Python-RSA 3.4 released
Python-RSA 3.4 has been released! This is the first release from GitHub, and contains a lot of improvements by myself, Michael Manganiello, and Filippo Valsorda, including the solution for a side-channel vulnerability.
Get it while it’s hot at
the Python Package Index, or just
pip install --upgrade rsa.
The changes are:
- Moved development to Github: https://github.com/sybrenstuvel/python-rsa
- Solved side-channel vulnerability by implementing blinding, fixes #19
- Deprecated the VARBLOCK format and rsa.bigfile module due to security issues, see https://github.com/sybrenstuvel/python-rsa/issues/13
- Integration with Travis-CI, Coveralls and Code Climate.
- Deprecated the old rsa._version133 and rsa._version200 submodules, they will be completely removed in version 4.0.
- Add an ’exponent’ argument to key.newkeys()
- Switched from Solovay-Strassen to Miller-Rabin primality testing, to comply with NIST FIPS 186-4 as probabilistic primality test (Appendix C, subsection C.3).
- Fixed various bugs.
Version 3.4 is the last version in the 3.x range. Version 4.0 will drop the following modules, as they are insecure:
Those modules are marked as deprecated in version 3.4.
Furthermore, in 4.0 the I/O functions will be streamlined to always work with bytes on all supported versions of Python.