",
+                    _Reasons.UNSUPPORTED_SERIALIZATION,
+                )
+
+        return self._backend._public_key_bytes(
+            encoding, format, self, self._evp_pkey, None
+        )

asq-env/lib/python3.9/site-packages/cryptography/hazmat/backends/openssl/dsa.py

@@ -0,0 +1,289 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+import typing
+
+from cryptography import utils
+from cryptography.exceptions import InvalidSignature
+from cryptography.hazmat.backends.openssl.utils import (
+    _calculate_digest_and_algorithm,
+    _check_not_prehashed,
+    _warn_sign_verify_deprecated,
+)
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import (
+    AsymmetricSignatureContext,
+    AsymmetricVerificationContext,
+    dsa,
+    utils as asym_utils,
+)
+
+
+def _dsa_sig_sign(backend, private_key, data):
+    sig_buf_len = backend._lib.DSA_size(private_key._dsa_cdata)
+    sig_buf = backend._ffi.new("unsigned char[]", sig_buf_len)
+    buflen = backend._ffi.new("unsigned int *")
+
+    # The first parameter passed to DSA_sign is unused by OpenSSL but
+    # must be an integer.
+    res = backend._lib.DSA_sign(
+        0, data, len(data), sig_buf, buflen, private_key._dsa_cdata
+    )
+    backend.openssl_assert(res == 1)
+    backend.openssl_assert(buflen[0])
+
+    return backend._ffi.buffer(sig_buf)[: buflen[0]]
+
+
+def _dsa_sig_verify(backend, public_key, signature, data):
+    # The first parameter passed to DSA_verify is unused by OpenSSL but
+    # must be an integer.
+    res = backend._lib.DSA_verify(
+        0, data, len(data), signature, len(signature), public_key._dsa_cdata
+    )
+
+    if res != 1:
+        backend._consume_errors()
+        raise InvalidSignature
+
+
+class _DSAVerificationContext(AsymmetricVerificationContext):
+    def __init__(self, backend, public_key, signature, algorithm):
+        self._backend = backend
+        self._public_key = public_key
+        self._signature = signature
+        self._algorithm = algorithm
+
+        self._hash_ctx = hashes.Hash(self._algorithm, self._backend)
+
+    def update(self, data: bytes):
+        self._hash_ctx.update(data)
+
+    def verify(self) -> None:
+        data_to_verify = self._hash_ctx.finalize()
+
+        _dsa_sig_verify(
+            self._backend, self._public_key, self._signature, data_to_verify
+        )
+
+
+class _DSASignatureContext(AsymmetricSignatureContext):
+    def __init__(
+        self,
+        backend,
+        private_key: dsa.DSAPrivateKey,
+        algorithm: hashes.HashAlgorithm,
+    ):
+        self._backend = backend
+        self._private_key = private_key
+        self._algorithm = algorithm
+        self._hash_ctx = hashes.Hash(self._algorithm, self._backend)
+
+    def update(self, data: bytes) -> None:
+        self._hash_ctx.update(data)
+
+    def finalize(self) -> bytes:
+        data_to_sign = self._hash_ctx.finalize()
+        return _dsa_sig_sign(self._backend, self._private_key, data_to_sign)
+
+
+class _DSAParameters(dsa.DSAParameters):
+    def __init__(self, backend, dsa_cdata):
+        self._backend = backend
+        self._dsa_cdata = dsa_cdata
+
+    def parameter_numbers(self) -> dsa.DSAParameterNumbers:
+        p = self._backend._ffi.new("BIGNUM **")
+        q = self._backend._ffi.new("BIGNUM **")
+        g = self._backend._ffi.new("BIGNUM **")
+        self._backend._lib.DSA_get0_pqg(self._dsa_cdata, p, q, g)
+        self._backend.openssl_assert(p[0] != self._backend._ffi.NULL)
+        self._backend.openssl_assert(q[0] != self._backend._ffi.NULL)
+        self._backend.openssl_assert(g[0] != self._backend._ffi.NULL)
+        return dsa.DSAParameterNumbers(
+            p=self._backend._bn_to_int(p[0]),
+            q=self._backend._bn_to_int(q[0]),
+            g=self._backend._bn_to_int(g[0]),
+        )
+
+    def generate_private_key(self) -> dsa.DSAPrivateKey:
+        return self._backend.generate_dsa_private_key(self)
+
+
+class _DSAPrivateKey(dsa.DSAPrivateKey):
+    def __init__(self, backend, dsa_cdata, evp_pkey):
+        self._backend = backend
+        self._dsa_cdata = dsa_cdata
+        self._evp_pkey = evp_pkey
+
+        p = self._backend._ffi.new("BIGNUM **")
+        self._backend._lib.DSA_get0_pqg(
+            dsa_cdata, p, self._backend._ffi.NULL, self._backend._ffi.NULL
+        )
+        self._backend.openssl_assert(p[0] != backend._ffi.NULL)
+        self._key_size = self._backend._lib.BN_num_bits(p[0])
+
+    key_size = utils.read_only_property("_key_size")
+
+    def signer(
+        self, signature_algorithm: hashes.HashAlgorithm
+    ) -> AsymmetricSignatureContext:
+        _warn_sign_verify_deprecated()
+        _check_not_prehashed(signature_algorithm)
+        return _DSASignatureContext(self._backend, self, signature_algorithm)
+
+    def private_numbers(self) -> dsa.DSAPrivateNumbers:
+        p = self._backend._ffi.new("BIGNUM **")
+        q = self._backend._ffi.new("BIGNUM **")
+        g = self._backend._ffi.new("BIGNUM **")
+        pub_key = self._backend._ffi.new("BIGNUM **")
+        priv_key = self._backend._ffi.new("BIGNUM **")
+        self._backend._lib.DSA_get0_pqg(self._dsa_cdata, p, q, g)
+        self._backend.openssl_assert(p[0] != self._backend._ffi.NULL)
+        self._backend.openssl_assert(q[0] != self._backend._ffi.NULL)
+        self._backend.openssl_assert(g[0] != self._backend._ffi.NULL)
+        self._backend._lib.DSA_get0_key(self._dsa_cdata, pub_key, priv_key)
+        self._backend.openssl_assert(pub_key[0] != self._backend._ffi.NULL)
+        self._backend.openssl_assert(priv_key[0] != self._backend._ffi.NULL)
+        return dsa.DSAPrivateNumbers(
+            public_numbers=dsa.DSAPublicNumbers(
+                parameter_numbers=dsa.DSAParameterNumbers(
+                    p=self._backend._bn_to_int(p[0]),
+                    q=self._backend._bn_to_int(q[0]),
+                    g=self._backend._bn_to_int(g[0]),
+                ),
+                y=self._backend._bn_to_int(pub_key[0]),
+            ),
+            x=self._backend._bn_to_int(priv_key[0]),
+        )
+
+    def public_key(self) -> dsa.DSAPublicKey:
+        dsa_cdata = self._backend._lib.DSAparams_dup(self._dsa_cdata)
+        self._backend.openssl_assert(dsa_cdata != self._backend._ffi.NULL)
+        dsa_cdata = self._backend._ffi.gc(
+            dsa_cdata, self._backend._lib.DSA_free
+        )
+        pub_key = self._backend._ffi.new("BIGNUM **")
+        self._backend._lib.DSA_get0_key(
+            self._dsa_cdata, pub_key, self._backend._ffi.NULL
+        )
+        self._backend.openssl_assert(pub_key[0] != self._backend._ffi.NULL)
+        pub_key_dup = self._backend._lib.BN_dup(pub_key[0])
+        res = self._backend._lib.DSA_set0_key(
+            dsa_cdata, pub_key_dup, self._backend._ffi.NULL
+        )
+        self._backend.openssl_assert(res == 1)
+        evp_pkey = self._backend._dsa_cdata_to_evp_pkey(dsa_cdata)
+        return _DSAPublicKey(self._backend, dsa_cdata, evp_pkey)
+
+    def parameters(self) -> dsa.DSAParameters:
+        dsa_cdata = self._backend._lib.DSAparams_dup(self._dsa_cdata)
+        self._backend.openssl_assert(dsa_cdata != self._backend._ffi.NULL)
+        dsa_cdata = self._backend._ffi.gc(
+            dsa_cdata, self._backend._lib.DSA_free
+        )
+        return _DSAParameters(self._backend, dsa_cdata)
+
+    def private_bytes(
+        self,
+        encoding: serialization.Encoding,
+        format: serialization.PrivateFormat,
+        encryption_algorithm: serialization.KeySerializationEncryption,
+    ) -> bytes:
+        return self._backend._private_key_bytes(
+            encoding,
+            format,
+            encryption_algorithm,
+            self,
+            self._evp_pkey,
+            self._dsa_cdata,
+        )
+
+    def sign(
+        self,
+        data: bytes,
+        algorithm: typing.Union[asym_utils.Prehashed, hashes.HashAlgorithm],
+    ) -> bytes:
+        data, algorithm = _calculate_digest_and_algorithm(
+            self._backend, data, algorithm
+        )
+        return _dsa_sig_sign(self._backend, self, data)
+
+
+class _DSAPublicKey(dsa.DSAPublicKey):
+    def __init__(self, backend, dsa_cdata, evp_pkey):
+        self._backend = backend
+        self._dsa_cdata = dsa_cdata
+        self._evp_pkey = evp_pkey
+        p = self._backend._ffi.new("BIGNUM **")
+        self._backend._lib.DSA_get0_pqg(
+            dsa_cdata, p, self._backend._ffi.NULL, self._backend._ffi.NULL
+        )
+        self._backend.openssl_assert(p[0] != backend._ffi.NULL)
+        self._key_size = self._backend._lib.BN_num_bits(p[0])
+
+    key_size = utils.read_only_property("_key_size")
+
+    def verifier(
+        self,
+        signature: bytes,
+        signature_algorithm: hashes.HashAlgorithm,
+    ) -> AsymmetricVerificationContext:
+        _warn_sign_verify_deprecated()
+        utils._check_bytes("signature", signature)
+
+        _check_not_prehashed(signature_algorithm)
+        return _DSAVerificationContext(
+            self._backend, self, signature, signature_algorithm
+        )
+
+    def public_numbers(self) -> dsa.DSAPublicNumbers:
+        p = self._backend._ffi.new("BIGNUM **")
+        q = self._backend._ffi.new("BIGNUM **")
+        g = self._backend._ffi.new("BIGNUM **")
+        pub_key = self._backend._ffi.new("BIGNUM **")
+        self._backend._lib.DSA_get0_pqg(self._dsa_cdata, p, q, g)
+        self._backend.openssl_assert(p[0] != self._backend._ffi.NULL)
+        self._backend.openssl_assert(q[0] != self._backend._ffi.NULL)
+        self._backend.openssl_assert(g[0] != self._backend._ffi.NULL)
+        self._backend._lib.DSA_get0_key(
+            self._dsa_cdata, pub_key, self._backend._ffi.NULL
+        )
+        self._backend.openssl_assert(pub_key[0] != self._backend._ffi.NULL)
+        return dsa.DSAPublicNumbers(
+            parameter_numbers=dsa.DSAParameterNumbers(
+                p=self._backend._bn_to_int(p[0]),
+                q=self._backend._bn_to_int(q[0]),
+                g=self._backend._bn_to_int(g[0]),
+            ),
+            y=self._backend._bn_to_int(pub_key[0]),
+        )
+
+    def parameters(self) -> dsa.DSAParameters:
+        dsa_cdata = self._backend._lib.DSAparams_dup(self._dsa_cdata)
+        dsa_cdata = self._backend._ffi.gc(
+            dsa_cdata, self._backend._lib.DSA_free
+        )
+        return _DSAParameters(self._backend, dsa_cdata)
+
+    def public_bytes(
+        self,
+        encoding: serialization.Encoding,
+        format: serialization.PublicFormat,
+    ) -> bytes:
+        return self._backend._public_key_bytes(
+            encoding, format, self, self._evp_pkey, None
+        )
+
+    def verify(
+        self,
+        signature: bytes,
+        data: bytes,
+        algorithm: typing.Union[asym_utils.Prehashed, hashes.HashAlgorithm],
+    ) -> None:
+        data, algorithm = _calculate_digest_and_algorithm(
+            self._backend, data, algorithm
+        )
+        return _dsa_sig_verify(self._backend, self, signature, data)

asq-env/lib/python3.9/site-packages/cryptography/hazmat/backends/openssl/ec.py

@@ -0,0 +1,367 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+from cryptography import utils
+from cryptography.exceptions import (
+    InvalidSignature,
+    UnsupportedAlgorithm,
+    _Reasons,
+)
+from cryptography.hazmat.backends.openssl.utils import (
+    _calculate_digest_and_algorithm,
+    _check_not_prehashed,
+    _evp_pkey_derive,
+    _warn_sign_verify_deprecated,
+)
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import (
+    AsymmetricSignatureContext,
+    AsymmetricVerificationContext,
+    ec,
+)
+
+
+def _check_signature_algorithm(
+    signature_algorithm: ec.EllipticCurveSignatureAlgorithm,
+):
+    if not isinstance(signature_algorithm, ec.ECDSA):
+        raise UnsupportedAlgorithm(
+            "Unsupported elliptic curve signature algorithm.",
+            _Reasons.UNSUPPORTED_PUBLIC_KEY_ALGORITHM,
+        )
+
+
+def _ec_key_curve_sn(backend, ec_key):
+    group = backend._lib.EC_KEY_get0_group(ec_key)
+    backend.openssl_assert(group != backend._ffi.NULL)
+
+    nid = backend._lib.EC_GROUP_get_curve_name(group)
+    # The following check is to find EC keys with unnamed curves and raise
+    # an error for now.
+    if nid == backend._lib.NID_undef:
+        raise NotImplementedError(
+            "ECDSA keys with unnamed curves are unsupported at this time"
+        )
+
+    # This is like the above check, but it also catches the case where you
+    # explicitly encoded a curve with the same parameters as a named curve.
+    # Don't do that.
+    if (
+        not backend._lib.CRYPTOGRAPHY_IS_LIBRESSL
+        and backend._lib.EC_GROUP_get_asn1_flag(group) == 0
+    ):
+        raise NotImplementedError(
+            "ECDSA keys with unnamed curves are unsupported at this time"
+        )
+
+    curve_name = backend._lib.OBJ_nid2sn(nid)
+    backend.openssl_assert(curve_name != backend._ffi.NULL)
+
+    sn = backend._ffi.string(curve_name).decode("ascii")
+    return sn
+
+
+def _mark_asn1_named_ec_curve(backend, ec_cdata):
+    """
+    Set the named curve flag on the EC_KEY. This causes OpenSSL to
+    serialize EC keys along with their curve OID which makes
+    deserialization easier.
+    """
+
+    backend._lib.EC_KEY_set_asn1_flag(
+        ec_cdata, backend._lib.OPENSSL_EC_NAMED_CURVE
+    )
+
+
+def _sn_to_elliptic_curve(backend, sn):
+    try:
+        return ec._CURVE_TYPES[sn]()
+    except KeyError:
+        raise UnsupportedAlgorithm(
+            "{} is not a supported elliptic curve".format(sn),
+            _Reasons.UNSUPPORTED_ELLIPTIC_CURVE,
+        )
+
+
+def _ecdsa_sig_sign(backend, private_key, data):
+    max_size = backend._lib.ECDSA_size(private_key._ec_key)
+    backend.openssl_assert(max_size > 0)
+
+    sigbuf = backend._ffi.new("unsigned char[]", max_size)
+    siglen_ptr = backend._ffi.new("unsigned int[]", 1)
+    res = backend._lib.ECDSA_sign(
+        0, data, len(data), sigbuf, siglen_ptr, private_key._ec_key
+    )
+    backend.openssl_assert(res == 1)
+    return backend._ffi.buffer(sigbuf)[: siglen_ptr[0]]
+
+
+def _ecdsa_sig_verify(backend, public_key, signature, data):
+    res = backend._lib.ECDSA_verify(
+        0, data, len(data), signature, len(signature), public_key._ec_key
+    )
+    if res != 1:
+        backend._consume_errors()
+        raise InvalidSignature
+
+
+class _ECDSASignatureContext(AsymmetricSignatureContext):
+    def __init__(
+        self,
+        backend,
+        private_key: ec.EllipticCurvePrivateKey,
+        algorithm: hashes.HashAlgorithm,
+    ):
+        self._backend = backend
+        self._private_key = private_key
+        self._digest = hashes.Hash(algorithm, backend)
+
+    def update(self, data: bytes) -> None:
+        self._digest.update(data)
+
+    def finalize(self) -> bytes:
+        digest = self._digest.finalize()
+
+        return _ecdsa_sig_sign(self._backend, self._private_key, digest)
+
+
+class _ECDSAVerificationContext(AsymmetricVerificationContext):
+    def __init__(
+        self,
+        backend,
+        public_key: ec.EllipticCurvePublicKey,
+        signature: bytes,
+        algorithm: hashes.HashAlgorithm,
+    ):
+        self._backend = backend
+        self._public_key = public_key
+        self._signature = signature
+        self._digest = hashes.Hash(algorithm, backend)
+
+    def update(self, data: bytes) -> None:
+        self._digest.update(data)
+
+    def verify(self) -> None:
+        digest = self._digest.finalize()
+        _ecdsa_sig_verify(
+            self._backend, self._public_key, self._signature, digest
+        )
+
+
+class _EllipticCurvePrivateKey(ec.EllipticCurvePrivateKey):
+    def __init__(self, backend, ec_key_cdata, evp_pkey):
+        self._backend = backend
+        self._ec_key = ec_key_cdata
+        self._evp_pkey = evp_pkey
+
+        sn = _ec_key_curve_sn(backend, ec_key_cdata)
+        self._curve = _sn_to_elliptic_curve(backend, sn)
+        _mark_asn1_named_ec_curve(backend, ec_key_cdata)
+
+    curve = utils.read_only_property("_curve")
+
+    @property
+    def key_size(self) -> int:
+        return self.curve.key_size
+
+    def signer(
+        self, signature_algorithm: ec.EllipticCurveSignatureAlgorithm
+    ) -> AsymmetricSignatureContext:
+        _warn_sign_verify_deprecated()
+        _check_signature_algorithm(signature_algorithm)
+        _check_not_prehashed(signature_algorithm.algorithm)
+        # This assert is to help mypy realize what type this object holds
+        assert isinstance(signature_algorithm.algorithm, hashes.HashAlgorithm)
+        return _ECDSASignatureContext(
+            self._backend, self, signature_algorithm.algorithm
+        )
+
+    def exchange(
+        self, algorithm: ec.ECDH, peer_public_key: ec.EllipticCurvePublicKey
+    ) -> bytes:
+        if not (
+            self._backend.elliptic_curve_exchange_algorithm_supported(
+                algorithm, self.curve
+            )
+        ):
+            raise UnsupportedAlgorithm(
+                "This backend does not support the ECDH algorithm.",
+                _Reasons.UNSUPPORTED_EXCHANGE_ALGORITHM,
+            )
+
+        if peer_public_key.curve.name != self.curve.name:
+            raise ValueError(
+                "peer_public_key and self are not on the same curve"
+            )
+
+        return _evp_pkey_derive(self._backend, self._evp_pkey, peer_public_key)
+
+    def public_key(self) -> ec.EllipticCurvePublicKey:
+        group = self._backend._lib.EC_KEY_get0_group(self._ec_key)
+        self._backend.openssl_assert(group != self._backend._ffi.NULL)
+
+        curve_nid = self._backend._lib.EC_GROUP_get_curve_name(group)
+        public_ec_key = self._backend._ec_key_new_by_curve_nid(curve_nid)
+
+        point = self._backend._lib.EC_KEY_get0_public_key(self._ec_key)
+        self._backend.openssl_assert(point != self._backend._ffi.NULL)
+
+        res = self._backend._lib.EC_KEY_set_public_key(public_ec_key, point)
+        self._backend.openssl_assert(res == 1)
+
+        evp_pkey = self._backend._ec_cdata_to_evp_pkey(public_ec_key)
+
+        return _EllipticCurvePublicKey(self._backend, public_ec_key, evp_pkey)
+
+    def private_numbers(self) -> ec.EllipticCurvePrivateNumbers:
+        bn = self._backend._lib.EC_KEY_get0_private_key(self._ec_key)
+        private_value = self._backend._bn_to_int(bn)
+        return ec.EllipticCurvePrivateNumbers(
+            private_value=private_value,
+            public_numbers=self.public_key().public_numbers(),
+        )
+
+    def private_bytes(
+        self,
+        encoding: serialization.Encoding,
+        format: serialization.PrivateFormat,
+        encryption_algorithm: serialization.KeySerializationEncryption,
+    ) -> bytes:
+        return self._backend._private_key_bytes(
+            encoding,
+            format,
+            encryption_algorithm,
+            self,
+            self._evp_pkey,
+            self._ec_key,
+        )
+
+    def sign(
+        self,
+        data: bytes,
+        signature_algorithm: ec.EllipticCurveSignatureAlgorithm,
+    ) -> bytes:
+        _check_signature_algorithm(signature_algorithm)
+        data, algorithm = _calculate_digest_and_algorithm(
+            self._backend,
+            data,
+            signature_algorithm._algorithm,  # type: ignore[attr-defined]
+        )
+        return _ecdsa_sig_sign(self._backend, self, data)
+
+
+class _EllipticCurvePublicKey(ec.EllipticCurvePublicKey):
+    def __init__(self, backend, ec_key_cdata, evp_pkey):
+        self._backend = backend
+        self._ec_key = ec_key_cdata
+        self._evp_pkey = evp_pkey
+
+        sn = _ec_key_curve_sn(backend, ec_key_cdata)
+        self._curve = _sn_to_elliptic_curve(backend, sn)
+        _mark_asn1_named_ec_curve(backend, ec_key_cdata)
+
+    curve = utils.read_only_property("_curve")
+
+    @property
+    def key_size(self) -> int:
+        return self.curve.key_size
+
+    def verifier(
+        self,
+        signature: bytes,
+        signature_algorithm: ec.EllipticCurveSignatureAlgorithm,
+    ) -> AsymmetricVerificationContext:
+        _warn_sign_verify_deprecated()
+        utils._check_bytes("signature", signature)
+
+        _check_signature_algorithm(signature_algorithm)
+        _check_not_prehashed(signature_algorithm.algorithm)
+        # This assert is to help mypy realize what type this object holds
+        assert isinstance(signature_algorithm.algorithm, hashes.HashAlgorithm)
+        return _ECDSAVerificationContext(
+            self._backend, self, signature, signature_algorithm.algorithm
+        )
+
+    def public_numbers(self) -> ec.EllipticCurvePublicNumbers:
+        get_func, group = self._backend._ec_key_determine_group_get_func(
+            self._ec_key
+        )
+        point = self._backend._lib.EC_KEY_get0_public_key(self._ec_key)
+        self._backend.openssl_assert(point != self._backend._ffi.NULL)
+
+        with self._backend._tmp_bn_ctx() as bn_ctx:
+            bn_x = self._backend._lib.BN_CTX_get(bn_ctx)
+            bn_y = self._backend._lib.BN_CTX_get(bn_ctx)
+
+            res = get_func(group, point, bn_x, bn_y, bn_ctx)
+            self._backend.openssl_assert(res == 1)
+
+            x = self._backend._bn_to_int(bn_x)
+            y = self._backend._bn_to_int(bn_y)
+
+        return ec.EllipticCurvePublicNumbers(x=x, y=y, curve=self._curve)
+
+    def _encode_point(self, format: serialization.PublicFormat) -> bytes:
+        if format is serialization.PublicFormat.CompressedPoint:
+            conversion = self._backend._lib.POINT_CONVERSION_COMPRESSED
+        else:
+            assert format is serialization.PublicFormat.UncompressedPoint
+            conversion = self._backend._lib.POINT_CONVERSION_UNCOMPRESSED
+
+        group = self._backend._lib.EC_KEY_get0_group(self._ec_key)
+        self._backend.openssl_assert(group != self._backend._ffi.NULL)
+        point = self._backend._lib.EC_KEY_get0_public_key(self._ec_key)
+        self._backend.openssl_assert(point != self._backend._ffi.NULL)
+        with self._backend._tmp_bn_ctx() as bn_ctx:
+            buflen = self._backend._lib.EC_POINT_point2oct(
+                group, point, conversion, self._backend._ffi.NULL, 0, bn_ctx
+            )
+            self._backend.openssl_assert(buflen > 0)
+            buf = self._backend._ffi.new("char[]", buflen)
+            res = self._backend._lib.EC_POINT_point2oct(
+                group, point, conversion, buf, buflen, bn_ctx
+            )
+            self._backend.openssl_assert(buflen == res)
+
+        return self._backend._ffi.buffer(buf)[:]
+
+    def public_bytes(
+        self,
+        encoding: serialization.Encoding,
+        format: serialization.PublicFormat,
+    ) -> bytes:
+        if (
+            encoding is serialization.Encoding.X962
+            or format is serialization.PublicFormat.CompressedPoint
+            or format is serialization.PublicFormat.UncompressedPoint
+        ):
+            if encoding is not serialization.Encoding.X962 or format not in (
+                serialization.PublicFormat.CompressedPoint,
+                serialization.PublicFormat.UncompressedPoint,
+            ):
+                raise ValueError(
+                    "X962 encoding must be used with CompressedPoint or "
+                    "UncompressedPoint format"
+                )
+
+            return self._encode_point(format)
+        else:
+            return self._backend._public_key_bytes(
+                encoding, format, self, self._evp_pkey, None
+            )
+
+    def verify(
+        self,
+        signature: bytes,
+        data: bytes,
+        signature_algorithm: ec.EllipticCurveSignatureAlgorithm,
+    ) -> None:
+        _check_signature_algorithm(signature_algorithm)
+        data, algorithm = _calculate_digest_and_algorithm(
+            self._backend,
+            data,
+            signature_algorithm._algorithm,  # type: ignore[attr-defined]
+        )
+        _ecdsa_sig_verify(self._backend, self, signature, data)

asq-env/lib/python3.9/site-packages/cryptography/hazmat/backends/openssl/ed25519.py

@@ -0,0 +1,151 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+from cryptography import exceptions
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric.ed25519 import (
+    Ed25519PrivateKey,
+    Ed25519PublicKey,
+    _ED25519_KEY_SIZE,
+    _ED25519_SIG_SIZE,
+)
+
+
+class _Ed25519PublicKey(Ed25519PublicKey):
+    def __init__(self, backend, evp_pkey):
+        self._backend = backend
+        self._evp_pkey = evp_pkey
+
+    def public_bytes(
+        self,
+        encoding: serialization.Encoding,
+        format: serialization.PublicFormat,
+    ) -> bytes:
+        if (
+            encoding is serialization.Encoding.Raw
+            or format is serialization.PublicFormat.Raw
+        ):
+            if (
+                encoding is not serialization.Encoding.Raw
+                or format is not serialization.PublicFormat.Raw
+            ):
+                raise ValueError(
+                    "When using Raw both encoding and format must be Raw"
+                )
+
+            return self._raw_public_bytes()
+
+        return self._backend._public_key_bytes(
+            encoding, format, self, self._evp_pkey, None
+        )
+
+    def _raw_public_bytes(self) -> bytes:
+        buf = self._backend._ffi.new("unsigned char []", _ED25519_KEY_SIZE)
+        buflen = self._backend._ffi.new("size_t *", _ED25519_KEY_SIZE)
+        res = self._backend._lib.EVP_PKEY_get_raw_public_key(
+            self._evp_pkey, buf, buflen
+        )
+        self._backend.openssl_assert(res == 1)
+        self._backend.openssl_assert(buflen[0] == _ED25519_KEY_SIZE)
+        return self._backend._ffi.buffer(buf, _ED25519_KEY_SIZE)[:]
+
+    def verify(self, signature: bytes, data: bytes) -> None:
+        evp_md_ctx = self._backend._lib.EVP_MD_CTX_new()
+        self._backend.openssl_assert(evp_md_ctx != self._backend._ffi.NULL)
+        evp_md_ctx = self._backend._ffi.gc(
+            evp_md_ctx, self._backend._lib.EVP_MD_CTX_free
+        )
+        res = self._backend._lib.EVP_DigestVerifyInit(
+            evp_md_ctx,
+            self._backend._ffi.NULL,
+            self._backend._ffi.NULL,
+            self._backend._ffi.NULL,
+            self._evp_pkey,
+        )
+        self._backend.openssl_assert(res == 1)
+        res = self._backend._lib.EVP_DigestVerify(
+            evp_md_ctx, signature, len(signature), data, len(data)
+        )
+        if res != 1:
+            self._backend._consume_errors()
+            raise exceptions.InvalidSignature
+
+
+class _Ed25519PrivateKey(Ed25519PrivateKey):
+    def __init__(self, backend, evp_pkey):
+        self._backend = backend
+        self._evp_pkey = evp_pkey
+
+    def public_key(self) -> Ed25519PublicKey:
+        buf = self._backend._ffi.new("unsigned char []", _ED25519_KEY_SIZE)
+        buflen = self._backend._ffi.new("size_t *", _ED25519_KEY_SIZE)
+        res = self._backend._lib.EVP_PKEY_get_raw_public_key(
+            self._evp_pkey, buf, buflen
+        )
+        self._backend.openssl_assert(res == 1)
+        self._backend.openssl_assert(buflen[0] == _ED25519_KEY_SIZE)
+        public_bytes = self._backend._ffi.buffer(buf)[:]
+        return self._backend.ed25519_load_public_bytes(public_bytes)
+
+    def sign(self, data: bytes) -> bytes:
+        evp_md_ctx = self._backend._lib.EVP_MD_CTX_new()
+        self._backend.openssl_assert(evp_md_ctx != self._backend._ffi.NULL)
+        evp_md_ctx = self._backend._ffi.gc(
+            evp_md_ctx, self._backend._lib.EVP_MD_CTX_free
+        )
+        res = self._backend._lib.EVP_DigestSignInit(
+            evp_md_ctx,
+            self._backend._ffi.NULL,
+            self._backend._ffi.NULL,
+            self._backend._ffi.NULL,
+            self._evp_pkey,
+        )
+        self._backend.openssl_assert(res == 1)
+        buf = self._backend._ffi.new("unsigned char[]", _ED25519_SIG_SIZE)
+        buflen = self._backend._ffi.new("size_t *", len(buf))
+        res = self._backend._lib.EVP_DigestSign(
+            evp_md_ctx, buf, buflen, data, len(data)
+        )
+        self._backend.openssl_assert(res == 1)
+        self._backend.openssl_assert(buflen[0] == _ED25519_SIG_SIZE)
+        return self._backend._ffi.buffer(buf, buflen[0])[:]
+
+    def private_bytes(
+        self,
+        encoding: serialization.Encoding,
+        format: serialization.PrivateFormat,
+        encryption_algorithm: serialization.KeySerializationEncryption,
+    ) -> bytes:
+        if (
+            encoding is serialization.Encoding.Raw
+            or format is serialization.PublicFormat.Raw
+        ):
+            if (
+                format is not serialization.PrivateFormat.Raw
+                or encoding is not serialization.Encoding.Raw
+                or not isinstance(
+                    encryption_algorithm, serialization.NoEncryption
+                )
+            ):
+                raise ValueError(
+                    "When using Raw both encoding and format must be Raw "
+                    "and encryption_algorithm must be NoEncryption()"
+                )
+
+            return self._raw_private_bytes()
+
+        return self._backend._private_key_bytes(
+            encoding, format, encryption_algorithm, self, self._evp_pkey, None
+        )
+
+    def _raw_private_bytes(self) -> bytes:
+        buf = self._backend._ffi.new("unsigned char []", _ED25519_KEY_SIZE)
+        buflen = self._backend._ffi.new("size_t *", _ED25519_KEY_SIZE)
+        res = self._backend._lib.EVP_PKEY_get_raw_private_key(
+            self._evp_pkey, buf, buflen
+        )
+        self._backend.openssl_assert(res == 1)
+        self._backend.openssl_assert(buflen[0] == _ED25519_KEY_SIZE)
+        return self._backend._ffi.buffer(buf, _ED25519_KEY_SIZE)[:]

asq-env/lib/python3.9/site-packages/cryptography/hazmat/backends/openssl/ed448.py

@@ -0,0 +1,152 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+from cryptography import exceptions
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric.ed448 import (
+    Ed448PrivateKey,
+    Ed448PublicKey,
+)
+
+_ED448_KEY_SIZE = 57
+_ED448_SIG_SIZE = 114
+
+
+class _Ed448PublicKey(Ed448PublicKey):
+    def __init__(self, backend, evp_pkey):
+        self._backend = backend
+        self._evp_pkey = evp_pkey
+
+    def public_bytes(
+        self,
+        encoding: serialization.Encoding,
+        format: serialization.PublicFormat,
+    ) -> bytes:
+        if (
+            encoding is serialization.Encoding.Raw
+            or format is serialization.PublicFormat.Raw
+        ):
+            if (
+                encoding is not serialization.Encoding.Raw
+                or format is not serialization.PublicFormat.Raw
+            ):
+                raise ValueError(
+                    "When using Raw both encoding and format must be Raw"
+                )
+
+            return self._raw_public_bytes()
+
+        return self._backend._public_key_bytes(
+            encoding, format, self, self._evp_pkey, None
+        )
+
+    def _raw_public_bytes(self) -> bytes:
+        buf = self._backend._ffi.new("unsigned char []", _ED448_KEY_SIZE)
+        buflen = self._backend._ffi.new("size_t *", _ED448_KEY_SIZE)
+        res = self._backend._lib.EVP_PKEY_get_raw_public_key(
+            self._evp_pkey, buf, buflen
+        )
+        self._backend.openssl_assert(res == 1)
+        self._backend.openssl_assert(buflen[0] == _ED448_KEY_SIZE)
+        return self._backend._ffi.buffer(buf, _ED448_KEY_SIZE)[:]
+
+    def verify(self, signature: bytes, data: bytes) -> None:
+        evp_md_ctx = self._backend._lib.EVP_MD_CTX_new()
+        self._backend.openssl_assert(evp_md_ctx != self._backend._ffi.NULL)
+        evp_md_ctx = self._backend._ffi.gc(
+            evp_md_ctx, self._backend._lib.EVP_MD_CTX_free
+        )
+        res = self._backend._lib.EVP_DigestVerifyInit(
+            evp_md_ctx,
+            self._backend._ffi.NULL,
+            self._backend._ffi.NULL,
+            self._backend._ffi.NULL,
+            self._evp_pkey,
+        )
+        self._backend.openssl_assert(res == 1)
+        res = self._backend._lib.EVP_DigestVerify(
+            evp_md_ctx, signature, len(signature), data, len(data)
+        )
+        if res != 1:
+            self._backend._consume_errors()
+            raise exceptions.InvalidSignature
+
+
+class _Ed448PrivateKey(Ed448PrivateKey):
+    def __init__(self, backend, evp_pkey):
+        self._backend = backend
+        self._evp_pkey = evp_pkey
+
+    def public_key(self) -> Ed448PublicKey:
+        buf = self._backend._ffi.new("unsigned char []", _ED448_KEY_SIZE)
+        buflen = self._backend._ffi.new("size_t *", _ED448_KEY_SIZE)
+        res = self._backend._lib.EVP_PKEY_get_raw_public_key(
+            self._evp_pkey, buf, buflen
+        )
+        self._backend.openssl_assert(res == 1)
+        self._backend.openssl_assert(buflen[0] == _ED448_KEY_SIZE)
+        public_bytes = self._backend._ffi.buffer(buf)[:]
+        return self._backend.ed448_load_public_bytes(public_bytes)
+
+    def sign(self, data: bytes) -> bytes:
+        evp_md_ctx = self._backend._lib.EVP_MD_CTX_new()
+        self._backend.openssl_assert(evp_md_ctx != self._backend._ffi.NULL)
+        evp_md_ctx = self._backend._ffi.gc(
+            evp_md_ctx, self._backend._lib.EVP_MD_CTX_free
+        )
+        res = self._backend._lib.EVP_DigestSignInit(
+            evp_md_ctx,
+            self._backend._ffi.NULL,
+            self._backend._ffi.NULL,
+            self._backend._ffi.NULL,
+            self._evp_pkey,
+        )
+        self._backend.openssl_assert(res == 1)
+        buf = self._backend._ffi.new("unsigned char[]", _ED448_SIG_SIZE)
+        buflen = self._backend._ffi.new("size_t *", len(buf))
+        res = self._backend._lib.EVP_DigestSign(
+            evp_md_ctx, buf, buflen, data, len(data)
+        )
+        self._backend.openssl_assert(res == 1)
+        self._backend.openssl_assert(buflen[0] == _ED448_SIG_SIZE)
+        return self._backend._ffi.buffer(buf, buflen[0])[:]
+
+    def private_bytes(
+        self,
+        encoding: serialization.Encoding,
+        format: serialization.PrivateFormat,
+        encryption_algorithm: serialization.KeySerializationEncryption,
+    ) -> bytes:
+        if (
+            encoding is serialization.Encoding.Raw
+            or format is serialization.PublicFormat.Raw
+        ):
+            if (
+                format is not serialization.PrivateFormat.Raw
+                or encoding is not serialization.Encoding.Raw
+                or not isinstance(
+                    encryption_algorithm, serialization.NoEncryption
+                )
+            ):
+                raise ValueError(
+                    "When using Raw both encoding and format must be Raw "
+                    "and encryption_algorithm must be NoEncryption()"
+                )
+
+            return self._raw_private_bytes()
+
+        return self._backend._private_key_bytes(
+            encoding, format, encryption_algorithm, self, self._evp_pkey, None
+        )
+
+    def _raw_private_bytes(self) -> bytes:
+        buf = self._backend._ffi.new("unsigned char []", _ED448_KEY_SIZE)
+        buflen = self._backend._ffi.new("size_t *", _ED448_KEY_SIZE)
+        res = self._backend._lib.EVP_PKEY_get_raw_private_key(
+            self._evp_pkey, buf, buflen
+        )
+        self._backend.openssl_assert(res == 1)
+        self._backend.openssl_assert(buflen[0] == _ED448_KEY_SIZE)
+        return self._backend._ffi.buffer(buf, _ED448_KEY_SIZE)[:]

asq-env/lib/python3.9/site-packages/cryptography/hazmat/backends/openssl/encode_asn1.py

@@ -0,0 +1,654 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+import calendar
+import ipaddress
+
+from cryptography import utils, x509
+from cryptography.hazmat.backends.openssl.decode_asn1 import (
+    _CRL_ENTRY_REASON_ENUM_TO_CODE,
+    _DISTPOINT_TYPE_FULLNAME,
+    _DISTPOINT_TYPE_RELATIVENAME,
+)
+from cryptography.x509.name import _ASN1Type
+from cryptography.x509.oid import (
+    CRLEntryExtensionOID,
+    ExtensionOID,
+    OCSPExtensionOID,
+)
+
+
+def _encode_asn1_int(backend, x):
+    """
+    Converts a python integer to an ASN1_INTEGER. The returned ASN1_INTEGER
+    will not be garbage collected (to support adding them to structs that take
+    ownership of the object). Be sure to register it for GC if it will be
+    discarded after use.
+
+    """
+    # Convert Python integer to OpenSSL "bignum" in case value exceeds
+    # machine's native integer limits (note: `int_to_bn` doesn't automatically
+    # GC).
+    i = backend._int_to_bn(x)
+    i = backend._ffi.gc(i, backend._lib.BN_free)
+
+    # Wrap in an ASN.1 integer.  Don't GC -- as documented.
+    i = backend._lib.BN_to_ASN1_INTEGER(i, backend._ffi.NULL)
+    backend.openssl_assert(i != backend._ffi.NULL)
+    return i
+
+
+def _encode_asn1_int_gc(backend, x):
+    i = _encode_asn1_int(backend, x)
+    i = backend._ffi.gc(i, backend._lib.ASN1_INTEGER_free)
+    return i
+
+
+def _encode_asn1_str(backend, data):
+    """
+    Create an ASN1_OCTET_STRING from a Python byte string.
+    """
+    s = backend._lib.ASN1_OCTET_STRING_new()
+    res = backend._lib.ASN1_OCTET_STRING_set(s, data, len(data))
+    backend.openssl_assert(res == 1)
+    return s
+
+
+def _encode_asn1_utf8_str(backend, string):
+    """
+    Create an ASN1_UTF8STRING from a Python unicode string.
+    This object will be an ASN1_STRING with UTF8 type in OpenSSL and
+    can be decoded with ASN1_STRING_to_UTF8.
+    """
+    s = backend._lib.ASN1_UTF8STRING_new()
+    res = backend._lib.ASN1_STRING_set(
+        s, string.encode("utf8"), len(string.encode("utf8"))
+    )
+    backend.openssl_assert(res == 1)
+    return s
+
+
+def _encode_asn1_str_gc(backend, data):
+    s = _encode_asn1_str(backend, data)
+    s = backend._ffi.gc(s, backend._lib.ASN1_OCTET_STRING_free)
+    return s
+
+
+def _encode_inhibit_any_policy(backend, inhibit_any_policy):
+    return _encode_asn1_int_gc(backend, inhibit_any_policy.skip_certs)
+
+
+def _encode_name(backend, name):
+    """
+    The X509_NAME created will not be gc'd. Use _encode_name_gc if needed.
+    """
+    subject = backend._lib.X509_NAME_new()
+    for rdn in name.rdns:
+        set_flag = 0  # indicate whether to add to last RDN or create new RDN
+        for attribute in rdn:
+            name_entry = _encode_name_entry(backend, attribute)
+            # X509_NAME_add_entry dups the object so we need to gc this copy
+            name_entry = backend._ffi.gc(
+                name_entry, backend._lib.X509_NAME_ENTRY_free
+            )
+            res = backend._lib.X509_NAME_add_entry(
+                subject, name_entry, -1, set_flag
+            )
+            backend.openssl_assert(res == 1)
+            set_flag = -1
+    return subject
+
+
+def _encode_name_gc(backend, attributes):
+    subject = _encode_name(backend, attributes)
+    subject = backend._ffi.gc(subject, backend._lib.X509_NAME_free)
+    return subject
+
+
+def _encode_sk_name_entry(backend, attributes):
+    """
+    The sk_X509_NAME_ENTRY created will not be gc'd.
+    """
+    stack = backend._lib.sk_X509_NAME_ENTRY_new_null()
+    for attribute in attributes:
+        name_entry = _encode_name_entry(backend, attribute)
+        res = backend._lib.sk_X509_NAME_ENTRY_push(stack, name_entry)
+        backend.openssl_assert(res >= 1)
+    return stack
+
+
+def _encode_name_entry(backend, attribute):
+    if attribute._type is _ASN1Type.BMPString:
+        value = attribute.value.encode("utf_16_be")
+    elif attribute._type is _ASN1Type.UniversalString:
+        value = attribute.value.encode("utf_32_be")
+    else:
+        value = attribute.value.encode("utf8")
+
+    obj = _txt2obj_gc(backend, attribute.oid.dotted_string)
+
+    name_entry = backend._lib.X509_NAME_ENTRY_create_by_OBJ(
+        backend._ffi.NULL, obj, attribute._type.value, value, len(value)
+    )
+    return name_entry
+
+
+def _encode_crl_number_delta_crl_indicator(backend, ext):
+    return _encode_asn1_int_gc(backend, ext.crl_number)
+
+
+def _encode_issuing_dist_point(backend, ext):
+    idp = backend._lib.ISSUING_DIST_POINT_new()
+    backend.openssl_assert(idp != backend._ffi.NULL)
+    idp = backend._ffi.gc(idp, backend._lib.ISSUING_DIST_POINT_free)
+    idp.onlyuser = 255 if ext.only_contains_user_certs else 0
+    idp.onlyCA = 255 if ext.only_contains_ca_certs else 0
+    idp.indirectCRL = 255 if ext.indirect_crl else 0
+    idp.onlyattr = 255 if ext.only_contains_attribute_certs else 0
+    if ext.only_some_reasons:
+        idp.onlysomereasons = _encode_reasonflags(
+            backend, ext.only_some_reasons
+        )
+
+    if ext.full_name:
+        idp.distpoint = _encode_full_name(backend, ext.full_name)
+
+    if ext.relative_name:
+        idp.distpoint = _encode_relative_name(backend, ext.relative_name)
+
+    return idp
+
+
+def _encode_crl_reason(backend, crl_reason):
+    asn1enum = backend._lib.ASN1_ENUMERATED_new()
+    backend.openssl_assert(asn1enum != backend._ffi.NULL)
+    asn1enum = backend._ffi.gc(asn1enum, backend._lib.ASN1_ENUMERATED_free)
+    res = backend._lib.ASN1_ENUMERATED_set(
+        asn1enum, _CRL_ENTRY_REASON_ENUM_TO_CODE[crl_reason.reason]
+    )
+    backend.openssl_assert(res == 1)
+
+    return asn1enum
+
+
+def _encode_invalidity_date(backend, invalidity_date):
+    time = backend._lib.ASN1_GENERALIZEDTIME_set(
+        backend._ffi.NULL,
+        calendar.timegm(invalidity_date.invalidity_date.timetuple()),
+    )
+    backend.openssl_assert(time != backend._ffi.NULL)
+    time = backend._ffi.gc(time, backend._lib.ASN1_GENERALIZEDTIME_free)
+
+    return time
+
+
+def _encode_certificate_policies(backend, certificate_policies):
+    cp = backend._lib.sk_POLICYINFO_new_null()
+    backend.openssl_assert(cp != backend._ffi.NULL)
+    cp = backend._ffi.gc(cp, backend._lib.sk_POLICYINFO_free)
+    for policy_info in certificate_policies:
+        pi = backend._lib.POLICYINFO_new()
+        backend.openssl_assert(pi != backend._ffi.NULL)
+        res = backend._lib.sk_POLICYINFO_push(cp, pi)
+        backend.openssl_assert(res >= 1)
+        oid = _txt2obj(backend, policy_info.policy_identifier.dotted_string)
+        pi.policyid = oid
+        if policy_info.policy_qualifiers:
+            pqis = backend._lib.sk_POLICYQUALINFO_new_null()
+            backend.openssl_assert(pqis != backend._ffi.NULL)
+            for qualifier in policy_info.policy_qualifiers:
+                pqi = backend._lib.POLICYQUALINFO_new()
+                backend.openssl_assert(pqi != backend._ffi.NULL)
+                res = backend._lib.sk_POLICYQUALINFO_push(pqis, pqi)
+                backend.openssl_assert(res >= 1)
+                if isinstance(qualifier, str):
+                    pqi.pqualid = _txt2obj(
+                        backend, x509.OID_CPS_QUALIFIER.dotted_string
+                    )
+                    pqi.d.cpsuri = _encode_asn1_str(
+                        backend,
+                        qualifier.encode("ascii"),
+                    )
+                else:
+                    assert isinstance(qualifier, x509.UserNotice)
+                    pqi.pqualid = _txt2obj(
+                        backend, x509.OID_CPS_USER_NOTICE.dotted_string
+                    )
+                    un = backend._lib.USERNOTICE_new()
+                    backend.openssl_assert(un != backend._ffi.NULL)
+                    pqi.d.usernotice = un
+                    if qualifier.explicit_text:
+                        un.exptext = _encode_asn1_utf8_str(
+                            backend, qualifier.explicit_text
+                        )
+
+                    un.noticeref = _encode_notice_reference(
+                        backend, qualifier.notice_reference
+                    )
+
+            pi.qualifiers = pqis
+
+    return cp
+
+
+def _encode_notice_reference(backend, notice):
+    if notice is None:
+        return backend._ffi.NULL
+    else:
+        nr = backend._lib.NOTICEREF_new()
+        backend.openssl_assert(nr != backend._ffi.NULL)
+        # organization is a required field
+        nr.organization = _encode_asn1_utf8_str(backend, notice.organization)
+
+        notice_stack = backend._lib.sk_ASN1_INTEGER_new_null()
+        nr.noticenos = notice_stack
+        for number in notice.notice_numbers:
+            num = _encode_asn1_int(backend, number)
+            res = backend._lib.sk_ASN1_INTEGER_push(notice_stack, num)
+            backend.openssl_assert(res >= 1)
+
+        return nr
+
+
+def _txt2obj(backend, name):
+    """
+    Converts a Python string with an ASN.1 object ID in dotted form to a
+    ASN1_OBJECT.
+    """
+    name = name.encode("ascii")
+    obj = backend._lib.OBJ_txt2obj(name, 1)
+    backend.openssl_assert(obj != backend._ffi.NULL)
+    return obj
+
+
+def _txt2obj_gc(backend, name):
+    obj = _txt2obj(backend, name)
+    obj = backend._ffi.gc(obj, backend._lib.ASN1_OBJECT_free)
+    return obj
+
+
+def _encode_ocsp_nocheck(backend, ext):
+    # Doesn't need to be GC'd
+    return backend._lib.ASN1_NULL_new()
+
+
+def _encode_key_usage(backend, key_usage):
+    set_bit = backend._lib.ASN1_BIT_STRING_set_bit
+    ku = backend._lib.ASN1_BIT_STRING_new()
+    ku = backend._ffi.gc(ku, backend._lib.ASN1_BIT_STRING_free)
+    res = set_bit(ku, 0, key_usage.digital_signature)
+    backend.openssl_assert(res == 1)
+    res = set_bit(ku, 1, key_usage.content_commitment)
+    backend.openssl_assert(res == 1)
+    res = set_bit(ku, 2, key_usage.key_encipherment)
+    backend.openssl_assert(res == 1)
+    res = set_bit(ku, 3, key_usage.data_encipherment)
+    backend.openssl_assert(res == 1)
+    res = set_bit(ku, 4, key_usage.key_agreement)
+    backend.openssl_assert(res == 1)
+    res = set_bit(ku, 5, key_usage.key_cert_sign)
+    backend.openssl_assert(res == 1)
+    res = set_bit(ku, 6, key_usage.crl_sign)
+    backend.openssl_assert(res == 1)
+    if key_usage.key_agreement:
+        res = set_bit(ku, 7, key_usage.encipher_only)
+        backend.openssl_assert(res == 1)
+        res = set_bit(ku, 8, key_usage.decipher_only)
+        backend.openssl_assert(res == 1)
+    else:
+        res = set_bit(ku, 7, 0)
+        backend.openssl_assert(res == 1)
+        res = set_bit(ku, 8, 0)
+        backend.openssl_assert(res == 1)
+
+    return ku
+
+
+def _encode_authority_key_identifier(backend, authority_keyid):
+    akid = backend._lib.AUTHORITY_KEYID_new()
+    backend.openssl_assert(akid != backend._ffi.NULL)
+    akid = backend._ffi.gc(akid, backend._lib.AUTHORITY_KEYID_free)
+    if authority_keyid.key_identifier is not None:
+        akid.keyid = _encode_asn1_str(
+            backend,
+            authority_keyid.key_identifier,
+        )
+
+    if authority_keyid.authority_cert_issuer is not None:
+        akid.issuer = _encode_general_names(
+            backend, authority_keyid.authority_cert_issuer
+        )
+
+    if authority_keyid.authority_cert_serial_number is not None:
+        akid.serial = _encode_asn1_int(
+            backend, authority_keyid.authority_cert_serial_number
+        )
+
+    return akid
+
+
+def _encode_basic_constraints(backend, basic_constraints):
+    constraints = backend._lib.BASIC_CONSTRAINTS_new()
+    constraints = backend._ffi.gc(
+        constraints, backend._lib.BASIC_CONSTRAINTS_free
+    )
+    constraints.ca = 255 if basic_constraints.ca else 0
+    if basic_constraints.ca and basic_constraints.path_length is not None:
+        constraints.pathlen = _encode_asn1_int(
+            backend, basic_constraints.path_length
+        )
+
+    return constraints
+
+
+def _encode_information_access(backend, info_access):
+    aia = backend._lib.sk_ACCESS_DESCRIPTION_new_null()
+    backend.openssl_assert(aia != backend._ffi.NULL)
+    aia = backend._ffi.gc(
+        aia,
+        lambda x: backend._lib.sk_ACCESS_DESCRIPTION_pop_free(
+            x,
+            backend._ffi.addressof(
+                backend._lib._original_lib, "ACCESS_DESCRIPTION_free"
+            ),
+        ),
+    )
+    for access_description in info_access:
+        ad = backend._lib.ACCESS_DESCRIPTION_new()
+        method = _txt2obj(
+            backend, access_description.access_method.dotted_string
+        )
+        _encode_general_name_preallocated(
+            backend, access_description.access_location, ad.location
+        )
+        ad.method = method
+        res = backend._lib.sk_ACCESS_DESCRIPTION_push(aia, ad)
+        backend.openssl_assert(res >= 1)
+
+    return aia
+
+
+def _encode_general_names(backend, names):
+    general_names = backend._lib.GENERAL_NAMES_new()
+    backend.openssl_assert(general_names != backend._ffi.NULL)
+    for name in names:
+        gn = _encode_general_name(backend, name)
+        res = backend._lib.sk_GENERAL_NAME_push(general_names, gn)
+        backend.openssl_assert(res != 0)
+
+    return general_names
+
+
+def _encode_alt_name(backend, san):
+    general_names = _encode_general_names(backend, san)
+    general_names = backend._ffi.gc(
+        general_names, backend._lib.GENERAL_NAMES_free
+    )
+    return general_names
+
+
+def _encode_subject_key_identifier(backend, ski):
+    return _encode_asn1_str_gc(backend, ski.digest)
+
+
+def _encode_general_name(backend, name):
+    gn = backend._lib.GENERAL_NAME_new()
+    _encode_general_name_preallocated(backend, name, gn)
+    return gn
+
+
+def _encode_general_name_preallocated(backend, name, gn):
+    if isinstance(name, x509.DNSName):
+        backend.openssl_assert(gn != backend._ffi.NULL)
+        gn.type = backend._lib.GEN_DNS
+
+        ia5 = backend._lib.ASN1_IA5STRING_new()
+        backend.openssl_assert(ia5 != backend._ffi.NULL)
+        # ia5strings are supposed to be ITU T.50 but to allow round-tripping
+        # of broken certs that encode utf8 we'll encode utf8 here too.
+        value = name.value.encode("utf8")
+
+        res = backend._lib.ASN1_STRING_set(ia5, value, len(value))
+        backend.openssl_assert(res == 1)
+        gn.d.dNSName = ia5
+    elif isinstance(name, x509.RegisteredID):
+        backend.openssl_assert(gn != backend._ffi.NULL)
+        gn.type = backend._lib.GEN_RID
+        obj = backend._lib.OBJ_txt2obj(
+            name.value.dotted_string.encode("ascii"), 1
+        )
+        backend.openssl_assert(obj != backend._ffi.NULL)
+        gn.d.registeredID = obj
+    elif isinstance(name, x509.DirectoryName):
+        backend.openssl_assert(gn != backend._ffi.NULL)
+        dir_name = _encode_name(backend, name.value)
+        gn.type = backend._lib.GEN_DIRNAME
+        gn.d.directoryName = dir_name
+    elif isinstance(name, x509.IPAddress):
+        backend.openssl_assert(gn != backend._ffi.NULL)
+        if isinstance(name.value, ipaddress.IPv4Network):
+            packed = name.value.network_address.packed + utils.int_to_bytes(
+                ((1 << 32) - name.value.num_addresses), 4
+            )
+        elif isinstance(name.value, ipaddress.IPv6Network):
+            packed = name.value.network_address.packed + utils.int_to_bytes(
+                (1 << 128) - name.value.num_addresses, 16
+            )
+        else:
+            packed = name.value.packed
+        ipaddr = _encode_asn1_str(backend, packed)
+        gn.type = backend._lib.GEN_IPADD
+        gn.d.iPAddress = ipaddr
+    elif isinstance(name, x509.OtherName):
+        backend.openssl_assert(gn != backend._ffi.NULL)
+        other_name = backend._lib.OTHERNAME_new()
+        backend.openssl_assert(other_name != backend._ffi.NULL)
+
+        type_id = backend._lib.OBJ_txt2obj(
+            name.type_id.dotted_string.encode("ascii"), 1
+        )
+        backend.openssl_assert(type_id != backend._ffi.NULL)
+        data = backend._ffi.new("unsigned char[]", name.value)
+        data_ptr_ptr = backend._ffi.new("unsigned char **")
+        data_ptr_ptr[0] = data
+        value = backend._lib.d2i_ASN1_TYPE(
+            backend._ffi.NULL, data_ptr_ptr, len(name.value)
+        )
+        if value == backend._ffi.NULL:
+            backend._consume_errors()
+            raise ValueError("Invalid ASN.1 data")
+        other_name.type_id = type_id
+        other_name.value = value
+        gn.type = backend._lib.GEN_OTHERNAME
+        gn.d.otherName = other_name
+    elif isinstance(name, x509.RFC822Name):
+        backend.openssl_assert(gn != backend._ffi.NULL)
+        # ia5strings are supposed to be ITU T.50 but to allow round-tripping
+        # of broken certs that encode utf8 we'll encode utf8 here too.
+        data = name.value.encode("utf8")
+        asn1_str = _encode_asn1_str(backend, data)
+        gn.type = backend._lib.GEN_EMAIL
+        gn.d.rfc822Name = asn1_str
+    elif isinstance(name, x509.UniformResourceIdentifier):
+        backend.openssl_assert(gn != backend._ffi.NULL)
+        # ia5strings are supposed to be ITU T.50 but to allow round-tripping
+        # of broken certs that encode utf8 we'll encode utf8 here too.
+        data = name.value.encode("utf8")
+        asn1_str = _encode_asn1_str(backend, data)
+        gn.type = backend._lib.GEN_URI
+        gn.d.uniformResourceIdentifier = asn1_str
+    else:
+        raise ValueError("{} is an unknown GeneralName type".format(name))
+
+
+def _encode_extended_key_usage(backend, extended_key_usage):
+    eku = backend._lib.sk_ASN1_OBJECT_new_null()
+    eku = backend._ffi.gc(eku, backend._lib.sk_ASN1_OBJECT_free)
+    for oid in extended_key_usage:
+        obj = _txt2obj(backend, oid.dotted_string)
+        res = backend._lib.sk_ASN1_OBJECT_push(eku, obj)
+        backend.openssl_assert(res >= 1)
+
+    return eku
+
+
+_CRLREASONFLAGS = {
+    x509.ReasonFlags.key_compromise: 1,
+    x509.ReasonFlags.ca_compromise: 2,
+    x509.ReasonFlags.affiliation_changed: 3,
+    x509.ReasonFlags.superseded: 4,
+    x509.ReasonFlags.cessation_of_operation: 5,
+    x509.ReasonFlags.certificate_hold: 6,
+    x509.ReasonFlags.privilege_withdrawn: 7,
+    x509.ReasonFlags.aa_compromise: 8,
+}
+
+
+def _encode_reasonflags(backend, reasons):
+    bitmask = backend._lib.ASN1_BIT_STRING_new()
+    backend.openssl_assert(bitmask != backend._ffi.NULL)
+    for reason in reasons:
+        res = backend._lib.ASN1_BIT_STRING_set_bit(
+            bitmask, _CRLREASONFLAGS[reason], 1
+        )
+        backend.openssl_assert(res == 1)
+
+    return bitmask
+
+
+def _encode_full_name(backend, full_name):
+    dpn = backend._lib.DIST_POINT_NAME_new()
+    backend.openssl_assert(dpn != backend._ffi.NULL)
+    dpn.type = _DISTPOINT_TYPE_FULLNAME
+    dpn.name.fullname = _encode_general_names(backend, full_name)
+    return dpn
+
+
+def _encode_relative_name(backend, relative_name):
+    dpn = backend._lib.DIST_POINT_NAME_new()
+    backend.openssl_assert(dpn != backend._ffi.NULL)
+    dpn.type = _DISTPOINT_TYPE_RELATIVENAME
+    dpn.name.relativename = _encode_sk_name_entry(backend, relative_name)
+    return dpn
+
+
+def _encode_cdps_freshest_crl(backend, cdps):
+    cdp = backend._lib.sk_DIST_POINT_new_null()
+    cdp = backend._ffi.gc(cdp, backend._lib.sk_DIST_POINT_free)
+    for point in cdps:
+        dp = backend._lib.DIST_POINT_new()
+        backend.openssl_assert(dp != backend._ffi.NULL)
+
+        if point.reasons:
+            dp.reasons = _encode_reasonflags(backend, point.reasons)
+
+        if point.full_name:
+            dp.distpoint = _encode_full_name(backend, point.full_name)
+
+        if point.relative_name:
+            dp.distpoint = _encode_relative_name(backend, point.relative_name)
+
+        if point.crl_issuer:
+            dp.CRLissuer = _encode_general_names(backend, point.crl_issuer)
+
+        res = backend._lib.sk_DIST_POINT_push(cdp, dp)
+        backend.openssl_assert(res >= 1)
+
+    return cdp
+
+
+def _encode_name_constraints(backend, name_constraints):
+    nc = backend._lib.NAME_CONSTRAINTS_new()
+    backend.openssl_assert(nc != backend._ffi.NULL)
+    nc = backend._ffi.gc(nc, backend._lib.NAME_CONSTRAINTS_free)
+    permitted = _encode_general_subtree(
+        backend, name_constraints.permitted_subtrees
+    )
+    nc.permittedSubtrees = permitted
+    excluded = _encode_general_subtree(
+        backend, name_constraints.excluded_subtrees
+    )
+    nc.excludedSubtrees = excluded
+
+    return nc
+
+
+def _encode_policy_constraints(backend, policy_constraints):
+    pc = backend._lib.POLICY_CONSTRAINTS_new()
+    backend.openssl_assert(pc != backend._ffi.NULL)
+    pc = backend._ffi.gc(pc, backend._lib.POLICY_CONSTRAINTS_free)
+    if policy_constraints.require_explicit_policy is not None:
+        pc.requireExplicitPolicy = _encode_asn1_int(
+            backend, policy_constraints.require_explicit_policy
+        )
+
+    if policy_constraints.inhibit_policy_mapping is not None:
+        pc.inhibitPolicyMapping = _encode_asn1_int(
+            backend, policy_constraints.inhibit_policy_mapping
+        )
+
+    return pc
+
+
+def _encode_general_subtree(backend, subtrees):
+    if subtrees is None:
+        return backend._ffi.NULL
+    else:
+        general_subtrees = backend._lib.sk_GENERAL_SUBTREE_new_null()
+        for name in subtrees:
+            gs = backend._lib.GENERAL_SUBTREE_new()
+            gs.base = _encode_general_name(backend, name)
+            res = backend._lib.sk_GENERAL_SUBTREE_push(general_subtrees, gs)
+            backend.openssl_assert(res >= 1)
+
+        return general_subtrees
+
+
+def _encode_nonce(backend, nonce):
+    return _encode_asn1_str_gc(backend, nonce.nonce)
+
+
+_EXTENSION_ENCODE_HANDLERS = {
+    ExtensionOID.BASIC_CONSTRAINTS: _encode_basic_constraints,
+    ExtensionOID.SUBJECT_KEY_IDENTIFIER: _encode_subject_key_identifier,
+    ExtensionOID.KEY_USAGE: _encode_key_usage,
+    ExtensionOID.SUBJECT_ALTERNATIVE_NAME: _encode_alt_name,
+    ExtensionOID.ISSUER_ALTERNATIVE_NAME: _encode_alt_name,
+    ExtensionOID.EXTENDED_KEY_USAGE: _encode_extended_key_usage,
+    ExtensionOID.AUTHORITY_KEY_IDENTIFIER: _encode_authority_key_identifier,
+    ExtensionOID.CERTIFICATE_POLICIES: _encode_certificate_policies,
+    ExtensionOID.AUTHORITY_INFORMATION_ACCESS: _encode_information_access,
+    ExtensionOID.SUBJECT_INFORMATION_ACCESS: _encode_information_access,
+    ExtensionOID.CRL_DISTRIBUTION_POINTS: _encode_cdps_freshest_crl,
+    ExtensionOID.FRESHEST_CRL: _encode_cdps_freshest_crl,
+    ExtensionOID.INHIBIT_ANY_POLICY: _encode_inhibit_any_policy,
+    ExtensionOID.OCSP_NO_CHECK: _encode_ocsp_nocheck,
+    ExtensionOID.NAME_CONSTRAINTS: _encode_name_constraints,
+    ExtensionOID.POLICY_CONSTRAINTS: _encode_policy_constraints,
+}
+
+_CRL_EXTENSION_ENCODE_HANDLERS = {
+    ExtensionOID.ISSUER_ALTERNATIVE_NAME: _encode_alt_name,
+    ExtensionOID.AUTHORITY_KEY_IDENTIFIER: _encode_authority_key_identifier,
+    ExtensionOID.AUTHORITY_INFORMATION_ACCESS: _encode_information_access,
+    ExtensionOID.CRL_NUMBER: _encode_crl_number_delta_crl_indicator,
+    ExtensionOID.DELTA_CRL_INDICATOR: _encode_crl_number_delta_crl_indicator,
+    ExtensionOID.ISSUING_DISTRIBUTION_POINT: _encode_issuing_dist_point,
+    ExtensionOID.FRESHEST_CRL: _encode_cdps_freshest_crl,
+}
+
+_CRL_ENTRY_EXTENSION_ENCODE_HANDLERS = {
+    CRLEntryExtensionOID.CERTIFICATE_ISSUER: _encode_alt_name,
+    CRLEntryExtensionOID.CRL_REASON: _encode_crl_reason,
+    CRLEntryExtensionOID.INVALIDITY_DATE: _encode_invalidity_date,
+}
+
+_OCSP_REQUEST_EXTENSION_ENCODE_HANDLERS = {
+    OCSPExtensionOID.NONCE: _encode_nonce,
+}
+
+_OCSP_BASICRESP_EXTENSION_ENCODE_HANDLERS = {
+    OCSPExtensionOID.NONCE: _encode_nonce,
+}

asq-env/lib/python3.9/site-packages/cryptography/hazmat/backends/openssl/hashes.py

@@ -0,0 +1,80 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+from cryptography.exceptions import UnsupportedAlgorithm, _Reasons
+from cryptography.hazmat.primitives import hashes
+
+
+class _HashContext(hashes.HashContext):
+    def __init__(self, backend, algorithm: hashes.HashAlgorithm, ctx=None):
+        self._algorithm = algorithm
+
+        self._backend = backend
+
+        if ctx is None:
+            ctx = self._backend._lib.EVP_MD_CTX_new()
+            ctx = self._backend._ffi.gc(
+                ctx, self._backend._lib.EVP_MD_CTX_free
+            )
+            evp_md = self._backend._evp_md_from_algorithm(algorithm)
+            if evp_md == self._backend._ffi.NULL:
+                raise UnsupportedAlgorithm(
+                    "{} is not a supported hash on this backend.".format(
+                        algorithm.name
+                    ),
+                    _Reasons.UNSUPPORTED_HASH,
+                )
+            res = self._backend._lib.EVP_DigestInit_ex(
+                ctx, evp_md, self._backend._ffi.NULL
+            )
+            self._backend.openssl_assert(res != 0)
+
+        self._ctx = ctx
+
+    @property
+    def algorithm(self) -> hashes.HashAlgorithm:
+        return self._algorithm
+
+    def copy(self) -> "_HashContext":
+        copied_ctx = self._backend._lib.EVP_MD_CTX_new()
+        copied_ctx = self._backend._ffi.gc(
+            copied_ctx, self._backend._lib.EVP_MD_CTX_free
+        )
+        res = self._backend._lib.EVP_MD_CTX_copy_ex(copied_ctx, self._ctx)
+        self._backend.openssl_assert(res != 0)
+        return _HashContext(self._backend, self.algorithm, ctx=copied_ctx)
+
+    def update(self, data: bytes) -> None:
+        data_ptr = self._backend._ffi.from_buffer(data)
+        res = self._backend._lib.EVP_DigestUpdate(
+            self._ctx, data_ptr, len(data)
+        )
+        self._backend.openssl_assert(res != 0)
+
+    def finalize(self) -> bytes:
+        if isinstance(self.algorithm, hashes.ExtendableOutputFunction):
+            # extendable output functions use a different finalize
+            return self._finalize_xof()
+        else:
+            buf = self._backend._ffi.new(
+                "unsigned char[]", self._backend._lib.EVP_MAX_MD_SIZE
+            )
+            outlen = self._backend._ffi.new("unsigned int *")
+            res = self._backend._lib.EVP_DigestFinal_ex(self._ctx, buf, outlen)
+            self._backend.openssl_assert(res != 0)
+            self._backend.openssl_assert(
+                outlen[0] == self.algorithm.digest_size
+            )
+            return self._backend._ffi.buffer(buf)[: outlen[0]]
+
+    def _finalize_xof(self) -> bytes:
+        buf = self._backend._ffi.new(
+            "unsigned char[]", self.algorithm.digest_size
+        )
+        res = self._backend._lib.EVP_DigestFinalXOF(
+            self._ctx, buf, self.algorithm.digest_size
+        )
+        self._backend.openssl_assert(res != 0)
+        return self._backend._ffi.buffer(buf)[: self.algorithm.digest_size]

asq-env/lib/python3.9/site-packages/cryptography/hazmat/backends/openssl/hmac.py

@@ -0,0 +1,76 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+from cryptography.exceptions import (
+    InvalidSignature,
+    UnsupportedAlgorithm,
+    _Reasons,
+)
+from cryptography.hazmat.primitives import constant_time, hashes
+
+
+class _HMACContext(hashes.HashContext):
+    def __init__(
+        self, backend, key: bytes, algorithm: hashes.HashAlgorithm, ctx=None
+    ):
+        self._algorithm = algorithm
+        self._backend = backend
+
+        if ctx is None:
+            ctx = self._backend._lib.HMAC_CTX_new()
+            self._backend.openssl_assert(ctx != self._backend._ffi.NULL)
+            ctx = self._backend._ffi.gc(ctx, self._backend._lib.HMAC_CTX_free)
+            evp_md = self._backend._evp_md_from_algorithm(algorithm)
+            if evp_md == self._backend._ffi.NULL:
+                raise UnsupportedAlgorithm(
+                    "{} is not a supported hash on this backend".format(
+                        algorithm.name
+                    ),
+                    _Reasons.UNSUPPORTED_HASH,
+                )
+            key_ptr = self._backend._ffi.from_buffer(key)
+            res = self._backend._lib.HMAC_Init_ex(
+                ctx, key_ptr, len(key), evp_md, self._backend._ffi.NULL
+            )
+            self._backend.openssl_assert(res != 0)
+
+        self._ctx = ctx
+        self._key = key
+
+    @property
+    def algorithm(self) -> hashes.HashAlgorithm:
+        return self._algorithm
+
+    def copy(self) -> "_HMACContext":
+        copied_ctx = self._backend._lib.HMAC_CTX_new()
+        self._backend.openssl_assert(copied_ctx != self._backend._ffi.NULL)
+        copied_ctx = self._backend._ffi.gc(
+            copied_ctx, self._backend._lib.HMAC_CTX_free
+        )
+        res = self._backend._lib.HMAC_CTX_copy(copied_ctx, self._ctx)
+        self._backend.openssl_assert(res != 0)
+        return _HMACContext(
+            self._backend, self._key, self.algorithm, ctx=copied_ctx
+        )
+
+    def update(self, data: bytes) -> None:
+        data_ptr = self._backend._ffi.from_buffer(data)
+        res = self._backend._lib.HMAC_Update(self._ctx, data_ptr, len(data))
+        self._backend.openssl_assert(res != 0)
+
+    def finalize(self) -> bytes:
+        buf = self._backend._ffi.new(
+            "unsigned char[]", self._backend._lib.EVP_MAX_MD_SIZE
+        )
+        outlen = self._backend._ffi.new("unsigned int *")
+        res = self._backend._lib.HMAC_Final(self._ctx, buf, outlen)
+        self._backend.openssl_assert(res != 0)
+        self._backend.openssl_assert(outlen[0] == self.algorithm.digest_size)
+        return self._backend._ffi.buffer(buf)[: outlen[0]]
+
+    def verify(self, signature: bytes) -> None:
+        digest = self.finalize()
+        if not constant_time.bytes_eq(digest, signature):
+            raise InvalidSignature("Signature did not match digest.")

asq-env/lib/python3.9/site-packages/cryptography/hazmat/backends/openssl/poly1305.py

@@ -0,0 +1,63 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+from cryptography.exceptions import InvalidSignature
+from cryptography.hazmat.primitives import constant_time
+
+
+_POLY1305_TAG_SIZE = 16
+_POLY1305_KEY_SIZE = 32
+
+
+class _Poly1305Context(object):
+    def __init__(self, backend, key):
+        self._backend = backend
+
+        key_ptr = self._backend._ffi.from_buffer(key)
+        # This function copies the key into OpenSSL-owned memory so we don't
+        # need to retain it ourselves
+        evp_pkey = self._backend._lib.EVP_PKEY_new_raw_private_key(
+            self._backend._lib.NID_poly1305,
+            self._backend._ffi.NULL,
+            key_ptr,
+            len(key),
+        )
+        self._backend.openssl_assert(evp_pkey != self._backend._ffi.NULL)
+        self._evp_pkey = self._backend._ffi.gc(
+            evp_pkey, self._backend._lib.EVP_PKEY_free
+        )
+        ctx = self._backend._lib.EVP_MD_CTX_new()
+        self._backend.openssl_assert(ctx != self._backend._ffi.NULL)
+        self._ctx = self._backend._ffi.gc(
+            ctx, self._backend._lib.EVP_MD_CTX_free
+        )
+        res = self._backend._lib.EVP_DigestSignInit(
+            self._ctx,
+            self._backend._ffi.NULL,
+            self._backend._ffi.NULL,
+            self._backend._ffi.NULL,
+            self._evp_pkey,
+        )
+        self._backend.openssl_assert(res == 1)
+
+    def update(self, data):
+        data_ptr = self._backend._ffi.from_buffer(data)
+        res = self._backend._lib.EVP_DigestSignUpdate(
+            self._ctx, data_ptr, len(data)
+        )
+        self._backend.openssl_assert(res != 0)
+
+    def finalize(self):
+        buf = self._backend._ffi.new("unsigned char[]", _POLY1305_TAG_SIZE)
+        outlen = self._backend._ffi.new("size_t *")
+        res = self._backend._lib.EVP_DigestSignFinal(self._ctx, buf, outlen)
+        self._backend.openssl_assert(res != 0)
+        self._backend.openssl_assert(outlen[0] == _POLY1305_TAG_SIZE)
+        return self._backend._ffi.buffer(buf)[: outlen[0]]
+
+    def verify(self, tag):
+        mac = self.finalize()
+        if not constant_time.bytes_eq(mac, tag):
+            raise InvalidSignature("Value did not match computed tag.")

asq-env/lib/python3.9/site-packages/cryptography/hazmat/backends/openssl/rsa.py

@@ -0,0 +1,581 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+import typing
+
+from cryptography import utils
+from cryptography.exceptions import (
+    InvalidSignature,
+    UnsupportedAlgorithm,
+    _Reasons,
+)
+from cryptography.hazmat.backends.openssl.utils import (
+    _calculate_digest_and_algorithm,
+    _check_not_prehashed,
+    _warn_sign_verify_deprecated,
+)
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import (
+    AsymmetricSignatureContext,
+    AsymmetricVerificationContext,
+    utils as asym_utils,
+)
+from cryptography.hazmat.primitives.asymmetric.padding import (
+    AsymmetricPadding,
+    MGF1,
+    OAEP,
+    PKCS1v15,
+    PSS,
+    calculate_max_pss_salt_length,
+)
+from cryptography.hazmat.primitives.asymmetric.rsa import (
+    RSAPrivateKey,
+    RSAPrivateNumbers,
+    RSAPublicKey,
+    RSAPublicNumbers,
+)
+
+
+def _get_rsa_pss_salt_length(
+    pss: PSS,
+    key: typing.Union[RSAPrivateKey, RSAPublicKey],
+    hash_algorithm: hashes.HashAlgorithm,
+) -> int:
+    salt = pss._salt_length
+
+    if salt is MGF1.MAX_LENGTH or salt is PSS.MAX_LENGTH:
+        return calculate_max_pss_salt_length(key, hash_algorithm)
+    else:
+        return salt
+
+
+def _enc_dec_rsa(
+    backend,
+    key: typing.Union["_RSAPrivateKey", "_RSAPublicKey"],
+    data: bytes,
+    padding: AsymmetricPadding,
+) -> bytes:
+    if not isinstance(padding, AsymmetricPadding):
+        raise TypeError("Padding must be an instance of AsymmetricPadding.")
+
+    if isinstance(padding, PKCS1v15):
+        padding_enum = backend._lib.RSA_PKCS1_PADDING
+    elif isinstance(padding, OAEP):
+        padding_enum = backend._lib.RSA_PKCS1_OAEP_PADDING
+
+        if not isinstance(padding._mgf, MGF1):
+            raise UnsupportedAlgorithm(
+                "Only MGF1 is supported by this backend.",
+                _Reasons.UNSUPPORTED_MGF,
+            )
+
+        if not backend.rsa_padding_supported(padding):
+            raise UnsupportedAlgorithm(
+                "This combination of padding and hash algorithm is not "
+                "supported by this backend.",
+                _Reasons.UNSUPPORTED_PADDING,
+            )
+
+    else:
+        raise UnsupportedAlgorithm(
+            "{} is not supported by this backend.".format(padding.name),
+            _Reasons.UNSUPPORTED_PADDING,
+        )
+
+    return _enc_dec_rsa_pkey_ctx(backend, key, data, padding_enum, padding)
+
+
+def _enc_dec_rsa_pkey_ctx(
+    backend,
+    key: typing.Union["_RSAPrivateKey", "_RSAPublicKey"],
+    data: bytes,
+    padding_enum: int,
+    padding: AsymmetricPadding,
+) -> bytes:
+    if isinstance(key, _RSAPublicKey):
+        init = backend._lib.EVP_PKEY_encrypt_init
+        crypt = backend._lib.EVP_PKEY_encrypt
+    else:
+        init = backend._lib.EVP_PKEY_decrypt_init
+        crypt = backend._lib.EVP_PKEY_decrypt
+
+    pkey_ctx = backend._lib.EVP_PKEY_CTX_new(key._evp_pkey, backend._ffi.NULL)
+    backend.openssl_assert(pkey_ctx != backend._ffi.NULL)
+    pkey_ctx = backend._ffi.gc(pkey_ctx, backend._lib.EVP_PKEY_CTX_free)
+    res = init(pkey_ctx)
+    backend.openssl_assert(res == 1)
+    res = backend._lib.EVP_PKEY_CTX_set_rsa_padding(pkey_ctx, padding_enum)
+    backend.openssl_assert(res > 0)
+    buf_size = backend._lib.EVP_PKEY_size(key._evp_pkey)
+    backend.openssl_assert(buf_size > 0)
+    if isinstance(padding, OAEP) and backend._lib.Cryptography_HAS_RSA_OAEP_MD:
+        mgf1_md = backend._evp_md_non_null_from_algorithm(
+            padding._mgf._algorithm
+        )
+        res = backend._lib.EVP_PKEY_CTX_set_rsa_mgf1_md(pkey_ctx, mgf1_md)
+        backend.openssl_assert(res > 0)
+        oaep_md = backend._evp_md_non_null_from_algorithm(padding._algorithm)
+        res = backend._lib.EVP_PKEY_CTX_set_rsa_oaep_md(pkey_ctx, oaep_md)
+        backend.openssl_assert(res > 0)
+
+    if (
+        isinstance(padding, OAEP)
+        and padding._label is not None
+        and len(padding._label) > 0
+    ):
+        # set0_rsa_oaep_label takes ownership of the char * so we need to
+        # copy it into some new memory
+        labelptr = backend._lib.OPENSSL_malloc(len(padding._label))
+        backend.openssl_assert(labelptr != backend._ffi.NULL)
+        backend._ffi.memmove(labelptr, padding._label, len(padding._label))
+        res = backend._lib.EVP_PKEY_CTX_set0_rsa_oaep_label(
+            pkey_ctx, labelptr, len(padding._label)
+        )
+        backend.openssl_assert(res == 1)
+
+    outlen = backend._ffi.new("size_t *", buf_size)
+    buf = backend._ffi.new("unsigned char[]", buf_size)
+    # Everything from this line onwards is written with the goal of being as
+    # constant-time as is practical given the constraints of Python and our
+    # API. See Bleichenbacher's '98 attack on RSA, and its many many variants.
+    # As such, you should not attempt to change this (particularly to "clean it
+    # up") without understanding why it was written this way (see
+    # Chesterton's Fence), and without measuring to verify you have not
+    # introduced observable time differences.
+    res = crypt(pkey_ctx, buf, outlen, data, len(data))
+    resbuf = backend._ffi.buffer(buf)[: outlen[0]]
+    backend._lib.ERR_clear_error()
+    if res <= 0:
+        raise ValueError("Encryption/decryption failed.")
+    return resbuf
+
+
+def _rsa_sig_determine_padding(backend, key, padding, algorithm):
+    if not isinstance(padding, AsymmetricPadding):
+        raise TypeError("Expected provider of AsymmetricPadding.")
+
+    pkey_size = backend._lib.EVP_PKEY_size(key._evp_pkey)
+    backend.openssl_assert(pkey_size > 0)
+
+    if isinstance(padding, PKCS1v15):
+        # Hash algorithm is ignored for PKCS1v15-padding, may be None.
+        padding_enum = backend._lib.RSA_PKCS1_PADDING
+    elif isinstance(padding, PSS):
+        if not isinstance(padding._mgf, MGF1):
+            raise UnsupportedAlgorithm(
+                "Only MGF1 is supported by this backend.",
+                _Reasons.UNSUPPORTED_MGF,
+            )
+
+        # PSS padding requires a hash algorithm
+        if not isinstance(algorithm, hashes.HashAlgorithm):
+            raise TypeError("Expected instance of hashes.HashAlgorithm.")
+
+        # Size of key in bytes - 2 is the maximum
+        # PSS signature length (salt length is checked later)
+        if pkey_size - algorithm.digest_size - 2 < 0:
+            raise ValueError(
+                "Digest too large for key size. Use a larger "
+                "key or different digest."
+            )
+
+        padding_enum = backend._lib.RSA_PKCS1_PSS_PADDING
+    else:
+        raise UnsupportedAlgorithm(
+            "{} is not supported by this backend.".format(padding.name),
+            _Reasons.UNSUPPORTED_PADDING,
+        )
+
+    return padding_enum
+
+
+# Hash algorithm can be absent (None) to initialize the context without setting
+# any message digest algorithm. This is currently only valid for the PKCS1v15
+# padding type, where it means that the signature data is encoded/decoded
+# as provided, without being wrapped in a DigestInfo structure.
+def _rsa_sig_setup(backend, padding, algorithm, key, init_func):
+    padding_enum = _rsa_sig_determine_padding(backend, key, padding, algorithm)
+    pkey_ctx = backend._lib.EVP_PKEY_CTX_new(key._evp_pkey, backend._ffi.NULL)
+    backend.openssl_assert(pkey_ctx != backend._ffi.NULL)
+    pkey_ctx = backend._ffi.gc(pkey_ctx, backend._lib.EVP_PKEY_CTX_free)
+    res = init_func(pkey_ctx)
+    backend.openssl_assert(res == 1)
+    if algorithm is not None:
+        evp_md = backend._evp_md_non_null_from_algorithm(algorithm)
+        res = backend._lib.EVP_PKEY_CTX_set_signature_md(pkey_ctx, evp_md)
+        if res == 0:
+            backend._consume_errors()
+            raise UnsupportedAlgorithm(
+                "{} is not supported by this backend for RSA signing.".format(
+                    algorithm.name
+                ),
+                _Reasons.UNSUPPORTED_HASH,
+            )
+    res = backend._lib.EVP_PKEY_CTX_set_rsa_padding(pkey_ctx, padding_enum)
+    if res <= 0:
+        backend._consume_errors()
+        raise UnsupportedAlgorithm(
+            "{} is not supported for the RSA signature operation.".format(
+                padding.name
+            ),
+            _Reasons.UNSUPPORTED_PADDING,
+        )
+    if isinstance(padding, PSS):
+        res = backend._lib.EVP_PKEY_CTX_set_rsa_pss_saltlen(
+            pkey_ctx, _get_rsa_pss_salt_length(padding, key, algorithm)
+        )
+        backend.openssl_assert(res > 0)
+
+        mgf1_md = backend._evp_md_non_null_from_algorithm(
+            padding._mgf._algorithm
+        )
+        res = backend._lib.EVP_PKEY_CTX_set_rsa_mgf1_md(pkey_ctx, mgf1_md)
+        backend.openssl_assert(res > 0)
+
+    return pkey_ctx
+
+
+def _rsa_sig_sign(backend, padding, algorithm, private_key, data):
+    pkey_ctx = _rsa_sig_setup(
+        backend,
+        padding,
+        algorithm,
+        private_key,
+        backend._lib.EVP_PKEY_sign_init,
+    )
+    buflen = backend._ffi.new("size_t *")
+    res = backend._lib.EVP_PKEY_sign(
+        pkey_ctx, backend._ffi.NULL, buflen, data, len(data)
+    )
+    backend.openssl_assert(res == 1)
+    buf = backend._ffi.new("unsigned char[]", buflen[0])
+    res = backend._lib.EVP_PKEY_sign(pkey_ctx, buf, buflen, data, len(data))
+    if res != 1:
+        errors = backend._consume_errors_with_text()
+        raise ValueError(
+            "Digest or salt length too long for key size. Use a larger key "
+            "or shorter salt length if you are specifying a PSS salt",
+            errors,
+        )
+
+    return backend._ffi.buffer(buf)[:]
+
+
+def _rsa_sig_verify(backend, padding, algorithm, public_key, signature, data):
+    pkey_ctx = _rsa_sig_setup(
+        backend,
+        padding,
+        algorithm,
+        public_key,
+        backend._lib.EVP_PKEY_verify_init,
+    )
+    res = backend._lib.EVP_PKEY_verify(
+        pkey_ctx, signature, len(signature), data, len(data)
+    )
+    # The previous call can return negative numbers in the event of an
+    # error. This is not a signature failure but we need to fail if it
+    # occurs.
+    backend.openssl_assert(res >= 0)
+    if res == 0:
+        backend._consume_errors()
+        raise InvalidSignature
+
+
+def _rsa_sig_recover(backend, padding, algorithm, public_key, signature):
+    pkey_ctx = _rsa_sig_setup(
+        backend,
+        padding,
+        algorithm,
+        public_key,
+        backend._lib.EVP_PKEY_verify_recover_init,
+    )
+
+    # Attempt to keep the rest of the code in this function as constant/time
+    # as possible. See the comment in _enc_dec_rsa_pkey_ctx. Note that the
+    # buflen parameter is used even though its value may be undefined in the
+    # error case. Due to the tolerant nature of Python slicing this does not
+    # trigger any exceptions.
+    maxlen = backend._lib.EVP_PKEY_size(public_key._evp_pkey)
+    backend.openssl_assert(maxlen > 0)
+    buf = backend._ffi.new("unsigned char[]", maxlen)
+    buflen = backend._ffi.new("size_t *", maxlen)
+    res = backend._lib.EVP_PKEY_verify_recover(
+        pkey_ctx, buf, buflen, signature, len(signature)
+    )
+    resbuf = backend._ffi.buffer(buf)[: buflen[0]]
+    backend._lib.ERR_clear_error()
+    # Assume that all parameter errors are handled during the setup phase and
+    # any error here is due to invalid signature.
+    if res != 1:
+        raise InvalidSignature
+    return resbuf
+
+
+class _RSASignatureContext(AsymmetricSignatureContext):
+    def __init__(
+        self,
+        backend,
+        private_key: RSAPrivateKey,
+        padding: AsymmetricPadding,
+        algorithm: hashes.HashAlgorithm,
+    ):
+        self._backend = backend
+        self._private_key = private_key
+
+        # We now call _rsa_sig_determine_padding in _rsa_sig_setup. However
+        # we need to make a pointless call to it here so we maintain the
+        # API of erroring on init with this context if the values are invalid.
+        _rsa_sig_determine_padding(backend, private_key, padding, algorithm)
+        self._padding = padding
+        self._algorithm = algorithm
+        self._hash_ctx = hashes.Hash(self._algorithm, self._backend)
+
+    def update(self, data: bytes) -> None:
+        self._hash_ctx.update(data)
+
+    def finalize(self) -> bytes:
+        return _rsa_sig_sign(
+            self._backend,
+            self._padding,
+            self._algorithm,
+            self._private_key,
+            self._hash_ctx.finalize(),
+        )
+
+
+class _RSAVerificationContext(AsymmetricVerificationContext):
+    def __init__(
+        self,
+        backend,
+        public_key: RSAPublicKey,
+        signature: bytes,
+        padding: AsymmetricPadding,
+        algorithm: hashes.HashAlgorithm,
+    ):
+        self._backend = backend
+        self._public_key = public_key
+        self._signature = signature
+        self._padding = padding
+        # We now call _rsa_sig_determine_padding in _rsa_sig_setup. However
+        # we need to make a pointless call to it here so we maintain the
+        # API of erroring on init with this context if the values are invalid.
+        _rsa_sig_determine_padding(backend, public_key, padding, algorithm)
+
+        padding = padding
+        self._algorithm = algorithm
+        self._hash_ctx = hashes.Hash(self._algorithm, self._backend)
+
+    def update(self, data: bytes) -> None:
+        self._hash_ctx.update(data)
+
+    def verify(self) -> None:
+        return _rsa_sig_verify(
+            self._backend,
+            self._padding,
+            self._algorithm,
+            self._public_key,
+            self._signature,
+            self._hash_ctx.finalize(),
+        )
+
+
+class _RSAPrivateKey(RSAPrivateKey):
+    def __init__(self, backend, rsa_cdata, evp_pkey, _skip_check_key):
+        # RSA_check_key is slower in OpenSSL 3.0.0 due to improved
+        # primality checking. In normal use this is unlikely to be a problem
+        # since users don't load new keys constantly, but for TESTING we've
+        # added an init arg that allows skipping the checks. You should not
+        # use this in production code unless you understand the consequences.
+        if not _skip_check_key:
+            res = backend._lib.RSA_check_key(rsa_cdata)
+            if res != 1:
+                errors = backend._consume_errors_with_text()
+                raise ValueError("Invalid private key", errors)
+
+        # Blinding is on by default in many versions of OpenSSL, but let's
+        # just be conservative here.
+        res = backend._lib.RSA_blinding_on(rsa_cdata, backend._ffi.NULL)
+        backend.openssl_assert(res == 1)
+
+        self._backend = backend
+        self._rsa_cdata = rsa_cdata
+        self._evp_pkey = evp_pkey
+
+        n = self._backend._ffi.new("BIGNUM **")
+        self._backend._lib.RSA_get0_key(
+            self._rsa_cdata,
+            n,
+            self._backend._ffi.NULL,
+            self._backend._ffi.NULL,
+        )
+        self._backend.openssl_assert(n[0] != self._backend._ffi.NULL)
+        self._key_size = self._backend._lib.BN_num_bits(n[0])
+
+    key_size = utils.read_only_property("_key_size")
+
+    def signer(
+        self, padding: AsymmetricPadding, algorithm: hashes.HashAlgorithm
+    ) -> AsymmetricSignatureContext:
+        _warn_sign_verify_deprecated()
+        _check_not_prehashed(algorithm)
+        return _RSASignatureContext(self._backend, self, padding, algorithm)
+
+    def decrypt(self, ciphertext: bytes, padding: AsymmetricPadding) -> bytes:
+        key_size_bytes = (self.key_size + 7) // 8
+        if key_size_bytes != len(ciphertext):
+            raise ValueError("Ciphertext length must be equal to key size.")
+
+        return _enc_dec_rsa(self._backend, self, ciphertext, padding)
+
+    def public_key(self) -> RSAPublicKey:
+        ctx = self._backend._lib.RSAPublicKey_dup(self._rsa_cdata)
+        self._backend.openssl_assert(ctx != self._backend._ffi.NULL)
+        ctx = self._backend._ffi.gc(ctx, self._backend._lib.RSA_free)
+        evp_pkey = self._backend._rsa_cdata_to_evp_pkey(ctx)
+        return _RSAPublicKey(self._backend, ctx, evp_pkey)
+
+    def private_numbers(self) -> RSAPrivateNumbers:
+        n = self._backend._ffi.new("BIGNUM **")
+        e = self._backend._ffi.new("BIGNUM **")
+        d = self._backend._ffi.new("BIGNUM **")
+        p = self._backend._ffi.new("BIGNUM **")
+        q = self._backend._ffi.new("BIGNUM **")
+        dmp1 = self._backend._ffi.new("BIGNUM **")
+        dmq1 = self._backend._ffi.new("BIGNUM **")
+        iqmp = self._backend._ffi.new("BIGNUM **")
+        self._backend._lib.RSA_get0_key(self._rsa_cdata, n, e, d)
+        self._backend.openssl_assert(n[0] != self._backend._ffi.NULL)
+        self._backend.openssl_assert(e[0] != self._backend._ffi.NULL)
+        self._backend.openssl_assert(d[0] != self._backend._ffi.NULL)
+        self._backend._lib.RSA_get0_factors(self._rsa_cdata, p, q)
+        self._backend.openssl_assert(p[0] != self._backend._ffi.NULL)
+        self._backend.openssl_assert(q[0] != self._backend._ffi.NULL)
+        self._backend._lib.RSA_get0_crt_params(
+            self._rsa_cdata, dmp1, dmq1, iqmp
+        )
+        self._backend.openssl_assert(dmp1[0] != self._backend._ffi.NULL)
+        self._backend.openssl_assert(dmq1[0] != self._backend._ffi.NULL)
+        self._backend.openssl_assert(iqmp[0] != self._backend._ffi.NULL)
+        return RSAPrivateNumbers(
+            p=self._backend._bn_to_int(p[0]),
+            q=self._backend._bn_to_int(q[0]),
+            d=self._backend._bn_to_int(d[0]),
+            dmp1=self._backend._bn_to_int(dmp1[0]),
+            dmq1=self._backend._bn_to_int(dmq1[0]),
+            iqmp=self._backend._bn_to_int(iqmp[0]),
+            public_numbers=RSAPublicNumbers(
+                e=self._backend._bn_to_int(e[0]),
+                n=self._backend._bn_to_int(n[0]),
+            ),
+        )
+
+    def private_bytes(
+        self,
+        encoding: serialization.Encoding,
+        format: serialization.PrivateFormat,
+        encryption_algorithm: serialization.KeySerializationEncryption,
+    ) -> bytes:
+        return self._backend._private_key_bytes(
+            encoding,
+            format,
+            encryption_algorithm,
+            self,
+            self._evp_pkey,
+            self._rsa_cdata,
+        )
+
+    def sign(
+        self,
+        data: bytes,
+        padding: AsymmetricPadding,
+        algorithm: typing.Union[asym_utils.Prehashed, hashes.HashAlgorithm],
+    ) -> bytes:
+        data, algorithm = _calculate_digest_and_algorithm(
+            self._backend, data, algorithm
+        )
+        return _rsa_sig_sign(self._backend, padding, algorithm, self, data)
+
+
+class _RSAPublicKey(RSAPublicKey):
+    def __init__(self, backend, rsa_cdata, evp_pkey):
+        self._backend = backend
+        self._rsa_cdata = rsa_cdata
+        self._evp_pkey = evp_pkey
+
+        n = self._backend._ffi.new("BIGNUM **")
+        self._backend._lib.RSA_get0_key(
+            self._rsa_cdata,
+            n,
+            self._backend._ffi.NULL,
+            self._backend._ffi.NULL,
+        )
+        self._backend.openssl_assert(n[0] != self._backend._ffi.NULL)
+        self._key_size = self._backend._lib.BN_num_bits(n[0])
+
+    key_size = utils.read_only_property("_key_size")
+
+    def verifier(
+        self,
+        signature: bytes,
+        padding: AsymmetricPadding,
+        algorithm: hashes.HashAlgorithm,
+    ) -> AsymmetricVerificationContext:
+        _warn_sign_verify_deprecated()
+        utils._check_bytes("signature", signature)
+
+        _check_not_prehashed(algorithm)
+        return _RSAVerificationContext(
+            self._backend, self, signature, padding, algorithm
+        )
+
+    def encrypt(self, plaintext: bytes, padding: AsymmetricPadding) -> bytes:
+        return _enc_dec_rsa(self._backend, self, plaintext, padding)
+
+    def public_numbers(self) -> RSAPublicNumbers:
+        n = self._backend._ffi.new("BIGNUM **")
+        e = self._backend._ffi.new("BIGNUM **")
+        self._backend._lib.RSA_get0_key(
+            self._rsa_cdata, n, e, self._backend._ffi.NULL
+        )
+        self._backend.openssl_assert(n[0] != self._backend._ffi.NULL)
+        self._backend.openssl_assert(e[0] != self._backend._ffi.NULL)
+        return RSAPublicNumbers(
+            e=self._backend._bn_to_int(e[0]),
+            n=self._backend._bn_to_int(n[0]),
+        )
+
+    def public_bytes(
+        self,
+        encoding: serialization.Encoding,
+        format: serialization.PublicFormat,
+    ) -> bytes:
+        return self._backend._public_key_bytes(
+            encoding, format, self, self._evp_pkey, self._rsa_cdata
+        )
+
+    def verify(
+        self,
+        signature: bytes,
+        data: bytes,
+        padding: AsymmetricPadding,
+        algorithm: typing.Union[asym_utils.Prehashed, hashes.HashAlgorithm],
+    ) -> None:
+        data, algorithm = _calculate_digest_and_algorithm(
+            self._backend, data, algorithm
+        )
+        return _rsa_sig_verify(
+            self._backend, padding, algorithm, self, signature, data
+        )
+
+    def recover_data_from_signature(
+        self,
+        signature: bytes,
+        padding: AsymmetricPadding,
+        algorithm: typing.Optional[hashes.HashAlgorithm],
+    ) -> bytes:
+        _check_not_prehashed(algorithm)
+        return _rsa_sig_recover(
+            self._backend, padding, algorithm, self, signature
+        )

asq-env/lib/python3.9/site-packages/cryptography/hazmat/backends/openssl/utils.py

@@ -0,0 +1,66 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+import warnings
+
+from cryptography import utils
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.asymmetric.utils import Prehashed
+
+
+def _evp_pkey_derive(backend, evp_pkey, peer_public_key):
+    ctx = backend._lib.EVP_PKEY_CTX_new(evp_pkey, backend._ffi.NULL)
+    backend.openssl_assert(ctx != backend._ffi.NULL)
+    ctx = backend._ffi.gc(ctx, backend._lib.EVP_PKEY_CTX_free)
+    res = backend._lib.EVP_PKEY_derive_init(ctx)
+    backend.openssl_assert(res == 1)
+    res = backend._lib.EVP_PKEY_derive_set_peer(ctx, peer_public_key._evp_pkey)
+    backend.openssl_assert(res == 1)
+    keylen = backend._ffi.new("size_t *")
+    res = backend._lib.EVP_PKEY_derive(ctx, backend._ffi.NULL, keylen)
+    backend.openssl_assert(res == 1)
+    backend.openssl_assert(keylen[0] > 0)
+    buf = backend._ffi.new("unsigned char[]", keylen[0])
+    res = backend._lib.EVP_PKEY_derive(ctx, buf, keylen)
+    if res != 1:
+        errors_with_text = backend._consume_errors_with_text()
+        raise ValueError("Error computing shared key.", errors_with_text)
+
+    return backend._ffi.buffer(buf, keylen[0])[:]
+
+
+def _calculate_digest_and_algorithm(backend, data, algorithm):
+    if not isinstance(algorithm, Prehashed):
+        hash_ctx = hashes.Hash(algorithm, backend)
+        hash_ctx.update(data)
+        data = hash_ctx.finalize()
+    else:
+        algorithm = algorithm._algorithm
+
+    if len(data) != algorithm.digest_size:
+        raise ValueError(
+            "The provided data must be the same length as the hash "
+            "algorithm's digest size."
+        )
+
+    return (data, algorithm)
+
+
+def _check_not_prehashed(signature_algorithm):
+    if isinstance(signature_algorithm, Prehashed):
+        raise TypeError(
+            "Prehashed is only supported in the sign and verify methods. "
+            "It cannot be used with signer, verifier or "
+            "recover_data_from_signature."
+        )
+
+
+def _warn_sign_verify_deprecated():
+    warnings.warn(
+        "signer and verifier have been deprecated. Please use sign "
+        "and verify instead.",
+        utils.PersistentlyDeprecated2017,
+        stacklevel=3,
+    )

asq-env/lib/python3.9/site-packages/cryptography/hazmat/backends/openssl/x25519.py

@@ -0,0 +1,128 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+from cryptography.hazmat.backends.openssl.utils import _evp_pkey_derive
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric.x25519 import (
+    X25519PrivateKey,
+    X25519PublicKey,
+)
+
+
+_X25519_KEY_SIZE = 32
+
+
+class _X25519PublicKey(X25519PublicKey):
+    def __init__(self, backend, evp_pkey):
+        self._backend = backend
+        self._evp_pkey = evp_pkey
+
+    def public_bytes(
+        self,
+        encoding: serialization.Encoding,
+        format: serialization.PublicFormat,
+    ) -> bytes:
+        if (
+            encoding is serialization.Encoding.Raw
+            or format is serialization.PublicFormat.Raw
+        ):
+            if (
+                encoding is not serialization.Encoding.Raw
+                or format is not serialization.PublicFormat.Raw
+            ):
+                raise ValueError(
+                    "When using Raw both encoding and format must be Raw"
+                )
+
+            return self._raw_public_bytes()
+
+        return self._backend._public_key_bytes(
+            encoding, format, self, self._evp_pkey, None
+        )
+
+    def _raw_public_bytes(self) -> bytes:
+        ucharpp = self._backend._ffi.new("unsigned char **")
+        res = self._backend._lib.EVP_PKEY_get1_tls_encodedpoint(
+            self._evp_pkey, ucharpp
+        )
+        self._backend.openssl_assert(res == 32)
+        self._backend.openssl_assert(ucharpp[0] != self._backend._ffi.NULL)
+        data = self._backend._ffi.gc(
+            ucharpp[0], self._backend._lib.OPENSSL_free
+        )
+        return self._backend._ffi.buffer(data, res)[:]
+
+
+class _X25519PrivateKey(X25519PrivateKey):
+    def __init__(self, backend, evp_pkey):
+        self._backend = backend
+        self._evp_pkey = evp_pkey
+
+    def public_key(self) -> X25519PublicKey:
+        bio = self._backend._create_mem_bio_gc()
+        res = self._backend._lib.i2d_PUBKEY_bio(bio, self._evp_pkey)
+        self._backend.openssl_assert(res == 1)
+        evp_pkey = self._backend._lib.d2i_PUBKEY_bio(
+            bio, self._backend._ffi.NULL
+        )
+        self._backend.openssl_assert(evp_pkey != self._backend._ffi.NULL)
+        evp_pkey = self._backend._ffi.gc(
+            evp_pkey, self._backend._lib.EVP_PKEY_free
+        )
+        return _X25519PublicKey(self._backend, evp_pkey)
+
+    def exchange(self, peer_public_key: X25519PublicKey) -> bytes:
+        if not isinstance(peer_public_key, X25519PublicKey):
+            raise TypeError("peer_public_key must be X25519PublicKey.")
+
+        return _evp_pkey_derive(self._backend, self._evp_pkey, peer_public_key)
+
+    def private_bytes(
+        self,
+        encoding: serialization.Encoding,
+        format: serialization.PrivateFormat,
+        encryption_algorithm: serialization.KeySerializationEncryption,
+    ) -> bytes:
+        if (
+            encoding is serialization.Encoding.Raw
+            or format is serialization.PublicFormat.Raw
+        ):
+            if (
+                format is not serialization.PrivateFormat.Raw
+                or encoding is not serialization.Encoding.Raw
+                or not isinstance(
+                    encryption_algorithm, serialization.NoEncryption
+                )
+            ):
+                raise ValueError(
+                    "When using Raw both encoding and format must be Raw "
+                    "and encryption_algorithm must be NoEncryption()"
+                )
+
+            return self._raw_private_bytes()
+
+        return self._backend._private_key_bytes(
+            encoding, format, encryption_algorithm, self, self._evp_pkey, None
+        )
+
+    def _raw_private_bytes(self) -> bytes:
+        # When we drop support for CRYPTOGRAPHY_OPENSSL_LESS_THAN_111 we can
+        # switch this to EVP_PKEY_new_raw_private_key
+        # The trick we use here is serializing to a PKCS8 key and just
+        # using the last 32 bytes, which is the key itself.
+        bio = self._backend._create_mem_bio_gc()
+        res = self._backend._lib.i2d_PKCS8PrivateKey_bio(
+            bio,
+            self._evp_pkey,
+            self._backend._ffi.NULL,
+            self._backend._ffi.NULL,
+            0,
+            self._backend._ffi.NULL,
+            self._backend._ffi.NULL,
+        )
+        self._backend.openssl_assert(res == 1)
+        pkcs8 = self._backend._read_mem_bio(bio)
+        self._backend.openssl_assert(len(pkcs8) == 48)
+        return pkcs8[-_X25519_KEY_SIZE:]

asq-env/lib/python3.9/site-packages/cryptography/hazmat/backends/openssl/x448.py

@@ -0,0 +1,112 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+from cryptography.hazmat.backends.openssl.utils import _evp_pkey_derive
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric.x448 import (
+    X448PrivateKey,
+    X448PublicKey,
+)
+
+_X448_KEY_SIZE = 56
+
+
+class _X448PublicKey(X448PublicKey):
+    def __init__(self, backend, evp_pkey):
+        self._backend = backend
+        self._evp_pkey = evp_pkey
+
+    def public_bytes(
+        self,
+        encoding: serialization.Encoding,
+        format: serialization.PublicFormat,
+    ) -> bytes:
+        if (
+            encoding is serialization.Encoding.Raw
+            or format is serialization.PublicFormat.Raw
+        ):
+            if (
+                encoding is not serialization.Encoding.Raw
+                or format is not serialization.PublicFormat.Raw
+            ):
+                raise ValueError(
+                    "When using Raw both encoding and format must be Raw"
+                )
+
+            return self._raw_public_bytes()
+
+        return self._backend._public_key_bytes(
+            encoding, format, self, self._evp_pkey, None
+        )
+
+    def _raw_public_bytes(self) -> bytes:
+        buf = self._backend._ffi.new("unsigned char []", _X448_KEY_SIZE)
+        buflen = self._backend._ffi.new("size_t *", _X448_KEY_SIZE)
+        res = self._backend._lib.EVP_PKEY_get_raw_public_key(
+            self._evp_pkey, buf, buflen
+        )
+        self._backend.openssl_assert(res == 1)
+        self._backend.openssl_assert(buflen[0] == _X448_KEY_SIZE)
+        return self._backend._ffi.buffer(buf, _X448_KEY_SIZE)[:]
+
+
+class _X448PrivateKey(X448PrivateKey):
+    def __init__(self, backend, evp_pkey):
+        self._backend = backend
+        self._evp_pkey = evp_pkey
+
+    def public_key(self) -> X448PublicKey:
+        buf = self._backend._ffi.new("unsigned char []", _X448_KEY_SIZE)
+        buflen = self._backend._ffi.new("size_t *", _X448_KEY_SIZE)
+        res = self._backend._lib.EVP_PKEY_get_raw_public_key(
+            self._evp_pkey, buf, buflen
+        )
+        self._backend.openssl_assert(res == 1)
+        self._backend.openssl_assert(buflen[0] == _X448_KEY_SIZE)
+        return self._backend.x448_load_public_bytes(buf)
+
+    def exchange(self, peer_public_key: X448PublicKey) -> bytes:
+        if not isinstance(peer_public_key, X448PublicKey):
+            raise TypeError("peer_public_key must be X448PublicKey.")
+
+        return _evp_pkey_derive(self._backend, self._evp_pkey, peer_public_key)
+
+    def private_bytes(
+        self,
+        encoding: serialization.Encoding,
+        format: serialization.PrivateFormat,
+        encryption_algorithm: serialization.KeySerializationEncryption,
+    ) -> bytes:
+        if (
+            encoding is serialization.Encoding.Raw
+            or format is serialization.PublicFormat.Raw
+        ):
+            if (
+                format is not serialization.PrivateFormat.Raw
+                or encoding is not serialization.Encoding.Raw
+                or not isinstance(
+                    encryption_algorithm, serialization.NoEncryption
+                )
+            ):
+                raise ValueError(
+                    "When using Raw both encoding and format must be Raw "
+                    "and encryption_algorithm must be NoEncryption()"
+                )
+
+            return self._raw_private_bytes()
+
+        return self._backend._private_key_bytes(
+            encoding, format, encryption_algorithm, self, self._evp_pkey, None
+        )
+
+    def _raw_private_bytes(self) -> bytes:
+        buf = self._backend._ffi.new("unsigned char []", _X448_KEY_SIZE)
+        buflen = self._backend._ffi.new("size_t *", _X448_KEY_SIZE)
+        res = self._backend._lib.EVP_PKEY_get_raw_private_key(
+            self._evp_pkey, buf, buflen
+        )
+        self._backend.openssl_assert(res == 1)
+        self._backend.openssl_assert(buflen[0] == _X448_KEY_SIZE)
+        return self._backend._ffi.buffer(buf, _X448_KEY_SIZE)[:]

asq-env/lib/python3.9/site-packages/cryptography/hazmat/backends/openssl/x509.py

@@ -0,0 +1,70 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+import datetime
+import warnings
+
+from cryptography import utils, x509
+
+
+# This exists for pyOpenSSL compatibility and SHOULD NOT BE USED
+# WE WILL REMOVE THIS VERY SOON.
+def _Certificate(backend, x509) -> x509.Certificate:  # noqa: N802
+    warnings.warn(
+        "This version of cryptography contains a temporary pyOpenSSL "
+        "fallback path. Upgrade pyOpenSSL now.",
+        utils.DeprecatedIn35,
+    )
+    return backend._ossl2cert(x509)
+
+
+# This exists for pyOpenSSL compatibility and SHOULD NOT BE USED
+# WE WILL REMOVE THIS VERY SOON.
+def _CertificateSigningRequest(  # noqa: N802
+    backend, x509_req
+) -> x509.CertificateSigningRequest:
+    warnings.warn(
+        "This version of cryptography contains a temporary pyOpenSSL "
+        "fallback path. Upgrade pyOpenSSL now.",
+        utils.DeprecatedIn35,
+    )
+    return backend._ossl2csr(x509_req)
+
+
+# This exists for pyOpenSSL compatibility and SHOULD NOT BE USED
+# WE WILL REMOVE THIS VERY SOON.
+def _CertificateRevocationList(  # noqa: N802
+    backend, x509_crl
+) -> x509.CertificateRevocationList:
+    warnings.warn(
+        "This version of cryptography contains a temporary pyOpenSSL "
+        "fallback path. Upgrade pyOpenSSL now.",
+        utils.DeprecatedIn35,
+    )
+    return backend._ossl2crl(x509_crl)
+
+
+class _RawRevokedCertificate(x509.RevokedCertificate):
+    def __init__(
+        self,
+        serial_number: int,
+        revocation_date: datetime.datetime,
+        extensions: x509.Extensions,
+    ):
+        self._serial_number = serial_number
+        self._revocation_date = revocation_date
+        self._extensions = extensions
+
+    @property
+    def serial_number(self) -> int:
+        return self._serial_number
+
+    @property
+    def revocation_date(self) -> datetime.datetime:
+        return self._revocation_date
+
+    @property
+    def extensions(self) -> x509.Extensions:
+        return self._extensions

asq-env/lib/python3.9/site-packages/cryptography/hazmat/bindings/__init__.py

@@ -0,0 +1,3 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.

asq-env/lib/python3.9/site-packages/cryptography/hazmat/bindings/_rust/__init__.pyi

@@ -0,0 +1,2 @@
+def check_pkcs7_padding(data: bytes) -> bool: ...
+def check_ansix923_padding(data: bytes) -> bool: ...

asq-env/lib/python3.9/site-packages/cryptography/hazmat/bindings/_rust/asn1.pyi

@@ -0,0 +1,16 @@
+import typing
+
+from cryptography.x509 import TLSFeature, PrecertPoison
+
+class TestCertificate:
+    not_after_tag: int
+    not_before_tag: int
+    issuer_value_tags: typing.List[int]
+    subject_value_tags: typing.List[int]
+
+def decode_dss_signature(signature: bytes) -> typing.Tuple[int, int]: ...
+def encode_dss_signature(r: int, s: int) -> bytes: ...
+def encode_tls_feature(ext: TLSFeature) -> bytes: ...
+def encode_precert_poison(ext: PrecertPoison) -> bytes: ...
+def parse_spki_for_data(data: bytes) -> bytes: ...
+def test_parse_certificate(data: bytes) -> TestCertificate: ...

asq-env/lib/python3.9/site-packages/cryptography/hazmat/bindings/_rust/ocsp.pyi

@@ -0,0 +1,5 @@
+from cryptography.x509 import ExtensionType
+from cryptography.x509.ocsp import OCSPRequest, OCSPResponse
+
+def load_der_ocsp_request(data: bytes) -> OCSPRequest: ...
+def load_der_ocsp_response(data: bytes) -> OCSPResponse: ...

asq-env/lib/python3.9/site-packages/cryptography/hazmat/bindings/_rust/x509.pyi

@@ -0,0 +1,23 @@
+import datetime
+import typing
+
+from cryptography import x509
+
+def parse_csr_extension(
+    der_oid: bytes, ext_data: bytes
+) -> x509.ExtensionType: ...
+def load_pem_x509_certificate(data: bytes) -> x509.Certificate: ...
+def load_der_x509_certificate(data: bytes) -> x509.Certificate: ...
+def load_pem_x509_crl(data: bytes) -> x509.CertificateRevocationList: ...
+def load_der_x509_crl(data: bytes) -> x509.CertificateRevocationList: ...
+def load_pem_x509_csr(data: bytes) -> x509.CertificateSigningRequest: ...
+def load_der_x509_csr(data: bytes) -> x509.CertificateSigningRequest: ...
+def encode_precertificate_signed_certificate_timestamps(
+    extension: x509.PrecertificateSignedCertificateTimestamps,
+) -> bytes: ...
+
+class Sct: ...
+class Certificate: ...
+class RevokedCertificate: ...
+class CertificateRevocationList: ...
+class CertificateSigningRequest: ...

asq-env/lib/python3.9/site-packages/cryptography/hazmat/bindings/openssl/__init__.py

@@ -0,0 +1,3 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.

asq-env/lib/python3.9/site-packages/cryptography/hazmat/bindings/openssl/_conditional.py

@@ -0,0 +1,316 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+def cryptography_has_ec2m():
+    return [
+        "EC_POINT_get_affine_coordinates_GF2m",
+    ]
+
+
+def cryptography_has_rsa_oaep_md():
+    return [
+        "EVP_PKEY_CTX_set_rsa_oaep_md",
+    ]
+
+
+def cryptography_has_rsa_oaep_label():
+    return [
+        "EVP_PKEY_CTX_set0_rsa_oaep_label",
+    ]
+
+
+def cryptography_has_ssl3_method():
+    return [
+        "SSLv3_method",
+        "SSLv3_client_method",
+        "SSLv3_server_method",
+    ]
+
+
+def cryptography_has_110_verification_params():
+    return ["X509_CHECK_FLAG_NEVER_CHECK_SUBJECT"]
+
+
+def cryptography_has_set_cert_cb():
+    return [
+        "SSL_CTX_set_cert_cb",
+        "SSL_set_cert_cb",
+    ]
+
+
+def cryptography_has_ssl_st():
+    return [
+        "SSL_ST_BEFORE",
+        "SSL_ST_OK",
+        "SSL_ST_INIT",
+        "SSL_ST_RENEGOTIATE",
+    ]
+
+
+def cryptography_has_tls_st():
+    return [
+        "TLS_ST_BEFORE",
+        "TLS_ST_OK",
+    ]
+
+
+def cryptography_has_scrypt():
+    return [
+        "EVP_PBE_scrypt",
+    ]
+
+
+def cryptography_has_evp_pkey_dhx():
+    return [
+        "EVP_PKEY_DHX",
+    ]
+
+
+def cryptography_has_mem_functions():
+    return [
+        "Cryptography_CRYPTO_set_mem_functions",
+    ]
+
+
+def cryptography_has_x509_store_ctx_get_issuer():
+    return [
+        "X509_STORE_get_get_issuer",
+        "X509_STORE_set_get_issuer",
+    ]
+
+
+def cryptography_has_ed448():
+    return [
+        "EVP_PKEY_ED448",
+        "NID_ED448",
+    ]
+
+
+def cryptography_has_ed25519():
+    return [
+        "NID_ED25519",
+        "EVP_PKEY_ED25519",
+    ]
+
+
+def cryptography_has_poly1305():
+    return [
+        "NID_poly1305",
+        "EVP_PKEY_POLY1305",
+    ]
+
+
+def cryptography_has_oneshot_evp_digest_sign_verify():
+    return [
+        "EVP_DigestSign",
+        "EVP_DigestVerify",
+    ]
+
+
+def cryptography_has_evp_digestfinal_xof():
+    return [
+        "EVP_DigestFinalXOF",
+    ]
+
+
+def cryptography_has_evp_pkey_get_set_tls_encodedpoint():
+    return [
+        "EVP_PKEY_get1_tls_encodedpoint",
+        "EVP_PKEY_set1_tls_encodedpoint",
+    ]
+
+
+def cryptography_has_fips():
+    return [
+        "FIPS_mode_set",
+        "FIPS_mode",
+    ]
+
+
+def cryptography_has_ssl_sigalgs():
+    return [
+        "SSL_CTX_set1_sigalgs_list",
+        "SSL_get_sigalgs",
+    ]
+
+
+def cryptography_has_psk():
+    return [
+        "SSL_CTX_use_psk_identity_hint",
+        "SSL_CTX_set_psk_server_callback",
+        "SSL_CTX_set_psk_client_callback",
+    ]
+
+
+def cryptography_has_custom_ext():
+    return [
+        "SSL_CTX_add_client_custom_ext",
+        "SSL_CTX_add_server_custom_ext",
+        "SSL_extension_supported",
+    ]
+
+
+def cryptography_has_openssl_cleanup():
+    return [
+        "OPENSSL_cleanup",
+    ]
+
+
+def cryptography_has_tlsv13():
+    return [
+        "TLS1_3_VERSION",
+        "SSL_OP_NO_TLSv1_3",
+        "SSL_VERIFY_POST_HANDSHAKE",
+        "SSL_CTX_set_ciphersuites",
+        "SSL_verify_client_post_handshake",
+        "SSL_CTX_set_post_handshake_auth",
+        "SSL_set_post_handshake_auth",
+        "SSL_SESSION_get_max_early_data",
+        "SSL_write_early_data",
+        "SSL_read_early_data",
+        "SSL_CTX_set_max_early_data",
+    ]
+
+
+def cryptography_has_keylog():
+    return [
+        "SSL_CTX_set_keylog_callback",
+        "SSL_CTX_get_keylog_callback",
+    ]
+
+
+def cryptography_has_raw_key():
+    return [
+        "EVP_PKEY_new_raw_private_key",
+        "EVP_PKEY_new_raw_public_key",
+        "EVP_PKEY_get_raw_private_key",
+        "EVP_PKEY_get_raw_public_key",
+    ]
+
+
+def cryptography_has_engine():
+    return [
+        "ENGINE_by_id",
+        "ENGINE_init",
+        "ENGINE_finish",
+        "ENGINE_get_default_RAND",
+        "ENGINE_set_default_RAND",
+        "ENGINE_unregister_RAND",
+        "ENGINE_ctrl_cmd",
+        "ENGINE_free",
+        "ENGINE_get_name",
+        "Cryptography_add_osrandom_engine",
+        "ENGINE_ctrl_cmd_string",
+        "ENGINE_load_builtin_engines",
+        "ENGINE_load_private_key",
+        "ENGINE_load_public_key",
+    ]
+
+
+def cryptography_has_verified_chain():
+    return [
+        "SSL_get0_verified_chain",
+    ]
+
+
+def cryptography_has_srtp():
+    return [
+        "SSL_CTX_set_tlsext_use_srtp",
+        "SSL_set_tlsext_use_srtp",
+        "SSL_get_selected_srtp_profile",
+    ]
+
+
+def cryptography_has_get_proto_version():
+    return [
+        "SSL_CTX_get_min_proto_version",
+        "SSL_CTX_get_max_proto_version",
+        "SSL_get_min_proto_version",
+        "SSL_get_max_proto_version",
+    ]
+
+
+def cryptography_has_providers():
+    return [
+        "OSSL_PROVIDER_load",
+        "OSSL_PROVIDER_unload",
+        "ERR_LIB_PROV",
+        "PROV_R_WRONG_FINAL_BLOCK_LENGTH",
+        "PROV_R_BAD_DECRYPT",
+    ]
+
+
+def cryptography_has_op_no_renegotiation():
+    return [
+        "SSL_OP_NO_RENEGOTIATION",
+    ]
+
+
+def cryptography_has_dtls_get_data_mtu():
+    return [
+        "DTLS_get_data_mtu",
+    ]
+
+
+def cryptography_has_300_fips():
+    return [
+        "EVP_default_properties_is_fips_enabled",
+        "EVP_default_properties_enable_fips",
+    ]
+
+
+# This is a mapping of
+# {condition: function-returning-names-dependent-on-that-condition} so we can
+# loop over them and delete unsupported names at runtime. It will be removed
+# when cffi supports #if in cdef. We use functions instead of just a dict of
+# lists so we can use coverage to measure which are used.
+CONDITIONAL_NAMES = {
+    "Cryptography_HAS_EC2M": cryptography_has_ec2m,
+    "Cryptography_HAS_RSA_OAEP_MD": cryptography_has_rsa_oaep_md,
+    "Cryptography_HAS_RSA_OAEP_LABEL": cryptography_has_rsa_oaep_label,
+    "Cryptography_HAS_SSL3_METHOD": cryptography_has_ssl3_method,
+    "Cryptography_HAS_110_VERIFICATION_PARAMS": (
+        cryptography_has_110_verification_params
+    ),
+    "Cryptography_HAS_SET_CERT_CB": cryptography_has_set_cert_cb,
+    "Cryptography_HAS_SSL_ST": cryptography_has_ssl_st,
+    "Cryptography_HAS_TLS_ST": cryptography_has_tls_st,
+    "Cryptography_HAS_SCRYPT": cryptography_has_scrypt,
+    "Cryptography_HAS_EVP_PKEY_DHX": cryptography_has_evp_pkey_dhx,
+    "Cryptography_HAS_MEM_FUNCTIONS": cryptography_has_mem_functions,
+    "Cryptography_HAS_X509_STORE_CTX_GET_ISSUER": (
+        cryptography_has_x509_store_ctx_get_issuer
+    ),
+    "Cryptography_HAS_ED448": cryptography_has_ed448,
+    "Cryptography_HAS_ED25519": cryptography_has_ed25519,
+    "Cryptography_HAS_POLY1305": cryptography_has_poly1305,
+    "Cryptography_HAS_ONESHOT_EVP_DIGEST_SIGN_VERIFY": (
+        cryptography_has_oneshot_evp_digest_sign_verify
+    ),
+    "Cryptography_HAS_EVP_PKEY_get_set_tls_encodedpoint": (
+        cryptography_has_evp_pkey_get_set_tls_encodedpoint
+    ),
+    "Cryptography_HAS_FIPS": cryptography_has_fips,
+    "Cryptography_HAS_SIGALGS": cryptography_has_ssl_sigalgs,
+    "Cryptography_HAS_PSK": cryptography_has_psk,
+    "Cryptography_HAS_CUSTOM_EXT": cryptography_has_custom_ext,
+    "Cryptography_HAS_OPENSSL_CLEANUP": cryptography_has_openssl_cleanup,
+    "Cryptography_HAS_TLSv1_3": cryptography_has_tlsv13,
+    "Cryptography_HAS_KEYLOG": cryptography_has_keylog,
+    "Cryptography_HAS_RAW_KEY": cryptography_has_raw_key,
+    "Cryptography_HAS_EVP_DIGESTFINAL_XOF": (
+        cryptography_has_evp_digestfinal_xof
+    ),
+    "Cryptography_HAS_ENGINE": cryptography_has_engine,
+    "Cryptography_HAS_VERIFIED_CHAIN": cryptography_has_verified_chain,
+    "Cryptography_HAS_SRTP": cryptography_has_srtp,
+    "Cryptography_HAS_GET_PROTO_VERSION": cryptography_has_get_proto_version,
+    "Cryptography_HAS_PROVIDERS": cryptography_has_providers,
+    "Cryptography_HAS_OP_NO_RENEGOTIATION": (
+        cryptography_has_op_no_renegotiation
+    ),
+    "Cryptography_HAS_DTLS_GET_DATA_MTU": cryptography_has_dtls_get_data_mtu,
+    "Cryptography_HAS_300_FIPS": cryptography_has_300_fips,
+}

asq-env/lib/python3.9/site-packages/cryptography/hazmat/bindings/openssl/binding.py

@@ -0,0 +1,205 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+import collections
+import threading
+import types
+import typing
+
+import cryptography
+from cryptography import utils
+from cryptography.exceptions import InternalError
+from cryptography.hazmat.bindings._openssl import ffi, lib
+from cryptography.hazmat.bindings.openssl._conditional import CONDITIONAL_NAMES
+
+_OpenSSLErrorWithText = collections.namedtuple(
+    "_OpenSSLErrorWithText", ["code", "lib", "reason", "reason_text"]
+)
+
+
+class _OpenSSLError(object):
+    def __init__(self, code, lib, reason):
+        self._code = code
+        self._lib = lib
+        self._reason = reason
+
+    def _lib_reason_match(self, lib, reason):
+        return lib == self.lib and reason == self.reason
+
+    code = utils.read_only_property("_code")
+    lib = utils.read_only_property("_lib")
+    reason = utils.read_only_property("_reason")
+
+
+def _consume_errors(lib):
+    errors = []
+    while True:
+        code = lib.ERR_get_error()
+        if code == 0:
+            break
+
+        err_lib = lib.ERR_GET_LIB(code)
+        err_reason = lib.ERR_GET_REASON(code)
+
+        errors.append(_OpenSSLError(code, err_lib, err_reason))
+
+    return errors
+
+
+def _errors_with_text(errors):
+    errors_with_text = []
+    for err in errors:
+        buf = ffi.new("char[]", 256)
+        lib.ERR_error_string_n(err.code, buf, len(buf))
+        err_text_reason = ffi.string(buf)
+
+        errors_with_text.append(
+            _OpenSSLErrorWithText(
+                err.code, err.lib, err.reason, err_text_reason
+            )
+        )
+
+    return errors_with_text
+
+
+def _consume_errors_with_text(lib):
+    return _errors_with_text(_consume_errors(lib))
+
+
+def _openssl_assert(lib, ok, errors=None):
+    if not ok:
+        if errors is None:
+            errors = _consume_errors(lib)
+        errors_with_text = _errors_with_text(errors)
+
+        raise InternalError(
+            "Unknown OpenSSL error. This error is commonly encountered when "
+            "another library is not cleaning up the OpenSSL error stack. If "
+            "you are using cryptography with another library that uses "
+            "OpenSSL try disabling it before reporting a bug. Otherwise "
+            "please file an issue at https://github.com/pyca/cryptography/"
+            "issues with information on how to reproduce "
+            "this. ({0!r})".format(errors_with_text),
+            errors_with_text,
+        )
+
+
+def build_conditional_library(lib, conditional_names):
+    conditional_lib = types.ModuleType("lib")
+    conditional_lib._original_lib = lib  # type: ignore[attr-defined]
+    excluded_names = set()
+    for condition, names_cb in conditional_names.items():
+        if not getattr(lib, condition):
+            excluded_names.update(names_cb())
+
+    for attr in dir(lib):
+        if attr not in excluded_names:
+            setattr(conditional_lib, attr, getattr(lib, attr))
+
+    return conditional_lib
+
+
+class Binding(object):
+    """
+    OpenSSL API wrapper.
+    """
+
+    lib: typing.ClassVar = None
+    ffi = ffi
+    _lib_loaded = False
+    _init_lock = threading.Lock()
+    _legacy_provider: typing.Any = None
+    _default_provider: typing.Any = None
+
+    def __init__(self):
+        self._ensure_ffi_initialized()
+
+    def _enable_fips(self):
+        # This function enables FIPS mode for OpenSSL 3.0.0 on installs that
+        # have the FIPS provider installed properly.
+        _openssl_assert(self.lib, self.lib.CRYPTOGRAPHY_OPENSSL_300_OR_GREATER)
+        self._base_provider = self.lib.OSSL_PROVIDER_load(
+            self.ffi.NULL, b"base"
+        )
+        _openssl_assert(self.lib, self._base_provider != self.ffi.NULL)
+        self.lib._fips_provider = self.lib.OSSL_PROVIDER_load(
+            self.ffi.NULL, b"fips"
+        )
+        _openssl_assert(self.lib, self.lib._fips_provider != self.ffi.NULL)
+
+        res = self.lib.EVP_default_properties_enable_fips(self.ffi.NULL, 1)
+        _openssl_assert(self.lib, res == 1)
+
+    @classmethod
+    def _register_osrandom_engine(cls):
+        # Clear any errors extant in the queue before we start. In many
+        # scenarios other things may be interacting with OpenSSL in the same
+        # process space and it has proven untenable to assume that they will
+        # reliably clear the error queue. Once we clear it here we will
+        # error on any subsequent unexpected item in the stack.
+        cls.lib.ERR_clear_error()
+        if cls.lib.CRYPTOGRAPHY_NEEDS_OSRANDOM_ENGINE:
+            result = cls.lib.Cryptography_add_osrandom_engine()
+            _openssl_assert(cls.lib, result in (1, 2))
+
+    @classmethod
+    def _ensure_ffi_initialized(cls):
+        with cls._init_lock:
+            if not cls._lib_loaded:
+                cls.lib = build_conditional_library(lib, CONDITIONAL_NAMES)
+                cls._lib_loaded = True
+                # initialize the SSL library
+                cls.lib.SSL_library_init()
+                # adds all ciphers/digests for EVP
+                cls.lib.OpenSSL_add_all_algorithms()
+                cls._register_osrandom_engine()
+                # As of OpenSSL 3.0.0 we must register a legacy cipher provider
+                # to get RC2 (needed for junk asymmetric private key
+                # serialization), RC4, Blowfish, IDEA, SEED, etc. These things
+                # are ugly legacy, but we aren't going to get rid of them
+                # any time soon.
+                if cls.lib.CRYPTOGRAPHY_OPENSSL_300_OR_GREATER:
+                    cls._legacy_provider = cls.lib.OSSL_PROVIDER_load(
+                        cls.ffi.NULL, b"legacy"
+                    )
+                    _openssl_assert(
+                        cls.lib, cls._legacy_provider != cls.ffi.NULL
+                    )
+                    cls._default_provider = cls.lib.OSSL_PROVIDER_load(
+                        cls.ffi.NULL, b"default"
+                    )
+                    _openssl_assert(
+                        cls.lib, cls._default_provider != cls.ffi.NULL
+                    )
+
+    @classmethod
+    def init_static_locks(cls):
+        cls._ensure_ffi_initialized()
+
+
+def _verify_package_version(version):
+    # Occasionally we run into situations where the version of the Python
+    # package does not match the version of the shared object that is loaded.
+    # This may occur in environments where multiple versions of cryptography
+    # are installed and available in the python path. To avoid errors cropping
+    # up later this code checks that the currently imported package and the
+    # shared object that were loaded have the same version and raise an
+    # ImportError if they do not
+    so_package_version = ffi.string(lib.CRYPTOGRAPHY_PACKAGE_VERSION)
+    if version.encode("ascii") != so_package_version:
+        raise ImportError(
+            "The version of cryptography does not match the loaded "
+            "shared object. This can happen if you have multiple copies of "
+            "cryptography installed in your Python path. Please try creating "
+            "a new virtual environment to resolve this issue. "
+            "Loaded python version: {}, shared object version: {}".format(
+                version, so_package_version
+            )
+        )
+
+
+_verify_package_version(cryptography.__version__)
+
+Binding.init_static_locks()

asq-env/lib/python3.9/site-packages/cryptography/hazmat/primitives/__init__.py

@@ -0,0 +1,3 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.

asq-env/lib/python3.9/site-packages/cryptography/hazmat/primitives/_asymmetric.py

@@ -0,0 +1,17 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+import abc
+
+
+# This exists to break an import cycle. It is normally accessible from the
+# asymmetric padding module.
+
+
+class AsymmetricPadding(metaclass=abc.ABCMeta):
+    @abc.abstractproperty
+    def name(self) -> str:
+        """
+        A string naming this padding (e.g. "PSS", "PKCS1").
+        """

asq-env/lib/python3.9/site-packages/cryptography/hazmat/primitives/_cipheralgorithm.py

@@ -0,0 +1,38 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+import abc
+import typing
+
+
+# This exists to break an import cycle. It is normally accessible from the
+# ciphers module.
+
+
+class CipherAlgorithm(metaclass=abc.ABCMeta):
+    @abc.abstractproperty
+    def name(self) -> str:
+        """
+        A string naming this mode (e.g. "AES", "Camellia").
+        """
+
+    @abc.abstractproperty
+    def key_sizes(self) -> typing.FrozenSet[int]:
+        """
+        Valid key sizes for this algorithm in bits
+        """
+
+    @abc.abstractproperty
+    def key_size(self) -> int:
+        """
+        The size of the key being used as an integer in bits (e.g. 128, 256).
+        """
+
+
+class BlockCipherAlgorithm(metaclass=abc.ABCMeta):
+    @abc.abstractproperty
+    def block_size(self) -> int:
+        """
+        The size of a block as an integer in bits (e.g. 64, 128).
+        """

asq-env/lib/python3.9/site-packages/cryptography/hazmat/primitives/_serialization.py

@@ -0,0 +1,55 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+import abc
+
+from cryptography import utils
+
+# This exists to break an import cycle. These classes are normally accessible
+# from the serialization module.
+
+
+class Encoding(utils.Enum):
+    PEM = "PEM"
+    DER = "DER"
+    OpenSSH = "OpenSSH"
+    Raw = "Raw"
+    X962 = "ANSI X9.62"
+    SMIME = "S/MIME"
+
+
+class PrivateFormat(utils.Enum):
+    PKCS8 = "PKCS8"
+    TraditionalOpenSSL = "TraditionalOpenSSL"
+    Raw = "Raw"
+    OpenSSH = "OpenSSH"
+
+
+class PublicFormat(utils.Enum):
+    SubjectPublicKeyInfo = "X.509 subjectPublicKeyInfo with PKCS#1"
+    PKCS1 = "Raw PKCS#1"
+    OpenSSH = "OpenSSH"
+    Raw = "Raw"
+    CompressedPoint = "X9.62 Compressed Point"
+    UncompressedPoint = "X9.62 Uncompressed Point"
+
+
+class ParameterFormat(utils.Enum):
+    PKCS3 = "PKCS3"
+
+
+class KeySerializationEncryption(metaclass=abc.ABCMeta):
+    pass
+
+
+class BestAvailableEncryption(KeySerializationEncryption):
+    def __init__(self, password: bytes):
+        if not isinstance(password, bytes) or len(password) == 0:
+            raise ValueError("Password must be 1 or more bytes.")
+
+        self.password = password
+
+
+class NoEncryption(KeySerializationEncryption):
+    pass

asq-env/lib/python3.9/site-packages/cryptography/hazmat/primitives/asymmetric/__init__.py

@@ -0,0 +1,35 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+import abc
+
+
+class AsymmetricSignatureContext(metaclass=abc.ABCMeta):
+    @abc.abstractmethod
+    def update(self, data: bytes) -> None:
+        """
+        Processes the provided bytes and returns nothing.
+        """
+
+    @abc.abstractmethod
+    def finalize(self) -> bytes:
+        """
+        Returns the signature as bytes.
+        """
+
+
+class AsymmetricVerificationContext(metaclass=abc.ABCMeta):
+    @abc.abstractmethod
+    def update(self, data: bytes) -> None:
+        """
+        Processes the provided bytes and returns nothing.
+        """
+
+    @abc.abstractmethod
+    def verify(self) -> None:
+        """
+        Raises an exception if the bytes provided to update do not match the
+        signature or the signature does not match the public key.
+        """

asq-env/lib/python3.9/site-packages/cryptography/hazmat/primitives/asymmetric/dh.py

@@ -0,0 +1,239 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+import abc
+import typing
+
+from cryptography.hazmat.backends import _get_backend
+from cryptography.hazmat.backends.interfaces import Backend
+from cryptography.hazmat.primitives import serialization
+
+
+_MIN_MODULUS_SIZE = 512
+
+
+def generate_parameters(
+    generator: int, key_size: int, backend: typing.Optional[Backend] = None
+) -> "DHParameters":
+    backend = _get_backend(backend)
+    return backend.generate_dh_parameters(generator, key_size)
+
+
+class DHParameterNumbers(object):
+    def __init__(self, p: int, g: int, q: typing.Optional[int] = None) -> None:
+        if not isinstance(p, int) or not isinstance(g, int):
+            raise TypeError("p and g must be integers")
+        if q is not None and not isinstance(q, int):
+            raise TypeError("q must be integer or None")
+
+        if g < 2:
+            raise ValueError("DH generator must be 2 or greater")
+
+        if p.bit_length() < _MIN_MODULUS_SIZE:
+            raise ValueError(
+                "p (modulus) must be at least {}-bit".format(_MIN_MODULUS_SIZE)
+            )
+
+        self._p = p
+        self._g = g
+        self._q = q
+
+    def __eq__(self, other):
+        if not isinstance(other, DHParameterNumbers):
+            return NotImplemented
+
+        return (
+            self._p == other._p and self._g == other._g and self._q == other._q
+        )
+
+    def __ne__(self, other):
+        return not self == other
+
+    def parameters(
+        self, backend: typing.Optional[Backend] = None
+    ) -> "DHParameters":
+        backend = _get_backend(backend)
+        return backend.load_dh_parameter_numbers(self)
+
+    p = property(lambda self: self._p)
+    g = property(lambda self: self._g)
+    q = property(lambda self: self._q)
+
+
+class DHPublicNumbers(object):
+    def __init__(self, y: int, parameter_numbers: DHParameterNumbers) -> None:
+        if not isinstance(y, int):
+            raise TypeError("y must be an integer.")
+
+        if not isinstance(parameter_numbers, DHParameterNumbers):
+            raise TypeError(
+                "parameters must be an instance of DHParameterNumbers."
+            )
+
+        self._y = y
+        self._parameter_numbers = parameter_numbers
+
+    def __eq__(self, other):
+        if not isinstance(other, DHPublicNumbers):
+            return NotImplemented
+
+        return (
+            self._y == other._y
+            and self._parameter_numbers == other._parameter_numbers
+        )
+
+    def __ne__(self, other):
+        return not self == other
+
+    def public_key(
+        self, backend: typing.Optional[Backend] = None
+    ) -> "DHPublicKey":
+        backend = _get_backend(backend)
+        return backend.load_dh_public_numbers(self)
+
+    y = property(lambda self: self._y)
+    parameter_numbers = property(lambda self: self._parameter_numbers)
+
+
+class DHPrivateNumbers(object):
+    def __init__(self, x: int, public_numbers: DHPublicNumbers) -> None:
+        if not isinstance(x, int):
+            raise TypeError("x must be an integer.")
+
+        if not isinstance(public_numbers, DHPublicNumbers):
+            raise TypeError(
+                "public_numbers must be an instance of " "DHPublicNumbers."
+            )
+
+        self._x = x
+        self._public_numbers = public_numbers
+
+    def __eq__(self, other):
+        if not isinstance(other, DHPrivateNumbers):
+            return NotImplemented
+
+        return (
+            self._x == other._x
+            and self._public_numbers == other._public_numbers
+        )
+
+    def __ne__(self, other):
+        return not self == other
+
+    def private_key(
+        self, backend: typing.Optional[Backend] = None
+    ) -> "DHPrivateKey":
+        backend = _get_backend(backend)
+        return backend.load_dh_private_numbers(self)
+
+    public_numbers = property(lambda self: self._public_numbers)
+    x = property(lambda self: self._x)
+
+
+class DHParameters(metaclass=abc.ABCMeta):
+    @abc.abstractmethod
+    def generate_private_key(self) -> "DHPrivateKey":
+        """
+        Generates and returns a DHPrivateKey.
+        """
+
+    @abc.abstractmethod
+    def parameter_bytes(
+        self,
+        encoding: "serialization.Encoding",
+        format: "serialization.ParameterFormat",
+    ) -> bytes:
+        """
+        Returns the parameters serialized as bytes.
+        """
+
+    @abc.abstractmethod
+    def parameter_numbers(self) -> DHParameterNumbers:
+        """
+        Returns a DHParameterNumbers.
+        """
+
+
+DHParametersWithSerialization = DHParameters
+
+
+class DHPublicKey(metaclass=abc.ABCMeta):
+    @abc.abstractproperty
+    def key_size(self) -> int:
+        """
+        The bit length of the prime modulus.
+        """
+
+    @abc.abstractmethod
+    def parameters(self) -> DHParameters:
+        """
+        The DHParameters object associated with this public key.
+        """
+
+    @abc.abstractmethod
+    def public_numbers(self) -> DHPublicNumbers:
+        """
+        Returns a DHPublicNumbers.
+        """
+
+    @abc.abstractmethod
+    def public_bytes(
+        self,
+        encoding: "serialization.Encoding",
+        format: "serialization.PublicFormat",
+    ) -> bytes:
+        """
+        Returns the key serialized as bytes.
+        """
+
+
+DHPublicKeyWithSerialization = DHPublicKey
+
+
+class DHPrivateKey(metaclass=abc.ABCMeta):
+    @abc.abstractproperty
+    def key_size(self) -> int:
+        """
+        The bit length of the prime modulus.
+        """
+
+    @abc.abstractmethod
+    def public_key(self) -> DHPublicKey:
+        """
+        The DHPublicKey associated with this private key.
+        """
+
+    @abc.abstractmethod
+    def parameters(self) -> DHParameters:
+        """
+        The DHParameters object associated with this private key.
+        """
+
+    @abc.abstractmethod
+    def exchange(self, peer_public_key: DHPublicKey) -> bytes:
+        """
+        Given peer's DHPublicKey, carry out the key exchange and
+        return shared key as bytes.
+        """
+
+    @abc.abstractmethod
+    def private_numbers(self) -> DHPrivateNumbers:
+        """
+        Returns a DHPrivateNumbers.
+        """
+
+    @abc.abstractmethod
+    def private_bytes(
+        self,
+        encoding: "serialization.Encoding",
+        format: "serialization.PrivateFormat",
+        encryption_algorithm: "serialization.KeySerializationEncryption",
+    ) -> bytes:
+        """
+        Returns the key serialized as bytes.
+        """
+
+
+DHPrivateKeyWithSerialization = DHPrivateKey

asq-env/lib/python3.9/site-packages/cryptography/hazmat/primitives/asymmetric/dsa.py

@@ -0,0 +1,297 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+import abc
+import typing
+
+from cryptography.hazmat.backends import _get_backend
+from cryptography.hazmat.backends.interfaces import Backend
+from cryptography.hazmat.primitives import _serialization, hashes
+from cryptography.hazmat.primitives.asymmetric import (
+    AsymmetricSignatureContext,
+    AsymmetricVerificationContext,
+    utils as asym_utils,
+)
+
+
+class DSAParameters(metaclass=abc.ABCMeta):
+    @abc.abstractmethod
+    def generate_private_key(self) -> "DSAPrivateKey":
+        """
+        Generates and returns a DSAPrivateKey.
+        """
+
+    @abc.abstractmethod
+    def parameter_numbers(self) -> "DSAParameterNumbers":
+        """
+        Returns a DSAParameterNumbers.
+        """
+
+
+DSAParametersWithNumbers = DSAParameters
+
+
+class DSAPrivateKey(metaclass=abc.ABCMeta):
+    @abc.abstractproperty
+    def key_size(self) -> int:
+        """
+        The bit length of the prime modulus.
+        """
+
+    @abc.abstractmethod
+    def public_key(self) -> "DSAPublicKey":
+        """
+        The DSAPublicKey associated with this private key.
+        """
+
+    @abc.abstractmethod
+    def parameters(self) -> DSAParameters:
+        """
+        The DSAParameters object associated with this private key.
+        """
+
+    @abc.abstractmethod
+    def signer(
+        self,
+        signature_algorithm: hashes.HashAlgorithm,
+    ) -> AsymmetricSignatureContext:
+        """
+        Returns an AsymmetricSignatureContext used for signing data.
+        """
+
+    @abc.abstractmethod
+    def sign(
+        self,
+        data: bytes,
+        algorithm: typing.Union[asym_utils.Prehashed, hashes.HashAlgorithm],
+    ) -> bytes:
+        """
+        Signs the data
+        """
+
+    @abc.abstractmethod
+    def private_numbers(self) -> "DSAPrivateNumbers":
+        """
+        Returns a DSAPrivateNumbers.
+        """
+
+    @abc.abstractmethod
+    def private_bytes(
+        self,
+        encoding: _serialization.Encoding,
+        format: _serialization.PrivateFormat,
+        encryption_algorithm: _serialization.KeySerializationEncryption,
+    ) -> bytes:
+        """
+        Returns the key serialized as bytes.
+        """
+
+
+DSAPrivateKeyWithSerialization = DSAPrivateKey
+
+
+class DSAPublicKey(metaclass=abc.ABCMeta):
+    @abc.abstractproperty
+    def key_size(self) -> int:
+        """
+        The bit length of the prime modulus.
+        """
+
+    @abc.abstractmethod
+    def parameters(self) -> DSAParameters:
+        """
+        The DSAParameters object associated with this public key.
+        """
+
+    @abc.abstractmethod
+    def verifier(
+        self,
+        signature: bytes,
+        signature_algorithm: hashes.HashAlgorithm,
+    ) -> AsymmetricVerificationContext:
+        """
+        Returns an AsymmetricVerificationContext used for signing data.
+        """
+
+    @abc.abstractmethod
+    def public_numbers(self) -> "DSAPublicNumbers":
+        """
+        Returns a DSAPublicNumbers.
+        """
+
+    @abc.abstractmethod
+    def public_bytes(
+        self,
+        encoding: _serialization.Encoding,
+        format: _serialization.PublicFormat,
+    ) -> bytes:
+        """
+        Returns the key serialized as bytes.
+        """
+
+    @abc.abstractmethod
+    def verify(
+        self,
+        signature: bytes,
+        data: bytes,
+        algorithm: typing.Union[asym_utils.Prehashed, hashes.HashAlgorithm],
+    ) -> None:
+        """
+        Verifies the signature of the data.
+        """
+
+
+DSAPublicKeyWithSerialization = DSAPublicKey
+
+
+class DSAParameterNumbers(object):
+    def __init__(self, p: int, q: int, g: int):
+        if (
+            not isinstance(p, int)
+            or not isinstance(q, int)
+            or not isinstance(g, int)
+        ):
+            raise TypeError(
+                "DSAParameterNumbers p, q, and g arguments must be integers."
+            )
+
+        self._p = p
+        self._q = q
+        self._g = g
+
+    p = property(lambda self: self._p)
+    q = property(lambda self: self._q)
+    g = property(lambda self: self._g)
+
+    def parameters(
+        self, backend: typing.Optional[Backend] = None
+    ) -> DSAParameters:
+        backend = _get_backend(backend)
+        return backend.load_dsa_parameter_numbers(self)
+
+    def __eq__(self, other):
+        if not isinstance(other, DSAParameterNumbers):
+            return NotImplemented
+
+        return self.p == other.p and self.q == other.q and self.g == other.g
+
+    def __ne__(self, other):
+        return not self == other
+
+    def __repr__(self):
+        return (
+            "<DSAParameterNumbers(p={self.p}, q={self.q}, "
+            "g={self.g})>".format(self=self)
+        )
+
+
+class DSAPublicNumbers(object):
+    def __init__(self, y: int, parameter_numbers: DSAParameterNumbers):
+        if not isinstance(y, int):
+            raise TypeError("DSAPublicNumbers y argument must be an integer.")
+
+        if not isinstance(parameter_numbers, DSAParameterNumbers):
+            raise TypeError(
+                "parameter_numbers must be a DSAParameterNumbers instance."
+            )
+
+        self._y = y
+        self._parameter_numbers = parameter_numbers
+
+    y = property(lambda self: self._y)
+    parameter_numbers = property(lambda self: self._parameter_numbers)
+
+    def public_key(
+        self, backend: typing.Optional[Backend] = None
+    ) -> DSAPublicKey:
+        backend = _get_backend(backend)
+        return backend.load_dsa_public_numbers(self)
+
+    def __eq__(self, other):
+        if not isinstance(other, DSAPublicNumbers):
+            return NotImplemented
+
+        return (
+            self.y == other.y
+            and self.parameter_numbers == other.parameter_numbers
+        )
+
+    def __ne__(self, other):
+        return not self == other
+
+    def __repr__(self):
+        return (
+            "<DSAPublicNumbers(y={self.y}, "
+            "parameter_numbers={self.parameter_numbers})>".format(self=self)
+        )
+
+
+class DSAPrivateNumbers(object):
+    def __init__(self, x: int, public_numbers: DSAPublicNumbers):
+        if not isinstance(x, int):
+            raise TypeError("DSAPrivateNumbers x argument must be an integer.")
+
+        if not isinstance(public_numbers, DSAPublicNumbers):
+            raise TypeError(
+                "public_numbers must be a DSAPublicNumbers instance."
+            )
+        self._public_numbers = public_numbers
+        self._x = x
+
+    x = property(lambda self: self._x)
+    public_numbers = property(lambda self: self._public_numbers)
+
+    def private_key(
+        self, backend: typing.Optional[Backend] = None
+    ) -> DSAPrivateKey:
+        backend = _get_backend(backend)
+        return backend.load_dsa_private_numbers(self)
+
+    def __eq__(self, other):
+        if not isinstance(other, DSAPrivateNumbers):
+            return NotImplemented
+
+        return (
+            self.x == other.x and self.public_numbers == other.public_numbers
+        )
+
+    def __ne__(self, other):
+        return not self == other
+
+
+def generate_parameters(
+    key_size: int, backend: typing.Optional[Backend] = None
+) -> DSAParameters:
+    backend = _get_backend(backend)
+    return backend.generate_dsa_parameters(key_size)
+
+
+def generate_private_key(
+    key_size: int, backend: typing.Optional[Backend] = None
+) -> DSAPrivateKey:
+    backend = _get_backend(backend)
+    return backend.generate_dsa_private_key_and_parameters(key_size)
+
+
+def _check_dsa_parameters(parameters: DSAParameterNumbers) -> None:
+    if parameters.p.bit_length() not in [1024, 2048, 3072, 4096]:
+        raise ValueError(
+            "p must be exactly 1024, 2048, 3072, or 4096 bits long"
+        )
+    if parameters.q.bit_length() not in [160, 224, 256]:
+        raise ValueError("q must be exactly 160, 224, or 256 bits long")
+
+    if not (1 < parameters.g < parameters.p):
+        raise ValueError("g, p don't satisfy 1 < g < p.")
+
+
+def _check_dsa_private_numbers(numbers: DSAPrivateNumbers) -> None:
+    parameters = numbers.public_numbers.parameter_numbers
+    _check_dsa_parameters(parameters)
+    if numbers.x <= 0 or numbers.x >= parameters.q:
+        raise ValueError("x must be > 0 and < q.")
+
+    if numbers.public_numbers.y != pow(parameters.g, numbers.x, parameters.p):
+        raise ValueError("y must be equal to (g ** x % p).")

asq-env/lib/python3.9/site-packages/cryptography/hazmat/primitives/asymmetric/ec.py

@@ -0,0 +1,533 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+import abc
+import typing
+import warnings
+
+from cryptography import utils
+from cryptography.hazmat._oid import ObjectIdentifier
+from cryptography.hazmat.backends import _get_backend
+from cryptography.hazmat.backends.interfaces import Backend
+from cryptography.hazmat.primitives import _serialization, hashes
+from cryptography.hazmat.primitives.asymmetric import (
+    AsymmetricSignatureContext,
+    AsymmetricVerificationContext,
+    utils as asym_utils,
+)
+
+
+class EllipticCurveOID(object):
+    SECP192R1 = ObjectIdentifier("1.2.840.10045.3.1.1")
+    SECP224R1 = ObjectIdentifier("1.3.132.0.33")
+    SECP256K1 = ObjectIdentifier("1.3.132.0.10")
+    SECP256R1 = ObjectIdentifier("1.2.840.10045.3.1.7")
+    SECP384R1 = ObjectIdentifier("1.3.132.0.34")
+    SECP521R1 = ObjectIdentifier("1.3.132.0.35")
+    BRAINPOOLP256R1 = ObjectIdentifier("1.3.36.3.3.2.8.1.1.7")
+    BRAINPOOLP384R1 = ObjectIdentifier("1.3.36.3.3.2.8.1.1.11")
+    BRAINPOOLP512R1 = ObjectIdentifier("1.3.36.3.3.2.8.1.1.13")
+    SECT163K1 = ObjectIdentifier("1.3.132.0.1")
+    SECT163R2 = ObjectIdentifier("1.3.132.0.15")
+    SECT233K1 = ObjectIdentifier("1.3.132.0.26")
+    SECT233R1 = ObjectIdentifier("1.3.132.0.27")
+    SECT283K1 = ObjectIdentifier("1.3.132.0.16")
+    SECT283R1 = ObjectIdentifier("1.3.132.0.17")
+    SECT409K1 = ObjectIdentifier("1.3.132.0.36")
+    SECT409R1 = ObjectIdentifier("1.3.132.0.37")
+    SECT571K1 = ObjectIdentifier("1.3.132.0.38")
+    SECT571R1 = ObjectIdentifier("1.3.132.0.39")
+
+
+class EllipticCurve(metaclass=abc.ABCMeta):
+    @abc.abstractproperty
+    def name(self) -> str:
+        """
+        The name of the curve. e.g. secp256r1.
+        """
+
+    @abc.abstractproperty
+    def key_size(self) -> int:
+        """
+        Bit size of a secret scalar for the curve.
+        """
+
+
+class EllipticCurveSignatureAlgorithm(metaclass=abc.ABCMeta):
+    @abc.abstractproperty
+    def algorithm(
+        self,
+    ) -> typing.Union[asym_utils.Prehashed, hashes.HashAlgorithm]:
+        """
+        The digest algorithm used with this signature.
+        """
+
+
+class EllipticCurvePrivateKey(metaclass=abc.ABCMeta):
+    @abc.abstractmethod
+    def signer(
+        self,
+        signature_algorithm: EllipticCurveSignatureAlgorithm,
+    ) -> AsymmetricSignatureContext:
+        """
+        Returns an AsymmetricSignatureContext used for signing data.
+        """
+
+    @abc.abstractmethod
+    def exchange(
+        self, algorithm: "ECDH", peer_public_key: "EllipticCurvePublicKey"
+    ) -> bytes:
+        """
+        Performs a key exchange operation using the provided algorithm with the
+        provided peer's public key.
+        """
+
+    @abc.abstractmethod
+    def public_key(self) -> "EllipticCurvePublicKey":
+        """
+        The EllipticCurvePublicKey for this private key.
+        """
+
+    @abc.abstractproperty
+    def curve(self) -> EllipticCurve:
+        """
+        The EllipticCurve that this key is on.
+        """
+
+    @abc.abstractproperty
+    def key_size(self) -> int:
+        """
+        Bit size of a secret scalar for the curve.
+        """
+
+    @abc.abstractmethod
+    def sign(
+        self,
+        data: bytes,
+        signature_algorithm: EllipticCurveSignatureAlgorithm,
+    ) -> bytes:
+        """
+        Signs the data
+        """
+
+    @abc.abstractmethod
+    def private_numbers(self) -> "EllipticCurvePrivateNumbers":
+        """
+        Returns an EllipticCurvePrivateNumbers.
+        """
+
+    @abc.abstractmethod
+    def private_bytes(
+        self,
+        encoding: _serialization.Encoding,
+        format: _serialization.PrivateFormat,
+        encryption_algorithm: _serialization.KeySerializationEncryption,
+    ) -> bytes:
+        """
+        Returns the key serialized as bytes.
+        """
+
+
+EllipticCurvePrivateKeyWithSerialization = EllipticCurvePrivateKey
+
+
+class EllipticCurvePublicKey(metaclass=abc.ABCMeta):
+    @abc.abstractmethod
+    def verifier(
+        self,
+        signature: bytes,
+        signature_algorithm: EllipticCurveSignatureAlgorithm,
+    ) -> AsymmetricVerificationContext:
+        """
+        Returns an AsymmetricVerificationContext used for signing data.
+        """
+
+    @abc.abstractproperty
+    def curve(self) -> EllipticCurve:
+        """
+        The EllipticCurve that this key is on.
+        """
+
+    @abc.abstractproperty
+    def key_size(self) -> int:
+        """
+        Bit size of a secret scalar for the curve.
+        """
+
+    @abc.abstractmethod
+    def public_numbers(self) -> "EllipticCurvePublicNumbers":
+        """
+        Returns an EllipticCurvePublicNumbers.
+        """
+
+    @abc.abstractmethod
+    def public_bytes(
+        self,
+        encoding: _serialization.Encoding,
+        format: _serialization.PublicFormat,
+    ) -> bytes:
+        """
+        Returns the key serialized as bytes.
+        """
+
+    @abc.abstractmethod
+    def verify(
+        self,
+        signature: bytes,
+        data: bytes,
+        signature_algorithm: EllipticCurveSignatureAlgorithm,
+    ) -> None:
+        """
+        Verifies the signature of the data.
+        """
+
+    @classmethod
+    def from_encoded_point(
+        cls, curve: EllipticCurve, data: bytes
+    ) -> "EllipticCurvePublicKey":
+        utils._check_bytes("data", data)
+
+        if not isinstance(curve, EllipticCurve):
+            raise TypeError("curve must be an EllipticCurve instance")
+
+        if len(data) == 0:
+            raise ValueError("data must not be an empty byte string")
+
+        if data[0] not in [0x02, 0x03, 0x04]:
+            raise ValueError("Unsupported elliptic curve point type")
+
+        from cryptography.hazmat.backends.openssl.backend import backend
+
+        return backend.load_elliptic_curve_public_bytes(curve, data)
+
+
+EllipticCurvePublicKeyWithSerialization = EllipticCurvePublicKey
+
+
+class SECT571R1(EllipticCurve):
+    name = "sect571r1"
+    key_size = 570
+
+
+class SECT409R1(EllipticCurve):
+    name = "sect409r1"
+    key_size = 409
+
+
+class SECT283R1(EllipticCurve):
+    name = "sect283r1"
+    key_size = 283
+
+
+class SECT233R1(EllipticCurve):
+    name = "sect233r1"
+    key_size = 233
+
+
+class SECT163R2(EllipticCurve):
+    name = "sect163r2"
+    key_size = 163
+
+
+class SECT571K1(EllipticCurve):
+    name = "sect571k1"
+    key_size = 571
+
+
+class SECT409K1(EllipticCurve):
+    name = "sect409k1"
+    key_size = 409
+
+
+class SECT283K1(EllipticCurve):
+    name = "sect283k1"
+    key_size = 283
+
+
+class SECT233K1(EllipticCurve):
+    name = "sect233k1"
+    key_size = 233
+
+
+class SECT163K1(EllipticCurve):
+    name = "sect163k1"
+    key_size = 163
+
+
+class SECP521R1(EllipticCurve):
+    name = "secp521r1"
+    key_size = 521
+
+
+class SECP384R1(EllipticCurve):
+    name = "secp384r1"
+    key_size = 384
+
+
+class SECP256R1(EllipticCurve):
+    name = "secp256r1"
+    key_size = 256
+
+
+class SECP256K1(EllipticCurve):
+    name = "secp256k1"
+    key_size = 256
+
+
+class SECP224R1(EllipticCurve):
+    name = "secp224r1"
+    key_size = 224
+
+
+class SECP192R1(EllipticCurve):
+    name = "secp192r1"
+    key_size = 192
+
+
+class BrainpoolP256R1(EllipticCurve):
+    name = "brainpoolP256r1"
+    key_size = 256
+
+
+class BrainpoolP384R1(EllipticCurve):
+    name = "brainpoolP384r1"
+    key_size = 384
+
+
+class BrainpoolP512R1(EllipticCurve):
+    name = "brainpoolP512r1"
+    key_size = 512
+
+
+_CURVE_TYPES: typing.Dict[str, typing.Type[EllipticCurve]] = {
+    "prime192v1": SECP192R1,
+    "prime256v1": SECP256R1,
+    "secp192r1": SECP192R1,
+    "secp224r1": SECP224R1,
+    "secp256r1": SECP256R1,
+    "secp384r1": SECP384R1,
+    "secp521r1": SECP521R1,
+    "secp256k1": SECP256K1,
+    "sect163k1": SECT163K1,
+    "sect233k1": SECT233K1,
+    "sect283k1": SECT283K1,
+    "sect409k1": SECT409K1,
+    "sect571k1": SECT571K1,
+    "sect163r2": SECT163R2,
+    "sect233r1": SECT233R1,
+    "sect283r1": SECT283R1,
+    "sect409r1": SECT409R1,
+    "sect571r1": SECT571R1,
+    "brainpoolP256r1": BrainpoolP256R1,
+    "brainpoolP384r1": BrainpoolP384R1,
+    "brainpoolP512r1": BrainpoolP512R1,
+}
+
+
+class ECDSA(EllipticCurveSignatureAlgorithm):
+    def __init__(
+        self,
+        algorithm: typing.Union[asym_utils.Prehashed, hashes.HashAlgorithm],
+    ):
+        self._algorithm = algorithm
+
+    @property
+    def algorithm(
+        self,
+    ) -> typing.Union[asym_utils.Prehashed, hashes.HashAlgorithm]:
+        return self._algorithm
+
+
+def generate_private_key(
+    curve: EllipticCurve, backend: typing.Optional[Backend] = None
+) -> EllipticCurvePrivateKey:
+    backend = _get_backend(backend)
+    return backend.generate_elliptic_curve_private_key(curve)
+
+
+def derive_private_key(
+    private_value: int,
+    curve: EllipticCurve,
+    backend: typing.Optional[Backend] = None,
+) -> EllipticCurvePrivateKey:
+    backend = _get_backend(backend)
+    if not isinstance(private_value, int):
+        raise TypeError("private_value must be an integer type.")
+
+    if private_value <= 0:
+        raise ValueError("private_value must be a positive integer.")
+
+    if not isinstance(curve, EllipticCurve):
+        raise TypeError("curve must provide the EllipticCurve interface.")
+
+    return backend.derive_elliptic_curve_private_key(private_value, curve)
+
+
+class EllipticCurvePublicNumbers(object):
+    def __init__(self, x: int, y: int, curve: EllipticCurve):
+        if not isinstance(x, int) or not isinstance(y, int):
+            raise TypeError("x and y must be integers.")
+
+        if not isinstance(curve, EllipticCurve):
+            raise TypeError("curve must provide the EllipticCurve interface.")
+
+        self._y = y
+        self._x = x
+        self._curve = curve
+
+    def public_key(
+        self, backend: typing.Optional[Backend] = None
+    ) -> EllipticCurvePublicKey:
+        backend = _get_backend(backend)
+        return backend.load_elliptic_curve_public_numbers(self)
+
+    def encode_point(self) -> bytes:
+        warnings.warn(
+            "encode_point has been deprecated on EllipticCurvePublicNumbers"
+            " and will be removed in a future version. Please use "
+            "EllipticCurvePublicKey.public_bytes to obtain both "
+            "compressed and uncompressed point encoding.",
+            utils.PersistentlyDeprecated2019,
+            stacklevel=2,
+        )
+        # key_size is in bits. Convert to bytes and round up
+        byte_length = (self.curve.key_size + 7) // 8
+        return (
+            b"\x04"
+            + utils.int_to_bytes(self.x, byte_length)
+            + utils.int_to_bytes(self.y, byte_length)
+        )
+
+    @classmethod
+    def from_encoded_point(
+        cls, curve: EllipticCurve, data: bytes
+    ) -> "EllipticCurvePublicNumbers":
+        if not isinstance(curve, EllipticCurve):
+            raise TypeError("curve must be an EllipticCurve instance")
+
+        warnings.warn(
+            "Support for unsafe construction of public numbers from "
+            "encoded data will be removed in a future version. "
+            "Please use EllipticCurvePublicKey.from_encoded_point",
+            utils.PersistentlyDeprecated2019,
+            stacklevel=2,
+        )
+
+        if data.startswith(b"\x04"):
+            # key_size is in bits. Convert to bytes and round up
+            byte_length = (curve.key_size + 7) // 8
+            if len(data) == 2 * byte_length + 1:
+                x = int.from_bytes(data[1 : byte_length + 1], "big")
+                y = int.from_bytes(data[byte_length + 1 :], "big")
+                return cls(x, y, curve)
+            else:
+                raise ValueError("Invalid elliptic curve point data length")
+        else:
+            raise ValueError("Unsupported elliptic curve point type")
+
+    curve = property(lambda self: self._curve)
+    x = property(lambda self: self._x)
+    y = property(lambda self: self._y)
+
+    def __eq__(self, other):
+        if not isinstance(other, EllipticCurvePublicNumbers):
+            return NotImplemented
+
+        return (
+            self.x == other.x
+            and self.y == other.y
+            and self.curve.name == other.curve.name
+            and self.curve.key_size == other.curve.key_size
+        )
+
+    def __ne__(self, other):
+        return not self == other
+
+    def __hash__(self):
+        return hash((self.x, self.y, self.curve.name, self.curve.key_size))
+
+    def __repr__(self):
+        return (
+            "<EllipticCurvePublicNumbers(curve={0.curve.name}, x={0.x}, "
+            "y={0.y}>".format(self)
+        )
+
+
+class EllipticCurvePrivateNumbers(object):
+    def __init__(
+        self, private_value: int, public_numbers: EllipticCurvePublicNumbers
+    ):
+        if not isinstance(private_value, int):
+            raise TypeError("private_value must be an integer.")
+
+        if not isinstance(public_numbers, EllipticCurvePublicNumbers):
+            raise TypeError(
+                "public_numbers must be an EllipticCurvePublicNumbers "
+                "instance."
+            )
+
+        self._private_value = private_value
+        self._public_numbers = public_numbers
+
+    def private_key(
+        self, backend: typing.Optional[Backend] = None
+    ) -> EllipticCurvePrivateKey:
+        backend = _get_backend(backend)
+        return backend.load_elliptic_curve_private_numbers(self)
+
+    private_value = property(lambda self: self._private_value)
+    public_numbers = property(lambda self: self._public_numbers)
+
+    def __eq__(self, other):
+        if not isinstance(other, EllipticCurvePrivateNumbers):
+            return NotImplemented
+
+        return (
+            self.private_value == other.private_value
+            and self.public_numbers == other.public_numbers
+        )
+
+    def __ne__(self, other):
+        return not self == other
+
+    def __hash__(self):
+        return hash((self.private_value, self.public_numbers))
+
+
+class ECDH(object):
+    pass
+
+
+_OID_TO_CURVE = {
+    EllipticCurveOID.SECP192R1: SECP192R1,
+    EllipticCurveOID.SECP224R1: SECP224R1,
+    EllipticCurveOID.SECP256K1: SECP256K1,
+    EllipticCurveOID.SECP256R1: SECP256R1,
+    EllipticCurveOID.SECP384R1: SECP384R1,
+    EllipticCurveOID.SECP521R1: SECP521R1,
+    EllipticCurveOID.BRAINPOOLP256R1: BrainpoolP256R1,
+    EllipticCurveOID.BRAINPOOLP384R1: BrainpoolP384R1,
+    EllipticCurveOID.BRAINPOOLP512R1: BrainpoolP512R1,
+    EllipticCurveOID.SECT163K1: SECT163K1,
+    EllipticCurveOID.SECT163R2: SECT163R2,
+    EllipticCurveOID.SECT233K1: SECT233K1,
+    EllipticCurveOID.SECT233R1: SECT233R1,
+    EllipticCurveOID.SECT283K1: SECT283K1,
+    EllipticCurveOID.SECT283R1: SECT283R1,
+    EllipticCurveOID.SECT409K1: SECT409K1,
+    EllipticCurveOID.SECT409R1: SECT409R1,
+    EllipticCurveOID.SECT571K1: SECT571K1,
+    EllipticCurveOID.SECT571R1: SECT571R1,
+}
+
+
+def get_curve_for_oid(oid: ObjectIdentifier) -> typing.Type[EllipticCurve]:
+    try:
+        return _OID_TO_CURVE[oid]
+    except KeyError:
+        raise LookupError(
+            "The provided object identifier has no matching elliptic "
+            "curve class"
+        )

asq-env/lib/python3.9/site-packages/cryptography/hazmat/primitives/asymmetric/ed25519.py

@@ -0,0 +1,92 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+import abc
+
+from cryptography.exceptions import UnsupportedAlgorithm, _Reasons
+from cryptography.hazmat.primitives import _serialization
+
+
+_ED25519_KEY_SIZE = 32
+_ED25519_SIG_SIZE = 64
+
+
+class Ed25519PublicKey(metaclass=abc.ABCMeta):
+    @classmethod
+    def from_public_bytes(cls, data: bytes) -> "Ed25519PublicKey":
+        from cryptography.hazmat.backends.openssl.backend import backend
+
+        if not backend.ed25519_supported():
+            raise UnsupportedAlgorithm(
+                "ed25519 is not supported by this version of OpenSSL.",
+                _Reasons.UNSUPPORTED_PUBLIC_KEY_ALGORITHM,
+            )
+
+        return backend.ed25519_load_public_bytes(data)
+
+    @abc.abstractmethod
+    def public_bytes(
+        self,
+        encoding: _serialization.Encoding,
+        format: _serialization.PublicFormat,
+    ) -> bytes:
+        """
+        The serialized bytes of the public key.
+        """
+
+    @abc.abstractmethod
+    def verify(self, signature: bytes, data: bytes) -> None:
+        """
+        Verify the signature.
+        """
+
+
+class Ed25519PrivateKey(metaclass=abc.ABCMeta):
+    @classmethod
+    def generate(cls) -> "Ed25519PrivateKey":
+        from cryptography.hazmat.backends.openssl.backend import backend
+
+        if not backend.ed25519_supported():
+            raise UnsupportedAlgorithm(
+                "ed25519 is not supported by this version of OpenSSL.",
+                _Reasons.UNSUPPORTED_PUBLIC_KEY_ALGORITHM,
+            )
+
+        return backend.ed25519_generate_key()
+
+    @classmethod
+    def from_private_bytes(cls, data: bytes) -> "Ed25519PrivateKey":
+        from cryptography.hazmat.backends.openssl.backend import backend
+
+        if not backend.ed25519_supported():
+            raise UnsupportedAlgorithm(
+                "ed25519 is not supported by this version of OpenSSL.",
+                _Reasons.UNSUPPORTED_PUBLIC_KEY_ALGORITHM,
+            )
+
+        return backend.ed25519_load_private_bytes(data)
+
+    @abc.abstractmethod
+    def public_key(self) -> Ed25519PublicKey:
+        """
+        The Ed25519PublicKey derived from the private key.
+        """
+
+    @abc.abstractmethod
+    def private_bytes(
+        self,
+        encoding: _serialization.Encoding,
+        format: _serialization.PrivateFormat,
+        encryption_algorithm: _serialization.KeySerializationEncryption,
+    ) -> bytes:
+        """
+        The serialized bytes of the private key.
+        """
+
+    @abc.abstractmethod
+    def sign(self, data: bytes) -> bytes:
+        """
+        Signs the data.
+        """

asq-env/lib/python3.9/site-packages/cryptography/hazmat/primitives/asymmetric/ed448.py

@@ -0,0 +1,87 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+import abc
+
+from cryptography.exceptions import UnsupportedAlgorithm, _Reasons
+from cryptography.hazmat.primitives import _serialization
+
+
+class Ed448PublicKey(metaclass=abc.ABCMeta):
+    @classmethod
+    def from_public_bytes(cls, data: bytes) -> "Ed448PublicKey":
+        from cryptography.hazmat.backends.openssl.backend import backend
+
+        if not backend.ed448_supported():
+            raise UnsupportedAlgorithm(
+                "ed448 is not supported by this version of OpenSSL.",
+                _Reasons.UNSUPPORTED_PUBLIC_KEY_ALGORITHM,
+            )
+
+        return backend.ed448_load_public_bytes(data)
+
+    @abc.abstractmethod
+    def public_bytes(
+        self,
+        encoding: _serialization.Encoding,
+        format: _serialization.PublicFormat,
+    ) -> bytes:
+        """
+        The serialized bytes of the public key.
+        """
+
+    @abc.abstractmethod
+    def verify(self, signature: bytes, data: bytes) -> None:
+        """
+        Verify the signature.
+        """
+
+
+class Ed448PrivateKey(metaclass=abc.ABCMeta):
+    @classmethod
+    def generate(cls) -> "Ed448PrivateKey":
+        from cryptography.hazmat.backends.openssl.backend import backend
+
+        if not backend.ed448_supported():
+            raise UnsupportedAlgorithm(
+                "ed448 is not supported by this version of OpenSSL.",
+                _Reasons.UNSUPPORTED_PUBLIC_KEY_ALGORITHM,
+            )
+        return backend.ed448_generate_key()
+
+    @classmethod
+    def from_private_bytes(cls, data: bytes) -> "Ed448PrivateKey":
+        from cryptography.hazmat.backends.openssl.backend import backend
+
+        if not backend.ed448_supported():
+            raise UnsupportedAlgorithm(
+                "ed448 is not supported by this version of OpenSSL.",
+                _Reasons.UNSUPPORTED_PUBLIC_KEY_ALGORITHM,
+            )
+
+        return backend.ed448_load_private_bytes(data)
+
+    @abc.abstractmethod
+    def public_key(self) -> Ed448PublicKey:
+        """
+        The Ed448PublicKey derived from the private key.
+        """
+
+    @abc.abstractmethod
+    def sign(self, data: bytes) -> bytes:
+        """
+        Signs the data.
+        """
+
+    @abc.abstractmethod
+    def private_bytes(
+        self,
+        encoding: _serialization.Encoding,
+        format: _serialization.PrivateFormat,
+        encryption_algorithm: _serialization.KeySerializationEncryption,
+    ) -> bytes:
+        """
+        The serialized bytes of the private key.
+        """

asq-env/lib/python3.9/site-packages/cryptography/hazmat/primitives/asymmetric/padding.py

@@ -0,0 +1,75 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+import typing
+
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives._asymmetric import (
+    AsymmetricPadding as AsymmetricPadding,
+)
+from cryptography.hazmat.primitives.asymmetric import rsa
+
+
+class PKCS1v15(AsymmetricPadding):
+    name = "EMSA-PKCS1-v1_5"
+
+
+class PSS(AsymmetricPadding):
+    MAX_LENGTH = object()
+    name = "EMSA-PSS"
+
+    def __init__(self, mgf, salt_length):
+        self._mgf = mgf
+
+        if (
+            not isinstance(salt_length, int)
+            and salt_length is not self.MAX_LENGTH
+        ):
+            raise TypeError("salt_length must be an integer.")
+
+        if salt_length is not self.MAX_LENGTH and salt_length < 0:
+            raise ValueError("salt_length must be zero or greater.")
+
+        self._salt_length = salt_length
+
+
+class OAEP(AsymmetricPadding):
+    name = "EME-OAEP"
+
+    def __init__(
+        self,
+        mgf: "MGF1",
+        algorithm: hashes.HashAlgorithm,
+        label: typing.Optional[bytes],
+    ):
+        if not isinstance(algorithm, hashes.HashAlgorithm):
+            raise TypeError("Expected instance of hashes.HashAlgorithm.")
+
+        self._mgf = mgf
+        self._algorithm = algorithm
+        self._label = label
+
+
+class MGF1(object):
+    MAX_LENGTH = object()
+
+    def __init__(self, algorithm: hashes.HashAlgorithm):
+        if not isinstance(algorithm, hashes.HashAlgorithm):
+            raise TypeError("Expected instance of hashes.HashAlgorithm.")
+
+        self._algorithm = algorithm
+
+
+def calculate_max_pss_salt_length(
+    key: typing.Union["rsa.RSAPrivateKey", "rsa.RSAPublicKey"],
+    hash_algorithm: hashes.HashAlgorithm,
+) -> int:
+    if not isinstance(key, (rsa.RSAPrivateKey, rsa.RSAPublicKey)):
+        raise TypeError("key must be an RSA public or private key")
+    # bit length - 1 per RFC 3447
+    emlen = (key.key_size + 6) // 8
+    salt_length = emlen - hash_algorithm.digest_size - 2
+    assert salt_length >= 0
+    return salt_length

asq-env/lib/python3.9/site-packages/cryptography/hazmat/primitives/asymmetric/rsa.py

@@ -0,0 +1,433 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+import abc
+import typing
+from math import gcd
+
+from cryptography.exceptions import UnsupportedAlgorithm, _Reasons
+from cryptography.hazmat.backends import _get_backend
+from cryptography.hazmat.backends.interfaces import Backend, RSABackend
+from cryptography.hazmat.primitives import _serialization, hashes
+from cryptography.hazmat.primitives._asymmetric import AsymmetricPadding
+from cryptography.hazmat.primitives.asymmetric import (
+    AsymmetricSignatureContext,
+    AsymmetricVerificationContext,
+    utils as asym_utils,
+)
+
+
+class RSAPrivateKey(metaclass=abc.ABCMeta):
+    @abc.abstractmethod
+    def signer(
+        self, padding: AsymmetricPadding, algorithm: hashes.HashAlgorithm
+    ) -> AsymmetricSignatureContext:
+        """
+        Returns an AsymmetricSignatureContext used for signing data.
+        """
+
+    @abc.abstractmethod
+    def decrypt(self, ciphertext: bytes, padding: AsymmetricPadding) -> bytes:
+        """
+        Decrypts the provided ciphertext.
+        """
+
+    @abc.abstractproperty
+    def key_size(self) -> int:
+        """
+        The bit length of the public modulus.
+        """
+
+    @abc.abstractmethod
+    def public_key(self) -> "RSAPublicKey":
+        """
+        The RSAPublicKey associated with this private key.
+        """
+
+    @abc.abstractmethod
+    def sign(
+        self,
+        data: bytes,
+        padding: AsymmetricPadding,
+        algorithm: typing.Union[asym_utils.Prehashed, hashes.HashAlgorithm],
+    ) -> bytes:
+        """
+        Signs the data.
+        """
+
+    @abc.abstractmethod
+    def private_numbers(self) -> "RSAPrivateNumbers":
+        """
+        Returns an RSAPrivateNumbers.
+        """
+
+    @abc.abstractmethod
+    def private_bytes(
+        self,
+        encoding: _serialization.Encoding,
+        format: _serialization.PrivateFormat,
+        encryption_algorithm: _serialization.KeySerializationEncryption,
+    ) -> bytes:
+        """
+        Returns the key serialized as bytes.
+        """
+
+
+RSAPrivateKeyWithSerialization = RSAPrivateKey
+
+
+class RSAPublicKey(metaclass=abc.ABCMeta):
+    @abc.abstractmethod
+    def verifier(
+        self,
+        signature: bytes,
+        padding: AsymmetricPadding,
+        algorithm: hashes.HashAlgorithm,
+    ) -> AsymmetricVerificationContext:
+        """
+        Returns an AsymmetricVerificationContext used for verifying signatures.
+        """
+
+    @abc.abstractmethod
+    def encrypt(self, plaintext: bytes, padding: AsymmetricPadding) -> bytes:
+        """
+        Encrypts the given plaintext.
+        """
+
+    @abc.abstractproperty
+    def key_size(self) -> int:
+        """
+        The bit length of the public modulus.
+        """
+
+    @abc.abstractmethod
+    def public_numbers(self) -> "RSAPublicNumbers":
+        """
+        Returns an RSAPublicNumbers
+        """
+
+    @abc.abstractmethod
+    def public_bytes(
+        self,
+        encoding: _serialization.Encoding,
+        format: _serialization.PublicFormat,
+    ) -> bytes:
+        """
+        Returns the key serialized as bytes.
+        """
+
+    @abc.abstractmethod
+    def verify(
+        self,
+        signature: bytes,
+        data: bytes,
+        padding: AsymmetricPadding,
+        algorithm: typing.Union[asym_utils.Prehashed, hashes.HashAlgorithm],
+    ) -> None:
+        """
+        Verifies the signature of the data.
+        """
+
+    @abc.abstractmethod
+    def recover_data_from_signature(
+        self,
+        signature: bytes,
+        padding: AsymmetricPadding,
+        algorithm: typing.Optional[hashes.HashAlgorithm],
+    ) -> bytes:
+        """
+        Recovers the original data from the signature.
+        """
+
+
+RSAPublicKeyWithSerialization = RSAPublicKey
+
+
+def generate_private_key(
+    public_exponent: int,
+    key_size: int,
+    backend: typing.Optional[Backend] = None,
+) -> RSAPrivateKey:
+    backend = _get_backend(backend)
+    if not isinstance(backend, RSABackend):
+        raise UnsupportedAlgorithm(
+            "Backend object does not implement RSABackend.",
+            _Reasons.BACKEND_MISSING_INTERFACE,
+        )
+
+    _verify_rsa_parameters(public_exponent, key_size)
+    return backend.generate_rsa_private_key(public_exponent, key_size)
+
+
+def _verify_rsa_parameters(public_exponent: int, key_size: int) -> None:
+    if public_exponent not in (3, 65537):
+        raise ValueError(
+            "public_exponent must be either 3 (for legacy compatibility) or "
+            "65537. Almost everyone should choose 65537 here!"
+        )
+
+    if key_size < 512:
+        raise ValueError("key_size must be at least 512-bits.")
+
+
+def _check_private_key_components(
+    p: int,
+    q: int,
+    private_exponent: int,
+    dmp1: int,
+    dmq1: int,
+    iqmp: int,
+    public_exponent: int,
+    modulus: int,
+) -> None:
+    if modulus < 3:
+        raise ValueError("modulus must be >= 3.")
+
+    if p >= modulus:
+        raise ValueError("p must be < modulus.")
+
+    if q >= modulus:
+        raise ValueError("q must be < modulus.")
+
+    if dmp1 >= modulus:
+        raise ValueError("dmp1 must be < modulus.")
+
+    if dmq1 >= modulus:
+        raise ValueError("dmq1 must be < modulus.")
+
+    if iqmp >= modulus:
+        raise ValueError("iqmp must be < modulus.")
+
+    if private_exponent >= modulus:
+        raise ValueError("private_exponent must be < modulus.")
+
+    if public_exponent < 3 or public_exponent >= modulus:
+        raise ValueError("public_exponent must be >= 3 and < modulus.")
+
+    if public_exponent & 1 == 0:
+        raise ValueError("public_exponent must be odd.")
+
+    if dmp1 & 1 == 0:
+        raise ValueError("dmp1 must be odd.")
+
+    if dmq1 & 1 == 0:
+        raise ValueError("dmq1 must be odd.")
+
+    if p * q != modulus:
+        raise ValueError("p*q must equal modulus.")
+
+
+def _check_public_key_components(e: int, n: int) -> None:
+    if n < 3:
+        raise ValueError("n must be >= 3.")
+
+    if e < 3 or e >= n:
+        raise ValueError("e must be >= 3 and < n.")
+
+    if e & 1 == 0:
+        raise ValueError("e must be odd.")
+
+
+def _modinv(e: int, m: int) -> int:
+    """
+    Modular Multiplicative Inverse. Returns x such that: (x*e) mod m == 1
+    """
+    x1, x2 = 1, 0
+    a, b = e, m
+    while b > 0:
+        q, r = divmod(a, b)
+        xn = x1 - q * x2
+        a, b, x1, x2 = b, r, x2, xn
+    return x1 % m
+
+
+def rsa_crt_iqmp(p: int, q: int) -> int:
+    """
+    Compute the CRT (q ** -1) % p value from RSA primes p and q.
+    """
+    return _modinv(q, p)
+
+
+def rsa_crt_dmp1(private_exponent: int, p: int) -> int:
+    """
+    Compute the CRT private_exponent % (p - 1) value from the RSA
+    private_exponent (d) and p.
+    """
+    return private_exponent % (p - 1)
+
+
+def rsa_crt_dmq1(private_exponent: int, q: int) -> int:
+    """
+    Compute the CRT private_exponent % (q - 1) value from the RSA
+    private_exponent (d) and q.
+    """
+    return private_exponent % (q - 1)
+
+
+# Controls the number of iterations rsa_recover_prime_factors will perform
+# to obtain the prime factors. Each iteration increments by 2 so the actual
+# maximum attempts is half this number.
+_MAX_RECOVERY_ATTEMPTS = 1000
+
+
+def rsa_recover_prime_factors(
+    n: int, e: int, d: int
+) -> typing.Tuple[int, int]:
+    """
+    Compute factors p and q from the private exponent d. We assume that n has
+    no more than two factors. This function is adapted from code in PyCrypto.
+    """
+    # See 8.2.2(i) in Handbook of Applied Cryptography.
+    ktot = d * e - 1
+    # The quantity d*e-1 is a multiple of phi(n), even,
+    # and can be represented as t*2^s.
+    t = ktot
+    while t % 2 == 0:
+        t = t // 2
+    # Cycle through all multiplicative inverses in Zn.
+    # The algorithm is non-deterministic, but there is a 50% chance
+    # any candidate a leads to successful factoring.
+    # See "Digitalized Signatures and Public Key Functions as Intractable
+    # as Factorization", M. Rabin, 1979
+    spotted = False
+    a = 2
+    while not spotted and a < _MAX_RECOVERY_ATTEMPTS:
+        k = t
+        # Cycle through all values a^{t*2^i}=a^k
+        while k < ktot:
+            cand = pow(a, k, n)
+            # Check if a^k is a non-trivial root of unity (mod n)
+            if cand != 1 and cand != (n - 1) and pow(cand, 2, n) == 1:
+                # We have found a number such that (cand-1)(cand+1)=0 (mod n).
+                # Either of the terms divides n.
+                p = gcd(cand + 1, n)
+                spotted = True
+                break
+            k *= 2
+        # This value was not any good... let's try another!
+        a += 2
+    if not spotted:
+        raise ValueError("Unable to compute factors p and q from exponent d.")
+    # Found !
+    q, r = divmod(n, p)
+    assert r == 0
+    p, q = sorted((p, q), reverse=True)
+    return (p, q)
+
+
+class RSAPrivateNumbers(object):
+    def __init__(
+        self,
+        p: int,
+        q: int,
+        d: int,
+        dmp1: int,
+        dmq1: int,
+        iqmp: int,
+        public_numbers: "RSAPublicNumbers",
+    ):
+        if (
+            not isinstance(p, int)
+            or not isinstance(q, int)
+            or not isinstance(d, int)
+            or not isinstance(dmp1, int)
+            or not isinstance(dmq1, int)
+            or not isinstance(iqmp, int)
+        ):
+            raise TypeError(
+                "RSAPrivateNumbers p, q, d, dmp1, dmq1, iqmp arguments must"
+                " all be an integers."
+            )
+
+        if not isinstance(public_numbers, RSAPublicNumbers):
+            raise TypeError(
+                "RSAPrivateNumbers public_numbers must be an RSAPublicNumbers"
+                " instance."
+            )
+
+        self._p = p
+        self._q = q
+        self._d = d
+        self._dmp1 = dmp1
+        self._dmq1 = dmq1
+        self._iqmp = iqmp
+        self._public_numbers = public_numbers
+
+    p = property(lambda self: self._p)
+    q = property(lambda self: self._q)
+    d = property(lambda self: self._d)
+    dmp1 = property(lambda self: self._dmp1)
+    dmq1 = property(lambda self: self._dmq1)
+    iqmp = property(lambda self: self._iqmp)
+    public_numbers = property(lambda self: self._public_numbers)
+
+    def private_key(
+        self, backend: typing.Optional[Backend] = None
+    ) -> RSAPrivateKey:
+        backend = _get_backend(backend)
+        return backend.load_rsa_private_numbers(self)
+
+    def __eq__(self, other):
+        if not isinstance(other, RSAPrivateNumbers):
+            return NotImplemented
+
+        return (
+            self.p == other.p
+            and self.q == other.q
+            and self.d == other.d
+            and self.dmp1 == other.dmp1
+            and self.dmq1 == other.dmq1
+            and self.iqmp == other.iqmp
+            and self.public_numbers == other.public_numbers
+        )
+
+    def __ne__(self, other):
+        return not self == other
+
+    def __hash__(self):
+        return hash(
+            (
+                self.p,
+                self.q,
+                self.d,
+                self.dmp1,
+                self.dmq1,
+                self.iqmp,
+                self.public_numbers,
+            )
+        )
+
+
+class RSAPublicNumbers(object):
+    def __init__(self, e: int, n: int):
+        if not isinstance(e, int) or not isinstance(n, int):
+            raise TypeError("RSAPublicNumbers arguments must be integers.")
+
+        self._e = e
+        self._n = n
+
+    e = property(lambda self: self._e)
+    n = property(lambda self: self._n)
+
+    def public_key(
+        self, backend: typing.Optional[Backend] = None
+    ) -> RSAPublicKey:
+        backend = _get_backend(backend)
+        return backend.load_rsa_public_numbers(self)
+
+    def __repr__(self):
+        return "<RSAPublicNumbers(e={0.e}, n={0.n})>".format(self)
+
+    def __eq__(self, other):
+        if not isinstance(other, RSAPublicNumbers):
+            return NotImplemented
+
+        return self.e == other.e and self.n == other.n
+
+    def __ne__(self, other):
+        return not self == other
+
+    def __hash__(self):
+        return hash((self.e, self.n))

asq-env/lib/python3.9/site-packages/cryptography/hazmat/primitives/asymmetric/types.py

@@ -0,0 +1,29 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+import typing
+
+from cryptography.hazmat.primitives.asymmetric import (
+    dsa,
+    ec,
+    ed25519,
+    ed448,
+    rsa,
+)
+
+
+PUBLIC_KEY_TYPES = typing.Union[
+    dsa.DSAPublicKey,
+    rsa.RSAPublicKey,
+    ec.EllipticCurvePublicKey,
+    ed25519.Ed25519PublicKey,
+    ed448.Ed448PublicKey,
+]
+PRIVATE_KEY_TYPES = typing.Union[
+    ed25519.Ed25519PrivateKey,
+    ed448.Ed448PrivateKey,
+    rsa.RSAPrivateKey,
+    dsa.DSAPrivateKey,
+    ec.EllipticCurvePrivateKey,
+]

asq-env/lib/python3.9/site-packages/cryptography/hazmat/primitives/asymmetric/utils.py

@@ -0,0 +1,22 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+from cryptography.hazmat.bindings._rust import asn1
+from cryptography.hazmat.primitives import hashes
+
+
+decode_dss_signature = asn1.decode_dss_signature
+encode_dss_signature = asn1.encode_dss_signature
+
+
+class Prehashed(object):
+    def __init__(self, algorithm: hashes.HashAlgorithm):
+        if not isinstance(algorithm, hashes.HashAlgorithm):
+            raise TypeError("Expected instance of HashAlgorithm.")
+
+        self._algorithm = algorithm
+        self._digest_size = algorithm.digest_size
+
+    digest_size = property(lambda self: self._digest_size)

asq-env/lib/python3.9/site-packages/cryptography/hazmat/primitives/asymmetric/x25519.py

@@ -0,0 +1,81 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+
+import abc
+
+from cryptography.exceptions import UnsupportedAlgorithm, _Reasons
+from cryptography.hazmat.primitives import _serialization
+
+
+class X25519PublicKey(metaclass=abc.ABCMeta):
+    @classmethod
+    def from_public_bytes(cls, data: bytes) -> "X25519PublicKey":
+        from cryptography.hazmat.backends.openssl.backend import backend
+
+        if not backend.x25519_supported():
+            raise UnsupportedAlgorithm(
+                "X25519 is not supported by this version of OpenSSL.",
+                _Reasons.UNSUPPORTED_EXCHANGE_ALGORITHM,
+            )
+
+        return backend.x25519_load_public_bytes(data)
+
+    @abc.abstractmethod
+    def public_bytes(
+        self,
+        encoding: _serialization.Encoding,
+        format: _serialization.PublicFormat,
+    ) -> bytes:
+        """
+        The serialized bytes of the public key.
+        """
+
+
+class X25519PrivateKey(metaclass=abc.ABCMeta):
+    @classmethod
+    def generate(cls) -> "X25519PrivateKey":
+        from cryptography.hazmat.backends.openssl.backend import backend
+
+        if not backend.x25519_supported():
+            raise UnsupportedAlgorithm(
+                "X25519 is not supported by this version of OpenSSL.",
+                _Reasons.UNSUPPORTED_EXCHANGE_ALGORITHM,
+            )
+        return backend.x25519_generate_key()
+
+    @classmethod
+    def from_private_bytes(cls, data: bytes) -> "X25519PrivateKey":
+        from cryptography.hazmat.backends.openssl.backend import backend
+
+        if not backend.x25519_supported():
+            raise UnsupportedAlgorithm(
+                "X25519 is not supported by this version of OpenSSL.",
+                _Reasons.UNSUPPORTED_EXCHANGE_ALGORITHM,
+            )
+
+        return backend.x25519_load_private_bytes(data)
+
+    @abc.abstractmethod
+    def public_key(self) -> X25519PublicKey:
+        """
+        The serialized bytes of the public key.
+        """
+
+    @abc.abstractmethod
+    def private_bytes(
+        self,
+        encoding: _serialization.Encoding,
+        format: _serialization.PrivateFormat,
+        encryption_algorithm: _serialization.KeySerializationEncryption,
+    ) -> bytes:
+        """
+        The serialized bytes of the private key.
+        """
+
+    @abc.abstractmethod
+    def exchange(self, peer_public_key: X25519PublicKey) -> bytes:
+        """
+        Performs a key exchange operation using the provided peer's public key.
+        """