Surya/core 9290/py triplesec v4 #19
Conversation
triplesec/utils.py
Outdated
|
|
||
| def __init__(self, string=b''): | ||
| self._obj = Crypto.Hash.keccak.new(digest_bits=512) | ||
| self.input = b"" |
There was a problem hiding this comment.
is storing this okay (used in copy)?
There was a problem hiding this comment.
Holding onto an empty string?
| try: | ||
| print(plaintext.decode('ascii', 'strict')) | ||
| except UnicodeDecodeError: | ||
| sys.stderr.write("Aborting: unable to decode plaintext as ASCII. Use -b to output binary.\n") |
There was a problem hiding this comment.
what do you think about this change? to avoid printing arbitrary unicode to console
triplesec/utils.py
Outdated
|
|
||
| def __init__(self, string=b''): | ||
| self._obj = Crypto.Hash.keccak.new(digest_bits=512) | ||
| self.input = b"" |
There was a problem hiding this comment.
Holding onto an empty string?
triplesec/utils.py
Outdated
| def __init__(self, string=b''): | ||
| self._obj = Crypto.Hash.keccak.new(digest_bits=512) | ||
| self.input = b"" | ||
| self.input += string |
There was a problem hiding this comment.
I guess it can be called with some of the MAC key data in the HMAC construction, and therefore might be passing a MAC key around. That ok?
There was a problem hiding this comment.
I usually assume that anything in the processes' memory is safe. But I saw a lot of scrubbing in the JS repo, is that necessary or just an extra precaution?
There was a problem hiding this comment.
It was an extra precaution and likely not ineffective since with interpreted languages, you never really know what happens to memory.
There was a problem hiding this comment.
That makes sense. I got rid of this custom stuff entirely. And I finally figured out what caused the sudden change: pysha3 upgraded to 1.0 and changed the default sha3 function, but we weren't version locked so tests started failing (which I just now did). Still using the library since it provides keccak which the python stdlib doesn't.
Resolves https://github.com/keybase/python-triplesec/issues/15 https://github.com/keybase/python-triplesec/issues/14
Wontfix's https://github.com/keybase/python-triplesec/issues/8 due to deprecating py2.6