You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
As discussed in #12108 it is possible to make own Implementations of rsa.RSAPrivateKey to use keys which are stored in a HSM. Therefore code can just assume to get a rsa.RSAPrivateKey and be agnostic of the underlying implementation.
However the same possibility does not exist for the AEAD constructions in cryptography.hazmat.primitives.ciphers.aead. Since they are not abstract base classes as for the asymmetric keys but direct aliases of Rust bindings. This is also preventing my from just subclassing one of this classes, this seems not possible for the Rust class.
It is therefore not possible to write some code which receives a AESGCM object and uses it agnostic of how this works internally. This would be very helpful to have generic code that just needs to encrypt something, and that can be supplied with a standard cryptography implementation with a key in memory, or with a implementation using the en/decrypt functionality of a HSM. With the current situation there must be a distinction between cases.
I am not sure on how to approach this in a backward compatible manner. Since just replacing the current classes with abstract base classes would break existing code which then would have to use the concrete subclass using the rust backend. So basically I see two options here, but maybe there are more.
Make the current classes inheritable, so that one can just subclass it and override all methods to fit to the HSM implementation.
Add abstract base classes in another module, and register the current classes as virtual Subclasses as it is done with the rsa keys. On could then write code expecting the ABC and the current objects would be valid.
The text was updated successfully, but these errors were encountered:
As discussed in #12108 it is possible to make own Implementations of
rsa.RSAPrivateKey
to use keys which are stored in a HSM. Therefore code can just assume to get arsa.RSAPrivateKey
and be agnostic of the underlying implementation.However the same possibility does not exist for the AEAD constructions in
cryptography.hazmat.primitives.ciphers.aead
. Since they are not abstract base classes as for the asymmetric keys but direct aliases of Rust bindings. This is also preventing my from just subclassing one of this classes, this seems not possible for the Rust class.It is therefore not possible to write some code which receives a AESGCM object and uses it agnostic of how this works internally. This would be very helpful to have generic code that just needs to encrypt something, and that can be supplied with a standard cryptography implementation with a key in memory, or with a implementation using the en/decrypt functionality of a HSM. With the current situation there must be a distinction between cases.
I am not sure on how to approach this in a backward compatible manner. Since just replacing the current classes with abstract base classes would break existing code which then would have to use the concrete subclass using the rust backend. So basically I see two options here, but maybe there are more.
The text was updated successfully, but these errors were encountered: