{"action":"created","comment":{"url":"https://api.github.com/repos/reaperhulk/cryptography/pulls/comments/61689599","id":61689599,"diff_hunk":"@@ -578,7 +578,40 @@ def _pem_password_cb(self, password):\n         userdata = _PasswordUserdata(password=password)\n         return _pem_password_cb, userdata\n \n-    def _mgf1_hash_supported(self, algorithm):\n+    def _get_oaep_supported_padding_algorithms(backend):\n+        # Verified test Vectors for OAEP only cover SHA-1 and SHA-2 currently\n+        # with OpenSSL >= 1.0.2.\n+        if backend._lib.OpenSSL_version_num() >= 0x10002001:\n+            _oaep_supported_padding_algorithms = (\n+                hashes.SHA1,\n+                hashes.SHA224,\n+                hashes.SHA256,\n+                hashes.SHA384,\n+                hashes.SHA512\n+            )\n+        else:\n+            _oaep_supported_padding_algorithms = ( hashes.SHA1, )\n+\n+        return _oaep_supported_padding_algorithms\n+\n+    def _oaep_mgf1_hash_supported(self, algorithm):\n+        if self._lib.Cryptography_HAS_MGF1_MD:\n+            return (\n+                isinstance(algorithm,\n+                    self._get_oaep_supported_padding_algorithms()) and\n+                self.hash_supported(algorithm)\n+            )\n+        else:\n+            return isinstance(algorithm, hashes.SHA1)\n+\n+    def _oaep_hash_supported(self, algorithm):\n+        return (\n+            isinstance(algorithm,\n+                self._get_oaep_supported_padding_algorithms()) and\n+            self.hash_supported(algorithm)\n+        )\n+\n+    def _pss_mgf1_hash_supported(self, algorithm):\n         if self._lib.Cryptography_HAS_MGF1_MD:\n             return self.hash_supported(algorithm)","path":"src/cryptography/hazmat/backends/openssl/backend.py","position":40,"original_position":40,"commit_id":"bf34c354ca58f86ffb23bd539345be2449a38d48","original_commit_id":"bf34c354ca58f86ffb23bd539345be2449a38d48","user":{"login":"collisdigital","id":14041600,"avatar_url":"https://avatars.githubusercontent.com/u/14041600?v=3","gravatar_id":"","url":"https://api.github.com/users/collisdigital","html_url":"https://github.com/collisdigital","followers_url":"https://api.github.com/users/collisdigital/followers","following_url":"https://api.github.com/users/collisdigital/following{/other_user}","gists_url":"https://api.github.com/users/collisdigital/gists{/gist_id}","starred_url":"https://api.github.com/users/collisdigital/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/collisdigital/subscriptions","organizations_url":"https://api.github.com/users/collisdigital/orgs","repos_url":"https://api.github.com/users/collisdigital/repos","events_url":"https://api.github.com/users/collisdigital/events{/privacy}","received_events_url":"https://api.github.com/users/collisdigital/received_events","type":"User","site_admin":false},"body":"I have split out the PSS check as I wasn't sure that these changes should also apply the PSS? Although the existing code returns True for any supported hash with PSS, is that correct? If not I think that's a separate PR...","created_at":"2016-05-01T16:50:49Z","updated_at":"2016-05-01T16:50:49Z","html_url":"https://github.com/reaperhulk/cryptography/pull/6#discussion_r61689599","pull_request_url":"https://api.github.com/repos/reaperhulk/cryptography/pulls/6","_links":{"self":{"href":"https://api.github.com/repos/reaperhulk/cryptography/pulls/comments/61689599"},"html":{"href":"https://github.com/reaperhulk/cryptography/pull/6#discussion_r61689599"},"pull_request":{"href":"https://api.github.com/repos/reaperhulk/cryptography/pulls/6"}}},"pull_request":{"url":"https://api.github.com/repos/reaperhulk/cryptography/pulls/6","id":68438439,"html_url":"https://github.com/reaperhulk/cryptography/pull/6","diff_url":"https://github.com/reaperhulk/cryptography/pull/6.diff","patch_url":"https://github.com/reaperhulk/cryptography/pull/6.patch","issue_url":"https://api.github.com/repos/reaperhulk/cryptography/issues/6","number":6,"state":"open","locked":false,"title":"Limit RSA-OAEP padding to SHA-1 and SHA-2 algorithms in supported openssl","user":{"login":"collisdigital","id":14041600,"avatar_url":"https://avatars.githubusercontent.com/u/14041600?v=3","gravatar_id":"","url":"https://api.github.com/users/collisdigital","html_url":"https://github.com/collisdigital","followers_url":"https://api.github.com/users/collisdigital/followers","following_url":"https://api.github.com/users/collisdigital/following{/other_user}","gists_url":"https://api.github.com/users/collisdigital/gists{/gist_id}","starred_url":"https://api.github.com/users/collisdigital/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/collisdigital/subscriptions","organizations_url":"https://api.github.com/users/collisdigital/orgs","repos_url":"https://api.github.com/users/collisdigital/repos","events_url":"https://api.github.com/users/collisdigital/events{/privacy}","received_events_url":"https://api.github.com/users/collisdigital/received_events","type":"User","site_admin":false},"body":"Raising this as WIP, want your thoughts on this approach. I've updated the openssl backend to limit the hashes allowed with RSA-OAEP depending on the OpenSSL version to those verified with test vectors. \r\n\r\nDoing this made some of the code in rsa.py a duplicate of the backend.py so I've removed the duplicate checks, however it does mean the errors are less verbose when an invalid combination is given. Advantage being only one set of checks need to be maintained and two areas of code don't need to be synchronised manually when changing.\r\n\r\nWhat do you think? ","created_at":"2016-04-29T21:44:43Z","updated_at":"2016-05-01T16:50:49Z","closed_at":null,"merged_at":null,"merge_commit_sha":"3dcde80e226b045d41f60cf7fe2c0690bbb8379f","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/reaperhulk/cryptography/pulls/6/commits","review_comments_url":"https://api.github.com/repos/reaperhulk/cryptography/pulls/6/comments","review_comment_url":"https://api.github.com/repos/reaperhulk/cryptography/pulls/comments{/number}","comments_url":"https://api.github.com/repos/reaperhulk/cryptography/issues/6/comments","statuses_url":"https://api.github.com/repos/reaperhulk/cryptography/statuses/bf34c354ca58f86ffb23bd539345be2449a38d48","head":{"label":"collisdigital:oaep-sha2-support-algo-limit","ref":"oaep-sha2-support-algo-limit","sha":"bf34c354ca58f86ffb23bd539345be2449a38d48","user":{"login":"collisdigital","id":14041600,"avatar_url":"https://avatars.githubusercontent.com/u/14041600?v=3","gravatar_id":"","url":"https://api.github.com/users/collisdigital","html_url":"https://github.com/collisdigital","followers_url":"https://api.github.com/users/collisdigital/followers","following_url":"https://api.github.com/users/collisdigital/following{/other_user}","gists_url":"https://api.github.com/users/collisdigital/gists{/gist_id}","starred_url":"https://api.github.com/users/collisdigital/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/collisdigital/subscriptions","organizations_url":"https://api.github.com/users/collisdigital/orgs","repos_url":"https://api.github.com/users/collisdigital/repos","events_url":"https://api.github.com/users/collisdigital/events{/privacy}","received_events_url":"https://api.github.com/users/collisdigital/received_events","type":"User","site_admin":false},"repo":{"id":56889407,"name":"cryptography","full_name":"collisdigital/cryptography","owner":{"login":"collisdigital","id":14041600,"avatar_url":"https://avatars.githubusercontent.com/u/14041600?v=3","gravatar_id":"","url":"https://api.github.com/users/collisdigital","html_url":"https://github.com/collisdigital","followers_url":"https://api.github.com/users/collisdigital/followers","following_url":"https://api.github.com/users/collisdigital/following{/other_user}","gists_url":"https://api.github.com/users/collisdigital/gists{/gist_id}","starred_url":"https://api.github.com/users/collisdigital/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/collisdigital/subscriptions","organizations_url":"https://api.github.com/users/collisdigital/orgs","repos_url":"https://api.github.com/users/collisdigital/repos","events_url":"https://api.github.com/users/collisdigital/events{/privacy}","received_events_url":"https://api.github.com/users/collisdigital/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/collisdigital/cryptography","description":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.","fork":true,"url":"https://api.github.com/repos/collisdigital/cryptography","forks_url":"https://api.github.com/repos/collisdigital/cryptography/forks","keys_url":"https://api.github.com/repos/collisdigital/cryptography/keys{/key_id}","collaborators_url":"https://api.github.com/repos/collisdigital/cryptography/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/collisdigital/cryptography/teams","hooks_url":"https://api.github.com/repos/collisdigital/cryptography/hooks","issue_events_url":"https://api.github.com/repos/collisdigital/cryptography/issues/events{/number}","events_url":"https://api.github.com/repos/collisdigital/cryptography/events","assignees_url":"https://api.github.com/repos/collisdigital/cryptography/assignees{/user}","branches_url":"https://api.github.com/repos/collisdigital/cryptography/branches{/branch}","tags_url":"https://api.github.com/repos/collisdigital/cryptography/tags","blobs_url":"https://api.github.com/repos/collisdigital/cryptography/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/collisdigital/cryptography/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/collisdigital/cryptography/git/refs{/sha}","trees_url":"https://api.github.com/repos/collisdigital/cryptography/git/trees{/sha}","statuses_url":"https://api.github.com/repos/collisdigital/cryptography/statuses/{sha}","languages_url":"https://api.github.com/repos/collisdigital/cryptography/languages","stargazers_url":"https://api.github.com/repos/collisdigital/cryptography/stargazers","contributors_url":"https://api.github.com/repos/collisdigital/cryptography/contributors","subscribers_url":"https://api.github.com/repos/collisdigital/cryptography/subscribers","subscription_url":"https://api.github.com/repos/collisdigital/cryptography/subscription","commits_url":"https://api.github.com/repos/collisdigital/cryptography/commits{/sha}","git_commits_url":"https://api.github.com/repos/collisdigital/cryptography/git/commits{/sha}","comments_url":"https://api.github.com/repos/collisdigital/cryptography/comments{/number}","issue_comment_url":"https://api.github.com/repos/collisdigital/cryptography/issues/comments{/number}","contents_url":"https://api.github.com/repos/collisdigital/cryptography/contents/{+path}","compare_url":"https://api.github.com/repos/collisdigital/cryptography/compare/{base}...{head}","merges_url":"https://api.github.com/repos/collisdigital/cryptography/merges","archive_url":"https://api.github.com/repos/collisdigital/cryptography/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/collisdigital/cryptography/downloads","issues_url":"https://api.github.com/repos/collisdigital/cryptography/issues{/number}","pulls_url":"https://api.github.com/repos/collisdigital/cryptography/pulls{/number}","milestones_url":"https://api.github.com/repos/collisdigital/cryptography/milestones{/number}","notifications_url":"https://api.github.com/repos/collisdigital/cryptography/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/collisdigital/cryptography/labels{/name}","releases_url":"https://api.github.com/repos/collisdigital/cryptography/releases{/id}","deployments_url":"https://api.github.com/repos/collisdigital/cryptography/deployments","created_at":"2016-04-22T22:48:29Z","updated_at":"2016-04-22T22:48:37Z","pushed_at":"2016-05-01T16:37:47Z","git_url":"git://github.com/collisdigital/cryptography.git","ssh_url":"git@github.com:collisdigital/cryptography.git","clone_url":"https://github.com/collisdigital/cryptography.git","svn_url":"https://github.com/collisdigital/cryptography","homepage":"https://cryptography.io/","size":33895,"stargazers_count":0,"watchers_count":0,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"reaperhulk:oaep-sha2-support","ref":"oaep-sha2-support","sha":"445fbd014863884f1bd183e8b912bb933f43993c","user":{"login":"reaperhulk","id":161495,"avatar_url":"https://avatars.githubusercontent.com/u/161495?v=3","gravatar_id":"","url":"https://api.github.com/users/reaperhulk","html_url":"https://github.com/reaperhulk","followers_url":"https://api.github.com/users/reaperhulk/followers","following_url":"https://api.github.com/users/reaperhulk/following{/other_user}","gists_url":"https://api.github.com/users/reaperhulk/gists{/gist_id}","starred_url":"https://api.github.com/users/reaperhulk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/reaperhulk/subscriptions","organizations_url":"https://api.github.com/users/reaperhulk/orgs","repos_url":"https://api.github.com/users/reaperhulk/repos","events_url":"https://api.github.com/users/reaperhulk/events{/privacy}","received_events_url":"https://api.github.com/users/reaperhulk/received_events","type":"User","site_admin":false},"repo":{"id":12704352,"name":"cryptography","full_name":"reaperhulk/cryptography","owner":{"login":"reaperhulk","id":161495,"avatar_url":"https://avatars.githubusercontent.com/u/161495?v=3","gravatar_id":"","url":"https://api.github.com/users/reaperhulk","html_url":"https://github.com/reaperhulk","followers_url":"https://api.github.com/users/reaperhulk/followers","following_url":"https://api.github.com/users/reaperhulk/following{/other_user}","gists_url":"https://api.github.com/users/reaperhulk/gists{/gist_id}","starred_url":"https://api.github.com/users/reaperhulk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/reaperhulk/subscriptions","organizations_url":"https://api.github.com/users/reaperhulk/orgs","repos_url":"https://api.github.com/users/reaperhulk/repos","events_url":"https://api.github.com/users/reaperhulk/events{/privacy}","received_events_url":"https://api.github.com/users/reaperhulk/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/reaperhulk/cryptography","description":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.","fork":true,"url":"https://api.github.com/repos/reaperhulk/cryptography","forks_url":"https://api.github.com/repos/reaperhulk/cryptography/forks","keys_url":"https://api.github.com/repos/reaperhulk/cryptography/keys{/key_id}","collaborators_url":"https://api.github.com/repos/reaperhulk/cryptography/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/reaperhulk/cryptography/teams","hooks_url":"https://api.github.com/repos/reaperhulk/cryptography/hooks","issue_events_url":"https://api.github.com/repos/reaperhulk/cryptography/issues/events{/number}","events_url":"https://api.github.com/repos/reaperhulk/cryptography/events","assignees_url":"https://api.github.com/repos/reaperhulk/cryptography/assignees{/user}","branches_url":"https://api.github.com/repos/reaperhulk/cryptography/branches{/branch}","tags_url":"https://api.github.com/repos/reaperhulk/cryptography/tags","blobs_url":"https://api.github.com/repos/reaperhulk/cryptography/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/reaperhulk/cryptography/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/reaperhulk/cryptography/git/refs{/sha}","trees_url":"https://api.github.com/repos/reaperhulk/cryptography/git/trees{/sha}","statuses_url":"https://api.github.com/repos/reaperhulk/cryptography/statuses/{sha}","languages_url":"https://api.github.com/repos/reaperhulk/cryptography/languages","stargazers_url":"https://api.github.com/repos/reaperhulk/cryptography/stargazers","contributors_url":"https://api.github.com/repos/reaperhulk/cryptography/contributors","subscribers_url":"https://api.github.com/repos/reaperhulk/cryptography/subscribers","subscription_url":"https://api.github.com/repos/reaperhulk/cryptography/subscription","commits_url":"https://api.github.com/repos/reaperhulk/cryptography/commits{/sha}","git_commits_url":"https://api.github.com/repos/reaperhulk/cryptography/git/commits{/sha}","comments_url":"https://api.github.com/repos/reaperhulk/cryptography/comments{/number}","issue_comment_url":"https://api.github.com/repos/reaperhulk/cryptography/issues/comments{/number}","contents_url":"https://api.github.com/repos/reaperhulk/cryptography/contents/{+path}","compare_url":"https://api.github.com/repos/reaperhulk/cryptography/compare/{base}...{head}","merges_url":"https://api.github.com/repos/reaperhulk/cryptography/merges","archive_url":"https://api.github.com/repos/reaperhulk/cryptography/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/reaperhulk/cryptography/downloads","issues_url":"https://api.github.com/repos/reaperhulk/cryptography/issues{/number}","pulls_url":"https://api.github.com/repos/reaperhulk/cryptography/pulls{/number}","milestones_url":"https://api.github.com/repos/reaperhulk/cryptography/milestones{/number}","notifications_url":"https://api.github.com/repos/reaperhulk/cryptography/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/reaperhulk/cryptography/labels{/name}","releases_url":"https://api.github.com/repos/reaperhulk/cryptography/releases{/id}","deployments_url":"https://api.github.com/repos/reaperhulk/cryptography/deployments","created_at":"2013-09-09T14:59:27Z","updated_at":"2015-10-08T21:28:40Z","pushed_at":"2016-05-01T16:37:48Z","git_url":"git://github.com/reaperhulk/cryptography.git","ssh_url":"git@github.com:reaperhulk/cryptography.git","clone_url":"https://github.com/reaperhulk/cryptography.git","svn_url":"https://github.com/reaperhulk/cryptography","homepage":"","size":34196,"stargazers_count":1,"watchers_count":1,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":1,"forks":0,"open_issues":1,"watchers":1,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/reaperhulk/cryptography/pulls/6"},"html":{"href":"https://github.com/reaperhulk/cryptography/pull/6"},"issue":{"href":"https://api.github.com/repos/reaperhulk/cryptography/issues/6"},"comments":{"href":"https://api.github.com/repos/reaperhulk/cryptography/issues/6/comments"},"review_comments":{"href":"https://api.github.com/repos/reaperhulk/cryptography/pulls/6/comments"},"review_comment":{"href":"https://api.github.com/repos/reaperhulk/cryptography/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/reaperhulk/cryptography/pulls/6/commits"},"statuses":{"href":"https://api.github.com/repos/reaperhulk/cryptography/statuses/bf34c354ca58f86ffb23bd539345be2449a38d48"}}}}