Arthur de Jong

Open Source / Free Software developer

summaryrefslogtreecommitdiffstats
path: root/pskc/encryption.py
Commit message (Collapse)AuthorAgeFilesLines
* Increase default PBKDF2 iterations to 100000Arthur de Jong2018-03-111-1/+1
|
* Add and cleanup docstringsArthur de Jong2018-02-151-0/+2
| | | | | | | | This adds docstrings to public methods and cleans up a few other docstrings to pass most flake8 docstring related tests. This also adds noqa statements in a few places so we can remove most entries from the global flake8 ignore list.
* Correctly write a PSKC file with a global IVArthur de Jong2018-02-091-1/+4
| | | | | | | This ensures that the encryption IV, which should be per encrypted value is written out per encrypted value instead of globally. This is mostly useful for when reading an old format PSKC file and writing out a RFC 6030 compliant one.
* Implement removing encryptionArthur de Jong2018-02-081-1/+27
| | | | | This adds a function to decrypt all values and remove the encryption of an encrypted PSKC file.
* Fix code style issuesArthur de Jong2018-02-081-1/+1
| | | | Fixes 1ff3237f, 84bfb8a6 and 20bf9c5
* Add an is_encrypted propertyArthur de Jong2017-12-271-0/+12
| | | | | | This property can be use to see whether the PSKC file needs an additional pre-shared key or passphrase to decrypt any stored information.
* Add support for KW-Camellia suite of algorithmsArthur de Jong2017-12-131-2/+16
|
* Add support for Camellia-CBC suite of algorithmsArthur de Jong2017-12-131-2/+14
|
* Replace pycrypto with cryptographyArthur de Jong2017-10-091-24/+43
| | | | | | | | | The cryptography library is better supported. This uses the functions from cryptography for AES and Triple DES encryption, replaces the (un)padding functions that were previously implemented in python-pskc with cryptography and uses PBKDF2 implementation from hashlib.
* Use PBKDF2 from hashlibArthur de Jong2017-10-091-9/+18
| | | | | | This uses pbkdf2_hmac() from hashlib for the PBKDF2 calculation. The downside of this is that this function is only available since Python 2.7.8.
* Replace use of pycrypto utility functionsArthur de Jong2017-10-011-11/+9
| | | | | | This uses os.urandom() as a source for random data and replaces other utility functions. This also removes one import for getting the lengths of Tripple DES keys.
* Various minor code style improvementsArthur de Jong2017-06-101-2/+2
|
* Normalise key derivation algorithmsArthur de Jong2017-06-101-5/+26
| | | | | This makes KeyDerivation.algorithm and KeyDerivation.pbkdf2_prf properties automatically normalise assigned values.
* Refactor MAC lookupsArthur de Jong2017-06-091-11/+11
| | | | | | | | This switches to using the hashlib.new() function to be able to use all hashes that are available in Python (specifically RIPEMD160). This also adds a number of tests for HMACs using test vectors from RFC 2202, RFC 4231 and RFC 2857.
* Add sanity checks to unpaddingArthur de Jong2016-12-201-2/+2
|
* Move XML generation to own moduleArthur de Jong2016-09-171-34/+0
| | | | | Similar to the change for parsing, move the XML serialisation of PSKC data to a single class in a separate module.
* Move document parsing to own moduleArthur de Jong2016-09-171-34/+0
| | | | | | This moves all the parse() functions to a single class in a dedicated module that can be used for parsing PSKC files. This should make it easier to subclass the parser.
* Improve branch coverageArthur de Jong2016-09-141-3/+8
| | | | This enables branch coverage testing and adds tests to improve coverage.
* Support specifying PRF in setup_pbkdf2()Arthur de Jong2016-09-111-1/+4
| | | | This also ensures that the PRF URL is normalised.
* Fix bug in passing explicit key to setup_preshared_key()Arthur de Jong2016-09-111-2/+2
|
* Clarify encryption.setup_*() documentationArthur de Jong2016-09-111-2/+2
| | | | | | This tries to make it clearer that the setup_preshared_key() and setup_pbkdf2() functions are meant to be used when writing out PSKC files.
* Allow global specification of IVArthur de Jong2016-04-231-9/+13
| | | | | | In older versions of the PSKC standard it was allowed to have a global initialization vector for CBC based encryption algorithms. It is probably not a good idea to re-use an IV in general.
* Move crypto to functionsArthur de Jong2016-04-231-84/+95
| | | | | This makes it much easier to test the encryption, decryption and HMAC processing separate from the PSKC parsing.
* Remove parse call from constructorsArthur de Jong2016-04-051-2/+1
| | | | This makes the creation if internal instances a litte more consistent.
* Move algorithm uri handling to separate moduleArthur de Jong2016-04-051-50/+2
|
* Move padding functions to crypto packageArthur de Jong2016-04-051-11/+4
|
* Allow configuring a pre-shared keyArthur de Jong2016-03-261-13/+38
| | | | | | | This method allows configuring a pre-shared encryption key and will chose reasonable defaults for needed encryption values (e.g. it will choose an algorithm, generate a new key of the appropriate length if needed, etc.).
* Allow configuring PBKDF2 key derivationArthur de Jong2016-03-261-12/+69
| | | | | This factors out the PBKDF2 key derivation to a separate function and introduces a function to configure KeyDerivation instances with PBKDF2.
* Write MACMethodArthur de Jong2016-03-261-1/+8
| | | | | | This also makes the MAC.algorithm a property similarly as what is done for Encryption (normalise algorithm names) and adds a setter for the MAC.key property.
* Write out encrypted valuesArthur de Jong2016-03-261-0/+43
| | | | | | | | | The Encryption class now has a fields property that lists the fields that should be encrypted when writing the PSKC file. This adds an encrypt_value() function that performs the encryption and various functions to convert the plain value to binary before writing the encrypted XML elements.
* Make Encryption and MAC constructors consistentArthur de Jong2016-03-261-3/+2
| | | | | | This removes calling parse() from the Encryption and MAC constructors and stores a reference to the PSKC object in both objects so it can be used later on.
* Write encryption key informationArthur de Jong2016-03-261-3/+35
| | | | | | This writes information about a pre-shared key or PBKDF2 key derivation in the PSKC file. This also means that writing a decrypted version of a previously encrypted file requires actively removing the encryption.
* Add algorithm_key_lengths propertyArthur de Jong2016-03-261-16/+26
| | | | | This property on the Encryption object provides a list of key sizes (in bytes) that the configured encryption algorithm supports.
* Refactor out EncryptedValue and ValueMACArthur de Jong2016-01-241-85/+48
| | | | | | | | | This removes the EncryptedValue and ValueMAC classes and instead moves the XML parsing of these values to the DataType class. This will make it easier to support different parsing schemes. This also includes a small consistency improvement in the subclasses of DataType.
* Normalise algorithm namesArthur de Jong2016-01-241-2/+45
| | | | | This transforms the algorithm URIs that are set to known values when parsing or setting the algorithm.
* Add encryption algorithm propertyArthur de Jong2016-01-241-0/+23
| | | | | | Either determine the encryption algorithm from the PSKC file or from the explicitly set value. This also adds support for setting the encryption key name.
* Strip XML namespaces before parsingArthur de Jong2016-01-241-16/+11
| | | | | | | | | This simplifies calls to the find() family of functions and allows parsing PSKC files that have slightly different namespace URLs. This is especially common when parsing old draft versions of the specification. This also removes passing multiple patterns to the find() functions that was introduced in 68b20e2.
* Fix typo in variable nameMathias Laurin2015-11-301-6/+6
|
* Support Python 3Arthur de Jong2015-10-061-1/+1
| | | | | | | | This enables support for Python 3 together with Python 2 support with a single codebase. On Python 3 key data is passed around as bytestrings which makes the doctests a little harder to maintain across Python versions.
* Fix issue with namespaced PBKDF2 parametersArthur de Jong2015-10-061-8/+10
| | | | | | | | | | | | The find() utility functions now allow specifying multiple paths to be searched where the first match is returned. This allows handling PSKC files where the PBKDF2 salt, iteration count, key length and PRF elements are prefixed with the xenc11 namespace. A test including such a PSKC file has been included. Thanks to Eric Plet for reporting this.
* Move encryption functions in pskc.crypto packageArthur de Jong2014-10-091-2/+2
| | | | | | This moves the encryption functions under the pskc.crypto package to more clearly separate it from the other code. Ideally this should be replaced by third-party library code.
* Rename pskc.parse to pskc.xmlArthur de Jong2014-10-091-3/+3
| | | | | | | This renames the parse module to xml to better reflect the purpose of the module and it's functions. This also introduces a parse() function that wraps etree.parse().
* PEP8 fixArthur de Jong2014-06-171-2/+2
|
* Support PBKDF2 PRF argumentArthur de Jong2014-06-151-5/+9
| | | | | Support specifying a pseudorandom function for PBKDF2 key derivation. It currently supports any HMAC that the MAC checking also supports.
* Handle missing MAC algorithm properlyArthur de Jong2014-06-141-1/+2
|
* Have parse module provide find() functionsArthur de Jong2014-06-141-30/+19
| | | | | | | | This changes the parse module functions to better match the ElementTree API and extends it with findint(), findtime() and findbin(). It also passes the namespaces to all calls that require it without duplicating this throughout the normal code.
* Use get() instead of attrib.get() (shorter)Arthur de Jong2014-06-141-4/+4
|
* Support kw-tripledes decryptionArthur de Jong2014-05-311-0/+6
| | | | | This adds support for key unwrapping using the RFC 3217 Triple DES key wrap algorithm if the PSKC file uses this.
* Support kw-aes128, kw-aes192 and kw-aes256Arthur de Jong2014-05-301-0/+9
| | | | | This adds support for key unwrapping using the RFC 3394 or RFC 5649 algorithm if the PSKC file uses this.
* Support Tripple DES decryptionArthur de Jong2014-05-291-0/+8
|