As the PyCrypto website says [1]:
> PyCrypto 2.x is unmaintained, obsolete, and contains security
> vulnerabilities.
Therefore, switch to PyCryptodome, a maintained PyCrypto fork
which is listed there as the recommended alternative for
existing software that depends on PyCrypto.
Notes on the port:
1) As the PyCryptodome introduction documentation [2] says,
there are 2 alternative projects/namespaces that can be
used:
* pycryptodome, which uses the `Crypto` package
that PyCrypto also uses, so is almost a drop-in
replacement for Pycrypto
* pycryptodomex, which uses the `Cryptodome` package
It also mentions that the use of pycryptodome
"is therefore recommended only when you are
sure that the whole application is deployed in a virtualenv".
Since it isn't sure that the application is deployed in a
virtualenv, to make it more explicit that PyCryptodome
is being used and because Linux distros like Debian
package the `Cryptodome` package [3], the port is done to
the `pycryptodomex` library that uses the `Cryptodome`
package name.
2) As the "Compatibility with PyCrypto" page in the PyCryptodome
doc [4] says:
> The following packages, modules and functions have been removed:
>
> * Crypto.Random.OSRNG, Crypto.Util.winrandom and Crypto.Random.randpool.
> You should use Crypto.Random only.
The `PublicKey.RSA.generate` method already uses
`Crypto.Random.get_random_bytes()` as default [5],
so just drop the second parameter using `RandomPool.getBytes`
in `virtualsmartcard/src/vpicc/virtualsmartcard/cards/cryptoflex.py`.
[1] https://www.pycrypto.org/
[2] https://www.pycryptodome.org/src/introduction
[3] https://packages.debian.org/bullseye/python3-pycryptodome
[4] https://pycryptodome.readthedocs.io/en/latest/src/vs_pycrypto.html
[5] https://pycryptodome.readthedocs.io/en/latest/src/public_key/rsa.html
Commit 82c0c4fdd2
("Fallback to hashlib instead of deprecated libs")
had changed the hmac import to try the import from
the hashlib module, but there appears to be 'hmac'
underneath hashlib in neither Python 2 nor Python 3, but
it's a separate module.
Test on Debian testing with Python 2.7.18:
$ python2
Python 2.7.18 (default, Aug 1 2022, 06:23:55)
[GCC 12.1.0] on linux2
Type "help", "copyright", "credits" or "license" for more information.
Jedi is not installed, falling back to readline
>>> from hashlib import hmac as HMAC
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
ImportError: cannot import name hmac
>>> import hmac as HMAC
>>>
The same with Python 3.10.6:
$ python3
Python 3.10.6 (main, Aug 10 2022, 11:19:32) [GCC 12.1.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
Using Jedi for tab completion.
>>> from hashlib import hmac as HMAC
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
ImportError: cannot import name 'hmac' from 'hashlib' (/usr/lib/python3.10/hashlib.py)
>>> import hmac as HMAC
>>>
Even the official Python 3.10.6 documentation for the hashlib
module use plain hmac import [1] in its example:
>>> import hmac, hashlib
>>> m = hmac.new(b'secret key', digestmod=hashlib.blake2s)
>>> m.update(b'message')
>>> m.hexdigest()
'e3c8102868d28b5ff85fc35dda07329970d1a01e273c37481326fe0c861c8142'
Therefore, revert that change to the import and use the direct hmac
import again to make the case where PyCrypto is not installed work
again.
[1] https://docs.python.org/3/library/hashlib.htmlFixes: #223
