aboutsummaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* X25519 Support (#3686)Paul Kehrer2017-06-093-0/+179
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * early days * sort of working * more things * remove private_bytes * public bytes, interface fix * load public keys * x25519 support basically done now * private_bytes is gone * some reminders * doctest this too * remove a thing that doesn't matter * x25519 supported checks * libressl has the NID, but a different API, so check for OpenSSL * pep8 * add missing coverage * update to use reasons * expand test a little * add changelog entry * review feedback
* ChaCha20Poly1305 support (#3680)Paul Kehrer2017-06-084-0/+177
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * chacha20poly1305 support * add chacha20poly1305 backend and some fixes * refactor * forgot to remove this * pep8 * review feedback and a lot of type/value checking * review feedback * raise unsupportedalgorithm when creating a ChaCha20Poly1305 object if it's not supported. * switch to ciphertext||tag * typo * remove a branch we don't need * review feedback * decrypts is *also* a word * use reasons
* bind even more evp (#3684)Paul Kehrer2017-06-062-4/+10
| | | | | | * bind even more evp * oops
* bind EVP_PKEY_get1_tls_encodedpoint because X25519 (#3682)Paul Kehrer2017-06-052-0/+14
|
* add EVP_PKEY_keygen and EVP_PKEY_keygen_init for x25519/ed25519 (#3681)Paul Kehrer2017-06-051-0/+6
| | | | | | * add EVP_PKEY_keygen and EVP_PKEY_keygen_init for x25519/ed25519 * add a few more bindings we'll need for X25519
* bind EVP_CTRL_AEAD even when on < 1.1.0 (#3679)Paul Kehrer2017-06-042-7/+18
|
* Refs #3461 -- parse SCTs from x.509 extension (#3480)Alex Gaynor2017-06-044-3/+99
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Stub API for SCTs, feedback wanted * grr, flake8 * finish up the __init__ * Initial implementation and tests * write a test. it fails because computer * get the tests passing and fix some TODOs * changelog entry * This can go now * Put a skip in this test * grump * Removed unreachable code * moved changelog to the correct section * Use the deocrator for expressing requirements * This needs f for the right entry_type * coverage * syntax error * tests for coverage * better sct eq tests * docs * technically correct, the most useless kind of correct * typo and more details * bug * drop __eq__
* deprecate signer/verifier on asymmetric keys (#3663)Paul Kehrer2017-06-034-3/+24
| | | | | | * deprecate signer/verifier on asymmetric keys * review feedback, switch deprecated_call to work around a bug
* make signature and verification contexts error better re: prehashed (#3658)Paul Kehrer2017-06-024-3/+17
| | | | | | * make signature and verification contexts error better re: prehashed * code review feedback
* runtime detection of getentropy for macOS via weak-linking (#3650)Paul Kehrer2017-05-302-22/+55
| | | | | | | | | | | | | | | | | | | | | | | | | * runtime detection of getentropy for macOS via weak-linking In the before time, in the long long ago, there was a desire to use getentropy on macOS. So some code was written and it detected getentropy support by seeing if SYS_getentropy was available in the headers. But lo, it turns out Apple ships headers for different SDK versions and users on < 10.12 were getting headers that had SYS_getentropy even though their OS did not support it. There was much wailing and gnashing of teeth, but the frustrated developers remembered that Apple wants their developers to use weak linking. With weak linking the mighty developer can specify a minimum version and any symbol that was added after that version will be weakly linked. Then, at runtime, the dynamic linker will make unavailable symbols thus marked into NULLs. So, the developer need only alter their code to do runtime detection of weakly linked symbols and then a single binary may be compiled that will correctly select getentropy or /dev/urandom at runtime. Hallelujah! * oops * separate the enum * okay just apple
* move files to make the next PR easier to read (#3651)Paul Kehrer2017-05-301-43/+43
|
* Remove a binding that hasn't been used for a while (#3643)Alex Gaynor2017-05-301-7/+0
|
* Post release tasks to open master for 2.0 (#3644)Alex Gaynor2017-05-292-2/+2
|
* 1.9 version bump and changelog (#3641)Paul Kehrer2017-05-291-1/+1
|
* Enlarge _oid2txt buffer to handle larger OIDs (#3612)Fraser Tweedale2017-05-291-0/+14
| | | | | | | | | The OpenSSL manual recommends a buffer size of 80 for OBJ_oid2txt: https://www.openssl.org/docs/crypto/OBJ_nid2ln.html#return_values. But OIDs longer than this occur in real life (e.g. Active Directory makes some very long OIDs). If the length of the stringified OID exceeds the buffer size, allocate a new buffer that is big enough to hold the stringified OID, and re-do the conversion into the new buffer.
* move MACContext to mac.py and eliminate interfaces.py (#3631)Paul Kehrer2017-05-296-8/+25
| | | | | | | | | | | | | * move MACContext to mac.py and eliminate interfaces.py finally * improve title * re-add and deprecate interfaces.MACContext * use pytest.warns instead of deprecated_call The pytest docs insist that deprecation warnings are handled differently and that you should use deprecated_call, but this works so okay then
* Simplify int to hex string conversion (#3628)Alex Gaynor2017-05-281-3/+3
|
* fix libressl error/refactor some error handling (#3609)Paul Kehrer2017-05-264-44/+54
| | | | | | | | | | | | | | | | | | | | | | | * add libre so I can see the error * add the libre error needed and refactor error handling a bit We were historically matching on lib + func + reason, but func is somewhat unstable so now we match on lib + reason only. Of course, in this case libressl changed both lib and reason so it wouldn't have mattered. All error handling from the error queue in openssl is an illusion * fix a typo, probably an unneeded branch * review feedback * refactor tests to support libressl insert additional rant about libre here, although admittedly these tests were assuming stability where openssl itself guarantees none * better assert, fix flake8
* Document when OpenSSL changed its default (#3611)Alex Gaynor2017-05-251-1/+1
| | | | | | | | | | * Figure out when this came into existance by deleting it * Revert "Figure out when this came into existance by deleting it" This reverts commit 2fb9b8e104742bfa12eb5feedccebacfc23c66bb. * Clearly document when this became true
* jurisdictionCountryName also must be PrintableString (#3516)Alex Gaynor2017-05-252-3/+11
| | | | | | | | | | | | | | * jurisdictionCountryName also must be PrintableString * flake8 + citation * Write a test, which fails. If my analysis is correct, this is blocked on: https://github.com/openssl/openssl/pull/3284 * This is only true on 1.1.0 * clearly express the version requirement
* fix compilation on 1.1.0f (#3603)Paul Kehrer2017-05-251-2/+4
|
* Put the exchange method on the correct interface (#3591)Alex Gaynor2017-05-241-7/+7
| | | | | | * Put the exchange method on the correct interface * fixed links in docs
* allow global suppression of link flags (#3592)Paul Kehrer2017-05-241-24/+11
| | | | | CRYPTOGRAPHY_SUPPRESS_LINK_FLAGS will now suppress link flags regardless of platform. Additionally, CRYPTOGRAPHY_WINDOWS_LINK_LEGACY_OPENSSL is now the flag you need if you want to link against < 1.1.0 on windows.
* add convenience methods for key_size on EC{Public,Private}Key (#3587)Paul Kehrer2017-05-232-1/+21
|
* Simplify the update (#3586)Alex Gaynor2017-05-231-7/+3
| | | | | | * Simplify the update * wtf, cant reproduce issue
* Bump the minimum PyPy/cffi version and simplify as a result (#3585)Alex Gaynor2017-05-231-27/+7
| | | | | | | | * Bump the minimum PyPy/cffi version and simplify as a result * unused imports * grumble, fix
* let's deprecate some hashes we should never have exposed (#3584)Paul Kehrer2017-05-231-0/+16
|
* Fix deprecation warning (#3574)Alex Gaynor2017-05-231-1/+5
|
* Deprecate Python 3.3 support, with the intention of being removed in the ↵Alex Gaynor2017-05-221-0/+6
| | | | | | | | next release (#3566) * Deprecate Python 3.3 support, with the intention of being removed in the next release * whoops
* add the x25519 NID (#3560)Paul Kehrer2017-05-202-0/+12
|
* Fixed #3533 -- made GCM mode object immutable (#3553)Alex Gaynor2017-05-204-39/+41
| | | | | | | | | | | | | | | | | | | | | | | | * Fixed #3533 -- made GCM mode object immutable * flake8 * Fix for older openssl * fix * fix * sigh, fix * fixed * dropped negation * computers are bad * A test * This implements an interface
* remove multibackend (#3555)Paul Kehrer2017-05-202-531/+2
| | | | | | | | * remove multibackend * oops * goodbye pointless tests
* More accurate LibreSSL detection (#3530)Moriyoshi Koizumi2017-05-201-0/+8
| | | | | | | | * More accurate LibreSSL detection * Update x509_vfy.py change approach to use ifndef
* time to remove commoncrypto, fare thee well (#3551)Paul Kehrer2017-05-2025-1715/+3
| | | | | | | | | | | | | | | | * time to remove commoncrypto, fare thee well * remove even more * update the changelog * remove more things * don't need this function * remove CAST5 CTR tests since that was only supported in commoncrypto * assert a thing
* Don't raise an UnsupportedExtension for critical extensions. (#3550)Alex Gaynor2017-05-204-17/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | * Don't raise an UnsupportedExtension for critical extensions. Fixes #2903 Fixes #2901 Fixes #3325 * Don't link * Revert "Don't link" This reverts commit 4fe847f91d9dd45cdc28a4984c4e44aad62a5de6. * fix * Revert "Revert "Don't link"" This reverts commit 856031b5a1fbad04ac218fa94ebf37dcd402f3ed. * fix * Deprecate this * Better changelog entry
* Add PEM_write_bio_DHxparams, d2i_DHxparams_bio, i2d_DHxparams_bio (#3485)Aviv Palivoda2017-05-193-0/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | * Add PEM_write_bio_DHxparams * Define PEM_write_bio_DHxparams only if EVP_PKEY_DHX defined. Both added in commit afb14cda in openssl * Add d2i_DHxparams_bio and i2d_DHxparams_bio bindings * Fix bindings addition * change condtional bindings to be after 1.1.0f * Change i2d_DHxparams_bio return type * define Cryptography_d2i_DHxparams_bio and Cryptography_i2d_DHxparams_bio * Remove d2i_DHxparams_bio, i2d_DHxparams_bio bindings * Add declarations for Cryptography_d2i_DHxparams_bio and Cryptography_i2d_DHxparams_bio * Move Cryptography_d2i_DHxparams_bio and Cryptography_i2d_DHxparams_bio declaration to MACROS * Add Cryptography_d2i_DHxparams_bio, Cryptography_i2d_DHxparams_bio and PEM_write_bio_DHxparams to _coditionals.py * Make sure we did not define EVP_PKEY_DHX
* Added a binding that will be useful for AIA chasing (#3546)Alex Gaynor2017-05-182-1/+20
| | | | | | | | | | | | | | | | | | | | | | | | * Added a binding that will be useful for AIA chasing * another function * This is required * void arguments are morally complex * These are macros * fixes * This has existed for a while * long line * typo * Cory wants this as well * This is conditional
* Fixes #3538 -- Make our OpenSSL EC verifier's implementation match the API ↵Alex Gaynor2017-05-101-3/+2
| | | | | | | | | | | | | | (#3539) * Document our real API for EC verification, not an accident * formatting consistency * fix the code itself * fixed class name * fixed a test too
* use openssl constants (#3534)Paul Kehrer2017-05-033-7/+20
|
* postpone GCM authentication tag requirement until finalization (#3421)Philipp Gesang2017-05-024-23/+64
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * postpone GCM authentication tag requirement until finalization Add a .finalize_with_tag() variant of the .finalize() function of the GCM context. At the same time, do not enforce the requirement of supplying the tag with the mode ctor. This facilitates streamed decryption when the MAC is appended to the ciphertext and cannot be efficiently retrieved ahead of decryption. According to the GCM spec (section 7.2: “Algorithm for the Authenticated Decryption Function”), the tag itself is not needed until the ciphertext has been decrypted. Addresses #3380 Signed-off-by: Philipp Gesang <philipp.gesang@intra2net.com> * disallow delayed GCM tag passing for legacy OpenSSL Old versions of Ubuntu supported by Cryptography ship a v1.0.1 of OpenSSL which is no longer supported by upstream. This library seems to cause erratic test failures with the delayed GCM tag functionality which are not reproducible outside the CI. Unfortunately OpenSSL v1.0.1 does not even document the required API (``EVP_EncryptInit(3)``) so there is no by-the-book fix. For backends of version 1.0.1 and earlier, verify the GCM tag at the same stage as before. Also, indicate to the user that late passing of GCM tags is unsupported by throwing ``NotImplementedError`` for these backend versions if - the method ``finalize_with_tag()`` is invoked, or - the mode ctor is called without passing a tag. Unit tests have been adapted to account for different backend versions.
* Delete dead code and update a comment (#3529)Alex Gaynor2017-04-302-5/+3
|
* Don't compare cffi version using strings (#3524)Alex Gaynor2017-04-292-9/+2
|
* Remove unused assignment (#3519)Alex Gaynor2017-04-271-1/+1
|
* Additional SCT bindings (#3510)Alex Gaynor2017-04-212-0/+23
| | | | | | * Additional SCT bindings * forgot to conditional these
* Another simplification of freeing (#3498)Alex Gaynor2017-04-092-7/+2
|
* Fixed #3492 -- use a better API (#3497)Alex Gaynor2017-04-092-7/+2
| | | | | | | | | | * Fixed #3492 -- use a better API * More correct types * Revert "More correct types" This reverts commit e7412927eccf2b983bbcab2d2864ae1e4e83b56f.
* Add some ASN1_TIME related functions for the relevant PyOpenSSL patch. (#3491)Moriyoshi Koizumi2017-04-061-0/+2
| | | | | | * Add ASN1_TIME related functions for the relevant PyOpenSSL patch. * Move ASN1_TIME_check() to MACROS as the argument's constness varies between 1.0.x and 1.1.0~.
* minor int_to_bytes performance increase (#3490)Ofek Lev2017-04-061-7/+13
| | | | | | | | * minor int_to_bytes performance increase * why is Python 2.6 supported anyway... * keep py2k version
* Style nit in C code (#3486)Alex Gaynor2017-04-031-1/+1
|
* remove key check (#3473)Ofek Lev2017-04-011-3/+0
|
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-29 07:58:16 +0000