* Add support for encrypting S/MIME messages
* Move PKCS7 decrypt test function to Rust
* Use symmetric encryption function from PKCS12
* Remove debug file write from tests
* Remove unneeded backend parameter
* docs and changelog
Given the RSA public exponent (`e`), and the RSA primes (`p`, `q`), it is possible
to calculate the corresponding private exponent `d = e⁻¹ mod λ(n)` where
`λ(n) = lcm(p-1, q-1)`.
With this function added, it becomes possible to use the library to reconstruct an RSA
private key given *only* `p`, `q`, and `e`:
from cryptography.hazmat.primitives.asymmetric import rsa
n = p * q
d = rsa.rsa_recover_private_exponent(e, p, q) # newly-added piece
iqmp = rsa.rsa_crt_iqmp(p, q) # preexisting
dmp1 = rsa.rsa_crt_dmp1(d, p) # preexisting
dmq1 = rsa.rsa_crt_dmq1(d, q) # preexisting
assert rsa.rsa_recover_prime_factors(n, e, d) in ((p, q), (q, p)) # verify consistency
privk = rsa.RSAPrivateNumbers(p, q, d, dmp1, dmq1, iqmp, rsa.RSAPublicNumbers(e, n)).private_key()
Older RSA implementations, including the original RSA paper, often used the
Euler totient function `ɸ(n) = (p-1) * (q-1)` instead of `λ(n)`. The
private exponents generated by that method work equally well, but may be
larger than strictly necessary (`λ(n)` always divides `ɸ(n)`). This commit
additionally implements `_rsa_recover_euler_private_exponent`, so that tests
of the internal structure of RSA private keys can allow for either the Euler
or the Carmichael versions of the private exponents.
It makes sense to expose only the more modern version (using the Carmichael
totient function) for public usage, given that it is slightly more
computationally efficient to use the keys in this form, and that some
standards like FIPS 186-4 require this form. (See
https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf#page=63)
* Update reference.rst
This code snippet works when importing the extension oid
* Apply suggestions from code review
Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>
---------
Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>
* Fix more misspellings
* Apply codespell suggestion: implementor → implementer
This is not exactly a misspelling, but:
* From Garner's Modern English Usage (4 ed.)
Although the variant spelling ✳implementor predominated for much of
the late 20th century, today implementer is considered standard.
* The Google Ngram Viewer shows a ratio of almost 10:1 in 2019.
* verification: WIP client verification skeleton
Signed-off-by: William Woodruff <william@yossarian.net>
* verify: fill in build_client_verifier
Signed-off-by: William Woodruff <william@yossarian.net>
* implement ClientVerifier.verify
Signed-off-by: William Woodruff <william@yossarian.net>
* verification: make Python 3.8 happy
Signed-off-by: William Woodruff <william@yossarian.net>
* switch to a full VerifiedClient type
Signed-off-by: William Woodruff <william@yossarian.net>
* remove the SubjectOwner::None hack
Signed-off-by: William Woodruff <william@yossarian.net>
* docs: fix ClientVerifier
Signed-off-by: William Woodruff <william@yossarian.net>
* verification: replace match with if
Signed-off-by: William Woodruff <william@yossarian.net>
* return GNs directly, not whole extension
Signed-off-by: William Woodruff <william@yossarian.net>
* docs/verification: document UnsupportedGeneralNameType raise
Signed-off-by: William Woodruff <william@yossarian.net>
* lib: RFC822 checks on NCs
* test_limbo: enable client tests
* tests: flake
* test_verification: more Python API coverage
* verification: filter GNs by NC support
* verification: forbid unsupported NC GNs
This is what we should have been doing originally, per
RFC 5280 4.2.1.10:
> If a name constraints extension that is marked as critical
> imposes constraints on a particular name form, and an instance of
> that name form appears in the subject field or subjectAltName
> extension of a subsequent certificate, then the application MUST
> either process the constraint or reject the certificate.
* docs/verification: remove old sentence
Signed-off-by: William Woodruff <william@yossarian.net>
* verification: ensure the right EKU for client/server paths
Signed-off-by: William Woodruff <william@yossarian.net>
* test_limbo: fixup EKU assertion
* verification: feedback
---------
Signed-off-by: William Woodruff <william@yossarian.net>
* allow SPKI RSA keys to be parsed even if they have an incorrect delimiter
This allows RSA SPKI keys (typically delimited with PUBLIC KEY) to be parsed
even if they are using the RSA PUBLIC KEY delimiter.
* formatting
* use original error if nothing parses, don't let it parse non-RSA
* Update ocsp.rst
Added warning about SHA1 being used for sign()
* Update ocsp.rst
Fixed spelling issues, at least according to en-GB dictionary.
* Update ocsp.rst
Spell checker didn't catch "algorithim" somehow.
* Update ocsp.rst
Attempting to rephrase the warning.
* Update ocsp.rst
Removing rouge space.
* Add support for SM4-GCM cipher
ref: #7503
ref: https://github.com/openssl/openssl/issues/13667
* Update SM4 GCM tests to use external test vector
* Cite SM4 test vectors sources in document
* Add tests for SM4ModeGCM finalize_with_tag
* Update CHANGELOG.rst
* x509/verification: add an API usage example
Signed-off-by: William Woodruff <william@yossarian.net>
* Apply suggestions from code review
Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>
---------
Signed-off-by: William Woodruff <william@yossarian.net>
Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>
- No special configuration is required for brew or macports OpenSSL anymore
- There's no point in documenting building local docs, it's basically never necessary
The existing cert doesn't expire until late 2038 but this simplifies
2038 checks for some downstream consumers. We shift the original
cert/key into a new pkcs12/ca directory so that we don't need to
regenerate all the PKCS12 vectors (which don't care about expiry anyway)
* src, tests: all max_chain_depth to validation API
Signed-off-by: William Woodruff <william@trailofbits.com>
* docs: document max_chain_depth
Signed-off-by: William Woodruff <william@trailofbits.com>
* verify: simplify type
Signed-off-by: William Woodruff <william@trailofbits.com>
* validation: document DEFAULT_MAX_CHAIN_DEPTH
Signed-off-by: William Woodruff <william@trailofbits.com>
---------
Signed-off-by: William Woodruff <william@trailofbits.com>
* Add top-level ServerVerifier.verify API
This is a breakout from #8873, with just the interface/types and
a `NotImplementedError` stub.
Signed-off-by: William Woodruff <william@trailofbits.com>
* verification: move Store into PolicyBuilder/ServerVerifier
Signed-off-by: William Woodruff <william@trailofbits.com>
* verification: docs
Signed-off-by: William Woodruff <william@trailofbits.com>
* lintage
Signed-off-by: William Woodruff <william@trailofbits.com>
* docs: document ServerVerifier.store
Signed-off-by: William Woodruff <william@trailofbits.com>
---------
Signed-off-by: William Woodruff <william@trailofbits.com>
* src, tests: flatten all changes
Signed-off-by: William Woodruff <william@trailofbits.com>
validation: remove Profile abstract from public APIs
One step towards removing it entirely
Signed-off-by: William Woodruff <william@trailofbits.com>
policy: disambiguate references
Signed-off-by: William Woodruff <william@trailofbits.com>
policy: remove separate rfc5280 profile
Signed-off-by: William Woodruff <william@trailofbits.com>
policy: remove profile abstraction entirely
Signed-off-by: William Woodruff <william@trailofbits.com>
rust: permitted_algorithms filtering
Signed-off-by: William Woodruff <william@trailofbits.com>
verify: simplify policy API substantially
No more manual monomorphization.
Signed-off-by: William Woodruff <william@trailofbits.com>
src, tests: remove verification code
Signed-off-by: William Woodruff <william@trailofbits.com>
validation: remove more validation code
Signed-off-by: William Woodruff <william@trailofbits.com>
* cryptography, rust: lintage
Signed-off-by: William Woodruff <william@trailofbits.com>
* cryptography, rust: lintage, add Policy.subject API
Signed-off-by: William Woodruff <william@trailofbits.com>
* src, tests: initial PolicyBuilder tests
Signed-off-by: William Woodruff <william@trailofbits.com>
* verify: Policy.validation_time getter
Signed-off-by: William Woodruff <william@trailofbits.com>
* push Store into rust
Signed-off-by: William Woodruff <william@trailofbits.com>
* cleanup, fixup
Signed-off-by: William Woodruff <william@trailofbits.com>
* tests: lintage
Signed-off-by: William Woodruff <william@trailofbits.com>
* src: lintage
Signed-off-by: William Woodruff <william@trailofbits.com>
* tests: fix linter warning
* policy: apply the relevant parts of trail-of-forks/cryptography/pull/3
Signed-off-by: William Woodruff <william@trailofbits.com>
* policy: typo
Signed-off-by: William Woodruff <william@trailofbits.com>
* fixup type hints
Signed-off-by: William Woodruff <william@trailofbits.com>
* drop dep
Not used, yet.
Signed-off-by: William Woodruff <william@trailofbits.com>
* Revert "drop dep"
This reverts commit a5154e1245e666a79838cd73784884fad6743e7f.
* mod: remove permits_* bodies
Will include these in a subsequent PR.
Signed-off-by: William Woodruff <william@trailofbits.com>
* src: drop certificate helpers as well
Not needed yet.
Signed-off-by: William Woodruff <william@trailofbits.com>
* verify: remove unneeded explicit lifetimes
Signed-off-by: William Woodruff <william@trailofbits.com>
* tests: builder API coverage
Signed-off-by: William Woodruff <william@trailofbits.com>
* tests: more coverage
Signed-off-by: William Woodruff <william@trailofbits.com>
* type hints
Signed-off-by: William Woodruff <william@trailofbits.com>
* unused derives
Signed-off-by: William Woodruff <william@trailofbits.com>
* validation: more coverage
Signed-off-by: William Woodruff <william@trailofbits.com>
* policy: more cov
Signed-off-by: William Woodruff <william@trailofbits.com>
* policy: more coverage
Signed-off-by: William Woodruff <william@trailofbits.com>
* policy: add some known bad testcases
Signed-off-by: William Woodruff <william@trailofbits.com>
* policy: coverage
Signed-off-by: William Woodruff <william@trailofbits.com>
* validation: remove trust_store
Not yet used.
Signed-off-by: William Woodruff <william@trailofbits.com>
* ops: add NullOps test
Signed-off-by: William Woodruff <william@trailofbits.com>
* x509: reimplement verify_directly_issued_by via CryptoOps
Tests fail, but this gets the right coverage.
Signed-off-by: William Woodruff <william@trailofbits.com>
* ops: use results
Signed-off-by: William Woodruff <william@trailofbits.com>
* src, tests: last cov, hopefully
Signed-off-by: William Woodruff <william@trailofbits.com>
* test: lintage
Signed-off-by: William Woodruff <william@trailofbits.com>
* docs: fill in API docs
Signed-off-by: William Woodruff <william@trailofbits.com>
* rust: uniform imports
Signed-off-by: William Woodruff <william@trailofbits.com>
* minimize for MVP
No configurable profile, Web PKI only.
Signed-off-by: William Woodruff <william@trailofbits.com>
* verify: remove old NOTE
Signed-off-by: William Woodruff <william@trailofbits.com>
* verify: remove another old NOTE
Signed-off-by: William Woodruff <william@trailofbits.com>
* src, tests: fixup tests
Signed-off-by: William Woodruff <william@trailofbits.com>
* docs: cleanup
Signed-off-by: William Woodruff <william@trailofbits.com>
* src, tests: drop support for missing subjects
As part of the MVP.
Signed-off-by: William Woodruff <william@trailofbits.com>
* profile: remove old comments
Signed-off-by: William Woodruff <william@trailofbits.com>
* policy: remove some verify-adjacent APIs
Paring down for review.
Signed-off-by: William Woodruff <william@trailofbits.com>
* policy: remove more verify-adjacent APIs
Signed-off-by: William Woodruff <william@trailofbits.com>
* policy: remove some From impls
Signed-off-by: William Woodruff <william@trailofbits.com>
* policy: remove rfc5280 constructor
Signed-off-by: William Woodruff <william@trailofbits.com>
* docs: declutter diff
Signed-off-by: William Woodruff <william@trailofbits.com>
* profile: prune even more state
Signed-off-by: William Woodruff <william@trailofbits.com>
* policy: remove old TODO
Signed-off-by: William Woodruff <william@trailofbits.com>
* policy: remove PolicyError
For now.
Signed-off-by: William Woodruff <william@trailofbits.com>
* docs: typo
Signed-off-by: William Woodruff <william@trailofbits.com>
* ops: remove NullOps
Signed-off-by: William Woodruff <william@trailofbits.com>
* rust: remove dev-dep, don't use import
Signed-off-by: William Woodruff <william@trailofbits.com>
* rust: fix IP_ADDRESS rename
Signed-off-by: William Woodruff <william@trailofbits.com>
* docs: clarify time behavior
Signed-off-by: William Woodruff <william@trailofbits.com>
* rename webpki() to new()
Since it doesn't actually do anything WebPKI related at the moment.
Signed-off-by: William Woodruff <william@trailofbits.com>
* docs: relocate
Signed-off-by: William Woodruff <william@trailofbits.com>
* verify: FixedPolicy -> PyCryptoPolicy
Signed-off-by: William Woodruff <william@trailofbits.com>
* verify: simplify SubjectOwner substantially
Signed-off-by: William Woodruff <william@trailofbits.com>
* verify: remove getter helper
Signed-off-by: William Woodruff <william@trailofbits.com>
* verify: reloc TODO
Signed-off-by: William Woodruff <william@trailofbits.com>
---------
Signed-off-by: William Woodruff <william@trailofbits.com>
Co-authored-by: Facundo Tuesca <facundo.tuesca@trailofbits.com>
* Adapt ChaCha20 test vectors to 64-bit counter
* Add ChaCha20 test vectors for counter overflow
These vectors test the behavior during counter overflow. Since
different implementations use different counter sizes (e.g. OpenSSL
uses a 64-bit counter, whereas BoringSSL uses a 32-bit counter),
it's important to ensure that the behavior during counter overflow
is consistent between implementations.
These vectors take into account both 32-bit and 64-bit overflows.
* Restore missing section from ChaCha20 docs
This change fixes the indentation of a note inside the ChaCha20
section of the docs, which caused the note to not render in the
resulting HTML.
* Fix ChaCha20 docs to specify non RFC-compliance
Currently, cryptography uses OpenSSL's ChaCha20 implementation,
which is based on the original algorithm designed by Daniel J.
Bernstein rather than the later standardized version (RFC 7539).
Since the documentation does not reflect this (it describes the RFC
version of the algorithm, rather than the original version we use),
this change fixes that.
* Remove random counter from ChaCha20 example docs
This changes the ChaCha20 example in the documentation to use a
normal user-defined variable for the counter part of the nonce,
rather than a randomized counter.
