forked from arthurdejong/python-pskc
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathChangeLog
1912 lines (1249 loc) · 66.5 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
2019-02-10 Arthur de Jong <[email protected]>
* [21323a0] .travis.yml, setup.py: Add Python 3.7 in Travis and
reduce build matrix
This runs the signxml flavour on all Python versions and only
runs all other flavours on Python 2.6 and 3.6.
2019-02-10 Arthur de Jong <[email protected]>
* [c2abbec] setup.cfg: Make the multi-line operator place explicit
Recent versions of flake8 changed the defaults of the errors
to ignore.
2018-07-30 Arthur de Jong <[email protected]>
* [5e93d32] pskc/crypto/aeskw.py: Ignore more flake8 messages
2018-05-21 Arthur de Jong <[email protected]>
* [f4b2559] docs/index.rst, docs/scripts.rst: Add links to script
documentation
2018-04-21 Arthur de Jong <[email protected]>
* [610f7cd] : Implement csv2pcks script
2018-04-19 Arthur de Jong <[email protected]>
* [7bbaac3] docs/csv2pskc.rst, pskc/scripts/csv2pskc.py,
tests/test_csv2pskc.doctest: Add --skip-columns option
This option can be used to skip a number of rows in the CSV file
before the key data is read. If the number of rows to skip is 0,
the column interpretation should be provided using the --columns
option.
2018-04-05 Arthur de Jong <[email protected]>
* [88002fc] docs/csv2pskc.rst, pskc/scripts/csv2pskc.py,
tests/test_csv2pskc.doctest: Add --set option
This option can be used to set key properties for all keys in
the PSKC file.
2018-04-05 Arthur de Jong <[email protected]>
* [e91e498] docs/csv2pskc.rst, pskc/scripts/csv2pskc.py,
tests/test_csv2pskc.doctest: Add --columns option
This option can be used to override the list of columns as found
in the first line of the CSV file or provide a mapping for values
found in the first line to PSKC properties.
2018-03-31 Arthur de Jong <[email protected]>
* [c652eee] csv2pskc.py, docs/conf.py, docs/csv2pskc.rst,
pskc/scripts/csv2pskc.py, setup.py, tests/test_csv2pskc.doctest:
Add a csv2pskc script for CSV to PSKC conversion
This script reads a CSV file and writes out a PSKC file with the
key information from the CSV file. The CSV file is expected to
have one row for each key and key property values in columns.
2018-04-02 Arthur de Jong <[email protected]>
* [ce96e69] pskc/scripts/__init__.py, pskc/scripts/pskc2csv.py,
pskc/scripts/pskc2pskc.py, pskc/scripts/util.py, pskc2csv.py,
pskc2pskc.py, setup.cfg, setup.py, tests/test_pskc2csv.doctest,
tests/test_pskc2pskc.doctest, tox.ini: Ship the script as part
of the pskc package
This also installs pskc2csv and pskc2pskc console script entry
points as part of the package installation.
2018-03-03 Arthur de Jong <[email protected]>
* [7a56eac] pskc/__init__.py, pskc/device.py,
tests/test_misc.doctest: Support setting key sub-properties
via add_key()
2018-03-11 Arthur de Jong <[email protected]>
* [e6f2dd4] pskc/encryption.py, tests/test_encryption.doctest,
tests/test_pskc2pskc.doctest, tests/test_write.doctest: Increase
default PBKDF2 iterations to 100000
2018-02-21 Arthur de Jong <[email protected]>
* [9026e1c] setup.cfg: Support building a universal wheel
2018-02-15 Arthur de Jong <[email protected]>
* [b3e7fe7] pskc/__init__.py, pskc/crypto/aeskw.py,
pskc/device.py, pskc/encryption.py, pskc/key.py, pskc/parser.py,
pskc/serialiser.py, pskc/signature.py, setup.cfg: Add and
cleanup docstrings
This adds docstrings to public methods and cleans up a few other
docstrings to pass most flake8 docstring related tests.
This also adds noqa statements in a few places so we can remove
most entries from the global flake8 ignore list.
2018-02-10 Arthur de Jong <[email protected]>
* [03ee35d] docs/conf.py, docs/pskc2pskc.rst, pskc2pskc.py,
setup.cfg, tests/test_pskc2pskc.doctest: Add a pskc2pskc script
for converting PSKC files
This script reads a PSKC file in any supported format and writes
out a RFC 6030 compliant version of the file, optionally with
the encryption removed or (re-)encrypting the file with a new key.
2018-02-08 Arthur de Jong <[email protected]>
* [924e1f3] pskc/serialiser.py, tests/test_write.doctest: Correctly
write a PSKC file without a MAC key
In some cases a PSKC file can be written with a MAC algorithm
but without a MAC key. This is possible when the MAC key is not
supplied (allowed in older PSKC versions) and a fallback to the
encryption key is done. If we have not yet decrypted the file
the MAC key is not yet available and so can't be included in
the written file.
2018-02-04 Arthur de Jong <[email protected]>
* [be2b49f] pskc/encryption.py, pskc/serialiser.py,
tests/test_write.doctest: Correctly write a PSKC file with a
global IV
This ensures that the encryption IV, which should be per encrypted
value is written out per encrypted value instead of globally. This
is mostly useful for when reading an old format PSKC file and
writing out a RFC 6030 compliant one.
2018-02-07 Arthur de Jong <[email protected]>
* [e60d7f3] pskc/mac.py, pskc/parser.py, pskc/serialiser.py:
Also use EncryptedValue for MAC key
This ensures that an encrypted MAC key is hanled in the same
way as normal encrypted data values.
This also ensures consistent fallback to the globally
configured encryption algorithm if no value has been set in
the EncryptedValue.
2018-01-31 Arthur de Jong <[email protected]>
* [8054c6e] pskc/serialiser.py: Always output a PSKC 1.0 format file
This ignores the value of the version attribute in the PSKC
object and always writes a PSKC 1.0 (RFC 6030) format file.
2018-01-31 Arthur de Jong <[email protected]>
* [97faa13] docs/encryption.rst, pskc/encryption.py,
tests/test_encryption.doctest, tests/test_write.doctest: Implement
removing encryption
This adds a function to decrypt all values and remove the
encryption of an encrypted PSKC file.
2018-02-08 Arthur de Jong <[email protected]>
* [2698657] .travis.yml: Add a Travis configuration file
2018-02-04 Arthur de Jong <[email protected]>
* [82fa3bd] pskc/encryption.py, pskc/serialiser.py, pskc2csv.py:
Fix code style issues
Fixes 1ff3237f, 84bfb8a6 and 20bf9c5
2017-12-29 Arthur de Jong <[email protected]>
* [2693495] tests/test_misc.doctest, tests/test_pskc2csv.doctest,
tox.ini: Fixes to test suite
This ensures that the tests also work without a TTY and work
regardless of the PYTHONWARNINGS and TZ environment variables
Fixes cd33833
2017-12-29 Arthur de Jong <[email protected]>
* [fe63c42] ChangeLog, MANIFEST.in, NEWS, pskc/__init__.py,
setup.py: Get files ready for 1.0 release
2017-12-29 Arthur de Jong <[email protected]>
* [2651e80] tests/test_write.doctest: Not all XML serialisers
write namespaces in same order
This ignores the namespace declarations in the generated XML
files because not all implementations on all environments write
these in the same order.
2017-12-29 Arthur de Jong <[email protected]>
* [44b1353] docs/conf.py, setup.cfg, tox.ini: Add Sphinx
documentation checks
This also slightly tunes the way Sphinx documentation is built.
2017-12-15 Arthur de Jong <[email protected]>
* [42be53b] pskc2csv.py, tox.ini: Add support for PyPy
2017-12-15 Arthur de Jong <[email protected]>
* [660ed65] setup.py, tox.ini: Add support for Python 3.7
2017-12-15 Arthur de Jong <[email protected]>
* [9cd97c9] README, setup.py: Use README as package long description
2017-12-15 Arthur de Jong <[email protected]>
* [20bf9c5] docs/encryption.rst, pskc/encryption.py, pskc2csv.py,
tests/test_rfc6030.doctest: Add an is_encrypted property
This property can be use to see whether the PSKC file needs an
additional pre-shared key or passphrase to decrypt any stored
information.
2017-12-27 Arthur de Jong <[email protected]>
* [c365a70] : Implement XML signature checking
2017-12-17 Arthur de Jong <[email protected]>
* [418f3dc] docs/encryption.rst, docs/index.rst, docs/mac.rst,
docs/signatures.rst, docs/usage.rst: Add documentation for signed
PSKC files
2017-12-23 Arthur de Jong <[email protected]>
* [a97ac46] pskc/parser.py, pskc/serialiser.py,
pskc/signature.py, pskc/xml.py, setup.py,
tests/certificate/README, tests/certificate/ca-certificate.pem,
tests/certificate/ca-key.pem, tests/certificate/certificate.pem,
tests/certificate/key.pem, tests/certificate/request.pem,
tests/certificate/ss-certificate.pem,
tests/rfc6030/figure9.pskcxml,
tests/test_draft_ietf_keyprov_pskc_02.doctest,
tests/test_rfc6030.doctest, tests/test_signature.doctest, tox.ini:
Implement signature checking
This adds support for creating and verifying embedded XML
signatures in PSKC files. This uses the third-party signxml
library for actual signing and verification.
The signxml library has a dependency on lxml and defusedxml
(and a few others) but all parts of python-pskc still work
correctly with our without lxml and/or defusedxml and signxml
is only required when working with embedded signatures.
This modifies the tox configuration to skip the signature
checks if singxml is not installed and to only require 100%
code coverage if the signature tests are done.
2017-12-15 Arthur de Jong <[email protected]>
* [c0bd21f] pskc/xml.py: Move namespace moving to own function
2017-09-22 Arthur de Jong <[email protected]>
* [ea503d6] pskc/__init__.py, pskc/parser.py, pskc/signature.py,
tests/test_draft_ietf_keyprov_pskc_02.doctest,
tests/test_rfc6030.doctest: Implement basic parsing of signature
properties
2017-12-23 Arthur de Jong <[email protected]>
* [fcc6cdb] pskc2csv.py: Explicitly close output file in pskc2csv
This ensures that the file descriptor is closed if we opened
the file. This is not a big problem for the script (because
the script exists anyway) but causes problems for the tests.
2017-12-18 Arthur de Jong <[email protected]>
* [052f5bc] docs/policy.rst, pskc/parser.py,
pskc/policy.py, pskc/serialiser.py, tests/test_misc.doctest,
tests/test_write.doctest: Fix typo in pin_max_failed_attempts
attribute
This makes the old name (pin_max_failed_attemtps) available as
a deprecated property.
2017-12-15 Arthur de Jong <[email protected]>
* [6f0ca70] pskc/parser.py,
tests/draft-hoyer-keyprov-portable-symmetric-key-container-00/non-encrypted.pskcxml,
tests/draft-hoyer-keyprov-portable-symmetric-key-container-00/password-encrypted.pskcxml,
tests/draft-hoyer-keyprov-portable-symmetric-key-container-01/non-encrypted.pskcxml,
tests/draft-hoyer-keyprov-portable-symmetric-key-container-01/password-encrypted.pskcxml,
tests/test_draft_hoyer_keyprov_portable_symmetric_key_container.doctest:
Add limited support for very old draft PSKC versions
This adds basic support for parsing the PSKC files as specified
in draft-hoyer-keyprov-portable-symmetric-key-container-00 and
draft-hoyer-keyprov-portable-symmetric-key-container-01.
It should be able to extract secrets, counters, etc. but not
all properties from the PSKC file are supported.
It is speculated that this format resembles the "Verisign PSKC
format" that some applications produce.
2016-09-19 Arthur de Jong <[email protected]>
* [9b85634] tests/multiotp/pskc-hotp-aes.txt,
tests/multiotp/pskc-hotp-pbe.txt, tests/multiotp/pskc-totp-aes.txt,
tests/multiotp/pskc-totp-pbe.txt,
tests/multiotp/tokens_hotp_aes.pskc,
tests/multiotp/tokens_hotp_pbe.pskc,
tests/multiotp/tokens_ocra_aes.pskc,
tests/multiotp/tokens_ocra_pbe.pskc,
tests/multiotp/tokens_totp_aes.pskc,
tests/multiotp/tokens_totp_pbe.pskc, tests/test_multiotp.doctest:
Add test files from multiOTP
This adds tests for parsing the files that are shipped as part
of the multiOTP test suite.
https://www.multiotp.net/
2017-12-15 Arthur de Jong <[email protected]>
* [01507af] pskc/key.py, pskc/parser.py, pskc/serialiser.py,
tests/misc/partialxml.pskcxml, tests/test_misc.doctest,
tests/test_write.doctest: Refactor internal storate of encrypted
values
This changes the way encrypted values are stored internally before
being decrypted. For example, the internal _secret property can now
be a decrypted plain value or an EncryptedValue instance instead
of always being a DataType, simplifying some things (e.g. all
XML encoding/decoding is now done in the corresponding module).
This should not change the public API but does have consequences
for those who use custom serialisers or parsers.
2017-12-13 Arthur de Jong <[email protected]>
* [dcf1919] pskc/crypto/aeskw.py, pskc/encryption.py,
tests/encryption/kw-camellia128.pskcxml,
tests/encryption/kw-camellia192.pskcxml,
tests/encryption/kw-camellia256.pskcxml,
tests/test_encryption.doctest: Add support for KW-Camellia suite
of algorithms
2017-12-13 Arthur de Jong <[email protected]>
* [364e93d] pskc/encryption.py,
tests/encryption/camellia128-cbc.pskcxml,
tests/encryption/camellia192-cbc.pskcxml,
tests/encryption/camellia256-cbc.pskcxml,
tests/test_encryption.doctest: Add support for Camellia-CBC
suite of algorithms
2017-10-11 Arthur de Jong <[email protected]>
* [4c5e046] docs/conf.py, docs/pskc2csv.rst, setup.cfg: Add a
manual page for pskc2csv
2017-10-09 Arthur de Jong <[email protected]>
* [25cb2fc] setup.cfg: Ignore missing docstring in __init__ in flake
2017-09-30 Arthur de Jong <[email protected]>
* [225e569] pskc/crypto/__init__.py, pskc/crypto/aeskw.py,
pskc/crypto/tripledeskw.py, pskc/encryption.py,
pskc/mac.py, setup.cfg, setup.py, tests/test_crypto.doctest,
tests/test_encryption.doctest, tox.ini: Replace pycrypto with
cryptography
The cryptography library is better supported.
This uses the functions from cryptography for AES and Triple
DES encryption, replaces the (un)padding functions that were
previously implemented in python-pskc with cryptography and uses
PBKDF2 implementation from hashlib.
2017-09-30 Arthur de Jong <[email protected]>
* [5dff7d4] pskc/encryption.py: Use PBKDF2 from hashlib
This uses pbkdf2_hmac() from hashlib for the PBKDF2 calculation.
The downside of this is that this function is only available
since Python 2.7.8.
2017-09-30 Arthur de Jong <[email protected]>
* [2c8a9b7] pskc/crypto/aeskw.py, pskc/crypto/tripledeskw.py,
pskc/encryption.py, pskc/mac.py, tests/test_aeskw.doctest,
tests/test_write.doctest: Replace use of pycrypto utility functions
This uses os.urandom() as a source for random data and replaces
other utility functions. This also removes one import for getting
the lengths of Tripple DES keys.
2017-09-24 Arthur de Jong <[email protected]>
* [d0eddf8] pskc/serialiser.py, pskc/xml.py,
tests/test_write.doctest: Implement our own XML formatting
This avoids a using xml.dom.minidom to indent the XML tree and
keep the attributes ordered alphabetically. This also allows
for customisations to the XML formatting.
2017-09-24 Arthur de Jong <[email protected]>
* [4ed4e11] tests/test_mac.doctest: Support hashlib from Python 2.7.3
Some Python versions don't have the algorithms_available property
but do have the algorithms property in hashlib.
2017-09-24 Arthur de Jong <[email protected]>
* [b90faeb] pskc/xml.py, setup.py, tox.ini: Use defusedxml if
available
This uses the defusedxml library if available to defend agains
a number of XML-based attacks.
2017-09-23 Arthur de Jong <[email protected]>
* [7272e54] pskc/serialiser.py, tests/test_write.doctest: Fix bug
in saving PBKDF2 salt on Python3
The PBKDF2 salt was saved in the wrong way (b'base64encodeddata'
instead of base64encodeddata) when using Python 3. This fixes
that problem and tests that saving and loading of a file that
uses PBKDF2 key derivation works.
2017-09-23 Arthur de Jong <[email protected]>
* [cd33833] pskc2csv.py, setup.cfg, tests/test_pskc2csv.doctest:
Add tests for the pskc2csv script
This makes minor changes to the pskc2csv script to make it more
easily testable.
2017-09-22 Arthur de Jong <[email protected]>
* [6028b8e] pskc2csv.py: Support adding custom CSV file headers
This allows adding an optional label to the --columns option that
can be used to output a label different from the key property
name in the CSV file header.
2017-09-20 Arthur de Jong <[email protected]>
* [eef681b] pskc2csv.py: Add --secret-encoding option to pskc2csv
This option can be used to configure the encoding of the secret
in the CSV file (still hex by default).
2017-09-20 Arthur de Jong <[email protected]>
* [6f78dd6] pskc/__init__.py, pskc/crypto/aeskw.py,
pskc/crypto/tripledeskw.py, pskc/exceptions.py, pskc/mac.py,
pskc/parser.py, pskc/policy.py, pskc/serialiser.py, setup.cfg,
tox.ini: Run flake8 from tox
This also makes a few small code formatting changes to ensure
that the flake8 tests pass.
2017-09-11 Arthur de Jong <[email protected]>
* [cc3acc2] tox.ini: Simplify Tox configuration
2017-06-10 Arthur de Jong <[email protected]>
* [0c00c80] pskc/__init__.py, pskc/encryption.py, pskc/parser.py,
pskc/serialiser.py, pskc/xml.py, pskc2csv.py: Various minor code
style improvements
2017-06-10 Arthur de Jong <[email protected]>
* [510e6a5] pskc/encryption.py, pskc/parser.py: Normalise key
derivation algorithms
This makes KeyDerivation.algorithm and KeyDerivation.pbkdf2_prf
properties automatically normalise assigned values.
2017-06-10 Arthur de Jong <[email protected]>
* [d72e6cc] pskc/xml.py: Switch to using non-deprecated method
This uses ElementTree.iter() instead of ElementTree.getiterator()
for going over all the child elements in the tree because the
latter is deprecated.
2017-06-10 Arthur de Jong <[email protected]>
* [7b106ff] docs/usage.rst, pskc/key.py, tests/test_yubico.doctest:
Provide Key.userid convenience property
This provides a read-only userid property on Key objects that uses
the key_userid or device_userid value, whichever one is defined.
2017-06-09 Arthur de Jong <[email protected]>
* [f0d2991] docs/conf.py, docs/encryption.rst, docs/exceptions.rst,
docs/mac.rst: Document supported encryption and MAC algorithms
This also includes a few other small documentation improvements.
2017-06-09 Arthur de Jong <[email protected]>
* [8b8848d] pskc/encryption.py, pskc/mac.py,
tests/test_invalid.doctest, tests/test_mac.doctest: Refactor
MAC lookups
This switches to using the hashlib.new() function to be able to use
all hashes that are available in Python (specifically RIPEMD160).
This also adds a number of tests for HMACs using test vectors
from RFC 2202, RFC 4231 and RFC 2857.
2017-06-09 Arthur de Jong <[email protected]>
* [e10f9c6] pskc/algorithms.py: Handle more algortihm URIs
This adds a number of algorithm URIs defined in RFC 6931 and also
simplifies the definition of the list of URIs. It also adds more
aliases for algorithms.
2017-01-25 Arthur de Jong <[email protected]>
* [1fc1a03] README, docs/usage.rst, setup.py: Switch URLs to HTTPS
2017-01-21 Arthur de Jong <[email protected]>
* [8de25c2] tests/actividentity/test.pskcxml,
tests/test_actividentity.doctest: Correct name of ActivIdentity
test file
2017-01-21 Arthur de Jong <[email protected]>
* [5889df7] ChangeLog, NEWS, README, docs/conf.py, pskc/__init__.py,
pskc2csv.py, setup.py: Get files ready for 0.5 release
2017-01-15 Arthur de Jong <[email protected]>
* [29a183d] tests/test_feitian.doctest, tests/test_nagraid.doctest:
Split vendor tests
Have one doctest file per vendor to make tests a little more
manageable.
2017-01-14 Arthur de Jong <[email protected]>
* [02eb520] tests/test_yubico.doctest, tests/yubico/example1.pskcxml,
tests/yubico/example2.pskcxml, tests/yubico/example3.pskcxml:
Add tests for Yubikey files
This adds tests from draft-josefsson-keyprov-pskc-yubikey-00.
2017-01-13 Arthur de Jong <[email protected]>
* [12dfa64] pskc/parser.py, tests/actividentity/test.pskc,
tests/test_actividentity.doctest: Support legacy ActivIdentity
files
This adds support for parsing ActivIdentity files that conform
to a very old version of an Internet Draft. The implementation
and test were based on a file provided by Jaap Ruijgrok.
2017-01-11 Arthur de Jong <[email protected]>
* [a5e2343] pskc/parser.py,
tests/draft-hoyer-keyprov-pskc-algorithm-profiles-01/actividentity-3des.pskcxml,
tests/draft-hoyer-keyprov-pskc-algorithm-profiles-01/ocra.pskcxml,
tests/draft-hoyer-keyprov-pskc-algorithm-profiles-01/securid-aes-counter.pskcxml,
tests/draft-hoyer-keyprov-pskc-algorithm-profiles-01/totp.pskcxml:
Use original examples from old profiles Internet Draft
This updates the tests to use the original examples from
draft-hoyer-keyprov-pskc-algorithm-profiles-01 instead of
modifying them to fit the RFC 6030 schema (but does include some
minor changes to make them valid XML).
This adds a few additions to the parser to handle legacy challenge
and resposne encoding and a few key policy properties.
This also includes a fix for 0b757ec in the handling of the
<ChallengeFormat> element under a <Usage> element.
2016-12-21 Arthur de Jong <[email protected]>
* [2f7cb1a] tests/rfc6030/figure8.pskcxml,
tests/rfc6030/figure9.pskcxml, tests/test_rfc6030.doctest:
Add all figures from RFC 6030 to test suite
Note that asymmetric encryption and digital signature checking
has not yet been implemented so the tests are pretty minimal.
2016-12-21 Arthur de Jong <[email protected]>
* [0b757ec] pskc/parser.py, pskc/xml.py,
tests/draft-ietf-keyprov-pskc-02/figure2.pskcxml,
tests/draft-ietf-keyprov-pskc-02/figure3.pskcxml,
tests/draft-ietf-keyprov-pskc-02/figure4.pskcxml,
tests/draft-ietf-keyprov-pskc-02/figure5.pskcxml,
tests/draft-ietf-keyprov-pskc-02/figure6.pskcxml,
tests/draft-ietf-keyprov-pskc-02/figure7.pskcxml,
tests/draft-ietf-keyprov-pskc-02/figure8.pskcxml,
tests/draft-ietf-keyprov-pskc-02/figure9.pskcxml,
tests/test_draft_ietf_keyprov_pskc_02.doctest: Add support for
older Internet Draft version
This adds support for parsing most examples from
draft-ietf-keyprov-pskc-02. That file uses a few other names
for elements and attributes of the PSKC file and a few other
minor differences.
The XML parsing has been changed to allow specifying multiple
matches and the find*() functions now return the first found match.
While all examples from draft-ietf-keyprov-pskc-02 are tested
support for verifying digital signatures and asymmetric keys
have not yet been implemented.
2016-12-19 Arthur de Jong <[email protected]>
* [09076f8] tests/test_encryption.doctest: Fix typo in test
2016-12-20 Arthur de Jong <[email protected]>
* [46fa5f1] setup.cfg: Fail tests on missing coverage
2016-12-20 Arthur de Jong <[email protected]>
* [047a2a9] pskc/key.py, pskc/mac.py,
tests/encryption/mac-over-plaintext.pskcxml,
tests/invalid/mac-missing.pskcxml, tests/invalid/mac-value.pskcxml,
tests/invalid/missing-encryption-method.pskcxml,
tests/test_encryption.doctest, tests/test_invalid.doctest:
Allow MAC over plaintext or ciphertext
RFC 6030 implies that the MAC should be performed over the
ciphertext but some earlier drafts implied that the MAC should
be performed on the plaintext. This change accpets the MAC if
either the plaintext or ciphertext match.
Note that this change allows for a padding oracle attack when
CBC encryption modes are used because decryption (and unpadding)
needs to be done before MAC checking. However, this module is
not expected to be available to users to process arbitrary PSKC
files repeatedly.
This removes the tests for a missing MAC key (and replaces it for
tests of missing EncryptionMethod) because falling back to using
the encryption key (implemented in a444f78) in combination with
this change means that decryption is performed before MAC checking
and is no longer possible to trigger a missing MAC key error.
2016-12-19 Arthur de Jong <[email protected]>
* [bae7084] pskc/crypto/__init__.py, pskc/encryption.py,
tests/test_crypto.doctest: Add sanity checks to unpadding
2016-12-19 Arthur de Jong <[email protected]>
* [d864bc8] pskc/serialiser.py: Ensure XML file ends with a newline
2016-12-19 Arthur de Jong <[email protected]>
* [c631628] pskc/xml.py: Adapt coverage pragma annotations
This fixes the pragma directives to be be correct independently
of whether lxml is installed or not.
2016-12-19 Arthur de Jong <[email protected]>
* [18d82dc] .gitignore, tox.ini: Add Tox configuration
This sets up Tox with various versions of Python and for each
version a run with and without lxml.
2016-12-19 Arthur de Jong <[email protected]>
* [71058e2] tests/test_write.doctest: Close read files in tests
This ensures that the files that are read in the test suite are
properly closed to avoid leaking open file descriptors.
2016-12-18 Arthur de Jong <[email protected]>
* [f0a0a3b] pskc/parser.py: Support missing or lowercase version
attribute
2016-09-26 Arthur de Jong <[email protected]>
* [3bf4737] docs/usage.rst: Fix copy-pasto in documentation
This accidentally slipped in as part of beafc6b. 2016-09-19
Arthur de Jong <[email protected]>
* [02b30a9] pskc/__init__.py, pskc/parser.py, pskc/serialiser.py:
Also move outer writing and parsing to modules
2016-09-17 Arthur de Jong <[email protected]>
* [b1f8f87] .gitignore, README, pskc/__init__.py: Add writing
example to toplevel documentation
2016-09-17 Arthur de Jong <[email protected]>
* [e23a467] pskc/key.py: Use custom data descriptors for key
properties
This uses a custom data descriptor (property) for secret, counter,
time_offset, time_interval and time_drift.
2016-09-17 Arthur de Jong <[email protected]>
* [beafc6b] docs/usage.rst, pskc/__init__.py, pskc/device.py,
pskc/key.py, pskc/parser.py, pskc/policy.py, pskc/serialiser.py,
tests/test_misc.doctest, tests/test_write.doctest: Support
separate device from key
This allows having multiple keys per device while also maintaining
the previous API.
Note that having multiple keys per device is not allowed by the
RFC 6030 schema but is allowed by some older internet drafts.
2016-09-16 Arthur de Jong <[email protected]>
* [84bfb8a] pskc/__init__.py, pskc/encryption.py, pskc/key.py,
pskc/mac.py, pskc/policy.py, pskc/serialiser.py: Move XML
generation to own module
Similar to the change for parsing, move the XML serialisation
of PSKC data to a single class in a separate module.
2016-09-14 Arthur de Jong <[email protected]>
* [426e821] pskc/__init__.py, pskc/encryption.py, pskc/key.py,
pskc/mac.py, pskc/parser.py, pskc/policy.py: Move document
parsing to own module
This moves all the parse() functions to a single class in a
dedicated module that can be used for parsing PSKC files. This
should make it easier to subclass the parser.
2016-09-14 Arthur de Jong <[email protected]>
* [bf34209] tests/invalid/no-mac-method.pskcxml,
tests/test_invalid.doctest, tests/test_rfc6030.doctest: Some
minor improvements to the tests
2016-09-12 Arthur de Jong <[email protected]>
* [600ae68] pskc/encryption.py, pskc/key.py, pskc/xml.py,
setup.cfg, tests/invalid/empty-mac-key.pskcxml,
tests/invalid/incomplete-derivation.pskcxml,
tests/invalid/missing-encryption.pskcxml,
tests/misc/SampleFullyQualifiedNS.xml, tests/misc/policy.pskcxml,
tests/test_aeskw.doctest, tests/test_encryption.doctest,
tests/test_invalid.doctest, tests/test_misc.doctest,
tests/test_write.doctest: Improve branch coverage
This enables branch coverage testing and adds tests to improve
coverage.
2016-09-11 Arthur de Jong <[email protected]>
* [713d106] pskc/encryption.py, tests/test_encryption.doctest:
Support specifying PRF in setup_pbkdf2()
This also ensures that the PRF URL is normalised.
2016-09-11 Arthur de Jong <[email protected]>
* [ff811c9] pskc/encryption.py: Fix bug in passing explicit key
to setup_preshared_key()
2016-09-11 Arthur de Jong <[email protected]>
* [fa07aa5] docs/encryption.rst, pskc/encryption.py: Clarify
encryption.setup_*() documentation
This tries to make it clearer that the setup_preshared_key()
and setup_pbkdf2() functions are meant to be used when writing
out PSKC files.
2016-04-23 Arthur de Jong <[email protected]>
* [a444f78] pskc/key.py, pskc/mac.py,
tests/encryption/no-mac-key.pskcxml,
tests/invalid/mac-missing.pskcxml, tests/test_encryption.doctest,
tests/test_invalid.doctest: Fall back to encryption key for MAC
This uses the encryption key also as MAC key if no MAC key has
been specified in the PSKC file. Earlier versions of the PSKC
draft specified this behaviour.
2016-04-23 Arthur de Jong <[email protected]>
* [9b76135] pskc/encryption.py,
tests/encryption/aes128-cbc-noiv.pskcxml,
tests/test_encryption.doctest: Allow global specification of IV
In older versions of the PSKC standard it was allowed to
have a global initialization vector for CBC based encryption
algorithms. It is probably not a good idea to re-use an IV
in general.
2016-04-23 Arthur de Jong <[email protected]>
* [d53f05b] pskc/encryption.py, pskc/mac.py: Move crypto to functions
This makes it much easier to test the encryption, decryption
and HMAC processing separate from the PSKC parsing.
2016-04-05 Arthur de Jong <[email protected]>
* [5dbfefd] pskc/__init__.py, pskc/encryption.py, pskc/key.py,
pskc/policy.py: Remove parse call from constructors
This makes the creation if internal instances a litte more
consistent.
2016-04-05 Arthur de Jong <[email protected]>
* [0d7caf1] pskc/algorithms.py, pskc/encryption.py, pskc/mac.py:
Move algorithm uri handling to separate module
2016-03-29 Arthur de Jong <[email protected]>
* [22ba9f1] pskc/crypto/__init__.py, pskc/encryption.py: Move
padding functions to crypto package
2016-03-28 Arthur de Jong <[email protected]>
* [efbe94c] ChangeLog, NEWS, pskc/__init__.py, setup.py: Get files
ready for 0.4 release
2016-03-26 Arthur de Jong <[email protected]>
* [0c57335] docs/policy.rst: Document may_use() policy function
2016-03-27 Arthur de Jong <[email protected]>
* [b4a6c72] : Implement writing encrypted files
This adds support for setting up encryption keys and password-based
key derivation when writing PSKC files. Also MAC keys are set
up when needed.
2016-03-26 Arthur de Jong <[email protected]>
* [59aa65b] README, docs/conf.py, docs/encryption.rst, docs/mac.rst,
docs/usage.rst, pskc/__init__.py: Document writing encrypted files
2016-03-21 Arthur de Jong <[email protected]>
* [5f32528] tests/test_write.doctest: Add encryption error tests
2016-03-21 Arthur de Jong <[email protected]>
* [7ede4a1] tests/test_write.doctest: Add tests for writing
encrypted PSKC files
2016-03-20 Arthur de Jong <[email protected]>
* [1ff3237] pskc/encryption.py: Allow configuring a pre-shared key
This method allows configuring a pre-shared encryption key and
will chose reasonable defaults for needed encryption values
(e.g. it will choose an algorithm, generate a new key of the
appropriate length if needed, etc.).
2016-03-19 Arthur de Jong <[email protected]>
* [50414a3] pskc/encryption.py, tests/test_encryption.doctest:
Allow configuring PBKDF2 key derivation
This factors out the PBKDF2 key derivation to a separate function
and introduces a function to configure KeyDerivation instances
with PBKDF2.
2016-03-21 Arthur de Jong <[email protected]>
* [5ac9d43] pskc/mac.py, tests/test_encryption.doctest: Allow
configuring a MAC key
This method will set up a MAC key and algorithm as specified or
use reasonable defauts.
2016-03-20 Arthur de Jong <[email protected]>
* [16da531] pskc/key.py, pskc/mac.py: Generate MAC values
2016-03-20 Arthur de Jong <[email protected]>
* [ca0fa36] pskc/__init__.py, pskc/encryption.py, pskc/mac.py:
Write MACMethod
This also makes the MAC.algorithm a property similarly as what
is done for Encryption (normalise algorithm names) and adds a
setter for the MAC.key property.
2016-03-21 Arthur de Jong <[email protected]>
* [8fd35ba] pskc/encryption.py, pskc/key.py: Write out encrypted
values
The Encryption class now has a fields property that lists the
fields that should be encrypted when writing the PSKC file.
This adds an encrypt_value() function that performs the encryption
and various functions to convert the plain value to binary before
writing the encrypted XML elements.
2016-03-20 Arthur de Jong <[email protected]>
* [eba541e] pskc/__init__.py, pskc/encryption.py, pskc/mac.py:
Make Encryption and MAC constructors consistent
This removes calling parse() from the Encryption and MAC
constructors and stores a reference to the PSKC object in both
objects so it can be used later on.
2016-03-20 Arthur de Jong <[email protected]>
* [fe21231] pskc/__init__.py, pskc/encryption.py,
tests/test_write.doctest: Write encryption key information
This writes information about a pre-shared key or PBKDF2 key
derivation in the PSKC file. This also means that writing
a decrypted version of a previously encrypted file requires
actively removing the encryption.
2016-03-19 Arthur de Jong <[email protected]>
* [0893640] pskc/encryption.py, tests/test_misc.doctest: Add
algorithm_key_lengths property
This property on the Encryption object provides a list of key
sizes (in bytes) that the configured encryption algorithm supports.
2016-03-22 Arthur de Jong <[email protected]>
* [8b5f6c2] pskc/policy.py, tests/test_misc.doctest,
tests/test_rfc6030.doctest, tests/test_write.doctest: Also check
key expiry in may_use()
2016-03-20 Arthur de Jong <[email protected]>
* [dfa57ae] pskc2csv.py: Support reading password or key in pskc2csv
This supports reading the encryption password or key from the
command line or from a file.
2014-06-28 Arthur de Jong <[email protected]>
* [0744222] pskc/xml.py: Copy namespaces to toplevel element
Ensure that when writing an XML file all namespace definitions
are on the toplevel KeyContainer element instead of scattered
throughout the XML document.
2016-03-19 Arthur de Jong <[email protected]>
* [e8ef157] pskc/__init__.py, tests/test_write.doctest: Support
writing to text streams in Python 3
This supports writing the XML output to binary streams as well
as text streams in Python 3.
2016-03-19 Arthur de Jong <[email protected]>
* [cadc6d9] pskc/key.py, pskc/mac.py,
tests/invalid/missing-encryption.pskcxml,
tests/invalid/not-boolean.pskcxml,
tests/invalid/not-integer.pskcxml,
tests/invalid/not-integer2.pskcxml,
tests/invalid/unknown-encryption.pskcxml, tests/test_aeskw.doctest,
tests/test_encryption.doctest, tests/test_invalid.doctest,
tests/test_misc.doctest, tests/test_rfc6030.doctest,
tests/test_tripledeskw.doctest, tests/test_write.doctest:
Improve tests and test coverage
This adds tests to ensure that incorrect attribute and value
types in the PSKC file raise a ValueError exception and extends
the tests for invalid encryption options.
This removes some code or adds no cover directives to a few
places that have unreachable code or are Python version specific