aboutsummaryrefslogtreecommitdiffstats
path: root/src/cryptography/hazmat/backends/openssl/backend.py
Commit message (Collapse)AuthorAgeFilesLines
* Unify X.509 signature algorithm validation (#5276)HEADmasterMarko Kreen2020-06-141-38/+17
| | | | | - Use common implementation - OCSP signing was using different validation - Check if private key is usable for signing
* Consistently use 'self' in backend.py (#5261)Marko Kreen2020-05-271-6/+6
| | | | There happens to be global var named 'backend' so backend._lib works, but is confusing.
* Cleanup serialize (#5149)Marko Kreen2020-05-251-105/+95
| | | | | | | | | | | | | | * Additional tests for public/private_bytes They expose few places that raise TypeError and AssertionError! before, and ValueError later. * Cleanup of private_bytes() backend Also pass key itself down to backend. * Cleanup of public_bytes() backend * Test handling of unsupported key type
* Drop support for OpenSSL 1.0.1 (#5178)Alex Gaynor2020-04-041-4/+2
|
* Fixes #5065 -- skip serialization tests which use RC2 if OpenSSL doesn't ↵Alex Gaynor2019-11-251-0/+9
| | | | | | | | have RC2 (#5072) * Refs #5065 -- have a CI job with OpenSSL built with no-rc2 * Fixes #5065 -- skip serialization tests which use RC2 if OpenSSL doesn't have RC2
* Finish ed25519 and ed448 support in x509 module (#4972)Marko Kreen2019-09-091-14/+32
| | | | | | | | | | | | | | | | | | * Support ed25519 in csr/crl creation * Tests for ed25519/x509 * Support ed448 in crt/csr/crl creation * Tests for ed448/x509 * Support ed25519/ed448 in OCSPResponseBuilder * Tests for eddsa in OCSPResponseBuilder * Builder check missing in create_x509_csr * Documentation update for ed25519+ed448 in x509
* Remove asn1crypto dependency (#4941)David Benjamin2019-07-281-6/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Remove non-test dependencies on asn1crypto. cryptography.io actually contains two OpenSSL bindings right now, the expected cffi one, and an optional one hidden in asn1crypto. asn1crypto contains a lot of things that cryptography.io doesn't use, including a BER parser and a hand-rolled and not constant-time EC implementation. Instead, check in a much small DER-only parser in cryptography/hazmat. A quick benchmark suggests this parser is also faster than asn1crypto: from __future__ import absolute_import, division, print_function import timeit print(timeit.timeit( "decode_dss_signature(sig)", setup=r""" from cryptography.hazmat.primitives.asymmetric.utils import decode_dss_signature sig=b"\x30\x2d\x02\x15\x00\xb5\xaf\x30\x78\x67\xfb\x8b\x54\x39\x00\x13\xcc\x67\x02\x0d\xdf\x1f\x2c\x0b\x81\x02\x14\x62\x0d\x3b\x22\xab\x50\x31\x44\x0c\x3e\x35\xea\xb6\xf4\x81\x29\x8f\x9e\x9f\x08" """, number=10000)) Python 2.7: asn1crypto: 0.25 _der.py: 0.098 Python 3.5: asn1crypto: 0.17 _der.py: 0.10 * Remove test dependencies on asn1crypto. The remaining use of asn1crypto was some sanity-checking of Certificates. Add a minimal X.509 parser to extract the relevant fields. * Add a read_single_element helper function. The outermost read is a little tedious. * Address flake8 warnings * Fix test for long-form vs short-form lengths. Testing a zero length trips both this check and the non-minimal long form check. Use a one-byte length to cover the missing branch. * Remove support for negative integers. These never come up in valid signatures. Note, however, this does change public API. * Update src/cryptography/hazmat/primitives/asymmetric/utils.py Co-Authored-By: Alex Gaynor <alex.gaynor@gmail.com> * Review comments * Avoid hardcoding the serialization of NULL in decode_asn1.py too.
* fix osrandom/builtin switching methods for 1.1.0+ (#4955)Paul Kehrer2019-07-271-4/+6
| | | | | | | | | | * fix osrandom/builtin switching methods for 1.1.0+ In 1.1.0 RAND_cleanup became a no-op. This broke changing to the builtin random engine via activate_builtin_random(). Fixed by directly calling RAND_set_rand_method. This works on 1.0.x and 1.1.x * missed an assert
* ed25519 support in x509 certificate builder (#4937)Paul Kehrer2019-07-061-3/+15
| | | | | | | | | | * ed25519 support in x509 certificate builder This adds minimal ed25519 support. More to come. * Apply suggestions from code review Co-Authored-By: Alex Gaynor <alex.gaynor@gmail.com>
* Switch to new notBefore/After APIs (#4914)Rosen Penev2019-06-071-2/+2
| | | Introduced in OpenSSL 1.1. Added compatibility for older versions.
* Fixes #4830 -- handle negative serial numbers (#4843)Alex Gaynor2019-04-131-1/+4
|
* add new branch for unsupported openssh serialization (#4813)Paul Kehrer2019-03-181-2/+5
| | | | | we don't support ed448 openssh keys so we'll use that to test this branch. if we ever do support ed448 keys we can always just call this private method directly to keep coverage.
* add OpenSSH serialization for ed25519 keys (#4808) (#4811)bernhl2019-03-171-0/+7
| | | | | | * add OpenSSH serialization for ed25519 keys (#4808) * address review comments
* poly1305 support (#4802)Paul Kehrer2019-03-091-0/+13
| | | | | | | | | | | | | | | | | | | | * poly1305 support * some more tests * have I mentioned how bad the spellchecker is? * doc improvements * EVP_PKEY_new_raw_private_key copies the key but that's not documented Let's assume that might change and be very defensive * review feedback * add a test that fails on a tag of the correct length but wrong value * docs improvements
* support ed25519 openssh public keys (#4785)Paul Kehrer2019-02-271-4/+4
| | | | | | * support ed25519 openssh public keys * don't need this check
* ed448 support (#4610)Paul Kehrer2019-02-271-0/+43
| | | | | | | | * ed448 support * move the changelog entry * flake8
* ed25519 support (#4114)Paul Kehrer2019-02-261-0/+44
| | | | | | * ed25519 support * review feedback
* reduce our engine bindings even more (#4768)Paul Kehrer2019-02-251-9/+10
|
* support NO_ENGINE (#4763)Paul Kehrer2019-02-251-8/+9
| | | | | | | | * support OPENSSL_NO_ENGINE * support some new openssl config args * sigh
* why did we have these variables (#4764)Paul Kehrer2019-02-241-1/+1
|
* Simplify string formatting (#4757)Alex Gaynor2019-02-201-7/+7
|
* allow 32-bit platforms to encode certs with dates > unix epoch (#4727)Paul Kehrer2019-01-211-15/+6
| | | | | | | | | | | | | | | | | Previously we used unix timestamps, but now we are switching to using ASN1_TIME_set_string and automatically formatting the string based on the year. The rule is as follows: Per RFC 5280 (section 4.1.2.5.), the valid input time strings should be encoded with the following rules: 1. UTC: YYMMDDHHMMSSZ, if YY < 50 (20YY) --> UTC: YYMMDDHHMMSSZ 2. UTC: YYMMDDHHMMSSZ, if YY >= 50 (19YY) --> UTC: YYMMDDHHMMSSZ 3. G'd: YYYYMMDDHHMMSSZ, if YYYY >= 2050 --> G'd: YYYYMMDDHHMMSSZ 4. G'd: YYYYMMDDHHMMSSZ, if YYYY < 2050 --> UTC: YYMMDDHHMMSSZ Notably, Dates < 1950 are not valid UTCTime. At the moment we still reject dates < Jan 1, 1970 in all cases but a followup PR can fix that.
* bind EVP_R_MEMORY_LIMIT_EXCEEDED and update a test (#4726)Paul Kehrer2019-01-211-0/+4
| | | | | | | | | | | * bind EVP_R_MEMORY_LIMIT_EXCEEDED and update a test This will allow OpenSSL 1.1.1 on 32-bit (including our Windows 32-bit builders) to fail as expected. Technically this isn't a malloc error, but rather failing because the allocation requested is larger than 32-bits, but raising a MemoryError still seems appropriate * what you want an endif too?
* deprecate encode_point and migrate all internal callers (#4720)Paul Kehrer2019-01-201-1/+6
|
* add support for encoding compressed points (#4638)Paul Kehrer2019-01-201-0/+11
| | | | | | * add support for encoding compressed points * review feedback
* support byteslike in ConcatKDF{HMAC,Hash}, Scrypt, and X963KDF (#4709)Paul Kehrer2019-01-171-1/+2
| | | | | | | | * byteslike concatkdf * byteslike scrypt * byteslike x963kdf
* Support byteslike in HKDF and PBKDF2HMAC (#4707)Paul Kehrer2019-01-171-1/+2
| | | | | | | | * support byteslike in HKDF * support byteslike in PBKDF2HMAC * add missing docs
* support bytes-like for X25519PrivateKey.from_private_bytes (#4698)Paul Kehrer2019-01-171-6/+31
| | | yuck.
* x448 and x25519 should enforce key lengths in backend (#4703)Paul Kehrer2019-01-171-0/+9
| | | | | | | | | | | * x448 and x25519 should enforce key lengths in from_private_bytes they should also check if the algorithm is supported like the public bytes class methods do * oops * move the checks
* add support for byteslike password/data to load_{pem,der}_private_key (#4693)Paul Kehrer2019-01-161-3/+1
| | | | | | * add support for byteslike password/data to load_{pem,der}_private_key * pypy 5.4 can't do memoryview from_buffer
* support byteslike in X448PrivateKey.from_private_bytes (#4694)Paul Kehrer2019-01-151-1/+2
|
* add support for byteslike on password and data for pkcs12 loading (#4690)Paul Kehrer2019-01-151-13/+37
| | | | | | | | | | | | * add support for byteslike on password and data for pkcs12 loading * use a contextmanager to yield a null terminated buffer we can zero * review feedback * updated text * one last change
* Serialization x25519 (#4688)Paul Kehrer2019-01-141-0/+6
| | | | | | | | | | | | | | | | | * modify x25519 serialization to match x448 supports raw and pkcs8 encoding on private_bytes supports raw and subjectpublickeyinfo on public_bytes deprecates zero argument call to public_bytes * add docs * this is public now * don't need that * review feedback
* support x448 public/private serialization both raw and pkcs8 (#4653)Paul Kehrer2019-01-131-1/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * support x448 public/private serialization both raw and pkcs8 * add tests for all other asym key types to prevent Raw * more tests * better tests * fix a test * funny story, I'm actually illiterate. * pep8 * require PrivateFormat.Raw or PublicFormat.Raw with Encoding.Raw * missing docs * parametrize * docs fixes * remove dupe line * assert something
* Compressed point support (#4629)Paul Kehrer2018-12-111-0/+20
| | | | | | | | | | | | | | | | | | | | | | | | * compressed point support * refactor to use oct2point directly * small docs change * remove deprecation for the moment and a bit of review feedback * no backend arg, implicitly import it * missed a spot * double oops * remove superfluous call * use refactored method * use vector file * one last item
* ec key creation by curve name refactored into a method (#4634)Paul Kehrer2018-12-101-21/+10
| | | | | | * ec key creation by curve name refactored into a method * typo
* Adds a more descriptive error msg for wrong wrapping (#4504)André Almeida2018-12-081-3/+12
| | | | | | | | | | | | | | | | | | | | * PoC code for check PEM wrap * Remove PoC check wrap code * Add PEM file info to FAQ * Add FAQ/PEM link in exception message * Fix flake8 style issues * refactor, update language * it's really amazing how bad the spell checker is * review feedback * change to etc
* Raise MemoryError when backend.derive_scrypt can't malloc enough (#4592)Tux2018-12-081-1/+18
| | | | | | | | | | | | * Raise MemoryError when backend.derive_scrypt can't malloc enough * Expose ERR_R_MALLOC_FAILURE and use the reason_match pattern to catch it * Add test_scrypt_malloc_failure in test_scrypt * let's see if this passes * add comment to filippo's blog post about scrypt's params
* centralize our bytes check (#4622)Paul Kehrer2018-12-021-4/+4
| | | this will make life a bit easier when we support bytearrays
* PKCS12 Basic Parsing (#4553)Paul Kehrer2018-11-281-0/+46
| | | | | | | | | | | | | | | | | | * PKCS12 parsing support * running all the tests is so gauche * rename func * various significant fixes * dangerous idiot here * move pkcs12 * docs updates * a bit more prose
* Move SSH serialization to it's own file (#4607)Alex Gaynor2018-11-241-14/+12
| | | | | | * Move SSH serialization to it's own file * flake8
* refactor serialization module into package (#4606)Paul Kehrer2018-11-231-11/+14
| | | | | | * refactor serialization into a package so we can add a pkcs12 module * oops
* Added comments reminding us to improve this code when we go 1.1.1+ only (#4605)Alex Gaynor2018-11-231-0/+4
|
* X448 support (#4580)Paul Kehrer2018-11-221-0/+29
| | | | | | | | | | | | | | | | | | | | * x448 support This work was originally authored by derwolfe * update docs to have a more useful derived key length * error if key is not a valid length in from_public_bytes * one more * switch to using evp_pkey_keygen_gc for x448 keygen * review feedback * switch to using evp_pkey_derive * nit fix
* refactor x25519 keygen into evp_pkey_keygen (#4587)Paul Kehrer2018-11-131-7/+7
| | | this allows us to use the same code for ed25519, x448, and ed448
* create & use _evp_md_from_algorithm and _evp_md_non_null_from_algorithm (#4542)Paul Kehrer2018-10-291-28/+18
| | | | | | * create & use _evp_md_from_algorithm and _evp_md_non_null_from_algorithm * remove unused import
* OCSP response builder (#4485)Paul Kehrer2018-10-281-1/+103
| | | | | | | | * ocsp response builder * better prose * review changes
* add _create_asn1_time (#4524)Paul Kehrer2018-10-241-12/+10
|
* refactor set_asn1_time to take a datetime (#4516)Paul Kehrer2018-10-231-14/+7
|
* support extensions in the OCSP request builder (#4481)Paul Kehrer2018-10-061-0/+8
| | | | | | | | | | * support extensions in the OCSP request builder * cover a missed branch * refactor to use new func * review feedback
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-13 02:39:46 +0000