aboutsummaryrefslogtreecommitdiffstats
path: root/src/cryptography/hazmat/primitives
Commit message (Collapse)AuthorAgeFilesLines
* Deal with the 2.5 deprecations (#5048)Alex Gaynor2019-11-032-3/+3
| | | | | | | | | | | | * Deal with the 2.5 deprecations * pep8 + test fixes * docs typo * Why did I do this? * typo
* Don't bother computing y coefficient in _modinv (#5037)Clayton Smith2019-10-291-3/+3
|
* Make DER reader into a context manager (#4957)Alex Gaynor2019-07-281-5/+4
| | | | | | | | * Make DER reader into a context manager * Added another test case * flake8
* Remove asn1crypto dependency (#4941)David Benjamin2019-07-281-13/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Remove non-test dependencies on asn1crypto. cryptography.io actually contains two OpenSSL bindings right now, the expected cffi one, and an optional one hidden in asn1crypto. asn1crypto contains a lot of things that cryptography.io doesn't use, including a BER parser and a hand-rolled and not constant-time EC implementation. Instead, check in a much small DER-only parser in cryptography/hazmat. A quick benchmark suggests this parser is also faster than asn1crypto: from __future__ import absolute_import, division, print_function import timeit print(timeit.timeit( "decode_dss_signature(sig)", setup=r""" from cryptography.hazmat.primitives.asymmetric.utils import decode_dss_signature sig=b"\x30\x2d\x02\x15\x00\xb5\xaf\x30\x78\x67\xfb\x8b\x54\x39\x00\x13\xcc\x67\x02\x0d\xdf\x1f\x2c\x0b\x81\x02\x14\x62\x0d\x3b\x22\xab\x50\x31\x44\x0c\x3e\x35\xea\xb6\xf4\x81\x29\x8f\x9e\x9f\x08" """, number=10000)) Python 2.7: asn1crypto: 0.25 _der.py: 0.098 Python 3.5: asn1crypto: 0.17 _der.py: 0.10 * Remove test dependencies on asn1crypto. The remaining use of asn1crypto was some sanity-checking of Certificates. Add a minimal X.509 parser to extract the relevant fields. * Add a read_single_element helper function. The outermost read is a little tedious. * Address flake8 warnings * Fix test for long-form vs short-form lengths. Testing a zero length trips both this check and the non-minimal long form check. Use a one-byte length to cover the missing branch. * Remove support for negative integers. These never come up in valid signatures. Note, however, this does change public API. * Update src/cryptography/hazmat/primitives/asymmetric/utils.py Co-Authored-By: Alex Gaynor <alex.gaynor@gmail.com> * Review comments * Avoid hardcoding the serialization of NULL in decode_asn1.py too.
* add class methods for poly1305 sign verify operations (#4932)Jeff Yang2019-07-081-0/+12
|
* poly1305 support (#4802)Paul Kehrer2019-03-091-0/+43
| | | | | | | | | | | | | | | | | | | | * poly1305 support * some more tests * have I mentioned how bad the spellchecker is? * doc improvements * EVP_PKEY_new_raw_private_key copies the key but that's not documented Let's assume that might change and be very defensive * review feedback * add a test that fails on a tag of the correct length but wrong value * docs improvements
* Improve deprecation warning to specify the release (#4804)Josh Soref2019-03-081-2/+2
|
* remove maccontext (#4803)Paul Kehrer2019-03-073-41/+2
|
* support ed25519 openssh public keys (#4785)Paul Kehrer2019-02-272-1/+16
| | | | | | * support ed25519 openssh public keys * don't need this check
* ed448 support (#4610)Paul Kehrer2019-02-271-0/+79
| | | | | | | | * ed448 support * move the changelog entry * flake8
* ed25519 support (#4114)Paul Kehrer2019-02-261-0/+80
| | | | | | * ed25519 support * review feedback
* add an EC OID to curve dictionary mapping (#4759)Paul Kehrer2019-02-201-0/+33
| | | | | | | | | | * add an EC OID to curve dictionary mapping * oid_to_curve function * changelog and docs fix * rename to get_curve_for_oid
* Simplify string formatting (#4757)Alex Gaynor2019-02-207-10/+10
|
* Fixes #4734 -- Deal with deprecated things (#4736)Alex Gaynor2019-01-232-23/+1
| | | | | | | | | | * Fixes #4734 -- Deal with deprecated things - Make year based aliases of PersistentlyDeprecated so we can easily assess age - Removed encode/decode rfc6979 signature - Removed Certificate.serial * Unused import
* deprecate encode_point and migrate all internal callers (#4720)Paul Kehrer2019-01-201-0/+8
|
* add support for encoding compressed points (#4638)Paul Kehrer2019-01-201-0/+3
| | | | | | * add support for encoding compressed points * review feedback
* shake128/256 support (#4611)Paul Kehrer2019-01-191-0/+41
| | | | | | | | | | | | | | * shake128/256 support * remove block_size * doc an exception * change how we detect XOF by adding _xof attribute * interface! * review feedback
* support byteslike in KBKDFHMAC (#4711)Paul Kehrer2019-01-171-1/+1
|
* support byteslike in ConcatKDF{HMAC,Hash}, Scrypt, and X963KDF (#4709)Paul Kehrer2019-01-173-3/+3
| | | | | | | | * byteslike concatkdf * byteslike scrypt * byteslike x963kdf
* Support byteslike in HKDF and PBKDF2HMAC (#4707)Paul Kehrer2019-01-172-3/+3
| | | | | | | | * support byteslike in HKDF * support byteslike in PBKDF2HMAC * add missing docs
* x448 and x25519 should enforce key lengths in backend (#4703)Paul Kehrer2019-01-172-3/+12
| | | | | | | | | | | * x448 and x25519 should enforce key lengths in from_private_bytes they should also check if the algorithm is supported like the public bytes class methods do * oops * move the checks
* support byteslike in hmac update (#4705)Paul Kehrer2019-01-171-1/+1
| | | needed for some KDF keying material
* support byteslike in hash updates (#4702)Paul Kehrer2019-01-161-1/+1
| | | This is needed to handle keying material in some of the KDFs
* support byteslike in aead for key and nonce (#4695)Paul Kehrer2019-01-151-6/+6
|
* Serialization x25519 (#4688)Paul Kehrer2019-01-142-2/+11
| | | | | | | | | | | | | | | | | * modify x25519 serialization to match x448 supports raw and pkcs8 encoding on private_bytes supports raw and subjectpublickeyinfo on public_bytes deprecates zero argument call to public_bytes * add docs * this is public now * don't need that * review feedback
* support x448 public/private serialization both raw and pkcs8 (#4653)Paul Kehrer2019-01-132-2/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * support x448 public/private serialization both raw and pkcs8 * add tests for all other asym key types to prevent Raw * more tests * better tests * fix a test * funny story, I'm actually illiterate. * pep8 * require PrivateFormat.Raw or PublicFormat.Raw with Encoding.Raw * missing docs * parametrize * docs fixes * remove dupe line * assert something
* handle empty byte string in from_encoded_point (#4649)Paul Kehrer2018-12-171-0/+4
| | | | | | * handle empty byte string in from_encoded_point * move the error
* deprecate old from_encoded_point (#4640)Paul Kehrer2018-12-111-0/+9
|
* Compressed point support (#4629)Paul Kehrer2018-12-112-2/+13
| | | | | | | | | | | | | | | | | | | | | | | | * compressed point support * refactor to use oct2point directly * small docs change * remove deprecation for the moment and a bit of review feedback * no backend arg, implicitly import it * missed a spot * double oops * remove superfluous call * use refactored method * use vector file * one last item
* allow bytes-like for key/iv/data for symmetric encryption (#4621)Paul Kehrer2018-12-092-9/+9
| | | | | | | | | | | | | | | | | | * allow bytearrays for key/iv for symmetric encryption * bump pypy/cffi requirements * update docs, fix some tests * old openssl is naught but pain * revert a typo * use trusty for old pypy * better error msg again * restore match
* Updated BLAKE2s and BLAKE2b error messages from unsupportedalgorithm … (#4519)Colin Metcalf2018-12-081-14/+6
| | | | | | | | | | | | | | | | | * Updated BLAKE2s and BLAKE2b error messages from unsupportedalgorithm exception to an explicit error. The error is now "ValueError: Digest size must be 32" (or 64 for BLAKE2b) This was done to give a more contextual error message and should be in place until OpenSSL supports variable lengths. * Updated if statements in hashes.py so that they no longer wrap to separate line. Updated test_hashes.py to unclude a test for non 32 or 64 digest_sizes that fall between 0-32/64. * Removed the new tests in test_hashes.py as the old ones were satisfactory. This also solved misaligned tabs and spaces. * Removed dead code in hashes.py that could no longer be reached after error message updates. * pep8 fix * remove superfluous parens
* centralize our bytes check (#4622)Paul Kehrer2018-12-0212-77/+40
| | | this will make life a bit easier when we support bytearrays
* PKCS12 Basic Parsing (#4553)Paul Kehrer2018-11-281-0/+9
| | | | | | | | | | | | | | | | | | * PKCS12 parsing support * running all the tests is so gauche * rename func * various significant fixes * dangerous idiot here * move pkcs12 * docs updates * a bit more prose
* Move SSH serialization to it's own file (#4607)Alex Gaynor2018-11-243-134/+146
| | | | | | * Move SSH serialization to it's own file * flake8
* refactor serialization module into package (#4606)Paul Kehrer2018-11-232-0/+21
| | | | | | * refactor serialization into a package so we can add a pkcs12 module * oops
* X448 support (#4580)Paul Kehrer2018-11-221-0/+61
| | | | | | | | | | | | | | | | | | | | * x448 support This work was originally authored by derwolfe * update docs to have a more useful derived key length * error if key is not a valid length in from_public_bytes * one more * switch to using evp_pkey_keygen_gc for x448 keygen * review feedback * switch to using evp_pkey_derive * nit fix
* add sha3 support (#4573)Paul Kehrer2018-11-221-0/+24
| | | | | | | | * add sha3 support * missed versionadded * add prose, remove block_size
* error if the key length for x25519 isn't 32 bytes (#4584)Paul Kehrer2018-11-121-0/+4
| | | | | | * error if the key length for x25519 isn't 32 bytes * also test 33
* add SHA512/224 and SHA512/256 support (#4575)Paul Kehrer2018-11-121-0/+14
| | | | | | * add SHA512/224 and SHA512/256 support * add missing docs
* add a little bit of x25519 interface docs we missed (#4574)Paul Kehrer2018-11-121-3/+9
|
* add a few more EC OIDs (#4572)Paul Kehrer2018-11-111-0/+13
| | | | | | * add a few more EC OIDs * spaces matter
* add EC OIDs (#4435)Paul Kehrer2018-10-301-0/+10
| | | | | | * add EC OIDs * move ec oid docs to bottom
* Refs #4375 -- integrate wycheproof AES CCM tests (#4379)Alex Gaynor2018-08-021-1/+1
| | | | | | * Refs #4375 -- integrate wycheproof AES CCM tests * Skip these tests if we don't have CCM support
* sign is a method (#4362)Paul Kehrer2018-07-201-1/+1
|
* also check iv length for GCM nonce in AEAD (#4350)Paul Kehrer2018-07-171-0/+2
| | | | | | * also check iv length for GCM nonce in AEAD * ugh
* raise ValueError on zero length GCM IV (#4348)Paul Kehrer2018-07-171-0/+2
|
* disallow implicit tag truncation with finalize_with_tag (#4342)Paul Kehrer2018-07-171-0/+1
|
* Change the exception we raise in keywrap unwrapping on invalid length (#4337)Alex Gaynor2018-07-161-3/+3
| | | I believe this can reasonably be considered backwards compatible since other invalid inputs already lead to InvalidUnwrap, and clients shouldn't be distinguishing between these two conditions, and ValueError wasn't documented anyways.
* document one shot AEAD length restrictions (#4322)Paul Kehrer2018-07-141-0/+24
| | | | | | | | | | | | | | * document one shot AEAD length restrictions * write a test that won't consume infinity ram continue to raise OverflowError since that's what cffi did. * this applies to associated_data too * remove unneeded arg * review feedback on docs
* since the generator order is 570 bits this should be 570 (#4307)Paul Kehrer2018-07-041-1/+1
| | | but key_size is nonsense and we'll deprecate it next
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-28 08:11:40 +0000