From 784e3bc30d7c08952a2b994c57fc98bcc3f805c5 Mon Sep 17 00:00:00 2001 From: Paul Kehrer Date: Fri, 30 Jun 2017 19:49:53 -0500 Subject: disallow MD5 in CertificateBuilder and CertificateSigningRequestBuilder (#3738) * disallow MD5 in CertificateBuilder and CertificateSigningRequestBuilder * only error on ECDSA and DSA lots of duplication in tests here, bleh * remove changelog entry, also handle this for CRLBuilder * pep8 --- .../hazmat/backends/openssl/backend.py | 24 ++++++++++++++++++++++ 1 file changed, 24 insertions(+) (limited to 'src') diff --git a/src/cryptography/hazmat/backends/openssl/backend.py b/src/cryptography/hazmat/backends/openssl/backend.py index 18238e1c..cf0300e0 100644 --- a/src/cryptography/hazmat/backends/openssl/backend.py +++ b/src/cryptography/hazmat/backends/openssl/backend.py @@ -662,6 +662,14 @@ class Backend(object): if not isinstance(algorithm, hashes.HashAlgorithm): raise TypeError('Algorithm must be a registered hash algorithm.') + if ( + isinstance(algorithm, hashes.MD5) and not + isinstance(private_key, rsa.RSAPrivateKey) + ): + raise ValueError( + "MD5 is not a supported hash algorithm for EC/DSA CSRs" + ) + # Resolve the signature algorithm. evp_md = self._lib.EVP_get_digestbyname( algorithm.name.encode('ascii') @@ -731,6 +739,14 @@ class Backend(object): if not isinstance(algorithm, hashes.HashAlgorithm): raise TypeError('Algorithm must be a registered hash algorithm.') + if ( + isinstance(algorithm, hashes.MD5) and not + isinstance(private_key, rsa.RSAPrivateKey) + ): + raise ValueError( + "MD5 is not a supported hash algorithm for EC/DSA certificates" + ) + # Resolve the signature algorithm. evp_md = self._lib.EVP_get_digestbyname( algorithm.name.encode('ascii') @@ -828,6 +844,14 @@ class Backend(object): if not isinstance(algorithm, hashes.HashAlgorithm): raise TypeError('Algorithm must be a registered hash algorithm.') + if ( + isinstance(algorithm, hashes.MD5) and not + isinstance(private_key, rsa.RSAPrivateKey) + ): + raise ValueError( + "MD5 is not a supported hash algorithm for EC/DSA CRLs" + ) + evp_md = self._lib.EVP_get_digestbyname( algorithm.name.encode('ascii') ) -- cgit v1.2.3