deprecate encode_point and migrate all internal callers (#4720)
diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index 88e2aaf..d77cf15 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -50,7 +50,8 @@
:meth:`~cryptography.hazmat.primitives.asymmetric.x25519.X25519PublicKey.public_bytes`
with no arguments has been deprecated.
* Added support for encoding compressed and uncompressed points via
- :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey.public_bytes`.
+ :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey.public_bytes`. Deprecated the previous method
+ :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicNumbers.encode_point`.
.. _v2-4-2:
diff --git a/docs/hazmat/primitives/asymmetric/ec.rst b/docs/hazmat/primitives/asymmetric/ec.rst
index a356dca..d89fde3 100644
--- a/docs/hazmat/primitives/asymmetric/ec.rst
+++ b/docs/hazmat/primitives/asymmetric/ec.rst
@@ -194,6 +194,12 @@
.. method:: encode_point()
+ .. warning::
+
+ This method is deprecated as of version 2.5. Callers should migrate
+ to using
+ :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey.public_bytes`.
+
.. versionadded:: 1.1
Encodes an elliptic curve point to a byte string as described in
diff --git a/src/cryptography/hazmat/backends/openssl/backend.py b/src/cryptography/hazmat/backends/openssl/backend.py
index b5232ba..64a91f0 100644
--- a/src/cryptography/hazmat/backends/openssl/backend.py
+++ b/src/cryptography/hazmat/backends/openssl/backend.py
@@ -1885,10 +1885,15 @@
"Only SECP256R1, SECP384R1, and SECP521R1 curves are "
"supported by the SSH public key format"
)
+
+ point = key.public_bytes(
+ serialization.Encoding.X962,
+ serialization.PublicFormat.UncompressedPoint
+ )
return b"ecdsa-sha2-" + curve_name + b" " + base64.b64encode(
ssh._ssh_write_string(b"ecdsa-sha2-" + curve_name) +
ssh._ssh_write_string(curve_name) +
- ssh._ssh_write_string(public_numbers.encode_point())
+ ssh._ssh_write_string(point)
)
def _parameter_bytes(self, encoding, format, cdata):
diff --git a/src/cryptography/hazmat/primitives/asymmetric/ec.py b/src/cryptography/hazmat/primitives/asymmetric/ec.py
index c93cc09..1de0976 100644
--- a/src/cryptography/hazmat/primitives/asymmetric/ec.py
+++ b/src/cryptography/hazmat/primitives/asymmetric/ec.py
@@ -359,6 +359,14 @@
return backend.load_elliptic_curve_public_numbers(self)
def encode_point(self):
+ warnings.warn(
+ "encode_point has been deprecated on EllipticCurvePublicNumbers"
+ " and will be removed in a future version. Please use "
+ "EllipticCurvePublicKey.public_bytes to obtain both "
+ "compressed and uncompressed point encoding.",
+ utils.DeprecatedIn25,
+ stacklevel=2,
+ )
# key_size is in bits. Convert to bytes and round up
byte_length = (self.curve.key_size + 7) // 8
return (
diff --git a/src/cryptography/x509/extensions.py b/src/cryptography/x509/extensions.py
index bdd445d..88afa31 100644
--- a/src/cryptography/x509/extensions.py
+++ b/src/cryptography/x509/extensions.py
@@ -35,7 +35,10 @@
serialization.PublicFormat.PKCS1,
)
elif isinstance(public_key, EllipticCurvePublicKey):
- data = public_key.public_numbers().encode_point()
+ data = public_key.public_bytes(
+ serialization.Encoding.X962,
+ serialization.PublicFormat.UncompressedPoint
+ )
else:
# This is a very slow way to do this.
serialized = public_key.public_bytes(
diff --git a/tests/hazmat/primitives/test_ec.py b/tests/hazmat/primitives/test_ec.py
index 471ef26..7a6d6af 100644
--- a/tests/hazmat/primitives/test_ec.py
+++ b/tests/hazmat/primitives/test_ec.py
@@ -175,7 +175,8 @@
16
)
pn = ec.EllipticCurvePublicNumbers(x, y, ec.SECP256R1())
- data = pn.encode_point()
+ with pytest.warns(utils.DeprecatedIn25):
+ data = pn.encode_point()
assert data == binascii.unhexlify(
"04233ea3b0027127084cd2cd336a13aeef69c598d8af61369a36454a17c6c22ae"
"c3ea2c10a84153862be4ec82940f0543f9ba866af9751a6ee79d38460b35f442e"
