derivepassphrase.git

@@ -32,6 +32,7 @@ import json

 import logging

 import os

 import pathlib

+import threading

 import warnings

 from typing import TYPE_CHECKING

@@ -176,6 +177,7 @@ class VaultNativeConfigParser(abc.ABC):

         if not password:

             msg = 'Password must not be empty'

             raise ValueError(msg)

+        self._consistency_lock = threading.RLock()

         self._contents = bytes(contents)

         self._iv_size = 0

         self._mac_size = 0

@@ -204,6 +206,7 @@ class VaultNativeConfigParser(abc.ABC):

                 unexpected extra contents, or invalid padding.)

         """

+        with self._consistency_lock:

             if self._data is self._sentinel:

                 self._parse_contents()

                 self._derive_keys()

@@ -283,26 +286,35 @@ class VaultNativeConfigParser(abc.ABC):

             ),

         )

-        if len(self._contents) < self._iv_size + 16 + self._mac_size:

-            msg = 'Invalid vault configuration file: file is truncated'

-            raise ValueError(msg)

-

         def cut(buffer: bytes, cutpoint: int) -> tuple[bytes, bytes]:

             return buffer[:cutpoint], buffer[cutpoint:]

-        cutpos1 = len(self._contents) - self._mac_size

-        cutpos2 = self._iv_size

+        with self._consistency_lock:

+            contents = self._contents

+            iv_size = self._iv_size

+            mac_size = self._mac_size

+

+            if len(contents) < iv_size + 16 + mac_size:

+                msg = 'Invalid vault configuration file: file is truncated'

+                raise ValueError(msg)

-        self._message, self._message_tag = cut(self._contents, cutpos1)

-        self._iv, self._payload = cut(self._message, cutpos2)

+            cutpos1 = len(contents) - mac_size

+            cutpos2 = iv_size

+            message, message_tag = cut(contents, cutpos1)

+            iv, payload = cut(message, cutpos2)

+

+            self._message = message

+            self._message_tag = message_tag

+            self._iv = iv

+            self._payload = payload

         logger.debug(

             _msg.TranslatedString(

                 _msg.DebugMsgTemplate.VAULT_NATIVE_PARSE_BUFFER,

-                contents=_h(self._contents),

-                iv=_h(self._iv),

-                payload=_h(self._payload),

-                mac=_h(self._message_tag),

+                contents=_h(contents),

+                iv=_h(iv),

+                payload=_h(payload),

+                mac=_h(message_tag),

             ),

         )

@@ -318,6 +330,7 @@ class VaultNativeConfigParser(abc.ABC):

                 _msg.InfoMsgTemplate.VAULT_NATIVE_DERIVING_KEYS,

             ),

         )

+        with self._consistency_lock:

             self._generate_keys()

             assert len(self._encryption_key) == self._encryption_key_size, (

                 'Derived encryption key is invalid'

@@ -356,18 +369,20 @@ class VaultNativeConfigParser(abc.ABC):

                 _msg.InfoMsgTemplate.VAULT_NATIVE_CHECKING_MAC,

             ),

         )

+        with self._consistency_lock:

             mac = hmac.HMAC(self._signing_key, hashes.SHA256())

             mac_input = self._hmac_input()

+            mac_expected = self._message_tag

         logger.debug(

             _msg.TranslatedString(

                 _msg.DebugMsgTemplate.VAULT_NATIVE_CHECKING_MAC_DETAILS,

                 mac_input=_h(mac_input),

-                mac=_h(self._message_tag),

+                mac=_h(mac_expected),

             ),

         )

         mac.update(mac_input)

         try:

-            mac.verify(self._message_tag)

+            mac.verify(mac_expected)

         except crypt_exceptions.InvalidSignature:

             msg = 'File does not contain a valid signature'

             raise ValueError(msg) from None

@@ -399,9 +414,12 @@ class VaultNativeConfigParser(abc.ABC):

                 _msg.InfoMsgTemplate.VAULT_NATIVE_DECRYPTING_CONTENTS,

             ),

         )

+        with self._consistency_lock:

+            payload = self._payload

+            iv_size = self._iv_size

         decryptor = self._make_decryptor()

         padded_plaintext = bytearray()

-        padded_plaintext.extend(decryptor.update(self._payload))

+        padded_plaintext.extend(decryptor.update(payload))

         padded_plaintext.extend(decryptor.finalize())

         logger.debug(

             _msg.TranslatedString(

@@ -409,7 +427,7 @@ class VaultNativeConfigParser(abc.ABC):

                 contents=_h(padded_plaintext),

             ),

         )

-        unpadder = padding.PKCS7(self._iv_size * 8).unpadder()

+        unpadder = padding.PKCS7(iv_size * 8).unpadder()

         plaintext = bytearray()

         plaintext.extend(unpadder.update(padded_plaintext))

         plaintext.extend(unpadder.finalize())

@@ -480,8 +498,13 @@ class VaultNativeV03ConfigParser(VaultNativeConfigParser):

             moderately determined attackers!

         """

-        self._encryption_key = self._pbkdf2(self._password, self.KEY_SIZE, 100)

-        self._signing_key = self._pbkdf2(self._password, self.KEY_SIZE, 200)

+        with self._consistency_lock:

+            self._encryption_key = self._pbkdf2(

+                self._password, self.KEY_SIZE, 100

+            )

+            self._signing_key = self._pbkdf2(

+                self._password, self.KEY_SIZE, 200

+            )

             self._encryption_key_size = self._signing_key_size = self.KEY_SIZE

     def _hmac_input(self) -> bytes:

@@ -500,8 +523,11 @@ class VaultNativeV03ConfigParser(VaultNativeConfigParser):

         (MAC-verified) message payload.

         """

+        with self._consistency_lock:

+            encryption_key = self._encryption_key

+            iv = self._iv

         return ciphers.Cipher(

-            algorithms.AES256(self._encryption_key), modes.CBC(self._iv)

+            algorithms.AES256(encryption_key), modes.CBC(iv)

         ).decryptor()

@@ -545,14 +571,17 @@ class VaultNativeV02ConfigParser(VaultNativeConfigParser):

                 properly.

         """

+        with self._consistency_lock:

             super()._parse_contents()

-        self._payload = base64.standard_b64decode(self._payload)

-        self._message_tag = bytes.fromhex(self._message_tag.decode('ASCII'))

+            payload = self._payload = base64.standard_b64decode(self._payload)

+            message_tag = self._message_tag = bytes.fromhex(

+                self._message_tag.decode('ASCII')

+            )

         logger.debug(

             _msg.TranslatedString(

                 _msg.DebugMsgTemplate.VAULT_NATIVE_V02_PAYLOAD_MAC_POSTPROCESSING,

-                payload=_h(self._payload),

-                mac=_h(self._message_tag),

+                payload=_h(payload),

+                mac=_h(message_tag),

             ),

         )

@@ -580,6 +609,7 @@ class VaultNativeV02ConfigParser(VaultNativeConfigParser):

             access by even moderately determined attackers!

         """

+        with self._consistency_lock:

             self._encryption_key = self._pbkdf2(self._password, 8, 16)

             self._signing_key = self._pbkdf2(self._password, 16, 16)

             self._encryption_key_size = 8

@@ -713,6 +743,7 @@ class VaultNativeV02ConfigParser(VaultNativeConfigParser):

             determined attackers!

         """

+        with self._consistency_lock:

             data = base64.standard_b64encode(self._iv + self._encryption_key)

         encryption_key, iv = self._evp_bytestokey_md5_one_iteration_no_salt(

             data, key_size=32, iv_size=16

@@ -23,6 +23,7 @@ The main API is the [`Sequin`][] class, which is thoroughly documented.

 from __future__ import annotations

 import collections

+import threading

 from typing import TYPE_CHECKING

 from typing_extensions import assert_type

@@ -99,18 +100,19 @@ class Sequin:

         else:

             sequence = tuple(sequence)

         assert_type(sequence, tuple[int, ...])

-        self.bases: dict[int, collections.deque[int]] = {}

-

-        def gen() -> Iterator[int]:

+        consistency_lock = threading.RLock()

+        bitstream: collections.deque[int] = collections.deque()

         for num in sequence:

             if num not in range(2 if is_bitstring else 256):

                 raise ValueError(msg)

             if is_bitstring:

-                    yield num

+                bitstream.append(num)

             else:

-                    yield from uint8_to_bits(num)

+                bitstream.extend(uint8_to_bits(num))

-        self.bases[2] = collections.deque(gen())

+        with consistency_lock:

+            self.consistency_lock = consistency_lock

+            self.bases = {2: bitstream}

     def _all_or_nothing_shift(

         self, count: int, /, *, base: int = 2

@@ -126,6 +128,9 @@ class Sequin:

             consume them from the sequence and return them.  Otherwise,

             consume nothing, and return nothing.

+        Info: Thread-safety

+            This call is thread-safe.

+

         Notes:

             We currently remove now-empty sequences from the registry of

             sequences.

@@ -150,6 +155,7 @@ class Sequin:

             False

         """

+        with self.consistency_lock:

             try:

                 seq = self.bases[base]

             except KeyError:

@@ -181,6 +187,9 @@ class Sequin:

             ValueError: `base` is an invalid base.

             ValueError: Not all integers are valid base `base` digits.

+        Info: Thread-safety

+            This call is thread-safe.

+

         Examples:

             >>> Sequin._big_endian_number([1, 2, 3, 4, 5, 6, 7, 8], base=10)

             12345678

@@ -235,6 +244,9 @@ class Sequin:

             SequinExhaustedError:

                 The sequin is exhausted.

+        Info: Thread-safety

+            This call is thread-safe.

+

         Examples:

             >>> seq = Sequin(

             ...     [1, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1, 0, 0, 1],

@@ -268,6 +280,7 @@ class Sequin:

             SequinExhaustedError: Sequin is exhausted

         """

+        with self.consistency_lock:

             if 2 not in self.bases:  # noqa: PLR2004

                 raise SequinExhaustedError

             value = self._generate_inner(n, base=2)

@@ -304,6 +317,9 @@ class Sequin:

             ValueError:

                 The range is empty.

+        Warning: Thread-safety

+            This call is **not thread-safe**.

+

         Examples:

             >>> seq = Sequin(

             ...     [1, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1, 0, 0, 1],

@@ -379,7 +395,11 @@ class Sequin:

         Sets up the base `base` sequence if it does not yet exist.

+        Info: Thread-safety

+            This call is thread-safe.

+

         """

+        with self.consistency_lock:

             if base not in self.bases:

                 self.bases[base] = collections.deque()

             self.bases[base].append(value)