Mailman 3 August 2021 - Cryptography-dev

PyCA cryptography 3.4.8 released
by Paul Kehrer Aug. 24, 2021

Aug. 24, 2021

PyCA cryptography 3.4.8 has been released to PyPI. cryptography includes both high level recipes and low level interfaces to common cryptographic algorithms such as symmetric ciphers, asymmetric algorithms, message digests, X509, key derivation functions, and much more. We support Python 3.6+, and PyPy3. Changelog (https://cryptography.io/en/latest/changelog.html#v3-4-8): * Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1l. -Paul Kehrer (reaperhulk)

1 0

A question about the ValueError "Encryption/decryption failed"
by JIAO Guangren Aug. 11, 2021

Aug. 11, 2021

Hello. I am a student from the City University of Hong Kong. I want to realize a project about oblivious transfer. I have a problem that I used public_key_1 to encrypt a message and I want to use three private key to decrypt the ciphertext. Of course, private_key_1 could decrypt the ciphertext correctly. The private_key_2 and private_key_3 could not decrypt the ciphertext and return the ValueError "Encryption/decryption failed". But what I need is if the private key could not decrypt the ciphertext, it ought to return a random array not an error. How could I achieve my aim using the package Cryptography of Python? I would be deeply grateful if you could solve my problem. Thank you for your help! Best Wishes!

2 1

KBKDFCMAC review
by Krzysztof Jackiewicz/Security (PLT ) /SRPOL/Engineer/삼성전자 Aug. 5, 2021

Aug. 5, 2021

Hi, My PR https://github.com/pyca/cryptography/pull/6181 has finally passed all the checks. Is there anything else I should do initiate the review? Thanks in advance Krzysiek

3 2

Re: [Cryptography-dev] custom oids.
by Paul Kehrer Aug. 5, 2021

Aug. 5, 2021

As I already mentioned in the pyopenssl issue you filed, neither pyopenssl or cryptography support this in their x509 signing, no. Callers who need this will need to implement their own asn1 serialization and just use cryptography to obtain a signature. -Paul > On Aug 4, 2021, at 9:00 PM, sinuthampi <sanojthampi(a)gmail.com> wrote: > > Hi all > > > is it possible to use custom OIDs for signing algorithms in pyca? , i have uploaded a sample certificate which is using a custom private oid and this oid is mapped with ed25519ph. how is this possible using pyca, is there any other ca which is supporting this custom method? > > > > > > <image.png> > > > _______________________________________________ > Cryptography-dev mailing list > Cryptography-dev(a)python.org > https://mail.python.org/mailman/listinfo/cryptography-dev

1 0

custom oids.
by sinuthampi Aug. 4, 2021

Aug. 4, 2021

Hi all is it possible to use custom OIDs for signing algorithms in pyca? , i have uploaded a sample certificate which is using a custom private oid and this oid is mapped with ed25519ph. how is this possible using pyca, is there any other ca which is supporting this custom method? [image: image.png]

1 0

SM4 support
by Rowan, Jim Aug. 3, 2021

Aug. 3, 2021

I have a few questions about SM4 support? 1. Is there a planned release date for a release that includes SM4? 2. Is GCM support for SM4 planned? I don't see it listed in _register_default_ciphers(). * https://github.com/Infineon/cryptography/blob/sm4/src/cryptography/hazmat/b… Thanks, Jim Rowan<im:sip:jim.rowan@intel.com> FPGA System Validation Architect, PE DPG | Custom Logic Engineering | CPSE | Platform Validation Engineering

3 2

openssl command three that a pyca/cryptography rewrite
by Dan Stromberg Aug. 2, 2021

Aug. 2, 2021

The third command looks like: ["openssl", "rsa", "-passin", "pass:{0}".format(newpassword), "-pubout"] I think here we're obtaining a new public key. Any suggestions as to how this could be rewritten to use pyca/cryptography? Thanks!

2 1

openssl command two that needs a pyca/cryptography rewrite
by Dan Stromberg Aug. 2, 2021

Aug. 2, 2021

The second command looks like: ['openssl', 'genrsa', '-aes128', '-passout', 'stdin', '2048'] I believe this is generating a public key, that will later be used by ssh. This one probably isn't much of a problem, but it might be better to go all pyca/cryptography (one dependency) rather than openssl(1) and pyca/cryptography (two dependencies). Any suggestions? Thanks!

2 1

openssl command one that needs a pyca/cryptography rewrite
by Dan Stromberg Aug. 2, 2021

Aug. 2, 2021

So the first command looks like this: ['openssl', 'rsa', '-passin', 'pass:{0}'.format(record.password)] It's just accepting the following on stdin, formatted like: -----BEGIN RSA PRIVATE KEY----- ... -----END RSA PRIVATE KEY----- ...and outputting something that'll later be passed to ssh-keygen -i -f -mPKCS8. Is there a pyca/cryptography equivalent? Thanks! PS: I should've mentioned previously: I'm a bit of a cryptography newb.

2 2

Three openssl(1) commands
by Dan Stromberg Aug. 2, 2021

Aug. 2, 2021

Hi people. We have some Python (CPython) code that uses openssl(1) via a subprocess at present. I'm coming to believe this isn't terribly secure though, so I looked for an openssl wrapper for CPython. What I found was PyOpenSSL, which recommends using pyca/cryptography instead for almost everything. So I'm looking into what it would take to rewrite those three openssl(1) commands using pyca/cryptography. I'm intending to send those three openssl(1) commands to this list, inquiring about how to rewrite them to use pyca/cryptography - one command per message. Thanks!

1 0