Mailman 3 January 2015 - Cryptography-dev

Create Fernet API allowing streaming encryption and decryption from file-like objects.
by Michael Iverson Jan. 19, 2015

Jan. 19, 2015

Hello, I'm new to the cryptography library, and I'm definitely excited about having a well-reviewed cryptographic library with a simple API. However, I'm noticing that there is area that might improve the usefulness of the high level methods. The Fernet API is where my interest lies, as I'm presently in need of a symmetric algorithm. However, the idea could be equally applicable for other APIs. The fernet API presently requires that a complete buffer containing the plaintext or cyphertext be passed to the encryption or decryption methods. This requirement becomes memory inefficient for moderately sized objects, and can prevent processing of large objects entirely, especially on memory constrained systems. Furthermore, many python libraries use file handles as an abstraction for incrementally consuming or producing data. Examples include http responses in Tornado and Cyclone, and the SFTP interface in paramiko. I'd like to propose the addition of an alternate API that would accept and return file handles, and incrementally encrypt or decrypt using the handles. I think this would make the library more useful for a variety of solutions, enhancing adoption. On the surface, it appears that the main cryptographic primitives, (hmac, padding, aes, etc.) are designed to operate on in an incremental fashion, using the update() method to incrementally compute data, and finalize() to return the final result, so the change may not be overly difficult. I'm willing to contribute the code for such an endeavor, as I'm going to write it anyway for a current project. Contributing the code will help ensure it it is adequately reviewed. Does anyone feel this would be a worthwhile improvement? -- Michael Iverson

5 11

PyCA cryptography 0.7.2 release
by Paul Kehrer Jan. 16, 2015

Jan. 16, 2015

PyCA cryptography 0.7.2 has been released to PyPI. Changelog: * Updated Windows wheels to be compiled against OpenSSL 1.0.1l. * enum34 is no longer installed on Python 3.4, where it is included in the standard library. * Added a new function to the OpenSSL bindings to support additional functionality in pyOpenSSL. As always, thanks to everyone who helped with this release. -Paul Kehrer

1 0

Fernet newbie question: suppling existing key for decoding
by David Evans Jan. 5, 2015

Jan. 5, 2015

I'm playing with the Fernet and AES encryption from cryptography. I've only started with Python a few weeks ago and I'm not up on cryptography. I'm trying to decrypt data that has been encoded with OpenSSL. I can decode it with python 2.7 using Crypto.Cipher but I'm having problems getting cryptography to do the same thing. Q: While key *=* Fernet*.*generate_key() will generate a new key is there a way to generate a valid key from an existing passphrase? openssl enc -base64 produces a key that is too small. Does this need to be padded with NULLs or is there a command I'm missing? I'd prefer documentation that will bring me up to speed on this area rather than example code. The November thread on signatures and keys didn't address my simplistic issue. FYI: I have tried using the lower level "Cipher(algorithms.AES(key), modes.CBC(iv), backend=backend)" but my decryptor generates and error but this due to my sending a str and not bytes. Many thanks, David -- ========================= Your reason is treason. Kasabian

2 3