def _sign(private_key, data, hash_algorithm, rsa_pss_padding=False):
    """
    Generates an RSA, DSA or ECDSA signature

    :param private_key:
        The PrivateKey to generate the signature with

    :param data:
        A byte string of the data the signature is for

    :param hash_algorithm:
        A unicode string of "md5", "sha1", "sha256", "sha384", "sha512" or "raw"

    :param rsa_pss_padding:
        If PSS padding should be used for RSA keys

    :raises:
        ValueError - when any of the parameters contain an invalid value
        TypeError - when any of the parameters are of the wrong type
        OSError - when an error is returned by the OS crypto library

    :return:
        A byte string of the signature
    """

    if not isinstance(private_key, PrivateKey):
        raise TypeError(pretty_message(
            '''
            private_key must be an instance of PrivateKey, not %s
            ''',
            type_name(private_key)
        ))

    if not isinstance(data, byte_cls):
        raise TypeError(pretty_message(
            '''
            data must be a byte string, not %s
            ''',
            type_name(data)
        ))

    valid_hash_algorithms = set(['md5', 'sha1', 'sha256', 'sha384', 'sha512'])
    if private_key.algorithm == 'rsa' and not rsa_pss_padding:
        valid_hash_algorithms |= set(['raw'])

    if hash_algorithm not in valid_hash_algorithms:
        valid_hash_algorithms_error = '"md5", "sha1", "sha256", "sha384", "sha512"'
        if private_key.algorithm == 'rsa' and not rsa_pss_padding:
            valid_hash_algorithms_error += ', "raw"'
        raise ValueError(pretty_message(
            '''
            hash_algorithm must be one of %s, not %s
            ''',
            valid_hash_algorithms_error,
            repr(hash_algorithm)
        ))

    if private_key.algorithm != 'rsa' and rsa_pss_padding is not False:
        raise ValueError(pretty_message(
            '''
            PSS padding may only be used with RSA keys - signing via a %s key
            was requested
            ''',
            private_key.algorithm.upper()
        ))

    if hash_algorithm == 'raw':
        if len(data) > private_key.byte_size - 11:
            raise ValueError(pretty_message(
                '''
                data must be 11 bytes shorter than the key size when
                hash_algorithm is "raw" - key size is %s bytes, but data
                is %s bytes long
                ''',
                private_key.byte_size,
                len(data)
            ))

    if _backend == 'winlegacy':
        if private_key.algorithm == 'ec':
            return _pure_python_ecdsa_sign(private_key, data, hash_algorithm)
        return _advapi32_sign(private_key, data, hash_algorithm, rsa_pss_padding)
    return _bcrypt_sign(private_key, data, hash_algorithm, rsa_pss_padding)
def _sign(private_key, data, hash_algorithm, rsa_pss_padding=False):
    """
    Generates an RSA, DSA or ECDSA signature

    :param private_key:
        The PrivateKey to generate the signature with

    :param data:
        A byte string of the data the signature is for

    :param hash_algorithm:
        A unicode string of "md5", "sha1", "sha256", "sha384", "sha512" or "raw"

    :param rsa_pss_padding:
        If PSS padding should be used for RSA keys

    :raises:
        ValueError - when any of the parameters contain an invalid value
        TypeError - when any of the parameters are of the wrong type
        OSError - when an error is returned by the OS crypto library

    :return:
        A byte string of the signature
    """

    if not isinstance(private_key, PrivateKey):
        raise TypeError(pretty_message(
            '''
            private_key must be an instance of PrivateKey, not %s
            ''',
            type_name(private_key)
        ))

    if not isinstance(data, byte_cls):
        raise TypeError(pretty_message(
            '''
            data must be a byte string, not %s
            ''',
            type_name(data)
        ))

    valid_hash_algorithms = set(['md5', 'sha1', 'sha256', 'sha384', 'sha512'])
    if private_key.algorithm == 'rsa' and not rsa_pss_padding:
        valid_hash_algorithms |= set(['raw'])

    if hash_algorithm not in valid_hash_algorithms:
        valid_hash_algorithms_error = '"md5", "sha1", "sha256", "sha384", "sha512"'
        if private_key.algorithm == 'rsa' and not rsa_pss_padding:
            valid_hash_algorithms_error += ', "raw"'
        raise ValueError(pretty_message(
            '''
            hash_algorithm must be one of %s, not %s
            ''',
            valid_hash_algorithms_error,
            repr(hash_algorithm)
        ))

    if private_key.algorithm != 'rsa' and rsa_pss_padding is not False:
        raise ValueError(pretty_message(
            '''
            PSS padding may only be used with RSA keys - signing via a %s key
            was requested
            ''',
            private_key.algorithm.upper()
        ))

    if hash_algorithm == 'raw':
        if len(data) > private_key.byte_size - 11:
            raise ValueError(pretty_message(
                '''
                data must be 11 bytes shorter than the key size when
                hash_algorithm is "raw" - key size is %s bytes, but data
                is %s bytes long
                ''',
                private_key.byte_size,
                len(data)
            ))

    if _backend == 'winlegacy':
        if private_key.algorithm == 'ec':
            return _pure_python_ecdsa_sign(private_key, data, hash_algorithm)
        return _advapi32_sign(private_key, data, hash_algorithm, rsa_pss_padding)
    return _bcrypt_sign(private_key, data, hash_algorithm, rsa_pss_padding)
def _sign ( private_key , data , hash_algorithm , rsa_pss_padding = False ) : if not isinstance ( private_key , PrivateKey ) : raise TypeError ( pretty_message ( '''
            private_key must be an instance of PrivateKey, not %s
            ''' , type_name ( private_key ) ) ) if not isinstance ( data , byte_cls ) : raise TypeError ( pretty_message ( '''
            data must be a byte string, not %s
            ''' , type_name ( data ) ) ) valid_hash_algorithms = set ( [ 'md5' , 'sha1' , 'sha256' , 'sha384' , 'sha512' ] ) if private_key . algorithm == 'rsa' and not rsa_pss_padding : valid_hash_algorithms |= set ( [ 'raw' ] ) if hash_algorithm not in valid_hash_algorithms : valid_hash_algorithms_error = '"md5", "sha1", "sha256", "sha384", "sha512"' if private_key . algorithm == 'rsa' and not rsa_pss_padding : valid_hash_algorithms_error += ', "raw"' raise ValueError ( pretty_message ( '''
            hash_algorithm must be one of %s, not %s
            ''' , valid_hash_algorithms_error , repr ( hash_algorithm ) ) ) if private_key . algorithm != 'rsa' and rsa_pss_padding is not False : raise ValueError ( pretty_message ( '''
            PSS padding may only be used with RSA keys - signing via a %s key
            was requested
            ''' , private_key . algorithm . upper ( ) ) ) if hash_algorithm == 'raw' : if len ( data ) > private_key . byte_size - 11 : raise ValueError ( pretty_message ( '''
                data must be 11 bytes shorter than the key size when
                hash_algorithm is "raw" - key size is %s bytes, but data
                is %s bytes long
                ''' , private_key . byte_size , len ( data ) ) ) if _backend == 'winlegacy' : if private_key . algorithm == 'ec' : return _pure_python_ecdsa_sign ( private_key , data , hash_algorithm ) return _advapi32_sign ( private_key , data , hash_algorithm , rsa_pss_padding ) return _bcrypt_sign ( private_key , data , hash_algorithm , rsa_pss_padding )
Generates an RSA, DSA or ECDSA signature

    :param private_key:
        The PrivateKey to generate the signature with

    :param data:
        A byte string of the data the signature is for

    :param hash_algorithm:
        A unicode string of "md5", "sha1", "sha256", "sha384", "sha512" or "raw"

    :param rsa_pss_padding:
        If PSS padding should be used for RSA keys

    :raises:
        ValueError - when any of the parameters contain an invalid value
        TypeError - when any of the parameters are of the wrong type
        OSError - when an error is returned by the OS crypto library

    :return:
        A byte string of the signature
Generates an RSA DSA or ECDSA signature