search

CZ-NIC / pyoidc

A complete OpenID Connect implementation in Python
Other
718 stars 259 forks source link

Switch to pyca/cryptography #589

Open tpazderka opened 5 years ago

tpazderka commented 5 years ago

pycryptodome is not considered a secure alternative to pycrypto.

pyca/cryptography is more widely used and probably more secure.

schlenk commented 5 years ago

Should be easy. The only thing not provided by cryptography is SIV (https://www.rfc-editor.org/info/rfc5297) which is kind of nice but not essential.

tpazderka commented 5 years ago

OK, this turned out not to be that easy... We heavily depend on jwkest which in turn depends on pycryptodome.

So either we build a layer inbetween to pass pycryptodome-like objects to jwkest or we drop the dependency on jwkest and using something new.

schlenk commented 5 years ago

Didn't @rohe mention a jwkest rewrite on top of cryptography?

tpazderka commented 5 years ago

I guess it is https://github.com/openid/JWTConnect-Python-CryptoJWT, but I am not sure how finished it is.

schlenk commented 5 years ago

No idea. Alternative would be pyjwt, which is also based on cryptography and seems to be in quite wide spread usage. https://github.com/jpadilla/pyjwt

tpazderka commented 5 years ago

Hm, looks good. I am inclined to use more widespread packages since they tend to be better maintained. I will have a look and then maybe give it a go in another issue.

infohash commented 2 years ago

@tpazderka What's the progress on this? It will be good if we only use maintained dependencies. Is there a branch on this I can contribute to complete this enhancement?

schlenk commented 2 years ago

Pycryptodomex is actually maintained, so "unmaintained" isn't the major issue. But jwkest is kind of an issue.

But we support quite some features from JWT, like encrypted jwt, and things are pretty intermingled with jkwest API. So It might be necessary to break some APIs, rewrite the keyjar API a bit to switch the code to something like jwcrypto (https://github.com/latchset/jwcrypto), as pyjwt does not support encryption.

tpazderka commented 2 years ago

There is a branch use_pyjwt which is still very much WIP...