Commit dd37080c authored by Szilárd Pfeiffer's avatar Szilárd Pfeiffer
Browse files

Merge branch '190-implement-tests-for-pqc-algorithms' 

Closes: #190
parents 71c0ef93 71d6f5a8

CHANGELOG.rst

+11 −0
Original line number Diff line number Diff line
@@ -2,6 +2,17 @@ 
Changelog

=========



------------------

1.6.0 - Unreleased

------------------



Notable fixes

=============



-  TLS (``tls``)



   -  offer the standalone post-quantum signature algorithms in the client hello (#190)



------------------

1.5.0 - 2026-07-31

------------------

cryptolyzer.spec

+3 −0
Original line number Diff line number Diff line
@@ -90,6 +90,9 @@ export SETUPTOOLS_SCM_PRETEND_VERSION=%{version} 
%{_bindir}/cryptolyze



%changelog

* Wed Aug 05 2026 Szilárd Pfeiffer <coroner@pfeifferszilard.hu> - 1.6.0-1

- offer the standalone post-quantum signature algorithms in the client hello (#190)



* Fri Jul 31 2026 Szilárd Pfeiffer <coroner@pfeifferszilard.hu> - 1.5.0-1

- add IKE public keys checker for IKEv1 aggressive-mode and IKEv2 EAP-mode servers (#183)

- add IKE public key request checker for enumerating accepted certification authority hashes (#183)

cryptolyzer/tls/client.py

+12 −2
Original line number Diff line number Diff line
@@ -129,6 +129,16 @@ def key_share_entry_from_named_curve(named_curve): 




class TlsHandshakeClientHelloSpecalization(TlsHandshakeClientHello):

    @staticmethod

    def _is_tls1_3_signature_algorithm(signature_algorithm):

        # A standalone signature algorithm, such as ML-DSA or Falcon, has no separate hash algorithm,

        # so the absence of one does not exclude it. The entries without a hash algorithm that are

        # not TLS 1.3 algorithms are the legacy combinations of TLS 1.2 signalling no hash at all.

        return (

            signature_algorithm.value.hash_algorithm is not None or

            signature_algorithm.value.initial_version.value.code >= TlsVersion.TLS1_3.value.code

        )



    @classmethod

    def _get_signature_algorithms(cls, protocol_version_min, protocol_version_max, cipher_suites):

        if protocol_version_max > TlsProtocolVersion(TlsVersion.TLS1_2):
@@ -137,7 +147,7 @@ class TlsHandshakeClientHelloSpecalization(TlsHandshakeClientHello): 
                signature_algorithm

                for signature_algorithm in TlsSignatureAndHashAlgorithm

                if (signature_algorithm.value.signature_algorithm not in authentications_not_exist_in_tls1_3 and

                    signature_algorithm.value.hash_algorithm is not None)

                    cls._is_tls1_3_signature_algorithm(signature_algorithm))

            ]

        elif protocol_version_min >= TlsProtocolVersion(TlsVersion.TLS1_2):

            authentication_algorithms = set(
@@ -226,7 +236,7 @@ class TlsHandshakeClientHelloSpecalization(TlsHandshakeClientHello): 
                signature_algorithm

                for signature_algorithm in TlsSignatureAndHashAlgorithm

                if (signature_algorithm.value.signature_algorithm not in authentications_not_exist_in_tls1_3 and

                    signature_algorithm.value.hash_algorithm is not None)

                    self._is_tls1_3_signature_algorithm(signature_algorithm))

            ]



            present_extension_types = set(map(type, extensions))

debian/changelog

+6 −0
Original line number Diff line number Diff line 
cryptolyzer (1.6.0) unstable; urgency=low



  * offer the standalone post-quantum signature algorithms in the client hello (#190)



 -- Szilárd Pfeiffer <coroner@pfeifferszilard.hu>  Wed, 05 Aug 2026 00:00:00 +0200



cryptolyzer (1.5.0) unstable; urgency=low



  * add IKE public keys checker for IKEv1 aggressive-mode and IKEv2 EAP-mode servers (#183)

cryptoparser @ 269e32f7

Compare 81fbcd7a to 269e32f7
Original line number Diff line number Diff line 
Subproject commit 81fbcd7a6a2b74955d854cd6326e8d98be4c5ee7
 
Subproject commit 269e32f728868d596567bc3d45de1e41a074de0b