Mailman 3 October 2019 - Cryptography-dev

Verify signature via cryptography.
by Ajeet Singh Oct. 25, 2019

Oct. 25, 2019

Hi All, I am trying to verify signature via lib cryptography. Basically , I am trying to simulate below Openssl command via python lib. openssl smime -verify -in $PKCS7 -inform PEM -content $DOCUMENT -certfile pubkey Can you please help me how can I do this in python. Thanks and Regards, Ajeet

1 0

macOS older than 10.12
by Alex Gaynor Oct. 20, 2019

Oct. 20, 2019

Hi everyone, We're considering dropping support for macOS versions older than 10.12, due to maintenance burden, and incredibly low usage (per PyPI metrics). Before we do that, we just wanted to check in to see if there was any reason this would cause a problem for anyone? Alex -- All that is necessary for evil to succeed is for good people to do nothing.

2 1

PyCA cryptography 2.8 released
by Paul Kehrer Oct. 17, 2019

Oct. 17, 2019

PyCA cryptography 2.8 has been released to PyPI. cryptography includes both high level recipes and low level interfaces to common cryptographic algorithms such as symmetric ciphers, asymmetric algorithms, message digests, X509, key derivation functions, and much more. We support Python 2.7, Python 3.4+, and PyPy. Changelog (https://cryptography.io/en/latest/changelog/#v2-8): * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1d. * Added support for Python 3.8. * Added class methods Poly1305.generate_tag and Poly1305.verify_tag for Poly1305 sign and verify operations. * Deprecated support for OpenSSL 1.0.1. Support will be removed in cryptography 2.9. * We now ship manylinux2010 wheels in addition to our manylinux1 wheels. * Added support for ed25519 and ed448 keys in the CertificateBuilder, CertificateSigningRequestBuilder, CertificateRevocationListBuilder and OCSPResponseBuilder. * cryptography no longer depends on asn1crypto. * FreshestCRL is now allowed as a CertificateRevocationList extension. -Paul Kehrer (reaperhulk)

1 0

Help to get a patch for ocsp and crl support for cryptography
by salil GK Oct. 4, 2019

Oct. 4, 2019

Hello I am not that an expert developer in cryptography. We are using cryptography module for certificate management. I was looking at our code base and found that there was a patch we applied to cryptography module to get ocsp and crl support. We have been using 2.1.4 cryptography version. But now we need to move to 2.7 and the older patch is not working. Could you please help me find the patch for this that works in cryptography 2.7. Thanks GKS

2 4

cryptography built with custom OpenSSL missing FIPS functionality
by Ryan Hsu Oct. 4, 2019

Oct. 4, 2019

Hi All, Running into an interesting problem here. I have built cryptography in a centos container using a custom OpenSSL (1.0.2t) with FIPS object module (2.0.16). This all works well and fine but FIPS functionality seems to be missing. For example, when running: print backend._lib.FIPS_mode_set(1) print ''.join([backend._lib.OPENSSL_VERSION_TEXT[i] for i in range(30)]) I expect to get "1" and "OpenSSL 1.0.2t-fips 10 Sep 2019". Instead, I am getting "0" and "OpenSSL 1.0.2t 10 Sep 2019" (without the -fips designation). Since the output of "openssl version" using the OpenSSL binary that I built shows "OpenSSL 1.0.2t-fips 10 Sep 2019", I assume that my OpenSSL build is fine and therefore something went wrong in my cryptography build. As a quick way to reproduce this, I have attached a Dockerfile that can reproduce what I'm seeing. Does anyone know if what I'm seeing is expected or perhaps I'm doing something wrong in my cryptography build? Since I'm not much of an expert in C and building from source, I'm hoping this is just a small mistake on my part. Appreciate any help here! Thank you, Ryan FROM centos # Install build dependencies RUN yum groupinstall -y "Development Tools" && \ yum install -y python-devel libffi-devel # Install Python dependencies RUN curl https://bootstrap.pypa.io/get-pip.py -o get-pip.py && \ python get-pip.py && \ pip install virtualenv setuptools wheel pip # Build Fips object module RUN curl -O https://www.openssl.org/source/openssl-fips-2.0.16.tar.gz && \ tar xvf openssl-fips-2.0.16.tar.gz && \ cd openssl-fips-2.0.16 && \ ./config && \ make && \ make install # Build OpenSSL RUN curl -O https://www.openssl.org/source/openssl-1.0.2t.tar.gz && \ tar xvf openssl-1.0.2t.tar.gz && \ cd /openssl-1.0.2t && \ ./config fips no-shared -fPIC --prefix=/openssl-1.0.2t/openssl && \ make depend && \ make && \ make install # Build cryptography RUN CFLAGS="-I/openssl-1.0.2t/openssl/include" LDFLAGS="-L/openssl-1.0.2t/openssl/lib" pip wheel --no-cache --no-binary :all: cryptography && \ pip install cryptography*.whl # Test if fips is enabled RUN python -c "\ from cryptography.hazmat.backends.openssl.backend import backend;\ print backend._lib.FIPS_mode_set(1);\ print ''.join([backend._lib.OPENSSL_VERSION_TEXT[i] for i in range(30)])"

1 0