chore(deps): bump pycryptodomex from 3.17 to 3.21.0 in /demos/jans-tent

[dependabot]

Bumps pycryptodomex from 3.17 to 3.21.0.

Release notes

Sourced from pycryptodomex's releases.

v3.20.0 - Amiens

New features

• Added support for TurboSHAKE128 and TurboSHAKE256.
• Added method Crypto.Hash.new() to generate a hash object given a hash name.
• Added support for AES-GCM encryption of PBES2 and PKCS#8 containers.
• Added support for SHA-2 and SHA-3 algorithms in PBKDF2 when creating PBES2 and PKCS#8 containers.
• Export of RSA keys accepts the prot_params dictionary as parameter to control the number of iterations for PBKDF2 and scrypt.
• C unit tests also run on non-x86 architectures.

Resolved issues

• GH#787: Fixed autodetect logic for GCC 14 in combination with LTO.

v3.20.0 - Amiens (pycryptodomex)

New features

• Added support for TurboSHAKE128 and TurboSHAKE256.
• Added method Crypto.Hash.new() to generate a hash object given a hash name.
• Added support for AES-GCM encryption of PBES2 and PKCS#8 containers.
• Added support for SHA-2 and SHA-3 algorithms in PBKDF2 when creating PBES2 and PKCS#8 containers.
• Export of RSA keys accepts the prot_params dictionary as parameter to control the number of iterations for PBKDF2 and scrypt.
• C unit tests also run on non-x86 architectures.

Resolved issues

• GH#787: Fixed autodetect logic for GCC 14 in combination with LTO.

v3.19.1 - Zeil

Resolved issues

• Fixed a side-channel leakage with OAEP decryption that could be exploited to carry out a Manger attack. Thanks to Hubert Kario.

v3.19.1 - Zeil (pycryptodomex)

Resolved issues

• Fixed a side-channel leakage with OAEP decryption that could be exploited to carry out a Manger attack. Thanks to Hubert Kario.

... (truncated)

Changelog

Sourced from pycryptodomex's changelog.

3.21.0 (30 September 2024) ++++++++++++++++++++++++++

New features

• By setting the PYCRYPTODOME_DISABLE_GMP environment variable, the GMP library will not be used even if detected.
• Add support for Curve25519 / X25519.
• Add support for Curve448 / X448.
• Add attribute curve to EccPoint and EccXPoint classes, with the canonical name of the curve.
• GH#781: the label for the SP800_108_Counter KDF may now contain zero bytes. Thanks to Julien Rische.
• GH#814: RSA keys for PSS can be imported.

Resolved issues

• GH#810: fixed negation of Ed25519 points.
• GH#819: accept an RFC5916 ECPrivateKey even if it doesn't contain any of the optional elements (parameters [0] and publicKey[1]).

Other changes

• Remove support for Python 3.5.

3.20.0 (9 January 2024) ++++++++++++++++++++++++++

New features

• Added support for TurboSHAKE128 and TurboSHAKE256.
• Added method Crypto.Hash.new() to generate a hash object given a hash name.
• Added support for AES-GCM encryption of PBES2 and PKCS#8 containers.
• Added support for SHA-2 and SHA-3 algorithms in PBKDF2 when creating PBES2 and PKCS#8 containers.
• Export of RSA keys accepts the prot_params dictionary as parameter to control the number of iterations for PBKDF2 and scrypt.
• C unit tests also run on non-x86 architectures.

Resolved issues

• GH#787: Fixed autodetect logic for GCC 14 in combination with LTO.

3.19.1 (28 December 2023) ++++++++++++++++++++++++++

... (truncated)

Commits

• 5e40a18 Bump version
• cd4cb45 Fix docs and changelog
• d499d27 Decrypt PKCS#8 key even if the password is empty
• 0c86527 Build wheel on Windows 2019
• fdd7892 Bump required version of pycryptodome-test-vectors
• 5040405 Build wheel for Python 3.13
• 19494e0 Bump version for test vectors package
• 66420a7 Fix tests for x448/x25519
• 05bcdff Add tag for Python 3.13
• 2ddda6a Fixed typo in documentation
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dryrunsecurity]

DryRun Security Summary

The pull request updates the pycryptodomex library from version 3.17 to 3.21.0, which is a security-relevant change that addresses vulnerabilities or security issues, and keeping dependencies up-to-date is a crucial part of maintaining a secure application.

Expand for full summary

Summary:

The changes in this pull request update the version of the pycryptodomex library from 3.17 to 3.21.0. This is a security-relevant change, as it likely addresses vulnerabilities or security issues found in the previous version of the library. Updating to the latest version of this library is generally a good practice, as it ensures that the application is using the most secure and up-to-date cryptographic implementations.

From an application security perspective, it's important to keep all dependencies up-to-date to mitigate potential vulnerabilities. Regularly reviewing and updating dependencies is a crucial part of maintaining a secure application. Additionally, it's a good practice to have a process in place to monitor and update dependencies as new versions are released, especially for security-critical libraries like pycryptodomex.

Files Changed:

• demos/jans-tent/requirements.txt: This file has been updated to use the latest version of the pycryptodomex library, which is a security-relevant change. Updating dependencies to their latest versions is an important step in maintaining the security of the application.

Code Analysis

We ran 9 analyzers against 1 file and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	1 finding

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.