summaryrefslogtreecommitdiff
path: root/src/cryptography/hazmat/backends/openssl/backend.py
Commit message (Collapse)AuthorAgeFilesLines
* Remove a bunch of unused bindings (#8830)Alex Gaynor2023-04-261-19/+7
| | | Also replace one DH function with a simpler implementation
* Move is_fips logic to Rust (#8822)Alex Gaynor2023-04-251-16/+3
|
* Convert KDFs to Rust (#8787)Alex Gaynor2023-04-251-60/+0
|
* Migrate DH to Rust (#8768)Alex Gaynor2023-04-241-163/+13
|
* Convert HMAC to Rust (#8781)Alex Gaynor2023-04-221-6/+0
|
* Convert hashes to Rust (#8775)Alex Gaynor2023-04-211-6/+0
|
* Remove unused parameter (#8707)Alex Gaynor2023-04-111-7/+2
|
* Convert ed448 to Rust (#8705)Alex Gaynor2023-04-111-55/+13
|
* Convert ed25519 to Rust (#8697)Alex Gaynor2023-04-101-37/+28
|
* support equality checks on all public asymmetric key types (#8700)Paul Kehrer2023-04-101-4/+0
| | | | | * support equality checks on all public asymmetric key types * review feedback
* Migrate x448 to Rust (#8691)Alex Gaynor2023-04-101-27/+9
|
* Use from __future__ import annotations everywhere (#8643)Alex Gaynor2023-03-311-0/+1
|
* Fix handling very large pointer values (32-bit) (#8602)Alex Gaynor2023-03-251-2/+2
|
* drop support for openssl < 1.1.1d (#8449)Paul Kehrer2023-03-241-63/+1
| | | | | This removes the OS random engine, which contained the only CPython PSF licensed code in the repository. Accordingly, that license has now been removed.
* Migrate x25519 to use rust-openssl (#7933)Alex Gaynor2023-03-241-28/+9
|
* Simplify/unify Rust and Python OpenSSL error handling (#8552)Alex Gaynor2023-03-201-13/+8
|
* Support handling OpenSSL errors from Rust code (#8530)Alex Gaynor2023-03-161-2/+2
|
* Small cleanups: (#8476)Alex Gaynor2023-03-091-18/+22
| | | | - Avoid typing.cast - Consolidate bn_ctx allocations
* replace use of EC_KEY_set_public_key_affine_coordinates (#8475)Paul Kehrer2023-03-091-2/+41
| | | | | | | | | | | | EC_KEY_set_public_key_affine_coordinates calls EC_KEY_check_key, which checks the point isn't at infinity, that it is on the curve (which has already been done by EC_POINT_set_affine_coordinates), and that the private scalar matches the public point. We don't want to do expensive checks twice, so instead we swap to calling EC_POINT_set_affine_coordinates directly and implement a private scalar matches public point check of our own. Also we no longer call deprecated functions.
* Make Union type aliases a documented public API (#8168)Marti Raudsepp2023-03-071-14/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Rename Union type aliases to CamelCase Many `typing.Union` type aliases were previously using `UPPER_SNAKE_CASE`, but Python's convention is `CamelCase` for these (e.g. https://docs.python.org/3/library/typing.html#type-aliases) * Add utils.deprecated for the old non-underscore type aliases * Added documentation for new type aliases & minor tweaks * Use 'versionadded:: 40.0.0' * Fix CertificatePublicKeyTypes vs CertificateIssuerPublicKeyTypes. Rename CertificatePrivateKeyTypes to CertificateIssuerPrivateKeyTypes * Fix imports (ruff) * Fix one more versionadded * Tweak docs & Reorder: CertificateIssuerPublicKeyTypes before CertificateIssuerPrivateKeyTypes * Fix test mypy errors using cast() * Fix black, oops * Revert "Fix black, oops" This reverts commit 85344e231d697bdc0940e105f7aed729445f9743. * Revert "Fix test mypy errors using cast()" This reverts commit b272d8ca95fbbbc62060663f9e8930a139a7a43e. * Revert type of SubjectKeyIdentifier.from_public_key arg * Changelog tweak
* Remove use of deprecated EC functions (#8459)Alex Gaynor2023-03-061-30/+5
|
* Added type annotations for more things in backend (#8265)Alex Gaynor2023-02-111-11/+20
|
* Simplify X25519 key loading (#8263)Alex Gaynor2023-02-111-48/+10
|
* add support for centos9-fips (#8216)Paul Kehrer2023-02-061-0/+9
| | | | | | | | * add support for centos9-fips Requires a variety of new FIPS constraints on our tests, including the addition of rsa_encryption_supported * review comments
* Several cleanups to the backend: (#8166)Alex Gaynor2023-01-301-12/+10
| | | | | 1. use public API for loading DER cert 2. use length-API for PKCS12 friendly name, not NUL-terminated 3. don't upref and GC and X509* that doesn't need to live longer
* Use Rust for CRL::is_signature_valid (#8162)Alex Gaynor2023-01-291-35/+0
|
* Use Rust for CSR::is_signature_valid (#8161)Alex Gaynor2023-01-291-23/+0
|
* Use the ruff 'pyupgrade' checks (#8104)Alex Gaynor2023-01-201-3/+3
|
* rename variable to make sense (#8080)Alex Gaynor2023-01-171-3/+3
|
* Update formatting for new ruff (#7937)Alex Gaynor2022-12-261-10/+10
|
* Switch from flake8 to ruff (#7920)Alex Gaynor2022-12-211-10/+7
| | | It's more than 60x faster.
* Rewrite PKCS7 signature generation in Rust (#7729)Alex Gaynor2022-11-251-99/+1
| | | | | * Rewrite PKCS7 signature generation in Rust * Update src/rust/src/pkcs7.rs
* LibreSSL 3.7 adds support for Ed25519 (#7803)Theo Buehler2022-11-221-1/+1
| | | | | | | | | * LibreSSL 3.7 adds support for Ed25519 This brings support for the raw public key API. * Use feature variable to enable Ed25519 Ed25519 support is available since OpenSSL 1.1.1b and LibreSSL 3.7.0.
* Update minimum LibreSSL to 3.5 (#7780)Alex Gaynor2022-11-071-3/+3
| | | This is the version of LibreSSL in OpenBSD 7.1, which is the oldest currently supported.
* Revert workaround for yanked OpenSSL (#7765)Alex Gaynor2022-11-031-4/+1
| | | Partial revert of 6578d86ec557e0b4af2ba9d0c0a821fe939044ee
* Convert basic PKCS7 generation to Rust (#7700)Alex Gaynor2022-10-121-47/+0
|
* upgrade some openssls in CI (#7690)Paul Kehrer2022-10-111-2/+4
| | | | | | | | | | | * bump tests to 3.0.6 * qs become rs * fix openssl 3.0.6 error stack bug in pkcs12 * flake * more comment
* add unsafe_skip_rsa_key_validation (#7667)Paul Kehrer2022-10-031-15/+43
| | | | | | | | | | | | | | | | | | | * add unsafe_skip_rsa_key_validation This allows users to skip RSA key validation when calling load_pem_private_key, load_der_private_key, and RSAPrivateNumbers.private_key. This is a significant performance improvement but is **only safe if you know the key is valid**. If you use this when the key is invalid OpenSSL makes no guarantees about what might happen. Infinite loops, crashes, and all manner of terrible things become possible if that occurs. Beware, beware, beware. * Apply suggestions from code review Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com> * remove unneeded variable Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>
* Handle error generating DH params with very very large key size (#7666)Alex Gaynor2022-10-011-1/+3
| | | Detected by OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52024
* support compilation against openssl 3 with no legacy provider (#7650)Paul Kehrer2022-09-261-22/+40
| | | | | You must pass CRYPTOGRAPHY_OPENSSL_NO_LEGACY for this to be allowed. Downstreams can easily patch this check out if they want to default to this behavior.
* remove consume_errors that are no longer required (#7620)Alex Gaynor2022-09-181-10/+0
|
* Remove reimplementation of OpenSSL function in DHX (#7611)Alex Gaynor2022-09-141-3/+1
|
* Move to a libressl policy (#7605)Alex Gaynor2022-09-131-5/+0
| | | This policy is to support things that are in supported versions of openbsd. the current oldest supported openbsd is 7.0, which included libressl 3.4
* Final set of cleanups to comments and bindings for dropping OpenSSL 1.1.0 ↵Alex Gaynor2022-09-111-6/+6
| | | | (#7598)
* simplify code now that we're >=1.1.1 only (#7595)Alex Gaynor2022-09-111-3/+1
|
* remove outdated comments and simplify code (#7594)Alex Gaynor2022-09-111-5/+3
|
* Remove pyOpenSSL fallback. (#7590)Alex Gaynor2022-09-111-16/+0
| | | We already require pyOpenSSL>=22.0, but pyOpenSSL has not required this fallback since 21.0.
* fixes #7109 -- update final comments for having dropped 1.1.0 (#7591)Alex Gaynor2022-09-111-4/+4
|
* Drop OpenSSL 1.1.0 (#7570)Alex Gaynor2022-09-071-1/+1
| | | | | There's still a few TODOs for cleanup. Refs #7109
* support setting more PKCS12 serialization encryption options (#7560)Paul Kehrer2022-09-051-3/+73
| | | | | | | | | | | | | | | | | | * support setting more PKCS12 serialization encryption options This is limited support, but makes it possible to set two different PBES choices as well as set KDF rounds and MAC algorithm * Apply suggestions from code review Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com> * review feedback redux * Update docs/hazmat/primitives/asymmetric/serialization.rst Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com> Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>
View Lorry Controller Status