We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Remove `return True` in OpenSSL ecdsa verify implementation
https://github.com/pyca/cryptography/blob/master/src/cryptography/hazmat/backends/openssl/ec.py#L89

This isn't part of our documented API

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `src/cryptography/hazmat/backends/openssl/ec.py`
Content:
```
1 # This file is dual licensed under the terms of the Apache License, Version
2 # 2.0, and the BSD License. See the LICENSE file in the root of this repository
3 # for complete details.
4 
5 from __future__ import absolute_import, division, print_function
6 
7 from cryptography import utils
8 from cryptography.exceptions import (
9     InvalidSignature, UnsupportedAlgorithm, _Reasons
10 )
11 from cryptography.hazmat.backends.openssl.utils import (
12     _calculate_digest_and_algorithm
13 )
14 from cryptography.hazmat.primitives import hashes, serialization
15 from cryptography.hazmat.primitives.asymmetric import (
16     AsymmetricSignatureContext, AsymmetricVerificationContext, ec
17 )
18 
19 
20 def _check_signature_algorithm(signature_algorithm):
21     if not isinstance(signature_algorithm, ec.ECDSA):
22         raise UnsupportedAlgorithm(
23             "Unsupported elliptic curve signature algorithm.",
24             _Reasons.UNSUPPORTED_PUBLIC_KEY_ALGORITHM)
25 
26 
27 def _ec_key_curve_sn(backend, ec_key):
28     group = backend._lib.EC_KEY_get0_group(ec_key)
29     backend.openssl_assert(group != backend._ffi.NULL)
30 
31     nid = backend._lib.EC_GROUP_get_curve_name(group)
32     # The following check is to find EC keys with unnamed curves and raise
33     # an error for now.
34     if nid == backend._lib.NID_undef:
35         raise NotImplementedError(
36             "ECDSA certificates with unnamed curves are unsupported "
37             "at this time"
38         )
39 
40     curve_name = backend._lib.OBJ_nid2sn(nid)
41     backend.openssl_assert(curve_name != backend._ffi.NULL)
42 
43     sn = backend._ffi.string(curve_name).decode('ascii')
44     return sn
45 
46 
47 def _mark_asn1_named_ec_curve(backend, ec_cdata):
48     """
49     Set the named curve flag on the EC_KEY. This causes OpenSSL to
50     serialize EC keys along with their curve OID which makes
51     deserialization easier.
52     """
53 
54     backend._lib.EC_KEY_set_asn1_flag(
55         ec_cdata, backend._lib.OPENSSL_EC_NAMED_CURVE
56     )
57 
58 
59 def _sn_to_elliptic_curve(backend, sn):
60     try:
61         return ec._CURVE_TYPES[sn]()
62     except KeyError:
63         raise UnsupportedAlgorithm(
64             "{0} is not a supported elliptic curve".format(sn),
65             _Reasons.UNSUPPORTED_ELLIPTIC_CURVE
66         )
67 
68 
69 def _ecdsa_sig_sign(backend, private_key, data):
70     max_size = backend._lib.ECDSA_size(private_key._ec_key)
71     backend.openssl_assert(max_size > 0)
72 
73     sigbuf = backend._ffi.new("unsigned char[]", max_size)
74     siglen_ptr = backend._ffi.new("unsigned int[]", 1)
75     res = backend._lib.ECDSA_sign(
76         0, data, len(data), sigbuf, siglen_ptr, private_key._ec_key
77     )
78     backend.openssl_assert(res == 1)
79     return backend._ffi.buffer(sigbuf)[:siglen_ptr[0]]
80 
81 
82 def _ecdsa_sig_verify(backend, public_key, signature, data):
83     res = backend._lib.ECDSA_verify(
84         0, data, len(data), signature, len(signature), public_key._ec_key
85     )
86     if res != 1:
87         backend._consume_errors()
88         raise InvalidSignature
89     return True
90 
91 
92 @utils.register_interface(AsymmetricSignatureContext)
93 class _ECDSASignatureContext(object):
94     def __init__(self, backend, private_key, algorithm):
95         self._backend = backend
96         self._private_key = private_key
97         self._digest = hashes.Hash(algorithm, backend)
98 
99     def update(self, data):
100         self._digest.update(data)
101 
102     def finalize(self):
103         digest = self._digest.finalize()
104 
105         return _ecdsa_sig_sign(self._backend, self._private_key, digest)
106 
107 
108 @utils.register_interface(AsymmetricVerificationContext)
109 class _ECDSAVerificationContext(object):
110     def __init__(self, backend, public_key, signature, algorithm):
111         self._backend = backend
112         self._public_key = public_key
113         self._signature = signature
114         self._digest = hashes.Hash(algorithm, backend)
115 
116     def update(self, data):
117         self._digest.update(data)
118 
119     def verify(self):
120         digest = self._digest.finalize()
121         return _ecdsa_sig_verify(
122             self._backend, self._public_key, self._signature, digest
123         )
124 
125 
126 @utils.register_interface(ec.EllipticCurvePrivateKeyWithSerialization)
127 class _EllipticCurvePrivateKey(object):
128     def __init__(self, backend, ec_key_cdata, evp_pkey):
129         self._backend = backend
130         _mark_asn1_named_ec_curve(backend, ec_key_cdata)
131         self._ec_key = ec_key_cdata
132         self._evp_pkey = evp_pkey
133 
134         sn = _ec_key_curve_sn(backend, ec_key_cdata)
135         self._curve = _sn_to_elliptic_curve(backend, sn)
136 
137     curve = utils.read_only_property("_curve")
138 
139     def signer(self, signature_algorithm):
140         _check_signature_algorithm(signature_algorithm)
141         return _ECDSASignatureContext(
142             self._backend, self, signature_algorithm.algorithm
143         )
144 
145     def exchange(self, algorithm, peer_public_key):
146         if not (
147             self._backend.elliptic_curve_exchange_algorithm_supported(
148                 algorithm, self.curve
149             )
150         ):
151             raise UnsupportedAlgorithm(
152                 "This backend does not support the ECDH algorithm.",
153                 _Reasons.UNSUPPORTED_EXCHANGE_ALGORITHM
154             )
155 
156         if peer_public_key.curve.name != self.curve.name:
157             raise ValueError(
158                 "peer_public_key and self are not on the same curve"
159             )
160 
161         group = self._backend._lib.EC_KEY_get0_group(self._ec_key)
162         z_len = (self._backend._lib.EC_GROUP_get_degree(group) + 7) // 8
163         self._backend.openssl_assert(z_len > 0)
164         z_buf = self._backend._ffi.new("uint8_t[]", z_len)
165         peer_key = self._backend._lib.EC_KEY_get0_public_key(
166             peer_public_key._ec_key
167         )
168 
169         r = self._backend._lib.ECDH_compute_key(
170             z_buf, z_len, peer_key, self._ec_key, self._backend._ffi.NULL
171         )
172         self._backend.openssl_assert(r > 0)
173         return self._backend._ffi.buffer(z_buf)[:z_len]
174 
175     def public_key(self):
176         group = self._backend._lib.EC_KEY_get0_group(self._ec_key)
177         self._backend.openssl_assert(group != self._backend._ffi.NULL)
178 
179         curve_nid = self._backend._lib.EC_GROUP_get_curve_name(group)
180 
181         public_ec_key = self._backend._lib.EC_KEY_new_by_curve_name(curve_nid)
182         self._backend.openssl_assert(public_ec_key != self._backend._ffi.NULL)
183         public_ec_key = self._backend._ffi.gc(
184             public_ec_key, self._backend._lib.EC_KEY_free
185         )
186 
187         point = self._backend._lib.EC_KEY_get0_public_key(self._ec_key)
188         self._backend.openssl_assert(point != self._backend._ffi.NULL)
189 
190         res = self._backend._lib.EC_KEY_set_public_key(public_ec_key, point)
191         self._backend.openssl_assert(res == 1)
192 
193         evp_pkey = self._backend._ec_cdata_to_evp_pkey(public_ec_key)
194 
195         return _EllipticCurvePublicKey(self._backend, public_ec_key, evp_pkey)
196 
197     def private_numbers(self):
198         bn = self._backend._lib.EC_KEY_get0_private_key(self._ec_key)
199         private_value = self._backend._bn_to_int(bn)
200         return ec.EllipticCurvePrivateNumbers(
201             private_value=private_value,
202             public_numbers=self.public_key().public_numbers()
203         )
204 
205     def private_bytes(self, encoding, format, encryption_algorithm):
206         return self._backend._private_key_bytes(
207             encoding,
208             format,
209             encryption_algorithm,
210             self._evp_pkey,
211             self._ec_key
212         )
213 
214     def sign(self, data, signature_algorithm):
215         _check_signature_algorithm(signature_algorithm)
216         data, algorithm = _calculate_digest_and_algorithm(
217             self._backend, data, signature_algorithm._algorithm
218         )
219         return _ecdsa_sig_sign(self._backend, self, data)
220 
221 
222 @utils.register_interface(ec.EllipticCurvePublicKeyWithSerialization)
223 class _EllipticCurvePublicKey(object):
224     def __init__(self, backend, ec_key_cdata, evp_pkey):
225         self._backend = backend
226         _mark_asn1_named_ec_curve(backend, ec_key_cdata)
227         self._ec_key = ec_key_cdata
228         self._evp_pkey = evp_pkey
229 
230         sn = _ec_key_curve_sn(backend, ec_key_cdata)
231         self._curve = _sn_to_elliptic_curve(backend, sn)
232 
233     curve = utils.read_only_property("_curve")
234 
235     def verifier(self, signature, signature_algorithm):
236         if not isinstance(signature, bytes):
237             raise TypeError("signature must be bytes.")
238 
239         _check_signature_algorithm(signature_algorithm)
240         return _ECDSAVerificationContext(
241             self._backend, self, signature, signature_algorithm.algorithm
242         )
243 
244     def public_numbers(self):
245         get_func, group = (
246             self._backend._ec_key_determine_group_get_func(self._ec_key)
247         )
248         point = self._backend._lib.EC_KEY_get0_public_key(self._ec_key)
249         self._backend.openssl_assert(point != self._backend._ffi.NULL)
250 
251         with self._backend._tmp_bn_ctx() as bn_ctx:
252             bn_x = self._backend._lib.BN_CTX_get(bn_ctx)
253             bn_y = self._backend._lib.BN_CTX_get(bn_ctx)
254 
255             res = get_func(group, point, bn_x, bn_y, bn_ctx)
256             self._backend.openssl_assert(res == 1)
257 
258             x = self._backend._bn_to_int(bn_x)
259             y = self._backend._bn_to_int(bn_y)
260 
261         return ec.EllipticCurvePublicNumbers(
262             x=x,
263             y=y,
264             curve=self._curve
265         )
266 
267     def public_bytes(self, encoding, format):
268         if format is serialization.PublicFormat.PKCS1:
269             raise ValueError(
270                 "EC public keys do not support PKCS1 serialization"
271             )
272 
273         return self._backend._public_key_bytes(
274             encoding,
275             format,
276             self,
277             self._evp_pkey,
278             None
279         )
280 
281     def verify(self, signature, data, signature_algorithm):
282         _check_signature_algorithm(signature_algorithm)
283         data, algorithm = _calculate_digest_and_algorithm(
284             self._backend, data, signature_algorithm._algorithm
285         )
286         return _ecdsa_sig_verify(self._backend, self, signature, data)
287
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/src/cryptography/hazmat/backends/openssl/ec.py b/src/cryptography/hazmat/backends/openssl/ec.py
--- a/src/cryptography/hazmat/backends/openssl/ec.py
+++ b/src/cryptography/hazmat/backends/openssl/ec.py
@@ -86,7 +86,6 @@
     if res != 1:
         backend._consume_errors()
         raise InvalidSignature
-    return True
 
 
 @utils.register_interface(AsymmetricSignatureContext)
@@ -118,7 +117,7 @@
 
     def verify(self):
         digest = self._digest.finalize()
-        return _ecdsa_sig_verify(
+        _ecdsa_sig_verify(
             self._backend, self._public_key, self._signature, digest
         )
 
@@ -283,4 +282,4 @@
         data, algorithm = _calculate_digest_and_algorithm(
             self._backend, data, signature_algorithm._algorithm
         )
-        return _ecdsa_sig_verify(self._backend, self, signature, data)
+        _ecdsa_sig_verify(self._backend, self, signature, data)

{"golden_diff": "diff --git a/src/cryptography/hazmat/backends/openssl/ec.py b/src/cryptography/hazmat/backends/openssl/ec.py\n--- a/src/cryptography/hazmat/backends/openssl/ec.py\n+++ b/src/cryptography/hazmat/backends/openssl/ec.py\n@@ -86,7 +86,6 @@\n     if res != 1:\n         backend._consume_errors()\n         raise InvalidSignature\n-    return True\n \n \n @utils.register_interface(AsymmetricSignatureContext)\n@@ -118,7 +117,7 @@\n \n     def verify(self):\n         digest = self._digest.finalize()\n-        return _ecdsa_sig_verify(\n+        _ecdsa_sig_verify(\n             self._backend, self._public_key, self._signature, digest\n         )\n \n@@ -283,4 +282,4 @@\n         data, algorithm = _calculate_digest_and_algorithm(\n             self._backend, data, signature_algorithm._algorithm\n         )\n-        return _ecdsa_sig_verify(self._backend, self, signature, data)\n+        _ecdsa_sig_verify(self._backend, self, signature, data)\n", "issue": "Remove `return True` in OpenSSL ecdsa verify implementation\nhttps://github.com/pyca/cryptography/blob/master/src/cryptography/hazmat/backends/openssl/ec.py#L89\r\n\r\nThis isn't part of our documented API\n", "before_files": [{"content": "# This file is dual licensed under the terms of the Apache License, Version\n# 2.0, and the BSD License. See the LICENSE file in the root of this repository\n# for complete details.\n\nfrom __future__ import absolute_import, division, print_function\n\nfrom cryptography import utils\nfrom cryptography.exceptions import (\n    InvalidSignature, UnsupportedAlgorithm, _Reasons\n)\nfrom cryptography.hazmat.backends.openssl.utils import (\n    _calculate_digest_and_algorithm\n)\nfrom cryptography.hazmat.primitives import hashes, serialization\nfrom cryptography.hazmat.primitives.asymmetric import (\n    AsymmetricSignatureContext, AsymmetricVerificationContext, ec\n)\n\n\ndef _check_signature_algorithm(signature_algorithm):\n    if not isinstance(signature_algorithm, ec.ECDSA):\n        raise UnsupportedAlgorithm(\n            \"Unsupported elliptic curve signature algorithm.\",\n            _Reasons.UNSUPPORTED_PUBLIC_KEY_ALGORITHM)\n\n\ndef _ec_key_curve_sn(backend, ec_key):\n    group = backend._lib.EC_KEY_get0_group(ec_key)\n    backend.openssl_assert(group != backend._ffi.NULL)\n\n    nid = backend._lib.EC_GROUP_get_curve_name(group)\n    # The following check is to find EC keys with unnamed curves and raise\n    # an error for now.\n    if nid == backend._lib.NID_undef:\n        raise NotImplementedError(\n            \"ECDSA certificates with unnamed curves are unsupported \"\n            \"at this time\"\n        )\n\n    curve_name = backend._lib.OBJ_nid2sn(nid)\n    backend.openssl_assert(curve_name != backend._ffi.NULL)\n\n    sn = backend._ffi.string(curve_name).decode('ascii')\n    return sn\n\n\ndef _mark_asn1_named_ec_curve(backend, ec_cdata):\n    \"\"\"\n    Set the named curve flag on the EC_KEY. This causes OpenSSL to\n    serialize EC keys along with their curve OID which makes\n    deserialization easier.\n    \"\"\"\n\n    backend._lib.EC_KEY_set_asn1_flag(\n        ec_cdata, backend._lib.OPENSSL_EC_NAMED_CURVE\n    )\n\n\ndef _sn_to_elliptic_curve(backend, sn):\n    try:\n        return ec._CURVE_TYPES[sn]()\n    except KeyError:\n        raise UnsupportedAlgorithm(\n            \"{0} is not a supported elliptic curve\".format(sn),\n            _Reasons.UNSUPPORTED_ELLIPTIC_CURVE\n        )\n\n\ndef _ecdsa_sig_sign(backend, private_key, data):\n    max_size = backend._lib.ECDSA_size(private_key._ec_key)\n    backend.openssl_assert(max_size > 0)\n\n    sigbuf = backend._ffi.new(\"unsigned char[]\", max_size)\n    siglen_ptr = backend._ffi.new(\"unsigned int[]\", 1)\n    res = backend._lib.ECDSA_sign(\n        0, data, len(data), sigbuf, siglen_ptr, private_key._ec_key\n    )\n    backend.openssl_assert(res == 1)\n    return backend._ffi.buffer(sigbuf)[:siglen_ptr[0]]\n\n\ndef _ecdsa_sig_verify(backend, public_key, signature, data):\n    res = backend._lib.ECDSA_verify(\n        0, data, len(data), signature, len(signature), public_key._ec_key\n    )\n    if res != 1:\n        backend._consume_errors()\n        raise InvalidSignature\n    return True\n\n\n@utils.register_interface(AsymmetricSignatureContext)\nclass _ECDSASignatureContext(object):\n    def __init__(self, backend, private_key, algorithm):\n        self._backend = backend\n        self._private_key = private_key\n        self._digest = hashes.Hash(algorithm, backend)\n\n    def update(self, data):\n        self._digest.update(data)\n\n    def finalize(self):\n        digest = self._digest.finalize()\n\n        return _ecdsa_sig_sign(self._backend, self._private_key, digest)\n\n\n@utils.register_interface(AsymmetricVerificationContext)\nclass _ECDSAVerificationContext(object):\n    def __init__(self, backend, public_key, signature, algorithm):\n        self._backend = backend\n        self._public_key = public_key\n        self._signature = signature\n        self._digest = hashes.Hash(algorithm, backend)\n\n    def update(self, data):\n        self._digest.update(data)\n\n    def verify(self):\n        digest = self._digest.finalize()\n        return _ecdsa_sig_verify(\n            self._backend, self._public_key, self._signature, digest\n        )\n\n\n@utils.register_interface(ec.EllipticCurvePrivateKeyWithSerialization)\nclass _EllipticCurvePrivateKey(object):\n    def __init__(self, backend, ec_key_cdata, evp_pkey):\n        self._backend = backend\n        _mark_asn1_named_ec_curve(backend, ec_key_cdata)\n        self._ec_key = ec_key_cdata\n        self._evp_pkey = evp_pkey\n\n        sn = _ec_key_curve_sn(backend, ec_key_cdata)\n        self._curve = _sn_to_elliptic_curve(backend, sn)\n\n    curve = utils.read_only_property(\"_curve\")\n\n    def signer(self, signature_algorithm):\n        _check_signature_algorithm(signature_algorithm)\n        return _ECDSASignatureContext(\n            self._backend, self, signature_algorithm.algorithm\n        )\n\n    def exchange(self, algorithm, peer_public_key):\n        if not (\n            self._backend.elliptic_curve_exchange_algorithm_supported(\n                algorithm, self.curve\n            )\n        ):\n            raise UnsupportedAlgorithm(\n                \"This backend does not support the ECDH algorithm.\",\n                _Reasons.UNSUPPORTED_EXCHANGE_ALGORITHM\n            )\n\n        if peer_public_key.curve.name != self.curve.name:\n            raise ValueError(\n                \"peer_public_key and self are not on the same curve\"\n            )\n\n        group = self._backend._lib.EC_KEY_get0_group(self._ec_key)\n        z_len = (self._backend._lib.EC_GROUP_get_degree(group) + 7) // 8\n        self._backend.openssl_assert(z_len > 0)\n        z_buf = self._backend._ffi.new(\"uint8_t[]\", z_len)\n        peer_key = self._backend._lib.EC_KEY_get0_public_key(\n            peer_public_key._ec_key\n        )\n\n        r = self._backend._lib.ECDH_compute_key(\n            z_buf, z_len, peer_key, self._ec_key, self._backend._ffi.NULL\n        )\n        self._backend.openssl_assert(r > 0)\n        return self._backend._ffi.buffer(z_buf)[:z_len]\n\n    def public_key(self):\n        group = self._backend._lib.EC_KEY_get0_group(self._ec_key)\n        self._backend.openssl_assert(group != self._backend._ffi.NULL)\n\n        curve_nid = self._backend._lib.EC_GROUP_get_curve_name(group)\n\n        public_ec_key = self._backend._lib.EC_KEY_new_by_curve_name(curve_nid)\n        self._backend.openssl_assert(public_ec_key != self._backend._ffi.NULL)\n        public_ec_key = self._backend._ffi.gc(\n            public_ec_key, self._backend._lib.EC_KEY_free\n        )\n\n        point = self._backend._lib.EC_KEY_get0_public_key(self._ec_key)\n        self._backend.openssl_assert(point != self._backend._ffi.NULL)\n\n        res = self._backend._lib.EC_KEY_set_public_key(public_ec_key, point)\n        self._backend.openssl_assert(res == 1)\n\n        evp_pkey = self._backend._ec_cdata_to_evp_pkey(public_ec_key)\n\n        return _EllipticCurvePublicKey(self._backend, public_ec_key, evp_pkey)\n\n    def private_numbers(self):\n        bn = self._backend._lib.EC_KEY_get0_private_key(self._ec_key)\n        private_value = self._backend._bn_to_int(bn)\n        return ec.EllipticCurvePrivateNumbers(\n            private_value=private_value,\n            public_numbers=self.public_key().public_numbers()\n        )\n\n    def private_bytes(self, encoding, format, encryption_algorithm):\n        return self._backend._private_key_bytes(\n            encoding,\n            format,\n            encryption_algorithm,\n            self._evp_pkey,\n            self._ec_key\n        )\n\n    def sign(self, data, signature_algorithm):\n        _check_signature_algorithm(signature_algorithm)\n        data, algorithm = _calculate_digest_and_algorithm(\n            self._backend, data, signature_algorithm._algorithm\n        )\n        return _ecdsa_sig_sign(self._backend, self, data)\n\n\n@utils.register_interface(ec.EllipticCurvePublicKeyWithSerialization)\nclass _EllipticCurvePublicKey(object):\n    def __init__(self, backend, ec_key_cdata, evp_pkey):\n        self._backend = backend\n        _mark_asn1_named_ec_curve(backend, ec_key_cdata)\n        self._ec_key = ec_key_cdata\n        self._evp_pkey = evp_pkey\n\n        sn = _ec_key_curve_sn(backend, ec_key_cdata)\n        self._curve = _sn_to_elliptic_curve(backend, sn)\n\n    curve = utils.read_only_property(\"_curve\")\n\n    def verifier(self, signature, signature_algorithm):\n        if not isinstance(signature, bytes):\n            raise TypeError(\"signature must be bytes.\")\n\n        _check_signature_algorithm(signature_algorithm)\n        return _ECDSAVerificationContext(\n            self._backend, self, signature, signature_algorithm.algorithm\n        )\n\n    def public_numbers(self):\n        get_func, group = (\n            self._backend._ec_key_determine_group_get_func(self._ec_key)\n        )\n        point = self._backend._lib.EC_KEY_get0_public_key(self._ec_key)\n        self._backend.openssl_assert(point != self._backend._ffi.NULL)\n\n        with self._backend._tmp_bn_ctx() as bn_ctx:\n            bn_x = self._backend._lib.BN_CTX_get(bn_ctx)\n            bn_y = self._backend._lib.BN_CTX_get(bn_ctx)\n\n            res = get_func(group, point, bn_x, bn_y, bn_ctx)\n            self._backend.openssl_assert(res == 1)\n\n            x = self._backend._bn_to_int(bn_x)\n            y = self._backend._bn_to_int(bn_y)\n\n        return ec.EllipticCurvePublicNumbers(\n            x=x,\n            y=y,\n            curve=self._curve\n        )\n\n    def public_bytes(self, encoding, format):\n        if format is serialization.PublicFormat.PKCS1:\n            raise ValueError(\n                \"EC public keys do not support PKCS1 serialization\"\n            )\n\n        return self._backend._public_key_bytes(\n            encoding,\n            format,\n            self,\n            self._evp_pkey,\n            None\n        )\n\n    def verify(self, signature, data, signature_algorithm):\n        _check_signature_algorithm(signature_algorithm)\n        data, algorithm = _calculate_digest_and_algorithm(\n            self._backend, data, signature_algorithm._algorithm\n        )\n        return _ecdsa_sig_verify(self._backend, self, signature, data)\n", "path": "src/cryptography/hazmat/backends/openssl/ec.py"}], "after_files": [{"content": "# This file is dual licensed under the terms of the Apache License, Version\n# 2.0, and the BSD License. See the LICENSE file in the root of this repository\n# for complete details.\n\nfrom __future__ import absolute_import, division, print_function\n\nfrom cryptography import utils\nfrom cryptography.exceptions import (\n    InvalidSignature, UnsupportedAlgorithm, _Reasons\n)\nfrom cryptography.hazmat.backends.openssl.utils import (\n    _calculate_digest_and_algorithm\n)\nfrom cryptography.hazmat.primitives import hashes, serialization\nfrom cryptography.hazmat.primitives.asymmetric import (\n    AsymmetricSignatureContext, AsymmetricVerificationContext, ec\n)\n\n\ndef _check_signature_algorithm(signature_algorithm):\n    if not isinstance(signature_algorithm, ec.ECDSA):\n        raise UnsupportedAlgorithm(\n            \"Unsupported elliptic curve signature algorithm.\",\n            _Reasons.UNSUPPORTED_PUBLIC_KEY_ALGORITHM)\n\n\ndef _ec_key_curve_sn(backend, ec_key):\n    group = backend._lib.EC_KEY_get0_group(ec_key)\n    backend.openssl_assert(group != backend._ffi.NULL)\n\n    nid = backend._lib.EC_GROUP_get_curve_name(group)\n    # The following check is to find EC keys with unnamed curves and raise\n    # an error for now.\n    if nid == backend._lib.NID_undef:\n        raise NotImplementedError(\n            \"ECDSA certificates with unnamed curves are unsupported \"\n            \"at this time\"\n        )\n\n    curve_name = backend._lib.OBJ_nid2sn(nid)\n    backend.openssl_assert(curve_name != backend._ffi.NULL)\n\n    sn = backend._ffi.string(curve_name).decode('ascii')\n    return sn\n\n\ndef _mark_asn1_named_ec_curve(backend, ec_cdata):\n    \"\"\"\n    Set the named curve flag on the EC_KEY. This causes OpenSSL to\n    serialize EC keys along with their curve OID which makes\n    deserialization easier.\n    \"\"\"\n\n    backend._lib.EC_KEY_set_asn1_flag(\n        ec_cdata, backend._lib.OPENSSL_EC_NAMED_CURVE\n    )\n\n\ndef _sn_to_elliptic_curve(backend, sn):\n    try:\n        return ec._CURVE_TYPES[sn]()\n    except KeyError:\n        raise UnsupportedAlgorithm(\n            \"{0} is not a supported elliptic curve\".format(sn),\n            _Reasons.UNSUPPORTED_ELLIPTIC_CURVE\n        )\n\n\ndef _ecdsa_sig_sign(backend, private_key, data):\n    max_size = backend._lib.ECDSA_size(private_key._ec_key)\n    backend.openssl_assert(max_size > 0)\n\n    sigbuf = backend._ffi.new(\"unsigned char[]\", max_size)\n    siglen_ptr = backend._ffi.new(\"unsigned int[]\", 1)\n    res = backend._lib.ECDSA_sign(\n        0, data, len(data), sigbuf, siglen_ptr, private_key._ec_key\n    )\n    backend.openssl_assert(res == 1)\n    return backend._ffi.buffer(sigbuf)[:siglen_ptr[0]]\n\n\ndef _ecdsa_sig_verify(backend, public_key, signature, data):\n    res = backend._lib.ECDSA_verify(\n        0, data, len(data), signature, len(signature), public_key._ec_key\n    )\n    if res != 1:\n        backend._consume_errors()\n        raise InvalidSignature\n\n\n@utils.register_interface(AsymmetricSignatureContext)\nclass _ECDSASignatureContext(object):\n    def __init__(self, backend, private_key, algorithm):\n        self._backend = backend\n        self._private_key = private_key\n        self._digest = hashes.Hash(algorithm, backend)\n\n    def update(self, data):\n        self._digest.update(data)\n\n    def finalize(self):\n        digest = self._digest.finalize()\n\n        return _ecdsa_sig_sign(self._backend, self._private_key, digest)\n\n\n@utils.register_interface(AsymmetricVerificationContext)\nclass _ECDSAVerificationContext(object):\n    def __init__(self, backend, public_key, signature, algorithm):\n        self._backend = backend\n        self._public_key = public_key\n        self._signature = signature\n        self._digest = hashes.Hash(algorithm, backend)\n\n    def update(self, data):\n        self._digest.update(data)\n\n    def verify(self):\n        digest = self._digest.finalize()\n        _ecdsa_sig_verify(\n            self._backend, self._public_key, self._signature, digest\n        )\n\n\n@utils.register_interface(ec.EllipticCurvePrivateKeyWithSerialization)\nclass _EllipticCurvePrivateKey(object):\n    def __init__(self, backend, ec_key_cdata, evp_pkey):\n        self._backend = backend\n        _mark_asn1_named_ec_curve(backend, ec_key_cdata)\n        self._ec_key = ec_key_cdata\n        self._evp_pkey = evp_pkey\n\n        sn = _ec_key_curve_sn(backend, ec_key_cdata)\n        self._curve = _sn_to_elliptic_curve(backend, sn)\n\n    curve = utils.read_only_property(\"_curve\")\n\n    def signer(self, signature_algorithm):\n        _check_signature_algorithm(signature_algorithm)\n        return _ECDSASignatureContext(\n            self._backend, self, signature_algorithm.algorithm\n        )\n\n    def exchange(self, algorithm, peer_public_key):\n        if not (\n            self._backend.elliptic_curve_exchange_algorithm_supported(\n                algorithm, self.curve\n            )\n        ):\n            raise UnsupportedAlgorithm(\n                \"This backend does not support the ECDH algorithm.\",\n                _Reasons.UNSUPPORTED_EXCHANGE_ALGORITHM\n            )\n\n        if peer_public_key.curve.name != self.curve.name:\n            raise ValueError(\n                \"peer_public_key and self are not on the same curve\"\n            )\n\n        group = self._backend._lib.EC_KEY_get0_group(self._ec_key)\n        z_len = (self._backend._lib.EC_GROUP_get_degree(group) + 7) // 8\n        self._backend.openssl_assert(z_len > 0)\n        z_buf = self._backend._ffi.new(\"uint8_t[]\", z_len)\n        peer_key = self._backend._lib.EC_KEY_get0_public_key(\n            peer_public_key._ec_key\n        )\n\n        r = self._backend._lib.ECDH_compute_key(\n            z_buf, z_len, peer_key, self._ec_key, self._backend._ffi.NULL\n        )\n        self._backend.openssl_assert(r > 0)\n        return self._backend._ffi.buffer(z_buf)[:z_len]\n\n    def public_key(self):\n        group = self._backend._lib.EC_KEY_get0_group(self._ec_key)\n        self._backend.openssl_assert(group != self._backend._ffi.NULL)\n\n        curve_nid = self._backend._lib.EC_GROUP_get_curve_name(group)\n\n        public_ec_key = self._backend._lib.EC_KEY_new_by_curve_name(curve_nid)\n        self._backend.openssl_assert(public_ec_key != self._backend._ffi.NULL)\n        public_ec_key = self._backend._ffi.gc(\n            public_ec_key, self._backend._lib.EC_KEY_free\n        )\n\n        point = self._backend._lib.EC_KEY_get0_public_key(self._ec_key)\n        self._backend.openssl_assert(point != self._backend._ffi.NULL)\n\n        res = self._backend._lib.EC_KEY_set_public_key(public_ec_key, point)\n        self._backend.openssl_assert(res == 1)\n\n        evp_pkey = self._backend._ec_cdata_to_evp_pkey(public_ec_key)\n\n        return _EllipticCurvePublicKey(self._backend, public_ec_key, evp_pkey)\n\n    def private_numbers(self):\n        bn = self._backend._lib.EC_KEY_get0_private_key(self._ec_key)\n        private_value = self._backend._bn_to_int(bn)\n        return ec.EllipticCurvePrivateNumbers(\n            private_value=private_value,\n            public_numbers=self.public_key().public_numbers()\n        )\n\n    def private_bytes(self, encoding, format, encryption_algorithm):\n        return self._backend._private_key_bytes(\n            encoding,\n            format,\n            encryption_algorithm,\n            self._evp_pkey,\n            self._ec_key\n        )\n\n    def sign(self, data, signature_algorithm):\n        _check_signature_algorithm(signature_algorithm)\n        data, algorithm = _calculate_digest_and_algorithm(\n            self._backend, data, signature_algorithm._algorithm\n        )\n        return _ecdsa_sig_sign(self._backend, self, data)\n\n\n@utils.register_interface(ec.EllipticCurvePublicKeyWithSerialization)\nclass _EllipticCurvePublicKey(object):\n    def __init__(self, backend, ec_key_cdata, evp_pkey):\n        self._backend = backend\n        _mark_asn1_named_ec_curve(backend, ec_key_cdata)\n        self._ec_key = ec_key_cdata\n        self._evp_pkey = evp_pkey\n\n        sn = _ec_key_curve_sn(backend, ec_key_cdata)\n        self._curve = _sn_to_elliptic_curve(backend, sn)\n\n    curve = utils.read_only_property(\"_curve\")\n\n    def verifier(self, signature, signature_algorithm):\n        if not isinstance(signature, bytes):\n            raise TypeError(\"signature must be bytes.\")\n\n        _check_signature_algorithm(signature_algorithm)\n        return _ECDSAVerificationContext(\n            self._backend, self, signature, signature_algorithm.algorithm\n        )\n\n    def public_numbers(self):\n        get_func, group = (\n            self._backend._ec_key_determine_group_get_func(self._ec_key)\n        )\n        point = self._backend._lib.EC_KEY_get0_public_key(self._ec_key)\n        self._backend.openssl_assert(point != self._backend._ffi.NULL)\n\n        with self._backend._tmp_bn_ctx() as bn_ctx:\n            bn_x = self._backend._lib.BN_CTX_get(bn_ctx)\n            bn_y = self._backend._lib.BN_CTX_get(bn_ctx)\n\n            res = get_func(group, point, bn_x, bn_y, bn_ctx)\n            self._backend.openssl_assert(res == 1)\n\n            x = self._backend._bn_to_int(bn_x)\n            y = self._backend._bn_to_int(bn_y)\n\n        return ec.EllipticCurvePublicNumbers(\n            x=x,\n            y=y,\n            curve=self._curve\n        )\n\n    def public_bytes(self, encoding, format):\n        if format is serialization.PublicFormat.PKCS1:\n            raise ValueError(\n                \"EC public keys do not support PKCS1 serialization\"\n            )\n\n        return self._backend._public_key_bytes(\n            encoding,\n            format,\n            self,\n            self._evp_pkey,\n            None\n        )\n\n    def verify(self, signature, data, signature_algorithm):\n        _check_signature_algorithm(signature_algorithm)\n        data, algorithm = _calculate_digest_and_algorithm(\n            self._backend, data, signature_algorithm._algorithm\n        )\n        _ecdsa_sig_verify(self._backend, self, signature, data)\n", "path": "src/cryptography/hazmat/backends/openssl/ec.py"}]}