pycrypto

Added PKCS#1 encryption schemes (v1.5 and OAEP). We now have a decent, easy-to-use non-textbook RSA implementation. Yay!

• Added PKCS#1 signature schemes (v1.5 and PSS). v1.5 required some extensive changes to Hash modules to contain the algorithm specific ASN.1 OID. To that end, we now always have a (thin) Python module to hide the one in pure C.

• Added 2 standard Key Derivation Functions (PBKDF1 and PBKDF2).

• Added export/import of RSA keys in OpenSSH and PKCS#8 formats.

• Added password-protected export/import of RSA keys (one old method for PKCS#8 PEM only).

• Added ability to generate RSA key pairs with configurable public exponent e.

• Added ability to construct an RSA key pair even if only the private exponent d is known, and not p and q.

• Added SHA-2 C source code (fully from Lorenz Quack).

• Unit tests for all the above.

• Updates to documentation (both inline and in Doc/pycrypt.rst)

• All of the above changes were put together by Legrandin (Thanks!)

• Minor bug fixes (setup.py and tests).

Python 3 support! (Thorsten E. Behrens, Anders Sundman) PyCrypto now supports every version of Python from 2.1 through 3.2.

• Timing-attack countermeasures in _fastmath: When built against libgmp version 5 or later, we use mpz_powm_sec instead of mpz_powm. This should prevent the timing attack described by Geremy Condra at PyCon 2011: http://blip.tv/pycon-us-videos-2009-2010-2011/pycon-2011-through-the-side-channel-timing-and-implementation-attacks-in-python-4897955

• New hash modules (for Python >= 2.5 only): SHA224, SHA384, and SHA512 (Frédéric Bertolus)

• Configuration using GNU autoconf. This should help fix a bunch of build issues.

• Support using MPIR as an alternative to GMP.

• Improve the test command in setup.py, by allowing tests to be performed on a single sub-package or module only. (Legrandin)

  You can now do something like this:

  python setup.py test -m Hash.SHA256 --skip-slow-tests

• Fix double-decref of "counter" when Cipher object initialisation fails (Ryan Kelly)

• Apply patches from Debian's python-crypto 2.3-3 package (Jan Dittberner, Sebastian Ramacher):

• fix-RSA-generate-exception.patch
• epydoc-exclude-introspect.patch
• no-usr-local.patch

• Fix launchpad bug #702835: "Import key code is not compatible with GMP library" (Legrandin)

• More tests, better documentation, various bugfixes.

Fix NameError when attempting to use deprecated getRandomNumber() function.

• _slowmath: Compute RSA u parameter when it's not given to RSA.construct. This makes _slowmath behave the same as _fastmath in this regard.

• Make RSA.generate raise a more user-friendly exception message when the user tries to generate a bogus-length key.

Deprecated Crypto.Util.number.getRandomNumber(), which had confusing semantics. It's been replaced by getRandomNBitInteger and getRandomInteger. (Thanks: Lorenz Quack)

• Better isPrime() and getPrime() implementations that do a real Rabin-Miller probabilistic primality test (not the phony test we did before with fixed bases). (Thanks: Lorenz Quack)

• getStrongPrime() implementation for generating RSA primes. (Thanks: Lorenz Quack)

• Support for importing and exporting RSA keys in DER and PEM format. (Thanks: Legrandin)

• Fix PyCrypto when floor division (python -Qnew) is enabled.

• When building using gcc, use -std=c99 for compilation. This should fix building on FreeBSD and NetBSD.

• Add PublicKey to Crypto.all

Added SHA256 module contributed by Jeethu Rao, with test data from Taylor Boon.

• Fixed AES.c compilation problems with Borland C.
  (Contributed by Jeethu Rao.)

• Fix ZeroDivisionErrors on Windows, caused by the system clock not having enough resolution.

  • Fix 2.1/2.2-incompatible use of (key not in dict), pointed out by Ian Bicking.

• Fix FutureWarning in Crypto.Util.randpool, noted by James P Rutledge.

Util.number.getPrime() would inadvertently round off the bit size; if you asked for a 129-bit prime or 135-bit prime, you got a 128-bit prime.

• Added Util/test/prime_speed.py to measure the speed of prime generation, and PublicKey/test/rsa_speed.py to measure the speed of RSA operations.

• Merged the _rsa.c and _dsa.c files into a single accelerator module, _fastmath.c.

• Speed improvements: Added fast isPrime() function to _fastmath, cutting the time to generate a 1024-bit prime by a factor of 10. Optimized the C version of RSA decryption to use a longer series of operations that's roughly 3x faster than a single exponentiation. (Contributed by Joris Bontje.)

• Added support to RSA key objects for blinding and unblinding data. (Contributed by Joris Bontje.)

• Simplified RSA key generation: hard-wired the encryption exponent to 65537 instead of generating a random prime; generate prime factors in a loop until the product is large enough.

• Renamed cansign(), canencrypt(), hasprivate(), to can_sign, can_encrypt, has_private. If people shriek about this change very loudly, I'll add aliases for the old method names that log a warning and call the new method.

Many randpool changes. RandomPool now has a randomize(N:int) method that can be called to get N bytes of entropy for the pool (N defaults to 0, which 'fills up' the pool's entropy) KeyboardRandom overloads this method.

  * Added src/winrand.c for Crypto.Util.winrandom and
    now use winrandom for _randomize if possible.
    (Calls Windows CryptoAPI CryptGenRandom)

  * Several additional places for stirring the pool,
    capturing inter-event entropy when reading/writing,
    stirring before and after saves.

  * RandomPool.add_event now returns the number of
    estimated bits of added entropy, rather than the
    pool entropy itself (since the pool entropy is
    capped at the number of bits in the pool)

  * Moved termios code from KeyboardRandomPool into a
    KeyboardEntry class, provided a version for Windows
    using msvcrt.

  * Fix randpool.py crash on machines with poor timer resolution.
    (Reported by Mark Moraes and others.)

  * If the GNU GMP library is available, two C extensions will be 
    compiled to speed up RSA and DSA operations.  (Contributed by 
    Paul Swartz.)

  * DES3 with a 24-byte key was broken; now fixed.  
(Patch by Philippe Frycia.)

(Backwards incompatible) The old Crypto.Hash.HMAC module is gone, replaced by a copy of hmac.py from Python 2.2's standard library. It will display a warning on interpreter versions older than 2.2.

  * (Backwards incompatible) Restored the Crypto.Protocol package,
    and modernized and tidied up the two modules in it,
    AllOrNothing.py and Chaffing.py, renaming various methods
    and changing the interface.
    
  * (Backwards incompatible) Changed the function names in
    Crypto.Util.RFC1751.
  
  * Restored the Crypto.PublicKey package at user request.  I
    think I'll leave it in the package and warn about it in the
    documentation.  I hope that eventually I can point to
    someone else's better public-key code, and at that point I
    may insert warnings and begin the process of deprecating
    this code.

  * Fix use of a Python 2.2 C function, replacing it with a 
    2.1-compatible equivalent.  (Bug report and patch by Andrew
    Eland.)  

  * Fix endianness bugs that caused test case failures on Sparc,
    PPC, and doubtless other platforms.

  * Fixed compilation problem on FreeBSD and MacOS X.
  
  * Expanded the test suite (requires Sancho, from 
    http://www.mems-exchange.org/software/sancho/)

  * Added lots of docstrings, so 'pydoc Crypto' now produces 
    helpful output.  (Open question: maybe *all* of the documentation
    should be moved into docstrings?)
    
  * Make test.py automatically add the build/* directory to sys.path.

  * Removed 'inline' declaration from C functions.  Some compilers
    don't support it, and Python's pyconfig.h no longer tells you whether
    it's supported or not.  After this change, some ciphers got slower,
    but others got faster.
    
  * The C-level API has been changed to reduce the amount of
    memory-to-memory copying.   This makes the code neater, but 
    had ambiguous performance effects; again, some ciphers got slower
    and others became faster.  Probably this is due to my compiler
    optimizing slightly worse or better as a result.

  * Moved C source implementations into src/ from block/, hash/, 
    and stream/.  Having Hash/ and hash/ directories causes problems
    on case-insensitive filesystems such as Mac OS.

  * Cleaned up the C code for the extensions.