aboutsummaryrefslogtreecommitdiffstats
path: root/src/cryptography/hazmat/backends
Commit message (Collapse)AuthorAgeFilesLines
* See if we can remove an OpenSSL 1.0.1 workaround (#5184)Alex Gaynor2020-04-061-8/+0
|
* Replace floating point arithmetic with integer arithmetic (#5181)Torin Carey2020-04-041-3/+1
|
* Drop support for OpenSSL 1.0.1 (#5178)Alex Gaynor2020-04-043-23/+4
|
* Use literals for collections and comprehensions. (#5091)Mads Jensen2020-01-121-1/+1
|
* Fixes #5065 -- skip serialization tests which use RC2 if OpenSSL doesn't ↵Alex Gaynor2019-11-251-0/+9
| | | | | | | | have RC2 (#5072) * Refs #5065 -- have a CI job with OpenSSL built with no-rc2 * Fixes #5065 -- skip serialization tests which use RC2 if OpenSSL doesn't have RC2
* Parse single_extensions in OCSP responses (#5059)Paul Kehrer2019-11-112-1/+19
| | | | | | | | | | | | * add single_extensions to OCSPResponse (#4753) * new vector, updateed docs, more stringent parser, changelog, etc * simplify PR (no SCT for now) * add a comment * finish pulling out the sct stuff so tests might actually run
* Deal with the 2.5 deprecations (#5048)Alex Gaynor2019-11-031-15/+1
| | | | | | | | | | | | * Deal with the 2.5 deprecations * pep8 + test fixes * docs typo * Why did I do this? * typo
* UniversalString needs to be encoded as UCS-4 (#5000)Marko Kreen2019-10-171-0/+2
|
* update openssls (#4995)Paul Kehrer2019-10-151-3/+15
| | | | | | | | | | * update openssls * missed one * what will this do * only do this check for 1.1.0+
* Finish ed25519 and ed448 support in x509 module (#4972)Marko Kreen2019-09-091-14/+32
| | | | | | | | | | | | | | | | | | * Support ed25519 in csr/crl creation * Tests for ed25519/x509 * Support ed448 in crt/csr/crl creation * Tests for ed448/x509 * Support ed25519/ed448 in OCSPResponseBuilder * Tests for eddsa in OCSPResponseBuilder * Builder check missing in create_x509_csr * Documentation update for ed25519+ed448 in x509
* be clear that NoEncryption must be an instance in the exception (#4985)Paul Kehrer2019-09-074-4/+4
|
* Allow FreshestCRL extension in CRL (#4975)Marko Kreen2019-09-072-0/+2
| | | Per RFC5280 it is allowed in both certificates and CRL-s.
* Remove asn1crypto dependency (#4941)David Benjamin2019-07-282-18/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Remove non-test dependencies on asn1crypto. cryptography.io actually contains two OpenSSL bindings right now, the expected cffi one, and an optional one hidden in asn1crypto. asn1crypto contains a lot of things that cryptography.io doesn't use, including a BER parser and a hand-rolled and not constant-time EC implementation. Instead, check in a much small DER-only parser in cryptography/hazmat. A quick benchmark suggests this parser is also faster than asn1crypto: from __future__ import absolute_import, division, print_function import timeit print(timeit.timeit( "decode_dss_signature(sig)", setup=r""" from cryptography.hazmat.primitives.asymmetric.utils import decode_dss_signature sig=b"\x30\x2d\x02\x15\x00\xb5\xaf\x30\x78\x67\xfb\x8b\x54\x39\x00\x13\xcc\x67\x02\x0d\xdf\x1f\x2c\x0b\x81\x02\x14\x62\x0d\x3b\x22\xab\x50\x31\x44\x0c\x3e\x35\xea\xb6\xf4\x81\x29\x8f\x9e\x9f\x08" """, number=10000)) Python 2.7: asn1crypto: 0.25 _der.py: 0.098 Python 3.5: asn1crypto: 0.17 _der.py: 0.10 * Remove test dependencies on asn1crypto. The remaining use of asn1crypto was some sanity-checking of Certificates. Add a minimal X.509 parser to extract the relevant fields. * Add a read_single_element helper function. The outermost read is a little tedious. * Address flake8 warnings * Fix test for long-form vs short-form lengths. Testing a zero length trips both this check and the non-minimal long form check. Use a one-byte length to cover the missing branch. * Remove support for negative integers. These never come up in valid signatures. Note, however, this does change public API. * Update src/cryptography/hazmat/primitives/asymmetric/utils.py Co-Authored-By: Alex Gaynor <alex.gaynor@gmail.com> * Review comments * Avoid hardcoding the serialization of NULL in decode_asn1.py too.
* fix osrandom/builtin switching methods for 1.1.0+ (#4955)Paul Kehrer2019-07-271-4/+6
| | | | | | | | | | * fix osrandom/builtin switching methods for 1.1.0+ In 1.1.0 RAND_cleanup became a no-op. This broke changing to the builtin random engine via activate_builtin_random(). Fixed by directly calling RAND_set_rand_method. This works on 1.0.x and 1.1.x * missed an assert
* ed25519 support in x509 certificate builder (#4937)Paul Kehrer2019-07-061-3/+15
| | | | | | | | | | * ed25519 support in x509 certificate builder This adds minimal ed25519 support. More to come. * Apply suggestions from code review Co-Authored-By: Alex Gaynor <alex.gaynor@gmail.com>
* Switch to new notBefore/After APIs (#4914)Rosen Penev2019-06-072-4/+4
| | | Introduced in OpenSSL 1.1. Added compatibility for older versions.
* Only EVP_CTRL_AEAD_SET_TAG in _aead_setup for CCM mode (#4916)Christian Heimes2019-06-051-1/+2
|
* fix aia encoding memory leak (#4889)Paul Kehrer2019-05-181-12/+15
| | | | | | * fix aia encoding memory leak * don't return anything from the prealloc func
* Fixes #4830 -- handle negative serial numbers (#4843)Alex Gaynor2019-04-131-1/+4
|
* fix a memory leak in AIA parsing (#4836)Paul Kehrer2019-04-111-1/+8
| | | | | | * fix a memory leak in AIA parsing * oops can't remove that
* add new branch for unsupported openssh serialization (#4813)Paul Kehrer2019-03-181-2/+5
| | | | | we don't support ed448 openssh keys so we'll use that to test this branch. if we ever do support ed448 keys we can always just call this private method directly to keep coverage.
* add OpenSSH serialization for ed25519 keys (#4808) (#4811)bernhl2019-03-171-0/+7
| | | | | | * add OpenSSH serialization for ed25519 keys (#4808) * address review comments
* poly1305 support (#4802)Paul Kehrer2019-03-092-0/+73
| | | | | | | | | | | | | | | | | | | | * poly1305 support * some more tests * have I mentioned how bad the spellchecker is? * doc improvements * EVP_PKEY_new_raw_private_key copies the key but that's not documented Let's assume that might change and be very defensive * review feedback * add a test that fails on a tag of the correct length but wrong value * docs improvements
* remove maccontext (#4803)Paul Kehrer2019-03-073-6/+4
|
* support ed25519 openssh public keys (#4785)Paul Kehrer2019-02-272-8/+5
| | | | | | * support ed25519 openssh public keys * don't need this check
* ed448 support (#4610)Paul Kehrer2019-02-272-0/+197
| | | | | | | | * ed448 support * move the changelog entry * flake8
* ed25519 support (#4114)Paul Kehrer2019-02-262-0/+198
| | | | | | * ed25519 support * review feedback
* reduce our engine bindings even more (#4768)Paul Kehrer2019-02-251-9/+10
|
* support NO_ENGINE (#4763)Paul Kehrer2019-02-251-8/+9
| | | | | | | | * support OPENSSL_NO_ENGINE * support some new openssl config args * sigh
* why did we have these variables (#4764)Paul Kehrer2019-02-241-1/+1
|
* Simplify string formatting (#4757)Alex Gaynor2019-02-2011-33/+33
|
* Fixes #4734 -- Deal with deprecated things (#4736)Alex Gaynor2019-01-232-11/+1
| | | | | | | | | | * Fixes #4734 -- Deal with deprecated things - Make year based aliases of PersistentlyDeprecated so we can easily assess age - Removed encode/decode rfc6979 signature - Removed Certificate.serial * Unused import
* allow 32-bit platforms to encode certs with dates > unix epoch (#4727)Paul Kehrer2019-01-211-15/+6
| | | | | | | | | | | | | | | | | Previously we used unix timestamps, but now we are switching to using ASN1_TIME_set_string and automatically formatting the string based on the year. The rule is as follows: Per RFC 5280 (section 4.1.2.5.), the valid input time strings should be encoded with the following rules: 1. UTC: YYMMDDHHMMSSZ, if YY < 50 (20YY) --> UTC: YYMMDDHHMMSSZ 2. UTC: YYMMDDHHMMSSZ, if YY >= 50 (19YY) --> UTC: YYMMDDHHMMSSZ 3. G'd: YYYYMMDDHHMMSSZ, if YYYY >= 2050 --> G'd: YYYYMMDDHHMMSSZ 4. G'd: YYYYMMDDHHMMSSZ, if YYYY < 2050 --> UTC: YYMMDDHHMMSSZ Notably, Dates < 1950 are not valid UTCTime. At the moment we still reject dates < Jan 1, 1970 in all cases but a followup PR can fix that.
* bind EVP_R_MEMORY_LIMIT_EXCEEDED and update a test (#4726)Paul Kehrer2019-01-211-0/+4
| | | | | | | | | | | * bind EVP_R_MEMORY_LIMIT_EXCEEDED and update a test This will allow OpenSSL 1.1.1 on 32-bit (including our Windows 32-bit builders) to fail as expected. Technically this isn't a malloc error, but rather failing because the allocation requested is larger than 32-bits, but raising a MemoryError still seems appropriate * what you want an endif too?
* deprecate encode_point and migrate all internal callers (#4720)Paul Kehrer2019-01-201-1/+6
|
* add support for encoding compressed points (#4638)Paul Kehrer2019-01-202-7/+61
| | | | | | * add support for encoding compressed points * review feedback
* shake128/256 support (#4611)Paul Kehrer2019-01-191-5/+20
| | | | | | | | | | | | | | * shake128/256 support * remove block_size * doc an exception * change how we detect XOF by adding _xof attribute * interface! * review feedback
* support byteslike in ConcatKDF{HMAC,Hash}, Scrypt, and X963KDF (#4709)Paul Kehrer2019-01-171-1/+2
| | | | | | | | * byteslike concatkdf * byteslike scrypt * byteslike x963kdf
* Support byteslike in HKDF and PBKDF2HMAC (#4707)Paul Kehrer2019-01-171-1/+2
| | | | | | | | * support byteslike in HKDF * support byteslike in PBKDF2HMAC * add missing docs
* support bytes-like for X25519PrivateKey.from_private_bytes (#4698)Paul Kehrer2019-01-171-6/+31
| | | yuck.
* x448 and x25519 should enforce key lengths in backend (#4703)Paul Kehrer2019-01-171-0/+9
| | | | | | | | | | | * x448 and x25519 should enforce key lengths in from_private_bytes they should also check if the algorithm is supported like the public bytes class methods do * oops * move the checks
* support byteslike in hmac update (#4705)Paul Kehrer2019-01-171-1/+2
| | | needed for some KDF keying material
* support byteslike in hash updates (#4702)Paul Kehrer2019-01-161-1/+4
| | | This is needed to handle keying material in some of the KDFs
* support bytes-like keys in CMAC and HMAC contexts (#4701)Paul Kehrer2019-01-162-2/+4
|
* add support for byteslike password/data to load_{pem,der}_private_key (#4693)Paul Kehrer2019-01-161-3/+1
| | | | | | * add support for byteslike password/data to load_{pem,der}_private_key * pypy 5.4 can't do memoryview from_buffer
* support byteslike in aead for key and nonce (#4695)Paul Kehrer2019-01-151-2/+4
|
* support byteslike in X448PrivateKey.from_private_bytes (#4694)Paul Kehrer2019-01-151-1/+2
|
* add support for byteslike on password and data for pkcs12 loading (#4690)Paul Kehrer2019-01-151-13/+37
| | | | | | | | | | | | * add support for byteslike on password and data for pkcs12 loading * use a contextmanager to yield a null terminated buffer we can zero * review feedback * updated text * one last change
* Remove a dead assignment (#4692)Alex Gaynor2019-01-151-1/+0
|
* Serialization x25519 (#4688)Paul Kehrer2019-01-143-6/+100
| | | | | | | | | | | | | | | | | * modify x25519 serialization to match x448 supports raw and pkcs8 encoding on private_bytes supports raw and subjectpublickeyinfo on public_bytes deprecates zero argument call to public_bytes * add docs * this is public now * don't need that * review feedback
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-27 12:53:45 +0000