aboutsummaryrefslogtreecommitdiffstats
path: root/docs
Commit message (Collapse)AuthorAgeFilesLines
* add OCSP basic response extension parsing (#4479)Paul Kehrer2018-10-061-0/+5
| | | | | | | | | | * add OCSP basic response extension parsing Just nonce for now. This does not support SINGLERESP extension parsing. * also raises on extensions for non-successful * empty commit
* support OCSP response parsing (#4452)Paul Kehrer2018-10-011-0/+21
| | | | | | | | | | | | * support OCSP response parsing * move the decorator to make pep8 happy * add some missing docs * review feedback * more review feedback
* a few docs fixes and language improvements (#4472)Paul Kehrer2018-09-144-13/+11
|
* OCSP request extension parsing (#4464)Paul Kehrer2018-09-093-0/+40
| | | | | | | | | | * add OCSP request parsing support with OCSPNonce * add docs * reprs man * make extensions a cached property
* add OCSP request with a request extension (nonce) (#4462)Paul Kehrer2018-09-071-0/+2
|
* document that OCSPResponse attributes can raise valuerror (#4453)Paul Kehrer2018-09-011-0/+48
|
* More OCSP vectors (#4451)Paul Kehrer2018-09-011-0/+5
| | | | | | | | * yet another ocsp response vector. and yet there will be at least one more after this * add one more
* add LE subordinate certificate to test vectors (#4450)Paul Kehrer2018-09-011-0/+2
|
* initial OCSP response docs (#4448)Paul Kehrer2018-09-011-0/+179
|
* add more OCSP response vectors (#4445)Paul Kehrer2018-09-011-0/+7
| | | | | | * add more OCSP response vectors * another vector and better docs
* Fixes #4333 -- added support for precert poison extension (#4442)Alex Gaynor2018-08-311-0/+23
| | | | | | | | | | | | | | * Fixes #4333 -- added support for precert poison extension * Make work on all OpenSSL versions * fixed flake8 + docs * fix for older OpenSSLs * document this * spell
* OCSP response vector (#4443)Paul Kehrer2018-08-311-0/+5
| | | | | | | | | | * OCSP response vector * oops, wrong name * move ocsp response vector docs * make alex happy
* refactor ocsp request parsing and generation to support only one cert (#4439)Paul Kehrer2018-08-311-25/+17
| | | | | | | | * refactor ocsp request parsing and generation to support only one cert * small doc change * notimplementederror
* Fixes #3460 -- deprecate OpenSSL 1.0.1 (#4427)Alex Gaynor2018-08-311-0/+4
| | | | | | | | | | | | * Fixes #3460 -- deprecate OpenSSL 1.0.1 * We need to import warnings * flake8 * words are hard * rephrase
* Fixes #4357 -- document the additional release steps for a security release ↵Alex Gaynor2018-08-302-0/+17
| | | | | | | | | | | | | | (#4429) * Fixes #4357 -- document the additional release steps for a security release * One additional step * Fix a few typos * this is a word * link these
* Added vector for pre-certificate poison extension (#4432)Alex Gaynor2018-08-301-0/+2
|
* Update our security documentation to match what we actually do (#4430)Alex Gaynor2018-08-301-37/+7
| | | | | | * Update our security documentation to match what we actually do * If you stand for nothing Burr, what will you fall for?
* make an ocsp request (#4402)Paul Kehrer2018-08-301-0/+113
| | | | | | | | | | | | | | | | * make an ocsp request * update test, add docs * make it an OCSPRequestBuilder * review feedback and more tests * make it a class * empty commit to retrigger * type check
* Fixes #4426 -- use modern idiom in our bindings docs (#4428)Alex Gaynor2018-08-301-1/+1
|
* Fixes #4408 -- added an FAQ about abi3 wheels (#4425)Alex Gaynor2018-08-301-0/+8
| | | | | | * Fixes #4408 -- added an FAQ about abi3 wheels * abi3 is a word, sort of
* Mention that PyCA also maintains pynacl (#4422)Alex Gaynor2018-08-291-1/+2
| | | | | | * Mention that PyCA also maintains pynacl * line wrap
* Remove several very old FAQ entries (#4423)Alex Gaynor2018-08-291-11/+1
|
* openssl 1.1.1 testing (#4112)Paul Kehrer2018-08-291-0/+1
| | | | | | | | | | | | | | * test openssl 1.1.1 * let's see what a 1.1.1 pyopenssl does * 1.1.1-pre8 * pre9 * docs and test more things * 3.7 needs xenial
* Fix encoding errors in RSA test keys. (#4410)David Benjamin2018-08-231-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Fix encoding errors in RSA test keys. enc-rsa-pkcs8.pem and unenc-rsa-pkcs8.pem did not encode the RSA key correctly. Per RFC 8017, appendix A.1: The object identifier rsaEncryption identifies RSA public and private keys as defined in Appendices A.1.1 and A.1.2. The parameters field has associated with this OID in a value of type AlgorithmIdentifier SHALL have a value of type NULL. rsaEncryption OBJECT IDENTIFIER ::= { pkcs-1 1 } unenc-rsa-pkcs8.pem, however, was missing that NULL, which was, in turn, carried into the encrypted payload of enc-rsa-pkcs8.pem. The DER version, enc-rsa-pkcs8.der, carries this mistake too. Interestingly, unenc-rsa-pkcs8.der does *not* have it. I'm guessing it was converted with the openssl command-line tool which fixed the encoding in conversion. Current versions of OpenSSL are lax and ignore the parameters field, but it's best to test against spec-compliant inputs. Fix unenc-rsa-pkcs8.pem to match unenc-rsa-pkcs8.der and then refresh enc-rsa-pkcs8.{der,pem} with the new encoding but otherwise the same encryption parameters. I've refreshed the dumpasn1 (at least that's what it looks like) preamble at the top of each file, but the current version of dumpasn1 appears to have changed the spacing slightly, so there's some whitespace diff noise. * Update test-vectors.rst.
* remove freebsd11 builder (#4401)Paul Kehrer2018-08-151-2/+0
| | | | | | | | | | | | * remove freebsd11 builder it's out of date, we can't update it, and it is unreliable * we don't test against freebsd for now * what did case sensitivity ever do for me * don't assert on bsd since we don't test on for now
* OCSP request parsing (#4393)Paul Kehrer2018-08-152-0/+95
| | | | | | | | | | | | * add public_bytes to OCSPRequest * review feedback * OCSP request parsing * change some prose * add __len__ as a required method
* add new OCSP request vectors (#4399)Paul Kehrer2018-08-151-0/+4
|
* Document wycheproof revision we're current as of (#4390)Alex Gaynor2018-08-122-1/+14
| | | | | | | | * Document wycheproof revision we're current as of * Wycheproof is a real word! * line length
* make a certificate expire a few years in the future, fixes doctests (#4383)Alex Gaynor2018-08-061-1/+1
| | | | | | | | * make a certificate expire a few years in the future, fixes doctests 👋 to future alex when this test breaks in two years * short lived certs are a good idea
* Refs #4375 -- integrate wycheproof AES CCM tests (#4379)Alex Gaynor2018-08-021-1/+1
| | | | | | * Refs #4375 -- integrate wycheproof AES CCM tests * Skip these tests if we don't have CCM support
* min_tag_length is an int (#4351)Paul Kehrer2018-07-171-1/+1
|
* raise ValueError on zero length GCM IV (#4348)Paul Kehrer2018-07-171-1/+2
|
* disallow implicit tag truncation with finalize_with_tag (#4342)Paul Kehrer2018-07-171-0/+1
|
* add crl.get_revoked_certificate method (#4331)Paul Kehrer2018-07-161-0/+9
| | | | | | | | * add crl.get_revoked_certificate method * lexicographic is the best ographic * rename
* document one shot AEAD length restrictions (#4322)Paul Kehrer2018-07-141-0/+6
| | | | | | | | | | | | | | * document one shot AEAD length restrictions * write a test that won't consume infinity ram continue to raise OverflowError since that's what cffi did. * this applies to associated_data too * remove unneeded arg * review feedback on docs
* document that an ECPublicNumbers object has some unexpected properties (#4319)Paul Kehrer2018-07-091-0/+8
| | | | | | | | | | | | | * document that an ECPublicNumbers object has some unexpected properties It is not guaranteed to be a valid point on the curve as that is not checked until you convert it to a PublicKey object. * different language * move the text, make it a warning, alter the language * new language
* Make RelativeDistinguishedName preserve attribtue order (#4306)Marti Raudsepp2018-07-091-2/+3
| | | | Duplicate attributes now raise an error instead of silently discarding duplicates.
* Make the docs clearer on why truncated tags are a bad idea (#4312)Alex Gaynor2018-07-061-4/+4
| | | | | | * Make the docs clearer on why truncated tags are a bad idea * clarify
* Add OID for RSASSA-PSS X.509 signature algorithm (RFC 4055) (#4294)Marti Raudsepp2018-06-291-0/+9
| | | | | | | | | | | | In 2005, IETF devised a more secure padding scheme to replace PKCS #1 v1.5. To make sure that nobody can easily support or use it, they mandated lots of complicated parameters in the certificate, unlike any other X.509 signature scheme. https://tools.ietf.org/html/rfc4055 `_SIG_OIDS_TO_HASH` and `Certificate.signature_hash_algorithm` cannot be supported as-is, because the hash algorithm is defined in the signature algorithm parameters, not by the OID itself.
* Add py37 (#4298)Paul Kehrer2018-06-271-1/+1
| | | | | | | | | | | | | | * test against python 3.7 for windows * update docs to say we test on 3.7 * more succinct * maybe make this actually work. * link properly * moar changes
* Add serialisation output examples (#4286)Коренберг Марк2018-06-261-0/+24
|
* Make AuthorityKeyIdentifier docs reflect reality (#4252)Thom Dixon2018-05-181-1/+1
| | | The `AuthorityKeyIdentifier.authority_cert_issuer` docs state that it returns a `Name` instance, but it [actually returns a list of `GeneralName` instances or `None`](https://github.com/pyca/cryptography/blob/master/src/cryptography/x509/extensions.py#L157).
* remove block size as a required part of HashAlgorithm (#4249)Paul Kehrer2018-05-161-6/+0
| | | | | | Internal block size isn't a particularly useful piece of information and constructions like SHA3 make it even harder to determine what that really means. Accordingly, we're removing it from the interface (but leaving it on all existing hashes)
* Add SHA512/224 and SHA512/256 test vectors from NIST CAVP (#4237)Paul Kehrer2018-05-141-1/+1
|
* Use pytest instead of py.test per upstream recommendation, #dropthedot (#4236)Ville Skyttä2018-05-131-1/+1
| | | | http://blog.pytest.org/2016/whats-new-in-pytest-30/ https://twitter.com/hashtag/dropthedot
* switch to py3 on docs job (#4230)Paul Kehrer2018-05-1211-47/+48
| | | | | | * switch to py3 on docs job * somehow unicode isn't a word
* Fixed some confusing type descriptions in docs (#4231)Alex Gaynor2018-05-121-4/+1
|
* Add support for extracting timestamp from a Fernet token (#4229)Paul Kehrer2018-05-121-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add API for retrieving the seconds-to-expiry for the token, given a TTL. * Process PR feedback: * Do compute the TTL, but just the age of the token. The caller can decided what to do next. * Factored out the HMAC signature verification to a separate function. * Fixed a copy&paste mistake in the test cases * Tests cleanup. * `struct` no longer needed * Document `def age()` * typo in `age()` documentation * token, not data * remove test for TTL expiry that is already covered by the parameterized `test_invalid()`. * let's call this extract_timestamp and just return timestamp * review comments * it's UNIX I know this
* Use a checklist for bumping openssl version (#4221)Alex Gaynor2018-05-091-19/+7
| | | | | | | | * Use a checklist for bumping openssl version * words * empty commit to retrigger jenkins
* add SHA3 and SHAKE vectors (#4213)Paul Kehrer2018-05-091-0/+2
| | | These can be used when OpenSSL 1.1.1 is released
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-02 10:14:17 +0000