replace PyCrypto usage with PyCA's Cryptography

[glyph]

No description provided.

[psi29a]

I'm just curious, is there something wrong with PyCrypto or is there just more development with Cryptography or is that where everyone is going to these days?

[glyph]

Cryptography has a lot to recommend it, but one major reason is that pyOpenSSL requires Cryptography, so using it for this as well is just fewer dependencies :-).

[alex]

Reasons to prefer PyCA cryptography (bearing in mind I'm one of the authors):

• Built on top of known cryptography toolkits, which are often faster, particularly on non-traditional platforms (SPARC, ARM, etc.), these toolkits are also more likely to be audited
• Runs on PyPy
• More active development
• Can be pip install'd on Windows without needing a C compiler

[schlenk]

ldaptor seems to use only DES (for the crappy LanManager Password Hashes). cryptography does not provide that cipher. So guess this cannot be fixed, unless cryptography provides DES or LanManager hashes are extinct.

[reaperhulk]

3DES uses an "encrypt decrypt encrypt" model (EDE) so you can do single DES encryption and decryption with pyca/cryptography by doing the following:

from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.backends import default_backend
tdes_key = des_key * 3 # just concat the key 3x
cipher = Cipher(algorithms.3DES(tdes_key), modes.ECB(), backend=default_backend())
encryptor = cipher.encryptor()
# not using padding here so you'll need to make sure your input is a multiple of block size or else add padding
ct = encryptor.update(b"encrypt!") + encryptor.finalize()

This will work (albeit 3x as slow as single DES).

Ideally you'd just drop LM support though as it's beyond ancient.

[glyph]

Beyond ancient and completely insecure; this is an interoperability measure, not a security measure. If it is at all avoidable it would be better just to drop it.

[simo5]

If you need this just for LanManager hashes, just forget about it, LanManager hashes are comepltely useless for compatibility unless you are catering for 25 year old machines.
Anything that can use LanManager today has it probably disabled and allows only NTLM (using NT hashes) thorugh instead. NT hashes are nothing great bu they don't use DES, only RC4 and MD4.
Just drop LM it's dead.

[graingert]

@glyph any update on this?

[glyph]

It should still happen, for sure! I don’t really work on ldaptor, though.

[psi29a]

@graingert thanks!