search

ChrisSuess / Project-Xbow

A computional chemistry cloud based project.
6 stars 2 forks source link

paramiko giving security warning #29

Closed ChrisSuess closed 5 years ago

ChrisSuess commented 5 years ago

paramiko use has been depracated.

need to switch to EllipticCurvePublicKey

ChrisSuess commented 5 years ago

Paramiko uses Cryptography. In versions <2.6.0 it returns this error code

/Library/Frameworks/Python.framework/Versions/3.6/lib/python3.6/site-packages/paramiko/kex_ecdh_nist.py:39: CryptographyDeprecationWarning: encode_point has been deprecated on EllipticCurvePublicNumbers and will be removed in a future version. Please use EllipticCurvePublicKey.public_bytes to obtain both compressed and uncompressed point encoding.
  m.add_string(self.Q_C.public_numbers().encode_point())
/Library/Frameworks/Python.framework/Versions/3.6/lib/python3.6/site-packages/paramiko/kex_ecdh_nist.py:96: CryptographyDeprecationWarning: Support for unsafe construction of public numbers from encoded data will be removed in a future version. Please use EllipticCurvePublicKey.from_encoded_point
  self.curve, Q_S_bytes
/Library/Frameworks/Python.framework/Versions/3.6/lib/python3.6/site-packages/paramiko/kex_ecdh_nist.py:111: CryptographyDeprecationWarning: encode_point has been deprecated on EllipticCurvePublicNumbers and will be removed in a future version. Please use EllipticCurvePublicKey.public_bytes to obtain both compressed and uncompressed point encoding.
  hm.add_string(self.Q_C.public_numbers().encode_point())

It remains an open issue at the moment.

Two possible fixes downgrade to cryptography 2.4.2 with pip install cryptography==2.4.2 or add warning catching with 

import warnings
warnings.filterwarnings(action='ignore',module='.*paramiko.*')
ChrisSuess commented 5 years ago

Commit e052d7d is fixes this issue for now.