Mailman 3 February 2019 - Cryptography-dev

PyCA cryptography 2.6.1 released
by Paul Kehrer Feb. 27, 2019

Feb. 27, 2019

PyCA cryptography 2.6.1 has been released to PyPI. cryptography includes both high level recipes and low level interfaces to common cryptographic algorithms such as symmetric ciphers, asymmetric algorithms, message digests, X509, key derivation functions, and much more. We support Python 2.7, Python 3.4+, and PyPy. Changelog (https://cryptography.io/en/latest/changelog/#v2-6-1): * Resolved an error in our build infrastructure that broke our Python3 wheels for macOS and Linux. -Paul Kehrer (reaperhulk)

1 0

PyCA cryptography 2.6
by Alex Gaynor Feb. 27, 2019

Feb. 27, 2019

PyCA cryptography 2.5 has been released to PyPI. cryptography includes both high level recipes and low level interfaces to common cryptographic algorithms such as symmetric ciphers, asymmetric algorithms, message digests, X509, key derivation functions, and much more. We support Python 2.7, Python 3.4+, and PyPy. Changelog (https://cryptography.io/en/latest/changelog/#v2-6): - *BACKWARDS INCOMPATIBLE:* Removed cryptography.hazmat.primitives.asymmetric.utils.encode_rfc6979_signature and cryptography.hazmat.primitives.asymmetric.utils.decode_rfc6979_signature, which had been deprecated for nearly 4 years. Use encode_dss_signature() <https://cryptography.io/en/latest/hazmat/primitives/asymmetric/utils/#crypt…> and decode_dss_signature() <https://cryptography.io/en/latest/hazmat/primitives/asymmetric/utils/#crypt…> instead. - *BACKWARDS INCOMPATIBLE*: Removed cryptography.x509.Certificate.serial, which had been deprecated for nearly 3 years. Use serial_number <https://cryptography.io/en/latest/x509/reference/#cryptography.x509.Certifi…> instead. - Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1b. - Added support for Ed448 signing <https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ed448/> when using OpenSSL 1.1.1b or newer. - Added support for Ed25519 signing <https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ed25519/> when using OpenSSL 1.1.1b or newer. - load_ssh_public_key() <https://cryptography.io/en/latest/hazmat/primitives/asymmetric/serializatio…> can now load ed25519 public keys. - Add support for easily mapping an object identifier to its elliptic curve class viaget_curve_for_oid() <https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#cryptogr…> . - Add support for OpenSSL when compiled with the no-engine ( OPENSSL_NO_ENGINE) flag. Alex -- All that is necessary for evil to succeed is for good people to do nothing.

1 0

Error with cryptography 2.5
by Thomas Feb. 22, 2019

Feb. 22, 2019

Hello all. I have a question about the compatibility of cryptography 2.5 I use Python 3.4.4 with current packages to create a proxy under the old Windows XP. Until now, this has worked flawlessly until and including cryptography 2.4.2. With cryptography 2.5 I get an error reported back when running the Python script (see also below). File "C:ProgrammePython34libsite-packagescryptographyhazmatbindingsope Nsslbinding.py, "line 14, in <module> From cryptography.hazmat.bindings. _ openssl import ffi, lib ImportError: DLL failed load: The specified module was not found. Is this a flaw in cryptography? Or has support for Python 3.4.4 already been discontinued? Can I do something to continue using current packages of cryptography? What else needs to be installed? Thanks and regards Thomas Schulze (Original Text in German) Ich habe eine Frage zur Kompatibilität von cryptography 2.5 Ich verwende Python 3.4.4 mit aktuellen Paketen, um unter dem alten Windows XP einen Proxy zu erstellen. Bisher funktionierte dies einwandfrei bis einschließlich cryptography 2.4.2. Mit cryptography 2.5 bekomme ich bereits beim Ausführen der Python-Scripte einen Fehler zurückgemeldet (siehe auch unten). File "C:\Programme\Python34\lib\site-packages\cryptography\hazmat\bindings\ope nssl\binding.py", line 14, in <module> from cryptography.hazmat.bindings._openssl import ffi, lib ImportError: DLL load failed: Das angegebene Modul wurde nicht gefunden. Ist das ein Fehler in cryptography? Oder wurde die Unterstützung für Python 3.4.4 bereits eingestellt? Kann ich etwas unternehmen, um weiterhin aktuelle Pakete von cryptography zu verwenden? Was muß noch installiert werden? Danke, mit freundlichen Grüßen Thomas Schulze Console output with cryptography 2.4.2 (Proxy works correct) ============================================================================ == HTTPSProxy WinXP TLS1.2 support v1.5.2 2018-11-06 cryptography v2.4.2 / pyOpenSSL v19.0.0 / urllib3 v1.24.1 HTTPSProxy local client port: localhost:8080 HTTPSProxy log send port: localhost:9020 ============================================================================ == Start logging: Install cryptography 2.5 (incl. idna) Collecting cryptography[idna] Using cached https://files.pythonhosted.org/packages/a7/5e/bd3cf6fda1860592d52 41ea2b8c6cc4e8c1fb4c576d30a8ab4d43f180121/cryptography-2.5-cp34-cp34m-win32. whl Collecting six>=1.4.1 (from cryptography[idna]) Using cached https://files.pythonhosted.org/packages/73/fb/00a976f728d0d1fecfe 898238ce23f502a721c0ac0ecfedb80e0d88c64e9/six-1.12.0-py2.py3-none-any.whl Collecting asn1crypto>=0.21.0 (from cryptography[idna]) Using cached https://files.pythonhosted.org/packages/ea/cd/35485615f45f30a5105 76f1a56d1e0a7ad7bd8ab5ed7cdc600ef7cd06222/asn1crypto-0.24.0-py2.py3-none-any .whl Collecting cffi!=1.11.3,>=1.8 (from cryptography[idna]) Using cached https://files.pythonhosted.org/packages/0e/a6/1275e5c1b1af26a5048 b0a596aab56236ea4ff4119e0b89cb36180440d72/cffi-1.12.1-cp34-cp34m-win32.whl Collecting idna>=2.1; extra == "idna" (from cryptography[idna]) Using cached https://files.pythonhosted.org/packages/14/2c/cd551d81dbe15200be1 cf41cd03869a46fe7226e7450af7a6545bfc474c9/idna-2.8-py2.py3-none-any.whl Collecting pycparser (from cffi!=1.11.3,>=1.8->cryptography[idna]) Installing collected packages: six, asn1crypto, pycparser, cffi, idna, cryptogra phy Found existing installation: six 1.12.0 Uninstalling six-1.12.0: Successfully uninstalled six-1.12.0 Found existing installation: asn1crypto 0.24.0 Uninstalling asn1crypto-0.24.0: Successfully uninstalled asn1crypto-0.24.0 Found existing installation: pycparser 2.19 Uninstalling pycparser-2.19: Successfully uninstalled pycparser-2.19 Found existing installation: cffi 1.12.1 Uninstalling cffi-1.12.1: Successfully uninstalled cffi-1.12.1 Found existing installation: idna 2.8 Uninstalling idna-2.8: Successfully uninstalled idna-2.8 Found existing installation: cryptography 2.4.2 Uninstalling cryptography-2.4.2: Successfully uninstalled cryptography-2.4.2 Successfully installed asn1crypto-0.24.0 cffi-1.12.1 cryptography-2.5 idna-2.8 p ycparser-2.19 six-1.12.0 Console output with cryptography 2.5 Traceback (most recent call last): File "S:\2017-10-31 Projekt HTTPSProxy\3_3_1 HTTPSProxy_py_actual_test_and_bui ld\HTTPSProxy.py", line 19, in <module> import OpenSSL File "C:\Programme\Python34\lib\site-packages\OpenSSL\__init__.py", line 8, in <module> from OpenSSL import crypto, SSL File "C:\Programme\Python34\lib\site-packages\OpenSSL\crypto.py", line 16, in <module> from OpenSSL._util import ( File "C:\Programme\Python34\lib\site-packages\OpenSSL\_util.py", line 6, in <m odule> from cryptography.hazmat.bindings.openssl.binding import Binding File "C:\Programme\Python34\lib\site-packages\cryptography\hazmat\bindings\ope nssl\binding.py", line 14, in <module> from cryptography.hazmat.bindings._openssl import ffi, lib ImportError: DLL load failed: Das angegebene Modul wurde nicht gefunden. All packages altgraph==0.16.1 appdirs==1.4.3 asn1crypto==0.24.0 blessings==1.7 bpython==0.17.1 certifi==2018.11.29 cffi==1.12.1 chardet==3.0.4 colorama==0.4.1 configparser==3.7.1 cryptography==2.5 curtsies==0.3.0 dill==0.2.9 future==0.17.1 greenlet==0.4.15 idna==2.8 JsonForm==0.0.2 jsonschema==2.6.0 JsonSir==0.0.2 macholib==1.11 multiprocess==0.70.7 packaging==19.0 pefile==2018.8.8 pip==19.0.3 print==1.3.0 pyasn1==0.4.5 pycparser==2.19 Pygments==2.3.1 PyInstaller==3.4 pyOpenSSL==19.0.0 pyparsing==2.3.1 pyreadline==2.1 PySocks==1.6.8 Python-EasyConfig==0.1.7 pywin32==221 pywin32-ctypes==0.2.0 PyYAML==3.13 queuelib==1.5.0 requests==2.21.0 Resource==0.2.1 setuptools==40.8.0 six==1.12.0 typing==3.6.6 urllib3==1.24.1 wcwidth==0.1.7 wheel==0.33.1

2 1

Help to build shared libraries on cavium platform
by Nirmal Sarkar Feb. 19, 2019

Feb. 19, 2019

Hello, I am working in a project where I need few libraries for cavium platform. 1. cryptography/hazmat/bindings/_padding.so 2. cryptography/hazmat/bindings/_openssl.so 3. cryptography/hazmat/bindings/_constant_time.so 4. nacl/_sodium.so 5. bcrypt/_bcrypt.so 6. .libs_cffi_backend/libffi-45372312.so.6.0.4 7. _cffi_backend.so I tried to find out both – directly the .so files for cavium platform as well as the source code from where I can build myself. But I did not get these. Can you please guide me on this ? Regards, Nirmal Sarkar

1 0

x509 Certificate Fingerprint Format
by Gilbert Mendoza Feb. 12, 2019

Feb. 12, 2019

Greets! I'm working with x509 certificates in Python, and I'm trying to see if there's a more elegant approach to producing a fingerprint string that is formatted similar to the OpenSSL fingerprint output. openssl x509 -noout -fingerprint -sha1 -inform pem -in certificate.pem SHA1 Fingerprint=76:E1:81:9F:AD:F0:6A:55:EF:4B:12:6A:2E:F7:43:C2:BA:E8:A1:51 Reading the documentation on the X.509 Certificate Object class [1], I learned how to return the fingerprint value as a bytes object, which I then converted to a hex string object, and then manipulated the string to look like a colon separated fingerprint. [1] https://cryptography.io/en/latest/x509/reference/#x-509-certificate-object cert = x509.load_pem_x509_certificate(pem_block, default_backend()) hash_bytes = cert.fingerprint(hashes.SHA1()) print(hash_bytes) b'v\xe1\x81\x9f\xad\xf0jU\xefK\x12j.\xf7C\xc2\xba\xe8\xa1Q' hash_hex = bytearray(cert.fingerprint(hashes.SHA1())).hex() print(hash_hex) 76e1819fadf06a55ef4b126a2ef743c2bae8a151 hash = ":".join(hash_hex[i:i+2] for i in range(0,len(hash_hex),2)).upper() print(hash) 76:E1:81:9F:AD:F0:6A:55:EF:4B:12:6A:2E:F7:43:C2:BA:E8:A1:51 So is there an easier way to get the fingerprint in this format, or am I already there? Many thanks in advance! Gilbert

4 7

Adding custom attributes to a CSR
by Ben Kinsella Feb. 8, 2019

Feb. 8, 2019

In pyOpenSSL and pyca/cryptography, I can't find any way to add custom attributes to a CSR. i.e. I want to pass some extra information to the CA, but these will NOT appear as Extensions in the final cert. Is this possible? Regards, Ben.

2 1

Re: [Cryptography-dev] Info Salsa20
by Colin Caine Feb. 7, 2019

Feb. 7, 2019

Salsa20 is implemented by nacl. You could link to that and throw an error if the system doesn't have nacl. (I am not a developer of this library, I don't know how they feel about adding new c dependencies, but I'd guess not keen) You could also just implement it in python, which will be a better learning exercise, but may turn out to be too slow. Worth a try, though. On Thu, 7 Feb 2019, 10:50 Antonio De Falco <anthonyphis(a)gmail.com wrote: > Hello, > I am a university student and for a project I was asked to integrate the > Salsa20 cipher into your library. But I noticed that the core of the > ciphers is invoked by OpenSSL, and since OpenSSL does not implement the > Salsa20 cipher, I wanted to ask you if an alternative way to integrate it > is possible. > Thank you > Best regards >

2 1

Info Salsa20
by Antonio De Falco Feb. 7, 2019

Feb. 7, 2019

Hello, I am a university student and for a project I was asked to integrate the Salsa20 cipher into your library. But I noticed that the core of the ciphers is invoked by OpenSSL, and since OpenSSL does not implement the Salsa20 cipher, I wanted to ask you if an alternative way to integrate it is possible. Thank you Best regards

1 0