Arthur de Jong

Open Source / Free Software developer

summaryrefslogtreecommitdiffstats
path: root/tests/test_encryption.doctest
Commit message (Collapse)AuthorAgeFilesLines
* Increase default PBKDF2 iterations to 100000Arthur de Jong2018-03-111-1/+1
|
* Implement removing encryptionArthur de Jong2018-02-081-1/+22
| | | | | This adds a function to decrypt all values and remove the encryption of an encrypted PSKC file.
* Add support for KW-Camellia suite of algorithmsArthur de Jong2017-12-131-0/+30
|
* Add support for Camellia-CBC suite of algorithmsArthur de Jong2017-12-131-0/+33
|
* Replace pycrypto with cryptographyArthur de Jong2017-10-091-1/+6
| | | | | | | | | The cryptography library is better supported. This uses the functions from cryptography for AES and Triple DES encryption, replaces the (un)padding functions that were previously implemented in python-pskc with cryptography and uses PBKDF2 implementation from hashlib.
* Fix typo in testArthur de Jong2016-12-201-4/+4
|
* Allow MAC over plaintext or ciphertextArthur de Jong2016-12-201-0/+9
| | | | | | | | | | | | | | | | | | RFC 6030 implies that the MAC should be performed over the ciphertext but some earlier drafts implied that the MAC should be performed on the plaintext. This change accpets the MAC if either the plaintext or ciphertext match. Note that this change allows for a padding oracle attack when CBC encryption modes are used because decryption (and unpadding) needs to be done before MAC checking. However, this module is not expected to be available to users to process arbitrary PSKC files repeatedly. This removes the tests for a missing MAC key (and replaces it for tests of missing EncryptionMethod) because falling back to using the encryption key (implemented in a444f78) in combination with this change means that decryption is performed before MAC checking and is no longer possible to trigger a missing MAC key error.
* Improve branch coverageArthur de Jong2016-09-141-1/+20
| | | | This enables branch coverage testing and adds tests to improve coverage.
* Support specifying PRF in setup_pbkdf2()Arthur de Jong2016-09-111-2/+6
| | | | This also ensures that the PRF URL is normalised.
* Fall back to encryption key for MACArthur de Jong2016-04-231-0/+11
| | | | | | This uses the encryption key also as MAC key if no MAC key has been specified in the PSKC file. Earlier versions of the PSKC draft specified this behaviour.
* Allow global specification of IVArthur de Jong2016-04-231-0/+11
| | | | | | In older versions of the PSKC standard it was allowed to have a global initialization vector for CBC based encryption algorithms. It is probably not a good idea to re-use an IV in general.
* Allow configuring PBKDF2 key derivationArthur de Jong2016-03-261-0/+58
| | | | | This factors out the PBKDF2 key derivation to a separate function and introduces a function to configure KeyDerivation instances with PBKDF2.
* Allow configuring a MAC keyArthur de Jong2016-03-261-0/+27
| | | | | This method will set up a MAC key and algorithm as specified or use reasonable defauts.
* Improve tests and test coverageArthur de Jong2016-03-191-5/+7
| | | | | | | | | | This adds tests to ensure that incorrect attribute and value types in the PSKC file raise a ValueError exception and extends the tests for invalid encryption options. This removes some code or adds no cover directives to a few places that have unreachable code or are Python version specific and places doctest directives inside the doctests where needed.
* Re-organise test filesArthur de Jong2016-01-301-8/+8
| | | | | This puts the test PSKC files in subdirectories so they can be organised more cleanly.
* Add encryption algorithm propertyArthur de Jong2016-01-241-1/+5
| | | | | | Either determine the encryption algorithm from the PSKC file or from the explicitly set value. This also adds support for setting the encryption key name.
* Support Python 3Arthur de Jong2015-10-061-26/+33
| | | | | | | | This enables support for Python 3 together with Python 2 support with a single codebase. On Python 3 key data is passed around as bytestrings which makes the doctests a little harder to maintain across Python versions.
* Add MAC tests to all CBC encrypted keysArthur de Jong2014-06-141-0/+16
| | | | | This adds hmac-sha224, hmac-sha256, hmac-sha384 and hmac-sha512 tests for values that are encrypted using CBC block cypher modes.
* Support kw-tripledes decryptionArthur de Jong2014-05-311-0/+11
| | | | | This adds support for key unwrapping using the RFC 3217 Triple DES key wrap algorithm if the PSKC file uses this.
* Support kw-aes128, kw-aes192 and kw-aes256Arthur de Jong2014-05-301-0/+28
| | | | | This adds support for key unwrapping using the RFC 3394 or RFC 5649 algorithm if the PSKC file uses this.
* Support Tripple DES decryptionArthur de Jong2014-05-291-0/+11
|
* Add test for all AES-CBC encryption schemesArthur de Jong2014-05-291-0/+44