summaryrefslogtreecommitdiff
path: root/src/cryptography
Commit message (Collapse)AuthorAgeFilesLines
* support X.509 certificate PSS signing (#8888)Paul Kehrer2023-05-102-1/+15
| | | | | | | | | | | | | * support X.509 certificate PSS signing no CSR, CRL, etc * handle PSS.(MAX_LENGTH, DIGEST_LENGTH), review feedback * name the kwarg * test improvements * skip if sha3 isn't supported
* add signature_algorithm_parameters to certificate (#8795)Paul Kehrer2023-05-071-0/+10
| | | | this allows easier verification of cert signatures, but more specifically allows PSS signature verification
* invalid visible string support (#8884)Paul Kehrer2023-05-071-0/+1
| | | | | | | | | | | | * invalid visible string support this allows utf8 in visiblestring, which is not valid DER. we raise a warning when this happens, but allow it since belgian eIDs, among others, have encoding errors. Belgium fixed this by 2021 (and possibly earlier), but their eID certificates have 10 year validity. * review comments * clippy
* Fix for #8854 (#8855)Harmin Parra Rueda2023-05-031-0/+1
| | | | | | | | | | | | | | | * Fix for #8854 Fix for issue #8854 * Fix for issue #8854 Fix for issue #8854 * versionadded --------- Co-authored-by: Paul Kehrer <paul.l.kehrer@gmail.com>
* Automate the version bump (#8828)Alex Gaynor2023-04-261-0/+1
|
* Remove a bunch of unused bindings (#8830)Alex Gaynor2023-04-262-28/+7
| | | Also replace one DH function with a simpler implementation
* Move is_fips logic to Rust (#8822)Alex Gaynor2023-04-252-16/+4
|
* Convert KDFs to Rust (#8787)Alex Gaynor2023-04-255-69/+37
|
* Migrate DH to Rust (#8768)Alex Gaynor2023-04-245-498/+44
|
* Use pyo3's facilities for exceptions (#8785)Alex Gaynor2023-04-222-15/+19
|
* Convert HMAC to Rust (#8781)Alex Gaynor2023-04-225-154/+27
|
* Convert hashes to Rust (#8775)Alex Gaynor2023-04-215-141/+48
|
* drop libressl 3.5.x support (#8741)Paul Kehrer2023-04-161-7/+0
| | | OpenBSD 7.1 is no longer supported so neither is LibreSSL 3.5.x
* add support for aes256-gcm@openssh.com decryption for SSH keys (#8738)Paul Kehrer2023-04-151-23/+85
| | | | | | | * add support for aes256-gcm@openssh.com decryption for SSH keys * review feedback * skip when bcrypt isn't present
* Remove unused consts (#8713)Alex Gaynor2023-04-121-3/+0
|
* Remove unused parameter (#8707)Alex Gaynor2023-04-111-7/+2
|
* Convert ed448 to Rust (#8705)Alex Gaynor2023-04-115-228/+45
|
* Convert ed25519 to Rust (#8697)Alex Gaynor2023-04-105-210/+61
|
* support equality checks on all public asymmetric key types (#8700)Paul Kehrer2023-04-1015-4/+99
| | | | | * support equality checks on all public asymmetric key types * review feedback
* Support msCertificateTemplate extension (#8695)Paul Kehrer2023-04-103-0/+63
| | | | | | | * support ms certificate template * contortions for rust coverage * review feedback
* Migrate x448 to Rust (#8691)Alex Gaynor2023-04-105-156/+36
|
* Use from __future__ import annotations everywhere (#8643)Alex Gaynor2023-03-3176-194/+298
|
* Added support for OCSP AcceptableResponses extension (#8617)Alex Gaynor2023-03-273-0/+32
| | | fixes #8589
* Make CffiBuf implementation sounder (#8612)Alex Gaynor2023-03-261-2/+2
| | | This keeps the buffer object alive, in addition to the original object. Some buffer-implementors have different behavior based on whether there's a buffer object alive.
* Fix handling very large pointer values (32-bit) (#8602)Alex Gaynor2023-03-252-3/+3
|
* remove unused warning constant (#8594)Alex Gaynor2023-03-251-1/+0
|
* fix copyright years (#8595)Alex Gaynor2023-03-251-1/+1
| | | | | * fix copyright year in docs * update copyright year
* drop python 3.6 support (#8448)Paul Kehrer2023-03-241-13/+0
| | | | | | | | | | | * drop python 3.6 support * Update tests/hazmat/bindings/test_openssl.py Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com> --------- Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>
* drop support for openssl < 1.1.1d (#8449)Paul Kehrer2023-03-244-96/+2
| | | | | This removes the OS random engine, which contained the only CPython PSF licensed code in the repository. Accordingly, that license has now been removed.
* reopen main for 41 dev (#8584)Paul Kehrer2023-03-241-1/+1
|
* version bump and changelog for 40.0.0 (#8583)40.0.0Paul Kehrer2023-03-241-1/+1
|
* Migrate x25519 to use rust-openssl (#7933)Alex Gaynor2023-03-245-156/+40
|
* Added support for handling python buffers in Rust code (#8556)Alex Gaynor2023-03-212-1/+8
| | | This is extra mega cursed, and strictly speaking unsound. It does, however, match the status quo ante, where someone mutating a buffer while its being used in cffi code will basically always be UB.
* Simplify/unify Rust and Python OpenSSL error handling (#8552)Alex Gaynor2023-03-207-100/+33
|
* Support handling OpenSSL errors from Rust code (#8530)Alex Gaynor2023-03-163-20/+28
|
* Ressurect the PoC of OpenSSL from Rust (#7164)Alex Gaynor2023-03-153-7/+21
|
* Stop validating keys in ECDH exchange (#8490)Alex Gaynor2023-03-112-4/+17
| | | | | The theory here is that we're already doing sufficient validation key loading, and this is purely duplicative. Note that there's at least _some_ validationg that was previously occurring only ECDH, the LowOrderPublic check that can be seen in wycheproof.
* Small cleanups: (#8476)Alex Gaynor2023-03-091-18/+22
| | | | - Avoid typing.cast - Consolidate bn_ctx allocations
* replace use of EC_KEY_set_public_key_affine_coordinates (#8475)Paul Kehrer2023-03-091-2/+41
| | | | | | | | | | | | EC_KEY_set_public_key_affine_coordinates calls EC_KEY_check_key, which checks the point isn't at infinity, that it is on the curve (which has already been done by EC_POINT_set_affine_coordinates), and that the private scalar matches the public point. We don't want to do expensive checks twice, so instead we swap to calling EC_POINT_set_affine_coordinates directly and implement a private scalar matches public point check of our own. Also we no longer call deprecated functions.
* Make Union type aliases a documented public API (#8168)Marti Raudsepp2023-03-0716-104/+154
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Rename Union type aliases to CamelCase Many `typing.Union` type aliases were previously using `UPPER_SNAKE_CASE`, but Python's convention is `CamelCase` for these (e.g. https://docs.python.org/3/library/typing.html#type-aliases) * Add utils.deprecated for the old non-underscore type aliases * Added documentation for new type aliases & minor tweaks * Use 'versionadded:: 40.0.0' * Fix CertificatePublicKeyTypes vs CertificateIssuerPublicKeyTypes. Rename CertificatePrivateKeyTypes to CertificateIssuerPrivateKeyTypes * Fix imports (ruff) * Fix one more versionadded * Tweak docs & Reorder: CertificateIssuerPublicKeyTypes before CertificateIssuerPrivateKeyTypes * Fix test mypy errors using cast() * Fix black, oops * Revert "Fix black, oops" This reverts commit 85344e231d697bdc0940e105f7aed729445f9743. * Revert "Fix test mypy errors using cast()" This reverts commit b272d8ca95fbbbc62060663f9e8930a139a7a43e. * Revert type of SubjectKeyIdentifier.from_public_key arg * Changelog tweak
* Remove use of deprecated EC functions (#8459)Alex Gaynor2023-03-063-41/+11
|
* deprecate support for OpenSSL <1.1.1d (#8444)Paul Kehrer2023-03-051-0/+18
| | | | | * deprecate support for OpenSSL <1.1.1d * use an actually exported constant
* Add an ignore for the newest ruff (#8440)Alex Gaynor2023-03-051-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | * Add an ignore for the newest ruff Clearly document why we have each of our ignores * Bump ruff from 0.0.253 to 0.0.254 Bumps [ruff](https://github.com/charliermarsh/ruff) from 0.0.253 to 0.0.254. - [Release notes](https://github.com/charliermarsh/ruff/releases) - [Changelog](https://github.com/charliermarsh/ruff/blob/main/BREAKING_CHANGES.md) - [Commits](https://github.com/charliermarsh/ruff/compare/v0.0.253...v0.0.254) --- updated-dependencies: - dependency-name: ruff dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Update to the new wycheproof (#8403)Alex Gaynor2023-02-281-1/+4
|
* raise UnsupportedAlgorithm instead of ValueError in x509 builder sign (#8397)Paul Kehrer2023-02-261-3/+16
| | | Also change the typing to be an explicit union
* fixes #8298 -- correctly generate content-type header in PKCS#7 SMIME (#8389)Alex Gaynor2023-02-261-4/+19
|
* Enforce max number of SSH certificate principals (#8376)Jake2023-02-231-0/+10
| | | | | | | | | | | | | | | | | | | | * Enforce max number of SSH certificate principals There is an undocumented limit for the maximum number of valid principals accepted by the openssh tooling, as seen at: * https://github.com/openssh/openssh-portable/blob/27267642699342412964aa785b98afd69d952c88/sshkey.h#L108 * https://github.com/openssh/openssh-portable/blob/25c8a2bbcc10c493d27faea57c42a6bf13fa51f2/sshkey.c#L1801 * https://github.com/openssh/openssh-portable/blob/6180b0fa4f7996687678702806257e661fd5931e/ssh-keygen.c#L1833 This change enforces that same restriction as currently a SSH certificate can be generated that is invalid against the default sshd server. Consideration might be given for any non openssh servers that accept openssh certificates, if they exist and want to allow a greater number of principals. Of note, the 256 limit is not found in the spec for SSH certificates as defined at https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.certkeys. It instead seems to be arbitrarily chosen by the project as some limit was needed. * Address formatting error. * Comment on valid_prinicpals size limit plus test added. --------- Co-authored-by: Jake <jake@vaultish.com>
* Add shortcut methods for exporting EC keys as raw bytes (#8357)David Buchanan2023-02-224-0/+80
| | | | | | | | | | | | | | | | | * WIP: Add raw export alias method for x25519 keys * Ditto for x448, ed448, ed25519 * Document new private_bytes_raw public_bytes_raw methods * docs: Populate versionadded to be 40 * docs: Fix PublicFormat -> PrivateFormat where applicable * formatting * Update tests for test_pub_priv_bytes_raw in x25519, x448, ed448 (TODO: ed25519) * Add test_pub_priv_bytes_raw test for Ed25519
* Remove unused bindings (#8321)Alex Gaynor2023-02-191-18/+0
|
* fixes #8316 -- correct docstring (#8319)Alex Gaynor2023-02-171-1/+1
| | | | | | | | | | | * fixes #8316 -- correct docstring * Update src/cryptography/hazmat/primitives/asymmetric/x448.py Co-authored-by: Paul Kehrer <paul.l.kehrer@gmail.com> --------- Co-authored-by: Paul Kehrer <paul.l.kehrer@gmail.com>
View Lorry Controller Status