tigrcorn-security 0.3.18.dev1__tar.gz → 0.3.18.dev3__tar.gz

{tigrcorn_security-0.3.18.dev1 → tigrcorn_security-0.3.18.dev3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tigrcorn-security
-Version: 0.3.18.dev1
+Version: 0.3.18.dev3
 Summary: TLS 1.3, mTLS, X.509, ALPN, OCSP, CRL, and certificate policy surfaces for the Tigrcorn Python web server.
 Author-email: Jacob Stewart <jacob@swarmauri.com>
 License: Apache License
@@ -187,8 +187,8 @@ Classifier: Typing :: Typed
 Requires-Python: <3.15,>=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: tigrcorn-core==0.3.18.dev1
-Requires-Dist: tigrcorn-config==0.3.18.dev1
+Requires-Dist: tigrcorn-core==0.3.18.dev3
+Requires-Dist: tigrcorn-config==0.3.18.dev3
 Provides-Extra: x509
 Requires-Dist: cryptography>=46.0.0; extra == "x509"
 Dynamic: license-file
@@ -280,7 +280,7 @@ The package exposes its supported public surface through the <code>tigrcorn_secu
 
 ## Package Graph
 
-[tigrcorn-core](https://pypi.org/project/tigrcorn-core/) | [tigrcorn-config](https://pypi.org/project/tigrcorn-config/) | [tigrcorn-http](https://pypi.org/project/tigrcorn-http/) | [tigrcorn-asgi](https://pypi.org/project/tigrcorn-asgi/) | [tigrcorn-contract](https://pypi.org/project/tigrcorn-contract/) | [tigrcorn-transports](https://pypi.org/project/tigrcorn-transports/) | [tigrcorn-security](https://pypi.org/project/tigrcorn-security/) | [tigrcorn-protocols](https://pypi.org/project/tigrcorn-protocols/) | [tigrcorn-static](https://pypi.org/project/tigrcorn-static/) | [tigrcorn-observability](https://pypi.org/project/tigrcorn-observability/) | [tigrcorn-runtime](https://pypi.org/project/tigrcorn-runtime/) | [tigrcorn-compat](https://pypi.org/project/tigrcorn-compat/) | [tigrcorn-certification](https://pypi.org/project/tigrcorn-certification/)
+[tigrcorn-core](https://pypi.org/project/tigrcorn-core/) | [tigrcorn-quic-cc](https://pypi.org/project/tigrcorn-quic-cc/) | [tigrcorn-quic-cc-reno](https://pypi.org/project/tigrcorn-quic-cc-reno/) | [tigrcorn-config](https://pypi.org/project/tigrcorn-config/) | [tigrcorn-http](https://pypi.org/project/tigrcorn-http/) | [tigrcorn-asgi](https://pypi.org/project/tigrcorn-asgi/) | [tigrcorn-contract](https://pypi.org/project/tigrcorn-contract/) | [tigrcorn-transports](https://pypi.org/project/tigrcorn-transports/) | [tigrcorn-security](https://pypi.org/project/tigrcorn-security/) | [tigrcorn-protocols](https://pypi.org/project/tigrcorn-protocols/) | [tigrcorn-static](https://pypi.org/project/tigrcorn-static/) | [tigrcorn-observability](https://pypi.org/project/tigrcorn-observability/) | [tigrcorn-runtime](https://pypi.org/project/tigrcorn-runtime/) | [tigrcorn-compat](https://pypi.org/project/tigrcorn-compat/) | [tigrcorn-certification](https://pypi.org/project/tigrcorn-certification/)
 
 ## Best Practices
 

{tigrcorn_security-0.3.18.dev1 → tigrcorn_security-0.3.18.dev3}/README.md

@@ -85,7 +85,7 @@ The package exposes its supported public surface through the <code>tigrcorn_secu
 
 ## Package Graph
 
-[tigrcorn-core](https://pypi.org/project/tigrcorn-core/) | [tigrcorn-config](https://pypi.org/project/tigrcorn-config/) | [tigrcorn-http](https://pypi.org/project/tigrcorn-http/) | [tigrcorn-asgi](https://pypi.org/project/tigrcorn-asgi/) | [tigrcorn-contract](https://pypi.org/project/tigrcorn-contract/) | [tigrcorn-transports](https://pypi.org/project/tigrcorn-transports/) | [tigrcorn-security](https://pypi.org/project/tigrcorn-security/) | [tigrcorn-protocols](https://pypi.org/project/tigrcorn-protocols/) | [tigrcorn-static](https://pypi.org/project/tigrcorn-static/) | [tigrcorn-observability](https://pypi.org/project/tigrcorn-observability/) | [tigrcorn-runtime](https://pypi.org/project/tigrcorn-runtime/) | [tigrcorn-compat](https://pypi.org/project/tigrcorn-compat/) | [tigrcorn-certification](https://pypi.org/project/tigrcorn-certification/)
+[tigrcorn-core](https://pypi.org/project/tigrcorn-core/) | [tigrcorn-quic-cc](https://pypi.org/project/tigrcorn-quic-cc/) | [tigrcorn-quic-cc-reno](https://pypi.org/project/tigrcorn-quic-cc-reno/) | [tigrcorn-config](https://pypi.org/project/tigrcorn-config/) | [tigrcorn-http](https://pypi.org/project/tigrcorn-http/) | [tigrcorn-asgi](https://pypi.org/project/tigrcorn-asgi/) | [tigrcorn-contract](https://pypi.org/project/tigrcorn-contract/) | [tigrcorn-transports](https://pypi.org/project/tigrcorn-transports/) | [tigrcorn-security](https://pypi.org/project/tigrcorn-security/) | [tigrcorn-protocols](https://pypi.org/project/tigrcorn-protocols/) | [tigrcorn-static](https://pypi.org/project/tigrcorn-static/) | [tigrcorn-observability](https://pypi.org/project/tigrcorn-observability/) | [tigrcorn-runtime](https://pypi.org/project/tigrcorn-runtime/) | [tigrcorn-compat](https://pypi.org/project/tigrcorn-compat/) | [tigrcorn-certification](https://pypi.org/project/tigrcorn-certification/)
 
 ## Best Practices
 

{tigrcorn_security-0.3.18.dev1 → tigrcorn_security-0.3.18.dev3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "tigrcorn-security"
-version = "0.3.18.dev1"
+version = "0.3.18.dev3"
 description = "TLS 1.3, mTLS, X.509, ALPN, OCSP, CRL, and certificate policy surfaces for the Tigrcorn Python web server."
 readme = "README.md"
 requires-python = ">=3.10,<3.15"
@@ -30,8 +30,8 @@ classifiers = [
   "Typing :: Typed",
 ]
 dependencies = [
-  "tigrcorn-core==0.3.18.dev1",
-  "tigrcorn-config==0.3.18.dev1",
+  "tigrcorn-core==0.3.18.dev3",
+  "tigrcorn-config==0.3.18.dev3",
 ]
 
 [project.optional-dependencies]

{tigrcorn_security-0.3.18.dev1 → tigrcorn_security-0.3.18.dev3}/src/tigrcorn_security/tls13/__init__.py

@@ -6,6 +6,7 @@ from .extensions import (
     QUIC_EARLY_DATA_SENTINEL,
     SIG_RSA_PKCS1_SHA256,
     SIG_ECDSA_SECP256R1_SHA256,
+    SIG_ECDSA_SECP384R1_SHA384,
     SIG_ED25519,
     SIG_RSA_PSS_PSS_SHA256,
     SIG_RSA_PSS_RSAE_SHA256,
@@ -36,6 +37,7 @@ __all__ = [
     'QUIC_EARLY_DATA_SENTINEL',
     'SIG_RSA_PKCS1_SHA256',
     'SIG_ECDSA_SECP256R1_SHA256',
+    'SIG_ECDSA_SECP384R1_SHA384',
     'SIG_ED25519',
     'SIG_RSA_PSS_RSAE_SHA256',
     'SIG_RSA_PSS_PSS_SHA256',

{tigrcorn_security-0.3.18.dev1 → tigrcorn_security-0.3.18.dev3}/src/tigrcorn_security/tls13/extensions/__init__.py

@@ -12,7 +12,7 @@ from .registry import *
 
 SUPPORTED_CIPHER_SUITES = (CIPHER_TLS_AES_256_GCM_SHA384, CIPHER_TLS_AES_128_GCM_SHA256)
 SUPPORTED_GROUPS = (GROUP_X25519, GROUP_SECP256R1)
-SUPPORTED_SIGNATURE_SCHEMES = (SIG_ED25519, SIG_ECDSA_SECP256R1_SHA256, SIG_RSA_PSS_RSAE_SHA256, SIG_RSA_PSS_PSS_SHA256)
+SUPPORTED_SIGNATURE_SCHEMES = (SIG_ED25519, SIG_ECDSA_SECP256R1_SHA256, SIG_ECDSA_SECP384R1_SHA384, SIG_RSA_PSS_RSAE_SHA256, SIG_RSA_PSS_PSS_SHA256)
 SUPPORTED_CERTIFICATE_SIGNATURE_SCHEMES = SUPPORTED_SIGNATURE_SCHEMES
 
 __all__ = [name for name in globals() if not name.startswith('__')]

{tigrcorn_security-0.3.18.dev1 → tigrcorn_security-0.3.18.dev3}/src/tigrcorn_security/tls13/extensions/imports.py

@@ -18,6 +18,7 @@ GROUP_X25519 = 0x001D
 
 SIG_RSA_PKCS1_SHA256 = 0x0401
 SIG_ECDSA_SECP256R1_SHA256 = 0x0403
+SIG_ECDSA_SECP384R1_SHA384 = 0x0503
 SIG_RSA_PSS_RSAE_SHA256 = 0x0804
 SIG_ED25519 = 0x0807
 SIG_RSA_PSS_PSS_SHA256 = 0x0809

{tigrcorn_security-0.3.18.dev1 → tigrcorn_security-0.3.18.dev3}/src/tigrcorn_security/tls13/extensions/models.py

@@ -62,14 +62,15 @@ _TP_ACTIVE_CONNECTION_ID_LIMIT = 0x0E
 _TP_INITIAL_SOURCE_CONNECTION_ID = 0x0F
 _TP_RETRY_SOURCE_CONNECTION_ID = 0x10
 _TP_MAX_DATAGRAM_FRAME_SIZE = 0x20
+_TP_RESET_STREAM_AT = 0x17F7586D2CB571
 
 
 @dataclass(slots=True)
 class TransportParameters:
-    max_data: int = 65536
-    max_stream_data_bidi_local: int = 65536
-    max_stream_data_bidi_remote: int = 65536
-    max_stream_data_uni: int = 65536
+    max_data: int = 16 * 1024 * 1024
+    max_stream_data_bidi_local: int = 2 * 1024 * 1024
+    max_stream_data_bidi_remote: int = 2 * 1024 * 1024
+    max_stream_data_uni: int = 2 * 1024 * 1024
     max_streams_bidi: int = 128
     max_streams_uni: int = 128
     idle_timeout: int = 30000
@@ -84,6 +85,7 @@ class TransportParameters:
     initial_source_connection_id: bytes | None = None
     retry_source_connection_id: bytes | None = None
     max_datagram_frame_size: int | None = None
+    reset_stream_at: bool = False
     unknown_parameters: dict[int, bytes] = field(default_factory=dict)
 
     def __post_init__(self) -> None:
@@ -138,6 +140,9 @@ class TransportParameters:
         add_bytes(_TP_INITIAL_SOURCE_CONNECTION_ID, self.initial_source_connection_id)
         add_bytes(_TP_RETRY_SOURCE_CONNECTION_ID, self.retry_source_connection_id)
         add_int(_TP_MAX_DATAGRAM_FRAME_SIZE, self.max_datagram_frame_size)
+        if self.reset_stream_at:
+            payload.extend(encode_quic_varint(_TP_RESET_STREAM_AT))
+            payload.extend(encode_quic_varint(0))
         for parameter_id, value in sorted(self.unknown_parameters.items()):
             payload.extend(encode_quic_varint(parameter_id))
             payload.extend(encode_quic_varint(len(value)))
@@ -207,6 +212,10 @@ class TransportParameters:
                 values['retry_source_connection_id'] = raw
             elif parameter_id == _TP_MAX_DATAGRAM_FRAME_SIZE:
                 values['max_datagram_frame_size'] = decode_int(raw)
+            elif parameter_id == _TP_RESET_STREAM_AT:
+                if raw:
+                    raise ProtocolError('reset_stream_at transport parameter must be empty')
+                values['reset_stream_at'] = True
             else:
                 values['unknown_parameters'][parameter_id] = raw
         return cls(**values)
@@ -231,6 +240,7 @@ class TransportParameters:
             and current.ack_delay_exponent == self.ack_delay_exponent
             and current.max_ack_delay == self.max_ack_delay
             and current.disable_active_migration == self.disable_active_migration
+            and (not self.reset_stream_at or current.reset_stream_at)
         )
 
 
@@ -239,12 +249,14 @@ SUPPORTED_SIGNATURE_SCHEMES = (
     SIG_RSA_PSS_RSAE_SHA256,
     SIG_RSA_PSS_PSS_SHA256,
     SIG_ECDSA_SECP256R1_SHA256,
+    SIG_ECDSA_SECP384R1_SHA384,
 )
 SUPPORTED_CERTIFICATE_SIGNATURE_SCHEMES = (
     SIG_ED25519,
     SIG_RSA_PSS_RSAE_SHA256,
     SIG_RSA_PSS_PSS_SHA256,
     SIG_ECDSA_SECP256R1_SHA256,
+    SIG_ECDSA_SECP384R1_SHA384,
     SIG_RSA_PKCS1_SHA256,
 )
 SUPPORTED_GROUPS = (

{tigrcorn_security-0.3.18.dev1 → tigrcorn_security-0.3.18.dev3}/src/tigrcorn_security/tls13/handshake/imports.py

@@ -52,6 +52,7 @@ from tigrcorn_security.tls13.extensions import (
     PSK_MODE_DHE_KE,
     QUIC_EARLY_DATA_SENTINEL,
     SIG_ECDSA_SECP256R1_SHA256,
+    SIG_ECDSA_SECP384R1_SHA384,
     SIG_ED25519,
     SIG_RSA_PSS_PSS_SHA256,
     SIG_RSA_PSS_RSAE_SHA256,

{tigrcorn_security-0.3.18.dev1 → tigrcorn_security-0.3.18.dev3}/src/tigrcorn_security/tls13/handshake/server.py

@@ -12,6 +12,7 @@ from .certificates import *
 
 class _QuicTlsServerHandshakeMixin:
     def _handle_client_hello(self, message: ClientHello, *, raw_message: bytes | None = None) -> bytes:
+        encoded_client_hello = raw_message if raw_message is not None else message.encode()
         extension_types = [int(extension.extension_type) for extension in message.extensions]
         if ExtensionType.PRE_SHARED_KEY in extension_types and extension_types[-1] != ExtensionType.PRE_SHARED_KEY:
             _raise_tls(AlertDescription.ILLEGAL_PARAMETER, 'pre_shared_key must be the final ClientHello extension')
@@ -149,7 +150,7 @@ class _QuicTlsServerHandshakeMixin:
                 self._selected_psk_index = index
                 self._selected_psk_ticket = ticket
                 self._early_secret = early_secret
-                self._client_early_secret = self._key_schedule.client_early_traffic_secret(early_secret, message.encode())
+                self._client_early_secret = self._key_schedule.client_early_traffic_secret(early_secret, encoded_client_hello)
                 if (
                     self.transport_mode == 'quic'
                     and client_requested_early_data
@@ -169,7 +170,7 @@ class _QuicTlsServerHandshakeMixin:
             self.early_data_accepted = False
 
         self._last_client_hello = message
-        self._last_client_hello_bytes = message.encode()
+        self._last_client_hello_bytes = encoded_client_hello
         self._transcript.append(self._last_client_hello_bytes)
 
         assert selected_group is not None

{tigrcorn_security-0.3.18.dev1 → tigrcorn_security-0.3.18.dev3}/src/tigrcorn_security/tls13/handshake/signatures.py

@@ -10,7 +10,10 @@ def _signature_algorithms_for_public_key(public_key: object) -> tuple[int, ...]:
     if isinstance(public_key, rsa.RSAPublicKey):
         return (SIG_RSA_PSS_RSAE_SHA256, SIG_RSA_PSS_PSS_SHA256)
     if isinstance(public_key, ec.EllipticCurvePublicKey):
-        return (SIG_ECDSA_SECP256R1_SHA256,)
+        if isinstance(public_key.curve, ec.SECP256R1):
+            return (SIG_ECDSA_SECP256R1_SHA256,)
+        if isinstance(public_key.curve, ec.SECP384R1):
+            return (SIG_ECDSA_SECP384R1_SHA384,)
     return ()
 
 
@@ -38,9 +41,13 @@ def _sign_with_scheme(private_key: object, scheme: int, payload: bytes) -> bytes
             hashes.SHA256(),
         )
     if scheme == SIG_ECDSA_SECP256R1_SHA256:
-        if not isinstance(private_key, ec.EllipticCurvePrivateKey):
-            _raise_tls(AlertDescription.ILLEGAL_PARAMETER, 'certificate key is not compatible with ECDSA')
+        if not isinstance(private_key, ec.EllipticCurvePrivateKey) or not isinstance(private_key.curve, ec.SECP256R1):
+            _raise_tls(AlertDescription.ILLEGAL_PARAMETER, 'certificate key is not compatible with ECDSA P-256')
         return private_key.sign(payload, ec.ECDSA(hashes.SHA256()))
+    if scheme == SIG_ECDSA_SECP384R1_SHA384:
+        if not isinstance(private_key, ec.EllipticCurvePrivateKey) or not isinstance(private_key.curve, ec.SECP384R1):
+            _raise_tls(AlertDescription.ILLEGAL_PARAMETER, 'certificate key is not compatible with ECDSA P-384')
+        return private_key.sign(payload, ec.ECDSA(hashes.SHA384()))
     _raise_tls(AlertDescription.ILLEGAL_PARAMETER, 'unsupported certificate verify signature algorithm')
 
 
@@ -63,10 +70,15 @@ def _verify_with_scheme(public_key: object, scheme: int, signature: bytes, paylo
             )
             return
         if scheme == SIG_ECDSA_SECP256R1_SHA256:
-            if not isinstance(public_key, ec.EllipticCurvePublicKey):
-                _raise_tls(AlertDescription.ILLEGAL_PARAMETER, 'peer certificate key is not compatible with ECDSA')
+            if not isinstance(public_key, ec.EllipticCurvePublicKey) or not isinstance(public_key.curve, ec.SECP256R1):
+                _raise_tls(AlertDescription.ILLEGAL_PARAMETER, 'peer certificate key is not compatible with ECDSA P-256')
             public_key.verify(signature, payload, ec.ECDSA(hashes.SHA256()))
             return
+        if scheme == SIG_ECDSA_SECP384R1_SHA384:
+            if not isinstance(public_key, ec.EllipticCurvePublicKey) or not isinstance(public_key.curve, ec.SECP384R1):
+                _raise_tls(AlertDescription.ILLEGAL_PARAMETER, 'peer certificate key is not compatible with ECDSA P-384')
+            public_key.verify(signature, payload, ec.ECDSA(hashes.SHA384()))
+            return
     except TlsAlertError:
         raise
     except Exception as exc:  # pragma: no cover - crypto backend specifics vary.

{tigrcorn_security-0.3.18.dev1 → tigrcorn_security-0.3.18.dev3}/src/tigrcorn_security.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tigrcorn-security
-Version: 0.3.18.dev1
+Version: 0.3.18.dev3
 Summary: TLS 1.3, mTLS, X.509, ALPN, OCSP, CRL, and certificate policy surfaces for the Tigrcorn Python web server.
 Author-email: Jacob Stewart <jacob@swarmauri.com>
 License: Apache License
@@ -187,8 +187,8 @@ Classifier: Typing :: Typed
 Requires-Python: <3.15,>=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: tigrcorn-core==0.3.18.dev1
-Requires-Dist: tigrcorn-config==0.3.18.dev1
+Requires-Dist: tigrcorn-core==0.3.18.dev3
+Requires-Dist: tigrcorn-config==0.3.18.dev3
 Provides-Extra: x509
 Requires-Dist: cryptography>=46.0.0; extra == "x509"
 Dynamic: license-file
@@ -280,7 +280,7 @@ The package exposes its supported public surface through the <code>tigrcorn_secu
 
 ## Package Graph
 
-[tigrcorn-core](https://pypi.org/project/tigrcorn-core/) | [tigrcorn-config](https://pypi.org/project/tigrcorn-config/) | [tigrcorn-http](https://pypi.org/project/tigrcorn-http/) | [tigrcorn-asgi](https://pypi.org/project/tigrcorn-asgi/) | [tigrcorn-contract](https://pypi.org/project/tigrcorn-contract/) | [tigrcorn-transports](https://pypi.org/project/tigrcorn-transports/) | [tigrcorn-security](https://pypi.org/project/tigrcorn-security/) | [tigrcorn-protocols](https://pypi.org/project/tigrcorn-protocols/) | [tigrcorn-static](https://pypi.org/project/tigrcorn-static/) | [tigrcorn-observability](https://pypi.org/project/tigrcorn-observability/) | [tigrcorn-runtime](https://pypi.org/project/tigrcorn-runtime/) | [tigrcorn-compat](https://pypi.org/project/tigrcorn-compat/) | [tigrcorn-certification](https://pypi.org/project/tigrcorn-certification/)
+[tigrcorn-core](https://pypi.org/project/tigrcorn-core/) | [tigrcorn-quic-cc](https://pypi.org/project/tigrcorn-quic-cc/) | [tigrcorn-quic-cc-reno](https://pypi.org/project/tigrcorn-quic-cc-reno/) | [tigrcorn-config](https://pypi.org/project/tigrcorn-config/) | [tigrcorn-http](https://pypi.org/project/tigrcorn-http/) | [tigrcorn-asgi](https://pypi.org/project/tigrcorn-asgi/) | [tigrcorn-contract](https://pypi.org/project/tigrcorn-contract/) | [tigrcorn-transports](https://pypi.org/project/tigrcorn-transports/) | [tigrcorn-security](https://pypi.org/project/tigrcorn-security/) | [tigrcorn-protocols](https://pypi.org/project/tigrcorn-protocols/) | [tigrcorn-static](https://pypi.org/project/tigrcorn-static/) | [tigrcorn-observability](https://pypi.org/project/tigrcorn-observability/) | [tigrcorn-runtime](https://pypi.org/project/tigrcorn-runtime/) | [tigrcorn-compat](https://pypi.org/project/tigrcorn-compat/) | [tigrcorn-certification](https://pypi.org/project/tigrcorn-certification/)
 
 ## Best Practices
 

tigrcorn_security-0.3.18.dev3/src/tigrcorn_security.egg-info/requires.txt

@@ -0,0 +1,5 @@
+tigrcorn-core==0.3.18.dev3
+tigrcorn-config==0.3.18.dev3
+
+[x509]
+cryptography>=46.0.0

tigrcorn_security-0.3.18.dev1/src/tigrcorn_security.egg-info/requires.txt

@@ -1,5 +0,0 @@
-tigrcorn-core==0.3.18.dev1
-tigrcorn-config==0.3.18.dev1
-
-[x509]
-cryptography>=46.0.0