Mailman 3 October 2015 - Cryptography-dev

Validating certificate chains
by Benn Bollay Oct. 30, 2015

Oct. 30, 2015

If I have two X509.Certificate objects, how would I validate that one is correctly subordinate (that is, the signature is correct) to the other? Cheers, --B

2 1

Certificate Chain Verification
by Benn Bollay Oct. 30, 2015

Oct. 30, 2015

Hello folks - Given a set of certificates, I'd like to verify that the chain is cryptographically correct, all of the certificates are chronologically valid, and so forth. Cheers, --B

3 3

PyCA cryptography 1.1 released
by Paul Kehrer Oct. 28, 2015

Oct. 28, 2015

On behalf of all our contributors I am pleased to announce the release of PyCA/cryptography (https://github.com/pyca/cryptography) 1.1! cryptography is a package which provides cryptographic recipes and primitives to Python developers. Our goal is for it to be your "cryptographic standard library". We support Python 2.6-2.7, Python 3.3+, and PyPy. Changelog (https://cryptography.io/en/latest/changelog/): * Added support for Elliptic Curve Diffie-Hellman with ECDH. * Added X963KDF. * Added support for parsing certificate revocation lists (CRLs) using load_pem_x509_crl() and load_der_x509_crl(). * Add support for AES key wrapping with aes_key_wrap() and aes_key_unwrap(). * Added a __hash__ method to Name. * Add support for encoding and decoding elliptic curve points to a byte string form using encode_point() and from_encoded_point(). * Added get_extension_for_class(). * CertificatePolicies are now supported in the CertificateBuilder. * countryName is now encoded as a PrintableString when creating subject and issuer distinguished names with the Certificate and CSR builder classes. ...and other small improvements as always. -Paul Kehrer (reaperhulk)

1 0

Re: [Cryptography-dev] Cryptography-dev Digest, Vol 27, Issue 10
by Peter Hamilton Oct. 28, 2015

Oct. 28, 2015

Thanks for the information Ron, it definitely helps. It actually looks like as of yesterday EllipticCurvePublicNumbers has a from_encoded_point class method, which handles converting x/y. I should be able to use cryptography.utils.int_from_bytes to handle the private_value. With these two utilities, I should be good to go. Thanks again! Peter On Wed, Oct 28, 2015 at 12:00 PM, <cryptography-dev-request(a)python.org> wrote: > Send Cryptography-dev mailing list submissions to > cryptography-dev(a)python.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://mail.python.org/mailman/listinfo/cryptography-dev > or, via email, send a message with subject or body 'help' to > cryptography-dev-request(a)python.org > > You can reach the person managing the list at > cryptography-dev-owner(a)python.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Cryptography-dev digest..." > > > Today's Topics: > > 1. Questions on writing EllipticCurve test fixtures (Peter Hamilton) > 2. Re: Questions on writing EllipticCurve test fixtures > (Ron Frederick) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 27 Oct 2015 15:27:25 -0400 > From: Peter Hamilton <peter.allen.hamilton(a)gmail.com> > To: cryptography-dev(a)python.org > Subject: [Cryptography-dev] Questions on writing EllipticCurve test > fixtures > Message-ID: > <CAL97E87hiXuGX40xdrHM7=_ > WM9mBg3z-A6SnuT-k1BnmHU-7wg(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > I'm trying to add a tests/hazmat/primitives/fixtures_ec.py file containing > EllipticCurve fixtures for use in testing the certificate validation > feature I'm working on, and I have a few questions. I'm using OpenSSL to > generate EllipticCurve public/private keys, with the intent of then adding > them in fixtures_ec.py as Python literals (like how fixtures_rsa.py and > fixtures_dsa.py handle things). > > When defining EllipticCurvePrivateNumbers, is the hex string used for the > private_value argument taken verbatim from the priv field in the > EllipticCurve private key file, or is it the hex of the integer produced > after converting the priv hex string according to the rules in RFC 5915 and > 3447? I have the same questions regarding the x and y fields of the > EllipticCurvePublicNumbers object that's also needed by > EllipticCurvePrivateNumbers. It's not clear to me, from looking at the RSA > and DSA examples, how they're handled so without more context here I'm > pretty much stuck. I tried backtracking how the EllipticCurvePrivateNumbers > data is used by the backends but I didn't find anything that shed light on > the situation. > > Also, is OpenSSL the best tool to use here for generating these test > examples? It's what I've always used but if there's another tool that > generates the EllipticCurve keys in the format that cryptography expects, > I'm happy to switch to using that to generate the examples. > > Thanks for your time, > Peter Hamilton >

1 0

Questions on writing EllipticCurve test fixtures
by Peter Hamilton Oct. 28, 2015

Oct. 28, 2015

I'm trying to add a tests/hazmat/primitives/fixtures_ec.py file containing EllipticCurve fixtures for use in testing the certificate validation feature I'm working on, and I have a few questions. I'm using OpenSSL to generate EllipticCurve public/private keys, with the intent of then adding them in fixtures_ec.py as Python literals (like how fixtures_rsa.py and fixtures_dsa.py handle things). When defining EllipticCurvePrivateNumbers, is the hex string used for the private_value argument taken verbatim from the priv field in the EllipticCurve private key file, or is it the hex of the integer produced after converting the priv hex string according to the rules in RFC 5915 and 3447? I have the same questions regarding the x and y fields of the EllipticCurvePublicNumbers object that's also needed by EllipticCurvePrivateNumbers. It's not clear to me, from looking at the RSA and DSA examples, how they're handled so without more context here I'm pretty much stuck. I tried backtracking how the EllipticCurvePrivateNumbers data is used by the backends but I didn't find anything that shed light on the situation. Also, is OpenSSL the best tool to use here for generating these test examples? It's what I've always used but if there's another tool that generates the EllipticCurve keys in the format that cryptography expects, I'm happy to switch to using that to generate the examples. Thanks for your time, Peter Hamilton

2 1

Selecting alternative OpenSSL library
by Jesus Cea Oct. 21, 2015

Oct. 21, 2015

My stock OpenSSL library is ancient so I installed an alternative current OpenSSL release under "/usr/local/ssl". In order to compile "cryptography" in this machine I must do: $ LDFLAGS="-L/usr/local/ssl/lib" \ CFLAGS="-I/usr/local/ssl/include" \ python -m pip install -U cryptography This is a Solaris machine, but I guess the same can be done in Linux, and other unix-like OSs. Please, add something about this in <https://cryptography.io/en/latest/installation/>. Thanks for "cryptography". It is an amazing product. PS: How can I know what OpenSSL version is using "cryptography", beside checking the loaded shared objects by hand? :): """ $ python3 Python 3.5.0 (dtrace-issue13405_3.5:a7da156226da, Sep 13 2015, 18:22:50) [GCC 5.2.0] on sunos5 Type "help", "copyright", "credits" or "license" for more information. >>> import cryptography >>> from cryptography.hazmat.bindings.openssl.binding import Binding >>> import os >>> os.getpid() 22075 ... [In another terminal] $ # pmap 22075 | grep -i ssl FDF00000 1536K r-x-- /usr/local/ssl/lib/libcrypto.so.1.0.0 FE08F000 92K rwx-- /usr/local/ssl/lib/libcrypto.so.1.0.0 FE0A6000 8K rwx-- /usr/local/ssl/lib/libcrypto.so.1.0.0 FE0B0000 376K r-x-- /usr/local/ssl/lib/libssl.so.1.0.0 FE11D000 28K rwx-- /usr/local/ssl/lib/libssl.so.1.0.0 FE130000 552K r-x-- /usr/local/lib/python3.5/site-packages/cryptography/hazmat/bindings/_openssl.so FE1C9000 60K rwx-- /usr/local/lib/python3.5/site-packages/cryptography/hazmat/bindings/_openssl.so """ -- Jesús Cea Avión _/_/ _/_/_/ _/_/_/ jcea(a)jcea.es - http://www.jcea.es/ _/_/ _/_/ _/_/ _/_/ _/_/ Twitter: @jcea _/_/ _/_/ _/_/_/_/_/ jabber / xmpp:jcea@jabber.org _/_/ _/_/ _/_/ _/_/ _/_/ "Things are not so easy" _/_/ _/_/ _/_/ _/_/ _/_/ _/_/ "My name is Dump, Core Dump" _/_/_/ _/_/_/ _/_/ _/_/ "El amor es poner tu felicidad en la felicidad de otro" - Leibniz

3 4

Creation and signing of X.509 certificates
by Jesus Cea Oct. 20, 2015

Oct. 20, 2015

I wonder if current library release can create X.509 certificates as clients and CAs, and signing those certificates with a CA certificate (generated with cryptography library too). I want to drop OpenSSL for this activity for good!. -- Jesús Cea Avión _/_/ _/_/_/ _/_/_/ jcea(a)jcea.es - http://www.jcea.es/ _/_/ _/_/ _/_/ _/_/ _/_/ Twitter: @jcea _/_/ _/_/ _/_/_/_/_/ jabber / xmpp:jcea@jabber.org _/_/ _/_/ _/_/ _/_/ _/_/ "Things are not so easy" _/_/ _/_/ _/_/ _/_/ _/_/ _/_/ "My name is Dump, Core Dump" _/_/_/ _/_/_/ _/_/ _/_/ "El amor es poner tu felicidad en la felicidad de otro" - Leibniz

2 1

SCEP OID support
by Micah Baker Oct. 15, 2015

Oct. 15, 2015

I’m attempting to build a SCEP server using cryptography and don’t see a way to add OIDs not already defined by the module. If it is not possible to use other real OIDs, can we add the half-dozen SCEP OIDs to cryptography? The OIDs can be found here: https://tools.ietf.org/html/draft-gutmann-scep-01#page-17 <https://tools.ietf.org/html/draft-gutmann-scep-01#page-17>. If someone is willing to give me some pointers I could try to write a patch for this, assuming it’s just a table of supported OIDs somewhere.

2 5

pkcs12 to pkcs7
by Roshan Cherian Oct. 14, 2015

Oct. 14, 2015

Hi Team, I have a requirement to convert from p12 to p7. I am sorry for my little knowledge on this. I am doing the following: p12 = load_pkcs12(file(self._pkcs12Path, 'rb').read()) pem = dump_certificate(FILETYPE_PEM, p12.get_certificate()) p7 = load_pkcs7_data(FILETYPE_PEM, pem) However I am getting an error: Error: [('asn1 encoding routines', 'ASN1_CHECK_TLEN', 'wrong tag'), ('asn1 encoding routines', 'ASN1_D2I_EX_PRIMITIVE', 'nested asn1 error'), ('asn1 encoding routines', 'ASN1_TEMPLATE_NOEXP_D2I', 'nested asn1 error'), ('PEM routines', 'PEM_ASN1_read_bio', 'ASN1 lib')] I am pretty sure I am doing something wrong, could you help? Thanks, -Roshan

5 6