Convert between pyOpenSSL and cryptography objects #439

reaperhulk · 2016-03-11T14:43:29Z

I'm putting this up so people can comment on this, but it is obviously incomplete:

tests
handle case where a user might send a non-openssl cryptography object.
conversion routines for CRLs
docs (if someone else wants to take a stab at this I'd really appreciate it)

@hynek do we want this in 16.0?

hynek · 2016-03-11T14:45:56Z

Let’s bikeshed. :)

I’d be for PKey.from_cryptography_key() instead of repeating the target type name?

hynek · 2016-03-11T14:52:45Z

as for 16.0: if it’s ready by accident, sure why not. but we’re not gonna wait for it.

and please don’t stall 1.3 just to get this in :D

hynek · 2016-03-31T12:38:32Z

OK we should start moving on this. I’m reluctant to add a 16.1 milestone to it just yet because there might be a smaller release fixing some little warts.

codecov-io · 2016-06-04T18:03:14Z

Current coverage is 95.03% (diff: 99.12%)

Merging #439 into master will increase coverage by 4.61%

@@             master       #439   diff @@
==========================================
  Files             7         16      +9   
  Lines          2067       5641   +3574   
  Methods           0          0           
  Messages          0          0           
  Branches        343        412     +69   
==========================================
+ Hits           1869       5361   +3492   
- Misses          107        198     +91   
+ Partials         91         82      -9

Powered by Codecov. Last update add5b07...da01178

hynek · 2016-06-05T00:06:11Z

Do these docs make sense?

hynek · 2016-07-01T12:26:24Z

Oh gee, I thought we merged this at the sprints.

reaperhulk · 2016-07-01T16:31:08Z

Looks like I need to rebase it?

hynek · 2016-07-02T11:32:51Z

I think I was waiting for a review of the docs? But I’m not sure anymore. :|

reaperhulk · 2016-07-02T15:29:36Z

I'm okay with the docs. In cryptography we mostly refer to our keys as instances of a type rather than interfaces, but it's not a big deal.

hynek · 2016-07-03T07:27:23Z

I’d like to do it right so we can refer people to it that want to add bindings.

The reason I've used “interfaces” is that it says “interfaces” in the docs https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/#key-interfaces ?

Summoning @alex for more opinions. :)

alex · 2016-07-04T04:01:21Z

RSAPrivateKey is an interface, openssl._RSAPrivateKey() is an instance of RSAPrivateKey. We never say that openssl._RSAPrivateKey() is a provider os RSAPrivateKey though.

hth

hynek · 2016-07-04T04:12:33Z

Hm I guess when we talk about types (:type: / :rtype:), interfaces seems the better term.

Last open question is the second checkbox: do we want to perform type checks?

Lukasa · 2016-07-19T12:01:54Z

Is there any intention of extending this to map between PyOpenSSL's X509 object and Cryptography's?

alex · 2016-07-19T12:21:27Z

Yes, we just needed to start somewhere.

On Tue, Jul 19, 2016 at 8:01 AM, Cory Benfield [email protected]
wrote:

Is there any intention of extending this to map between PyOpenSSL's X509
object and Cryptography's?

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
#439 (comment), or mute
the thread
https://github.com/notifications/unsubscribe-auth/AAADBIs60UUGF5hiajJWAYXvR2RlHDfcks5qXLyzgaJpZM4HuvDA
.

"I disapprove of what you say, but I will defend to the death your right to
say it." -- Evelyn Beatrice Hall (summarizing Voltaire)
"The people's good is the highest law." -- Cicero
GPG Key fingerprint: D1B3 ADC0 E023 8CA6

hynek · 2016-07-19T14:21:08Z

I would really like to land this but i’m not sure if it’s ready. It would be nice if someone could have a look and unblock us.

Lukasa · 2016-07-21T15:04:04Z

src/OpenSSL/crypto.py

+
+        .. versionadded:: 16.1.0
+        """
+        pkey = cls()


Is it worth policing this method to make sure the crypto key from cryptography isn't, say, an ECDSA key, or any other unsupported key type?

I have no opinion here. pyOpenSSL doesn't do much enforcement of this type, but we definitely do it in cryptography. I'll add it if you want, just let me know :)

I think we should do it: there'll be surprises if we don't.

Lukasa · 2016-07-21T15:04:52Z

I am mostly happy with this, though I have one question about whether we should police the type of keys we allow to be passed to the constructor. Otherwise, I am happy. =)

reaperhulk · 2016-07-29T06:52:02Z

@Lukasa type check added :)

Lukasa · 2016-07-29T07:31:02Z

\o/ Yay!

hynek · 2016-07-29T09:00:00Z

first shots fired 😱

* convert pkey to cryptography keys and vice versa * pep8 and such * Add documentation and changelog * add a type check and verify that it rejects ECDSA keys from cryptography

Add patch that makes tests on NetBSD progress further. But then there's a segfault. See pyca/pyopenssl#596 16.2.0 (2016-10-15) ------------------- Changes: ^^^^^^^^ - Fixed compatibility errors with OpenSSL 1.1.0. - Fixed an issue that caused failures with subinterpreters and embedded Pythons. `#552 <https://github.com/pyca/pyopenssl/pull/552>`_ 16.1.0 (2016-08-26) ------------------- Deprecations: ^^^^^^^^^^^^^ - Dropped support for OpenSSL 0.9.8. Changes: ^^^^^^^^ - Fix memory leak in ``OpenSSL.crypto.dump_privatekey()`` with ``FILETYPE_TEXT``. `#496 <https://github.com/pyca/pyopenssl/pull/496>`_ - Enable use of CRL (and more) in verify context. `#483 <https://github.com/pyca/pyopenssl/pull/483>`_ - ``OpenSSL.crypto.PKey`` can now be constructed from ``cryptography`` objects and also exported as such. `#439 <https://github.com/pyca/pyopenssl/pull/439>`_ - Support newer versions of ``cryptography`` which use opaque structs for OpenSSL 1.1.0 compatibility.

hynek mentioned this pull request Mar 17, 2016

Split sifting logic into separate function hynek/pem#20

Closed

hynek mentioned this pull request Mar 31, 2016

Load multiple certificates from one PEM file #462

Closed

reaperhulk force-pushed the cryptography-converter branch from ec66bcc to caa56a4 Compare June 4, 2016 18:03

reaperhulk force-pushed the cryptography-converter branch from 51bd110 to 31573fb Compare June 4, 2016 22:30

reaperhulk and others added 3 commits July 1, 2016 11:38

convert pkey to cryptography keys and vice versa

d183dcd

pep8 and such

c0afc89

Add documentation and changelog

88d05f4

reaperhulk force-pushed the cryptography-converter branch from cdffb80 to 88d05f4 Compare July 1, 2016 16:39

Lukasa mentioned this pull request Jul 19, 2016

Remove extra dependencies for PyOpenSSL. urllib3/urllib3#930

Merged

Lukasa reviewed Jul 21, 2016
View reviewed changes

add a type check and verify that it rejects ECDSA keys from cryptography

3c818c6

Lukasa merged commit 72d968b into pyca:master Jul 29, 2016

reaperhulk deleted the cryptography-converter branch August 1, 2016 01:07

This was referenced Dec 19, 2016

Add support for Elliptic Curve Pkey #308

Closed

Add EC support #286

Closed

Add Elliptic Curve support to PKey #195

Closed

hynek mentioned this pull request Jan 30, 2017

Remove API duplication in pyca/pyopenssl and pyca/cryptography #267

Closed

github-actions bot locked as resolved and limited conversation to collaborators Aug 19, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Convert between pyOpenSSL and cryptography objects #439

Convert between pyOpenSSL and cryptography objects #439

reaperhulk commented Mar 11, 2016 •

edited

Loading

hynek commented Mar 11, 2016

hynek commented Mar 11, 2016

hynek commented Mar 31, 2016

codecov-io commented Jun 4, 2016 •

edited

Loading

hynek commented Jun 5, 2016

hynek commented Jul 1, 2016

reaperhulk commented Jul 1, 2016

hynek commented Jul 2, 2016

reaperhulk commented Jul 2, 2016

hynek commented Jul 3, 2016

alex commented Jul 4, 2016

hynek commented Jul 4, 2016

Lukasa commented Jul 19, 2016

alex commented Jul 19, 2016

hynek commented Jul 19, 2016

Lukasa Jul 21, 2016 •

edited

Loading

reaperhulk Jul 21, 2016

Lukasa Jul 21, 2016

Lukasa commented Jul 21, 2016

reaperhulk commented Jul 29, 2016

Lukasa commented Jul 29, 2016

hynek commented Jul 29, 2016

Convert between pyOpenSSL and cryptography objects #439

Convert between pyOpenSSL and cryptography objects #439

Conversation

reaperhulk commented Mar 11, 2016 • edited Loading

hynek commented Mar 11, 2016

hynek commented Mar 11, 2016

hynek commented Mar 31, 2016

codecov-io commented Jun 4, 2016 • edited Loading

Current coverage is 95.03% (diff: 99.12%)

hynek commented Jun 5, 2016

hynek commented Jul 1, 2016

reaperhulk commented Jul 1, 2016

hynek commented Jul 2, 2016

reaperhulk commented Jul 2, 2016

hynek commented Jul 3, 2016

alex commented Jul 4, 2016

hynek commented Jul 4, 2016

Lukasa commented Jul 19, 2016

alex commented Jul 19, 2016

hynek commented Jul 19, 2016

Lukasa Jul 21, 2016 • edited Loading

Choose a reason for hiding this comment

reaperhulk Jul 21, 2016

Choose a reason for hiding this comment

Lukasa Jul 21, 2016

Choose a reason for hiding this comment

Lukasa commented Jul 21, 2016

reaperhulk commented Jul 29, 2016

Lukasa commented Jul 29, 2016

hynek commented Jul 29, 2016

reaperhulk commented Mar 11, 2016 •

edited

Loading

codecov-io commented Jun 4, 2016 •

edited

Loading

Lukasa Jul 21, 2016 •

edited

Loading