From 141509cce30fcf2b32dee405d4e8a511dfa5b91e Mon Sep 17 00:00:00 2001 From: Michael Weghorn Date: Sat, 17 Sep 2022 21:32:07 +0200 Subject: [PATCH 1/2] Drop unused PyCrypto imports --- virtualsmartcard/src/vpicc/virtualsmartcard/CryptoUtils.py | 1 - virtualsmartcard/src/vpicc/virtualsmartcard/SEutils.py | 2 -- 2 files changed, 3 deletions(-) diff --git a/virtualsmartcard/src/vpicc/virtualsmartcard/CryptoUtils.py b/virtualsmartcard/src/vpicc/virtualsmartcard/CryptoUtils.py index 07a095f..cdaeb14 100644 --- a/virtualsmartcard/src/vpicc/virtualsmartcard/CryptoUtils.py +++ b/virtualsmartcard/src/vpicc/virtualsmartcard/CryptoUtils.py @@ -201,7 +201,6 @@ def decrypt(cipherspec, key, data, iv=None): def hash(hashmethod, data): - from Crypto.Hash import SHA, MD5 # , RIPEMD hash_class = locals().get(hashmethod.upper(), None) if hash_class is None: logging.error("Unknown Hash method %s" % hashmethod) diff --git a/virtualsmartcard/src/vpicc/virtualsmartcard/SEutils.py b/virtualsmartcard/src/vpicc/virtualsmartcard/SEutils.py index 6183d31..c20efe0 100644 --- a/virtualsmartcard/src/vpicc/virtualsmartcard/SEutils.py +++ b/virtualsmartcard/src/vpicc/virtualsmartcard/SEutils.py @@ -683,8 +683,6 @@ class Security_Environment(object): P1-P2 different from '0000' """ - from Crypto.PublicKey import RSA, DSA - cipher = self.ct.algorithm c_class = locals().get(cipher, None) From 22edc2a22828551393a7dbbf83a6e1127f80420c Mon Sep 17 00:00:00 2001 From: Michael Weghorn Date: Sat, 17 Sep 2022 21:55:40 +0200 Subject: [PATCH 2/2] Port from PyCrypto to PyCroptodome As the PyCrypto website says [1]: > PyCrypto 2.x is unmaintained, obsolete, and contains security > vulnerabilities. Therefore, switch to PyCryptodome, a maintained PyCrypto fork which is listed there as the recommended alternative for existing software that depends on PyCrypto. Notes on the port: 1) As the PyCryptodome introduction documentation [2] says, there are 2 alternative projects/namespaces that can be used: * pycryptodome, which uses the `Crypto` package that PyCrypto also uses, so is almost a drop-in replacement for Pycrypto * pycryptodomex, which uses the `Cryptodome` package It also mentions that the use of pycryptodome "is therefore recommended only when you are sure that the whole application is deployed in a virtualenv". Since it isn't sure that the application is deployed in a virtualenv, to make it more explicit that PyCryptodome is being used and because Linux distros like Debian package the `Cryptodome` package [3], the port is done to the `pycryptodomex` library that uses the `Cryptodome` package name. 2) As the "Compatibility with PyCrypto" page in the PyCryptodome doc [4] says: > The following packages, modules and functions have been removed: > > * Crypto.Random.OSRNG, Crypto.Util.winrandom and Crypto.Random.randpool. > You should use Crypto.Random only. The `PublicKey.RSA.generate` method already uses `Crypto.Random.get_random_bytes()` as default [5], so just drop the second parameter using `RandomPool.getBytes` in `virtualsmartcard/src/vpicc/virtualsmartcard/cards/cryptoflex.py`. [1] https://www.pycrypto.org/ [2] https://www.pycryptodome.org/src/introduction [3] https://packages.debian.org/bullseye/python3-pycryptodome [4] https://pycryptodome.readthedocs.io/en/latest/src/vs_pycrypto.html [5] https://pycryptodome.readthedocs.io/en/latest/src/public_key/rsa.html --- .appveyor.yml | 2 +- docs/_sources/virtualsmartcard/README.txt | 4 ++-- docs/virtualsmartcard/README.html | 6 +++--- virtualsmartcard/doc/README.txt.in | 6 +++--- .../src/vpicc/virtualsmartcard/CryptoUtils.py | 10 +++++----- .../src/vpicc/virtualsmartcard/cards/cryptoflex.py | 6 ++---- 6 files changed, 16 insertions(+), 18 deletions(-) diff --git a/.appveyor.yml b/.appveyor.yml index 39b739f..aa3baa4 100644 --- a/.appveyor.yml +++ b/.appveyor.yml @@ -37,7 +37,7 @@ install: - python -m pip install --upgrade pip - pip install virtualenv - pip install -U setuptools - - pip install pycryptodome + - pip install pycryptodomex - pip install pbkdf2 - pip install Pillow - pip install pyreadline diff --git a/docs/_sources/virtualsmartcard/README.txt b/docs/_sources/virtualsmartcard/README.txt index be688fb..cb2c29d 100644 --- a/docs/_sources/virtualsmartcard/README.txt +++ b/docs/_sources/virtualsmartcard/README.txt @@ -103,7 +103,7 @@ Depending on your usage of the |vpicc| you may need to install the following: - Python_ - pyscard_ (relaying a local smart card with `--type=relay`) -- PyCrypto_, PBKDF2_, PIL_, readline_ or PyReadline_ (emulation of electronic +- PyCryptodome_, PBKDF2_, PIL_, readline_ or PyReadline_ (emulation of electronic passport with `--type=ePass`) - OpenPACE_ (emulation of German identity card with `--type=nPA`) - libqrencode_ (to print a QR code on the command line for `vpcd-config`; an @@ -314,7 +314,7 @@ Notes and References .. _PCSC-lite: https://pcsclite.apdu.fr/ .. _Python: http://www.python.org/ .. _pyscard: http://pyscard.sourceforge.net/ -.. _PyCrypto: http://pycrypto.org/ +.. _PyCryptodome: https://www.pycryptodome.org/ .. _PBKDF2: https://www.dlitz.net/software/python-pbkdf2/ .. _readline: https://docs.python.org/3.3/library/readline.html .. _PyReadline: https://pypi.python.org/pypi/pyreadline diff --git a/docs/virtualsmartcard/README.html b/docs/virtualsmartcard/README.html index 8f13faf..19091db 100644 --- a/docs/virtualsmartcard/README.html +++ b/docs/virtualsmartcard/README.html @@ -211,7 +211,7 @@ responses via NFC to a contact-less smart card that signs the mail.