Mailman 3 March 2025 - Cryptography-dev

setting value of x509.SubjectKeyIdentifier other than digest
by Robert Moskowitz March 13, 2025

March 13, 2025

Per RFC5280 Although the common practice for SubjectKeyIdentifier is to SHA1 hash the public key, sec 4.2.1.2 clearly states that: "Other methods of generating unique numbers are also acceptable." And in fact, using openSSL I have set whatever value I have wanted into SubjectKeyIdentifier in the config file. But it seems in https://cryptography.io/en/latest/x509/reference/#cryptography.x509.Subject… "digest" is the only allowed option. For example I have an IPv6 address that the reverse lookup will get you all the RR you may need for the thing. So I would want 2001003ffe3ff805f64b0a656aaee56 as my SubjectKeyIdentifier How can I do this? What type does that value need to be? Of course for AuthorityKeyIdentifier I think can "cheat" by using the int value of that ipv6 addr and feeding it in as the serial_number. thank you

2 9

compatibility between python cryptography and openssl for DSA signature
by Bruno Martin March 11, 2025

March 11, 2025

Hello, I'd like to show the interoperability between openssl 3.4.1 and Python 3.13/cryptography 44.0.1 library (which generally works). I signed with DSA a short message using Python/Cryptography with: message (in French): Je tente de signer un message un peu plus gros que le precedent def sign(message, sk): chosen_hash = hashes.SHA256() hasher = hashes.Hash(chosen_hash) hasher.update(message) digest = hasher.finalize() signature = sk.sign( digest, utils.Prehashed(chosen_hash) ) return signature with the DSA key -----BEGIN PRIVATE KEY----- MIIBSwIBADCCASsGByqGSM44BAEwggEeAoGBAJeeE6sU5RBpDfNHj9J9abda8TYk BZNBtnWBfPvsqsuiMpqPWOrs5N9m5kKZuKSF639XlHVKeCCh+k1YfOw02qZuP7w8 Q8v87FrMW5b9o35DeqGDlHyjYCdYRnDjM7Gs8VfAl1+8PCb1AbOhscF/ojP5lrqj n9m2XbAHe+afCRLXAhUA9krLBVX+ckL7mb+KrhD3JehLGHsCgYB3jMw4QDHsQDnR VZoo+NeAe5LkJeZbPMOrxHQ6H9LX0kKuAo1lZarkql3ACWyVLo9ytb2KPDCw4r0I taj1C742ty8FjlreC/E8vsArflV5joUyx7hlmV8Xuirpp2E0rC/feUXJ/zbnpGCc vrA823h8UZ2ehQoGnj1tfBBihk7ivQQXAhUAmeKg5l0VXaVoBLsLH6c0vpC4uBs= -----END PRIVATE KEY----- The signature of the message is saved as a byte array in a file test.sig. The verification with openssl fails with the message Verification failure after the command openssl dgst -verify dsa_public_key.pem -signature test.sig test.txt I ASN.1 decoded the pica signature which prints RSAPrivateKey SEQUENCE (2 items) version Version INTEGER (160 bit) modulus INTEGER (160 bit) And the same decoding holds as well for a signature obtained with OpenSSL (with different values) but the latter is successfully verified. Bellow are two DSA signatures of the message in base64 pyca: MC4CFQDGylJyxlks53gkzb0wFv86MjlbowIVALAkqD4+JoqYQdb//f6YhSQZ/f4S openssl : MC4CFQCq1x7axNVxFr7Y7fR/TZRBHHEMWQIVAKOkA3I6y1gEzBHBA/Ng99JIDeMs I asked the question on crypto stackexchange with two comments: one replying the openssl verification works on python3.10.6/pyca3.4.8 on Ubuntu22.04 the other confirms that OpenSSL accepts the openssl signature but refuses the pyca signature with Verification failure. Thanks in advance for any answer/explanation of this failure and direct replies since I am not a subscriber of the list. Bruno Martin

2 1

PyCA cryptography 44.0.2 released
by Alex Gaynor March 2, 2025

March 2, 2025

PyCA cryptography 44.0.2 has been released to PyPI. cryptography includes both high level recipes and low level interfaces to common cryptographic algorithms such as symmetric ciphers, asymmetric algorithms, message digests, X.509, key derivation functions, and much more. We support Python 3.7+, and PyPy3 7.3.10+. Changelog (https://cryptography.io/en/latest/changelog/#v44-0-2): * We now build wheels for PyPy 3.11. Alex -- All that is necessary for evil to succeed is for good people to do nothing.

1 0