- Move _build_ffi.py to scripts/build_ffi.py. Do as little in the global
namespace of the script as possible by putting functionality into functions,
including a new main function.
- Improve feature detection by allowing user_settings.h in addition to
options.h. This is particularly useful on Windows.
- Add the windows directory. This contains subdirectories non_fips and
fips_ready, which each have a user_settings.h. The non_fips user_settings.h is
used by the build script to build on Windows with CMake, when not using
USE_LOCAL_WOLFSSL. The fips_ready user_settings.h is an example user_settings.h
that works with our FIPS Ready code and wolfcrypt-py.
- Improve Windows support. This commit modifies the way we build wolfSSL for
wolfcrypt-py on Windows. Instead of using CMake directly, we use it with
user_settings.h. This is typically how Windows users are building wolfSSL, and
it gets around some shortcoming of wolfSSL's CMake support (e.g. not all
required features are supported). Additionally, USE_LOCAL_WOLFSSL now works
properly on Windows. When using USE_LOCAL_WOLFSSL, it should point to a wolfSSL
source code directory. This works for FIPS bundles, too. Finally, for FIPS on
Windows, we only support DLL builds. The CFFI library (.pyd extension) requires
this DLL to work. build_ffi.py detects this scenario and copies the .dll into
the wolfcrypt package directory. I've modified setup.py to distribute the
.dll with the package.
- Add some missing FIPS gates. Testing against FIPS v2 triggered some errors.
Those are fixed in this commit.
- sign_pss and verify_pss need to digest the data before calling into their
respective wolfCrypt functions. Those wolfCrypt functions expect digests, not
plaintext.
- RsaPrivate make_key should take an optional hash_type parameter for the case
where the key will be used to create PSS signatures.
- test_rsa_pss_sign_verify appears to have been deliberately coded to have the
input plaintext length line up with the digest size, which masked the problem
where we weren't digesting the plaintext. I modified the plaintext so that this
is no longer the case.
Makes things a little bit more like similar APIs.
* Hash type is now set in constructor.
* MGF is set automtically or manually with `set_mgf()`
* Label defaults to empty
Some bad assumptions were made during the creation of our Python AES GCM
code. This is now modified to be more in-line with other libraries. This
is an API breaking change on unreleased code.
This now allows for aad data to be used, varying length of
authentication tags and fixes a bug for multipart.
1. Now unified to a single class AesGcmStream()
2. Used `encrypt()` and `decrypt()` instead of `update()` to avoid
confusion over encryption and aad semantics
3. final tag_bytes is configurable in the constructor
4. `set_aad()` added to add the aad data
5. aad data is cleared after first `encrypt()` or `decrypt()` call due
to quirk in the C API.
6. More tests added
* Fix some path and compiler things for Windows
* Move source code to align better with Python standards
* Have setup.py build wolfSSL and FFI
* Update Python versions in tox
* Add CMake building for Windows build
* Add missing __init__.py for tox
* Make wolfSSL a git submodule
Koji Takeda
Jack Tjaden
Eric Blankenhorn
Hayden Roche
Hayden Roche
Andrew Hutchings
Daniele Lacamera
Moisés Guimarães