代码拉取完成，页面将自动刷新
Note
This version is not yet released and is under active development.
manylinux wheels to be compiled with
OpenSSL 1.1.1d.cryptography 2.9.manylinux2010 wheels in addition to our manylinux1
wheels.ed25519 and ed448 keys in the
:class:`~cryptography.x509.CertificateBuilder`,
:class:`~cryptography.x509.CertificateSigningRequestBuilder`,
:class:`~cryptography.x509.CertificateRevocationListBuilder` and
:class:`~cryptography.x509.ocsp.OCSPResponseBuilder`.cryptography no longer depends on asn1crypto.manylinux1
wheels. Continuing to produce them was a maintenance burden.cryptography.hazmat.primitives.mac.MACContext interface. The CMAC and
HMAC APIs have not changed, but they are no longer registered as
MACContext instances.manylinux1 wheels to be compiled with
OpenSSL 1.1.1c.setup.py test. Users
interested in running our tests can continue to follow the directions in our
:doc:`development documentation</development/getting-started>`.Encoding.OpenSSH and PublicFormat.OpenSSH
in
:meth:`Ed25519PublicKey.public_bytes
<cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey.public_bytes>`
.SubjectKeyIdentifier to
:meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier`
and deprecate passing an Extension object. The documentation always
required SubjectKeyIdentifier but the implementation previously
required an Extension.cryptography.hazmat.primitives.asymmetric.utils.encode_rfc6979_signature
and
cryptography.hazmat.primitives.asymmetric.utils.decode_rfc6979_signature,
which had been deprecated for nearly 4 years. Use
:func:`~cryptography.hazmat.primitives.asymmetric.utils.encode_dss_signature`
and
:func:`~cryptography.hazmat.primitives.asymmetric.utils.decode_dss_signature`
instead.cryptography.x509.Certificate.serial,
which had been deprecated for nearly 3 years. Use
:attr:`~cryptography.x509.Certificate.serial_number` instead.manylinux1 wheels to be compiled with
OpenSSL 1.1.1b.ed25519 public keys.no-engine
(OPENSSL_NO_ENGINE) flag.idna dependency as
well. If you still need this deprecated path please install cryptography
with the idna extra: pip install cryptography[idna].manylinux1 wheels to be compiled with
OpenSSL 1.1.1a.rfc4514_string() method to
:meth:`x509.Name <cryptography.x509.Name.rfc4514_string>`,
:meth:`x509.RelativeDistinguishedName
<cryptography.x509.RelativeDistinguishedName.rfc4514_string>`, and
:meth:`x509.NameAttribute <cryptography.x509.NameAttribute.rfc4514_string>`
to format the name or component an RFC 4514 Distinguished Name string.OCSPResponse.manylinux1 wheels to be compiled with
OpenSSL 1.1.0j.manylinux1 wheels.cryptography from a wheel.manylinux1 wheels to be compiled with
OpenSSL 1.1.0i.min_tag_length provided to the
:class:`~cryptography.hazmat.primitives.ciphers.modes.GCM` constructor.
CVE-2018-10903
hmac.compare_digest has been deprecated.
We will require Python 2.7.7 or higher (or 2.7.6 on Ubuntu) in the next
cryptography release.cryptography from compiling against
LibreSSL 2.7.x.ValueError.manylinux1 wheels to be compiled with
OpenSSL 1.1.0h.GeneralNames which prohibited having zero elements,
due to breakages.InvalidUnwrap when key length modulo 8 was
zero.HKDF that incorrectly constrained output size.q.X509_up_ref for an upcoming pyOpenSSL release.manylinux1 wheels to be compiled with
OpenSSL 1.1.0g.manylinux1 wheels where OpenSSL's stack was
marked executable.pip on Ubuntu 16.04.cryptography.Whirlpool, RIPEMD160, and
UnsupportedExtension have been removed in accordance with our
:doc:`/api-stability` policy.cryptography now requires pip 6 or newer.idna encoding if necessary.
This change will not affect anyone who is not processing internationalized
domains.UTF8String string types.OCSP Must-Staple in
certificates.manylinux1 wheel to avoid a
bug with symbol resolution in certain scenarios.manylinux1 wheels to statically link OpenSSL instead of
dynamically linking and bundling the shared object. This should resolve
crashes seen when using uwsgi or other binaries that link against
OpenSSL independently.signer and verifier warnings.manylinux1 wheels linked against OpenSSL 1.1.0f. These wheels
will be automatically used with most Linux distributions if you are running
the latest pip.signer on
:class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`,
:class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKey`,
and
:class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey`
in favor of sign.verifier on
:class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey`,
:class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKey`,
and
:class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`
in favor of verify.extensions attribute on :class:`~cryptography.x509.Certificate`,
:class:`~cryptography.x509.CertificateSigningRequest`,
:class:`~cryptography.x509.CertificateRevocationList`, and
:class:`~cryptography.x509.RevokedCertificate` now caches the computed
Extensions object. There should be no performance change, just a
performance improvement for programs accessing the extensions attribute
multiple times.True on success. This brings it in line with the interface's
documentation, and our intent. The correct way to use
:meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey.verify`
has always been to check whether or not
:class:`~cryptography.exceptions.InvalidSignature` was raised.cryptography release.tag during
:class:`~cryptography.hazmat.primitives.ciphers.modes.GCM` finalization via
:meth:`~cryptography.hazmat.primitives.ciphers.AEADDecryptionContext.finalize_with_tag`.cryptography from compiling against
LibreSSL 2.5.x.UnsupportedExtension exception, instead an
:class:`~cryptography.x509.UnrecognizedExtension` object will be returned.
This behavior was based on a poor reading of the RFC, unknown critical
extensions only need to be rejected on certificate verification.Whirlpool and RIPEMD160 have been deprecated.pyasn1 to asn1crypto resulting in a
general performance increase when encoding/decoding ASN.1 structures. Also,
the pyasn1_modules test dependency is no longer required.password must be bytes if provided. Previously this
was documented but not enforced.int_from_bytes where it failed to accept
bytearray.cryptography 1.7.PyInstaller and cx_freeze.IPv4Network and IPv6Network in X.509
certificates for use with :class:`~cryptography.x509.NameConstraints`.HKDF would return an empty
byte-string if used with a length less than algorithm.digest_size.
Credit to Markus Döring for reporting the issue. CVE-2016-9243
UserWarning when used with cffi 1.8.3.cryptography from compiling against
OpenSSL 1.0.2i.datetime objects as method argumentscryptography now supports OpenSSL 1.1.0 as a compilation target.OpenSSH public key serialization.serial attribute on
:class:`~cryptography.x509.Certificate`, in favor of
:attr:`~cryptography.x509.Certificate.serial_number`.pyOpenSSL release.pyOpenSSL release.cryptography from compiling against
LibreSSL 2.3.x.AttributeError when using mock to patch
some cryptography modules.cryptography 1.4.AssertionError when performing an RSA decryption on
an invalid ciphertext, ValueError is now correctly raised in all cases.EVP_PKEY object that caused errors with
pyOpenSSL.undefined symbol EC_GFp_nistp224_method that
occurred with some OpenSSL installations.InternalError on import.__hash__ method to :class:`~cryptography.x509.Name`.countryName is now encoded as a PrintableString when creating subject
and issuer distinguished names with the Certificate and CSR builder classes.-O these asserts are optimized
away. If a user ran Python with this flag and got an invalid response code
this could result in undefined behavior or worse. Accordingly, all response
checks from the OpenSSL backend have been converted from assert
to a true function call. Credit Emilia Käsper (Google Security Team)
for the report.set_source out-of-line API mode for
compilation. This results in significantly faster imports and lowered
memory consumption. Due to this change we no longer support PyPy releases
older than 2.6 nor do we support any released version of PyPy3 (until a
version supporting cffi 1.0 comes out).public_bytes method of
:class:`~cryptography.x509.CertificateSigningRequest`.public_bytes method of
:class:`~cryptography.x509.Certificate`.get_provisioning_uri method to
:class:`~cryptography.hazmat.primitives.twofactor.hotp.HOTP` and
:class:`~cryptography.hazmat.primitives.twofactor.totp.TOTP` for generating
provisioning URIs.TypeError when passing objects that are not text as the value to
:class:`~cryptography.x509.NameAttribute`.CertificateBuilder.encode_rfc6979_signature and decode_rfc6979_signature in
favor of
:func:`~cryptography.hazmat.primitives.asymmetric.utils.encode_dss_signature`
and
:func:`~cryptography.hazmat.primitives.asymmetric.utils.decode_dss_signature`.Removed support for Python 3.2. This version of Python is rarely used and caused support headaches. Users affected by this should upgrade to 3.3+.
Deprecated support for Python 2.6. At the time there is no time table for actually dropping support, however we strongly encourage all users to upgrade their Python, as Python 2.6 no longer receives support from the Python core team.
Add support for the :class:`~cryptography.hazmat.primitives.asymmetric.ec.SECP256K1` elliptic curve.
Fixed compilation when using an OpenSSL which was compiled with the
no-comp (OPENSSL_NO_COMP) option.
Support :attr:`~cryptography.hazmat.primitives.serialization.Encoding.DER`
serialization of public keys using the public_bytes method of
:class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKeyWithSerialization`,
:class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKeyWithSerialization`,
and
:class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKeyWithSerialization`.
Support :attr:`~cryptography.hazmat.primitives.serialization.Encoding.DER`
serialization of private keys using the private_bytes method of
:class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKeyWithSerialization`,
:class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKeyWithSerialization`,
and
:class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKeyWithSerialization`.
Add support for parsing X.509 certificate signing requests (CSRs) with :func:`~cryptography.x509.load_pem_x509_csr` and :func:`~cryptography.x509.load_der_x509_csr`.
Moved cryptography.exceptions.InvalidToken to
:class:`cryptography.hazmat.primitives.twofactor.InvalidToken` and deprecated
the old location. This was moved to minimize confusion between this exception
and :class:`cryptography.fernet.InvalidToken`.
Added support for X.509 extensions in :class:`~cryptography.x509.Certificate` objects. The following extensions are supported as of this release:
Note that unsupported extensions with the critical flag raise
UnsupportedExtension while unsupported extensions set to non-critical are
silently ignored. Read the :doc:`X.509 documentation</x509/index>` for more
information.
cryptography.hazmat.primitives.interfaces to
:mod:`~cryptography.hazmat.primitives.kdf`.EllipticCurvePrivateKeyWithNumbers.RSAPrivateKeyWithNumbers.DSAPrivateKeyWithNumbers.RSAPublicKeyWithNumbers.public_bytes to
:class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKeyWithSerialization`.EllipticCurvePublicKeyWithNumbers.public_bytes to
:class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKeyWithSerialization`.DSAPublicKeyWithNumbers.public_bytes to
:class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKeyWithSerialization`.cryptography.hazmat.primitives.interfaces to
:mod:`~cryptography.hazmat.primitives.hashes`.cryptography.hazmat.primitives.interfaces to
:mod:`~cryptography.hazmat.primitives.ciphers`.cryptography.hazmat.primitives.interfaces to
:mod:`~cryptography.hazmat.primitives.ciphers.modes`.cryptography.hazmat.primitives.interfaces to
:mod:`~cryptography.hazmat.primitives.padding`.cryptography.hazmat.primitives.interfaces to
:mod:`~cryptography.hazmat.primitives.asymmetric.padding`.AsymmetricSignatureContext and AsymmetricVerificationContext
were moved from cryptography.hazmat.primitives.interfaces to
cryptography.hazmat.primitives.asymmetric.DSAPrivateKeyWithNumbers,
:class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKey` and
DSAPublicKeyWithNumbers were moved from
cryptography.hazmat.primitives.interfaces to
:mod:`~cryptography.hazmat.primitives.asymmetric.dsa`
EllipticCurvePrivateKeyWithNumbers,
:class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`,
and EllipticCurvePublicKeyWithNumbers
were moved from cryptography.hazmat.primitives.interfaces to
:mod:`~cryptography.hazmat.primitives.asymmetric.ec`.RSAPrivateKeyWithNumbers,
:class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey` and
RSAPublicKeyWithNumbers were moved from
cryptography.hazmat.primitives.interfaces to
:mod:`~cryptography.hazmat.primitives.asymmetric.rsa`.enum34 is no longer installed on Python 3.4, where it is included in
the standard library.OPENSSL_NO_SSL3
was defined.p and q when loading DSA keys
from numbers.MACContext as a common interface for CMAC and HMAC and
deprecated CMACContext.cryptography-vectors package.salt_length argument to
the :class:`~cryptography.hazmat.primitives.asymmetric.padding.MGF1`
constructor. The salt_length should be passed to
:class:`~cryptography.hazmat.primitives.asymmetric.padding.PSS` instead.elliptic_curve_private_key_from_numbers and
elliptic_curve_public_key_from_numbers in favor of
load_elliptic_curve_private_numbers and
load_elliptic_curve_public_numbers on
:class:`~cryptography.hazmat.backends.interfaces.EllipticCurveBackend`.EllipticCurvePrivateKeyWithNumbers and
EllipticCurvePublicKeyWithNumbers support.TraditionalOpenSSLSerializationBackend support to multibackend.PKCS8SerializationBackend support to multibackend.cryptography allowed
tags to be truncated by default, applications wishing to preserve this
behavior (not recommended) can pass the min_tag_length argument.commoncrypto and :doc:`/hazmat/backends/openssl`.AES :class:`~cryptography.hazmat.primitives.ciphers.modes.CTR`
support to the OpenSSL backend when linked against 0.9.8.PKCS8SerializationBackend and
TraditionalOpenSSLSerializationBackend support to the
:doc:`/hazmat/backends/openssl`.commoncrypto and :doc:`/hazmat/backends/openssl`.RSAPrivateKey class in favor of backend
specific providers of the
:class:`cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
interface.RSAPublicKey in favor of backend specific
providers of the
:class:`cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey`
interface.DSAPrivateKey class in favor of backend
specific providers of the
:class:`cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKey`
interface.DSAPublicKey class in favor of backend specific
providers of the
:class:`cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKey`
interface.DSAParameters class in favor of backend specific
providers of the
:class:`cryptography.hazmat.primitives.asymmetric.dsa.DSAParameters`
interface.encrypt_rsa, decrypt_rsa, create_rsa_signature_ctx and
create_rsa_verification_ctx on
:class:`~cryptography.hazmat.backends.interfaces.RSABackend`.create_dsa_signature_ctx and create_dsa_verification_ctx
on :class:`~cryptography.hazmat.backends.interfaces.DSABackend`.salt_length on
:class:`~cryptography.hazmat.primitives.asymmetric.padding.MGF1` and added it
to :class:`~cryptography.hazmat.primitives.asymmetric.padding.PSS`. It will
be removed from MGF1 in two releases per our :doc:`/api-stability`
policy.cryptography_vectors package.commoncrypto.commoncrypto.register_cipher_adapter method from
:class:`~cryptography.hazmat.backends.interfaces.CipherBackend`.ec.h header is not
available, such as CentOS.multibackend.此处可能存在不合适展示的内容，页面不予展示。您可通过相关编辑功能自查并修改。
如您确认内容无涉及 不当用语 / 纯广告导流 / 暴力 / 低俗色情 / 侵权 / 盗版 / 虚假 / 无价值内容或违法国家有关法律法规的内容，可点击提交进行申诉，我们将尽快为您处理。
马建仓 AI 助手