text: import base64
  import hashlib
  import logging
  
  from cryptography import x509
  from cryptography.hazmat.backends import default_backend
  from cryptography.hazmat.primitives import serialization
  from cryptography.hazmat.primitives.asymmetric import rsa
  
  from ..exception import DeSerializationNotPossible
  from ..exception import JWKESTException
  from ..exception import SerializationNotPossible
  from ..exception import UnsupportedKeyType
  from ..utils import b64e
  from ..utils import deser
  from ..utils import long_to_base64
  from . import JWK
  from .asym import AsymmetricKey
  
  logger = logging.getLogger(__name__)
  
  PREFIX = "-----BEGIN CERTIFICATE-----"
  POSTFIX = "-----END CERTIFICATE-----"
  
  
  def generate_and_store_rsa_key(key_size=2048, filename='rsa.key',
                                 passphrase=''):
      """
      Generate a private RSA key and store a PEM representation of it in a
      file.
  
      :param key_size: The size of the key, default 2048 bytes.
      :param filename: The name of the file to which the key should be written
      :param passphrase: If the PEM representation should be protected with a
          pass phrase.
      :return: A
          cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey instance
      """
      private_key = rsa.generate_private_key(public_exponent=65537,
                                             key_size=key_size,
                                             backend=default_backend())
  
      with open(filename, "wb") as keyfile:
          if passphrase:
              pem = private_key.private_bytes(
                  encoding=serialization.Encoding.PEM,
                  format=serialization.PrivateFormat.PKCS8,
                  encryption_algorithm=serialization.BestAvailableEncryption(
                      passphrase))
          else:
              pem = private_key.private_bytes(
                  encoding=serialization.Encoding.PEM,
                  format=serialization.PrivateFormat.PKCS8,
                  encryption_algorithm=serialization.NoEncryption())
          keyfile.write(pem)
          keyfile.close()
      return private_key
  
  
  def import_private_rsa_key_from_file(filename, passphrase=None):
      """
      Read a private RSA key from a PEM file.
  
      :param filename: The name of the file
      :param passphrase: A pass phrase to use to unpack the PEM file.
      :return: A
          cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey instance
      """
      with open(filename, "rb") as key_file:
          private_key = serialization.load_pem_private_key(
              key_file.read(),
              password=passphrase,
              backend=default_backend())
      return private_key
  
  
  def import_public_rsa_key_from_file(filename):
      """
      Read a public RSA key from a PEM file.
  
      :param filename: The name of the file
      :param passphrase: A pass phrase to use to unpack the PEM file.
      :return: A
          cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey instance
      """
      with open(filename, "rb") as key_file:
          public_key = serialization.load_pem_public_key(
              key_file.read(),
              backend=default_backend())
      return public_key
  
  
  def import_rsa_key(pem_data):
      """
      Extract an RSA key from a PEM-encoded X.509 certificate
  
      :param pem_data: RSA key encoded in standard form
      :return: rsa.RSAPublicKey instance
      """
      if not pem_data.startswith(PREFIX):
          pem_data = bytes('{}\n{}\n{}'.format(PREFIX, pem_data, POSTFIX),
                           'utf-8')
      else:
          pem_data = bytes(pem_data, 'utf-8')
      cert = x509.load_pem_x509_certificate(pem_data, default_backend())
      return cert.public_key()
  
  
  def import_rsa_key_from_cert_file(pem_file):
      with open(pem_file, 'r') as cert_file:
          return import_rsa_key(cert_file.read())
  
  
  def rsa_eq(key1, key2):
      """
      Only works for RSAPublic Keys
  
      :param key1:
      :param key2:
      :return:
      """
      pn1 = key1.public_numbers()
      pn2 = key2.public_numbers()
      # Check if two RSA keys are in fact the same
      if pn1 == pn2:
          return True
      else:
          return False
  
  
  def x509_rsa_load(txt):
      """ So I get the same output format as loads produces
      :param txt:
      :return:
      """
      pub_key = import_rsa_key(txt)
      if isinstance(pub_key, rsa.RSAPublicKey):
          return [("rsa", pub_key)]
  
  
  def rsa_construct_public(numbers):
      rpn = rsa.RSAPublicNumbers(**numbers)
      return rpn.public_key(default_backend())
  
  
  def rsa_construct_private(numbers):
      args = dict([(k, v) for k, v in numbers.items() if k in ['n', 'e', 'd']])
      cnum = {'d': numbers['d']}
      if 'p' not in numbers and 'q' not in numbers:
          (p, q) = rsa.rsa_recover_prime_factors(**args)
          cnum['p'] = p
          cnum['q'] = q
      else:
          cnum['p'] = numbers['p']
          cnum['q'] = numbers['q']
  
      try:
          cnum['dmp1'] = numbers['dp']
      except KeyError:
          cnum['dmp1'] = rsa.rsa_crt_dmp1(cnum['d'], cnum['p'])
      else:
          if not numbers['dp']:
              cnum['dmp1'] = rsa.rsa_crt_dmp1(cnum['d'], cnum['p'])
  
      try:
          cnum['dmq1'] = numbers['dq']
      except KeyError:
          cnum['dmq1'] = rsa.rsa_crt_dmq1(cnum['d'], cnum['q'])
      else:
          if not numbers['dq']:
              cnum['dmq1'] = rsa.rsa_crt_dmq1(cnum['d'], cnum['q'])
  
      try:
          cnum['iqmp'] = numbers['di']
      except KeyError:
          cnum['iqmp'] = rsa.rsa_crt_iqmp(cnum['p'], cnum['p'])
      else:
          if not numbers['di']:
              cnum['iqmp'] = rsa.rsa_crt_iqmp(cnum['p'], cnum['p'])
  
      rpubn = rsa.RSAPublicNumbers(e=numbers['e'], n=numbers['n'])
      rprivn = rsa.RSAPrivateNumbers(public_numbers=rpubn, **cnum)
      return rprivn.private_key(default_backend())
  
  
  def der_cert(der_data):
      """
      Load a DER encoded certificate
  
      :param der_data: DER-encoded certificate
      :return: A cryptography.x509.certificate instance
      """
      if isinstance(der_data, str):
          der_data = bytes(der_data, 'utf-8')
      return x509.load_der_x509_certificate(der_data, default_backend())
  
  
  def load_x509_cert(url, httpc, spec2key, **get_args):
      """
      Get and transform a X509 cert into a key.
  
      :param url: Where the X509 cert can be found
      :param httpc: HTTP client to use for fetching
      :param spec2key: A dictionary over keys already seen
      :param get_args: Extra key word arguments to the HTTP GET request
      :return: List of 2-tuples (keytype, key)
      """
      try:
          r = httpc('GET', url, allow_redirects=True, **get_args)
          if r.status_code == 200:
              cert = str(r.text)
              try:
                  public_key = spec2key[cert]  # If I've already seen it
              except KeyError:
                  public_key = import_rsa_key(cert)
                  spec2key[cert] = public_key
              if isinstance(public_key, rsa.RSAPublicKey):
                  return {"rsa": public_key}
          else:
              raise Exception("HTTP Get error: %s" % r.status_code)
      except Exception as err:  # not a RSA key
          logger.warning("Can't load key: %s" % err)
          return []
  
  
  def cmp_public_numbers(pn1, pn2):
      """
      Compare 2 sets of public numbers. These is a way to compare
      2 public RSA keys. If the sets are the same then the keys are the same.
  
      :param pn1: The set of values belonging to the 1st key
      :param pn2: The set of values belonging to the 2nd key
      :return: True is the sets are the same otherwise False.
      """
      if pn1.n == pn2.n:
          if pn1.e == pn2.e:
              return True
      return False
  
  
  def cmp_private_numbers(pn1, pn2):
      """
      Compare 2 sets of private numbers. This is for comparing 2
      private RSA keys.
  
      :param pn1: The set of values belonging to the 1st key
      :param pn2: The set of values belonging to the 2nd key
      :return: True is the sets are the same otherwise False.
      """
      if not cmp_public_numbers(pn1.public_numbers, pn2.public_numbers):
          return False
  
      for param in ['d', 'p', 'q']:
          if getattr(pn1, param) != getattr(pn2, param):
              return False
      return True
  
  
  def x5t_calculation(cert):
      """
      base64url-encoded SHA-1 thumbprint (a.k.a. digest) of the DER
      encoding of an X.509 certificate.
  
      :param cert: DER encoded X.509 certificate
      :return: x5t value
      """
      if isinstance(cert, str):
          der_cert = base64.b64decode(cert.encode('ascii'))
      else:
          der_cert = base64.b64decode(cert)
  
      return b64e(hashlib.sha1(der_cert).digest())
  
  
  class RSAKey(AsymmetricKey):
      """
      JSON Web key representation of a RSA key
      The name of parameters used in this class are the same as
      specified in the RFC 7517.
  
      According to RFC7517 the JWK representation of a RSA (public key) can be
      something like this:
  
          {
          "kty": "RSA",
          "use": "sig",
          "kid": "1b94c",
          "n": "vrjOfz9Ccdgx5nQudyhdoR17V...",
          "e": "AQAB",
          }
  
      Parameters according to https://tools.ietf.org/html/rfc7518#section-6.3
      """
      members = JWK.members[:]
      # These are the RSA key specific parameters, they are always supposed to
      # be strings or bytes
      members.extend(["n", "e", "d", "p", "q"])
      # The parameters that represent long ints in the key instances
      longs = ["n", "e", "d", "p", "q", "dp", "dq", "di", "qi"]
      public_members = JWK.public_members[:]
      # the public members of the key
      public_members.extend(["n", "e"])
      required = ['kty', 'n', 'e']
  
      def __init__(self, kty="RSA", alg="", use="", kid="",
                   x5c=None, x5t="", x5u="", n="", e="", d="", p="", q="",
                   dp="", dq="", di="", qi="", **kwargs):
          AsymmetricKey.__init__(self, kty, alg, use, kid, x5c, x5t, x5u,
                                 **kwargs)
          self.n = n
          self.e = e
          self.d = d
          self.p = p
          self.q = q
          self.dp = dp
          self.dq = dq
          self.di = di
          self.qi = qi
  
          has_public_key_parts = len(self.n) > 0 and len(self.e)
          has_x509_cert_chain = len(self.x5c) > 0
  
          if self.priv_key:
              self._serialize(self.priv_key)
              self.pub_key = self.priv_key.public_key()
          elif self.pub_key:
              self._serialize(self.pub_key)
          elif has_public_key_parts:
              self.deserialize()
          elif has_x509_cert_chain:
              self.deserialize()
          elif not self.n and not self.e:
              pass
          else:  # one of n or e but not both
              raise JWKESTException('Missing required parameter')
  
      def deserialize(self):
          """
          Based on a text based representation of an RSA key this method
          instantiates a
          cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey or
          RSAPublicKey instance
  
          """
  
          # first look for the public parts of a RSA key
          if self.n and self.e:
              try:
                  numbers = {}
                  # loop over all the parameters that define a RSA key
                  for param in self.longs:
                      item = getattr(self, param)
                      if not item:
                          continue
                      else:
                          try:
                              val = int(deser(item))
                          except Exception:
                              raise
                          else:
                              numbers[param] = val
  
                  if 'd' in numbers:
                      self.priv_key = rsa_construct_private(numbers)
                      self.pub_key = self.priv_key.public_key()
                  else:
                      self.pub_key = rsa_construct_public(numbers)
              except ValueError as err:
                  raise DeSerializationNotPossible("%s" % err)
  
          if self.x5c:
              _cert_chain = []
              for der_data in self.x5c:
                  _cert_chain.append(der_cert(base64.b64decode(der_data)))
  
              if self.x5t:  # verify the cert thumbprint
                  if isinstance(self.x5t, bytes):
                      _x5t = self.x5t
                  else:
                      _x5t = self.x5t.encode('ascii')
                  if _x5t != x5t_calculation(self.x5c[0]):
                      raise DeSerializationNotPossible(
                          "The thumbprint 'x5t' does not match the certificate.")
  
              if self.pub_key:
                  if not rsa_eq(self.pub_key, _cert_chain[0].public_key()):
                      raise ValueError(
                          'key described by components and key in x5c not equal')
              else:
                  self.pub_key = _cert_chain[0].public_key()
  
              self._serialize(self.pub_key)
              if len(self.x5c) > 1:  # verify chain
                  pass
  
          if not self.priv_key and not self.pub_key:
              raise DeSerializationNotPossible()
  
      def serialize(self, private=False):
          """
          Given a cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey or
          RSAPublicKey instance construct the JWK representation.
  
          :param private: Should I do the private part or not
          :return: A JWK as a dictionary
          """
          if not self.priv_key and not self.pub_key:
              raise SerializationNotPossible()
  
          res = self.common()
  
          public_longs = list(set(self.public_members) & set(self.longs))
          for param in public_longs:
              item = getattr(self, param)
              if item:
                  res[param] = item
  
          if private:
              for param in self.longs:
                  if not private and param in ["d", "p", "q", "dp", "dq", "di",
                                               "qi"]:
                      continue
                  item = getattr(self, param)
                  if item:
                      res[param] = item
          if self.x5c:
              res['x5c'] = [x.decode('utf-8') for x in self.x5c]
  
          return res
  
      def _serialize(self, key):
          if isinstance(key, rsa.RSAPrivateKey):
              pn = key.private_numbers()
              self.n = long_to_base64(pn.public_numbers.n)
              self.e = long_to_base64(pn.public_numbers.e)
              self.d = long_to_base64(pn.d)
              self.p = long_to_base64(pn.p)
              self.q = long_to_base64(pn.q)
          elif isinstance(key, rsa.RSAPublicKey):
              pn = key.public_numbers()
              self.n = long_to_base64(pn.n)
              self.e = long_to_base64(pn.e)
          else:
              raise UnsupportedKeyType()
  
      def load_key(self, key):
          """
          Load a RSA key. Try to serialize the key before binding it to this
          instance.
  
          :param key: An RSA key instance
          """
  
          self._serialize(key)
          if isinstance(key, rsa.RSAPrivateKey):
              self.priv_key = key
              self.pub_key = key.public_key()
          else:
              self.pub_key = key
  
          return self
  
      def load(self, filename):
          """
          Load a RSA key from a file. Once we have the key do a serialization.
  
          :param filename: File name
          """
          return self.load_key(import_private_rsa_key_from_file(filename))
  
      def __eq__(self, other):
          """
          Verify that this other key is the same as myself.
  
          :param other: The other key
          :return: True if equal otherwise False
          """
          if not isinstance(other, RSAKey):
              return False
  
          if not self.pub_key:
              self.deserialize()
  
          if not other.pub_key:
              other.deserialize()
  
          if self.use and other.use:
              if self.use != other.use:
                  return False
  
          if self.kid:
              if other.kid:
                  if self.kid != other.kid:
                      return False
              else:
                  return False
          else:
              if other.kid:
                  return False
  
          try:
              pn1 = self.priv_key.private_numbers()
              pn2 = other.priv_key.private_numbers()
          except Exception:
              try:
                  return cmp_public_numbers(self.pub_key.public_numbers(),
                                            other.pub_key.public_numbers())
              except Exception:
                  return False
          else:
              return cmp_private_numbers(pn1, pn2)
  
  
  def new_rsa_key(key_size=2048, kid='', public_exponent=65537, **kwargs):
      """
      Creates a new RSA key pair and wraps it in a
      :py:class:`cryptojwt.jwk.rsa.RSAKey` instance
  
      :param key_size: The size of the key
      :param kid: The key ID
      :param public_exponent: The value of the public exponent.
      :return: A :py:class:`cryptojwt.jwk.rsa.RSAKey` instance
      """
  
      _key = rsa.generate_private_key(public_exponent=public_exponent,
                                      key_size=key_size,
                                      backend=default_backend())
  
      _rk = RSAKey(priv_key=_key, kid=kid, **kwargs)
      if not kid:
          _rk.add_kid()
  
      return _rk
  