DSA Opaque Keys for OpenSSL

Opaque implementation including WithNumbers support. PRs left after this will be deprecation (backend methods and DSA concrete classes) and a DSA doc update to mirror the RSA doc update.

One major item to be aware of for DSA is that some backends (e.g. CommonCrypto/Security.framework) do not support generating independent DSAParameters and reusing them to generate new keys. This will mean that when we add support for DSA in that backend we'll need to modify an existing function or add a new function to encompass the idea of generating parameters and key simultaneously. The backend also won't be able to provide a backend specific DSAParameters object when calling `parameters()` on a `DSA{Public,Private}Key`. I believe this is doable while preserving the `DSAParameters` path, but if anyone has a suggestion to make the API more elegant for both speak up in this PR before it lands!

Refs #1117
Have we established whether needing to generate a key from a given set of
parameters is a common/useful operation?


On Thu, Jun 26, 2014 at 2:48 PM, Paul Kehrer <notifications@github.com>
wrote:

> In cryptography/hazmat/primitives/asymmetric/dsa.py:
>
> > -def _check_dsa_parameters(modulus, subgroup_order, generator):
> > -    if (
> > -        not isinstance(modulus, six.integer_types) or
> > -        not isinstance(subgroup_order, six.integer_types) or
> > -        not isinstance(generator, six.integer_types)
> > -    ):
> > -        raise TypeError("DSA parameters must be integers.")
> > -
> > -    if (utils.bit_length(modulus),
> > -        utils.bit_length(subgroup_order)) not in (
> > +def generate_parameters(key_size, backend):
> > +    return backend.generate_dsa_parameters(key_size)
> > +
> > +
> > +def generate_private_key(parameters):
> > +    return parameters._backend.generate_dsa_private_key(parameters)
>
> This relates to some of the ideas in #1117 (comment)
> <https://github.com/pyca/cryptography/issues/1117#issuecomment-46766853>,
> but basically we have a few potential approaches. I would be okay with
> adding a generate_private_key method to the DSAParameters object, but
> backends like CommonCrypto can't generate DSAParameters independent of a
> key so we'll need to add a generate_private_key(key_size, backend)
> function as a least common denominator for those backends in the future.
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/pyca/cryptography/pull/1179/files#r14268910>.
>



-- 
"I disapprove of what you say, but I will defend to the death your right to
say it." -- Evelyn Beatrice Hall (summarizing Voltaire)
"The people's good is the highest law." -- Cicero
GPG Key fingerprint: 125F 5C67 DFE9 4084