summaryrefslogtreecommitdiff
path: root/src/cryptography/hazmat
Commit message (Collapse)AuthorAgeFilesLines
* support X.509 certificate PSS signing (#8888)Paul Kehrer2023-05-101-0/+2
| | | | | | | | | | | | | * support X.509 certificate PSS signing no CSR, CRL, etc * handle PSS.(MAX_LENGTH, DIGEST_LENGTH), review feedback * name the kwarg * test improvements * skip if sha3 isn't supported
* Fix for #8854 (#8855)Harmin Parra Rueda2023-05-031-0/+1
| | | | | | | | | | | | | | | * Fix for #8854 Fix for issue #8854 * Fix for issue #8854 Fix for issue #8854 * versionadded --------- Co-authored-by: Paul Kehrer <paul.l.kehrer@gmail.com>
* Remove a bunch of unused bindings (#8830)Alex Gaynor2023-04-262-28/+7
| | | Also replace one DH function with a simpler implementation
* Move is_fips logic to Rust (#8822)Alex Gaynor2023-04-252-16/+4
|
* Convert KDFs to Rust (#8787)Alex Gaynor2023-04-255-69/+37
|
* Migrate DH to Rust (#8768)Alex Gaynor2023-04-245-498/+44
|
* Use pyo3's facilities for exceptions (#8785)Alex Gaynor2023-04-221-0/+17
|
* Convert HMAC to Rust (#8781)Alex Gaynor2023-04-225-154/+27
|
* Convert hashes to Rust (#8775)Alex Gaynor2023-04-215-141/+48
|
* drop libressl 3.5.x support (#8741)Paul Kehrer2023-04-161-7/+0
| | | OpenBSD 7.1 is no longer supported so neither is LibreSSL 3.5.x
* add support for aes256-gcm@openssh.com decryption for SSH keys (#8738)Paul Kehrer2023-04-151-23/+85
| | | | | | | * add support for aes256-gcm@openssh.com decryption for SSH keys * review feedback * skip when bcrypt isn't present
* Remove unused consts (#8713)Alex Gaynor2023-04-121-3/+0
|
* Remove unused parameter (#8707)Alex Gaynor2023-04-111-7/+2
|
* Convert ed448 to Rust (#8705)Alex Gaynor2023-04-115-228/+45
|
* Convert ed25519 to Rust (#8697)Alex Gaynor2023-04-105-210/+61
|
* support equality checks on all public asymmetric key types (#8700)Paul Kehrer2023-04-1015-4/+99
| | | | | * support equality checks on all public asymmetric key types * review feedback
* Support msCertificateTemplate extension (#8695)Paul Kehrer2023-04-101-0/+2
| | | | | | | * support ms certificate template * contortions for rust coverage * review feedback
* Migrate x448 to Rust (#8691)Alex Gaynor2023-04-105-156/+36
|
* Use from __future__ import annotations everywhere (#8643)Alex Gaynor2023-03-3163-139/+231
|
* Added support for OCSP AcceptableResponses extension (#8617)Alex Gaynor2023-03-271-0/+1
| | | fixes #8589
* Fix handling very large pointer values (32-bit) (#8602)Alex Gaynor2023-03-251-2/+2
|
* drop support for openssl < 1.1.1d (#8449)Paul Kehrer2023-03-244-96/+2
| | | | | This removes the OS random engine, which contained the only CPython PSF licensed code in the repository. Accordingly, that license has now been removed.
* Migrate x25519 to use rust-openssl (#7933)Alex Gaynor2023-03-245-156/+40
|
* Added support for handling python buffers in Rust code (#8556)Alex Gaynor2023-03-211-1/+1
| | | This is extra mega cursed, and strictly speaking unsound. It does, however, match the status quo ante, where someone mutating a buffer while its being used in cffi code will basically always be UB.
* Simplify/unify Rust and Python OpenSSL error handling (#8552)Alex Gaynor2023-03-206-96/+31
|
* Support handling OpenSSL errors from Rust code (#8530)Alex Gaynor2023-03-163-20/+28
|
* Ressurect the PoC of OpenSSL from Rust (#7164)Alex Gaynor2023-03-153-7/+21
|
* Stop validating keys in ECDH exchange (#8490)Alex Gaynor2023-03-112-4/+17
| | | | | The theory here is that we're already doing sufficient validation key loading, and this is purely duplicative. Note that there's at least _some_ validationg that was previously occurring only ECDH, the LowOrderPublic check that can be seen in wycheproof.
* Small cleanups: (#8476)Alex Gaynor2023-03-091-18/+22
| | | | - Avoid typing.cast - Consolidate bn_ctx allocations
* replace use of EC_KEY_set_public_key_affine_coordinates (#8475)Paul Kehrer2023-03-091-2/+41
| | | | | | | | | | | | EC_KEY_set_public_key_affine_coordinates calls EC_KEY_check_key, which checks the point isn't at infinity, that it is on the curve (which has already been done by EC_POINT_set_affine_coordinates), and that the private scalar matches the public point. We don't want to do expensive checks twice, so instead we swap to calling EC_POINT_set_affine_coordinates directly and implement a private scalar matches public point check of our own. Also we no longer call deprecated functions.
* Make Union type aliases a documented public API (#8168)Marti Raudsepp2023-03-0712-73/+123
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Rename Union type aliases to CamelCase Many `typing.Union` type aliases were previously using `UPPER_SNAKE_CASE`, but Python's convention is `CamelCase` for these (e.g. https://docs.python.org/3/library/typing.html#type-aliases) * Add utils.deprecated for the old non-underscore type aliases * Added documentation for new type aliases & minor tweaks * Use 'versionadded:: 40.0.0' * Fix CertificatePublicKeyTypes vs CertificateIssuerPublicKeyTypes. Rename CertificatePrivateKeyTypes to CertificateIssuerPrivateKeyTypes * Fix imports (ruff) * Fix one more versionadded * Tweak docs & Reorder: CertificateIssuerPublicKeyTypes before CertificateIssuerPrivateKeyTypes * Fix test mypy errors using cast() * Fix black, oops * Revert "Fix black, oops" This reverts commit 85344e231d697bdc0940e105f7aed729445f9743. * Revert "Fix test mypy errors using cast()" This reverts commit b272d8ca95fbbbc62060663f9e8930a139a7a43e. * Revert type of SubjectKeyIdentifier.from_public_key arg * Changelog tweak
* Remove use of deprecated EC functions (#8459)Alex Gaynor2023-03-063-41/+11
|
* deprecate support for OpenSSL <1.1.1d (#8444)Paul Kehrer2023-03-051-0/+18
| | | | | * deprecate support for OpenSSL <1.1.1d * use an actually exported constant
* Add an ignore for the newest ruff (#8440)Alex Gaynor2023-03-051-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | * Add an ignore for the newest ruff Clearly document why we have each of our ignores * Bump ruff from 0.0.253 to 0.0.254 Bumps [ruff](https://github.com/charliermarsh/ruff) from 0.0.253 to 0.0.254. - [Release notes](https://github.com/charliermarsh/ruff/releases) - [Changelog](https://github.com/charliermarsh/ruff/blob/main/BREAKING_CHANGES.md) - [Commits](https://github.com/charliermarsh/ruff/compare/v0.0.253...v0.0.254) --- updated-dependencies: - dependency-name: ruff dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Update to the new wycheproof (#8403)Alex Gaynor2023-02-281-1/+4
|
* fixes #8298 -- correctly generate content-type header in PKCS#7 SMIME (#8389)Alex Gaynor2023-02-261-4/+19
|
* Enforce max number of SSH certificate principals (#8376)Jake2023-02-231-0/+10
| | | | | | | | | | | | | | | | | | | | * Enforce max number of SSH certificate principals There is an undocumented limit for the maximum number of valid principals accepted by the openssh tooling, as seen at: * https://github.com/openssh/openssh-portable/blob/27267642699342412964aa785b98afd69d952c88/sshkey.h#L108 * https://github.com/openssh/openssh-portable/blob/25c8a2bbcc10c493d27faea57c42a6bf13fa51f2/sshkey.c#L1801 * https://github.com/openssh/openssh-portable/blob/6180b0fa4f7996687678702806257e661fd5931e/ssh-keygen.c#L1833 This change enforces that same restriction as currently a SSH certificate can be generated that is invalid against the default sshd server. Consideration might be given for any non openssh servers that accept openssh certificates, if they exist and want to allow a greater number of principals. Of note, the 256 limit is not found in the spec for SSH certificates as defined at https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.certkeys. It instead seems to be arbitrarily chosen by the project as some limit was needed. * Address formatting error. * Comment on valid_prinicpals size limit plus test added. --------- Co-authored-by: Jake <jake@vaultish.com>
* Add shortcut methods for exporting EC keys as raw bytes (#8357)David Buchanan2023-02-224-0/+80
| | | | | | | | | | | | | | | | | * WIP: Add raw export alias method for x25519 keys * Ditto for x448, ed448, ed25519 * Document new private_bytes_raw public_bytes_raw methods * docs: Populate versionadded to be 40 * docs: Fix PublicFormat -> PrivateFormat where applicable * formatting * Update tests for test_pub_priv_bytes_raw in x25519, x448, ed448 (TODO: ed25519) * Add test_pub_priv_bytes_raw test for Ed25519
* Remove unused bindings (#8321)Alex Gaynor2023-02-191-18/+0
|
* fixes #8316 -- correct docstring (#8319)Alex Gaynor2023-02-171-1/+1
| | | | | | | | | | | * fixes #8316 -- correct docstring * Update src/cryptography/hazmat/primitives/asymmetric/x448.py Co-authored-by: Paul Kehrer <paul.l.kehrer@gmail.com> --------- Co-authored-by: Paul Kehrer <paul.l.kehrer@gmail.com>
* fixes #8316 -- correct docstring (#8318)Alex Gaynor2023-02-171-1/+1
|
* Added type annotations for more things in backend (#8265)Alex Gaynor2023-02-113-22/+31
|
* Remove now-unused bindings (#8264)Alex Gaynor2023-02-111-10/+0
|
* Simplify X25519 key loading (#8263)Alex Gaynor2023-02-112-73/+23
|
* Don't allow update_into to mutate immutable objects (#8230)Alex Gaynor2023-02-071-1/+1
|
* add support for centos9-fips (#8216)Paul Kehrer2023-02-061-0/+9
| | | | | | | | * add support for centos9-fips Requires a variety of new FIPS constraints on our tests, including the addition of rsa_encryption_supported * review comments
* add support for bytes-like objects in data and associated_data in aead ↵Mat2023-02-022-17/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | algorithms (#8187) * add support for bytes-like objects in data and associated_data in aead algorithms * flake * flake again * rework AESSIV _check_params * flake and 80char columns * associated_data cannot be None in _check_params, set to [] in calling function * Update src/cryptography/hazmat/primitives/ciphers/aead.py Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com> * flake fix --------- Co-authored-by: mat gas <none@none.com> Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>
* Update style for new black (#8185)Alex Gaynor2023-01-312-3/+0
|
* Several cleanups to the backend: (#8166)Alex Gaynor2023-01-301-12/+10
| | | | | 1. use public API for loading DER cert 2. use length-API for PKCS12 friendly name, not NUL-terminated 3. don't upref and GC and X509* that doesn't need to live longer
* Use Rust for CRL::is_signature_valid (#8162)Alex Gaynor2023-01-291-35/+0
|
View Lorry Controller Status