e744336385
C-6: ConnectorRuntime enforces capability_mask per operation.
READ-only ACs cannot invoke MUTATE operations (wipe, lock, retire).
C-7: AC validated against database (exists, active, not expired)
before connector invocation.
C-9: Delegated AC capability bounded by delegator's capability.
C-10: Command counter uses atomic SQL increment with limit check.
M-23: expire_stale() uses same atomic SQL pattern.
H-1: Sensitive credential fields hidden from repr/logs via repr=False.
H-2: Stub backend requires ALLOW_STUB_CREDENTIALS=true to activate.
H-3: Kerberos backend raises CredentialResolutionError instead of
returning stub ticket.
H-4: Chronicle INTENT emitted before execution, RESULT after.
H-5: device_id validated as UUID before Graph API URL interpolation.
H-8: ConnectorRuntime enforces governance for all connector invocations.
Signed-off-by: Tyler King <tking@guildhouse.dev>
53 lines
1.6 KiB
Python
53 lines
1.6 KiB
Python
# Copyright 2011 Sybren A. Stüvel <sybren@stuvel.eu>
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# https://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
"""Core mathematical operations.
|
|
|
|
This is the actual core RSA implementation, which is only defined
|
|
mathematically on integers.
|
|
"""
|
|
|
|
|
|
def assert_int(var: int, name: str) -> None:
|
|
if isinstance(var, int):
|
|
return
|
|
|
|
raise TypeError("%s should be an integer, not %s" % (name, var.__class__))
|
|
|
|
|
|
def encrypt_int(message: int, ekey: int, n: int) -> int:
|
|
"""Encrypts a message using encryption key 'ekey', working modulo n"""
|
|
|
|
assert_int(message, "message")
|
|
assert_int(ekey, "ekey")
|
|
assert_int(n, "n")
|
|
|
|
if message < 0:
|
|
raise ValueError("Only non-negative numbers are supported")
|
|
|
|
if message > n:
|
|
raise OverflowError("The message %i is too long for n=%i" % (message, n))
|
|
|
|
return pow(message, ekey, n)
|
|
|
|
|
|
def decrypt_int(cyphertext: int, dkey: int, n: int) -> int:
|
|
"""Decrypts a cypher text using the decryption key 'dkey', working modulo n"""
|
|
|
|
assert_int(cyphertext, "cyphertext")
|
|
assert_int(dkey, "dkey")
|
|
assert_int(n, "n")
|
|
|
|
message = pow(cyphertext, dkey, n)
|
|
return message
|