Package: oscrypto
oscryptoA compilation-free, always up-to-date encryption library for Python that works
on Windows, OS X, Linux and BSD. Supports the following versions of Python:
2.6, 2.7, 3.2, 3.3, 3.4, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10 and pypy.Supported Operating SystemsFeaturesWhy Another Python Crypto Library?Related Crypto LibrariesCurrent ReleaseDependenciesInstallationLicenseDocumentationContinuous IntegrationTestingDevelopmentCI TasksSupported Operating SystemsThe library integrates with the encryption library that is part of the operating
system. This means that a compiler is never needed, and OS security updates take
care of patching vulnerabilities. Supported operating systems include:Windows XP or newerUses:Cryptography API: Next Generation (CNG)Secure Channelfor TLSCryptoAPIfor trust lists and XP supportTested on:Windows XP (no SNI)Windows 7Windows 8.1Windows Server 2012Windows 10OS X 10.7 or newerUses:Security.frameworkSecure Transportfor TLSCommonCryptofor PBKDF2OpenSSL (or LibreSSL on macOS 10.13) for the PKCS #12 KDFTested on:OS X 10.7OS X 10.8OS X 10.9OS X 10.10OS X 10.11OS X 10.11 with OpenSSL 1.1.0macOS 10.12macOS 10.13 with LibreSSL 2.2.7macOS 10.14macOS 10.15macOS 10.15 with OpenSSL 3.0macOS 11macOS 12Linux or BSDUses one of:OpenSSL 0.9.8OpenSSL 1.0.xOpenSSL 1.1.0OpenSSL 3.0LibreSSLTested on:Arch Linux with OpenSSL 1.0.2OpenBSD 5.7 with LibreSSLUbuntu 10.04 with OpenSSL 0.9.8Ubuntu 12.04 with OpenSSL 1.0.1Ubuntu 15.04 with OpenSSL 1.0.1Ubuntu 16.04 with OpenSSL 1.0.2 on Raspberry Pi 3 (armhf)Ubuntu 18.04 with OpenSSL 1.1.x (amd64, arm64, ppc64el)Ubuntu 22.04 with OpenSSL 3.0 (amd64)OS X 10.6 will not be supported due to a lack of available
cryptographic primitives and due to lack of vendor support.FeaturesCurrently the following features are implemented. Many of these should only be
used for integration with existing/legacy systems. If you don't know which you
should, or should not use, please seeLearning.TLSv1.x socket wrappersCertificate verification performed by OS trust rootsCustom CA certificate supportSNI support (except Windows XP)Session reuse via IDs/ticketsModern cipher suites (RC4, DES, anon and NULL ciphers disabled)Weak DH parameters and certificate signatures rejectedSSLv3 disabled by default, SSLv2 unimplementedCRL/OCSP revocation checks consistenty disabledExporting OS trust rootsPEM-formatted CA certs from the OS for OpenSSL-based codeEncryption/decryptionAES (128, 192, 256), CBC mode, PKCS7 paddingAES (128, 192, 256), CBC mode, no paddingTripleDES 3-key, CBC mode, PKCS5 paddingTripleDes 2-key, CBC mode, PKCS5 paddingDES, CBC mode, PKCS5 paddingRC2 (40-128), CBC mode, PKCS5 paddingRC4 (40-128)RSA PKCSv1.5RSA OAEP (SHA1 only)Generating public/private key pairsRSA (1024, 2048, 3072, 4096 bit)DSA (1024 bit on all platforms - 2048, 3072 bit with OpenSSL 1.x or
Windows 8)EC (secp256r1, secp384r1, secp521r1 curves)Generating DH parametersSigning and verificationRSA PKCSv1.5RSA PSSDSAECLoading and normalizing DER and PEM formatted keysRSA public and private keysDSA public and private keysEC public and private keysX.509 CertificatesPKCS#12 archives (.pfx/.p12)Key derivationPBKDF2PBKDF1PKCS#12 KDFRandom byte generationThe feature set was largely driven by the technologies used related to
generating and validating X.509 certificates. The various CBC encryption schemes
and KDFs are used to load encrypted private keys, and the various RSA padding
schemes are part of X.509 signatures.For modern cryptography not tied to an existing system, please see theModern Cryptographysection of the docs.Please note that this library does not include modern block modes such as CTR
and GCM due to lack of support from both OS X and OpenSSL 0.9.8.Why Another Python Crypto Library?In short, the existing cryptography libraries for Python didn't fit the needs of
a couple of projects I was working on. Primarily these are applications
distributed to end-users who aren't programmers, that need to handle TLS and
various technologies related to X.509 certificates.If your system is not tied to AES, TLS, X.509, or related technologies, you
probably wantmore modern cryptography.Depending on your needs, thecryptographypackage may
be a good (or better) fit.Some things that make oscrypto unique:No compiler needed, ever. No need to pre-compile shared libraries. Just
distribute the Python source files, any way you want.Uses the operating system's crypto library - does not require OpenSSL on
Windows or OS X.Relies on the operating system for security patching. You don't need to
rebuild all of your apps every time there is a new TLS vulnerability.Intentionally limited in scope to crypto primitives. Other libraries
built upon it deal with certificate path validation, creating certificates
and CSRs, constructing CMS structures.Built on top of a fast, pure-Python ASN.1 parser,asn1crypto.TLS functionality uses the operating system's trust list/CA certs and is
pre-configured with sane defaultsPublic APIs are simple and use strict type checks to avoid errorsSome downsides include:Does not currently implement:standalone DH key exchangevarious encryption modes such as GCM, CCM, CTR, CFB, OFB, ECBkey wrappingCMACHKDFNon-TLS functionality is architected for dealing with data that fits in
memory and is available all at onceDeveloped by a single developerRelated Crypto Librariesoscryptois part of the modularcrypto family of Python packages:asn1cryptooscryptocsrbuildercertbuildercrlbuilderocspbuildercertvalidatorCurrent Release1.2.1 -changelogDependenciesasn1cryptoPython 2.6, 2.7, 3.2, 3.3, 3.4, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10 or pypyOpenSSL/LibreSSL if on Linux¹¹ On Linux,ctypes.util.find_library()is used to located OpenSSL. Alpine Linux does not have an appropriate install by default forfind_library()to work properly. Instead,oscrypto.use_openssl()must be called with the path to the OpenSSL shared libraries.InstallationpipinstalloscryptoLicenseoscryptois licensed under the terms of the MIT license. See theLICENSEfile for the exact license text.DocumentationoscryptodocumentationContinuous IntegrationVarious combinations of platforms and versions of Python are tested via:macOS, Linux, Windowsvia GitHub Actionsarm64via CircleCITestingTests are written usingunittestand require no third-party packages.Depending on what type of source is available for the package, the following
commands can be used to run the test suite.Git RepositoryWhen working within a Git working copy, or an archive of the Git repository,
the full test suite is run via:pythonrun.pytestsTo run only some tests, pass a regular expression as a parameter totests.pythonrun.pytestsaesTo run tests multiple times, in order to catch edge-case bugs, pass an integer
totests. If combined with a regular expression for filtering, pass the
repeat count after the regular expression.pythonrun.pytests20pythonrun.pytestsaes20Backend OptionsTo run tests using a custom build of OpenSSL, or to use OpenSSL on Windows or
Mac, adduse_opensslafterrun.py, like:pythonrun.pyuse_openssl=/path/to/libcrypto.so,/path/to/libssl.sotestsTo run tests forcing the use of ctypes, even if cffi is installed, adduse_ctypesafterrun.py:pythonrun.pyuse_ctypes=truetestsTo run tests using the legacy Windows crypto functions on Windows 7+, adduse_winlegacyafterrun.py:pythonrun.pyuse_winlegacy=truetestsInternet TestsTo skip tests that require an internet connection, addskip_internetafterrun.py:pythonrun.pyskip_internet=truetestsPyPi Source DistributionWhen working within an extracted source distribution (aka.tar.gz) from
PyPi, the full test suite is run via:pythonsetup.pytestTest OptionsThe following env vars can control aspects of running tests:Force OpenSSL Shared Library PathsSetting the env varOSCRYPTO_USE_OPENSSLto a string in the form:/path/to/libcrypto.so,/path/to/libssl.sowill force use of specific OpenSSL shared libraries.This also works on Mac and Windows to force use of OpenSSL instead of using
native crypto libraries.Force Use of ctypesBy default, oscrypto will use thecffimodule for FFI if it is installed.To use the slightly slower, but more widely-tested,ctypesFFI layer, set
the env varOPENSSL_USE_CTYPES=true.Force Use of Legacy Windows Crypto APIsOn Windows 7 and newer, oscrypto will use the CNG backend by default.To force use of the older CryptoAPI, set the env varOPENSSL_USE_WINLEGACY=true.Skip Tests Requiring an Internet ConnectionSome of the TLS tests require an active internet connection to ensure that
various "bad" server certificates are rejected.To skip tests requiring an internet connection, set the env varOPENSSL_SKIP_INTERNET_TESTS=true.PackageWhen the package has been installed via pip (or another method), the packageoscrypto_testsmay be installed and invoked to run the full test suite:pipinstalloscrypto_tests
python-moscrypto_testsDevelopmentTo install the package used for linting, execute:pipinstall--user-rrequires/lintThe following command will run the linter:pythonrun.pylintSupport for code coverage can be installed via:pipinstall--user-rrequires/coverageCoverage is measured by running:pythonrun.pycoverageTo install the packages requires to generate the API documentation, run:pipinstall--user-rrequires/api_docsThe documentation can then be generated by running:pythonrun.pyapi_docsTo install the necessary packages for releasing a new version on PyPI, run:pipinstall--user-rrequires/releaseReleases are created by:Making a git tag insemverformatRunning the command:pythonrun.pyreleaseExisting releases can be found athttps://pypi.python.org/pypi/oscrypto.CI TasksA task nameddepsexists to download and stage all necessary testing
dependencies. On posix platforms,curlis used for downloads and on Windows
PowerShell withNet.WebClientis used. This configuration sidesteps issues
related to getting pip to work properly and messing withsite-packagesfor
the version of Python being used.Thecitask runslint(if flake8 is available for the version of Python) andcoverage(ortestsif coverage is not available for the version of Python).
If the current directory is a clean git working copy, the coverage data is
submitted to codecov.io.pythonrun.pydeps
pythonrun.pyci