Helper method to base64url_decode a string. Args: input (bytes): A base64url_encoded string (bytes) to decode.

Encrypt the plain text and generate an auth tag if appropriate Args: plain_text (bytes): Data to encrypt aad

Decrypt the cipher text and validate the auth tag if present Args: cipher_text (bytes): Cipher text to decrypt

Helper method to base64url_encode a string. Args: input (bytes): A base64url_encoded string (bytes) to encode.

Coerce **s** to bytes.

Unwrap the the wrapped key data Args: wrapped_key (bytes): Wrapped key data to unwrap Returns: byte

Wrap the the plain text key data Args: key_data (bytes): Key data to wrap Returns: bytes: Wrapped k

Determine the correct serialization length for an encoded signature component. This is the number of bytes required to encode the maximum key

Verifies a JWS string's signature. Args: token (str): A signed JWS to be verified. key (str or dict): A key to attempt to verify

Get ann auth tag from the provided data Args: ciphertext (bytes): Encrypted value iv (bytes): Initialization vector

Convert signature from DER encoding to RAW encoding.

Get the raw key bytes from a Key object Args: key (Key): Key from which to extract the raw key bytes Returns: (bytes) ke

Get the random cek bytes based on the encryption algorithm Args: enc (str): Encryption algorithm Returns: (bytes) rando

Deserialize and verify the header and segments are appropriate. Args: jwe_bytes (bytes): The compact serialized JWE Returns:

Convert signature from RAW encoding to DER encoding.

Helper method for calculating an access token hash, as described in http://openid.net/specs/openid-connect-core-1_0.html#CodeIDToken Its valu

Compress the plaintext based on the algorithm supplied Args: zip (str): Compression Algorithm plaintext (bytes): plaintext t

Decompress the plaintext based on the algorithm supplied Args: zip (str): Compression Algorithm plaintext (bytes): plaintext

Decrypt and verify the data Args: cek_bytes (bytes): cek to derive encryption and possible auth key to verify the auth t

Generate an appropriate JOSE header based on the values provided Args: alg (str): Key wrap/negotiation algorithm enc (str): E

Generate a content encryption key (cek) and initialization vector (iv) based on enc and alg, compress the plaintext based on zip, encrypt

Calculate the Greatest Common Divisor of a and b. Unless b==0, the result will have the same sign as b (so that when b is divided by it, the

Get the content encryption key Args: enc (str): Encryption algorithm alg (str): kwy wrap/negotiation algorithm key (

Get the cek and wrapped cek from the encryption key direct Args: key (Key): Key provided to encryption method Return: (

Get an HMACKey for the provided encryption algorithm and key bytes Args: enc (str): Encryption algorithm mac_key_bytes (byte

_get_rsa_key_wrap_cek Get the content encryption key for RSA key wrap Args: enc (str): Encryption algorithm key (Key): Key pr

Generate a compact serialized JWE Args: encoded_header (bytes): Base64 URL Encoded JWE header JSON encrypted_cek (bytes): En

Legacy RSA private key PKCS8-to-PKCS1 conversion. .. warning:: This is incorrect parsing and only works because the legacy PKCS1-to-PKCS

Compute factors p and q from the private exponent d. We assume that n has no more than two factors. This function is adapted from code in PyC

Validates that the 'at_hash' is valid. Its value is the base64url encoding of the left-most half of the hash of the octets of the ASCII

Validates that the 'aud' claim is valid. The "aud" (audience) claim identifies the recipients that the JWT is intended for. Each principal i

Validates that the 'exp' claim is valid. The "exp" (expiration time) claim identifies the expiration time on or after which the JWT MUST NOT

Validates that the 'iat' claim is valid. The "iat" (issued at) claim identifies the time at which the JWT was issued. This claim can be used

Validates that the 'iss' claim is valid. The "iss" (issuer) claim identifies the principal that issued the JWT. The processing of this claim

Validates that the 'jti' claim is valid. The "jti" (JWT ID) claim provides a unique identifier for the JWT. The identifier value MUST be assi

Validates that the 'nbf' claim is valid. The "nbf" (not before) claim identifies the time before which the JWT MUST NOT be accepted for proce

Validates that the 'sub' claim is valid. The "sub" (subject) claim identifies the principal that is the subject of the JWT. The claims in a

Returns the decoded headers without verification of any kind. Args: token (str): A signed JWT to decode the headers from. Returns:

Returns the decoded headers without verification of any kind. Args: token (str): A signed JWS to decode the headers from. Returns:

Convert a PKCS1-encoded RSA private key to PKCS8.

Convert a PKCS8-encoded RSA private key to PKCS1.

Convert a PKCS1-encoded RSA private key to PKCS8.

Helper method to determine the total number of seconds from a timedelta. Args: delta (timedelta): A timedelta to convert to seconds.