[pycrypto] RSA exportKey question

[Kurt Vogel]

Hi, I was looking at the pycrypto pull request
https://github.com/dlitz/pycrypto/pull/32.  Just a few comments...

* For readability can you pep8 format the code?
* RSA, for import/export the protection parameter maybe rename to algo or
wrap algo?  It evolves from: 'protection' to 'wrap_algo' to 'mode' as it
goes down the call stack.
* Also maybe make this parameter an enum/value?  Since the long string can
be error prone, low level code would need to change anyway if it were
either string or int if we support more modes.
* And last but not least... I'm new to this email list and not sure how
often pull requests are accepted but maybe you could reduce the amount of
features going in?  I know you have another one, 51, after this...
Maintainer may reluctant to do massive changes all at once?

Anyway just ideas...
Thanks for your time,
Sincerely,
Kurt




On Wed, Jul 3, 2013 at 2:26 PM, Legrandin <helderijs at gmail.com> wrote:

> I find 3DES is as good as AES for most practical purposes.
> The main limitation I see is that the current RSA.exportKey() uses
> PEM-level encryption and the MD5-based EVP_BytesToKey function for key
> derivation. Nowadays that is *really* weak.
>
> I opened a pull request [1] with a proposal for adding PKCS#8, since
> it is widely used and it makes it easier to have pluggable algorithms
> (the default combination being PBKDF2WithHMAC-SHA1AndDES-EDE3-CBC but
> PBKDF2WithHMAC-SHA1AndAES128-CBC is available too). It took a few
> iterations, but I am pretty happy with it.
> On top of that I have also just added exportKey/importKey to DSA [2].
>
> Feedback is welcome.
>
> [1] https://github.com/dlitz/pycrypto/pull/32
> [2] https://github.com/dlitz/pycrypto/pull/51
>
> 2013/6/28 Kurt Vogel <kvogel at mdcom.com>:
> > Hello,
> >
> > Wondering if it would be worthwhile to add more encryption options to rsa
> > exportKey() function rather than just DES3?  As the default for
> ssh-keygen
> > -t rsa export is 128-bit AES.  And maybe allow plug-able hash algorithms
> > such as PBKDF2, Bcrypt, etc.?
> >
> > Thanks,
> > Kurt
> >
> >
> >
> >
> > _______________________________________________
> > pycrypto mailing list
> > pycrypto at lists.dlitz.net
> > http://lists.dlitz.net/cgi-bin/mailman/listinfo/pycrypto
> >
> _______________________________________________
> pycrypto mailing list
> pycrypto at lists.dlitz.net
> http://lists.dlitz.net/cgi-bin/mailman/listinfo/pycrypto
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.dlitz.net/pipermail/pycrypto/attachments/20130703/d2a98b19/attachment.html>