derivepassphrase.git

src/derivepassphrase/exporter/vault_native.py          1) # SPDX-FileCopyrightText: 2025 Marco Ricci <software@the13thletter.info>

src/derivepassphrase/exporter/vault_v03_and_below.py   2) #

src/derivepassphrase/exporter/vault_native.py          3) # SPDX-License-Identifier: Zlib

src/derivepassphrase/exporter/vault_v03_and_below.py   4) 

src/derivepassphrase/exporter/vault_native.py          5) """Exporter for the vault native configuration format (v0.2 or v0.3).
src/derivepassphrase/exporter/vault_native.py          6) 
src/derivepassphrase/exporter/vault_native.py          7) The vault native formats are the configuration formats used by vault
src/derivepassphrase/exporter/vault_native.py          8) v0.2 and v0.3.  The configuration is stored as a single encrypted file,
src/derivepassphrase/exporter/vault_native.py          9) which is encrypted and authenticated.  v0.2 and v0.3 differ in some
src/derivepassphrase/exporter/vault_native.py         10) details concerning key derivation and expected format of internal
src/derivepassphrase/exporter/vault_native.py         11) structures, so they are *not* compatible.  v0.2 additionally contains
src/derivepassphrase/exporter/vault_native.py         12) cryptographic weaknesses (API misuse of a key derivation function, and
src/derivepassphrase/exporter/vault_native.py         13) a low-entropy method of generating initialization vectors for CBC block
src/derivepassphrase/exporter/vault_native.py         14) encryption mode) and should thus be avoided if possible.
src/derivepassphrase/exporter/vault_native.py         15) 

src/derivepassphrase/exporter/vault_native.py         16) The public interface is the [`export_vault_native_data`][] function.
src/derivepassphrase/exporter/vault_native.py         17) Multiple *non-public* classes are additionally documented here for
src/derivepassphrase/exporter/vault_native.py         18) didactical and educational reasons, but they are not part of the module
src/derivepassphrase/exporter/vault_native.py         19) API, are subject to change without notice (including removal), and
src/derivepassphrase/exporter/vault_native.py         20) should *not* be used or relied on.

src/derivepassphrase/exporter/vault_native.py         21) 
src/derivepassphrase/exporter/vault_native.py         22) """

src/derivepassphrase/exporter/vault_v03_and_below.py  23) 

src/derivepassphrase/exporter/vault_native.py         24) # ruff: noqa: S303
src/derivepassphrase/exporter/vault_native.py         25) 

src/derivepassphrase/exporter/vault_v03_and_below.py  26) from __future__ import annotations
src/derivepassphrase/exporter/vault_v03_and_below.py  27) 
src/derivepassphrase/exporter/vault_v03_and_below.py  28) import abc
src/derivepassphrase/exporter/vault_v03_and_below.py  29) import base64

src/derivepassphrase/exporter/vault_native.py         30) import importlib

src/derivepassphrase/exporter/vault_v03_and_below.py  31) import json
src/derivepassphrase/exporter/vault_v03_and_below.py  32) import logging

src/derivepassphrase/exporter/vault_native.py         33) import os

src/derivepassphrase/exporter/vault_v03_and_below.py  34) import warnings

src/derivepassphrase/exporter/vault_v03_and_below.py  35) from typing import TYPE_CHECKING
src/derivepassphrase/exporter/vault_v03_and_below.py  36) 

src/derivepassphrase/exporter/vault_native.py         37) from derivepassphrase import _cli_msg as _msg

src/derivepassphrase/exporter/vault_v03_and_below.py  38) from derivepassphrase import exporter, vault
src/derivepassphrase/exporter/vault_v03_and_below.py  39) 
src/derivepassphrase/exporter/vault_v03_and_below.py  40) if TYPE_CHECKING:
src/derivepassphrase/exporter/vault_v03_and_below.py  41)     from typing import Any
src/derivepassphrase/exporter/vault_v03_and_below.py  42) 
src/derivepassphrase/exporter/vault_v03_and_below.py  43)     from typing_extensions import Buffer

src/derivepassphrase/exporter/vault_v03_and_below.py  44) 
src/derivepassphrase/exporter/vault_v03_and_below.py  45) if TYPE_CHECKING:
src/derivepassphrase/exporter/vault_v03_and_below.py  46)     from cryptography import exceptions as crypt_exceptions
src/derivepassphrase/exporter/vault_v03_and_below.py  47)     from cryptography import utils as crypt_utils
src/derivepassphrase/exporter/vault_v03_and_below.py  48)     from cryptography.hazmat.primitives import ciphers, hashes, hmac, padding
src/derivepassphrase/exporter/vault_v03_and_below.py  49)     from cryptography.hazmat.primitives.ciphers import algorithms, modes
src/derivepassphrase/exporter/vault_v03_and_below.py  50)     from cryptography.hazmat.primitives.kdf import pbkdf2
src/derivepassphrase/exporter/vault_v03_and_below.py  51) else:
src/derivepassphrase/exporter/vault_v03_and_below.py  52)     try:

src/derivepassphrase/exporter/vault_native.py         53)         importlib.import_module('cryptography')

src/derivepassphrase/exporter/vault_v03_and_below.py  54)     except ModuleNotFoundError as exc:
src/derivepassphrase/exporter/vault_v03_and_below.py  55) 

src/derivepassphrase/exporter/vault_v03_and_below.py  56)         class _DummyModule:  # pragma: no cover

src/derivepassphrase/exporter/vault_v03_and_below.py  57)             def __init__(self, exc: type[Exception]) -> None:
src/derivepassphrase/exporter/vault_v03_and_below.py  58)                 self.exc = exc
src/derivepassphrase/exporter/vault_v03_and_below.py  59) 

src/derivepassphrase/exporter/vault_v03_and_below.py  60)             def __getattr__(self, name: str) -> Any:  # noqa: ANN401
src/derivepassphrase/exporter/vault_v03_and_below.py  61)                 def func(*args: Any, **kwargs: Any) -> Any:  # noqa: ANN401,ARG001

src/derivepassphrase/exporter/vault_v03_and_below.py  62)                     raise self.exc
src/derivepassphrase/exporter/vault_v03_and_below.py  63) 
src/derivepassphrase/exporter/vault_v03_and_below.py  64)                 return func
src/derivepassphrase/exporter/vault_v03_and_below.py  65) 

src/derivepassphrase/exporter/vault_v03_and_below.py  66)         crypt_exceptions = crypt_utils = _DummyModule(exc)
src/derivepassphrase/exporter/vault_v03_and_below.py  67)         ciphers = hashes = hmac = padding = _DummyModule(exc)
src/derivepassphrase/exporter/vault_v03_and_below.py  68)         algorithms = modes = pbkdf2 = _DummyModule(exc)

src/derivepassphrase/exporter/vault_v03_and_below.py  69)         STUBBED = True
src/derivepassphrase/exporter/vault_v03_and_below.py  70)     else:

src/derivepassphrase/exporter/vault_native.py         71)         from cryptography import exceptions as crypt_exceptions
src/derivepassphrase/exporter/vault_native.py         72)         from cryptography import utils as crypt_utils
src/derivepassphrase/exporter/vault_native.py         73)         from cryptography.hazmat.primitives import (
src/derivepassphrase/exporter/vault_native.py         74)             ciphers,
src/derivepassphrase/exporter/vault_native.py         75)             hashes,
src/derivepassphrase/exporter/vault_native.py         76)             hmac,
src/derivepassphrase/exporter/vault_native.py         77)             padding,
src/derivepassphrase/exporter/vault_native.py         78)         )
src/derivepassphrase/exporter/vault_native.py         79)         from cryptography.hazmat.primitives.ciphers import algorithms, modes
src/derivepassphrase/exporter/vault_native.py         80)         from cryptography.hazmat.primitives.kdf import pbkdf2
src/derivepassphrase/exporter/vault_native.py         81) 

src/derivepassphrase/exporter/vault_v03_and_below.py  82)         STUBBED = False

src/derivepassphrase/exporter/vault_v03_and_below.py  83) 

src/derivepassphrase/exporter/vault_native.py         84) __all__ = ('export_vault_native_data',)
src/derivepassphrase/exporter/vault_native.py         85) 

src/derivepassphrase/exporter/vault_v03_and_below.py  86) logger = logging.getLogger(__name__)
src/derivepassphrase/exporter/vault_v03_and_below.py  87) 
src/derivepassphrase/exporter/vault_v03_and_below.py  88) 

src/derivepassphrase/exporter/vault_native.py         89) def _h(bs: Buffer) -> str:
src/derivepassphrase/exporter/vault_native.py         90)     return '<{}>'.format(memoryview(bs).hex(' '))

src/derivepassphrase/exporter/vault_v03_and_below.py  91) 
src/derivepassphrase/exporter/vault_v03_and_below.py  92) 

src/derivepassphrase/exporter/vault_v03_and_below.py  93) class VaultNativeConfigParser(abc.ABC):

src/derivepassphrase/exporter/vault_v03_and_below.py  94)     """A base parser for vault's native configuration format.
src/derivepassphrase/exporter/vault_v03_and_below.py  95) 
src/derivepassphrase/exporter/vault_v03_and_below.py  96)     Certain details are specific to the respective vault versions, and
src/derivepassphrase/exporter/vault_v03_and_below.py  97)     are abstracted out.  This class by itself is not instantiable
src/derivepassphrase/exporter/vault_v03_and_below.py  98)     because of this.
src/derivepassphrase/exporter/vault_v03_and_below.py  99) 
src/derivepassphrase/exporter/vault_v03_and_below.py 100)     """
src/derivepassphrase/exporter/vault_v03_and_below.py 101) 

src/derivepassphrase/exporter/vault_v03_and_below.py 102)     def __init__(self, contents: Buffer, password: str | Buffer) -> None:

src/derivepassphrase/exporter/vault_v03_and_below.py 103)         """Initialize the parser.
src/derivepassphrase/exporter/vault_v03_and_below.py 104) 
src/derivepassphrase/exporter/vault_v03_and_below.py 105)         Args:
src/derivepassphrase/exporter/vault_v03_and_below.py 106)             contents:
src/derivepassphrase/exporter/vault_v03_and_below.py 107)                 The binary contents of the encrypted configuration file.
src/derivepassphrase/exporter/vault_v03_and_below.py 108) 
src/derivepassphrase/exporter/vault_v03_and_below.py 109)                 Note: On disk, these are usually stored in
src/derivepassphrase/exporter/vault_v03_and_below.py 110)                 base64-encoded form, not in the "raw" form as needed
src/derivepassphrase/exporter/vault_v03_and_below.py 111)                 here.
src/derivepassphrase/exporter/vault_v03_and_below.py 112) 
src/derivepassphrase/exporter/vault_v03_and_below.py 113)             password:
src/derivepassphrase/exporter/vault_v03_and_below.py 114)                 The vault master key/master passphrase the file is
src/derivepassphrase/exporter/vault_v03_and_below.py 115)                 encrypted with.  Must be non-empty.  See

src/derivepassphrase/exporter/vault_native.py        116)                 [`exporter.get_vault_key`][] for details.

src/derivepassphrase/exporter/vault_v03_and_below.py 117) 
src/derivepassphrase/exporter/vault_v03_and_below.py 118)                 If this is a text string, then the UTF-8 encoding of the
src/derivepassphrase/exporter/vault_v03_and_below.py 119)                 string is used as the binary password.
src/derivepassphrase/exporter/vault_v03_and_below.py 120) 

src/derivepassphrase/exporter/vault_native.py        121)         Raises:
src/derivepassphrase/exporter/vault_native.py        122)             ValueError:
src/derivepassphrase/exporter/vault_native.py        123)                 The password must not be empty.
src/derivepassphrase/exporter/vault_native.py        124) 

src/derivepassphrase/exporter/vault_native.py        125)         Warning:
src/derivepassphrase/exporter/vault_native.py        126)             Non-public class, provided for didactical and educational
src/derivepassphrase/exporter/vault_native.py        127)             purposes only. Subject to change without notice, including
src/derivepassphrase/exporter/vault_native.py        128)             removal.
src/derivepassphrase/exporter/vault_native.py        129) 

src/derivepassphrase/exporter/vault_v03_and_below.py 130)         """

src/derivepassphrase/exporter/vault_v03_and_below.py 131)         if not password:

src/derivepassphrase/exporter/vault_v03_and_below.py 132)             msg = 'Password must not be empty'

src/derivepassphrase/exporter/vault_native.py        133)             raise ValueError(msg)

src/derivepassphrase/exporter/vault_v03_and_below.py 134)         self._contents = bytes(contents)

src/derivepassphrase/exporter/vault_v03_and_below.py 135)         self._iv_size = 0
src/derivepassphrase/exporter/vault_v03_and_below.py 136)         self._mac_size = 0
src/derivepassphrase/exporter/vault_v03_and_below.py 137)         self._encryption_key = b''
src/derivepassphrase/exporter/vault_v03_and_below.py 138)         self._encryption_key_size = 0
src/derivepassphrase/exporter/vault_v03_and_below.py 139)         self._signing_key = b''
src/derivepassphrase/exporter/vault_v03_and_below.py 140)         self._signing_key_size = 0
src/derivepassphrase/exporter/vault_v03_and_below.py 141)         self._message = b''
src/derivepassphrase/exporter/vault_v03_and_below.py 142)         self._message_tag = b''
src/derivepassphrase/exporter/vault_v03_and_below.py 143)         self._iv = b''
src/derivepassphrase/exporter/vault_v03_and_below.py 144)         self._payload = b''

src/derivepassphrase/exporter/vault_v03_and_below.py 145)         self._password = password
src/derivepassphrase/exporter/vault_v03_and_below.py 146)         self._sentinel: object = object()
src/derivepassphrase/exporter/vault_v03_and_below.py 147)         self._data: Any = self._sentinel
src/derivepassphrase/exporter/vault_v03_and_below.py 148) 

src/derivepassphrase/exporter/vault_v03_and_below.py 149)     def __call__(self) -> Any:  # noqa: ANN401
src/derivepassphrase/exporter/vault_v03_and_below.py 150)         """Return the decrypted and parsed vault configuration.
src/derivepassphrase/exporter/vault_v03_and_below.py 151) 
src/derivepassphrase/exporter/vault_v03_and_below.py 152)         Raises:
src/derivepassphrase/exporter/vault_v03_and_below.py 153)             cryptography.exceptions.InvalidSignature:
src/derivepassphrase/exporter/vault_v03_and_below.py 154)                 The encrypted configuration does not contain a valid
src/derivepassphrase/exporter/vault_v03_and_below.py 155)                 signature.
src/derivepassphrase/exporter/vault_v03_and_below.py 156)             ValueError:
src/derivepassphrase/exporter/vault_v03_and_below.py 157)                 The format is invalid, in a non-cryptographic way.  (For
src/derivepassphrase/exporter/vault_v03_and_below.py 158)                 example, it contains an unsupported version marker, or
src/derivepassphrase/exporter/vault_v03_and_below.py 159)                 unexpected extra contents, or invalid padding.)
src/derivepassphrase/exporter/vault_v03_and_below.py 160) 
src/derivepassphrase/exporter/vault_v03_and_below.py 161)         """

src/derivepassphrase/exporter/vault_v03_and_below.py 162)         if self._data is self._sentinel:
src/derivepassphrase/exporter/vault_v03_and_below.py 163)             self._parse_contents()
src/derivepassphrase/exporter/vault_v03_and_below.py 164)             self._derive_keys()
src/derivepassphrase/exporter/vault_v03_and_below.py 165)             self._check_signature()
src/derivepassphrase/exporter/vault_v03_and_below.py 166)             self._data = self._decrypt_payload()

src/derivepassphrase/exporter/vault_v03_and_below.py 167)         return self._data
src/derivepassphrase/exporter/vault_v03_and_below.py 168) 
src/derivepassphrase/exporter/vault_v03_and_below.py 169)     @staticmethod

src/derivepassphrase/exporter/vault_v03_and_below.py 170)     def _pbkdf2(

src/derivepassphrase/exporter/vault_v03_and_below.py 171)         password: str | Buffer, key_size: int, iterations: int

src/derivepassphrase/exporter/vault_v03_and_below.py 172)     ) -> bytes:
src/derivepassphrase/exporter/vault_v03_and_below.py 173)         if isinstance(password, str):
src/derivepassphrase/exporter/vault_v03_and_below.py 174)             password = password.encode('utf-8')
src/derivepassphrase/exporter/vault_v03_and_below.py 175)         raw_key = pbkdf2.PBKDF2HMAC(

src/derivepassphrase/exporter/vault_v03_and_below.py 176)             algorithm=hashes.SHA1(),

src/derivepassphrase/exporter/vault_v03_and_below.py 177)             length=key_size // 2,
src/derivepassphrase/exporter/vault_v03_and_below.py 178)             salt=vault.Vault._UUID,  # noqa: SLF001
src/derivepassphrase/exporter/vault_v03_and_below.py 179)             iterations=iterations,

src/derivepassphrase/exporter/vault_v03_and_below.py 180)         ).derive(bytes(password))

src/derivepassphrase/exporter/vault_native.py        181)         result_key = raw_key.hex().lower().encode('ASCII')

src/derivepassphrase/exporter/vault_v03_and_below.py 182)         logger.debug(

src/derivepassphrase/exporter/vault_native.py        183)             _msg.TranslatedString(
src/derivepassphrase/exporter/vault_native.py        184)                 _msg.DebugMsgTemplate.VAULT_NATIVE_PBKDF2_CALL,
src/derivepassphrase/exporter/vault_native.py        185)                 password=password,
src/derivepassphrase/exporter/vault_native.py        186)                 salt=vault.Vault._UUID,  # noqa: SLF001
src/derivepassphrase/exporter/vault_native.py        187)                 iterations=iterations,
src/derivepassphrase/exporter/vault_native.py        188)                 key_size=key_size // 2,
src/derivepassphrase/exporter/vault_native.py        189)                 algorithm='sha1',
src/derivepassphrase/exporter/vault_native.py        190)                 raw_result=raw_key,
src/derivepassphrase/exporter/vault_native.py        191)                 result_key=result_key.decode('ASCII'),
src/derivepassphrase/exporter/vault_native.py        192)             ),

src/derivepassphrase/exporter/vault_v03_and_below.py 193)         )

src/derivepassphrase/exporter/vault_native.py        194)         return result_key

src/derivepassphrase/exporter/vault_v03_and_below.py 195) 
src/derivepassphrase/exporter/vault_v03_and_below.py 196)     def _parse_contents(self) -> None:

src/derivepassphrase/exporter/vault_native.py        197)         logger.info(
src/derivepassphrase/exporter/vault_native.py        198)             _msg.TranslatedString(
src/derivepassphrase/exporter/vault_native.py        199)                 _msg.InfoMsgTemplate.VAULT_NATIVE_PARSING_IV_PAYLOAD_MAC,
src/derivepassphrase/exporter/vault_native.py        200)             ),
src/derivepassphrase/exporter/vault_native.py        201)         )

src/derivepassphrase/exporter/vault_v03_and_below.py 202) 

src/derivepassphrase/exporter/vault_v03_and_below.py 203)         if len(self._contents) < self._iv_size + 16 + self._mac_size:

src/derivepassphrase/exporter/vault_v03_and_below.py 204)             msg = 'Invalid vault configuration file: file is truncated'

src/derivepassphrase/exporter/vault_v03_and_below.py 205)             raise ValueError(msg)
src/derivepassphrase/exporter/vault_v03_and_below.py 206) 

src/derivepassphrase/exporter/vault_v03_and_below.py 207)         def cut(buffer: bytes, cutpoint: int) -> tuple[bytes, bytes]:
src/derivepassphrase/exporter/vault_v03_and_below.py 208)             return buffer[:cutpoint], buffer[cutpoint:]
src/derivepassphrase/exporter/vault_v03_and_below.py 209) 

src/derivepassphrase/exporter/vault_v03_and_below.py 210)         cutpos1 = len(self._contents) - self._mac_size
src/derivepassphrase/exporter/vault_v03_and_below.py 211)         cutpos2 = self._iv_size

src/derivepassphrase/exporter/vault_v03_and_below.py 212) 

src/derivepassphrase/exporter/vault_v03_and_below.py 213)         self._message, self._message_tag = cut(self._contents, cutpos1)
src/derivepassphrase/exporter/vault_v03_and_below.py 214)         self._iv, self._payload = cut(self._message, cutpos2)

src/derivepassphrase/exporter/vault_v03_and_below.py 215) 
src/derivepassphrase/exporter/vault_v03_and_below.py 216)         logger.debug(

src/derivepassphrase/exporter/vault_native.py        217)             _msg.TranslatedString(
src/derivepassphrase/exporter/vault_native.py        218)                 _msg.DebugMsgTemplate.VAULT_NATIVE_PARSE_BUFFER,
src/derivepassphrase/exporter/vault_native.py        219)                 contents=_h(self._contents),
src/derivepassphrase/exporter/vault_native.py        220)                 iv=_h(self._iv),
src/derivepassphrase/exporter/vault_native.py        221)                 payload=_h(self._payload),
src/derivepassphrase/exporter/vault_native.py        222)                 mac=_h(self._message_tag),
src/derivepassphrase/exporter/vault_native.py        223)             ),

src/derivepassphrase/exporter/vault_v03_and_below.py 224)         )
src/derivepassphrase/exporter/vault_v03_and_below.py 225) 
src/derivepassphrase/exporter/vault_v03_and_below.py 226)     def _derive_keys(self) -> None:

src/derivepassphrase/exporter/vault_native.py        227)         logger.info(
src/derivepassphrase/exporter/vault_native.py        228)             _msg.TranslatedString(
src/derivepassphrase/exporter/vault_native.py        229)                 _msg.InfoMsgTemplate.VAULT_NATIVE_DERIVING_KEYS,
src/derivepassphrase/exporter/vault_native.py        230)             ),
src/derivepassphrase/exporter/vault_native.py        231)         )

src/derivepassphrase/exporter/vault_v03_and_below.py 232)         self._generate_keys()

src/derivepassphrase/exporter/vault_native.py        233)         assert len(self._encryption_key) == self._encryption_key_size, (
src/derivepassphrase/exporter/vault_native.py        234)             'Derived encryption key is invalid'
src/derivepassphrase/exporter/vault_native.py        235)         )
src/derivepassphrase/exporter/vault_native.py        236)         assert len(self._signing_key) == self._signing_key_size, (
src/derivepassphrase/exporter/vault_native.py        237)             'Derived signing key is invalid'
src/derivepassphrase/exporter/vault_native.py        238)         )

src/derivepassphrase/exporter/vault_v03_and_below.py 239) 
src/derivepassphrase/exporter/vault_v03_and_below.py 240)     @abc.abstractmethod
src/derivepassphrase/exporter/vault_v03_and_below.py 241)     def _generate_keys(self) -> None:
src/derivepassphrase/exporter/vault_v03_and_below.py 242)         raise AssertionError
src/derivepassphrase/exporter/vault_v03_and_below.py 243) 
src/derivepassphrase/exporter/vault_v03_and_below.py 244)     def _check_signature(self) -> None:

src/derivepassphrase/exporter/vault_native.py        245)         logger.info(
src/derivepassphrase/exporter/vault_native.py        246)             _msg.TranslatedString(
src/derivepassphrase/exporter/vault_native.py        247)                 _msg.InfoMsgTemplate.VAULT_NATIVE_CHECKING_MAC,
src/derivepassphrase/exporter/vault_native.py        248)             ),
src/derivepassphrase/exporter/vault_native.py        249)         )

src/derivepassphrase/exporter/vault_v03_and_below.py 250)         mac = hmac.HMAC(self._signing_key, hashes.SHA256())

src/derivepassphrase/exporter/vault_v03_and_below.py 251)         mac_input = self._hmac_input()
src/derivepassphrase/exporter/vault_v03_and_below.py 252)         logger.debug(

src/derivepassphrase/exporter/vault_native.py        253)             _msg.TranslatedString(
src/derivepassphrase/exporter/vault_native.py        254)                 _msg.DebugMsgTemplate.VAULT_NATIVE_CHECKING_MAC_DETAILS,
src/derivepassphrase/exporter/vault_native.py        255)                 mac_input=_h(mac_input),
src/derivepassphrase/exporter/vault_native.py        256)                 mac=_h(self._message_tag),
src/derivepassphrase/exporter/vault_native.py        257)             ),

src/derivepassphrase/exporter/vault_v03_and_below.py 258)         )
src/derivepassphrase/exporter/vault_v03_and_below.py 259)         mac.update(mac_input)
src/derivepassphrase/exporter/vault_v03_and_below.py 260)         try:

src/derivepassphrase/exporter/vault_v03_and_below.py 261)             mac.verify(self._message_tag)

src/derivepassphrase/exporter/vault_v03_and_below.py 262)         except crypt_exceptions.InvalidSignature:

src/derivepassphrase/exporter/vault_v03_and_below.py 263)             msg = 'File does not contain a valid signature'

src/derivepassphrase/exporter/vault_v03_and_below.py 264)             raise ValueError(msg) from None
src/derivepassphrase/exporter/vault_v03_and_below.py 265) 
src/derivepassphrase/exporter/vault_v03_and_below.py 266)     @abc.abstractmethod
src/derivepassphrase/exporter/vault_v03_and_below.py 267)     def _hmac_input(self) -> bytes:
src/derivepassphrase/exporter/vault_v03_and_below.py 268)         raise AssertionError
src/derivepassphrase/exporter/vault_v03_and_below.py 269) 

src/derivepassphrase/exporter/vault_v03_and_below.py 270)     def _decrypt_payload(self) -> Any:  # noqa: ANN401

src/derivepassphrase/exporter/vault_native.py        271)         logger.info(
src/derivepassphrase/exporter/vault_native.py        272)             _msg.TranslatedString(
src/derivepassphrase/exporter/vault_native.py        273)                 _msg.InfoMsgTemplate.VAULT_NATIVE_DECRYPTING_CONTENTS,
src/derivepassphrase/exporter/vault_native.py        274)             ),
src/derivepassphrase/exporter/vault_native.py        275)         )

src/derivepassphrase/exporter/vault_v03_and_below.py 276)         decryptor = self._make_decryptor()
src/derivepassphrase/exporter/vault_v03_and_below.py 277)         padded_plaintext = bytearray()

src/derivepassphrase/exporter/vault_v03_and_below.py 278)         padded_plaintext.extend(decryptor.update(self._payload))

src/derivepassphrase/exporter/vault_v03_and_below.py 279)         padded_plaintext.extend(decryptor.finalize())

src/derivepassphrase/exporter/vault_native.py        280)         logger.debug(
src/derivepassphrase/exporter/vault_native.py        281)             _msg.TranslatedString(
src/derivepassphrase/exporter/vault_native.py        282)                 _msg.DebugMsgTemplate.VAULT_NATIVE_PADDED_PLAINTEXT,
src/derivepassphrase/exporter/vault_native.py        283)                 contents=_h(padded_plaintext),
src/derivepassphrase/exporter/vault_native.py        284)             ),
src/derivepassphrase/exporter/vault_native.py        285)         )

src/derivepassphrase/exporter/vault_v03_and_below.py 286)         unpadder = padding.PKCS7(self._iv_size * 8).unpadder()

src/derivepassphrase/exporter/vault_v03_and_below.py 287)         plaintext = bytearray()
src/derivepassphrase/exporter/vault_v03_and_below.py 288)         plaintext.extend(unpadder.update(padded_plaintext))
src/derivepassphrase/exporter/vault_v03_and_below.py 289)         plaintext.extend(unpadder.finalize())

src/derivepassphrase/exporter/vault_native.py        290)         logger.debug(
src/derivepassphrase/exporter/vault_native.py        291)             _msg.TranslatedString(
src/derivepassphrase/exporter/vault_native.py        292)                 _msg.DebugMsgTemplate.VAULT_NATIVE_PLAINTEXT,
src/derivepassphrase/exporter/vault_native.py        293)                 contents=_h(plaintext),
src/derivepassphrase/exporter/vault_native.py        294)             ),
src/derivepassphrase/exporter/vault_native.py        295)         )

src/derivepassphrase/exporter/vault_v03_and_below.py 296)         return json.loads(plaintext)

src/derivepassphrase/exporter/vault_v03_and_below.py 297) 
src/derivepassphrase/exporter/vault_v03_and_below.py 298)     @abc.abstractmethod
src/derivepassphrase/exporter/vault_v03_and_below.py 299)     def _make_decryptor(self) -> ciphers.CipherContext:
src/derivepassphrase/exporter/vault_v03_and_below.py 300)         raise AssertionError
src/derivepassphrase/exporter/vault_v03_and_below.py 301) 
src/derivepassphrase/exporter/vault_v03_and_below.py 302) 

src/derivepassphrase/exporter/vault_v03_and_below.py 303) class VaultNativeV03ConfigParser(VaultNativeConfigParser):

src/derivepassphrase/exporter/vault_v03_and_below.py 304)     """A parser for vault's native configuration format (v0.3).
src/derivepassphrase/exporter/vault_v03_and_below.py 305) 
src/derivepassphrase/exporter/vault_v03_and_below.py 306)     This is the modern, pre-storeroom configuration format.
src/derivepassphrase/exporter/vault_v03_and_below.py 307) 

src/derivepassphrase/exporter/vault_native.py        308)     Warning:
src/derivepassphrase/exporter/vault_native.py        309)         Non-public class, provided for didactical and educational
src/derivepassphrase/exporter/vault_native.py        310)         purposes only. Subject to change without notice, including
src/derivepassphrase/exporter/vault_native.py        311)         removal.
src/derivepassphrase/exporter/vault_native.py        312) 

src/derivepassphrase/exporter/vault_v03_and_below.py 313)     """
src/derivepassphrase/exporter/vault_v03_and_below.py 314) 

src/derivepassphrase/exporter/vault_v03_and_below.py 315)     KEY_SIZE = 32
src/derivepassphrase/exporter/vault_v03_and_below.py 316) 

src/derivepassphrase/exporter/vault_native.py        317)     def __init__(self, *args: Any, **kwargs: Any) -> None:  # noqa: ANN401

src/derivepassphrase/exporter/vault_v03_and_below.py 318)         super().__init__(*args, **kwargs)

src/derivepassphrase/exporter/vault_v03_and_below.py 319)         self._iv_size = 16
src/derivepassphrase/exporter/vault_v03_and_below.py 320)         self._mac_size = 32

src/derivepassphrase/exporter/vault_v03_and_below.py 321) 
src/derivepassphrase/exporter/vault_v03_and_below.py 322)     def _generate_keys(self) -> None:

src/derivepassphrase/exporter/vault_v03_and_below.py 323)         self._encryption_key = self._pbkdf2(self._password, self.KEY_SIZE, 100)
src/derivepassphrase/exporter/vault_v03_and_below.py 324)         self._signing_key = self._pbkdf2(self._password, self.KEY_SIZE, 200)
src/derivepassphrase/exporter/vault_v03_and_below.py 325)         self._encryption_key_size = self._signing_key_size = self.KEY_SIZE

src/derivepassphrase/exporter/vault_v03_and_below.py 326) 
src/derivepassphrase/exporter/vault_v03_and_below.py 327)     def _hmac_input(self) -> bytes:

src/derivepassphrase/exporter/vault_v03_and_below.py 328)         return self._message.hex().lower().encode('ASCII')

src/derivepassphrase/exporter/vault_v03_and_below.py 329) 
src/derivepassphrase/exporter/vault_v03_and_below.py 330)     def _make_decryptor(self) -> ciphers.CipherContext:
src/derivepassphrase/exporter/vault_v03_and_below.py 331)         return ciphers.Cipher(

src/derivepassphrase/exporter/vault_v03_and_below.py 332)             algorithms.AES256(self._encryption_key), modes.CBC(self._iv)

src/derivepassphrase/exporter/vault_v03_and_below.py 333)         ).decryptor()
src/derivepassphrase/exporter/vault_v03_and_below.py 334) 
src/derivepassphrase/exporter/vault_v03_and_below.py 335) 

src/derivepassphrase/exporter/vault_v03_and_below.py 336) class VaultNativeV02ConfigParser(VaultNativeConfigParser):

src/derivepassphrase/exporter/vault_v03_and_below.py 337)     """A parser for vault's native configuration format (v0.2).
src/derivepassphrase/exporter/vault_v03_and_below.py 338) 
src/derivepassphrase/exporter/vault_v03_and_below.py 339)     This is the classic configuration format.  Compared to v0.3, it
src/derivepassphrase/exporter/vault_v03_and_below.py 340)     contains an (accidental) API misuse for the generation of the master
src/derivepassphrase/exporter/vault_v03_and_below.py 341)     keys, a low-entropy method of generating initialization vectors for
src/derivepassphrase/exporter/vault_v03_and_below.py 342)     the AES-CBC encryption step, and extra layers of base64 encoding.
src/derivepassphrase/exporter/vault_v03_and_below.py 343)     Because of these significantly weakened confidentiality guarantees,
src/derivepassphrase/exporter/vault_v03_and_below.py 344)     v0.2 configurations should be upgraded to at least v0.3 as soon as
src/derivepassphrase/exporter/vault_v03_and_below.py 345)     possible.

src/derivepassphrase/exporter/vault_v03_and_below.py 346) 

src/derivepassphrase/exporter/vault_native.py        347)     Warning:
src/derivepassphrase/exporter/vault_native.py        348)         Non-public class, provided for didactical and educational
src/derivepassphrase/exporter/vault_native.py        349)         purposes only. Subject to change without notice, including
src/derivepassphrase/exporter/vault_native.py        350)         removal.
src/derivepassphrase/exporter/vault_native.py        351) 

src/derivepassphrase/exporter/vault_v03_and_below.py 352)     """
src/derivepassphrase/exporter/vault_v03_and_below.py 353) 

src/derivepassphrase/exporter/vault_native.py        354)     def __init__(self, *args: Any, **kwargs: Any) -> None:  # noqa: ANN401

src/derivepassphrase/exporter/vault_v03_and_below.py 355)         super().__init__(*args, **kwargs)

src/derivepassphrase/exporter/vault_v03_and_below.py 356)         self._iv_size = 16
src/derivepassphrase/exporter/vault_v03_and_below.py 357)         self._mac_size = 64

src/derivepassphrase/exporter/vault_v03_and_below.py 358) 
src/derivepassphrase/exporter/vault_v03_and_below.py 359)     def _parse_contents(self) -> None:
src/derivepassphrase/exporter/vault_v03_and_below.py 360)         super()._parse_contents()

src/derivepassphrase/exporter/vault_v03_and_below.py 361)         self._payload = base64.standard_b64decode(self._payload)
src/derivepassphrase/exporter/vault_v03_and_below.py 362)         self._message_tag = bytes.fromhex(self._message_tag.decode('ASCII'))

src/derivepassphrase/exporter/vault_native.py        363)         logger.debug(
src/derivepassphrase/exporter/vault_native.py        364)             _msg.TranslatedString(
src/derivepassphrase/exporter/vault_native.py        365)                 _msg.DebugMsgTemplate.VAULT_NATIVE_V02_PAYLOAD_MAC_POSTPROCESSING,
src/derivepassphrase/exporter/vault_native.py        366)                 payload=_h(self._payload),
src/derivepassphrase/exporter/vault_native.py        367)                 mac=_h(self._message_tag),
src/derivepassphrase/exporter/vault_native.py        368)             ),
src/derivepassphrase/exporter/vault_native.py        369)         )

src/derivepassphrase/exporter/vault_v03_and_below.py 370) 
src/derivepassphrase/exporter/vault_v03_and_below.py 371)     def _generate_keys(self) -> None:

src/derivepassphrase/exporter/vault_v03_and_below.py 372)         self._encryption_key = self._pbkdf2(self._password, 8, 16)
src/derivepassphrase/exporter/vault_v03_and_below.py 373)         self._signing_key = self._pbkdf2(self._password, 16, 16)
src/derivepassphrase/exporter/vault_v03_and_below.py 374)         self._encryption_key_size = 8
src/derivepassphrase/exporter/vault_v03_and_below.py 375)         self._signing_key_size = 16

src/derivepassphrase/exporter/vault_v03_and_below.py 376) 
src/derivepassphrase/exporter/vault_v03_and_below.py 377)     def _hmac_input(self) -> bytes:

src/derivepassphrase/exporter/vault_v03_and_below.py 378)         return base64.standard_b64encode(self._message)

src/derivepassphrase/exporter/vault_v03_and_below.py 379) 
src/derivepassphrase/exporter/vault_v03_and_below.py 380)     def _make_decryptor(self) -> ciphers.CipherContext:

src/derivepassphrase/exporter/vault_v03_and_below.py 381)         def evp_bytestokey_md5_one_iteration_no_salt(
src/derivepassphrase/exporter/vault_v03_and_below.py 382)             data: bytes, key_size: int, iv_size: int

src/derivepassphrase/exporter/vault_v03_and_below.py 383)         ) -> tuple[bytes, bytes]:
src/derivepassphrase/exporter/vault_v03_and_below.py 384)             total_size = key_size + iv_size
src/derivepassphrase/exporter/vault_v03_and_below.py 385)             buffer = bytearray()
src/derivepassphrase/exporter/vault_v03_and_below.py 386)             last_block = b''

src/derivepassphrase/exporter/vault_v03_and_below.py 387)             salt = b''

src/derivepassphrase/exporter/vault_native.py        388)             logger.debug(

src/derivepassphrase/exporter/vault_native.py        389)                 _msg.TranslatedString(
src/derivepassphrase/exporter/vault_native.py        390)                     _msg.DebugMsgTemplate.VAULT_NATIVE_EVP_BYTESTOKEY_INIT,
src/derivepassphrase/exporter/vault_native.py        391)                     data=_h(data),
src/derivepassphrase/exporter/vault_native.py        392)                     salt=_h(salt),
src/derivepassphrase/exporter/vault_native.py        393)                     key_size=key_size,
src/derivepassphrase/exporter/vault_native.py        394)                     iv_size=iv_size,
src/derivepassphrase/exporter/vault_native.py        395)                     buffer_length=len(buffer),
src/derivepassphrase/exporter/vault_native.py        396)                     buffer=_h(buffer),

src/derivepassphrase/exporter/vault_v03_and_below.py 397)                 ),
src/derivepassphrase/exporter/vault_v03_and_below.py 398)             )
src/derivepassphrase/exporter/vault_v03_and_below.py 399)             while len(buffer) < total_size:
src/derivepassphrase/exporter/vault_v03_and_below.py 400)                 with warnings.catch_warnings():
src/derivepassphrase/exporter/vault_v03_and_below.py 401)                     warnings.simplefilter(
src/derivepassphrase/exporter/vault_v03_and_below.py 402)                         'ignore', crypt_utils.CryptographyDeprecationWarning
src/derivepassphrase/exporter/vault_v03_and_below.py 403)                     )

src/derivepassphrase/exporter/vault_v03_and_below.py 404)                     block = hashes.Hash(hashes.MD5())

src/derivepassphrase/exporter/vault_v03_and_below.py 405)                 block.update(last_block)
src/derivepassphrase/exporter/vault_v03_and_below.py 406)                 block.update(data)
src/derivepassphrase/exporter/vault_v03_and_below.py 407)                 block.update(salt)
src/derivepassphrase/exporter/vault_v03_and_below.py 408)                 last_block = block.finalize()
src/derivepassphrase/exporter/vault_v03_and_below.py 409)                 buffer.extend(last_block)

src/derivepassphrase/exporter/vault_native.py        410)                 logger.debug(

src/derivepassphrase/exporter/vault_native.py        411)                     _msg.TranslatedString(
src/derivepassphrase/exporter/vault_native.py        412)                         _msg.DebugMsgTemplate.VAULT_NATIVE_EVP_BYTESTOKEY_ROUND,
src/derivepassphrase/exporter/vault_native.py        413)                         buffer_length=len(buffer),
src/derivepassphrase/exporter/vault_native.py        414)                         buffer=_h(buffer),
src/derivepassphrase/exporter/vault_native.py        415)                     ),

src/derivepassphrase/exporter/vault_v03_and_below.py 416)                 )

src/derivepassphrase/exporter/vault_native.py        417)             logger.debug(

src/derivepassphrase/exporter/vault_native.py        418)                 _msg.TranslatedString(
src/derivepassphrase/exporter/vault_native.py        419)                     _msg.DebugMsgTemplate.VAULT_NATIVE_EVP_BYTESTOKEY_RESULT,
src/derivepassphrase/exporter/vault_native.py        420)                     enc_key=_h(buffer[:key_size]),
src/derivepassphrase/exporter/vault_native.py        421)                     iv=_h(buffer[key_size:total_size]),
src/derivepassphrase/exporter/vault_native.py        422)                 ),

src/derivepassphrase/exporter/vault_v03_and_below.py 423)             )
src/derivepassphrase/exporter/vault_v03_and_below.py 424)             return bytes(buffer[:key_size]), bytes(buffer[key_size:total_size])
src/derivepassphrase/exporter/vault_v03_and_below.py 425) 

src/derivepassphrase/exporter/vault_v03_and_below.py 426)         data = base64.standard_b64encode(self._iv + self._encryption_key)

src/derivepassphrase/exporter/vault_v03_and_below.py 427)         encryption_key, iv = evp_bytestokey_md5_one_iteration_no_salt(
src/derivepassphrase/exporter/vault_v03_and_below.py 428)             data, key_size=32, iv_size=16

src/derivepassphrase/exporter/vault_v03_and_below.py 429)         )
src/derivepassphrase/exporter/vault_v03_and_below.py 430)         return ciphers.Cipher(
src/derivepassphrase/exporter/vault_v03_and_below.py 431)             algorithms.AES256(encryption_key), modes.CBC(iv)
src/derivepassphrase/exporter/vault_v03_and_below.py 432)         ).decryptor()
src/derivepassphrase/exporter/vault_v03_and_below.py 433) 
src/derivepassphrase/exporter/vault_v03_and_below.py 434) 

src/derivepassphrase/exporter/vault_native.py        435) @exporter.register_export_vault_config_data_handler('v0.2', 'v0.3')

src/derivepassphrase/exporter/vault_native.py        436) def export_vault_native_data(  # noqa: D417

src/derivepassphrase/exporter/vault_native.py        437)     path: str | bytes | os.PathLike | None = None,

src/derivepassphrase/exporter/vault_native.py        438)     key: str | Buffer | None = None,
src/derivepassphrase/exporter/vault_native.py        439)     *,

src/derivepassphrase/exporter/vault_native.py        440)     format: str,  # noqa: A002

src/derivepassphrase/exporter/vault_native.py        441) ) -> Any:  # noqa: ANN401
src/derivepassphrase/exporter/vault_native.py        442)     """Export the full configuration stored in vault native format.
src/derivepassphrase/exporter/vault_native.py        443) 

src/derivepassphrase/exporter/vault_native.py        444)     See [`exporter.ExportVaultConfigDataFunction`][] for an explanation
src/derivepassphrase/exporter/vault_native.py        445)     of the call signature, and the exceptions to expect.

src/derivepassphrase/exporter/vault_native.py        446) 

src/derivepassphrase/exporter/vault_native.py        447)     Other Args:
src/derivepassphrase/exporter/vault_native.py        448)         format:
src/derivepassphrase/exporter/vault_native.py        449)             The only supported formats are `v0.2` and `v0.3`.

src/derivepassphrase/exporter/vault_native.py        450) 

src/derivepassphrase/exporter/vault_native.py        451)     """  # noqa: DOC201,DOC501

src/derivepassphrase/exporter/vault_native.py        452)     # Trigger import errors if necessary.
src/derivepassphrase/exporter/vault_native.py        453)     importlib.import_module('cryptography')
src/derivepassphrase/exporter/vault_native.py        454)     if path is None:
src/derivepassphrase/exporter/vault_native.py        455)         path = exporter.get_vault_path()
src/derivepassphrase/exporter/vault_native.py        456)     with open(path, 'rb') as infile:
src/derivepassphrase/exporter/vault_native.py        457)         contents = base64.standard_b64decode(infile.read())

src/derivepassphrase/exporter/vault_native.py        458)     if key is None:
src/derivepassphrase/exporter/vault_native.py        459)         key = exporter.get_vault_key()

src/derivepassphrase/exporter/vault_native.py        460)     parser_class: type[VaultNativeConfigParser] | None = {
src/derivepassphrase/exporter/vault_native.py        461)         'v0.2': VaultNativeV02ConfigParser,
src/derivepassphrase/exporter/vault_native.py        462)         'v0.3': VaultNativeV03ConfigParser,
src/derivepassphrase/exporter/vault_native.py        463)     }.get(format)
src/derivepassphrase/exporter/vault_native.py        464)     if parser_class is None:  # pragma: no cover
src/derivepassphrase/exporter/vault_native.py        465)         msg = exporter.INVALID_VAULT_NATIVE_CONFIGURATION_FORMAT.format(
src/derivepassphrase/exporter/vault_native.py        466)             fmt=format
src/derivepassphrase/exporter/vault_native.py        467)         )
src/derivepassphrase/exporter/vault_native.py        468)         raise ValueError(msg)
src/derivepassphrase/exporter/vault_native.py        469)     try:
src/derivepassphrase/exporter/vault_native.py        470)         return parser_class(contents, key)()
src/derivepassphrase/exporter/vault_native.py        471)     except ValueError as exc:
src/derivepassphrase/exporter/vault_native.py        472)         raise exporter.NotAVaultConfigError(
src/derivepassphrase/exporter/vault_native.py        473)             os.fsdecode(path),
src/derivepassphrase/exporter/vault_native.py        474)             format=format,
src/derivepassphrase/exporter/vault_native.py        475)         ) from exc

src/derivepassphrase/exporter/vault_native.py        476) 
src/derivepassphrase/exporter/vault_native.py        477) 

src/derivepassphrase/exporter/vault_v03_and_below.py 478) if __name__ == '__main__':
src/derivepassphrase/exporter/vault_v03_and_below.py 479)     import os
src/derivepassphrase/exporter/vault_v03_and_below.py 480) 
src/derivepassphrase/exporter/vault_v03_and_below.py 481)     logging.basicConfig(level=('DEBUG' if os.getenv('DEBUG') else 'WARNING'))

src/derivepassphrase/exporter/vault_v03_and_below.py 482)     with open(exporter.get_vault_path(), 'rb') as infile:

src/derivepassphrase/exporter/vault_v03_and_below.py 483)         contents = base64.standard_b64decode(infile.read())

src/derivepassphrase/exporter/vault_v03_and_below.py 484)     password = exporter.get_vault_key()

src/derivepassphrase/exporter/vault_v03_and_below.py 485)     try:

src/derivepassphrase/exporter/vault_v03_and_below.py 486)         config = VaultNativeV03ConfigParser(contents, password)()

src/derivepassphrase/exporter/vault_v03_and_below.py 487)     except ValueError:

src/derivepassphrase/exporter/vault_v03_and_below.py 488)         config = VaultNativeV02ConfigParser(contents, password)()