Known security limitations¶
Secure memory wiping¶
Memory wiping is used to protect secret data or key material from attackers with access to deallocated memory. This is a defense-in-depth measure against vulnerabilities that leak application memory.
cryptography APIs which accept
bytes also accept types which
implement the buffer interface. Thus, users wishing to do so can pass
memoryview or another mutable type to
cryptography APIs, and overwrite
the contents once the data is no longer needed.
cryptography does not clear memory by default, as there is no way
to clear immutable structures such as
bytes. As a result,
like almost all software in Python is potentially vulnerable to this attack. The
CERT secure coding guidelines assesses this issue as “Severity: medium,
Likelihood: unlikely, Remediation Cost: expensive to repair” and we do not
consider this a high risk for most users.
RSA PKCS1 v1.5 constant time decryption¶
RSA decryption has several different modes, one of which is PKCS1 v1.5. When used in online contexts, a secure protocol implementation requires that peers not be able to tell whether RSA PKCS1 v1.5 decryption failed or succeeded, even by timing variability.
cryptography does not provide an API that makes this possible, due to the
fact that RSA decryption raises an exception on failure, which takes a
different amount of time than returning a value in the success case.
Fixing this would require a new API in
cryptography, but OpenSSL does
not expose an API for straightforwardly implementing this while reusing
its own constant-time logic. See issue 6167 for more information.
For this reason we recommend not implementing online protocols
that use RSA PKCS1 v1.5 decryption with
cryptography – independent of this
limitation, such protocols generally have poor security properties due to their
lack of forward security.