Mailman 3 January 2022 - Cryptography-dev

class NameOID
by Алекс Опеков Jan. 24, 2022

Jan. 24, 2022

Hello! I came across some a problem I have tried create a request with some subject field and noticed, that I can't use in NameOID field calling 'NAME' with id 2.5.4.41, because it absent in a class NameIOD, I have found closer field 'GIVEN_NAME' with id 2.5.4.42 but I can't use it. My project requires the field 'NAME'. Can you help me with them and add this field?

2 1

cryptography 36.0.1 Fernet example: AES in CBC mode UnsupportedAlgorithm
by ejanssen＠itmatters.nl Jan. 19, 2022

Jan. 19, 2022

Hi, This is maybe not a cryptography question but an openssl one, please bear with me.. I compiled openssl 1.1.1m myself and installed it next to the existing 1.0.1t from my distribution (debian 8). I built a Python linking against this new openssl. When I try the example code from the documentation I get UnsupportedAlgorithm: $ python3 -i Python 3.9.10 (main, Jan 19 2022, 14:33:07) [GCC 4.9.2] on linux Type "help", "copyright", "credits" or "license" for more information. >>> import cryptography.hazmat.backends.openssl.backend as b >>> b.openssl_version_text() 'OpenSSL 1.1.1m 14 Dec 2021' >>> '{:x}'.format(b.openssl_version_number()) '101010df' >>> from cryptography.fernet import Fernet >>> key = Fernet.generate_key() >>> f = Fernet(key) >>> token = f.encrypt(b"my deep dark secret") Traceback (most recent call last): <skipping parts> raise UnsupportedAlgorithm(msg, _Reasons.UNSUPPORTED_CIPHER) cryptography.exceptions.UnsupportedAlgorithm: cipher AES in CBC mode is not supported by this backend (Your version of OpenSSL may be too old. Current version: OpenSSL 1.1.1m 14 Dec 2021.) However, I can do this on the commandline: $ openssl version OpenSSL 1.1.1m 14 Dec 2021 $ openssl enc -aes128 -base64 -in text.plain -out text.enc enter aes-128-cbc encryption password: Verifying - enter aes-128-cbc encryption password: *** WARNING : deprecated key derivation used. Using -iter or -pbkdf2 would be better. $ cat text.enc U2FsdGVkX18dFTIizaI1vyR/zo26kRa6ZusV61GMYZ8= This didn't work initially, I first had to align openssl.cnf with the one from the distribution. But now I would say the openssl itself is working. Why is this not working in the cryptography module? Or/and, what would be the best next step to analyse? Thanks! Erik

1 1

Deprecating legacy symmetric algorithms
by Paul Kehrer Jan. 19, 2022

Jan. 19, 2022

Hi all, cryptography currently ships numerous legacy symmetric algorithms that, anecdotally, have very low use. These algorithms have a variety of security drawbacks when compared to more modern equivalents (namely AES or ChaCha20) and generally shouldn't be used. We plan to deprecate them on a long cycle such that users who don't read the mailing list have a chance to speak up if they have a use case that we should consider, but we're also reaching out here to solicit opinions. The algorithms we'd like to deprecate and remove are: * CAST5 * SEED * IDEA * Blowfish 3DES and ARC4 are also legacy (and ARC4 has serious security issues), but their common use in many scenarios means they will not be deprecated. This decision has two primary driving factors: reducing the number of algorithms that developers need to be aware of to make a reasonable choice, and lowering our reliance on the "legacy" provider in OpenSSL 3.0.0+ with a goal of eventually removing it entirely. If you have use cases that require these algorithms please let us know! -Paul Kehrer (reaperhulk)

1 0

Possible to customize how python handle ssl verify callback?
by Edward Tsang Jan. 7, 2022

Jan. 7, 2022

Is it possible to change the behavior of how standard python verifies X509 certificates? The background is that I want to filter, ignore and log some of the X509 certificate validation errors. I would like to apply universally for the Python standard library includes multiple modules that provide HTTP client functionality, including httplib, urllib, urllib2, and xmlrpclib. Does the python offers a way for user to customize certificate verification behavior? Anyone can point out how to do this or link to any project that is doing that? As per openssl doc, we can do that https://www.openssl.org/docs/man1.1.1/man3/X509_STORE_CTX_verify_cb.html we can customize how certificate verify callback with this void X509_STORE_CTX_set_verify_cb(X509_STORE_CTX *ctx, X509_STORE_CTX_verify_cb verify_cb);

2 1

OpenSSL.SSL.Error 4067
by Elias Kremer Jan. 2, 2022

Jan. 2, 2022

Good evening, I just ran into an error i'm unable to resolve and i couldn't find any help online: I work with the python ssl library, and my code throws an ssl.SSLError "[SSL] PEM lib* (_ssl.c:4067)*". The documentation of the ssl library ( https://docs.python.org/3/library/ssl.html#ssl.SSLContext.load_cert_chain) says that the highlighted error code comes from the OpenSSL library. But I can't find any reference to the error code 4067, the closest I could get was this: https://www.pyopenssl.org/en/stable/api/ssl.html?#OpenSSL.SSL.Error but this site basically just says that the error exists and points to "err(3)" which I could't retrieve on the site. I'd really appreciate any help since I have no idea how to solve this issue. Best regards, Elias Kremer <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> Virenfrei. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> <#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

2 1