Remove references to crypto_valid_advanced?

[guedou]

Since support for cryptography < 2.0 tests were removed in #2260, should we remove references to crypto_valid_advanced at these locations?

$ git grep crypto_valid_advanced
scapy/config.py:    crypto_valid_advanced = isCryptographyAdvanced()
scapy/layers/tls/automaton_cli.py:            if conf.crypto_valid_advanced:
scapy/layers/tls/automaton_cli.py:                            if conf.crypto_valid_advanced:
scapy/layers/tls/automaton_cli.py:        if conf.crypto_valid_advanced:
scapy/layers/tls/crypto/cipher_aead.py:if conf.crypto_valid_advanced:
scapy/layers/tls/crypto/cipher_aead.py:        # if conf.crypto_valid_advanced:
scapy/layers/tls/crypto/cipher_aead.py:if conf.crypto_valid_advanced:
scapy/layers/tls/crypto/cipher_aead.py:            if (conf.crypto_valid_advanced and
scapy/layers/tls/crypto/cipher_aead.py:                if (conf.crypto_valid_advanced and
scapy/layers/tls/crypto/cipher_aead.py:                    if (conf.crypto_valid_advanced and
scapy/layers/tls/crypto/cipher_aead.py:if conf.crypto_valid_advanced:
scapy/layers/tls/crypto/cipher_aead.py:        # if conf.crypto_valid_advanced:
scapy/layers/tls/crypto/cipher_aead.py:if conf.crypto_valid_advanced:
scapy/layers/tls/keyexchange_tls13.py:if conf.crypto_valid_advanced:
scapy/layers/tls/keyexchange_tls13.py:                if conf.crypto_valid_advanced:
scapy/layers/tls/keyexchange_tls13.py:                if conf.crypto_valid_advanced:
scapy/layers/tls/record.py:if conf.crypto_valid_advanced:
scapy/layers/tls/record.py:            if (conf.crypto_valid_advanced and

[gpotter2]

crypto_valid_advanced is about X25519 support. Doesn't it require a certain OpenSSL version or something ?

[guedou]

You are right. It is mostly used for X25519. In cipher_aead.py, and tls_record.py it is also used to import AESCCM and ChaCha20Poly1305. I will check if these algorithms need a specific suppor in OpenSSL or are implemented in Python.

[guedou]

I seems that cryptography supports OpenSSL >= 1.0.1 (from https://cryptography.io/en/latest/hazmat/backends/openssl/).

I found that 1.1.0 supports AES CCM, ChaCha20Poly1305 and X25519 (https://www.openssl.org/docs/man1.1.0/man1/ciphers.html).

[guedou]

It might be better to change crypto_valid_advanced to something more explicit and related to the algorithms. Another alternative is to use openssl_version_text() (https://cryptography.io/en/latest/hazmat/backends/openssl/#openssl_version_text) to decide which algorithms can be used.