9. windows.crypto – CryptoAPI

The windows.crypto module offers some wrappers arround the CryptoAPI.

The main goal of this module (for now) is providing simple encryption/decryption methods.

9.1. Encryption

Note

See sample Encryption demo

9.1.1. encrypt

windows.crypto.encrypt(cert_or_certlist, msg, algo=szOID_RSA_DES_EDE3_CBC('1.2.840.113549.3.7'), initvector=GenerateInitVector())

Encrypt msg with the certificate(s) in cert_or_certlist using algo with the initial vector initvector.

If geninitvector is left as it is, it will generate a random one.

Algorithms supported by GenerateInitVector are:

• szOID_OIWSEC_desCBC
• szOID_RSA_DES_EDE3_CBC
• szOID_NIST_AES128_CBC
• szOID_NIST_AES192_CBC
• szOID_NIST_AES256_CBC

Returns:bytearray: The encrypted message

9.1.2. decrypt

windows.crypto.decrypt(cert_store, encrypted)

Try to decrypt the encrypted msg with any certificate in cert_store.

If there is no certificate able to decrypt the message Kernel32Error(winerror=0x8009200c) is raised.

Returns:str: The decrypted message

9.1.3. import_pfx

windows.crypto.import_pfx(pfx, password=None, flags=36864L)

Import the file pfx with the password.

default flags = PKCS12_NO_PERSIST_KEY | CRYPT_USER_KEYSET.

PKCS12_NO_PERSIST_KEY tells CryptoAPI to NOT save the keys in a on-disk container.

Returns:EHCERTSTORE

9.2. Certificate

Note

See sample Certificate demo

9.2.1. CertificateContext

class windows.crypto.CertificateContext

Represent a Certificate.

note: It is a pointer ctypes structure (PCCERT_CONTEXT)

chains

The list of chain context available for this certificate. Each elements of this list is a list of CertificateContext that should go from the self certificate to a trusted certificate.

Type:[[CertificateContext]] – A list of chain (list) of CertificateContext

contents

the object this pointer points to (read-write)

duplicate()

Duplicate the certificate by incrementing the internal refcount. (see CertDuplicateCertificateContext)

note: The object returned is self

Returns:CertificateContext

encoded

The encoded certificate.

Type:bytearray

classmethod from_buffer(data)

Create a CertificateContext from the buffer data

Returns:CertificateContext

classmethod from_file(filename)

Create a CertificateContext from the file filename

Returns:CertificateContext

get_name(nametype=CERT_NAME_SIMPLE_DISPLAY_TYPE(0x4L), flags=0)

Retrieve the subject or issuer name of the certificate. See CertGetNameStringA

Returns:str

issuer

The name of the certificate’s issuer.

Type:str

name

The name of the certificate.

Type:str

raw_serial

The raw serial number of the certificate.

Type:[int]: A list of int 0 <= x <= 255

serial

The string representation of the certificate’s serial.

Type:str

store

The certificate store that contains the certificate

Type:EHCERTSTORE

9.2.2. EHCERTSTORE

class windows.crypto.EHCERTSTORE

A certificate store

add_certificate(certificate)

Add a certificate to the store

certs

The certificates in the store

Type:[CertificateContext] – A list of Certificate

classmethod from_file(filename)

Create a new EHCERTSTORE from filename

classmethod from_system_store(store_name)

Create a new EHCERTSTORE from system store``store_name`` (see https://msdn.microsoft.com/en-us/library/windows/desktop/aa388136(v=vs.85).aspx)

classmethod new_in_memory()

Create a new temporary EHCERTSTORE in memory

value

current value

9.2.3. CryptObject

class windows.crypto.CryptObject(filename, content_type=CERT_QUERY_CONTENT_FLAG_ALL(0x3ffeL))

Extract information from an CryptoAPI object.

Current main use is extracting the signers certificates from a PE file.

Warning

The methods and property of this class will problably change as I haven’t yet had the time to try it out in real cases.

cert

Return embded certificate number index.

note: not all embded certificate are directly used to sign the CryptObject.

Returns:CertificateContext

get_cert(index=0)

Return embded certificate number index.

note: not all embded certificate are directly used to sign the CryptObject.

Returns:CertificateContext

get_signer_certificate(index=0)

Return the certificate used for signer nb index

Returns:CertificateContext

get_signer_data(index=0)

Returns the signer informations for signer nb index

Returns:CMSG_SIGNER_INFO

nb_cert

The number of certificate embded in the CryptObject

Type:int

nb_signer

The number of signers for the CryptObject

Type:int

9.2.4. CryptContext

class windows.crypto.CryptContext(pszContainer=None, pszProvider=None, dwProvType=0, dwFlags=0, retrycreate=False)

A context manager arround CryptAcquireContextW & CryptReleaseContext

contents

the object this pointer points to (read-write)

9.3. Generating componants

This module is used to generate selfsigned-certificates / keypair and pfx file.

Note

See genkeys() in the sample Encryption demo

9.3.1. generate_selfsigned_certificate

windows.crypto.generation.generate_selfsigned_certificate(name='CN=DEFAULT', prov=None, key_info=None, flags=0, signature_algo=None)

Generate a selfsigned certificate.

See https://msdn.microsoft.com/en-us/library/windows/desktop/aa376039(v=vs.85).aspx

Returns:windows.crypto.CertificateContext

9.3.2. generate_key

windows.crypto.generation.generate_key(prov, keytype=AT_KEYEXCHANGE(0x1L), flags=CRYPT_EXPORTABLE(0x1L))

Generate a keypair if type keytype.

Returns:HCRYPTKEY

9.3.3. generate_pfx

windows.crypto.generation.generate_pfx(hstore, password=None)

Generate a pfx protected by password contaning the certificates in hstore

Returns:bytearray – The raw PFX