Commit graph

2231 commits

Author SHA1 Message Date
Alex Gaynor
4a66e2bdde
[3.4] More aggressively point people at Rust version docs (#5782) (#5783) 2021-02-08 09:51:55 -06:00
Alex Gaynor
9d1669534f
Linker script is no longer required for building your own OpenSSL (#5746)
fixes #5683
2021-02-06 10:43:23 -06:00
Paul Kehrer
a98e708d45
remove DSAParametersWithNumbers (#5724)
Merged into DSAParameters, just like we did years ago for everything
else. Somehow we missed this one.
2021-01-31 17:24:37 -05:00
Paul Kehrer
6a8c0b55b9
make PrivateKeyWithSerialization an alias of PrivateKey (#5722)
* make PrivateKeyWithSerialization an alias of PrivateKey

* black
2021-01-31 11:37:26 -05:00
Alex Gaynor
f16bff2cbd
Apply type annotations to x509 ct and ocsp (#5712) 2021-01-30 16:44:14 -06:00
Alex Gaynor
b24d67d49d
Apply type annotations to x509 builders (#5709) 2021-01-29 17:00:00 -06:00
Alex Gaynor
8fd6b44969
It's 2021! (#5701) 2021-01-25 14:12:56 -06:00
Anthony Sottile
5910690764
correct types in docs/index.rst doctest (#5692) 2021-01-12 11:05:47 -05:00
Chkoupinator
928262531c
Added information on what encrypt raises (#5686)
* Added information on what encrypt raises

Added a note on RSA's Encrypt explanation for newcomers such as myself, so that they don't have to waste 4 hours trying to figure out what is causing the ValueError like I did 😅

* Moved the note under the raises ValueError section

* Removed whitespaces causing issues

* Update rsa.rst

* Update docs/hazmat/primitives/asymmetric/rsa.rst

Co-authored-by: Paul Kehrer <paul.l.kehrer@gmail.com>

Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>
Co-authored-by: Paul Kehrer <paul.l.kehrer@gmail.com>
2021-01-09 11:08:26 -06:00
Alex Gaynor
c84d6ee060
Integrate Rust into the build process properly (#5410) 2020-12-22 13:33:47 -06:00
Alex Gaynor
3e53910e90
Build manylinux2014 wheels (#5642) 2020-12-12 12:45:20 -06:00
Paul Kehrer
08afd16f28
we didn't actually commit the final doc fixes for the recover PR (#5614) 2020-12-09 10:04:20 -05:00
Alex Gaynor
e0477596f7
Remove __future__ import from our code (#5610) 2020-12-09 00:35:11 -06:00
Alex Gaynor
7d4e567e16
Switch black to py36 as the minimum version (#5608) 2020-12-08 23:40:21 -06:00
Alex Gaynor
ff12a37552
Remove Python2 from CI and code that branched on it (#5607)
* Remove Python2 from CI and code that branched on it

* Update setup.py

Co-authored-by: Hugo van Kemenade <hugovk@users.noreply.github.com>

* remove

* review feedback

Co-authored-by: Hugo van Kemenade <hugovk@users.noreply.github.com>
2020-12-08 23:10:10 -06:00
Zoltan Kelemen
6693d55cbe
Add support for RSA signature recovery (#5573)
* Removed unused argument.

* Added support for RSA signature recovery.

* Syntatic corrections for passing pep8 tests.

* Corrected typo.

* Added test of invalid Prehashed parameter to RSA signature recover.

* Renamed recover to a more descriptive name.

* Extended RSA signature recovery with option to return full data (not
only the digest part).

* Added missing words to pass spell check.
2020-12-07 23:58:04 -05:00
Alex Gaynor
8686d524b7
Document that PKCS1v1.5 is not constant time (#5600)
closes #5510
2020-12-06 22:12:44 -06:00
Alex Gaynor
2660f93eca
Document that Firefox doesn't support unencrypted pkcs12 (#5596) 2020-12-01 10:54:29 -06:00
Paul Kehrer
4645f02c25
disallow p less than 512-bit on DH (#5592)
* disallow p less than 512-bit on DH

OpenSSL 3.0.0 enforces this so we'll go ahead and enforce it everywhere
that's practical for us. (Note that we do not enforce on deserializing
PKCS1/PKCS8 keys in < 3.0.0, but this PR adds a test so that in the
3.0.0 support branch we can test an error path)

* missing test

* black

* _MIN_MODULUS_SIZE is now a thing

* skip on fips
2020-11-29 11:01:16 -05:00
Paul Kehrer
ac4c22168f
Reduce granularity of error msging when deserializing keys (#5588)
* Reduce granularity of error msging when deserializing keys

In OpenSSL 3.0 it is no longer possible to determine whether the reason
a key failed to deserialize is because of an unsupported cipher. Since
we want to be more resilient to OpenSSL error code instability we'll
just remove these paths.

* black

* changelog and update docs
2020-11-26 14:07:25 -05:00
Alex Gaynor
239fddf2d9
Polish up the fernet limitations language (#5577) 2020-11-19 13:07:47 -06:00
Alex Gaynor
488cd740bb
Remove two linkcheck ignores (#5570) 2020-11-13 11:25:43 -06:00
Alex Gaynor
d59b7c235b
Don't tell people to use PGP, it's not good (#5543) 2020-11-01 08:55:52 -08:00
Paul Kehrer
81e5de8986
updated faq entry (#5541)
the error will be opensslv.h these days and we don't need to talk
specifically about macOS
2020-10-31 19:09:07 -04:00
Alex Gaynor
752f966c94
we have abi3 wheels for windows now (#5536)
* we have abi3 wheels for windows now

* Update faq.rst
2020-10-31 11:05:45 -07:00
Alex Gaynor
e06e5c6767
tense (#5538) 2020-10-31 11:05:21 -07:00
Alex Gaynor
851acb5ab4
Rephrase abi3 FAQ so it stays accurate (#5534) 2020-10-30 09:55:40 -07:00
Alex Gaynor
2ce289fdae
Update installation docs for 3.5 drop (#5531) 2020-10-28 22:01:37 -07:00
Thomas Grainger
6c43bbce9a
fix Python 2 CryptographyDeprecationWarning guide (#5529) 2020-10-28 14:02:17 -04:00
Alex Gaynor
d9e174d3e1
Drop python 3.5 (#5527) 2020-10-28 07:38:42 -07:00
Alex Gaynor
d3eae8d7db
Delete all the 1.0.2 code (#5511) 2020-10-25 22:41:40 -07:00
Alex Gaynor
58494b41d6
Attempt to mitigate Bleichenbacher attacks on RSA decryption (#5507) 2020-10-25 18:16:42 -07:00
frennkie
611c4a340f
PKCS7SignatureBuilder now supports new option NoCerts when signing (#5500) 2020-10-25 07:50:18 -07:00
Paul Kehrer
085d1e44c6
allow additional certificates to be added to a pkcs7 (#5498)
* allow additional certificates to be added to a pkcs7

* be more verbose about what these additional certs might be used for

* missing test
2020-10-25 09:11:48 -04:00
Paul Kehrer
95c4f68c1b
PKCS7SignatureBuilder now supports three serializations (#5497)
* PKCS7SignatureBuilder now supports three serializations

PEM, DER, and SMIME. SMIME embeds the S/MIME headers and has the
detached signature concept.

* thanks libre
2020-10-24 21:17:06 -04:00
Paul Kehrer
5edf5b828a
migrate smime builder to pkcs7 module and rename (#5496)
* migrate smime builder to pkcs7 module and rename

* missed a rename
2020-10-24 20:10:25 -04:00
Alex Gaynor
0b35c5d701
Remove bindings docs (#5469) 2020-09-20 16:49:09 -05:00
Paul Kehrer
20c0388086
smime signer support (#5465)
* smime signer support

* fix ed25519 check

* change some wording

* python 2.7...

* review feedback

* s/secure/signed

* do some verification in the tests

* review feedback

* doc return value
2020-09-19 19:07:26 -04:00
Paul Kehrer
00ba159220
add RSA 4096-bit self-signed CA for some upcoming tests (#5464) 2020-09-14 19:40:05 -04:00
Paul Kehrer
1a9e2e1ad7
allow bytes-like for padding (#5462)
this doesn't improve efficiency in any way (copies galore!), but it does
make it consistent between a cipher context and a padding context
2020-09-13 20:04:18 -04:00
Alex Gaynor
bfe7b455c5
Account for Bruce redoing his website or something (#5461) 2020-09-13 19:03:36 -05:00
Alex Gaynor
3367c18bf2
Be clear that a lack of authentication often means you don't have secrecy (#5454) 2020-09-05 10:46:34 -05:00
Alex Gaynor
63dfc57fca
fixed verify script that couldn't have ever worked (#5443) 2020-08-29 09:39:31 -05:00
Paul Kehrer
31a5da73f8
update docs to not use backends (#5404) 2020-08-29 09:28:32 -04:00
Alex Gaynor
8bc6920444
Break users on OpenSSL 1.0.2 (#5438)
fixes #5432
2020-08-28 09:55:41 -05:00
Paul Kehrer
b9d26d2608
add some words about separating ECDH and ECDSA (#5423)
* add some words about separating ECDH and ECDSA

* Thomas Pornin wrote some good words about why you should try not to mix
your ECDH and ECDSA keys.
2020-08-24 14:01:45 -04:00
Paul Kehrer
b2c5ac8919
Docs testing (#5413)
* document we test on aarch64

even odds this angers the spellchecker

* Just as my previous commit msg prophesied

* Update docs/spelling_wordlist.txt

Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>

Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>
2020-08-16 21:10:47 -04:00
Paul Kehrer
872835ea0d
update submitting patches docs to be a bit more true (#5407)
For now best practice is that they should be optional.
2020-08-16 15:23:02 -04:00
Paul Kehrer
0fa77f1530
HOTP and TOTP should also have optional backends (#5402) 2020-08-15 16:34:59 -04:00
Paul Kehrer
e52b861d75
add changelog and update backend docs for optional change (#5401) 2020-08-15 16:16:50 -04:00