Mailman 3 August 2016 - Security-SIG

Pending security features for 3.6
by Christian Heimes 26 Aug '16

26 Aug '16

Hi, (2nd attempt, first mail didn't make it) I have a bunch of tickets with security-related improvements or features for Python 3.6. Most of the tickets come with patches and tests. Some of the patches might be outdated or conflict with tip. I have branches on my private github fork for all patches. Please review the patches and decide which features you like to include in future releases. Make ssl module compatible with OpenSSL 1.1.0 --------------------------------------------- http://bugs.python.org/issue26470 https://github.com/tiran/cpython/commits/feature/openssl110 https://github.com/tiran/cpython/commits/feature/openssl110_27 OpenSSL 1.1.0 changes several APIs, e.g. it makes structs opaque. The ticket has patches for 2.7 and 3.x series. It should be applied to all Python versions that are open for security patches. Add ChaCha20 Poly1305 to SSL ciphers ------------------------------------ http://bugs.python.org/issue27766 https://github.com/tiran/cpython/commits/feature/chacha20 The ticket changes the default cipher list and moves ChaCha20 Poly1305 up front. For now the patch makes only sense with OpenSSL 1.1.0 since 1.0.2 does not include the cipher. I expect to see backports, though. It should be applied to all Python versions, too. ssl: add public API for IA-32 processor capabilities vector ----------------------------------------------------------- http://bugs.python.org/issue27768 This ticket doesn't have a patch yet. I'm going to move code from ticket 27766 to a separate ticket. Alex and Cory have requested to make the API public. Add AF_ALG (Linux Kernel crypto) to socket module ------------------------------------------------- http://bugs.python.org/issue27744 https://github.com/tiran/cpython/commits/feature/af_alg AF_ALG is a Linux-only socket it to interface with Kernel space crypto. It's limited but has a couple of really useful properties, e.g. zero-copy hashing of files with sendfile() or storing key material securely in Kernel memory. Add BLAKE2 to hashlib --------------------- http://bugs.python.org/issue26798 https://github.com/tiran/cpython/commits/feature/blake2 BLAKE2 is a fast and powerful hash algorithm. It's as secure as SHA-2 family, faster than MD5 and has built-in features like MAC support, variable output length, salting and personalization. Donald uses BLAKE2 for PyPI. The patch was refused on python-dev because it introduces too much new code. Add SHA-3 and SHAKE (Keccak) support ------------------------------------ http://bugs.python.org/issue16113 https://github.com/tiran/cpython/commits/feature/sha3 SHA-3 is the successor of SHA-2. Like BLAKE2 the patch was refused on python-dev because it introduces too much new code. Add truncated SHA512/224 and SHA512/256 --------------------------------------- http://bugs.python.org/issue26834 https://github.com/tiran/cpython/commits/feature/sha512truncated Truncated SHA512/224 and SHA512/256 use the SHA512 algorithm instead of SHA256 algorithm. Like SHA384 it's SHA512 with a different init vector and truncated output. Christian

5 5

Implementation of the PEP 524
by Victor Stinner 18 Aug '16

18 Aug '16

Hi, I wrote a first implementation of the PEP 524 (make os.urandom blocking): * https://bugs.python.org/issue27776 : "PEP 524: Make os.urandom() blocking on Linux" * https://bugs.python.org/issue27778 : "PEP 524: Add os.getrandom()" My patches are now waiting for your review :-) You should also review changes made to prepare the issue #27776: https://hg.python.org/cpython/rev/980e2c781810 https://hg.python.org/cpython/rev/265644bad99e https://hg.python.org/cpython/rev/86d0d74bc2e1 https://hg.python.org/cpython/rev/ad141164c792 The last change (close fd on error) is not a really bugfix, it's more a new feature. In Python 3.5, it wasn't needed to close the file descriptor since Py_FatalError() was called immediatly. Victor

2 5

Take a decision for os.urandom() in Python 3.6
by Victor Stinner 08 Aug '16

08 Aug '16

Hi, Would it be possible to take a decision on the PEP 522 and PEP 524? Deadline for new features in Python 3.6 is in one month or something like that, no? My PEP: https://www.python.org/dev/peps/pep-0524/ "PEP 524 -- Make os.urandom() blocking on Linux" Nick's PEP: https://www.python.org/dev/peps/pep-0522/ "PEP 522 -- Allow BlockingIOError in security sensitive APIs" Victor

7 28