Mailman 3 July 2018 - Cryptography-dev

Re: [Cryptography-dev] The ECDH vulnerability
by Roland Hedberg July 31, 2018

July 31, 2018

Excellent news, thanks ! — Roland The higher up you go, the more mistakes you are allowed. Right at the top, if you make enough of them, it's considered to be your style. -Fred Astaire, dancer, actor, singer, musician, and choreographer (10 May 1899-1987)

1 0

The ECDH vulnerability
by Roland Hedberg July 23, 2018

July 23, 2018

In https://blogs.adobe.com/security/2017/03/critical-vulnerability-uncovered-i… Antonio Sanso discusses a vulnerability when doing Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES). Can cryptography help me with this ? Basically, can I use cryptography to check whether public key is on the private key's curve. — Roland The higher up you go, the more mistakes you are allowed. Right at the top, if you make enough of them, it's considered to be your style. -Fred Astaire, dancer, actor, singer, musician, and choreographer (10 May 1899-1987)

2 1

an question about bcrypt 3.1.0
by Peng Lu July 19, 2018

July 19, 2018

Hi, I am from China and work in Ericsson. I have an question about bcrypt module and hope that you can give me a solution. I want to install bcrypt 3.1.0 in SunOS system. But it failed. [selix508] out: [?25hCollecting bcrypt>=3.1.3 (from paramiko<=2.4.1,>=2.4.1->ufte-toolkit==1.10.40) [selix508] out: [31m Could not find a version that satisfies the requirement bcrypt>=3.1.3 (from paramiko<=2.4.1,>=2.4.1->ufte-toolkit==1.10.40) (from versions: )[0m [selix508] out: [31mNo matching distribution found for bcrypt>=3.1.3 (from paramiko<=2.4.1,>=2.4.1->ufte-toolkit==1.10.40)[0m [selix508] out: Fatal error: run() received nonzero return code 1 while executing! Can bcrypt module be installed in SunOS system? If it can, how can we fix the issue? Thank you in advance. BRs//Peng

2 1

PyCA cryptography 2.3 released
by Paul Kehrer July 18, 2018

July 18, 2018

PyCA cryptography 2.2.2 has been released to PyPI. cryptography includes both high level recipes and low level interfaces to common cryptographic algorithms such as symmetric ciphers, message digests, and key derivation functions. We support Python 2.7, Python 3.4+, and PyPy. Changelog (https://cryptography.io/en/latest/changelog/#v2-3): * SECURITY ISSUE: finalize_with_tag() allowed tag truncation by default which can allow tag forgery in some cases. The method now enforces the min_tag_length provided to the GCM constructor. * Added support for Python 3.7. * Added extract_timestamp() to get the authenticated timestamp of a Fernet token. * Support for Python 2.7.x without hmac.compare_digest has been deprecated. We will require Python 2.7.7 or higher (or 2.7.6 on Ubuntu) in the next cryptography release. * Fixed multiple issues preventing cryptography from compiling against LibreSSL 2.7.x. * Added get_revoked_certificate_by_serial_number for quick serial number searches in CRLs. * The RelativeDistinguishedName class now preserves the order of attributes. Duplicate attributes now raise an error instead of silently discarding duplicates. * aes_key_unwrap() and aes_key_unwrap_with_padding() now raise InvalidUnwrap if the wrapped key is an invalid length, instead of ValueError. -Paul Kehrer (reaperhulk)

1 0