Bump ecdsa from 0.13.2 to 0.13.3

[dependabot[bot]]

Bumps ecdsa from 0.13.2 to 0.13.3.

Release notes

Sourced from ecdsa's releases.

ecdsa 0.13.3

Fix CVE-2019-14853 - possible DoS caused by malformed signature decoding Fix CVE-2019-14859 - signature malleability caused by insufficient checks of DER encoding

Also harden key decoding from string and DER encodings.

Changelog

Sourced from ecdsa's changelog.

• Release 0.17.0 (27 May 2021)

New API:

• Keys that use explicit curve parameters can now be read and written. Reading of explicit curves can be disabled by using the valid_curve_encodings keyword argument in VerifyingKey.from_pem(), VerifyingKey.from_der(), SigningKey.from_pem(), and SigningKey.from_der().
• Keys can now be written with use of explicit curve parameters, use curve_parameters_encoding keyword argument of VerifyingKey.to_pem(), VerifyingKey.to_der(), SigningKey.to_pem(), or SigningKey.to_der()to specify the format. By defaultnamed_curvewill be used, unless the curve doesn't have an associated OID (as will be the case for an unsupported curve), thenexplicit` encoding will be used.
• Allow specifying acceptable point formats when loading public keys (this also fixes a minor bug where python-ecdsa would accept raw encoding for points in PKCS#8 files). Set of accepted encodings is controlled by valid_encodings keyword argument in ECDH.load_received_public_key_bytes(), VerifyingKey.from_string(), VerifyingKey.from_pem(), VerifyingKey.from_der()`.
• PointJacobi and Point now inherit from AbstractPoint that implements the methods for parsing points. That added from_bytes() and to_bytes() methods to both of them.
• Curve parameters can now be read and written to PEM and DER files. The Curve class supports new to_der(), from_der(), to_pem(), and from_pem() methods.

Doc fix:

• Describe in detail which methods can raise RSZeroError, and that SigningKey.sign_deterministic() won't raise it.

Bug fix:

• Correctly truncate hash values larger than the curve order (only impacted custom curves and the curves added in this release).
• Correctly handle curves for which the order is larger than the prime (only impacted custom curves and the secp160r1 curve added in this release).
• Fix the handling of == and != for Public_key, Private_key, Point, PointJacobi, VerifyingKey, and SigningKey so that it behaves consistently and in the expected way both in Python 2 and Python 3.
• Implement lock-less algorithm inside PointJacobi for keeping shared state so that when a calculation is aborted with KeyboardInterrupt, the state doesn't become corrupted (this fixes the occasional breakage of ecdsa in interactive shells).

New features:

• The speed.py script now provides performance for signature verification without the use of precomputation.
• New curves supported: secp112r1, secp112r2, secp128r1, secp160r1.

Performance:

... (truncated)

Commits

• 7add221 update NEWS file for 0.13.3
• 5c4c74a Merge pull request #124 from tomato42/backport-sig-decode
• 1eb2c04 update README with error handling of from_string() and from_der()
• b95be03 execute also new tests in Travis
• 99c907d harden also key decoding
• 3427fa2 ensure that the encoding is actually the minimal one for length and integer
• 563d2ee make variable names in remove_integer more aproppriate
• 14abfe0 explicitly specify the distro to get py26 and py33
• 9080d1d fix length decoding
• 897178c give the same handling to string encoded signatures as to DER
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/Code4PuertoRico/horas/network/alerts).