From 754d459b4746e84218164593e5b88208e178f1da Mon Sep 17 00:00:00 2001 From: Alex Gaynor Date: Thu, 30 Oct 2014 13:29:31 -0700 Subject: Make sure the backend implementatinos of various interfaces have verify() methods. Also make the frontend versions actually use them --- cryptography/hazmat/backends/commoncrypto/hmac.py | 11 +++++++++-- cryptography/hazmat/backends/openssl/cmac.py | 11 +++++++++-- cryptography/hazmat/backends/openssl/hmac.py | 11 +++++++++-- cryptography/hazmat/primitives/cmac.py | 8 +++++--- cryptography/hazmat/primitives/hmac.py | 12 +++++++----- 5 files changed, 39 insertions(+), 14 deletions(-) diff --git a/cryptography/hazmat/backends/commoncrypto/hmac.py b/cryptography/hazmat/backends/commoncrypto/hmac.py index c2b6c379..ee7e3abb 100644 --- a/cryptography/hazmat/backends/commoncrypto/hmac.py +++ b/cryptography/hazmat/backends/commoncrypto/hmac.py @@ -14,8 +14,10 @@ from __future__ import absolute_import, division, print_function from cryptography import utils -from cryptography.exceptions import UnsupportedAlgorithm, _Reasons -from cryptography.hazmat.primitives import interfaces +from cryptography.exceptions import ( + InvalidSignature, UnsupportedAlgorithm, _Reasons +) +from cryptography.hazmat.primitives import constant_time, interfaces @utils.register_interface(interfaces.MACContext) @@ -59,3 +61,8 @@ class _HMACContext(object): self.algorithm.digest_size) self._backend._lib.CCHmacFinal(self._ctx, buf) return self._backend._ffi.buffer(buf)[:] + + def verify(self, signature): + digest = self.finalize() + if not constant_time.bytes_eq(digest, signature): + raise InvalidSignature("Signature did not match digest.") diff --git a/cryptography/hazmat/backends/openssl/cmac.py b/cryptography/hazmat/backends/openssl/cmac.py index 6a844cdc..1ad6055b 100644 --- a/cryptography/hazmat/backends/openssl/cmac.py +++ b/cryptography/hazmat/backends/openssl/cmac.py @@ -15,8 +15,10 @@ from __future__ import absolute_import, division, print_function from cryptography import utils -from cryptography.exceptions import UnsupportedAlgorithm, _Reasons -from cryptography.hazmat.primitives import interfaces +from cryptography.exceptions import ( + InvalidSignature, UnsupportedAlgorithm, _Reasons +) +from cryptography.hazmat.primitives import constant_time, interfaces from cryptography.hazmat.primitives.ciphers.modes import CBC @@ -80,3 +82,8 @@ class _CMACContext(object): return _CMACContext( self._backend, self._algorithm, ctx=copied_ctx ) + + def verify(self, signature): + digest = self.finalize() + if not constant_time.bytes_eq(digest, signature): + raise InvalidSignature("Signature did not match digest.") diff --git a/cryptography/hazmat/backends/openssl/hmac.py b/cryptography/hazmat/backends/openssl/hmac.py index d5300ea0..c324bd8c 100644 --- a/cryptography/hazmat/backends/openssl/hmac.py +++ b/cryptography/hazmat/backends/openssl/hmac.py @@ -15,8 +15,10 @@ from __future__ import absolute_import, division, print_function from cryptography import utils -from cryptography.exceptions import UnsupportedAlgorithm, _Reasons -from cryptography.hazmat.primitives import interfaces +from cryptography.exceptions import ( + InvalidSignature, UnsupportedAlgorithm, _Reasons +) +from cryptography.hazmat.primitives import constant_time, interfaces @utils.register_interface(interfaces.MACContext) @@ -81,3 +83,8 @@ class _HMACContext(object): assert outlen[0] == self.algorithm.digest_size self._backend._lib.HMAC_CTX_cleanup(self._ctx) return self._backend._ffi.buffer(buf)[:outlen[0]] + + def verify(self, signature): + digest = self.finalize() + if not constant_time.bytes_eq(digest, signature): + raise InvalidSignature("Signature did not match digest.") diff --git a/cryptography/hazmat/primitives/cmac.py b/cryptography/hazmat/primitives/cmac.py index 7ae5c118..d5e26a57 100644 --- a/cryptography/hazmat/primitives/cmac.py +++ b/cryptography/hazmat/primitives/cmac.py @@ -59,9 +59,11 @@ class CMAC(object): def verify(self, signature): if not isinstance(signature, bytes): raise TypeError("signature must be bytes.") - digest = self.finalize() - if not constant_time.bytes_eq(digest, signature): - raise InvalidSignature("Signature did not match digest.") + if self._ctx is None: + raise AlreadyFinalized("Context was already finalized.") + + ctx, self._ctx = self._ctx, None + ctx.verify(signature) def copy(self): if self._ctx is None: diff --git a/cryptography/hazmat/primitives/hmac.py b/cryptography/hazmat/primitives/hmac.py index 22a31391..47a048ff 100644 --- a/cryptography/hazmat/primitives/hmac.py +++ b/cryptography/hazmat/primitives/hmac.py @@ -15,10 +15,10 @@ from __future__ import absolute_import, division, print_function from cryptography import utils from cryptography.exceptions import ( - AlreadyFinalized, InvalidSignature, UnsupportedAlgorithm, _Reasons + AlreadyFinalized, UnsupportedAlgorithm, _Reasons ) from cryptography.hazmat.backends.interfaces import HMACBackend -from cryptography.hazmat.primitives import constant_time, interfaces +from cryptography.hazmat.primitives import interfaces @utils.register_interface(interfaces.MACContext) @@ -71,6 +71,8 @@ class HMAC(object): def verify(self, signature): if not isinstance(signature, bytes): raise TypeError("signature must be bytes.") - digest = self.finalize() - if not constant_time.bytes_eq(digest, signature): - raise InvalidSignature("Signature did not match digest.") + if self._ctx is None: + raise AlreadyFinalized("Context was already finalized.") + + ctx, self._ctx = self._ctx, None + ctx.verify(signature) -- cgit v1.2.3 From ef5195f581c672a06369c0fadf07fabb6e89bf83 Mon Sep 17 00:00:00 2001 From: Alex Gaynor Date: Thu, 30 Oct 2014 14:25:47 -0700 Subject: flake8 fix --- cryptography/hazmat/primitives/cmac.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/cryptography/hazmat/primitives/cmac.py b/cryptography/hazmat/primitives/cmac.py index d5e26a57..6f722031 100644 --- a/cryptography/hazmat/primitives/cmac.py +++ b/cryptography/hazmat/primitives/cmac.py @@ -15,10 +15,10 @@ from __future__ import absolute_import, division, print_function from cryptography import utils from cryptography.exceptions import ( - AlreadyFinalized, InvalidSignature, UnsupportedAlgorithm, _Reasons + AlreadyFinalized, UnsupportedAlgorithm, _Reasons ) from cryptography.hazmat.backends.interfaces import CMACBackend -from cryptography.hazmat.primitives import constant_time, interfaces +from cryptography.hazmat.primitives import interfaces @utils.register_interface(interfaces.MACContext) -- cgit v1.2.3 From a201cde67233018545120cd0245a0ffb9905e89f Mon Sep 17 00:00:00 2001 From: Alex Gaynor Date: Thu, 30 Oct 2014 17:59:59 -0700 Subject: added a test for verify-after-finalize --- tests/hazmat/primitives/test_cmac.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tests/hazmat/primitives/test_cmac.py b/tests/hazmat/primitives/test_cmac.py index c778ebee..a2a701a0 100644 --- a/tests/hazmat/primitives/test_cmac.py +++ b/tests/hazmat/primitives/test_cmac.py @@ -166,6 +166,9 @@ class TestCMAC(object): with pytest.raises(AlreadyFinalized): cmac.finalize() + with pytest.raises(AlreadyFinalized): + cmac.verify(b"") + @pytest.mark.supported( only_if=lambda backend: backend.cmac_algorithm_supported( AES(fake_key)), -- cgit v1.2.3