pySCG section 09 Cryptography: providing building blocks in context with sign, encrypt, key-handling

未关闭
  • 哪里不对？
#14 2 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
35/100
Issue 类型
文档
描述清晰度
基本清楚
活跃度
冷清
技术栈
python
领域
documentation, security

调研方向

Read the existing section 08 rule pyscg-0056 and the linked 07 Concurrency introduction for the guide’s structure. The issue proposes a new 09 Cryptography introduction and individual rules, including moving pyscg-0053 and adding several cryptography topics, but does not identify files or define the final scope. Done means the section provides shared concepts and building-block guidance for sign, encrypt, key handling, and the related rules.

由索引模型根据 Issue 内容生成。

描述

The write up of new rule pyscg-0056: Verify Downloaded Code Before Running It currently in section 08_coding_standard showed us that

  • new designers don't understand some of the key concepts such as 'payload' and 'digest'.
  • complexity of using signed software as per 0056 is actually to impractical without additional python modules.

So we need to explain cryptographic basic concepts in 09_Cryptography and also unload complexity from 0056 and move 0053 under section 09.

Historically we have seen similar need for crypto blocks during pyscg-0023: Secure Deserialization we decided that we don't want partial explanations for an overall solution to sign, encrypt, key-handling in individual rules. Instead we want to create of find a introduction to how security can work in Python explaining 'building block' on the road to overall security solutions in the new 09 Cryptography section consisting of:

  • A introduction page explaining common concepts across all rules in the section similar to what we do in 07 Concurrency
  • Details and examples on 'building blocks' in individual rules

Related issues:

On how to create a learning resource consider:

Suggested Building blocks for rules in 09 Cryptography:

Building block / rule Stdlib? + Refs
09 Cryptography - Introduction
Introduces the security goals and mental model for the section: confidentiality, integrity, authenticity, trust anchoring, safe composition, and why the rules build from primitives toward signed software and provenance.		 No

- If It Ain't Broken, Do Fix It
- Security and Cryptography Algorithms in Python
pyscg-0038: Use Sufficiently Random Values
Cryptographically secure randomness for tokens, nonces, and secret material		 Yes

- PEP 506
- secrets
TODO — pyscg-0057: Use Cryptographic Hashes for Integrity Checks
Digest computation, file integrity checks, and pinned-digest verification as a minimal integrity mechanism		 Yes

- hashlib
TODO — pyscg-0058: Compare Security-Critical Values in Constant Time
Constant-time comparison during verification; this is comparison hygiene, not HMAC itself		 Yes

- hmac
TODO — pyscg-0059: Use Keyed Message Authentication for Shared-Secret Integrity
MAC/HMAC, shared-secret authenticity and integrity, and why this does not solve publisher provenance or public software distribution		 Yes

- hmac
- hashlib
TODO — pyscg-0060: Derive Keys Securely from Passwords
PBKDF2 / scrypt, salts, work factors, and deriving keys from passwords instead of using raw passwords directly		 Yes

- hashlib
TODO — pyscg-0061: Use TLS with Certificate Validation on Network Interfaces
Normal TLS client/server use on application interfaces: CA trust, hostname validation, presenting certificates on service interfaces, and basic mutual TLS concepts		 Yes

- ssl
TODO — pyscg-0062: Use Authenticated Encryption Instead of Ad-Hoc Encryption Plus Integrity
AEAD and why confidentiality and integrity should be combined in a single construction instead of assembled ad hoc		 No

- cryptography AEAD
TODO — pyscg-0063: Use Digital Signatures for Publisher-Verifiable Authenticity
Signatures vs HMAC, public/private key model, and authenticity for software distributed to many consumers		 No

- cryptography asymmetric algorithms
TODO — pyscg-0064: Validate X.509 Certificates and Chains Outside TLS Handshakes
Standalone certificate parsing, certificate-chain inspection, path validation, trust anchors, and policy checks outside a live TLS handshake		 No

- cryptography X.509 tutorial
- cryptography X.509 verification
TODO — pyscg-0065: Verify Package Provenance and Publisher Identity with Index-Hosted Attestations
PEP 740, PyPI attestations, publisher identity, provenance objects, and package-index-level verification of signed software		 No

- PEP 740
- PyPI attestations docs
- pypi-attestations
TODO — pyscg-0066: Verify Attestation Signatures and Transparency Evidence
DSSE envelopes, signing certificates, transparency log entries, trust roots, and verification policy underlying attestation systems		 No

- PEP 740
- PyPI attestations docs
- Sigstore
主要语言
Python
星标
2
派生
2
平均合并
11 分钟
30 天内合并 PR
2

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

ossf/python-secure-coding-guide 的其他 Issue

查看 ossf/python-secure-coding-guide 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。