- Detect ECC timing resistance and call wc_ecc_set_rng where appropriate.
- Detect FIPS version and use that information to figure out how to map hash
enum values (see _TYPE_SHA and friends).
- Don't call wc_HmacSetKey in the _Hmac constructor if the key passed to _init
is length 0. This can happen, for example, when the _Hmac object is being
copied. The copy operation copies over the raw memory from the underlying C
object, so it's not important that we call wc_HmacSetKey in this case.
- Removed a unit test that expected importing an ECC public key from a private
key to fail. This does fail in the default wolfSSL version for wolfcrypt-py,
v4.1.0-stable, but we added the feature to be able to import public from
private with wolfSSL PR #2916. As a result, this test fails with v4.8.1-stable.
We should upgrade wolfcrypt-py's default wolfSSL version (and the wolfcrypt-py
version itself) in the near future.
- The array slicing in test_key_encoding was wrong in many places. This likely
stemmed from the author thinking slices were inclusive, but that's only true
for the first element of the slice (e.g. [0:31] is elements 0-30 inclusive, not
elements 0-31 inclusive). This was uncovered by testing with FIPS ready, which
adds -DWOLFSSL_VALIDATE_ECC_IMPORT, causing us to check ECC keys with
wc_ecc_check_key. wc_ecc_check_key kept saying, "hey, that point's not on the
curve." The array slicing problem was the culprit.
- Fixed tests that were doing HMAC with a key less than HMAC_FIPS_MIN_KEY.
- Refactor the feature detection section of _build_ffi.py to be more Pythonic.
- Add detection of FIPS and RSA blinding. Don't enable RSA blinding if FIPS is
enabled. Full-fledged FIPS checks for other features are not included; this just
helps with RSA blinding, for now. Use this to determine if wc_RsaSetRNG is
available.
- Change the various *_ENABLED variables to have extern, since they're
declared in a header and initialized in a source file.
- Add a missing include of pwdbased.h to provide the declaration of wc_PBKDF2.
1. Update the travis script to follow their multi-OS example.
2. Set the path to Python in the osx bulid wheels script.
3. For osx, removed all versions of python except 2.7, 3.7,
and 3.8.
1. Use the same docker image as the wolfSSL python project.
2. Remove the absolute path to the python interpreter. They just need to
be in the path. (For example, you might install old versions in /opt and
add their subdirs to the path while the latest runs out of its location.)
3. Build the name of python, pip, and venv_ based on the version.
Hayden Roche
Daniele Lacamera
Chris Conlon
Hayden Roche
John Safranek
David Garske
Daniele Lacamera