Cryptography-dev

Download

cryptography-dev@python.org

January 2019

3 participants
2 discussions

PyCA cryptography 2.5 released
by Paul Kehrer Jan. 22, 2019

Jan. 22, 2019

PyCA cryptography 2.5 has been released to PyPI. cryptography includes both high level recipes and low level interfaces to common cryptographic algorithms such as symmetric ciphers, asymmetric algorithms, message digests, X509, key derivation functions, and much more. We support Python 2.7, Python 3.4+, and PyPy. Changelog (https://cryptography.io/en/latest/changelog/#v2-5): * BACKWARDS INCOMPATIBLE: U-label strings were deprecated in version 2.1, but this version removes the default idna dependency as well. If you still need this deprecated path please install cryptography with the idna extra: pip install cryptography[idna]. * BACKWARDS INCOMPATIBLE: The minimum supported PyPy version is now 5.4. * Numerous classes and functions have been updated to allow bytes-like types for keying material and passwords, including symmetric algorithms, AEAD ciphers, KDFs, loading asymmetric keys, and one time password classes. * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1a. * Added support for SHA512_224 and SHA512_256 when using OpenSSL 1.1.1. * Added support for SHA3_224, SHA3_256, SHA3_384, and SHA3_512 when using OpenSSL 1.1.1. * Added support for X448 key exchange when using OpenSSL 1.1.1. * Added support for SHAKE128 and SHAKE256 when using OpenSSL 1.1.1. * Added initial support for parsing PKCS12 files with load_key_and_certificates(). * Added support for IssuingDistributionPoint. * Added rfc4514_string() method to x509.Name, x509.RelativeDistinguishedName, and x509.NameAttribute to format the name or component an RFC 4514 Distinguished Name string. * Added from_encoded_point(), which immediately checks if the point is on the curve and supports compressed points. Deprecated the previous method from_encoded_point(). * Added signature_hash_algorithm to OCSPResponse. * Updated X25519 key exchange support to allow additional serialization methods. Calling public_bytes() with no arguments has been deprecated. * Added support for encoding compressed and uncompressed points via public_bytes(). Deprecated the previous method encode_point(). -Paul Kehrer (reaperhulk)

1 0

build. cryptography with fips openssl and enable fips mode
by Krishna Kumar Jan. 11, 2019

Jan. 11, 2019

Hi I am new to python and I am trying to run mitmproxy <https://mitmproxy.org/>in fips mode. It uses cryptography <https://github.com/mitmproxy/mitmproxy/issues/1808>. Since its built on top of python i thought we need to make my python use fips openssl and enable fips mode in it. I compiled python 3.6 against fips openssl and along with exposing functions to enabled fips mode in it as explained here <https://stackoverflow.com/questions/49493537/how-to-implement-fips-mode-and…> . Python shows that it uses fips openssl nsroot@Egress-1:~/openssl$ python3 Python 3.6.4 (default, Jan 10 2019, 21:10:38) [GCC 5.4.0 20160609] on linux Type "help", "copyright", "credits" or "license" for more information. >>> import ssl >>> ssl.OPENSSL_VERSION *'OpenSSL 1.0.2q-fips 20 Nov 2018'* But when i do following i see different version nsroot@Egress-1:~/python$ python3 Python 3.6.4 (default, Jan 10 2019, 21:10:38) [GCC 5.4.0 20160609] on linux Type "help", "copyright", "credits" or "license" for more information. >>> from OpenSSL import SSL >>> print("OpenSSL: {}".format(SSL.SSLeay_version(SSL.SSLEAY_VERSION).decode()),) *OpenSSL: OpenSSL 1.1.0j 20 Nov 2018* So i guess i am getting different version because cryptography comes with its own version of openssl as mentioned here https://cryptography.io/en/latest/installation/#using-your-own-openssl-on-l… Looking at the documentation it looks like its tested with fips openssl https://cryptography.io/en/latest/installation/#supported-platforms. The link <https://cryptography.io/en/latest/installation/#using-your-own-openssl-on-l…> doesn't explain in detail how we can compile cryptography step by step with any custom openssl here in my case with fips openssl. Is there any other link or documentation which i can follow to compile cryptography against fips openssl? Any help is appreciated. Also once its compiled against fips openssl how do we enable fips mode in it. Openssl documentation says the application should call FIPS_mode_set() to be really in FIPS mode. How do we do it for the openssl used by cryptography so that the application mitmproxy uses FIPS crypto. Thanks Krishna kumar

2 1