Mailman 3 October 2020 - Cryptography-dev

Affected version of CVE-2020-25659
by Tristan Laurillard Oct. 28, 2020

Oct. 28, 2020

Hello, We maintain the Safety <http://pyup.io/safety/> vulnerability tool. I have a small question regarding CVE-2020-25659: are all versions <=3.2 affected? We need to know who we should warn. Tristan Laurillard Operations Manager PyUp.io

2 1

PyCA cryptography 3.2.1 released
by Paul Kehrer Oct. 28, 2020

Oct. 28, 2020

PyCA cryptography 3.2.1 has been released to PyPI. cryptography includes both high level recipes and low level interfaces to common cryptographic algorithms such as symmetric ciphers, asymmetric algorithms, message digests, X509, key derivation functions, and much more. We support Python 2.7, Python 3.5+, and PyPy. Changelog (https://cryptography.io/en/latest/changelog.html#v3-2-1): * Disable blinding on RSA public keys to address an error with some versions of OpenSSL. -Paul Kehrer (reaperhulk)

1 0

PyCA cryptography 3.2 released
by Paul Kehrer Oct. 26, 2020

Oct. 26, 2020

PyCA cryptography 3.2 has been released to PyPI. cryptography includes both high level recipes and low level interfaces to common cryptographic algorithms such as symmetric ciphers, asymmetric algorithms, message digests, X509, key derivation functions, and much more. We support Python 2.7, Python 3.5+, and PyPy. Changelog (https://cryptography.io/en/latest/changelog/): * SECURITY ISSUE: Attempted to make RSA PKCS#1v1.5 decryption more constant time, to protect against Bleichenbacher vulnerabilities. Due to limitations imposed by our API, we cannot completely mitigate this vulnerability and a future release will contain a new API which is designed to be resilient to these for contexts where it is required. Credit to Hubert Kario for reporting the issue. CVE-2020-25659 * Support for OpenSSL 1.0.2 has been removed. Users on older versions of OpenSSL will need to upgrade. * Added basic support for PKCS7 signing (including SMIME) via PKCS7SignatureBuilder. -Paul Kehrer (reaperhulk)

1 0

Adding set_cert_store to pyOpenSSL
by Barry Scott Oct. 21, 2020

Oct. 21, 2020

In an app that uses twisted that uses pyOpenSSL I found that to it takes 1s CPU bound to setup a TLS session because the twisted code copies the trust store into the context one cert at a time. I'm using openssl-1.1.1g and python 2.7.18 (yes I know...). Here is the function in twisted that causes the 1s CPU bound loop: class OpenSSLCertificateAuthorities(object): def __init__(self, caCerts): self._caCerts = caCerts def _addCACertsToContext(self, context): store = context.get_cert_store() for cert in self._caCerts: store.add_cert(cert) The obvious way to fix this is to setup the X509Store at app startup with the trusted certs. Then set that store on the context. The new code would be: class OpenSSLCertificateAuthorities(object): def __init__(self, caCerts): self._caCerts = caCerts self._store = X509Store() for cert in self._caCerts: self._store.add_cert(cert) def _addCACertsToContext(self, context): context.set_cert_store(self._store) And the patch to pyOpenSSL is: --- tmp1/pyopenssl-19.1.0/src/OpenSSL/SSL.py 2019-11-18 04:47:22.000000000 +0000 +++ tmp2/pyopenssl-19.1.0/src/OpenSSL/SSL.py 2020-10-13 15:11:02.255560148 +0100 @@ -1357,6 +1357,14 @@ pystore._store = store return pystore + def set_cert_store(self, store): + """ + Set the certificate store for the context. + + :store: A X509Store object or None if it does not have one. + """ + _lib.SSL_CTX_set_cert_store(self._context, store) + def set_options(self, options): """ Add options. Options set before are not cleared! But I see this exception: File "ngtls_context_set.py", line 107, in _addCACertsToContext context.set_cert_store(self._store) File "/usr/local/lib/python2.7/site-packages/OpenSSL/SSL.py", line 1366, in set_cert_store _lib.SSL_CTX_set_cert_store(self._context, store) TypeError: initializer for ctype 'X509_STORE *' must be a cdata pointer, not X509Store My searching has not lead me to a way to get a cdata pointer fpr X509Store. What do I need to do to get set_cert_store working? Barry

1 1

Cryptography v3.2 publish to PyPi
by Jonathan Trinh Oct. 19, 2020

Oct. 19, 2020

Hello, I would like to take advantage of Cryptography v3.2, but currently the version in PyPi is 3.1.1. I plan on using the new SMIME. Can someone with the proper permissions to publish the latest to PyPi? Thanks!

2 2

private_key.decrypt painfully slow
by momchil＠bojinov.info Oct. 15, 2020

Oct. 15, 2020

Hello, New guy. Not much of a python dev but I managed to put together some code to encrypt/decrypt files using RSA But like the entire fine, not just some intermediate password public_key.encrypt of 11 Mb ( ~47 000 * 190 byte pieces) file took about 8 seconds private_key.decrypt of the same file took 143 seconds profiler said 142 of those came from _openssl.EVP_PKEY_decrypt I m running x64 Python version 3.8.5 And I just installed the cryptography module today through pip Am I being stupid trying to do this and not go with asymmetric encryption for the intermediate and go symmetric from there ? Regards, Momchil

2 2