diff options
| author | Viacheslav Hletenko <v.gletenko@vyos.io> | 2026-09-01 13:35:41 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-09-01 13:35:41 +0300 |
| commit | 0ee7e143e52f39fe04b8b11fd6e7120808a74648 (patch) | |
| tree | 1f88934e1b33786a3a00e032d83f1903cd5e1c5c /python | |
| parent | 2c269ef450f88690d03970fcafb1dbaa8b3b7f54 (diff) | |
| parent | 4f7900b2601a57a0e9edd297e700f457abe72378 (diff) | |
| download | vyos-1x-0ee7e143e52f39fe04b8b11fd6e7120808a74648.tar.gz vyos-1x-0ee7e143e52f39fe04b8b11fd6e7120808a74648.zip | |
Merge pull request #5418 from abukharov/feat/t9225-pki-edsigns
pki: T9225: Support ED25519 and ED448 signatures on public keys in PKI
Diffstat (limited to 'python')
| -rw-r--r-- | python/vyos/pki.py | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/python/vyos/pki.py b/python/vyos/pki.py index af0dee626..e9f961911 100644 --- a/python/vyos/pki.py +++ b/python/vyos/pki.py @@ -26,6 +26,8 @@ from cryptography.hazmat.primitives import serialization from cryptography.hazmat.primitives.asymmetric import dh from cryptography.hazmat.primitives.asymmetric import dsa from cryptography.hazmat.primitives.asymmetric import ec +from cryptography.hazmat.primitives.asymmetric import ed25519 +from cryptography.hazmat.primitives.asymmetric import ed448 from cryptography.hazmat.primitives.asymmetric import padding from cryptography.hazmat.primitives.asymmetric import rsa @@ -390,6 +392,14 @@ def verify_certificate(cert, ca_cert): cert.signature, cert.tbs_certificate_bytes, signature_algorithm=ec.ECDSA(cert.signature_hash_algorithm)) + elif isinstance(ca_public_key, ed25519.Ed25519PublicKey): + ca_public_key.verify( + cert.signature, + cert.tbs_certificate_bytes) + elif isinstance(ca_public_key, ed448.Ed448PublicKey): + ca_public_key.verify( + cert.signature, + cert.tbs_certificate_bytes) else: return False # We cannot verify it return True @@ -419,6 +429,14 @@ def verify_crl(crl, ca_cert): crl.signature, crl.tbs_certlist_bytes, signature_algorithm=ec.ECDSA(crl.signature_hash_algorithm)) + elif isinstance(ca_public_key, ed25519.Ed25519PublicKey): + ca_public_key.verify( + crl.signature, + crl.tbs_certlist_bytes) + elif isinstance(ca_public_key, ed448.Ed448PublicKey): + ca_public_key.verify( + crl.signature, + crl.tbs_certlist_bytes) else: return False # We cannot verify it return True |