Security News
Node.js EOL Versions CVE Dubbed the "Worst CVE of the Year" by Security Experts
Critics call the Node.js EOL CVE a misuse of the system, sparking debate over CVE standards and the growing noise in vulnerability databases.
tinyaes
is a few lines Cython
wrapper for the tiny-AES-c
library, a
Small portable AES128/192/256 in C.
The library offers a few modes, CTR and CBC modes are the only ones currently wrapped. Given the C API works modifying a buffer in-place, the wrapper offers:
CTR_xcrypt_buffer(..)
that works on all bytes convertible types, and
encrypting a copy of the buffer,CTR_xcrypt_buffer_inplace(..)
that works on bytearray
s only, modifying
the buffer in-place.CBC_encrypt_buffer_inplace_raw(..)
that works on bytearray
s only, modifying
the buffer in-place (manual padding).CBC_decrypt_buffer_inplace_raw(..)
that works on bytearray
s only, modifying
the buffer in-place (manual unpadding).import tinyaes
import binascii
def pad(m):
return m + bytes([16 - len(m) % 16] * (16 - len(m) % 16))
def unpad(ct):
return ct[:-ct[-1]]
# assign key and IV
aes_enc = tinyaes.AES(bytes.fromhex('11223344556677889900AABBCCDDEEFF'),
bytes.fromhex('FFEEDDCCBBAA00998877665544332211'))
aes_dec = tinyaes.AES(bytes.fromhex('11223344556677889900AABBCCDDEEFF'),
bytes.fromhex('FFEEDDCCBBAA00998877665544332211'))
text = b"hello"
print(text) # b'hello'
# padding plaintext to a multiple of block size
text = pad(text)
print(binascii.hexlify(bytearray(text))) # b'68656c6c6f0b0b0b0b0b0b0b0b0b0b0b' hex representation of added text
aes_enc.CBC_encrypt_buffer_inplace_raw(text) # b'5adc04828f9421c34210b05fe5c92bfd' hex representation of encrypted text
print(binascii.hexlify(bytearray(text)))
aes_dec.CBC_decrypt_buffer_inplace_raw(text)
print(unpad(text)) # b'hello' decrypted, original text
manylinux2010
because of tlsv1 errors and drop Python 2.7
missing in the new imagemanylinux1
) and OSXtiny-AES-c
with
some cleanups and small optimizationstiny-AES-c
with
some code changesThe CI is up and running, but on Linux only, running a minimal test suite that uses hypothesis, and that allowed me to find a first bug, a missed variable replacement that had nefarious consequences.
The source package released on PyPI should be usable on Windows and MacOS too,
just pip install tinyaes
.
The development instead is Linux centered, without any guide yet, but the CI script can be a guide.
PATH
.just test
should install the library and the dependencies and run the tests
using your default Python version.justfile
for some hints about what happens.The library is very minimal, but nonetheless, it uses a lot of existing software. I'd like to thank:
Cython developer for their wonderful "product", both the library and the documentation.
Kudos to kokke
for their tiny-AES-c
library, very minimal and easy to build and wrap for any usage that needs only
the few AES modes it exposes.
Just developers for their automation tool, I use in most of my projects.
A huge thank to all the hypothesis authors to their fantastic library, that helped me to find an miss-named variable bug that I worked very hard to add in a 6 lines of code wrapper! And to this Data-driven testing with Python article that had left me with the desire to try the library.
FAQs
tiny-AES-c wrapper in Cython
We found that tinyaes demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Critics call the Node.js EOL CVE a misuse of the system, sparking debate over CVE standards and the growing noise in vulnerability databases.
Security News
cURL and Go security teams are publicly rejecting CVSS as flawed for assessing vulnerabilities and are calling for more accurate, context-aware approaches.
Security News
Bun 1.2 enhances its JavaScript runtime with 90% Node.js compatibility, built-in S3 and Postgres support, HTML Imports, and faster, cloud-first performance.