As the PyCrypto website says [1]:
> PyCrypto 2.x is unmaintained, obsolete, and contains security
> vulnerabilities.
Therefore, switch to PyCryptodome, a maintained PyCrypto fork
which is listed there as the recommended alternative for
existing software that depends on PyCrypto.
Notes on the port:
1) As the PyCryptodome introduction documentation [2] says,
there are 2 alternative projects/namespaces that can be
used:
* pycryptodome, which uses the `Crypto` package
that PyCrypto also uses, so is almost a drop-in
replacement for Pycrypto
* pycryptodomex, which uses the `Cryptodome` package
It also mentions that the use of pycryptodome
"is therefore recommended only when you are
sure that the whole application is deployed in a virtualenv".
Since it isn't sure that the application is deployed in a
virtualenv, to make it more explicit that PyCryptodome
is being used and because Linux distros like Debian
package the `Cryptodome` package [3], the port is done to
the `pycryptodomex` library that uses the `Cryptodome`
package name.
2) As the "Compatibility with PyCrypto" page in the PyCryptodome
doc [4] says:
> The following packages, modules and functions have been removed:
>
> * Crypto.Random.OSRNG, Crypto.Util.winrandom and Crypto.Random.randpool.
> You should use Crypto.Random only.
The `PublicKey.RSA.generate` method already uses
`Crypto.Random.get_random_bytes()` as default [5],
so just drop the second parameter using `RandomPool.getBytes`
in `virtualsmartcard/src/vpicc/virtualsmartcard/cards/cryptoflex.py`.
[1] https://www.pycrypto.org/
[2] https://www.pycryptodome.org/src/introduction
[3] https://packages.debian.org/bullseye/python3-pycryptodome
[4] https://pycryptodome.readthedocs.io/en/latest/src/vs_pycrypto.html
[5] https://pycryptodome.readthedocs.io/en/latest/src/public_key/rsa.html
Commit 82c0c4fdd2
("Fallback to hashlib instead of deprecated libs")
had changed the hmac import to try the import from
the hashlib module, but there appears to be 'hmac'
underneath hashlib in neither Python 2 nor Python 3, but
it's a separate module.
Test on Debian testing with Python 2.7.18:
$ python2
Python 2.7.18 (default, Aug 1 2022, 06:23:55)
[GCC 12.1.0] on linux2
Type "help", "copyright", "credits" or "license" for more information.
Jedi is not installed, falling back to readline
>>> from hashlib import hmac as HMAC
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
ImportError: cannot import name hmac
>>> import hmac as HMAC
>>>
The same with Python 3.10.6:
$ python3
Python 3.10.6 (main, Aug 10 2022, 11:19:32) [GCC 12.1.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
Using Jedi for tab completion.
>>> from hashlib import hmac as HMAC
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
ImportError: cannot import name 'hmac' from 'hashlib' (/usr/lib/python3.10/hashlib.py)
>>> import hmac as HMAC
>>>
Even the official Python 3.10.6 documentation for the hashlib
module use plain hmac import [1] in its example:
>>> import hmac, hashlib
>>> m = hmac.new(b'secret key', digestmod=hashlib.blake2s)
>>> m.update(b'message')
>>> m.hexdigest()
'e3c8102868d28b5ff85fc35dda07329970d1a01e273c37481326fe0c861c8142'
Therefore, revert that change to the import and use the direct hmac
import again to make the case where PyCrypto is not installed work
again.
[1] https://docs.python.org/3/library/hashlib.htmlFixes: #223
This should fix the appveyor build failure:
C:\projects\vsmartcard\virtualsmartcard\src\vpcd\vpcd.c(183): error C4700: uninitialized local variable 'rfds' used [C:\projects\vsmartcard\virtualsmartcard\win32\BixVReader\BixVReader.vcxproj]
Some additional code linting
- remove unused imports
- remove unecessary parenthesis from if statements
- created TLVutils TAG dictionary in creation time
- Use pycryptodome instead of pycrypto
- Fixed some unit tests asserts
- fixed some instances that sending message to vpcd the msg is considered a string object instead of byte array
- make TLVutils.pack work in python 3
Fix prerequisites and Automake variables in the Makefiles, so that
running "make dist" does not fail if the program is not built. When
running help2man, have it execute "gengetopt --show-help" instead
of the built program to obtain the help message.
* Fix length of filesize parameter in FCP template
'Number of data bytes in the file' parameters should be represented on
two bytes in FCP.
* Extendable length of filesize parameter in FCP
Increase length of filesize parameter in FCP template if can't be
represented on two bytes.
DF names shall be globally uniqe within a given card. Selecting by DF
name should be made on card level instead of current DF level.
A new list has been inroduced as a static attribute of MF in order to
track each named DF.
* Prevent prettyprint from infinite recursion
By adding a possible self-pointer to MF prettyprint_anything function
got into an infinite loop. Printing of named DFs has been cut off.
