Class PrivKey

scapy/layers/tls/cert.py:639–720

Parent class for PrivKeyRSA, PrivKeyECDSA and PrivKeyEdDSA. Provides common signTBSCert(), resignCert(), verifyCert() and export() methods.

class PrivKey(metaclass=_PrivKeyFactory):
    """
    Parent class for PrivKeyRSA, PrivKeyECDSA and PrivKeyEdDSA.
    Provides common signTBSCert(), resignCert(), verifyCert()
    and export() methods.
    """

    def signTBSCert(self, tbsCert, h="sha256"):
        """
        Note that this will always copy the signature field from the
        tbsCertificate into the signatureAlgorithm field of the result,
        regardless of the coherence between its contents (which might
        indicate ecdsa-with-SHA512) and the result (e.g. RSA signing MD2).

        There is a small inheritance trick for the computation of sigVal
        below: in order to use a sign() method which would apply
        to both PrivKeyRSA and PrivKeyECDSA, the sign() methods of the
        subclasses accept any argument, be it from the RSA or ECDSA world,
        and then they keep the ones they're interested in.
        Here, t will be passed eventually to pkcs1._DecryptAndSignRSA.sign().
        """
        sigAlg = tbsCert.signature
        h = h or hash_by_oid[sigAlg.algorithm.val]
        sigVal = self.sign(bytes(tbsCert), h=h, t="pkcs")
        c = X509_Cert()
        c.tbsCertificate = tbsCert
        c.signatureAlgorithm = sigAlg
        c.signatureValue = _Raw_ASN1_BIT_STRING(sigVal, readable=True)
        return c

    def resignCert(self, cert):
        """Rewrite the signature of either a Cert or an X509_Cert."""
        return self.signTBSCert(cert.tbsCertificate, h=None)

    def verifyCert(self, cert):
        """Verifies either a Cert or an X509_Cert."""
        return self.pubkey.verifyCert(cert)

    def verifyCsr(self, cert):
        """Verifies either a CSR."""
        return self.pubkey.verifyCsr(cert)

    @property
    def pem(self):
        return der2pem(self.der, self.marker)

    @property
    def der(self):
        return self.key.private_bytes(
            encoding=serialization.Encoding.DER,
            format=serialization.PrivateFormat.PKCS8,
            encryption_algorithm=serialization.NoEncryption(),
        )

    def export(self, filename, fmt=None):
        """
        Export private key in 'fmt' format (DER or PEM) to file 'filename'
        """