Merge branch 'master' into use-numbers

6 files changed, 158 insertions, 15 deletions

diff --git a/.travis/install.sh b/.travis/install.sh
index e028033e..3582ea12 100755
--- a/.travis/install.sh
+++ b/.travis/install.sh
@@ -3,21 +3,27 @@
 set -e
 set -x
 
+if [[ "$(uname -s)" == 'Darwin' ]]; then
+    DARWIN=true
+else
+    DARWIN=false
+fi
+
 if [[ "${OPENSSL}" == "0.9.8" ]]; then
-    if [[ "$(uname -s)" != "Darwin" ]]; then
-        sudo add-apt-repository "deb http://archive.ubuntu.com/ubuntu/ lucid main"
-        sudo apt-get -y update
-        sudo apt-get install -y --force-yes libssl-dev/lucid
-    else
+    if [[ "$DARWIN" = true ]]; then
         # travis has openssl installed via brew already, but let's be sure
         if [[ "$(brew list | grep openssl)" != "openssl" ]]; then
             brew install openssl
         fi
+    else
+        sudo add-apt-repository "deb http://archive.ubuntu.com/ubuntu/ lucid main"
+        sudo apt-get -y update
+        sudo apt-get install -y --force-yes libssl-dev/lucid
     fi
 fi
 
 if [[ "${TOX_ENV}" == "docs" ]]; then
-    if [[ "$(uname -s)" == "Darwin" ]]; then
+    if [[ "$DARWIN" = true ]]; then
         brew update
         brew install enchant
     else
@@ -26,7 +32,7 @@ if [[ "${TOX_ENV}" == "docs" ]]; then
     fi
 fi
 
-if [[ "$(uname -s)" == "Darwin" ]]; then
+if [[ "$DARWIN" = true ]]; then
     brew update
     brew install pyenv
     if which pyenv > /dev/null; then eval "$(pyenv init -)"; fi
@@ -102,6 +108,6 @@ virtualenv ~/.venv
 source ~/.venv/bin/activate
 pip install tox coveralls
 
-if [[ "$(uname -s)" == "Darwin" ]]; then
+if [[ "$DARWIN" = true ]]; then
     pyenv rehash
 fi
diff --git a/cryptography/hazmat/primitives/serialization.py b/cryptography/hazmat/primitives/serialization.py
index ed73c4c4..056d4a06 100644
--- a/cryptography/hazmat/primitives/serialization.py
+++ b/cryptography/hazmat/primitives/serialization.py
@@ -24,3 +24,11 @@ def load_pem_pkcs8_private_key(data, password, backend):
     return backend.load_pkcs8_pem_private_key(
         data, password
     )
+
+
+def load_rsa_private_numbers(numbers, backend):
+    return backend.load_rsa_private_numbers(numbers)
+
+
+def load_rsa_public_numbers(numbers, backend):
+    return backend.load_rsa_public_numbers(numbers)
diff --git a/docs/development/submitting-patches.rst b/docs/development/submitting-patches.rst
index f1bf954b..b7f43283 100644
--- a/docs/development/submitting-patches.rst
+++ b/docs/development/submitting-patches.rst
@@ -153,7 +153,8 @@ details.
 Documentation
 -------------
 
-All features should be documented with prose in the ``docs`` section.
+All features should be documented with prose in the ``docs`` section. To ensure
+it builds and passes `doc8`_ style checks you can run ``tox -e docs``.
 
 Because of the inherent challenges in implementing correct cryptographic
 systems, we want to make our documentation point people in the right directions
@@ -201,3 +202,4 @@ So, specifically:
 .. _`syntax`: http://sphinx-doc.org/domains.html#info-field-lists
 .. _`Studies have shown`: http://www.ibm.com/developerworks/rational/library/11-proven-practices-for-peer-review/
 .. _`our mailing list`: https://mail.python.org/mailman/listinfo/cryptography-dev
+.. _`doc8`: https://github.com/stackforge/doc8
diff --git a/docs/hazmat/primitives/asymmetric/serialization.rst b/docs/hazmat/primitives/asymmetric/serialization.rst
index 2b3eb511..e53d0d1f 100644
--- a/docs/hazmat/primitives/asymmetric/serialization.rst
+++ b/docs/hazmat/primitives/asymmetric/serialization.rst
@@ -98,3 +98,41 @@ header that mentions the type of the serialized key. e.g.
     :raises UnsupportedAlgorithm: If the serialized key is of a type that
         is not supported by the backend or if the key is encrypted with a
         symmetric cipher that is not supported by the backend.
+
+
+RSA Numbers
+~~~~~~~~~~~
+
+.. function:: load_rsa_private_numbers(numbers, backend)
+
+    .. versionadded:: 0.5
+
+    Create a private key instance using the given backend and numbers.
+
+    :param numbers: An instance of
+        :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateNumbers`.
+
+    :param backend: A
+        :class:`~cryptography.hazmat.backends.interfaces.RSABackend` provider.
+
+    :returns: A new instance of a private key.
+
+    :raises UnsupportedAlgorithm: If the given backend does not support loading
+        numbers.
+
+.. function:: load_rsa_public_numbers(numbers, backend)
+
+    .. versionadded:: 0.5
+
+    Create a public key instance using the given backend and numbers.
+
+    :param numbers: An instance of
+        :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicNumbers`.
+
+    :param backend: A
+        :class:`~cryptography.hazmat.backends.interfaces.RSABackend` provider.
+
+    :returns: A new instance of a public key.
+
+    :raises UnsupportedAlgorithm: If the given backend does not support loading
+        numbers.
diff --git a/docs/security.rst b/docs/security.rst
index 4dadc847..3d44cd3d 100644
--- a/docs/security.rst
+++ b/docs/security.rst
@@ -1,12 +1,71 @@
 Security
 ========
 
-We take the security of ``cryptography`` seriously. If you believe you've
-identified a security issue in it, please report it to
-``alex.gaynor@gmail.com``. Message may be encrypted with PGP using key
-fingerprint ``E27D 4AA0 1651 72CB C5D2  AF2B 125F 5C67 DFE9 4084`` (this public
-key is available from most commonly-used key servers).
+We take the security of ``cryptography`` seriously. The following are a set of
+policies we have adopted to ensure that security issues are addressed in a
+timely fashion.
+
+Reporting a security issue
+--------------------------
+
+We ask that you do not report security issues to our normal GitHub issue
+tracker.
+
+If you believe you've identified a security issue with ``cryptography``, please
+report it to ``alex.gaynor@gmail.com``. Message may be optionally be encrypted
+with PGP using  key fingerprint
+``E27D 4AA0 1651 72CB C5D2  AF2B 125F 5C67 DFE9 4084``
+(this public key is available from most commonly-used key servers).
 
 Once you've submitted an issue via email, you should receive an acknowledgment
 within 48 hours, and depending on the action to be taken, you may receive
 further follow-up emails.
+
+Supported Versions
+------------------
+
+At any given time, we will provide security support for the `master`_ branch
+as well as the 2 most recent releases.
+
+Disclosure Process
+------------------
+
+Our process for taking a security issue from private discussion to public
+disclosure involves multiple steps.
+
+Approximately one week before full public disclosure, we will send advance
+notification of the issue to a list of people and organizations, primarily
+composed of operating-system vendors and other distributors of
+``cryptography``.  This notification will consist of an email message
+containing:
+
+* A full description of the issue and the affected versions of
+  ``cryptography``.
+* The steps we will be taking to remedy the issue.
+* The patches, if any, that will be applied to ``cryptography``.
+* The date on which the ``cryptography`` team will apply these patches, issue
+  new releases, and publicly disclose the issue.
+
+Simultaneously, the reporter of the issue will receive notification of the date
+on which we plan to take the issue public.
+
+On the day of disclosure, we will take the following steps:
+
+* Apply the relevant patches to the ``cryptography`` repository. The commit
+  messages for these patches will indicate that they are for security issues,
+  but will not describe the issue in any detail; instead, they will warn of
+  upcoming disclosure.
+* Issue the relevant releases.
+* Post a notice to the cryptography mailing list that describes the issue in
+  detail, point to the new release and crediting the reporter of the issue.
+
+If a reported issue is believed to be particularly time-sensitive – due to a
+known exploit in the wild, for example – the time between advance notification
+and public disclosure may be shortened considerably.
+
+The list of people and organizations who receives advanced notification of
+security issues is not and will not be made public. This list generally
+consists of high profile downstream distributors and is entirely at the
+discretion of the ``cryptography`` team.
+
+.. _`master`: https://github.com/pyca/cryptography
diff --git a/tests/hazmat/primitives/test_serialization.py b/tests/hazmat/primitives/test_serialization.py
index b19990e0..53a5806f 100644
--- a/tests/hazmat/primitives/test_serialization.py
+++ b/tests/hazmat/primitives/test_serialization.py
@@ -23,9 +23,12 @@ from cryptography.exceptions import _Reasons
 from cryptography.hazmat.primitives.asymmetric import dsa, rsa
 from cryptography.hazmat.primitives.serialization import (
     load_pem_pkcs8_private_key,
-    load_pem_traditional_openssl_private_key
+    load_pem_traditional_openssl_private_key,
+    load_rsa_private_numbers,
+    load_rsa_public_numbers
 )
 
+from .fixtures_rsa import RSA_KEY_1024
 from .utils import _check_rsa_private_key, load_vectors_from_file
 from ...utils import raises_unsupported_algorithm
 
@@ -544,3 +547,30 @@ class TestPKCS8Serialisation(object):
                     pemfile.read().encode(), password, backend
                 )
             )
+
+
+@pytest.mark.rsa
+class TestLoadRSANumbers(object):
+    def test_load_private_numbers(self, backend):
+        numbers = rsa.RSAPrivateNumbers(
+            p=RSA_KEY_1024["p"],
+            q=RSA_KEY_1024["q"],
+            d=RSA_KEY_1024["private_exponent"],
+            dmp1=RSA_KEY_1024["dmp1"],
+            dmq1=RSA_KEY_1024["dmq1"],
+            iqmp=RSA_KEY_1024["iqmp"],
+            public_numbers=rsa.RSAPublicNumbers(
+                n=RSA_KEY_1024["modulus"],
+                e=RSA_KEY_1024["public_exponent"]
+            )
+        )
+        private_key = load_rsa_private_numbers(numbers, backend)
+        assert private_key
+
+    def test_load_public_numbers(self, backend):
+        numbers = rsa.RSAPublicNumbers(
+            n=RSA_KEY_1024["modulus"],
+            e=RSA_KEY_1024["public_exponent"]
+        )
+        public_key = load_rsa_public_numbers(numbers, backend)
+        assert public_key