easy-encryption-tool 2.6.0__tar.gz → 2.8.2__tar.gz

{easy_encryption_tool-2.6.0 → easy_encryption_tool-2.8.2}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: easy_encryption_tool
-Version: 2.6.0
+Version: 2.8.2
 Summary: 易加密 CLI 工具，支持 AES/SM4/ZUC/RSA/ECC/SM2 等加解密与签名验签
 Home-page: https://cipherhub.cloud
 Author: bowenerchen
@@ -30,8 +30,11 @@ Requires-Dist: requests>=2.28
 Requires-Dist: pyopenssl>=24.0
 Requires-Dist: rich>=13.0
 Requires-Dist: rich-click>=1.9.1
+Requires-Dist: prompt-toolkit>=3.0
 Provides-Extra: gmssl
 Requires-Dist: easy_gmssl>=2.0.1; extra == "gmssl"
+Provides-Extra: pqc
+Requires-Dist: cryptography>=45.0; extra == "pqc"
 Provides-Extra: kms
 Requires-Dist: boto3>=1.26; extra == "kms"
 Requires-Dist: tencentcloud-sdk-python-kms>=3.0.0; extra == "kms"
@@ -44,6 +47,19 @@ Requires-Dist: azure-identity>=1.15.0; extra == "kms"
 Provides-Extra: test
 Requires-Dist: pytest>=7.0; extra == "test"
 Requires-Dist: pytest-cov>=4.0; extra == "test"
+Dynamic: author
+Dynamic: author-email
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: keywords
+Dynamic: license
+Dynamic: project-url
+Dynamic: provides-extra
+Dynamic: requires-dist
+Dynamic: requires-python
+Dynamic: summary
 
 # 易加密（easy_encryption_tool）
 
@@ -71,6 +87,20 @@ pip install easy_gmssl
 
 **依赖国密算法的命令**：`hash -a sm3`、`hmac -a sm3`、`sm2`、`sm4`、`zuc`、`cert-parse -g`。未安装 `easy_gmssl` 时，执行这些命令会提示：`xxx 需要 easy_gmssl 库，请执行: pip install easy_gmssl`。
 
+### 后量子算法支持（可选）
+
+如需使用 **后量子算法**（ML-KEM 密钥封装、ML-DSA 签名），需要 `cryptography >= 45`：
+
+```bash
+# 推荐：通过 [pqc] extra 一次性安装并保证 cryptography 版本
+pip install "easy-encryption-tool[pqc]"
+
+# 或：单独升级 cryptography（若已安装 easy-encryption-tool）
+pip install "cryptography>=45"
+```
+
+**依赖后量子的命令**：`pqc mlkem`、`pqc mldsa`。cryptography 版本过旧时，执行这些命令会提示升级；参数集（如 ML-KEM-512）是否可用取决于 cryptography 版本，`easy_encryption_tool version` 的 Dependencies 行会列出。
+
 项目地址：[easy-encryption-tool · PyPI](https://pypi.org/project/easy-encryption-tool/)
 
 ---
@@ -102,9 +132,11 @@ Options:
 Commands:
   aes         aes加解密工具，默认支持 aes-cbc-256 和 aes-gcm-256
   cert-parse  解析 pem 或 der 格式的证书，支持国际算法及国密 SM2（-g）
+  doctor      环境与可选能力体检（cryptography/PQC、easy_gmssl、七家云 KMS）
   ecc         ecc签名验签和密钥交换验证工具
   hash        哈希摘要工具，支持 SM3、SHA256、SHA384、SHA512
   hmac        hmac消息验证码工具，支持 SM3 及国际哈希算法
+  pqc         后量子命令组：ML-KEM 密钥封装与 ML-DSA 签名验签（需 cryptography>=45）
   random-str  随机字符串生成器
   rsa         rsa加解密和签名验签工具
   sm2         国密 SM2 加解密和签名验签工具（多种密文/签名格式）
@@ -126,6 +158,31 @@ source ~/.easy_encryption_tool_complete.sh
 
 补全能力包括：子命令补全、选项补全、固定可选值补全（如 `-A` encrypt/decrypt、`-m` cbc/gcm）、文件路径补全（如 `-i` 在指定 `-f` 时、`-o`、密钥文件路径等）。详见 [CLI 使用说明](../docs/CLI_USAGE_GUIDE.md#4-install-completion---shell-自动补全)。
 
+## 环境与能力体检（eet doctor）
+
+一行命令检查本机环境与全部可选能力，缺什么给什么修复命令：
+
+```python
+❯ easy_encryption_tool doctor
+╭─ eet doctor ─╮
+│ python            ✓ ok        3.12.7                              │
+│ eet               ✓ ok        v2.8.1                              │
+│ cryptography      ✓ ok        48.0.0                              │
+│ pqc               ✓ ok        available (ML-KEM-768/1024, ML-DSA-44/65/87) │
+│ easy_gmssl        ✓ ok        2.0.1 (SM2/SM3/SM4/ZUC)             │
+│ ── cloud KMS backends ──                                            │
+│ kms aws           ✓ ok        boto3                               │
+│ kms tencentcloud  ✓ ok        tencentcloud.kms.v20190118          │
+│ kms aliyun        ✓ ok        alibabacloud_kms20160120            │
+│ kms huawei        ✓ ok        huaweicloudsdkkms                   │
+│ kms google        ✓ ok        google.cloud.kms_v1                 │
+│ kms vault         ✓ ok        hvac                                │
+│ kms azure         ✗ missing   azure.keyvault.keys.crypto          │
+╰────────────────────────────────────────────────────────────────────╯
+```
+
+缺失项的 Fix 列给出对应的 `pip install` 命令（如 `pip install 'easy-encryption-tool[kms]'`）。`doctor` 输出纯表格，不产生 JSON，适合直接阅读与截图排障。
+
 ## 显示版本
 
 ```python
@@ -197,41 +254,92 @@ try write to test_random failed
 
 ```python
 ❯ easy_encryption_tool aes --help
-Usage: main.py aes [OPTIONS]
-
-Options:
-  -m, --mode [cbc|gcm]            aes mode，默认为 cbc 模式，可选 cbc 或 gcm 模式
-                                  [default: cbc]
-  -k, --key TEXT                  key 默认 32 字节，即 256 位，只允许输入可见字符,
-                                  长度不够则自动补齐，长度超出则自动截取  [default:
-                                  kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk]
-  -v, --iv-nonce TEXT             cbc 模式下，iv 默认 16 字节即 128 位，gcm 模式下 nonce 默认
-                                  12 字节即 96 位，长度不够则自动补齐，长度超出则自动截取  [default:
-                                  vvvvvvvvvvvvvvvv]
-  -r, --random-key-iv             是否自动生成随机的密钥和 iv/nonce，如果随机生成，则密钥长度默认 32
-                                  字节，iv 默认为 16 字节， nonce 默认为 12 字节
-  -a, --action [encrypt|decrypt]  加密（encrypt）或 解密（decrypt），加密后输出 base64 编码的字符串
-                                  [default: encrypt]
-  -i, --input-data TEXT           输入数据，即被加密或解密的数据，加密时允许输入：字符串、 base64
-                                  编码数据、文件路径，解密时允许输入：base64 编码数据、文件路径
-                                  [required]
-  -e, --is-base64-encoded         如果 -i/--input-data 的值被 base64 编码过，则需要带上 -e
-                                  参数，-e 与 -f 互斥  [default: False]
-  -f, --is-a-file                 如果 -i/--input-data 的值是一个文件，则需要带上 -f
-                                  参数表示当前需要被处理的是一个文件，-e 与 -f 互斥
-  -l, --input-limit INTEGER       输入内容最大长度，单位为 MB，默认为 1MB，在 -i 为非文件时生效
-                                  [default: 1]
-  -o, --output-file TEXT          指定输出文件，当输入时指定了文件，则输出时必须指定
-  --aad TEXT                      gcm 模式下的关联认证数据 AAD，默认: "密码学人 CipherHUB 默认 AAD 数据"
-  --help                          Show this message and exit.
+                                                                                
+ Usage: eet aes [OPTIONS]                                                       
+                                                                                
+ AES encrypt/decrypt. Encrypt: each missing key/IV piece (-k/-v or b64          
+ variants) is generated from full-entropy CSPRNG bytes and output as base64.    
+ Decrypt: requires explicit key/IV (--key-b64/--iv-b64 or -k/-v). Input:        
+ plaintext (-i), base64 (-e), or file (-f).                                     
+                                                                                
+╭─ Options ────────────────────────────────────────────────────────────────────╮
+│    --mode               -m  [cbc|gcm]          AES mode: cbc or gcm          │
+│                                                [default: cbc]                │
+│    --key                -k  TEXT               Key string (normalized to 32  │
+│                                                bytes / 256-bit,              │
+│                                                CipherHUB-compatible)         │
+│                                                [default:                     │
+│                                                01234567890123456789012345678 │
+│                                                901]                          │
+│    --iv-nonce           -v  TEXT               CBC uses IV (16 bytes); GCM   │
+│                                                uses nonce (12 bytes). String │
+│                                                input is normalized for       │
+│                                                compatibility [default:       │
+│                                                0123456789012345]             │
+│    --aad                    TEXT               GCM additional authenticated  │
+│                                                data (AAD), default:          │
+│                                                "密码学人 CipherHUB 默认 AAD  │
+│                                                数据" [default: 密码学人      │
+│                                                CipherHUB 默认 AAD 数据]      │
+│    --random-key-iv      -r                     Force both key and IV/nonce   │
+│                                                random (encrypt only). On     │
+│                                                encrypt any missing           │
+│                                                -k/-v/--key-b64/--iv-b64      │
+│                                                piece is randomly generated   │
+│                                                anyway and shown as base64;   │
+│                                                use --key-b64/--iv-b64 for    │
+│                                                decrypt. Mutually exclusive   │
+│                                                with                          │
+│                                                -k/-v/--key-b64/--iv-b64.     │
+│    --key-b64                TEXT               Base64 key bytes (must decode │
+│                                                to 32 bytes). Use for decrypt │
+│                                                with key from encrypt -r      │
+│                                                output. Mutually exclusive    │
+│                                                with -k                       │
+│    --iv-b64                 TEXT               Base64 IV/nonce bytes (CBC    │
+│                                                16, GCM 12). Use for decrypt  │
+│                                                with IV from encrypt -r       │
+│                                                output. Mutually exclusive    │
+│                                                with -v                       │
+│    --action             -A  [encrypt|decrypt]  Action: encrypt or decrypt    │
+│                                                [default: encrypt]            │
+│ *  --input-data         -i  TEXT               Input data. Encrypt:          │
+│                                                text/base64/file. Decrypt:    │
+│                                                base64/file [required]        │
+│    --is-base64-encoded  -e                     Interpret -i as base64 data   │
+│                                                (mutually exclusive with -f)  │
+│    --is-a-file          -f                     Interpret -i as file path     │
+│                                                (mutually exclusive with -e)  │
+│    --input-limit        -l  INTEGER            Max non-file input size in MB │
+│                                                [default: 1]                  │
+│    --output-file        -o  TEXT               Output file path (required    │
+│                                                with -f)                      │
+│    --no-force                                  Do not overwrite an existing  │
+│                                                output file                   │
+│    --gcm-pad                                   [GCM only] Enable PKCS#7      │
+│                                                padding before encrypt and    │
+│                                                unpadding after decrypt.      │
+│                                                Default is no padding;        │
+│                                                encrypt and decrypt must both │
+│                                                use or both omit --gcm-pad.   │
+│                                                File decrypt with --gcm-pad   │
+│                                                loads entire file into        │
+│                                                memory; large files may cause │
+│                                                OOM.                          │
+│    --pretty-json                               Output colored pretty JSON    │
+│                                                (default)                     │
+│    --json                                      Output single-line JSON (use  │
+│                                                with jq for field extraction) │
+│    --help                                      Show this message and exit.   │
+╰──────────────────────────────────────────────────────────────────────────────╯
 ```
 
 ### 关于密钥、IV和模式的预设
 
 -   加密模式：仅支持 CBC 模式和 GCM 模式
 -   **填充规则**：CBC 模式始终按 PKCS#7 填充；GCM 模式**默认不填充**（与 CipherHUB stream_cipher 兼容），若需填充可加 `--gcm-pad`，加密与解密需一致使用
--   密钥：默认 32 字节，即 256 位，不足会自动补齐，超过会自动截取
--   IV：CBC 模式下时 IV 长度默认 16 字节，GCM 模式下 Nonce 长度默认 12 字节（其中 4 字节预留作为计数器，由算法自行处理）
+-   密钥：长度必须恰好 32 字节（256 位）。加密时完全不给则随机生成并以 base64 输出；**给了但不足 32 字节会被拒绝**（2.8.1 起不再随机补齐——补齐过的密钥无法复现，密文将永远解不开）；超过 32 字节会截断并警告
+-   IV：CBC 模式下时 IV 长度默认 16 字节，GCM 模式下 Nonce 长度默认 12 字节（其中 4 字节预留作为计数器，由算法自行处理）；与密钥同理——不给则加密时随机生成，给短了拒绝，给长了截断并警告
 
 ### 关于输入数据的预设
 
@@ -1416,6 +1524,67 @@ mode:ECDSA
 ------ d1c74d3acc46413b took 15.220 milli-seconds to execute ------
 ```
 
+## PQC 后量子（ML-KEM / ML-DSA）
+
+后量子命令组 `pqc`，提供 **ML-KEM**（FIPS 203 密钥封装）与 **ML-DSA**（FIPS 204 签名）能力，需要 `cryptography >= 45`。参数集可用性取决于所装 cryptography 版本（`easy_encryption_tool version` 的 Dependencies 行会列出当前可用参数集）。
+
+与 [CipherHUB 工具站](https://cipherhub.cloud) 的互通关系：**公钥可互换**（双方均为 NIST 标准 OID 的 SPKI/PKCS#8，工具站后端 liboqs 生成的公钥可直接喂给本工具 encap/verify）；**私钥不可互换**（本工具私钥为 PKCS#8 种子形态加密存储，工具站为展开形态，二者格式不同）。
+
+### 生成 ML-KEM 密钥对
+
+```shell
+# 私钥强制密码保护：-p 指定密码，或 -r 随机生成（两者都不传默认随机）
+❯ easy_encryption_tool pqc mlkem generate -f demo -p 1234567890 --json
+
+{"metadata": {"operation": "generate", "algorithm": "ML-KEM-768", "parameters": {"encoding": "pem", "seed_derived": false}}, "result": {"public_file": "demo_mlkem768_public.pem", "private_file": "demo_mlkem768_private_cipher.pem", "password": "1234567890"}, "runtime": {"request_id": "a2bac659-2d54-47f2-be3f-aab0fa28174c", "timestamp": "2026-08-28T15:07:32.353623+08:00", "duration_ms": 9.809, "host": "MacM2Max-2.local", "version": "v2.7.0"}}
+```
+
+`-a/--algorithm` 可选 `ML-KEM-512`、`ML-KEM-768`（默认）、`ML-KEM-1024`；`--seed-in-hex` 接受 64 字节 hex（128 个十六进制字符）做确定性派生，仅供教学与向量复现，生产环境留空即随机生成。
+
+### ML-KEM 封装与解封装
+
+发送方持有公钥做封装，得到密文与共享秘密；接收方持私钥解封装还原同一个共享秘密（典型用法：共享秘密作为对称加密的密钥材料）。
+
+```shell
+# 封装：输出 ciphertext（交给孩子信道传输）与 shared_secret（发送方本地留存）
+❯ easy_encryption_tool pqc mlkem encap -f demo_mlkem768_public.pem --json
+
+{"metadata": {"operation": "encap", "algorithm": "ML-KEM-768", "input": {"type": "key"}, "parameters": {"ciphertext_bytes": 1088}}, "result": {"ciphertext_in_hex": "cbf390d5c3a98de7ece00606...（共 2176 个 hex 字符）", "ciphertext_in_base64": "y/OQ1cOpjefs4AYGeHQe/Cf2knCg...（共 1452 个字符）", "ciphertext_bytes": 1088, "shared_secret_in_hex": "ca4954152db0dd42d6e50ff35ecc51a7590bc487cf7339ee352610cc4b7a56c3", "shared_secret_in_base64": "yklUFS2w3ULW5Q/zXsxRp1kLxIfPcznuNSYQzEt6VsM=", "shared_secret_sha256": "b71c5ae5a9132597df7a96250af8b029b24ec1e91ce92cc18de699dd8f35b8cc", "shared_secret_bytes": 32}, "runtime": {...}}
+
+# 解封装：-i 传入封装输出的 ciphertext_in_base64
+❯ easy_encryption_tool pqc mlkem decap -f demo_mlkem768_private_cipher.pem -p 1234567890 -i "<ciphertext_in_base64>" --json
+
+{"metadata": {"operation": "decap", "algorithm": "ML-KEM-768", "input": {"type": "binary", "size": 1088}}, "result": {"shared_secret_in_hex": "9b907dd7844ce9dd906e645ecaaa95936b18b43d7f66b21ae2ef265496ef1f7a", "shared_secret_in_base64": "m5B914RM6d2QbmReyqqVk2sYtD1/ZrIa4u8mVJbvH3o=", "shared_secret_sha256": "c8f5e74ba6ca40c5cef8d72de727c67183b256359c2639fb489e54abcc167697", "shared_secret_bytes": 32}, "runtime": {...}}
+```
+
+注意两次 `shared_secret` 不同是正常的：ML-KEM 封装本身随机化，同一条 ciphertext 的 encap/decap 结果必然一致（上例两段输出来自两次独立的封装）。按 FIPS 203 的隐式拒绝语义，篡改后的 ciphertext 解封装不报错，但得到的共享秘密必然不同——比对 `shared_secret_sha256` 即可发现。
+
+### 生成 ML-DSA 密钥对
+
+```shell
+❯ easy_encryption_tool pqc mldsa generate -f demo -p 1234567890 --json
+
+{"metadata": {"operation": "generate", "algorithm": "ML-DSA-65", "parameters": {"encoding": "pem", "seed_derived": false}}, "result": {"public_file": "demo_mldsa65_public.pem", "private_file": "demo_mldsa65_private_cipher.pem", "password": "1234567890"}, "runtime": {...}}
+```
+
+`-a/--algorithm` 可选 `ML-DSA-44`、`ML-DSA-65`（默认）、`ML-DSA-87`；`--seed-in-hex` 接受 32 字节 hex（64 个十六进制字符）做确定性派生，仅供教学与向量复现。
+
+### ML-DSA 签名与验签
+
+```shell
+# 签名：--context 为可选域分隔字符串（最长 255 字节），验签时必须传同一个值
+❯ easy_encryption_tool pqc mldsa sign -f demo_mldsa65_private_cipher.pem -p 1234567890 -i "hello,post-quantum" --context eet-demo --json
+
+{"metadata": {"operation": "sign", "algorithm": "ML-DSA-65", "input": {"type": "text", "size": 18}, "parameters": {"context": "eet-demo"}}, "result": {"signature_in_hex": "b2de9bf26b6685e2b64d8c348ccf726f...（共 6618 个 hex 字符）", "signature_in_base64": "st6b8mtmheK2TYw0jM9ybwQwSnPvYWp2M+Yk...（共 4412 个字符）", "signature_bytes": 3309}, "runtime": {...}}
+
+# 验签：-s 传入签名输出的 signature_in_base64，--context 必须与签名时一致
+❯ easy_encryption_tool pqc mldsa verify -f demo_mldsa65_public.pem -i "hello,post-quantum" --context eet-demo -s "<signature_in_base64>" --json
+
+{"metadata": {"operation": "verify", "algorithm": "ML-DSA-65", "input": {"type": "text", "size": 18}, "parameters": {"context": "eet-demo"}}, "result": {"valid": true}, "runtime": {...}}
+```
+
+ML-DSA 签名是随机化的：同一私钥对同一消息多次签名结果不同，属正常现象。验签失败（密钥、消息、context 不匹配或签名被篡改）时输出错误文档并以退出码 1 结束。
+
 ## 证书解析与验证
 
 ### 解析证书并验证签名

{easy_encryption_tool-2.6.0 → easy_encryption_tool-2.8.2}/easy_encryption_tool/__init__.py

@@ -3,7 +3,7 @@
 # @Time: 2024-04-04 22:49:35
 
 # Single source version, keep in sync with setup.py
-__version__ = "2.6.0"
+__version__ = "2.8.2"
 
 __all__ = [
     "__version__",
@@ -11,6 +11,7 @@ __all__ = [
     "common",
     "command_perf",
     "convert_command",
+    "doctor_command",
     "ecc_command",
     "envelope_command",
     "hmac_command",
@@ -19,10 +20,13 @@ __all__ = [
     "main",
     "output_builder",
     "output_renderer",
+    "pqc_command",
     "random_str",
     "rsa_command",
     "rich_ui",
+    "shell_command",
     "shell_completion",
+    "smart_group",
     "structured_command",
     "tool_version",
     "ts_command",

{easy_encryption_tool-2.6.0 → easy_encryption_tool-2.8.2}/easy_encryption_tool/aes_command.py

@@ -650,9 +650,14 @@ def aes_command(
             except ValueError as e:
                 err_msg = str(e).lower()
                 if "padding" in err_msg or "pkcs7" in err_msg:
-                    error(
-                        "decrypt failed: PKCS#7 unpad error. If cipher was GCM-encrypted without padding, retry without --gcm-pad"
-                    )
+                    if mode == aes_gcm_mode:
+                        error(
+                            "decrypt failed: PKCS#7 unpad error. If cipher was GCM-encrypted without padding, retry without --gcm-pad"
+                        )
+                    else:
+                        error(
+                            "decrypt failed: PKCS#7 unpad error (wrong key/IV or corrupted ciphertext)"
+                        )
                 else:
                     error("decrypt failed: {}".format(e))
                 hint_msg = validators.hint_decrypt_maybe_b64(input_data, "AES decrypt")
@@ -1005,7 +1010,7 @@ def aes_command(
                         err_msg = str(e).lower()
                         if "padding" in err_msg or "pkcs7" in err_msg:
                             error(
-                                "decrypt failed: PKCS#7 unpad error. If cipher was GCM-encrypted without padding, retry without --gcm-pad"
+                                "decrypt failed: PKCS#7 unpad error (wrong key/IV or corrupted ciphertext)"
                             )
                         else:
                             error("decrypt {} failed: {}".format(input_data, e))

{easy_encryption_tool-2.6.0 → easy_encryption_tool-2.8.2}/easy_encryption_tool/cert_parse.py

@@ -67,6 +67,10 @@ OID_AD_CA_ISSUERS = "1.3.6.1.5.5.7.48.2"
 OID_AD_OCSP = "1.3.6.1.5.5.7.48.1"
 
 AuthorityInformationAccessCAIssuers = "caIssuers"
+
+# A CA issuer certificate is a few KB; anything past this is not a certificate
+# but someone using the AIA fetch as a download pipe.
+MAX_CA_ISSUER_BYTES = 1024 * 1024
 AuthorityInformationAccessOCSP = "OCSP"
 AuthorityInformationAccess = (
     "x509.AuthorityInformationAccess",
@@ -286,15 +290,30 @@ def read_file_from_url(url: str) -> tuple[bytes | None, str | None]:
     - (bytes, None): success
     - (None, "empty_url"): url empty or None
     - (None, "http_NNN"): non-200 status
+    - (None, "too_large"): response exceeded MAX_CA_ISSUER_BYTES
     - (None, "network"): timeout or connection error
     """
     if url is None or not str(url).strip():
         return None, "empty_url"
     try:
-        response = requests.get(url, timeout=10)
-        if response.status_code == 200:
-            return response.content, None
-        return None, "http_{}".format(response.status_code)
+        response = requests.get(url, timeout=10, stream=True)
+        if response.status_code != 200:
+            response.close()
+            return None, "http_{}".format(response.status_code)
+        # The URL comes from the certificate being parsed, which may be
+        # attacker-controlled; never buffer an unbounded response body.
+        chunks: list[bytes] = []
+        total = 0
+        for chunk in response.iter_content(chunk_size=64 * 1024):
+            if not chunk:
+                continue
+            total += len(chunk)
+            if total > MAX_CA_ISSUER_BYTES:
+                response.close()
+                return None, "too_large"
+            chunks.append(chunk)
+        response.close()
+        return b"".join(chunks), None
     except requests.Timeout:
         return None, "timeout"
     except requests.RequestException:
@@ -368,6 +387,12 @@ def verify_cert_file_signature_from_ca_issuer(cert: X509, ca_issuer_url: str):
                     fetch_err.replace("http_", ""), ca_issuer_url
                 )
             )
+        if fetch_err == "too_large":
+            raise ValueError(
+                "CA issuer response exceeds {} bytes, aborting download: {}".format(
+                    MAX_CA_ISSUER_BYTES, ca_issuer_url
+                )
+            )
         raise ValueError(
             "fetch CA issuer cert failed (network error): {}".format(ca_issuer_url)
         )
@@ -384,6 +409,10 @@ def verify_cert_file_signature_from_ca_issuer(cert: X509, ca_issuer_url: str):
             continue
         try:
             verify_cert_signature(cert, ca_cert)
+        except ValueError:
+            # carries an actionable reason (unsupported CA key type, load
+            # failure) — don't flatten it into a generic verify failure
+            raise
         except BaseException:
             raise InvalidSignature(
                 "verify cert signature failed, ca issuer: {}".format(
@@ -505,6 +534,17 @@ def _parse_sm2_cert(cert_file: str, verbose: bool) -> tuple[dict[str, Any] | Non
     show_default=True,
     help="Show verbose certificate details",
 )
+@click.option(
+    "--fetch-aia",
+    required=False,
+    type=click.BOOL,
+    is_flag=True,
+    default=False,
+    help=(
+        "Fetch the certificate's AIA caIssuers URL to verify its signature "
+        "(makes a network request to a URL found inside the cert; opt-in)"
+    ),
+)
 @output_format_options
 @command_perf.timing_decorator
 def parse_x509_cert_file(
@@ -512,6 +552,7 @@ def parse_x509_cert_file(
     encoding: click.STRING,
     gm_cert: click.BOOL,
     verbose: click.BOOL,
+    fetch_aia: click.BOOL,
     output_format: str | None,
 ):
     request_id = create_request_id()
@@ -588,6 +629,14 @@ def parse_x509_cert_file(
                     "status": "skipped",
                     "message": "AIA caIssuers URL is empty, skip signature verification",
                 }
+            elif not fetch_aia:
+                verification = {
+                    "status": "skipped",
+                    "message": (
+                        "AIA signature verification skipped (offline mode); "
+                        "pass --fetch-aia to fetch the caIssuers URL"
+                    ),
+                }
             else:
                 try:
                     verify_cert_file_signature_from_ca_issuer(cert, ca_issuer_url)
@@ -617,7 +666,12 @@ def parse_x509_cert_file(
         algorithm="x509-certificate",
         input_type="file",
         input_size=len(cert_raw_bytes),
-        parameters={"encoding": encoding, "gm_cert": gm_cert, "verbose": verbose},
+        parameters={
+            "encoding": encoding,
+            "gm_cert": gm_cert,
+            "verbose": verbose,
+            "fetch_aia": fetch_aia,
+        },
     )
     result = build_result(
         certificate_type="x509",

{easy_encryption_tool-2.6.0 → easy_encryption_tool-2.8.2}/easy_encryption_tool/common.py

@@ -211,11 +211,22 @@ def resolve_symmetric_key_iv(
                 return None
             return ib, "", False
         if from_cli:
-            fitted, padded, truncated = _fit_str(text_val or "", length)
-            if padded:
-                warning(
-                    "Key/IV was padded (short input). Ensure compatibility with peer; consider using full-length key/IV."
+            piece_label = "key" if piece == "key" else "IV/nonce"
+            raw_len = len((text_val or "").encode("utf-8"))
+            if raw_len < length:
+                # Random padding made short inputs "work" for encryption but
+                # the padded value is never shown, so the ciphertext could not
+                # be decrypted again by anyone. Refuse instead (N4).
+                error(
+                    "{}: {} is {} bytes but this operation requires exactly {} "
+                    "bytes; short values are rejected instead of being padded "
+                    "with random bytes (a padded value could never be "
+                    "reproduced for decryption)".format(
+                        algo, piece_label, raw_len, length
+                    )
                 )
+                return None
+            fitted, padded, truncated = _fit_str(text_val or "", length)
             if truncated:
                 warning(
                     "Key/IV was truncated (long input). Ensure compatibility with peer; consider using exact-length key/IV."

{easy_encryption_tool-2.6.0 → easy_encryption_tool-2.8.2}/easy_encryption_tool/convert_command.py

@@ -7,7 +7,6 @@ from __future__ import annotations
 
 import base64
 import binascii
-import string
 import time
 
 import click
@@ -25,18 +24,24 @@ from easy_encryption_tool.output_renderer import (
     resolve_output_format,
 )
 from easy_encryption_tool.rich_ui import error
+from easy_encryption_tool.smart_group import SmartGroup
 
 
 def _is_printable_utf8(data: bytes) -> bool:
     """Return True when bytes decode to printable UTF-8 text."""
     try:
-        s = data.decode("utf-8")
-        return all(c in string.printable for c in s)
+        # str.isprintable() covers all printable Unicode (CJK included),
+        # unlike string.printable which is ASCII-only. It does however reject
+        # control whitespace (\n, \t, \r, ...) that string.printable allowed,
+        # so accept whitespace explicitly: multiline text must stay UTF-8,
+        # not fall through to hex/base64.
+        text = data.decode("utf-8")
+        return all(c.isprintable() or c.isspace() for c in text)
     except UnicodeDecodeError:
         return False
 
 
-@click.group(name="convert", short_help="String format conversion: UTF-8, Base64, Hex")
+@click.group(name="convert", short_help="String format conversion: UTF-8, Base64, Hex", cls=SmartGroup)
 def convert_group():
     """Convert between UTF-8 text, Base64, and Hex representations."""
     pass