aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--cryptography/hazmat/backends/openssl/backend.py30
-rw-r--r--docs/contributing.rst20
-rw-r--r--docs/hazmat/primitives/cryptographic-hashes.rst3
-rw-r--r--docs/hazmat/primitives/hmac.rst2
-rw-r--r--docs/hazmat/primitives/symmetric-encryption.rst13
-rw-r--r--tests/hazmat/backends/test_openssl.py12
-rw-r--r--tests/hazmat/primitives/test_3des.py30
-rw-r--r--tests/hazmat/primitives/test_aes.py20
-rw-r--r--tests/hazmat/primitives/test_arc4.py2
-rw-r--r--tests/hazmat/primitives/test_block.py12
-rw-r--r--tests/hazmat/primitives/test_blowfish.py16
-rw-r--r--tests/hazmat/primitives/test_camellia.py16
-rw-r--r--tests/hazmat/primitives/test_cast5.py4
-rw-r--r--tests/hazmat/primitives/test_hashes.py14
-rw-r--r--tests/hazmat/primitives/test_hmac.py14
-rw-r--r--tests/hazmat/primitives/utils.py23
16 files changed, 151 insertions, 80 deletions
diff --git a/cryptography/hazmat/backends/openssl/backend.py b/cryptography/hazmat/backends/openssl/backend.py
index 588a4273..080cb5f1 100644
--- a/cryptography/hazmat/backends/openssl/backend.py
+++ b/cryptography/hazmat/backends/openssl/backend.py
@@ -288,11 +288,19 @@ class _CipherContext(object):
try:
adapter = registry[type(cipher), type(mode)]
except KeyError:
- raise UnsupportedAlgorithm
+ raise UnsupportedAlgorithm(
+ "cipher {0} in {1} mode is not supported "
+ "by this backend".format(
+ cipher.name, mode.name if mode else mode)
+ )
evp_cipher = adapter(self._backend, cipher, mode)
if evp_cipher == self._backend.ffi.NULL:
- raise UnsupportedAlgorithm
+ raise UnsupportedAlgorithm(
+ "cipher {0} in {1} mode is not supported "
+ "by this backend".format(
+ cipher.name, mode.name if mode else mode)
+ )
if isinstance(mode, interfaces.ModeWithInitializationVector):
iv_nonce = mode.initialization_vector
@@ -319,9 +327,9 @@ class _CipherContext(object):
)
assert res != 0
if operation == self._DECRYPT:
- if not mode.tag:
- raise ValueError("Authentication tag must be supplied "
- "when decrypting")
+ if not mode.tag or len(mode.tag) < 4:
+ raise ValueError("Authentication tag must be provided and "
+ "be 4 bytes or longer when decrypting")
res = self._backend.lib.EVP_CIPHER_CTX_ctrl(
ctx, self._backend.lib.Cryptography_EVP_CTRL_GCM_SET_TAG,
len(mode.tag), mode.tag
@@ -400,7 +408,11 @@ class _HashContext(object):
self._backend.lib.EVP_MD_CTX_destroy)
evp_md = self._backend.lib.EVP_get_digestbyname(
algorithm.name.encode("ascii"))
- assert evp_md != self._backend.ffi.NULL
+ if evp_md == self._backend.ffi.NULL:
+ raise UnsupportedAlgorithm(
+ "{0} is not a supported hash on this backend".format(
+ algorithm.name)
+ )
res = self._backend.lib.EVP_DigestInit_ex(ctx, evp_md,
self._backend.ffi.NULL)
assert res != 0
@@ -442,7 +454,11 @@ class _HMACContext(object):
ctx = self._backend.ffi.gc(ctx, self._backend.lib.HMAC_CTX_cleanup)
evp_md = self._backend.lib.EVP_get_digestbyname(
algorithm.name.encode('ascii'))
- assert evp_md != self._backend.ffi.NULL
+ if evp_md == self._backend.ffi.NULL:
+ raise UnsupportedAlgorithm(
+ "{0} is not a supported hash on this backend".format(
+ algorithm.name)
+ )
res = self._backend.lib.Cryptography_HMAC_Init_ex(
ctx, key, len(key), evp_md, self._backend.ffi.NULL
)
diff --git a/docs/contributing.rst b/docs/contributing.rst
index cb9c7283..744f2098 100644
--- a/docs/contributing.rst
+++ b/docs/contributing.rst
@@ -53,11 +53,10 @@ API Considerations
Most projects' APIs are designed with a philosophy of "make easy things easy,
and make hard things possible". One of the perils of writing cryptographic code
-is that code that is secure looks just like code that isn't, and produces
-results that are also difficult to distinguish. As a result ``cryptography``
-has, as a design philosophy: "make it hard to do insecure things". Here are a
-few strategies for API design which should be both followed, and should inspire
-other API choices:
+is that secure code looks just like insecure code, and its results are almost
+always indistinguishable. As a result ``cryptography`` has, as a design
+philosophy: "make it hard to do insecure things". Here are a few strategies for
+API design which should be both followed, and should inspire other API choices:
If it is incorrect to ignore the result of a method, it should raise an
exception, and not return a boolean ``True``/``False`` flag. For example, a
@@ -77,6 +76,10 @@ whether the signature was valid.
if not is_valid:
raise InvalidSignature
+Every recipe should include a version or algorithmic marker of some sort in its
+output in order to allow transparent upgrading of the algorithms in use, as
+the algorithms or parameters needed to achieve a given security margin evolve.
+
APIs at the :doc:`/hazmat/primitives/index` layer should always take an
explicit backend, APIs at the recipes layer should automatically use the
:func:`~cryptography.hazmat.backends.default_backend`, but optionally allow
@@ -163,7 +166,7 @@ as much as possible. To that end:
* When documenting a generic interface, use a strong algorithm in examples.
(e.g. when showing a hashing example, don't use
- :class:`cryptography.hazmat.primitives.hashes.MD5`)
+ :class:`~cryptography.hazmat.primitives.hashes.MD5`)
* When giving prescriptive advice, always provide references and supporting
material.
* When there is real disagreement between cryptographic experts, represent both
@@ -206,7 +209,7 @@ automatically, so all you have to do is:
$ py.test
...
- 4294 passed in 15.24 seconds
+ 62746 passed in 220.43 seconds
This runs the tests with the default Python interpreter.
@@ -244,7 +247,8 @@ Use `tox`_ to build the documentation. For example:
docs: commands succeeded
congratulations :)
-The HTML documentation index can now be found at ``docs/_build/html/index.html``
+The HTML documentation index can now be found at
+``docs/_build/html/index.html``.
.. _`GitHub`: https://github.com/pyca/cryptography
diff --git a/docs/hazmat/primitives/cryptographic-hashes.rst b/docs/hazmat/primitives/cryptographic-hashes.rst
index 90ca198a..38347378 100644
--- a/docs/hazmat/primitives/cryptographic-hashes.rst
+++ b/docs/hazmat/primitives/cryptographic-hashes.rst
@@ -28,6 +28,9 @@ Message Digests
>>> digest.finalize()
'l\xa1=R\xcap\xc8\x83\xe0\xf0\xbb\x10\x1eBZ\x89\xe8bM\xe5\x1d\xb2\xd29%\x93\xafj\x84\x11\x80\x90'
+ If the backend doesn't support the requested ``algorithm`` an
+ :class:`~cryptography.exceptions.UnsupportedAlgorithm` will be raised.
+
Keep in mind that attacks against cryptographic hashes only get stronger
with time, and that often algorithms that were once thought to be strong,
become broken. Because of this it's important to include a plan for
diff --git a/docs/hazmat/primitives/hmac.rst b/docs/hazmat/primitives/hmac.rst
index 0c0d0220..0547b7d2 100644
--- a/docs/hazmat/primitives/hmac.rst
+++ b/docs/hazmat/primitives/hmac.rst
@@ -34,6 +34,8 @@ message.
>>> h.finalize()
'#F\xdaI\x8b"e\xc4\xf1\xbb\x9a\x8fc\xff\xf5\xdex.\xbc\xcd/+\x8a\x86\x1d\x84\'\xc3\xa6\x1d\xd8J'
+ If the backend doesn't support the requested ``algorithm`` an
+ :class:`~cryptography.exceptions.UnsupportedAlgorithm` will be raised.
:param key: Secret key as ``bytes``.
:param algorithm: A
diff --git a/docs/hazmat/primitives/symmetric-encryption.rst b/docs/hazmat/primitives/symmetric-encryption.rst
index f4d0457a..30896a05 100644
--- a/docs/hazmat/primitives/symmetric-encryption.rst
+++ b/docs/hazmat/primitives/symmetric-encryption.rst
@@ -61,7 +61,7 @@ an "encrypt-then-MAC" formulation as `described by Colin Percival`_.
provider.
If the backend doesn't support the requested combination of ``cipher``
- and ``mode`` an :class:`cryptography.exceptions.UnsupportedAlgorithm`
+ and ``mode`` an :class:`~cryptography.exceptions.UnsupportedAlgorithm`
will be raised.
.. method:: decryptor()
@@ -352,6 +352,16 @@ Modes
Do not reuse an ``initialization_vector``
with a given ``key``.
+ .. note::
+
+ Cryptography will emit a 128-bit tag when finalizing encryption.
+ You can shorten a tag by truncating it to the desired length, but this
+ is **not recommended** as it lowers the security margins of the
+ authentication (`NIST SP-800-38D`_ recommends 96-bits or greater).
+ If you must shorten the tag the minimum allowed length is 4 bytes
+ (32-bits). Applications **must** verify the tag is the expected length
+ to guarantee the expected security margin.
+
:param bytes tag: The tag bytes to verify during decryption. When encrypting
this must be None.
@@ -390,3 +400,4 @@ Insecure Modes
.. _`described by Colin Percival`: http://www.daemonology.net/blog/2009-06-11-cryptographic-right-answers.html
.. _`recommends 96-bit IV length`: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/gcm/gcm-spec.pdf
+.. _`NIST SP-800-38D`: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
diff --git a/tests/hazmat/backends/test_openssl.py b/tests/hazmat/backends/test_openssl.py
index 962959b9..543a05fe 100644
--- a/tests/hazmat/backends/test_openssl.py
+++ b/tests/hazmat/backends/test_openssl.py
@@ -23,13 +23,14 @@ from cryptography.hazmat.primitives.ciphers.algorithms import AES
from cryptography.hazmat.primitives.ciphers.modes import CBC
+@utils.register_interface(interfaces.Mode)
class DummyMode(object):
- pass
+ name = "dummy-mode"
@utils.register_interface(interfaces.CipherAlgorithm)
class DummyCipher(object):
- pass
+ name = "dummy-cipher"
class TestOpenSSL(object):
@@ -62,15 +63,16 @@ class TestOpenSSL(object):
assert b.ffi is backend.ffi
assert b.lib is backend.lib
- def test_nonexistent_cipher(self):
+ @pytest.mark.parametrize("mode", [DummyMode(), None])
+ def test_nonexistent_cipher(self, mode):
b = Backend()
b.register_cipher_adapter(
DummyCipher,
- DummyMode,
+ type(mode),
lambda backend, cipher, mode: backend.ffi.NULL
)
cipher = Cipher(
- DummyCipher(), DummyMode(), backend=b,
+ DummyCipher(), mode, backend=b,
)
with pytest.raises(UnsupportedAlgorithm):
cipher.encryptor()
diff --git a/tests/hazmat/primitives/test_3des.py b/tests/hazmat/primitives/test_3des.py
index 69ec9c9a..0db56f47 100644
--- a/tests/hazmat/primitives/test_3des.py
+++ b/tests/hazmat/primitives/test_3des.py
@@ -37,8 +37,8 @@ class TestTripleDES_CBC(object):
"TCBCvarkey.rsp",
"TCBCvartext.rsp",
],
- lambda keys, iv: algorithms.TripleDES(binascii.unhexlify(keys)),
- lambda keys, iv: modes.CBC(binascii.unhexlify(iv)),
+ lambda keys, **kwargs: algorithms.TripleDES(binascii.unhexlify(keys)),
+ lambda iv, **kwargs: modes.CBC(binascii.unhexlify(iv)),
)
test_MMT = generate_encrypt_test(
@@ -49,10 +49,10 @@ class TestTripleDES_CBC(object):
"TCBCMMT2.rsp",
"TCBCMMT3.rsp",
],
- lambda key1, key2, key3, iv: (
- algorithms.TripleDES(binascii.unhexlify(key1 + key2 + key3))
+ lambda key1, key2, key3, **kwargs: algorithms.TripleDES(
+ binascii.unhexlify(key1 + key2 + key3)
),
- lambda key1, key2, key3, iv: modes.CBC(binascii.unhexlify(iv)),
+ lambda iv, **kwargs: modes.CBC(binascii.unhexlify(iv)),
)
@@ -67,8 +67,8 @@ class TestTripleDES_OFB(object):
"TOFBvartext.rsp",
"TOFBinvperm.rsp",
],
- lambda keys, iv: algorithms.TripleDES(binascii.unhexlify(keys)),
- lambda keys, iv: modes.OFB(binascii.unhexlify(iv)),
+ lambda keys, **kwargs: algorithms.TripleDES(binascii.unhexlify(keys)),
+ lambda iv, **kwargs: modes.OFB(binascii.unhexlify(iv)),
)
test_MMT = generate_encrypt_test(
@@ -79,10 +79,10 @@ class TestTripleDES_OFB(object):
"TOFBMMT2.rsp",
"TOFBMMT3.rsp",
],
- lambda key1, key2, key3, iv: (
- algorithms.TripleDES(binascii.unhexlify(key1 + key2 + key3))
+ lambda key1, key2, key3, **kwargs: algorithms.TripleDES(
+ binascii.unhexlify(key1 + key2 + key3)
),
- lambda key1, key2, key3, iv: modes.OFB(binascii.unhexlify(iv)),
+ lambda iv, **kwargs: modes.OFB(binascii.unhexlify(iv)),
)
@@ -97,8 +97,8 @@ class TestTripleDES_CFB(object):
"TCFB64varkey.rsp",
"TCFB64vartext.rsp",
],
- lambda keys, iv: algorithms.TripleDES(binascii.unhexlify(keys)),
- lambda keys, iv: modes.CFB(binascii.unhexlify(iv)),
+ lambda keys, **kwargs: algorithms.TripleDES(binascii.unhexlify(keys)),
+ lambda iv, **kwargs: modes.CFB(binascii.unhexlify(iv)),
)
test_MMT = generate_encrypt_test(
@@ -109,8 +109,8 @@ class TestTripleDES_CFB(object):
"TCFB64MMT2.rsp",
"TCFB64MMT3.rsp",
],
- lambda key1, key2, key3, iv: (
- algorithms.TripleDES(binascii.unhexlify(key1 + key2 + key3))
+ lambda key1, key2, key3, **kwargs: algorithms.TripleDES(
+ binascii.unhexlify(key1 + key2 + key3)
),
- lambda key1, key2, key3, iv: modes.CFB(binascii.unhexlify(iv)),
+ lambda iv, **kwargs: modes.CFB(binascii.unhexlify(iv)),
)
diff --git a/tests/hazmat/primitives/test_aes.py b/tests/hazmat/primitives/test_aes.py
index f7b0b9a0..9e5a3cb5 100644
--- a/tests/hazmat/primitives/test_aes.py
+++ b/tests/hazmat/primitives/test_aes.py
@@ -45,8 +45,8 @@ class TestAES(object):
"CBCMMT192.rsp",
"CBCMMT256.rsp",
],
- lambda key, iv: algorithms.AES(binascii.unhexlify(key)),
- lambda key, iv: modes.CBC(binascii.unhexlify(iv)),
+ lambda key, **kwargs: algorithms.AES(binascii.unhexlify(key)),
+ lambda iv, **kwargs: modes.CBC(binascii.unhexlify(iv)),
)
test_ECB = generate_encrypt_test(
@@ -69,8 +69,8 @@ class TestAES(object):
"ECBMMT192.rsp",
"ECBMMT256.rsp",
],
- lambda key: algorithms.AES(binascii.unhexlify(key)),
- lambda key: modes.ECB(),
+ lambda key, **kwargs: algorithms.AES(binascii.unhexlify(key)),
+ lambda **kwargs: modes.ECB(),
)
test_OFB = generate_encrypt_test(
@@ -93,8 +93,8 @@ class TestAES(object):
"OFBMMT192.rsp",
"OFBMMT256.rsp",
],
- lambda key, iv: algorithms.AES(binascii.unhexlify(key)),
- lambda key, iv: modes.OFB(binascii.unhexlify(iv)),
+ lambda key, **kwargs: algorithms.AES(binascii.unhexlify(key)),
+ lambda iv, **kwargs: modes.OFB(binascii.unhexlify(iv)),
)
test_CFB = generate_encrypt_test(
@@ -117,16 +117,16 @@ class TestAES(object):
"CFB128MMT192.rsp",
"CFB128MMT256.rsp",
],
- lambda key, iv: algorithms.AES(binascii.unhexlify(key)),
- lambda key, iv: modes.CFB(binascii.unhexlify(iv)),
+ lambda key, **kwargs: algorithms.AES(binascii.unhexlify(key)),
+ lambda iv, **kwargs: modes.CFB(binascii.unhexlify(iv)),
)
test_CTR = generate_encrypt_test(
load_openssl_vectors,
os.path.join("ciphers", "AES", "CTR"),
["aes-128-ctr.txt", "aes-192-ctr.txt", "aes-256-ctr.txt"],
- lambda key, iv: algorithms.AES(binascii.unhexlify(key)),
- lambda key, iv: modes.CTR(binascii.unhexlify(iv)),
+ lambda key, **kwargs: algorithms.AES(binascii.unhexlify(key)),
+ lambda iv, **kwargs: modes.CTR(binascii.unhexlify(iv)),
only_if=lambda backend: backend.cipher_supported(
algorithms.AES("\x00" * 16), modes.CTR("\x00" * 16)
),
diff --git a/tests/hazmat/primitives/test_arc4.py b/tests/hazmat/primitives/test_arc4.py
index d233bec2..a9ef2bbe 100644
--- a/tests/hazmat/primitives/test_arc4.py
+++ b/tests/hazmat/primitives/test_arc4.py
@@ -35,7 +35,7 @@ class TestARC4(object):
"rfc-6229-192.txt",
"rfc-6229-256.txt",
],
- lambda key: algorithms.ARC4(binascii.unhexlify((key))),
+ lambda key, **kwargs: algorithms.ARC4(binascii.unhexlify(key)),
only_if=lambda backend: backend.cipher_supported(
algorithms.ARC4("\x00" * 16), None
),
diff --git a/tests/hazmat/primitives/test_block.py b/tests/hazmat/primitives/test_block.py
index 02de3861..573f5633 100644
--- a/tests/hazmat/primitives/test_block.py
+++ b/tests/hazmat/primitives/test_block.py
@@ -31,9 +31,14 @@ from .utils import (
)
+@utils.register_interface(interfaces.Mode)
+class DummyMode(object):
+ name = "dummy-mode"
+
+
@utils.register_interface(interfaces.CipherAlgorithm)
class DummyCipher(object):
- pass
+ name = "dummy-cipher"
class TestCipher(object):
@@ -101,9 +106,10 @@ class TestCipherContext(object):
assert pt == b"a" * 80
decryptor.finalize()
- def test_nonexistent_cipher(self, backend):
+ @pytest.mark.parametrize("mode", [DummyMode(), None])
+ def test_nonexistent_cipher(self, backend, mode):
cipher = Cipher(
- DummyCipher(), object(), backend
+ DummyCipher(), mode, backend
)
with pytest.raises(UnsupportedAlgorithm):
cipher.encryptor()
diff --git a/tests/hazmat/primitives/test_blowfish.py b/tests/hazmat/primitives/test_blowfish.py
index d5fbed6f..065855d7 100644
--- a/tests/hazmat/primitives/test_blowfish.py
+++ b/tests/hazmat/primitives/test_blowfish.py
@@ -27,8 +27,8 @@ class TestBlowfish(object):
load_nist_vectors,
os.path.join("ciphers", "Blowfish"),
["bf-ecb.txt"],
- lambda key: algorithms.Blowfish(binascii.unhexlify(key)),
- lambda key: modes.ECB(),
+ lambda key, **kwargs: algorithms.Blowfish(binascii.unhexlify(key)),
+ lambda **kwargs: modes.ECB(),
only_if=lambda backend: backend.cipher_supported(
algorithms.Blowfish("\x00" * 56), modes.ECB()
),
@@ -39,8 +39,8 @@ class TestBlowfish(object):
load_nist_vectors,
os.path.join("ciphers", "Blowfish"),
["bf-cbc.txt"],
- lambda key, iv: algorithms.Blowfish(binascii.unhexlify(key)),
- lambda key, iv: modes.CBC(binascii.unhexlify(iv)),
+ lambda key, **kwargs: algorithms.Blowfish(binascii.unhexlify(key)),
+ lambda iv, **kwargs: modes.CBC(binascii.unhexlify(iv)),
only_if=lambda backend: backend.cipher_supported(
algorithms.Blowfish("\x00" * 56), modes.CBC("\x00" * 8)
),
@@ -51,8 +51,8 @@ class TestBlowfish(object):
load_nist_vectors,
os.path.join("ciphers", "Blowfish"),
["bf-ofb.txt"],
- lambda key, iv: algorithms.Blowfish(binascii.unhexlify(key)),
- lambda key, iv: modes.OFB(binascii.unhexlify(iv)),
+ lambda key, **kwargs: algorithms.Blowfish(binascii.unhexlify(key)),
+ lambda iv, **kwargs: modes.OFB(binascii.unhexlify(iv)),
only_if=lambda backend: backend.cipher_supported(
algorithms.Blowfish("\x00" * 56), modes.OFB("\x00" * 8)
),
@@ -63,8 +63,8 @@ class TestBlowfish(object):
load_nist_vectors,
os.path.join("ciphers", "Blowfish"),
["bf-cfb.txt"],
- lambda key, iv: algorithms.Blowfish(binascii.unhexlify(key)),
- lambda key, iv: modes.CFB(binascii.unhexlify(iv)),
+ lambda key, **kwargs: algorithms.Blowfish(binascii.unhexlify(key)),
+ lambda iv, **kwargs: modes.CFB(binascii.unhexlify(iv)),
only_if=lambda backend: backend.cipher_supported(
algorithms.Blowfish("\x00" * 56), modes.CFB("\x00" * 8)
),
diff --git a/tests/hazmat/primitives/test_camellia.py b/tests/hazmat/primitives/test_camellia.py
index a2c935d9..6e5fe682 100644
--- a/tests/hazmat/primitives/test_camellia.py
+++ b/tests/hazmat/primitives/test_camellia.py
@@ -33,8 +33,8 @@ class TestCamellia(object):
"camellia-192-ecb.txt",
"camellia-256-ecb.txt"
],
- lambda key: algorithms.Camellia(binascii.unhexlify((key))),
- lambda key: modes.ECB(),
+ lambda key, **kwargs: algorithms.Camellia(binascii.unhexlify(key)),
+ lambda **kwargs: modes.ECB(),
only_if=lambda backend: backend.cipher_supported(
algorithms.Camellia("\x00" * 16), modes.ECB()
),
@@ -45,8 +45,8 @@ class TestCamellia(object):
load_openssl_vectors,
os.path.join("ciphers", "Camellia"),
["camellia-cbc.txt"],
- lambda key, iv: algorithms.Camellia(binascii.unhexlify(key)),
- lambda key, iv: modes.CBC(binascii.unhexlify(iv)),
+ lambda key, **kwargs: algorithms.Camellia(binascii.unhexlify(key)),
+ lambda iv, **kwargs: modes.CBC(binascii.unhexlify(iv)),
only_if=lambda backend: backend.cipher_supported(
algorithms.Camellia("\x00" * 16), modes.CBC("\x00" * 16)
),
@@ -57,8 +57,8 @@ class TestCamellia(object):
load_openssl_vectors,
os.path.join("ciphers", "Camellia"),
["camellia-ofb.txt"],
- lambda key, iv: algorithms.Camellia(binascii.unhexlify(key)),
- lambda key, iv: modes.OFB(binascii.unhexlify(iv)),
+ lambda key, **kwargs: algorithms.Camellia(binascii.unhexlify(key)),
+ lambda iv, **kwargs: modes.OFB(binascii.unhexlify(iv)),
only_if=lambda backend: backend.cipher_supported(
algorithms.Camellia("\x00" * 16), modes.OFB("\x00" * 16)
),
@@ -69,8 +69,8 @@ class TestCamellia(object):
load_openssl_vectors,
os.path.join("ciphers", "Camellia"),
["camellia-cfb.txt"],
- lambda key, iv: algorithms.Camellia(binascii.unhexlify(key)),
- lambda key, iv: modes.CFB(binascii.unhexlify(iv)),
+ lambda key, **kwargs: algorithms.Camellia(binascii.unhexlify(key)),
+ lambda iv, **kwargs: modes.CFB(binascii.unhexlify(iv)),
only_if=lambda backend: backend.cipher_supported(
algorithms.Camellia("\x00" * 16), modes.CFB("\x00" * 16)
),
diff --git a/tests/hazmat/primitives/test_cast5.py b/tests/hazmat/primitives/test_cast5.py
index a283dafc..406f9b55 100644
--- a/tests/hazmat/primitives/test_cast5.py
+++ b/tests/hazmat/primitives/test_cast5.py
@@ -27,8 +27,8 @@ class TestCAST5(object):
load_nist_vectors,
os.path.join("ciphers", "CAST5"),
["cast5-ecb.txt"],
- lambda key: algorithms.CAST5(binascii.unhexlify((key))),
- lambda key: modes.ECB(),
+ lambda key, **kwargs: algorithms.CAST5(binascii.unhexlify((key))),
+ lambda **kwargs: modes.ECB(),
only_if=lambda backend: backend.cipher_supported(
algorithms.CAST5("\x00" * 16), modes.ECB()
),
diff --git a/tests/hazmat/primitives/test_hashes.py b/tests/hazmat/primitives/test_hashes.py
index ff42e8f4..72bc3e27 100644
--- a/tests/hazmat/primitives/test_hashes.py
+++ b/tests/hazmat/primitives/test_hashes.py
@@ -19,12 +19,18 @@ import pytest
import six
-from cryptography.exceptions import AlreadyFinalized
-from cryptography.hazmat.primitives import hashes
+from cryptography import utils
+from cryptography.exceptions import AlreadyFinalized, UnsupportedAlgorithm
+from cryptography.hazmat.primitives import hashes, interfaces
from .utils import generate_base_hash_test
+@utils.register_interface(interfaces.HashAlgorithm)
+class UnsupportedDummyHash(object):
+ name = "unsupported-dummy-hash"
+
+
class TestHashContext(object):
def test_hash_reject_unicode(self, backend):
m = hashes.Hash(hashes.SHA1(), backend=backend)
@@ -57,6 +63,10 @@ class TestHashContext(object):
with pytest.raises(AlreadyFinalized):
h.finalize()
+ def test_unsupported_hash(self, backend):
+ with pytest.raises(UnsupportedAlgorithm):
+ hashes.Hash(UnsupportedDummyHash(), backend)
+
class TestSHA1(object):
test_SHA1 = generate_base_hash_test(
diff --git a/tests/hazmat/primitives/test_hmac.py b/tests/hazmat/primitives/test_hmac.py
index 992bcb1a..124c4377 100644
--- a/tests/hazmat/primitives/test_hmac.py
+++ b/tests/hazmat/primitives/test_hmac.py
@@ -19,12 +19,18 @@ import pytest
import six
-from cryptography.exceptions import AlreadyFinalized
-from cryptography.hazmat.primitives import hashes, hmac
+from cryptography import utils
+from cryptography.exceptions import AlreadyFinalized, UnsupportedAlgorithm
+from cryptography.hazmat.primitives import hashes, hmac, interfaces
from .utils import generate_base_hmac_test
+@utils.register_interface(interfaces.HashAlgorithm)
+class UnsupportedDummyHash(object):
+ name = "unsupported-dummy-hash"
+
+
class TestHMAC(object):
test_copy = generate_base_hmac_test(
hashes.MD5(),
@@ -63,3 +69,7 @@ class TestHMAC(object):
with pytest.raises(AlreadyFinalized):
h.finalize()
+
+ def test_unsupported_hash(self, backend):
+ with pytest.raises(UnsupportedAlgorithm):
+ hmac.HMAC(b"key", UnsupportedDummyHash(), backend)
diff --git a/tests/hazmat/primitives/utils.py b/tests/hazmat/primitives/utils.py
index 758e755c..b00d3184 100644
--- a/tests/hazmat/primitives/utils.py
+++ b/tests/hazmat/primitives/utils.py
@@ -44,8 +44,8 @@ def encrypt_test(backend, cipher_factory, mode_factory, params, only_if,
skip_message):
if not only_if(backend):
pytest.skip(skip_message)
- plaintext = params.pop("plaintext")
- ciphertext = params.pop("ciphertext")
+ plaintext = params["plaintext"]
+ ciphertext = params["ciphertext"]
cipher = Cipher(
cipher_factory(**params),
mode_factory(**params),
@@ -84,9 +84,9 @@ def aead_test(backend, cipher_factory, mode_factory, params, only_if,
if not only_if(backend):
pytest.skip(skip_message)
if params.get("pt") is not None:
- plaintext = params.pop("pt")
- ciphertext = params.pop("ct")
- aad = params.pop("aad")
+ plaintext = params["pt"]
+ ciphertext = params["ct"]
+ aad = params["aad"]
if params.get("fail") is True:
cipher = Cipher(
cipher_factory(binascii.unhexlify(params["key"])),
@@ -145,9 +145,9 @@ def stream_encryption_test(backend, cipher_factory, params, only_if,
skip_message):
if not only_if(backend):
pytest.skip(skip_message)
- plaintext = params.pop("plaintext")
- ciphertext = params.pop("ciphertext")
- offset = params.pop("offset")
+ plaintext = params["plaintext"]
+ ciphertext = params["ciphertext"]
+ offset = params["offset"]
cipher = Cipher(cipher_factory(**params), None, backend=backend)
encryptor = cipher.encryptor()
# throw away offset bytes
@@ -363,6 +363,13 @@ def aead_tag_exception_test(backend, cipher_factory, mode_factory,
cipher.decryptor()
cipher = Cipher(
cipher_factory(binascii.unhexlify(b"0" * 32)),
+ mode_factory(binascii.unhexlify(b"0" * 24), b"000"),
+ backend
+ )
+ with pytest.raises(ValueError):
+ cipher.decryptor()
+ cipher = Cipher(
+ cipher_factory(binascii.unhexlify(b"0" * 32)),
mode_factory(binascii.unhexlify(b"0" * 24), b"0" * 16),
backend
)
generated by cgit v1.2.3 (git 2.25.1) at 2025-04-18 17:59:51 +0000