Repository: pyca/cryptography

Issue:
deprecate mgf1_hash_supported
With the addition of `rsa_padding_supported` we no longer need `mgf1_hash_supported` to be a public method on the `RSABackend` interface. We should deprecate it.



Discussion:

Resolving patch:
diff --git a/cryptography/hazmat/backends/openssl/backend.py b/cryptography/hazmat/backends/openssl/backend.py
--- a/cryptography/hazmat/backends/openssl/backend.py
+++ b/cryptography/hazmat/backends/openssl/backend.py
@@ -560,6 +560,15 @@ def create_rsa_verification_ctx(self, public_key, signature, padding,
                                        algorithm)
 
     def mgf1_hash_supported(self, algorithm):
+        warnings.warn(
+            "mgf1_hash_supported is deprecated and will be removed in "
+            "a future version.",
+            utils.DeprecatedIn05,
+            stacklevel=2
+        )
+        return self._mgf1_hash_supported(algorithm)
+
+    def _mgf1_hash_supported(self, algorithm):
         if self._lib.Cryptography_HAS_MGF1_MD:
             return self.hash_supported(algorithm)
         else:
@@ -569,7 +578,7 @@ def rsa_padding_supported(self, padding):
         if isinstance(padding, PKCS1v15):
             return True
         elif isinstance(padding, PSS) and isinstance(padding._mgf, MGF1):
-            return self.mgf1_hash_supported(padding._mgf._algorithm)
+            return self._mgf1_hash_supported(padding._mgf._algorithm)
         elif isinstance(padding, OAEP) and isinstance(padding._mgf, MGF1):
             return isinstance(padding._mgf._algorithm, hashes.SHA1)
         else:
@@ -1518,7 +1527,7 @@ def __init__(self, backend, private_key, padding, algorithm):
                 raise ValueError("Digest too large for key size. Use a larger "
                                  "key.")
 
-            if not self._backend.mgf1_hash_supported(padding._mgf._algorithm):
+            if not self._backend._mgf1_hash_supported(padding._mgf._algorithm):
                 raise UnsupportedAlgorithm(
                     "When OpenSSL is older than 1.0.1 then only SHA1 is "
                     "supported with MGF1.",
@@ -1709,7 +1718,7 @@ def __init__(self, backend, public_key, signature, padding, algorithm):
                     "correct key and digest algorithm."
                 )
 
-            if not self._backend.mgf1_hash_supported(padding._mgf._algorithm):
+            if not self._backend._mgf1_hash_supported(padding._mgf._algorithm):
                 raise UnsupportedAlgorithm(
                     "When OpenSSL is older than 1.0.1 then only SHA1 is "
                     "supported with MGF1.",


Test patch:
diff --git a/tests/hazmat/backends/test_openssl.py b/tests/hazmat/backends/test_openssl.py
--- a/tests/hazmat/backends/test_openssl.py
+++ b/tests/hazmat/backends/test_openssl.py
@@ -353,7 +353,10 @@ def test_non_sha1_pss_mgf1_hash_algorithm_on_old_openssl(self):
             )
 
     def test_unsupported_mgf1_hash_algorithm(self):
-        assert backend.mgf1_hash_supported(DummyHash()) is False
+        assert pytest.deprecated_call(
+            backend.mgf1_hash_supported,
+            DummyHash()
+        ) is False
 
     def test_rsa_padding_unsupported_pss_mgf1_hash(self):
         assert backend.rsa_padding_supported(