cryptography

cryptography copied to clipboard

FR: Allow clients to set extension policies for x.509 verification

21

Given that the default policy seems to generally be to verify against the CA/B ruleset (a reasonable default), it would be nice for non-internet PKI users if we could pass...

nbastin

Certificate verification fails if the certificate being verified does not contain the relevant extensions

8

### Problem description I'm trying to verify the VCEK certificate published by AMD. According to the document VCEK is supposed to be verified by ARK (root certificate) and ASK (intermediate...

kajinamit

x509 verification fails on critical EKU

2

If any certificate in the verification chain has a critical EKU, verification will fail. RFC 5280 (and X.509 in general) allows EKU to be either critical or non-critical for any...

nbastin

VerificationError exceptions don't report which cert causes the problem, which can make debugging fairly time consuming (or impossible, if you're not in the situation of issuing your own certs).

nbastin

- [ ] `backend` - [ ] `aead` - [ ] `ciphers` - [ ] `cmac` - [ ] `dh` - [ ] `dsa` - [ ] `ec` - [...

alex

[RFC] TSP / RFC 3161 support

1

Filing this as a RFC, since the exact scope of a good/sane RFC 3161 API isn't fully clear. ## Background [RFC 3161](https://www.ietf.org/rfc/rfc3161.txt) defines the Time Stamp Protocol (TSP), which specifies...

woodruffw

Add support of Ed25519ph (i.e. ed25519 + SHA512)

14

https://www.openssl.org/docs/man3.3/man7/Ed25519.html: The instances Ed25519ph, Ed448ph are referred to as HashEdDSA schemes. For these two instances, the sign and verify procedures do not require access to the complete message; they operate...

socketpair

Bumps [alabaster](https://github.com/sphinx-doc/alabaster) from 0.7.16 to 1.0.0. Release notes Sourced from alabaster's releases. Alabaster 1.0.0 Changelog: https://alabaster.readthedocs.io/en/latest/changelog.html Changelog Sourced from alabaster's changelog. :git_tag:1.0.0 -- 2024-07-26 Dropped support for Python 3.9 and...

dependabot[bot]

## BoringSSL [Commit: 2a4643fde418d795c662f9b523f6e1552f2c6a49](https://boringssl.googlesource.com/boringssl/+/2a4643fde418d795c662f9b523f6e1552f2c6a49) [Diff](https://boringssl.googlesource.com/boringssl/+/0a2d3a4de0922411ce6c6296c6bbf1f62055d23d..2a4643fde418d795c662f9b523f6e1552f2c6a49) between the last commit hash merged to this repository and the new commit. ## OpenSSL [Commit: accd835f8d6ed946eb540a3e2e82f9723093f094](https://github.com/openssl/openssl/commit/accd835f8d6ed946eb540a3e2e82f9723093f094) [Diff](https://github.com/openssl/openssl/compare/c07a34e18b098b77ce7ecb14273b7c75f59b5871...accd835f8d6ed946eb540a3e2e82f9723093f094) between the last commit hash merged to...

pyca-boringbot[bot]

apps\lib\http_server.c(207): error C2065: 'OSSL_TRACE_CATEGORY_HTTP': undeclared identifier

10

Hi, I am trying to build cryptography 42.0.8 with custom OpenSSL 3.0.13. It fails with following error. ``` Building wheels for collected packages: cryptography Building wheel for cryptography (pyproject.toml) ......

suyogwani11