Mailman 3 August 2024 - Cryptography-dev

what to import
by Robert Moskowitz Aug. 30, 2024

Aug. 30, 2024

Unfortunately, I go too much be copying examples. I am not learning how to find the various components to load, For example, I want to load an x509 cert: https://cryptography.io/en/3.4.7/x509/reference.html#loading-certificates with open(x509cert, "rb") as f: cert = f.read() cryptography.x509.load_pem_x509_certificate(cert) cert.serial_number ImportError: cannot import name 'load_pem_x509_certificate' from 'cryptography.hazmat.primitives' (/usr/lib64/python3.11/site-packages/cryptography/hazmat/primitives/__init__.py) I can't find on the website where I am advised what to load. So far, shotgunning it as not worked. Nor should I really count on that approach. So where is there advise for importing what from where? thanks

2 4

cshake code
by Robert Moskowitz Aug. 30, 2024

Aug. 30, 2024

Does cryptography.hazmat.primitives include cshake code? So far the only source I have found is: https://pycryptodome.readthedocs.io/en/v3.15.0/src/introduction.html from Cryptodome.Hash import cSHAKE128 # print(type(h_orchid_left)) # print(type(hi), hi) shake = cSHAKE128.new(custom = ContextID) shake.update((h_orchid_left + hi)) h_hash = shake.read(8).hex() Would like to get all my crypto from one source. Of course, I got this a year ago, and cryptodome may have newer code.

2 2

About pull request
by Gonzalo Atienza Rela Aug. 30, 2024

Aug. 30, 2024

Hi! Just wondering if there's any interest in https://github.com/pyca/pynacl/pull/835? I can close it if not or if it's too pushy. Please let me know. Thanks. -- GA

2 1

Extracting pub key from a csr
by Robert Moskowitz Aug. 30, 2024

Aug. 30, 2024

I have a csr with an eddsa25519 key: -----BEGIN CERTIFICATE REQUEST----- MIGPMEMCAQAwEDEOMAwGA1UEBRMFeDEyMjQwKjAFBgMrZXADIQAqLOv73gF8OMT9 dvXIai0HOzyoT0kWkwziuPObnb+PbaAAMAUGAytlcANBAMbkfr344AGb2NHMJOk7 hUdknmKY3XOrAKITLbE0X5NiSxfsZ8ovLG4SnmIEE86t5pWfaPAFhJ8t+jMGJUzQ XgM= -----END CERTIFICATE REQUEST----- I want the Pbkey of Subject Public Key Info: Public Key Algorithm: ED25519 ED25519 Public-Key: pub: e7:3f:5c:a1:b7:78:8a:75:e4:7b:91:4c:0c:1c:48: d7:f8:06:c1:f1:9d:58:b0:4d:c9:48:7f:3d:1d:bc: ac:16 I am following https://cryptography.io/en/3.4.7/x509/reference.html#loading-certificate-si… and https://cryptography.io/en/3.4.7/x509/reference.html#x-509-csr-certificate-… I tried the following to get the key: from cryptography.hazmat.primitives import serialization from cryptography.hazmat.primitives.asymmetric import ed25519 from cryptography import x509 from cryptography.x509.oid import NameOID from cryptography.hazmat.primitives.serialization import load_pem_private_key with open(uacsr, "rb") as f: pem_req_data = f.read() csr = x509.load_pem_x509_csr(pem_req_data) csr_pbkey = csr.public_key() print(csr_pbkey) and get: <cryptography.hazmat.backends.openssl.ed25519._Ed25519PublicKey object at 0x7f513f0d39d0> not the public key itself. What am I missing here? thanks

4 8

Report a potential risk of secret leakage in project(cryptography_vectors)
by jiawei_zhou＠seu.edu.cn Aug. 13, 2024

Aug. 13, 2024

Dear developers of the project(cryptography_vectors), We are software security researchers, currently conducting research on secret detection and leakage risk within the open-source ecosystem. In our analysis, we identified potential secret leakage risks in your project, cryptography_vectors. We provide the detail of our findings in the attachment, which allows you to locate the potential leaked secrets. Below is an interpretation of the attached data: { 'file': '', #The file containing the secret #The project name, version or commit_hash may be reflected in the file path 'line_start': 1, #location: Start line of the secret 'line_end': 28, #location: End line of the secret 'col_start': 1, #location: Start column of the secret 'col_end': 1, #location: End column of the secret 'index_start': 0, #location: Start index of the secret 'index_end': 1675, #location: End index of the secret } Declaration: we hereby declare that we have *NOT* conducted any verification test or exploit on the identified secrets. we plan to publish related research papers in the future, and the relevant content MIGHT BE ACCESS TO THE PUBLIC due to the 90-day disclosure policy. Some advise: 1. If the leaked secret is sensitive and still valid, invalid and rotate the secret immediately. 2. Some secrets seem to be used only in testing environment. Although probably harmless, it is considered bad practices to include secrets for test environment in release builds. Best regards,

2 1