Mailman 3 April 2014 - Cryptography-dev

Packaging ideas
by Alex Gaynor April 28, 2014

April 28, 2014

So, before I can start talking about solutions, I have to describe the use cases. 1) Some folks need a very specific backend (i.e. pyOpenSSL) and right now it's just assumed that that will come with `pip install cryptography`. 2) Some folks want to use cryptography as the API for non-traditional primitives (e.g. scrypt), and `pip install cryptography` brings a lot more than what they want. 3) Some folks want to type the letters AES, and don't really care where that comes from. 4) Some folks want to type the letters "fab", and super don't care that fabric needs a paramiko which needs an AES. 5) Some folks want to be able `pip install something` without getting an OpenSSL, because OpenSSL is literally the worst thing in the world. Invariants that must hold true: * `pip install cryptography` gets you a thing that can AES (and whatever other core algorithms we think are important) * There's a thing you can `pip install` that gets you scrypt, but not OpenSSL * There's a thing you can `pip install` to definitely get some OpenSSL. Solution: We break things down into a few different packages: * `pip install cryptography-core`: This contains all the primitives, all the recipes, all the everything besides the backends/bindings * `pip install cryptography-{openssl,scrypt,etc.}`: This contains the backend/bindings for the specific thing * `pip install cryptography`: This gets you a cryptography, and whatever set of core backends we think are reasonable for your platform for doing stuff like typing AES (and, god willing, then typing HMAC). Thoughts? Alex -- "I disapprove of what you say, but I will defend to the death your right to say it." -- Evelyn Beatrice Hall (summarizing Voltaire) "The people's good is the highest law." -- Cicero GPG Key fingerprint: 125F 5C67 DFE9 4084

3 3

Cryptography 0.4 Release Schedule
by Paul Kehrer April 24, 2014

April 24, 2014

We’re discussing longer term release strategies in the release cadences thread, but we’ve also got a large backlog of work that is sitting in master unreleased right now so it’s time to talk about a 0.4 release (which I’ve previously volunteered to manage). The release milestone (https://github.com/pyca/cryptography/issues?milestone=4&page=1&state=open) has an up-to-date view of the remaining issues blocking release, but here’s a bullet list for posterity. * RSA encryption support (PR currently under review) * DSA verification (WIP PR) * DSA signing * Key serialization (this will probably only be TraditionalOpenSSL aka PKCS1-ish loading/serializing) I think we can probably close these items out and get a release out next week. If you think something else belongs in the release let me know or add the issue/PR to it. General list of new stuff for 0.4 that has already landed: * RSA decryption (OAEP, PKCS1v15) * SEED support * CMAC support * DSA key generation, interfaces * Many new OpenSSL bindings (ECDSA, NPN, CMS, etc). Some of these are very useful for PyOpenSSL and other downstream projects that need things we don’t offer in hazmat at this time. -Paul

1 0

Thoughts on opaque key material.
by David Reid April 23, 2014

April 23, 2014

I apologize for how disorganized these thoughts are, the problems are more fully formed than the solutions and I ended up spending much more time than desired writing this email, so I just sort of cut myself off at 4pm. Hopefully we can figure out some of these answers on the mailing list. -- Currently RSA key material is represented as an object having a series of properties that correspond to the various mathematical components of an RSA key. The initial reasoning for this is that it would make the internal representation of a key backend independent and allow for moving key material from one backend to another (for example, loading the key from one backend and performing encryption with another backend). However, as an initial proponent of this argument I feel comfortable saying that I was completely wrong. It has variety of negative effects, 1) The mathematical components have terrible names that we MUST expose to users. In RSA n, p, q, e, and d. In ECDSA x and y. Even when these components have well known multisyllable names their value as descriptors is somewhat limited, "public exponent" is a much better name than "e" but still requires knowledge of the mathematical foundations of RSA to be of any value to anyone. (You can argue that the hazmat/primitives layers are the place for exposing this kind of detail to users and that if you don't understand the RSA mathematically you shouldn't be using them, however we've never felt any need to point out that AES S-boxes can be described by a system of 23 quadratic equations in 80 terms.) 2) Not all backend representations of keys expose the individual components. Even given a single backend such as openssl there is no guarantee that two internal structures will contain all the necessary data. This is most notable with keys stored in a HSMs or SmartCards where it is a feature that you can not extract the RSA private key from the system. However this is also evident in backends like CommonCrypto which don't have a public API for getting or setting the values of the various key components. To actually use an RSA key from OpenSSL on CommonCrypto you MUST convert it to some intermediate representation that both understand (likely PKCS#8). 3) Optional optimizations get exposed to users as required interface. Similarly, our exposure of the Chinese remainder theorem intermediate calculations on the RSAPrivateKey interface complicates the usage of RSA key material on multiple backends instead of simplifies it. Not all serialization formats or backends support storing/loading the CRT values potentially requiring us to perform duplicate calculations of these values for exposing them on the nonopaque interface. 4) Using the generic key components makes frequent operations (like obtaining a new signing/verify context) more expensive. These backend specific operations now require potentially costly (or even dangerous) conversions between the generic and backend specific representations. Given these issues I think we must seriously consider switching away from these backend independent representations as our primary interface to key materials. Preferring instead opaque backend specific implementations. For example, instead of a concrete RSAPrivateKey instance which can be instantiated with the underlying components, I imagine all key generation and loading being mediated by backends and resulting in objects that provide much more narrow interfaces organized around what you can do with a key (instead of what a key intrinsically is). For example, when generating an RSA key on the openssl backend you would get back an object which provides a basic interface indicating that it is an RSA key, that has some basic attributes for key size, and accessing the public key object, then methods for obtaining backend specific contexts for performing signing/verification and encryption/decryption operations. In addition to those basic operations the object may provide any number of backend specific serialization methods, potentially including "serializing" the key to something similar to the current interface (which we can think of as a bag of bignums). In this way we can facilitate converting between backend specific key representations through a process of serialization/deserialization (in many cases through a formal specification such as PKCS#8). -David

4 3

problem installing on Mac OS X 10.8.5
by Greg Wilson April 22, 2014

April 22, 2014

Hi, Trying to install cryptography so that I can install Scrapy; as per https://cryptography.io/en/latest/installation/, I'm using: $ brewinstall openssl Warning: openssl-1.0.1e already installed and then: $ env ARCHFLAGS="-arch x86_64" LDFLAGS="-L/usr/local/opt/openssl/lib" CFLAGS="-I/usr/local/opt/openssl/include" pip install cryptography Error message is below; note that I have installed libffi using "brew install libffi", and /usr/local/Cellar/libffi/3.0.13/lib/pkgconfig/libffi.pc exists. Pointers would be welcome... Thanks, Greg -------- Downloading/unpacking cryptography Running setup.py egg_info for package cryptography OS/X: confusion between 'cc' versus 'gcc' (see issue 123) will not use '__thread' in the C code Installed /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cffi-0.8.2-py2.7-macosx-10.5-x86_64.egg building '_Cryptography_cffi_684bb40axf342507b' extension /usr/bin/clang -DNDEBUG -g -fwrapv -O3 -Wall -Wstrict-prototypes -I/usr/local/opt/openssl/include -arch x86_64 -I/Users/gwilson/anaconda/include/python2.7 -c cryptography/hazmat/primitives/__pycache__/_Cryptography_cffi_684bb40axf342507b.c -o /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/primitives/__pycache__/cryptography/hazmat/primitives/__pycache__/_Cryptography_cffi_684bb40axf342507b.o /usr/bin/clang -bundle -undefined dynamic_lookup -L/Users/gwilson/anaconda/lib -L/usr/local/opt/openssl/lib -I/usr/local/opt/openssl/include -arch x86_64 -arch x86_64 /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/primitives/__pycache__/cryptography/hazmat/primitives/__pycache__/_Cryptography_cffi_684bb40axf342507b.o -L/Users/gwilson/anaconda/lib -o /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/primitives/__pycache__/_Cryptography_cffi_684bb40axf342507b.so building '_Cryptography_cffi_8f86901cxc1767c5a' extension /usr/bin/clang -DNDEBUG -g -fwrapv -O3 -Wall -Wstrict-prototypes -I/usr/local/opt/openssl/include -arch x86_64 -I/Users/gwilson/anaconda/include/python2.7 -c cryptography/hazmat/primitives/__pycache__/_Cryptography_cffi_8f86901cxc1767c5a.c -o /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/primitives/__pycache__/cryptography/hazmat/primitives/__pycache__/_Cryptography_cffi_8f86901cxc1767c5a.o /usr/bin/clang -bundle -undefined dynamic_lookup -L/Users/gwilson/anaconda/lib -L/usr/local/opt/openssl/lib -I/usr/local/opt/openssl/include -arch x86_64 -arch x86_64 /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/primitives/__pycache__/cryptography/hazmat/primitives/__pycache__/_Cryptography_cffi_8f86901cxc1767c5a.o -L/Users/gwilson/anaconda/lib -o /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/primitives/__pycache__/_Cryptography_cffi_8f86901cxc1767c5a.so building '_Cryptography_cffi_48bbf0ebx93c91939' extension /usr/bin/clang -DNDEBUG -g -fwrapv -O3 -Wall -Wstrict-prototypes -I/usr/local/opt/openssl/include -arch x86_64 -I/Users/gwilson/anaconda/include/python2.7 -c cryptography/hazmat/bindings/__pycache__/_Cryptography_cffi_48bbf0ebx93c91939.c -o /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/bindings/__pycache__/cryptography/hazmat/bindings/__pycache__/_Cryptography_cffi_48bbf0ebx93c91939.o /usr/bin/clang -bundle -undefined dynamic_lookup -L/Users/gwilson/anaconda/lib -L/usr/local/opt/openssl/lib -I/usr/local/opt/openssl/include -arch x86_64 -arch x86_64 /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/bindings/__pycache__/cryptography/hazmat/bindings/__pycache__/_Cryptography_cffi_48bbf0ebx93c91939.o -L/Users/gwilson/anaconda/lib -lcrypto -lssl -o /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/bindings/__pycache__/_Cryptography_cffi_48bbf0ebx93c91939.so Traceback (most recent call last): File "<string>", line 16, in <module> File "/private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/setup.py", line 156, in <module> "test": PyTest, File "/Users/gwilson/anaconda/lib/python2.7/distutils/core.py", line 152, in setup dist.run_commands() File "/Users/gwilson/anaconda/lib/python2.7/distutils/dist.py", line 953, in run_commands self.run_command(cmd) File "/Users/gwilson/anaconda/lib/python2.7/distutils/dist.py", line 972, in run_command cmd_obj.run() File "<string>", line 14, in replacement_run File "/Users/gwilson/anaconda/lib/python2.7/site-packages/setuptools/command/egg_info.py", line 259, in find_sources mm.run() File "/Users/gwilson/anaconda/lib/python2.7/site-packages/setuptools/command/egg_info.py", line 325, in run self.add_defaults() File "/Users/gwilson/anaconda/lib/python2.7/site-packages/setuptools/command/egg_info.py", line 361, in add_defaults sdist.add_defaults(self) File "/Users/gwilson/anaconda/lib/python2.7/site-packages/setuptools/command/sdist.py", line 199, in add_defaults build_py = self.get_finalized_command('build_py') File "/Users/gwilson/anaconda/lib/python2.7/distutils/cmd.py", line 312, in get_finalized_command cmd_obj.ensure_finalized() File "/Users/gwilson/anaconda/lib/python2.7/distutils/cmd.py", line 109, in ensure_finalized self.finalize_options() File "/Users/gwilson/anaconda/lib/python2.7/site-packages/setuptools/command/build_py.py", line 73, in finalize_options _build_py.finalize_options(self) File "/Users/gwilson/anaconda/lib/python2.7/distutils/command/build_py.py", line 46, in finalize_options ('force', 'force')) File "/Users/gwilson/anaconda/lib/python2.7/distutils/cmd.py", line 298, in set_undefined_options src_cmd_obj.ensure_finalized() File "/Users/gwilson/anaconda/lib/python2.7/distutils/cmd.py", line 109, in ensure_finalized self.finalize_options() File "/private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/setup.py", line 75, in finalize_options OpenSSLBinding().ffi.verifier.get_extension(), File "cryptography/hazmat/bindings/openssl/binding.py", line 83, in __init__ self._ensure_ffi_initialized() File "cryptography/hazmat/bindings/openssl/binding.py", line 99, in _ensure_ffi_initialized libraries) File "cryptography/hazmat/bindings/utils.py", line 77, in build_ffi ext_package="cryptography", File "/private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cffi-0.8.2-py2.7-macosx-10.5-x86_64.egg/cffi/api.py", line 341, in verify lib = self.verifier.load_library() File "/private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cffi-0.8.2-py2.7-macosx-10.5-x86_64.egg/cffi/verifier.py", line 75, in load_library return self._load_library() File "/private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cffi-0.8.2-py2.7-macosx-10.5-x86_64.egg/cffi/verifier.py", line 151, in _load_library return self._vengine.load_library() File "/private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cffi-0.8.2-py2.7-macosx-10.5-x86_64.egg/cffi/vengine_cpy.py", line 138, in load_library raise ffiplatform.VerificationError(error) cffi.ffiplatform.VerificationError: importing '/private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/bindings/__pycache__/_Cryptography_cffi_48bbf0ebx93c91939.so': dlopen(/private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/bindings/__pycache__/_Cryptography_cffi_48bbf0ebx93c91939.so, 2): Library not loaded: libcrypto.1.0.0.dylib Referenced from: /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/bindings/__pycache__/_Cryptography_cffi_48bbf0ebx93c91939.so Reason: image not found Complete output from command python setup.py egg_info: OS/X: confusion between 'cc' versus 'gcc' (see issue 123) will not use '__thread' in the C code Installed /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cffi-0.8.2-py2.7-macosx-10.5-x86_64.egg running egg_info creating pip-egg-info/cryptography.egg-info writing requirements to pip-egg-info/cryptography.egg-info/requires.txt writing pip-egg-info/cryptography.egg-info/PKG-INFO writing top-level names to pip-egg-info/cryptography.egg-info/top_level.txt writing dependency_links to pip-egg-info/cryptography.egg-info/dependency_links.txt writing manifest file 'pip-egg-info/cryptography.egg-info/SOURCES.txt' warning: manifest_maker: standard file '-c' not found running build_ext building '_Cryptography_cffi_684bb40axf342507b' extension creating /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/primitives/__pycache__/cryptography creating /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/primitives/__pycache__/cryptography/hazmat creating /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/primitives/__pycache__/cryptography/hazmat/primitives creating /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/primitives/__pycache__/cryptography/hazmat/primitives/__pycache__ /usr/bin/clang -DNDEBUG -g -fwrapv -O3 -Wall -Wstrict-prototypes -I/usr/local/opt/openssl/include -arch x86_64 -I/Users/gwilson/anaconda/include/python2.7 -c cryptography/hazmat/primitives/__pycache__/_Cryptography_cffi_684bb40axf342507b.c -o /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/primitives/__pycache__/cryptography/hazmat/primitives/__pycache__/_Cryptography_cffi_684bb40axf342507b.o /usr/bin/clang -bundle -undefined dynamic_lookup -L/Users/gwilson/anaconda/lib -L/usr/local/opt/openssl/lib -I/usr/local/opt/openssl/include -arch x86_64 -arch x86_64 /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/primitives/__pycache__/cryptography/hazmat/primitives/__pycache__/_Cryptography_cffi_684bb40axf342507b.o -L/Users/gwilson/anaconda/lib -o /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/primitives/__pycache__/_Cryptography_cffi_684bb40axf342507b.so running build_ext building '_Cryptography_cffi_8f86901cxc1767c5a' extension /usr/bin/clang -DNDEBUG -g -fwrapv -O3 -Wall -Wstrict-prototypes -I/usr/local/opt/openssl/include -arch x86_64 -I/Users/gwilson/anaconda/include/python2.7 -c cryptography/hazmat/primitives/__pycache__/_Cryptography_cffi_8f86901cxc1767c5a.c -o /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/primitives/__pycache__/cryptography/hazmat/primitives/__pycache__/_Cryptography_cffi_8f86901cxc1767c5a.o /usr/bin/clang -bundle -undefined dynamic_lookup -L/Users/gwilson/anaconda/lib -L/usr/local/opt/openssl/lib -I/usr/local/opt/openssl/include -arch x86_64 -arch x86_64 /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/primitives/__pycache__/cryptography/hazmat/primitives/__pycache__/_Cryptography_cffi_8f86901cxc1767c5a.o -L/Users/gwilson/anaconda/lib -o /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/primitives/__pycache__/_Cryptography_cffi_8f86901cxc1767c5a.so running build_ext building '_Cryptography_cffi_48bbf0ebx93c91939' extension creating /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/bindings/__pycache__/cryptography creating /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/bindings/__pycache__/cryptography/hazmat creating /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/bindings/__pycache__/cryptography/hazmat/bindings creating /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/bindings/__pycache__/cryptography/hazmat/bindings/__pycache__ /usr/bin/clang -DNDEBUG -g -fwrapv -O3 -Wall -Wstrict-prototypes -I/usr/local/opt/openssl/include -arch x86_64 -I/Users/gwilson/anaconda/include/python2.7 -c cryptography/hazmat/bindings/__pycache__/_Cryptography_cffi_48bbf0ebx93c91939.c -o /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/bindings/__pycache__/cryptography/hazmat/bindings/__pycache__/_Cryptography_cffi_48bbf0ebx93c91939.o /usr/bin/clang -bundle -undefined dynamic_lookup -L/Users/gwilson/anaconda/lib -L/usr/local/opt/openssl/lib -I/usr/local/opt/openssl/include -arch x86_64 -arch x86_64 /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/bindings/__pycache__/cryptography/hazmat/bindings/__pycache__/_Cryptography_cffi_48bbf0ebx93c91939.o -L/Users/gwilson/anaconda/lib -lcrypto -lssl -o /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/bindings/__pycache__/_Cryptography_cffi_48bbf0ebx93c91939.so Traceback (most recent call last): File "<string>", line 16, in <module> File "/private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/setup.py", line 156, in <module> "test": PyTest, File "/Users/gwilson/anaconda/lib/python2.7/distutils/core.py", line 152, in setup dist.run_commands() File "/Users/gwilson/anaconda/lib/python2.7/distutils/dist.py", line 953, in run_commands self.run_command(cmd) File "/Users/gwilson/anaconda/lib/python2.7/distutils/dist.py", line 972, in run_command cmd_obj.run() File "<string>", line 14, in replacement_run File "/Users/gwilson/anaconda/lib/python2.7/site-packages/setuptools/command/egg_info.py", line 259, in find_sources mm.run() File "/Users/gwilson/anaconda/lib/python2.7/site-packages/setuptools/command/egg_info.py", line 325, in run self.add_defaults() File "/Users/gwilson/anaconda/lib/python2.7/site-packages/setuptools/command/egg_info.py", line 361, in add_defaults sdist.add_defaults(self) File "/Users/gwilson/anaconda/lib/python2.7/site-packages/setuptools/command/sdist.py", line 199, in add_defaults build_py = self.get_finalized_command('build_py') File "/Users/gwilson/anaconda/lib/python2.7/distutils/cmd.py", line 312, in get_finalized_command cmd_obj.ensure_finalized() File "/Users/gwilson/anaconda/lib/python2.7/distutils/cmd.py", line 109, in ensure_finalized self.finalize_options() File "/Users/gwilson/anaconda/lib/python2.7/site-packages/setuptools/command/build_py.py", line 73, in finalize_options _build_py.finalize_options(self) File "/Users/gwilson/anaconda/lib/python2.7/distutils/command/build_py.py", line 46, in finalize_options ('force', 'force')) File "/Users/gwilson/anaconda/lib/python2.7/distutils/cmd.py", line 298, in set_undefined_options src_cmd_obj.ensure_finalized() File "/Users/gwilson/anaconda/lib/python2.7/distutils/cmd.py", line 109, in ensure_finalized self.finalize_options() File "/private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/setup.py", line 75, in finalize_options OpenSSLBinding().ffi.verifier.get_extension(), File "cryptography/hazmat/bindings/openssl/binding.py", line 83, in __init__ self._ensure_ffi_initialized() File "cryptography/hazmat/bindings/openssl/binding.py", line 99, in _ensure_ffi_initialized libraries) File "cryptography/hazmat/bindings/utils.py", line 77, in build_ffi ext_package="cryptography", File "/private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cffi-0.8.2-py2.7-macosx-10.5-x86_64.egg/cffi/api.py", line 341, in verify lib = self.verifier.load_library() File "/private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cffi-0.8.2-py2.7-macosx-10.5-x86_64.egg/cffi/verifier.py", line 75, in load_library return self._load_library() File "/private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cffi-0.8.2-py2.7-macosx-10.5-x86_64.egg/cffi/verifier.py", line 151, in _load_library return self._vengine.load_library() File "/private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cffi-0.8.2-py2.7-macosx-10.5-x86_64.egg/cffi/vengine_cpy.py", line 138, in load_library raise ffiplatform.VerificationError(error) cffi.ffiplatform.VerificationError: importing '/private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/bindings/__pycache__/_Cryptography_cffi_48bbf0ebx93c91939.so': dlopen(/private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/bindings/__pycache__/_Cryptography_cffi_48bbf0ebx93c91939.so, 2): Library not loaded: libcrypto.1.0.0.dylib Referenced from: /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography/cryptography/hazmat/bindings/__pycache__/_Cryptography_cffi_48bbf0ebx93c91939.so Reason: image not found ---------------------------------------- Cleaning up... Command python setup.py egg_info failed with error code 1 in /private/var/folders/vz/m_8fd1kj2kn9t2gq0d8fqgg00000gn/T/pip_build_gwilson/cryptography Storing complete log in /Users/gwilson/.pip/pip.log

2 4

Release Cadences
by Paul Kehrer April 22, 2014

April 22, 2014

Now that we’re an upstream dependency for at least one major project (PyOpenSSL) it might make sense to try to fall into a monthly release cadence. This way we wouldn't block important features in our bindings from being consumed by downstream and we’ll also be able to get features out more regularly in hazmat/recipes. This would be helpful right now in allowing JP to schedule releases of PyOpenSSL that contain dependencies on new features we add. It would also help prevent situations like issue 941 (https://github.com/pyca/cryptography/issues/941) from arising in the future. If we did want to do monthly release cadence then next Monday would be essentially a month from the release of 0.3. We would need to significantly triage our fourth release issue list (and get some reviews!), but that will always be true for any release. Do people generally support this idea? -Paul

7 10

Towards a new TLS API
by Christopher Armstrong April 19, 2014

April 19, 2014

If you’re eager, the link is at the bottom of this email. I’m not sure I have it in me to describe the context of this project from the beginning, so I will start in the middle: a bunch of people have agreed that designing a new high-level TLS API for Python is a good idea. At PyCon, I sprinted on designing this API with several other people, and got input from many people in the PyCA community: - Ying Li - Paul Kehrer - Jean-Paul Calderone - Laurens Van Houtven - Alex Gaynor - David Reid - Hynek Schlawack - Corbin Simpson - Aaron Gallagher And probably some other people that I missed. It’s still in a very rough state, and certainly needs much more serious thought (as well as some bikeshedding). I’ll describe some of the basic tenets predicating the design: - It will be be easy to use! - It will be opinionated about which math and TLS versions to use, and not allow downgrading to weaker security - It will have no IO (deal only with in-memory buffers) - It will be implemented with multiple backends, such as OpenSSL, SecureTransport, PyTLS, etc. - It will have no global state - It will not allow disabling of security features such as basic security checks, chain validation and hostname validation. - It will support both client and server operation. - We may expose less safe and more flexible lower-level APIs, but they will be clearly delineated from the API that people *should* be using. In addition, we may implement the protocol from scratch (of course using existing cryptography backends) in the future. Some of us feel strongly that protocol code should not be implemented in C (or any memory-unsafe language). I believe that the PyCA community has enough expertise to eventually produce a secure TLS implementation. Right now the design is a sphinx-style .rst file in a branch of cryptography in my github account (mostly so I can run “make html” on it and get pretty output). Unfortunately this means I’m the only one who can commit to it or accept PRs, so if anyone has a suggestion to improve this situation I’d be happy to oblige. The direct link to the file is: https://raw.githubusercontent.com/radix/cryptography/tls-api/docs/tls-api.r… The branch is: https://github.com/radix/cryptography/tree/tls-api Any input would be greatly appreciated. Make sure to check the “TODO” and “Future work” sections of the document at the end in case you’re reading through it and immediately think of something to shout about :) PRs are appreciated. Thanks! -- Christopher Armstrong http://twitter.com/radix http://wordeology.com/

2 2