Mkae it possible to use all (most?) hash algorithms in cryptography.hazmat.primitives.hashes .

Author: rohe

src/cryptojwt/jwe/fernet.py

@@ -7,20 +7,33 @@
 from cryptography.hazmat.primitives import hashes
 from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
 
-from cryptojwt import as_unicode
 from cryptojwt.jwe import Encrypter
 from cryptojwt.utils import as_bytes
 
 
+DEFAULT_ITERATIONS = 390000
+
+
 class FernetEncrypter(Encrypter):
-    def __init__(self, password: str, salt: Optional[bytes] = ""):
+    def __init__(self,
+                 password: str,
+                 salt: Optional[bytes] = "",
+                 hash_alg: Optional[str] = "SHA256",
+                 digest_size: Optional[int] = 0,
+                 iterations: Optional[int] = DEFAULT_ITERATIONS):
         Encrypter.__init__(self)
         if not salt:
             salt = os.urandom(16)
         else:
             salt = as_bytes(salt)
 
-        kdf = PBKDF2HMAC(algorithm=hashes.SHA256(), length=32, salt=salt, iterations=390000)
+        _alg = getattr(hashes, hash_alg)
+        # A bit special for SHAKE* and BLAKE* hashes
+        if hash_alg.startswith("SHAKE") or hash_alg.startswith("BLAKE"):
+            _algorithm = _alg(digest_size)
+        else:
+            _algorithm = _alg()
+        kdf = PBKDF2HMAC(algorithm=_algorithm, length=32, salt=salt, iterations=iterations)
         self.key = base64.urlsafe_b64encode(kdf.derive(as_bytes(password)))
         self.core = Fernet(self.key)
 

tests/test_07_jwe.py

@@ -6,9 +6,9 @@
 import string
 import sys
 
-import pytest
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives.asymmetric import ec
+import pytest
 
 from cryptojwt.exception import BadSyntax
 from cryptojwt.exception import HeaderError
@@ -139,7 +139,8 @@ def test_jwe_09_a1():
 
     b64_ejek = (
         b"ApfOLCaDbqs_JXPYy2I937v_xmrzj"
-        b"-Iss1mG6NAHmeJViM6j2l0MHvfseIdHVyU2BIoGVu9ohvkkWiRq5DL2jYZTPA9TAdwq3FUIVyoH-Pedf6elHIVFi2KGDEspYMtQARMMSBcS7pslx6flh1Cfh3GBKysztVMEhZ_maFkm4PYVCsJsvq6Ct3fg2CJPOs0X1DHuxZKoIGIqcbeK4XEO5a0h5TAuJObKdfO0dKwfNSSbpu5sFrpRFwV2FTTYoqF4zI46N9-_hMIznlEpftRXhScEJuZ9HG8C8CHB1WRZ_J48PleqdhF4o7fB5J1wFqUXBtbtuGJ_A2Xe6AEhrlzCOw"
+        b"-Iss1mG6NAHmeJViM6j2l0MHvfseIdHVyU2BIoGVu9ohvkkWiRq5DL2jYZTPA9TAdwq3FUIVyoH"
+        b"-Pedf6elHIVFi2KGDEspYMtQARMMSBcS7pslx6flh1Cfh3GBKysztVMEhZ_maFkm4PYVCsJsvq6Ct3fg2CJPOs0X1DHuxZKoIGIqcbeK4XEO5a0h5TAuJObKdfO0dKwfNSSbpu5sFrpRFwV2FTTYoqF4zI46N9-_hMIznlEpftRXhScEJuZ9HG8C8CHB1WRZ_J48PleqdhF4o7fB5J1wFqUXBtbtuGJ_A2Xe6AEhrlzCOw"
     )
 
     iv = intarr2bytes([227, 197, 117, 252, 2, 219, 233, 68, 180, 225, 77, 219])
@@ -244,7 +245,8 @@ def test_jwe_09_a1():
         [
             b"eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkEyNTZHQ00ifQ",
             b"ApfOLCaDbqs_JXPYy2I937v_xmrzj"
-            b"-Iss1mG6NAHmeJViM6j2l0MHvfseIdHVyU2BIoGVu9ohvkkWiRq5DL2jYZTPA9TAdwq3FUIVyoH-Pedf6elHIVFi2KGDEspYMtQARMMSBcS7pslx6flh1Cfh3GBKysztVMEhZ_maFkm4PYVCsJsvq6Ct3fg2CJPOs0X1DHuxZKoIGIqcbeK4XEO5a0h5TAuJObKdfO0dKwfNSSbpu5sFrpRFwV2FTTYoqF4zI46N9-_hMIznlEpftRXhScEJuZ9HG8C8CHB1WRZ_J48PleqdhF4o7fB5J1wFqUXBtbtuGJ_A2Xe6AEhrlzCOw",
+            b"-Iss1mG6NAHmeJViM6j2l0MHvfseIdHVyU2BIoGVu9ohvkkWiRq5DL2jYZTPA9TAdwq3FUIVyoH"
+            b"-Pedf6elHIVFi2KGDEspYMtQARMMSBcS7pslx6flh1Cfh3GBKysztVMEhZ_maFkm4PYVCsJsvq6Ct3fg2CJPOs0X1DHuxZKoIGIqcbeK4XEO5a0h5TAuJObKdfO0dKwfNSSbpu5sFrpRFwV2FTTYoqF4zI46N9-_hMIznlEpftRXhScEJuZ9HG8C8CHB1WRZ_J48PleqdhF4o7fB5J1wFqUXBtbtuGJ_A2Xe6AEhrlzCOw",
             b"48V1_ALb6US04U3b",
             b"5eym8TW_c8SuK0ltJ3rpYIzOeDQz7TALvtu6UG9oMo4vpzs9tX_EFShS8iB7j6jiSdiwkIr3ajwQzaBtQD_A",
             b"ghEgxninkHEAMp4xZtB2mA",
@@ -655,3 +657,26 @@ def test_fernet():
     decrypter = encrypter
     resp = decrypter.decrypt(_token)
     assert resp == plain
+
+
+def test_fernet_sha512():
+    encryption_key = SYMKey(use="enc", key="DukeofHazardpass", kid="some-key-id")
+
+    encrypter = FernetEncrypter(encryption_key.key, hash_alg="SHA512")
+    _token = encrypter.encrypt(plain)
+
+    decrypter = encrypter
+    resp = decrypter.decrypt(_token)
+    assert resp == plain
+
+
+def test_fernet_blake2s():
+    encryption_key = SYMKey(use="enc", key="DukeofHazardpass", kid="some-key-id")
+
+    encrypter = FernetEncrypter(encryption_key.key, hash_alg="BLAKE2s", digest_size=32,
+                                iterations=1000)
+    _token = encrypter.encrypt(plain)
+
+    decrypter = encrypter
+    resp = decrypter.decrypt(_token)
+    assert resp == plain