commit 3e5f21b505a7a6a1a6fe95b719ef8eb355e09db0
author Paul Kehrer <paul.l.kehrer@gmail.com> Thu Jun 12 10:03:53 2014 -0500
committer Paul Kehrer <paul.l.kehrer@gmail.com> Thu Jun 12 10:03:53 2014 -0500
tree 6c291c41bc64af789def6a1ffe8d9496090a56bb
parent 6e3b6b18b26b05122cf43001dbddd2f65220fe21

do value checks when converting from numbers to key

cryptography/hazmat/backends/openssl/backend.py

diff --git a/cryptography/hazmat/backends/openssl/backend.py b/cryptography/hazmat/backends/openssl/backend.py
index 2036093..0e88fad 100644
--- a/cryptography/hazmat/backends/openssl/backend.py
+++ b/cryptography/hazmat/backends/openssl/backend.py
@@ -382,6 +382,16 @@
                 key_size >= 512)
 
     def load_rsa_private_numbers(self, numbers):
+        rsa._check_private_key_components(
+            numbers.p,
+            numbers.q,
+            numbers.d,
+            numbers.dmp1,
+            numbers.dmq1,
+            numbers.iqmp,
+            numbers.public_numbers.e,
+            numbers.public_numbers.n
+        )
         rsa_cdata = self._lib.RSA_new()
         assert rsa_cdata != self._ffi.NULL
         rsa_cdata = self._ffi.gc(rsa_cdata, self._lib.RSA_free)
@@ -399,7 +409,15 @@
         return _RSAPrivateKey(self, rsa_cdata)
 
     def load_rsa_public_numbers(self, numbers):
-        rsa_cdata = self._rsa_cdata_from_public_numbers(numbers)
+        rsa._check_public_key_components(numbers.e, numbers.n)
+        rsa_cdata = self._lib.RSA_new()
+        assert rsa_cdata != self._ffi.NULL
+        rsa_cdata = self._ffi.gc(rsa_cdata, self._lib.RSA_free)
+        rsa_cdata.e = self._int_to_bn(numbers.e)
+        rsa_cdata.n = self._int_to_bn(numbers.n)
+        res = self._lib.RSA_blinding_on(rsa_cdata, self._ffi.NULL)
+        assert res == 1
+
         return _RSAPublicKey(self, rsa_cdata)
 
     def _new_evp_pkey(self):
@@ -532,19 +550,6 @@
 
         return ctx
 
-    def _rsa_cdata_from_public_numbers(self, public_numbers):
-        # Does not GC the RSA cdata. You *must* make sure it's freed
-        # correctly yourself!
-
-        ctx = self._lib.RSA_new()
-        assert ctx != self._ffi.NULL
-        ctx.e = self._int_to_bn(public_numbers.e)
-        ctx.n = self._int_to_bn(public_numbers.n)
-        res = self._lib.RSA_blinding_on(ctx, self._ffi.NULL)
-        assert res == 1
-
-        return ctx
-
     def create_rsa_signature_ctx(self, private_key, padding, algorithm):
         rsa_cdata = self._rsa_cdata_from_private_key(private_key)
         rsa_cdata = self._ffi.gc(rsa_cdata, self._lib.RSA_free)

tests/hazmat/primitives/test_rsa.py

diff --git a/tests/hazmat/primitives/test_rsa.py b/tests/hazmat/primitives/test_rsa.py
index 6b65eba..ffaaf58 100644
--- a/tests/hazmat/primitives/test_rsa.py
+++ b/tests/hazmat/primitives/test_rsa.py
@@ -1644,7 +1644,7 @@
 class TestRSANumbers(object):
     def test_rsa_public_numbers(self):
         public_numbers = rsa.RSAPublicNumbers(e=1, n=15)
-        assert public_numbers.e == 3
+        assert public_numbers.e == 1
         assert public_numbers.n == 15
 
     def test_rsa_private_numbers(self):