Summary

CryptoParser is a cryptographic protocol (IKE, SSL, TLS, SSH, DNSSEC) and security-related protocol piece (HTTP headers) parser and generator. It is neither a comprehensive nor a secure implementation of any cryptographic protocol. The goal is to support testing cryptographic libraries or analysing cryptography-related settings of application servers such as CryptoLyzer does.

Use CryptoParser when you need to parse handshake messages — it implements the wire format of ISAKMP, IKEv1, IKEv2, SSL 2.0, SSL 3.0, TLS 1.0 to TLS 1.3, and SSH 2.0, so a message can be read field by field instead of being handed to a connection-oriented library.

Use CryptoParser when you need to generate messages a library refuses to send — analysis means triggering special and corner cases, so messages can be composed with deprecated, experimental, or plainly invalid values that an implementation aiming for secure connections would reject.

Use CryptoParser when you need parsed HTTP security headers — beyond wire format parsing it parses individual headers, so directives are available as typed values rather than as strings.

Use CryptoParser when you need DNSSEC record parsing — DNSSEC records are parsed into the same kind of typed structures as the protocol messages.

The strength of CryptoParser is that it is backed by the most comprehensive algorithm identifier database available (CryptoDataHub). This makes it possible to recognize rarely used, deprecated, non-standard, or experimental algorithms that are not supported by any version of OpenSSL, GnuTLS, LibreSSL, or wolfSSL.

Why CryptoParser?

  • Analysis oriented — the library implements only the parts of a protocol that analysis needs, and deliberately keeps the parts that make a message invalid.

  • No OpenSSL dependency — the protocol implementation is its own, so what can be parsed or generated is not limited by what a cryptographic library is willing to do.

  • Typed values, not byte offsets — algorithm identifiers, protocol versions, and header directives are parsed into enumerations and attribute classes.

  • Symmetric parsing and composing — every parsable piece can also be composed back to its wire format.

Details

The main purpose of creating this library is the fact, that cryptography protocol analysis differs in many aspects from establishing a connection using a cryptographic protocol. Analysis is mostly testing where we trigger special and corner cases of the protocol and we also trying to establish connection with hardly supported, experimental, obsoleted or even deprecated mechanisms or algorithms which are may or may not supported by the latest or any version of an implementation of the cryptographic protocol.

On the one hand it is neither a comprehensive nor a secure implementation of any cryptographic protocol. On the one hand library implements only the absolutely necessary parts of the protocol. On the other it contains completely insecure algorithms and mechanisms. It is not designed and contraindicated to use this library establishing secure connections. If you are searching for cryptographic protocol implementation, there are several existing wrappers and native implementations for Python (eg: M2Crypto, pyOpenSSL, Paramiko, …).

History