Mailman 3 December 2013 - Cryptography-dev

First release -- asymmetric?
by Alex Gaynor Dec. 31, 2013

Dec. 31, 2013

Hey all, What do people think of the idea of us doing our first release without having any asymmetric support? The motivation here would be to allow us to get our initial release out sooner, addressing the following concerns: - pyOpenSSL! (specifically on PyPy) - Crypto on py3k and on PyPy - GCM support - A safe recipe for symmetric encryption. What do folks think about this idea? Alex -- "I disapprove of what you say, but I will defend to the death your right to say it." -- Evelyn Beatrice Hall (summarizing Voltaire) "The people's good is the highest law." -- Cicero GPG Key fingerprint: 125F 5C67 DFE9 4084

5 4

PyCon & Releases
by Jarret Raim Dec. 19, 2013

Dec. 19, 2013

All, Paul (reaperhulk) and I got accepted to do a talk on the State of Crypto in Python¹. Here is the abstract for our talk: Python has a complex past with cryptography. There are half a dozen major frameworks built on at least three separate C implementations, each with their own strengths and weaknesses and in various states of maintenance. In our development of an open source key management system for OpenStack (Barbican), our team has spent some time investigating the major options including OpenSSL, libnss, nacl and pycrypto on the C side and PyOpenSSL, Pycrypto, python-nss and m2crypto on the Python side. In our research, we noted several challenges with the current crop of libraries including audit state, support for PyPy, maintenance status, etc. In response to this, a group of Python aficionados with more time than sense have begun development of Cryptography (https://github.com/pyca/cryptography). Cryptography is a modern Python crypto library capable of utilizing multiple C backends based on CFFI, thus enabling PyPy use. We will cover the current state of the library, it's goals and design decisions. As part of this effort, Paul, Donald (dstufft) and I were talking a bit about what a release before PyCon would look like. As PyCon is in April, we don¹t have a lot of time, but we figured our thinking would be a good place to take up the release discussion again. We came up with 5 areas we wanted to work on pre-release. 1. Recipes We need to define some of the high level API that consumers would actually use. We focused on a two options, hashing and symmetric encryption. - Hashing primitives & HMAC - Non-framed, authenticated encryption: GCM for small files. - Framed, authenticated encryption: GCM for large files. Possibly includes a custom wire format. I think the goal here is a prototype for review rather than something that is usable. 2. Backends We¹d like to land at least one new backend. This would help verify that our API is reasonable and nothing OpenSSL specific has managed to creep into the system. The options we came up with are below. We stayed away from C++ since CFFI. - CommonCrypto: Land the osx backend. Requires fixes for the testing infrastructure. - NSS: Easier backend to land as it works on Travis and is C, but isn¹t written yet. - DPAPI: ::shudder:: At least it is probably documented, but dev / testing on windows is a question. 3. Documentation We are in okay shape here. Mostly just need to beef it up for new users. - Recipes - Overview / getting started - Examples 4. Packaging Mostly here we need to look at how we package and whether / when it makes sense to move to a sub-package format (e.g. cryptography-openssl or cryptography-nss) 5. Testing Testing is pretty good now, but we need to move most of the jobs to jenkins to scale. We also wanted to add some test types that we aren¹t performing now. - Performance - Deep cycle (e.g. Cycle this 1M times and the answer should be X) We also spent some time talking about the preferred test matrix. We currently test (or should be testing against) the following Pythons: 2.6, 2.7, 3.2, 3.3, 3.4, PyPy Each one of those environments should be run on the following platforms: - Windows: 2008 R2 x32, 2008 R2 x64, 2012 x32, 2012 x64 - OSX: 10.8, 10.9 (gcc and clang) For linux, it seemed more important to test against OpenSSL versions rather than distros. The OpenSSL versions still need to be fleshed out, but they should cover the versions from common distros. Our initial list was: - 0.9.8 newest - 1.0.0 newest - 1.0.1 newest In addition to those, we want to cover the versions of OpenSSL shipped in the following distros: - RHEL / Cent 5, 6, 7 - Fedora 19, 20 - Ubuntu 12.04, newest - Debian 6, 7 Thanks, Jarret -- Jarret Raim @jarretraim

5 8

Jenkins Work In Progress
by Paul Kehrer Dec. 14, 2013

Dec. 14, 2013

Hey everyone, Some of you may have noticed a flurry of jenkins-related emails from Github going out. I'm currently working on configuring Jenkins so we can do OS X CI. Part of this effort includes a pull request builder (whitelisted to our org for safety for now), but it's not completely configured so don't believe it if it says your PR is passing! I'll send an email out to the list when it's full configured in the next few days. -Paul

1 0