replace ecdsa with cryptography

Open dotlambda opened this issue 2 months ago • 0 comments

ecdsa is vulnerable to CVE-2024-23342 and shouldn't be used anyway:

I don't want people to use this library in production environments...

It's a teaching tool, it's a testing tool, it's absolutely not an production grade implementation. I maintain it to have support for ECDH and ECDSA in tlsfuzzer, which I need to be first and foremost portable. Security does not even enter a picture for that tool.

If you need enterprise grade implementation you should use pyca/cryptography.

https://github.com/tlsfuzzer/python-ecdsa/issues/330

Oct 22 '25 04:10 dotlambda