| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
| |
* Add SSL_get0_verified_chain to cffi lib
OpenSSL 1.1.0 supports SSL_get0_verified_chain. This gives the full chain from the peer cert including your trusted CA cert.
* Work around no support for #if in cdef in old cffi
|
| |
|
|
|
|
|
|
| |
* Make DER reader into a context manager
* Added another test case
* flake8
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* Remove non-test dependencies on asn1crypto.
cryptography.io actually contains two OpenSSL bindings right now, the
expected cffi one, and an optional one hidden in asn1crypto. asn1crypto
contains a lot of things that cryptography.io doesn't use, including a
BER parser and a hand-rolled and not constant-time EC implementation.
Instead, check in a much small DER-only parser in cryptography/hazmat. A
quick benchmark suggests this parser is also faster than asn1crypto:
from __future__ import absolute_import, division, print_function
import timeit
print(timeit.timeit(
"decode_dss_signature(sig)",
setup=r"""
from cryptography.hazmat.primitives.asymmetric.utils import decode_dss_signature
sig=b"\x30\x2d\x02\x15\x00\xb5\xaf\x30\x78\x67\xfb\x8b\x54\x39\x00\x13\xcc\x67\x02\x0d\xdf\x1f\x2c\x0b\x81\x02\x14\x62\x0d\x3b\x22\xab\x50\x31\x44\x0c\x3e\x35\xea\xb6\xf4\x81\x29\x8f\x9e\x9f\x08"
""",
number=10000))
Python 2.7:
asn1crypto: 0.25
_der.py: 0.098
Python 3.5:
asn1crypto: 0.17
_der.py: 0.10
* Remove test dependencies on asn1crypto.
The remaining use of asn1crypto was some sanity-checking of
Certificates. Add a minimal X.509 parser to extract the relevant fields.
* Add a read_single_element helper function.
The outermost read is a little tedious.
* Address flake8 warnings
* Fix test for long-form vs short-form lengths.
Testing a zero length trips both this check and the non-minimal long
form check. Use a one-byte length to cover the missing branch.
* Remove support for negative integers.
These never come up in valid signatures. Note, however, this does
change public API.
* Update src/cryptography/hazmat/primitives/asymmetric/utils.py
Co-Authored-By: Alex Gaynor <alex.gaynor@gmail.com>
* Review comments
* Avoid hardcoding the serialization of NULL in decode_asn1.py too.
|
| |
|
|
|
|
|
|
|
|
| |
* fix osrandom/builtin switching methods for 1.1.0+
In 1.1.0 RAND_cleanup became a no-op. This broke changing to the builtin
random engine via activate_builtin_random(). Fixed by directly calling
RAND_set_rand_method. This works on 1.0.x and 1.1.x
* missed an assert
|
| |
|
|
|
|
| |
* add bindings to parse and create challenge passwords in X509 CSRs
* moved away from the 1.1.0 section
|
| | |
|
| |
|
|
|
|
|
|
|
|
| |
* ed25519 support in x509 certificate builder
This adds minimal ed25519 support. More to come.
* Apply suggestions from code review
Co-Authored-By: Alex Gaynor <alex.gaynor@gmail.com>
|
| |
|
|
|
|
| |
* Refs #4923; deprecate OpenSSL 1.0.1
* changelog
|
| |
|
| |
Introduced in OpenSSL 1.1. Added compatibility for older versions.
|
| | |
|
| |
|
|
|
|
|
|
| |
* reopen master for 2.8
also add the missing changelog
* sigh, empty commit to trigger azure pipelines
|
| | |
|
| |
|
|
|
|
|
|
| |
* test: ensure all public members of ExtensionOID have names defined
* add name for ExtensionOID.PRECERT_POISON
ref: https://github.com/google/certificate-transparency/blob/5fce65cb60cfe7808afc98de23c7dd5ddbfa1509/python/ct/crypto/asn1/oid.py#L338
|
| |
|
|
|
|
| |
* fix aia encoding memory leak
* don't return anything from the prealloc func
|
| | |
|
| |
|
|
|
|
|
|
|
|
| |
* fix from_issuer_subject_key_identifier to take the right type
deprecate passing the old Extension wrapper object
* don't use a try:except:
* hilarious contortions to satisfy doc8
|
| |
|
|
|
|
|
|
|
|
| |
* Use generic DTLS functions added in LibreSSL 2.9.1
While here, bump travis.
* Remove LibreSSL 2.9.0 from travis now that 2.9.1 exists.
Requested by: @reaperhulk
|
| |
|
|
|
|
|
|
| |
* test: regression test for UnicodeEncodeError in x509 name in #4810
added utf8 encoding at the top of the file due to PEP 263
* bugfix: #4810 resolve UnicodeEncodeError in x509 name
|
| | |
|
| |
|
|
|
|
| |
* fix a memory leak in AIA parsing
* oops can't remove that
|
| | |
|
| |
|
|
|
|
|
|
| |
* fix != comparison in py2 (fixes #4821)
* remove blank line b/c pep8
* move __ne__ next to __eq__ as per review request
|
| | |
|
| |
|
|
|
|
| |
* Try to use getrandom even in manylinux1 wheels
* typo
|
| |
|
|
|
| |
we don't support ed448 openssh keys so we'll use that to test this
branch. if we ever do support ed448 keys we can always just call this
private method directly to keep coverage.
|
| |
|
|
|
|
| |
* add OpenSSH serialization for ed25519 keys (#4808)
* address review comments
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* poly1305 support
* some more tests
* have I mentioned how bad the spellchecker is?
* doc improvements
* EVP_PKEY_new_raw_private_key copies the key but that's not documented
Let's assume that might change and be very defensive
* review feedback
* add a test that fails on a tag of the correct length but wrong value
* docs improvements
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
| |
* bump version and update changelog for 2.6 release
* 1.1.1b wheels for 2.6
|
| |
|
|
|
|
| |
* support ed25519 openssh public keys
* don't need this check
|
| |
|
|
|
|
|
|
| |
* ed448 support
* move the changelog entry
* flake8
|
| |
|
|
|
|
| |
* ed25519 support
* review feedback
|
| | |
|
| |
|
|
|
|
|
|
| |
* remove unused locking functions
we do all this in C when necessary
* oops, need this
|
| | |
|
| | |
|
| |
|
|
|
|
| |
* how about we have less NIDs
* pyopenssl needs these two NIDs still
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
| |
* support OPENSSL_NO_ENGINE
* support some new openssl config args
* sigh
|
| | |
|
