Mailman 3 November 2014 - Cryptography-dev

keys and signatures import/export
by Jesus Cea Nov. 21, 2014

Nov. 21, 2014

I am working on a project that requires standar key and signatures data formats. Ugly ASN.1 everywhere. I wonder how is the serialization work going in "Crytography". -- Jesús Cea Avión _/_/ _/_/_/ _/_/_/ jcea(a)jcea.es - http://www.jcea.es/ _/_/ _/_/ _/_/ _/_/ _/_/ Twitter: @jcea _/_/ _/_/ _/_/_/_/_/ jabber / xmpp:jcea@jabber.org _/_/ _/_/ _/_/ _/_/ _/_/ "Things are not so easy" _/_/ _/_/ _/_/ _/_/ _/_/ _/_/ "My name is Dump, Core Dump" _/_/_/ _/_/_/ _/_/ _/_/ "El amor es poner tu felicidad en la felicidad de otro" - Leibniz

4 8

gmane?
by Matěj Cepl Nov. 20, 2014

Nov. 20, 2014

Would it be possible to add this email list to Gmane? I know there is unfortunately named http://dir.gmane.org/gmane.comp.python.cryptography (which is actually PyCrypto), but could some good solution be found? Best, Matěj -- http://www.ceplovi.cz/matej/, Jabber: mcepl(a)ceplovi.cz GPG Finger: 89EF 4BC6 288A BF43 1BAB 25C3 E09F EF25 D964 84AC A child can go only so far in life without potty training. It is not mere coincidence that six of the last seven presidents were potty trained, not to mention nearly half of the nation's state legislators. -- Dave Barry

3 3

The one where we talk about crypto-ethics
by Alex Gaynor Nov. 20, 2014

Nov. 20, 2014

Hi everybody, Folks who've been following our issue tracker might have noticed I've been working on a pure-python implementation of key loading, to replace the way we use OpenSSL right now for that. Here's the motivation: * The OpenSSL API provides absolutely no flexibility, there's no way to control which encryption algorithms are used for encrypted keys -- this means very old, very bad, algorithms are enabled by default and silently work while providing you basically no protection. * The OpenSSL APIs don't handle non-ascii passwords correctly -- I don't know if this is a thing in practice (probably not, chicken and egg) * The support key loading algorithms differs quite a bit from backend to backend, this makes the API more consistent depending on which backend you're using. So that's the motivation. Before we even start reviewing the patches, I think we need to ask ourselves about the ethical implications of writing this stuff ourselves: * Are we qualified to do this? Some of this code, for example the PKCS#12 KDF is straight up crypto. Other parts of it are more-or-less just parsing and ASN.1 handling * Parsing and ASN.1 handling still have serious security implications * Are we qualified to review this code? * On the flip side, we're moving a bunch of code from dangerous C to memory safe Python. * We actually write tests, which is probably not true of all of our backends. Computationally ethicists, please opine, Alex

4 4

Recipe for files?
by Stefan Pochmann Nov. 20, 2014

Nov. 20, 2014

I like the Fernet recipe, but I'd like a better recipe for files. One that doesn't want the entire message at once (bad for big files) and that doesn't bloat with base64. Should I do it myself with "hazardous materials" (I might adapt the Fernet code) or will you maybe add such a recipe soon? Something like this maybe: f = SomethingLikeFernetButForFiles(key) for block in f.encrypt(filename, blocksize): myhandling(block) Or with a handler parameter: f = SomethingLikeFernetButForFiles(key) f.encrypt(filename, blocksize, myhandling) Stefan

5 5

gmane?
by Matěj Cepl Nov. 20, 2014

Nov. 20, 2014

Would it be possible to add this email list to Gmane? I know there is unfortunately named http://dir.gmane.org/gmane.comp.python.cryptography (which is actually PyCrypto), but could some good solution be found? Best, Matěj -- http://www.ceplovi.cz/matej/, Jabber: mcepl(a)ceplovi.cz GPG Finger: 89EF 4BC6 288A BF43 1BAB 25C3 E09F EF25 D964 84AC A child can go only so far in life without potty training. It is not mere coincidence that six of the last seven presidents were potty trained, not to mention nearly half of the nation's state legislators. -- Dave Barry

1 0

ping
by Jesus Cea Nov. 20, 2014

Nov. 20, 2014

Anybody there? -- Jesús Cea Avión _/_/ _/_/_/ _/_/_/ jcea(a)jcea.es - http://www.jcea.es/ _/_/ _/_/ _/_/ _/_/ _/_/ Twitter: @jcea _/_/ _/_/ _/_/_/_/_/ jabber / xmpp:jcea@jabber.org _/_/ _/_/ _/_/ _/_/ _/_/ "Things are not so easy" _/_/ _/_/ _/_/ _/_/ _/_/ _/_/ "My name is Dump, Core Dump" _/_/_/ _/_/_/ _/_/ _/_/ "El amor es poner tu felicidad en la felicidad de otro" - Leibniz

3 2