opcua.crypto package

Submodules

opcua.crypto.security_policies module

class opcua.crypto.security_policies.Cryptography(mode=<MessageSecurityMode.Sign: 2>)[source]

Bases: opcua.ua.uaprotocol_hand.CryptographyNone

Security policy: Sign or SignAndEncrypt

decrypt(data)[source]
encrypt(data)[source]
encrypted_block_size()[source]

Size of encrypted text block for block cipher.

min_padding_size()[source]
padding(size)[source]

Create padding for a block of given size. plain_size = size + len(padding) + signature_size() plain_size = N * plain_block_size()

plain_block_size()[source]

Size of plain text block for block cipher.

remove_padding(data)[source]
signature(data)[source]
signature_size()[source]
verify(data, sig)[source]

Verify signature and raise exception if signature is invalid

vsignature_size()[source]
class opcua.crypto.security_policies.Decryptor[source]

Bases: object

Abstract base class for decryption algorithm

decrypt(data)[source]
encrypted_block_size()[source]
plain_block_size()[source]
class opcua.crypto.security_policies.DecryptorAesCbc(key, init_vec)[source]

Bases: opcua.crypto.security_policies.Decryptor

decrypt(data)[source]
encrypted_block_size()[source]
plain_block_size()[source]
class opcua.crypto.security_policies.DecryptorRsa(client_pk, dec_fn, padding_size)[source]

Bases: opcua.crypto.security_policies.Decryptor

decrypt(data)[source]
encrypted_block_size()[source]
plain_block_size()[source]
class opcua.crypto.security_policies.Encryptor[source]

Bases: object

Abstract base class for encryption algorithm

encrypt(data)[source]
encrypted_block_size()[source]
plain_block_size()[source]
class opcua.crypto.security_policies.EncryptorAesCbc(key, init_vec)[source]

Bases: opcua.crypto.security_policies.Encryptor

encrypt(data)[source]
encrypted_block_size()[source]
plain_block_size()[source]
class opcua.crypto.security_policies.EncryptorRsa(server_cert, enc_fn, padding_size)[source]

Bases: opcua.crypto.security_policies.Encryptor

encrypt(data)[source]
encrypted_block_size()[source]
plain_block_size()[source]
class opcua.crypto.security_policies.SecurityPolicyBasic128Rsa15(server_cert, client_cert, client_pk, mode)[source]

Bases: opcua.ua.uaprotocol_hand.SecurityPolicy

DEPRECATED, do not use anymore!

Security Basic 128Rsa15 A suite of algorithms that uses RSA15 as Key-Wrap-algorithm and 128-Bit (16 bytes) for encryption algorithms. - SymmetricSignatureAlgorithm - HmacSha1

If a certificate or any certificate in the chain is not signed with a hash that is Sha1 or stronger then the certificate shall be rejected.

AsymmetricEncryptionURI = 'http://www.w3.org/2001/04/xmlenc#rsa-1_5'
AsymmetricSignatureURI = 'http://www.w3.org/2000/09/xmldsig#rsa-sha1'
URI = 'http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15'
static encrypt_asymmetric(pubkey, data)[source]
make_local_symmetric_key(secret, seed)[source]
make_remote_symmetric_key(secret, seed)[source]
signature_key_size = 16
symmetric_key_size = 16
class opcua.crypto.security_policies.SecurityPolicyBasic256(server_cert, client_cert, client_pk, mode)[source]

Bases: opcua.ua.uaprotocol_hand.SecurityPolicy

DEPRECATED, do not use anymore!

Security Basic 256 A suite of algorithms that are for 256-Bit (32 bytes) encryption, algorithms include: - SymmetricSignatureAlgorithm - HmacSha1

If a certificate or any certificate in the chain is not signed with a hash that is Sha1 or stronger then the certificate shall be rejected.

AsymmetricEncryptionURI = 'http://www.w3.org/2001/04/xmlenc#rsa-oaep'
AsymmetricSignatureURI = 'http://www.w3.org/2000/09/xmldsig#rsa-sha1'
URI = 'http://opcfoundation.org/UA/SecurityPolicy#Basic256'
static encrypt_asymmetric(pubkey, data)[source]
make_local_symmetric_key(secret, seed)[source]
make_remote_symmetric_key(secret, seed)[source]
signature_key_size = 24
symmetric_key_size = 32
class opcua.crypto.security_policies.SecurityPolicyBasic256Sha256(server_cert, client_cert, client_pk, mode)[source]

Bases: opcua.ua.uaprotocol_hand.SecurityPolicy

Security Basic 256Sha256 A suite of algorithms that uses Sha256 as Key-Wrap-algorithm and 256-Bit (32 bytes) for encryption algorithms.

AsymmetricEncryptionURI = 'http://www.w3.org/2001/04/xmlenc#rsa-oaep'
AsymmetricSignatureURI = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256'
URI = 'http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256'
static encrypt_asymmetric(pubkey, data)[source]
make_local_symmetric_key(secret, seed)[source]
make_remote_symmetric_key(secret, seed)[source]
signature_key_size = 32
symmetric_key_size = 32
class opcua.crypto.security_policies.Signer[source]

Bases: object

Abstract base class for cryptographic signature algorithm

signature(data)[source]
signature_size()[source]
class opcua.crypto.security_policies.SignerAesCbc(key)[source]

Bases: opcua.crypto.security_policies.Signer

signature(data)[source]
signature_size()[source]
class opcua.crypto.security_policies.SignerHMac256(key)[source]

Bases: opcua.crypto.security_policies.Signer

signature(data)[source]
signature_size()[source]
class opcua.crypto.security_policies.SignerRsa(client_pk)[source]

Bases: opcua.crypto.security_policies.Signer

signature(data)[source]
signature_size()[source]
class opcua.crypto.security_policies.SignerSha256(client_pk)[source]

Bases: opcua.crypto.security_policies.Signer

signature(data)[source]
signature_size()[source]
class opcua.crypto.security_policies.Verifier[source]

Bases: object

Abstract base class for cryptographic signature verification

signature_size()[source]
verify(data, signature)[source]
class opcua.crypto.security_policies.VerifierAesCbc(key)[source]

Bases: opcua.crypto.security_policies.Verifier

signature_size()[source]
verify(data, signature)[source]
class opcua.crypto.security_policies.VerifierHMac256(key)[source]

Bases: opcua.crypto.security_policies.Verifier

signature_size()[source]
verify(data, signature)[source]
class opcua.crypto.security_policies.VerifierRsa(server_cert)[source]

Bases: opcua.crypto.security_policies.Verifier

signature_size()[source]
verify(data, signature)[source]
class opcua.crypto.security_policies.VerifierSha256(server_cert)[source]

Bases: opcua.crypto.security_policies.Verifier

signature_size()[source]
verify(data, signature)[source]
opcua.crypto.security_policies.encrypt_asymmetric(pubkey, data, policy_uri)[source]

Encrypt data with pubkey using an asymmetric algorithm. The algorithm is selected by policy_uri. Returns a tuple (encrypted_data, algorithm_uri)

opcua.crypto.security_policies.require_cryptography(obj)[source]

Raise exception if cryptography module is not available. Call this function in constructors.

opcua.crypto.uacrypto module

opcua.crypto.uacrypto.cipher_aes_cbc(key, init_vec)[source]
opcua.crypto.uacrypto.cipher_decrypt(cipher, data)[source]
opcua.crypto.uacrypto.cipher_encrypt(cipher, data)[source]
opcua.crypto.uacrypto.decrypt_rsa15(private_key, data)[source]
opcua.crypto.uacrypto.decrypt_rsa_oaep(private_key, data)[source]
opcua.crypto.uacrypto.der_from_x509(certificate)[source]
opcua.crypto.uacrypto.encrypt_basic256(public_key, data)[source]
opcua.crypto.uacrypto.encrypt_rsa15(public_key, data)[source]
opcua.crypto.uacrypto.encrypt_rsa_oaep(public_key, data)[source]
opcua.crypto.uacrypto.hmac_sha1(key, message)[source]
opcua.crypto.uacrypto.hmac_sha256(key, message)[source]
opcua.crypto.uacrypto.load_certificate(path)[source]
opcua.crypto.uacrypto.load_private_key(path)[source]
opcua.crypto.uacrypto.p_sha1(secret, seed, sizes=())[source]

Derive one or more keys from secret and seed. (See specs part 6, 6.7.5 and RFC 2246 - TLS v1.0) Lengths of keys will match sizes argument

opcua.crypto.uacrypto.p_sha256(secret, seed, sizes=())[source]

Derive one or more keys from secret and seed. (See specs part 6, 6.7.5 and RFC 2246 - TLS v1.0) Lengths of keys will match sizes argument

opcua.crypto.uacrypto.sha1_size()[source]
opcua.crypto.uacrypto.sha256_size()[source]
opcua.crypto.uacrypto.sign_sha1(private_key, data)[source]
opcua.crypto.uacrypto.sign_sha256(private_key, data)[source]
opcua.crypto.uacrypto.verify_sha1(certificate, data, signature)[source]
opcua.crypto.uacrypto.verify_sha256(certificate, data, signature)[source]
opcua.crypto.uacrypto.x509_from_der(data)[source]
opcua.crypto.uacrypto.x509_name_to_string(name)[source]
opcua.crypto.uacrypto.x509_to_string(cert)[source]

Convert x509 certificate to human-readable string

Module contents