cryptography 46.0.3__tar.gz → 46.0.5__tar.gz

{cryptography-46.0.3 → cryptography-46.0.5}/CHANGELOG.rst

@@ -1,6 +1,29 @@
 Changelog
 =========
 
+.. _v46-0-5:
+
+46.0.5 - 2026-02-10
+~~~~~~~~~~~~~~~~~~~
+
+* An attacker could create a malicious public key that reveals portions of your
+  private key when using certain uncommon elliptic curves (binary curves).
+  This version now includes additional security checks to prevent this attack.
+  This issue only affects binary elliptic curves, which are rarely used in
+  real-world applications. Credit to **XlabAI Team of Tencent Xuanwu Lab and
+  Atuin Automated Vulnerability Discovery Engine** for reporting the issue.
+  **CVE-2026-26007**
+* Support for ``SECT*`` binary elliptic curves is deprecated and will be
+  removed in the next release.
+
+.. v46-0-4:
+
+46.0.4 - 2026-01-27
+~~~~~~~~~~~~~~~~~~~
+
+* `Dropped support for win_arm64 wheels`_.
+* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.
+
 .. _v46-0-3:
 
 46.0.3 - 2025-10-15
@@ -2763,3 +2786,4 @@ Changelog
 .. _`main`: https://github.com/pyca/cryptography/
 .. _`cffi`: https://cffi.readthedocs.io/
 .. _`aws-lc`: https://github.com/aws/aws-lc
+.. _`Dropped support for win_arm64 wheels`: https://github.com/pyca/cryptography/pull/14216

{cryptography-46.0.3 → cryptography-46.0.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cryptography
-Version: 46.0.3
+Version: 46.0.5
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
 Classifier: Natural Language :: English
@@ -28,7 +28,7 @@ Requires-Dist: cffi>=2.0.0 ; python_full_version >= '3.9' and platform_python_im
 Requires-Dist: typing-extensions>=4.13.2 ; python_full_version < '3.11'
 Requires-Dist: bcrypt>=3.1.5 ; extra == 'ssh'
 Requires-Dist: nox[uv]>=2024.4.15 ; extra == 'nox'
-Requires-Dist: cryptography-vectors==46.0.3 ; extra == 'test'
+Requires-Dist: cryptography-vectors==46.0.5 ; extra == 'test'
 Requires-Dist: pytest>=7.4.0 ; extra == 'test'
 Requires-Dist: pytest-benchmark>=4.0 ; extra == 'test'
 Requires-Dist: pytest-cov>=2.10.1 ; extra == 'test'

{cryptography-46.0.3 → cryptography-46.0.5}/docs/installation.rst

@@ -35,7 +35,6 @@ operating systems.
   Sid (unstable)
 * x86-64 and ARM64 Alpine (latest)
 * 32-bit and 64-bit Python on 64-bit Windows Server 2022
-* ARM64 Windows 11
 
 We test compiling with ``clang`` as well as ``gcc`` and use the following
 OpenSSL releases in addition to distribution provided releases from the

{cryptography-46.0.3 → cryptography-46.0.5}/pyproject.toml

@@ -16,7 +16,7 @@ build-backend = "maturin"
 
 [project]
 name = "cryptography"
-version = "46.0.3"
+version = "46.0.5"
 authors = [
     { name = "The Python Cryptographic Authority and individual contributors", email = "cryptography-dev@python.org" },
 ]
@@ -70,7 +70,7 @@ ssh = ["bcrypt >=3.1.5"]
 # All the following are used for our own testing.
 nox = ["nox[uv] >=2024.04.15"]
 test = [
-    "cryptography_vectors==46.0.3",
+    "cryptography_vectors==46.0.5",
     "pytest >=7.4.0",
     "pytest-benchmark >=4.0",
     "pytest-cov >=2.10.1",

{cryptography-46.0.3 → cryptography-46.0.5}/src/cryptography/__about__.py

@@ -10,7 +10,7 @@ __all__ = [
     "__version__",
 ]
 
-__version__ = "46.0.3"
+__version__ = "46.0.5"
 
 
 __author__ = "The Python Cryptographic Authority and individual contributors"

{cryptography-46.0.3 → cryptography-46.0.5}/src/cryptography/hazmat/primitives/asymmetric/ec.py

@@ -445,3 +445,26 @@ def get_curve_for_oid(oid: ObjectIdentifier) -> type[EllipticCurve]:
             "The provided object identifier has no matching elliptic "
             "curve class"
         )
+
+
+_SECT_CURVES: tuple[type[EllipticCurve], ...] = (
+    SECT163K1,
+    SECT163R2,
+    SECT233K1,
+    SECT233R1,
+    SECT283K1,
+    SECT283R1,
+    SECT409K1,
+    SECT409R1,
+    SECT571K1,
+    SECT571R1,
+)
+
+for _curve_cls in _SECT_CURVES:
+    utils.deprecated(
+        _curve_cls,
+        __name__,
+        f"{_curve_cls.__name__} will be removed in the next release.",
+        utils.DeprecatedIn46,
+        name=_curve_cls.__name__,
+    )

{cryptography-46.0.3 → cryptography-46.0.5}/src/cryptography/utils.py

@@ -26,6 +26,7 @@ DeprecatedIn40 = CryptographyDeprecationWarning
 DeprecatedIn41 = CryptographyDeprecationWarning
 DeprecatedIn42 = CryptographyDeprecationWarning
 DeprecatedIn43 = CryptographyDeprecationWarning
+DeprecatedIn46 = CryptographyDeprecationWarning
 
 
 # If you're wondering why we don't use `Buffer`, it's because `Buffer` would

{cryptography-46.0.3 → cryptography-46.0.5}/src/rust/src/backend/ec.rs

@@ -135,12 +135,10 @@ pub(crate) fn public_key_from_pkey(
 ) -> CryptographyResult<ECPublicKey> {
     let ec = pkey.ec_key()?;
     let curve = py_curve_from_curve(py, ec.group())?;
-    check_key_infinity(&ec)?;
-    Ok(ECPublicKey {
-        pkey: pkey.to_owned(),
-        curve: curve.into(),
-    })
+
+    ECPublicKey::new(pkey.to_owned(), curve.into())
 }
+
 #[pyo3::pyfunction]
 #[pyo3(signature = (curve, backend=None))]
 fn generate_private_key(
@@ -198,10 +196,7 @@ fn from_public_bytes(
     let ec = openssl::ec::EcKey::from_public_key(&curve, &point)?;
     let pkey = openssl::pkey::PKey::from_ec_key(ec)?;
 
-    Ok(ECPublicKey {
-        pkey,
-        curve: py_curve.into(),
-    })
+    ECPublicKey::new(pkey, py_curve.into())
 }
 
 #[pyo3::pymethods]
@@ -367,6 +362,29 @@ impl ECPrivateKey {
     }
 }
 
+impl ECPublicKey {
+    fn new(
+        pkey: openssl::pkey::PKey<openssl::pkey::Public>,
+        curve: pyo3::Py<pyo3::PyAny>,
+    ) -> CryptographyResult<ECPublicKey> {
+        let ec = pkey.ec_key()?;
+        check_key_infinity(&ec)?;
+        let mut bn_ctx = openssl::bn::BigNumContext::new()?;
+        let mut cofactor = openssl::bn::BigNum::new()?;
+        ec.group().cofactor(&mut cofactor, &mut bn_ctx)?;
+        let one = openssl::bn::BigNum::from_u32(1)?;
+        if cofactor != one {
+            ec.check_key().map_err(|_| {
+                pyo3::exceptions::PyValueError::new_err(
+                    "Invalid EC key (key out of range, infinity, etc.)",
+                )
+            })?;
+        }
+
+        Ok(ECPublicKey { pkey, curve })
+    }
+}
+
 #[pyo3::pymethods]
 impl ECPublicKey {
     #[getter]
@@ -606,10 +624,7 @@ impl EllipticCurvePublicNumbers {
 
         let pkey = openssl::pkey::PKey::from_ec_key(public_key)?;
 
-        Ok(ECPublicKey {
-            pkey,
-            curve: self.curve.clone_ref(py),
-        })
+        ECPublicKey::new(pkey, self.curve.clone_ref(py))
     }
 
     fn __eq__(

{cryptography-46.0.3 → cryptography-46.0.5}/tests/hazmat/primitives/test_ec.py

@@ -1542,3 +1542,40 @@ class TestECDH:
 
         with pytest.raises(ValueError):
             key.exchange(ec.ECDH(), public_key)
+
+
+def test_invalid_sect_public_keys(backend):
+    _skip_curve_unsupported(backend, ec.SECT571K1())
+    public_numbers = ec.EllipticCurvePublicNumbers(1, 1, ec.SECT571K1())
+    with pytest.raises(ValueError):
+        public_numbers.public_key()
+
+    point = binascii.unhexlify(
+        b"0400000000000000000000000000000000000000000000000000000000000000000"
+        b"0000000000000000000000000000000000000000000000000000000000000000000"
+        b"0000000000010000000000000000000000000000000000000000000000000000000"
+        b"0000000000000000000000000000000000000000000000000000000000000000000"
+        b"0000000000000000000001"
+    )
+    with pytest.raises(ValueError):
+        ec.EllipticCurvePublicKey.from_encoded_point(ec.SECT571K1(), point)
+
+    der = binascii.unhexlify(
+        b"3081a7301006072a8648ce3d020106052b810400260381920004000000000000000"
+        b"0000000000000000000000000000000000000000000000000000000000000000000"
+        b"0000000000000000000000000000000000000000000000000000000000000100000"
+        b"0000000000000000000000000000000000000000000000000000000000000000000"
+        b"0000000000000000000000000000000000000000000000000000000000000000000"
+        b"00001"
+    )
+    with pytest.raises(ValueError):
+        serialization.load_der_public_key(der)
+
+    pem = textwrap.dedent("""-----BEGIN PUBLIC KEY-----
+    MIGnMBAGByqGSM49AgEGBSuBBAAmA4GSAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    AAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE=
+    -----END PUBLIC KEY-----""").encode()
+    with pytest.raises(ValueError):
+        serialization.load_pem_public_key(pem)