Arthur de Jong

Open Source / Free Software developer

summaryrefslogtreecommitdiffstats
path: root/pskc
Commit message (Collapse)AuthorAgeFilesLines
* Get files ready for 0.5 release0.5Arthur de Jong2017-01-211-2/+2
|
* Support legacy ActivIdentity filesArthur de Jong2017-01-151-12/+33
| | | | | | This adds support for parsing ActivIdentity files that conform to a very old version of an Internet Draft. The implementation and test were based on a file provided by Jaap Ruijgrok.
* Use original examples from old profiles Internet DraftArthur de Jong2017-01-111-4/+18
| | | | | | | | | | | | | This updates the tests to use the original examples from draft-hoyer-keyprov-pskc-algorithm-profiles-01 instead of modifying them to fit the RFC 6030 schema (but does include some minor changes to make them valid XML). This adds a few additions to the parser to handle legacy challenge and resposne encoding and a few key policy properties. This also includes a fix for 0b757ec in the handling of the <ChallengeFormat> element under a <Usage> element.
* Add support for older Internet Draft versionArthur de Jong2016-12-212-35/+52
| | | | | | | | | | | | | | This adds support for parsing most examples from draft-ietf-keyprov-pskc-02. That file uses a few other names for elements and attributes of the PSKC file and a few other minor differences. The XML parsing has been changed to allow specifying multiple matches and the find*() functions now return the first found match. While all examples from draft-ietf-keyprov-pskc-02 are tested support for verifying digital signatures and asymmetric keys have not yet been implemented.
* Allow MAC over plaintext or ciphertextArthur de Jong2016-12-202-27/+13
| | | | | | | | | | | | | | | | | | RFC 6030 implies that the MAC should be performed over the ciphertext but some earlier drafts implied that the MAC should be performed on the plaintext. This change accpets the MAC if either the plaintext or ciphertext match. Note that this change allows for a padding oracle attack when CBC encryption modes are used because decryption (and unpadding) needs to be done before MAC checking. However, this module is not expected to be available to users to process arbitrary PSKC files repeatedly. This removes the tests for a missing MAC key (and replaces it for tests of missing EncryptionMethod) because falling back to using the encryption key (implemented in a444f78) in combination with this change means that decryption is performed before MAC checking and is no longer possible to trigger a missing MAC key error.
* Add sanity checks to unpaddingArthur de Jong2016-12-202-4/+10
|
* Ensure XML file ends with a newlineArthur de Jong2016-12-201-1/+1
|
* Adapt coverage pragma annotationsArthur de Jong2016-12-201-2/+2
| | | | | This fixes the pragma directives to be be correct independently of whether lxml is installed or not.
* Support missing or lowercase version attributeArthur de Jong2016-12-181-2/+2
|
* Also move outer writing and parsing to modulesArthur de Jong2016-09-243-17/+23
|
* Add writing example to toplevel documentationArthur de Jong2016-09-241-0/+9
|
* Use custom data descriptors for key propertiesArthur de Jong2016-09-171-24/+25
| | | | | This uses a custom data descriptor (property) for secret, counter, time_offset, time_interval and time_drift.
* Support separate device from keyArthur de Jong2016-09-176-85/+184
| | | | | | | | This allows having multiple keys per device while also maintaining the previous API. Note that having multiple keys per device is not allowed by the RFC 6030 schema but is allowed by some older internet drafts.
* Move XML generation to own moduleArthur de Jong2016-09-176-183/+216
| | | | | Similar to the change for parsing, move the XML serialisation of PSKC data to a single class in a separate module.
* Move document parsing to own moduleArthur de Jong2016-09-176-204/+229
| | | | | | This moves all the parse() functions to a single class in a dedicated module that can be used for parsing PSKC files. This should make it easier to subclass the parser.
* Improve branch coverageArthur de Jong2016-09-143-5/+11
| | | | This enables branch coverage testing and adds tests to improve coverage.
* Support specifying PRF in setup_pbkdf2()Arthur de Jong2016-09-111-1/+4
| | | | This also ensures that the PRF URL is normalised.
* Fix bug in passing explicit key to setup_preshared_key()Arthur de Jong2016-09-111-2/+2
|
* Clarify encryption.setup_*() documentationArthur de Jong2016-09-111-2/+2
| | | | | | This tries to make it clearer that the setup_preshared_key() and setup_pbkdf2() functions are meant to be used when writing out PSKC files.
* Fall back to encryption key for MACArthur de Jong2016-04-232-1/+5
| | | | | | This uses the encryption key also as MAC key if no MAC key has been specified in the PSKC file. Earlier versions of the PSKC draft specified this behaviour.
* Allow global specification of IVArthur de Jong2016-04-231-9/+13
| | | | | | In older versions of the PSKC standard it was allowed to have a global initialization vector for CBC based encryption algorithms. It is probably not a good idea to re-use an IV in general.
* Move crypto to functionsArthur de Jong2016-04-232-93/+108
| | | | | This makes it much easier to test the encryption, decryption and HMAC processing separate from the PSKC parsing.
* Remove parse call from constructorsArthur de Jong2016-04-054-12/+7
| | | | This makes the creation if internal instances a litte more consistent.
* Move algorithm uri handling to separate moduleArthur de Jong2016-04-053-51/+75
|
* Move padding functions to crypto packageArthur de Jong2016-04-052-11/+36
|
* Get files ready for 0.4 release0.4Arthur de Jong2016-03-281-1/+1
|
* Document writing encrypted filesArthur de Jong2016-03-271-2/+2
|
* Allow configuring a pre-shared keyArthur de Jong2016-03-261-13/+38
| | | | | | | This method allows configuring a pre-shared encryption key and will chose reasonable defaults for needed encryption values (e.g. it will choose an algorithm, generate a new key of the appropriate length if needed, etc.).
* Allow configuring PBKDF2 key derivationArthur de Jong2016-03-261-12/+69
| | | | | This factors out the PBKDF2 key derivation to a separate function and introduces a function to configure KeyDerivation instances with PBKDF2.
* Allow configuring a MAC keyArthur de Jong2016-03-261-0/+33
| | | | | This method will set up a MAC key and algorithm as specified or use reasonable defauts.
* Generate MAC valuesArthur de Jong2016-03-262-13/+30
|
* Write MACMethodArthur de Jong2016-03-263-3/+52
| | | | | | This also makes the MAC.algorithm a property similarly as what is done for Encryption (normalise algorithm names) and adds a setter for the MAC.key property.
* Write out encrypted valuesArthur de Jong2016-03-262-11/+88
| | | | | | | | | The Encryption class now has a fields property that lists the fields that should be encrypted when writing the PSKC file. This adds an encrypt_value() function that performs the encryption and various functions to convert the plain value to binary before writing the encrypted XML elements.
* Make Encryption and MAC constructors consistentArthur de Jong2016-03-263-6/+4
| | | | | | This removes calling parse() from the Encryption and MAC constructors and stores a reference to the PSKC object in both objects so it can be used later on.
* Write encryption key informationArthur de Jong2016-03-262-3/+36
| | | | | | This writes information about a pre-shared key or PBKDF2 key derivation in the PSKC file. This also means that writing a decrypted version of a previously encrypted file requires actively removing the encryption.
* Add algorithm_key_lengths propertyArthur de Jong2016-03-261-16/+26
| | | | | This property on the Encryption object provides a list of key sizes (in bytes) that the configured encryption algorithm supports.
* Also check key expiry in may_use()Arthur de Jong2016-03-231-2/+24
|
* Copy namespaces to toplevel elementArthur de Jong2016-03-201-0/+11
| | | | | | Ensure that when writing an XML file all namespace definitions are on the toplevel KeyContainer element instead of scattered throughout the XML document.
* Support writing to text streams in Python 3Arthur de Jong2016-03-191-1/+6
| | | | | This supports writing the XML output to binary streams as well as text streams in Python 3.
* Improve tests and test coverageArthur de Jong2016-03-192-6/+4
| | | | | | | | | | This adds tests to ensure that incorrect attribute and value types in the PSKC file raise a ValueError exception and extends the tests for invalid encryption options. This removes some code or adds no cover directives to a few places that have unreachable code or are Python version specific and places doctest directives inside the doctests where needed.
* Support both CheckDigit and CheckDigitsArthur de Jong2016-03-192-4/+15
| | | | | | RFC 6030 is not clear about whether the attribute of ChallengeFormat and ResponseFormat should be the singular CheckDigit or the plural CheckDigits. This ensures that both forms are accepted.
* Implement policy checkingArthur de Jong2016-03-191-7/+17
| | | | | This checks for unknown policy elements in the PSKC file and will cause the key usage policy check to fail.
* Support various integer representationsArthur de Jong2016-03-191-3/+14
| | | | | | | | | | | | | | | | | | | This extends support for handling various encoding methods for integer values in PSKC files. For encrypted files the decrypted value is first tried to be evaluated as an ASCII representation of the number and after that big-endian decoded. For plaintext values first ASCII decoding is tried after which base64 decoding is tried which tries the same encodings as for decrypted values. There should be no possibility for any base64 encoded value (either of an ASCII value or a big-endian value) to be interpreted as an ASCII value for any 32-bit integer. There is a possibility that a big-endian encoded integer could be incorrectly interpreted as an ASCII value but this is only the case for 110 numbers when only considering 6-digit numbers.
* Re-organise test filesArthur de Jong2016-01-301-1/+1
| | | | | This puts the test PSKC files in subdirectories so they can be organised more cleanly.
* Refactor out EncryptedValue and ValueMACArthur de Jong2016-01-243-155/+135
| | | | | | | | | This removes the EncryptedValue and ValueMAC classes and instead moves the XML parsing of these values to the DataType class. This will make it easier to support different parsing schemes. This also includes a small consistency improvement in the subclasses of DataType.
* Normalise algorithm namesArthur de Jong2016-01-241-2/+45
| | | | | This transforms the algorithm URIs that are set to known values when parsing or setting the algorithm.
* Add encryption algorithm propertyArthur de Jong2016-01-241-0/+23
| | | | | | Either determine the encryption algorithm from the PSKC file or from the explicitly set value. This also adds support for setting the encryption key name.
* Fix a problem when writing previously encrypted fileArthur de Jong2016-01-241-1/+1
| | | | | This fixes a problem with writing a PSKC file that is based on a read file that was encrypted.
* Strip XML namespaces before parsingArthur de Jong2016-01-246-85/+79
| | | | | | | | | This simplifies calls to the find() family of functions and allows parsing PSKC files that have slightly different namespace URLs. This is especially common when parsing old draft versions of the specification. This also removes passing multiple patterns to the find() functions that was introduced in 68b20e2.
* Make value conversion methods static privateMathias Laurin2015-11-301-11/+20
| | | | | - the conversions do not call self: they are static - the conversions are not to be used out of the class: make private