Deprecation warnings with newest cryptography

Hello @ronf!

After upgrading cryptography to the latest 38.0.0 I can see these warnings on asyncssh import:

/Users/apawlucz/opt/anaconda3/envs/rd_39/lib/python3.9/site-packages/asyncssh/crypto/cipher.py:29: CryptographyDeprecationWarning: Blowfish has been deprecated
  from cryptography.hazmat.primitives.ciphers.algorithms import Blowfish, CAST5
/Users/apawlucz/opt/anaconda3/envs/rd_39/lib/python3.9/site-packages/asyncssh/crypto/cipher.py:29: CryptographyDeprecationWarning: CAST5 has been deprecated
  from cryptography.hazmat.primitives.ciphers.algorithms import Blowfish, CAST5
/Users/apawlucz/opt/anaconda3/envs/rd_39/lib/python3.9/site-packages/asyncssh/crypto/cipher.py:30: CryptographyDeprecationWarning: SEED has been deprecated
  from cryptography.hazmat.primitives.ciphers.algorithms import SEED, TripleDES
/Users/apawlucz/opt/anaconda3/envs/rd_39/lib/python3.9/site-packages/paramiko/transport.py:236: CryptographyDeprecationWarning: Blowfish has been deprecated
  "class": algorithms.Blowfish,

So not sure what is the best way to go forward here (except for a workaround to silence the warnings).

Thanks!

[ronf]

Hi @adam-pawluczuk - thanks for the report!

It looks like this deprecation was added in cryptography 37.0.0, which went out yesterday. It doesn’t say exactly when these ciphers will be fully removed, though.

I’d like to keep support in AsyncSSH for as long as possible. While all of these ciphers (and more) are already disabled by default in AsyncSSH, I want to make it possible to re-enable them for cases where AsyncSSH is used to communicate with an implementation that might not support more modern ciphers.

Eventually, I’d want a conditional that could check at runtime whether the version of cryptography (or OpenSSL) has support for these ciphers or not. However, it’s not clear at this point what API (if any) cryptography will be provided to allow for that. Right now, I use calls like backend.ed25519_supported() and backend.ed448_supported() on the cryptography.hazmat.backends.openssl module to conditionally include support for some of the EdDSA algorithms. Hopefully something similar will be available at the point where these ciphers are removed. If not, I suppose I could always fall back to a cryptography version check.

In the meantime, there’s still the issue of what to do with the warnings. As you said, probably the best thing for now would be to just silence them, with something like:

diff --git a/asyncssh/crypto/cipher.py b/asyncssh/crypto/cipher.py
index 1c70d52..68badae 100644
--- a/asyncssh/crypto/cipher.py
+++ b/asyncssh/crypto/cipher.py
@@ -21,16 +21,22 @@
 """A shim around PyCA for accessing symmetric ciphers needed by AsyncSSH"""

 from typing import Any, MutableMapping, Optional, Tuple
+import warnings

 from cryptography.exceptions import InvalidTag
 from cryptography.hazmat.primitives.ciphers import Cipher, CipherContext
 from cryptography.hazmat.primitives.ciphers.aead import AESGCM
 from cryptography.hazmat.primitives.ciphers.algorithms import AES, ARC4
-from cryptography.hazmat.primitives.ciphers.algorithms import Blowfish, CAST5
-from cryptography.hazmat.primitives.ciphers.algorithms import SEED, TripleDES
-
+from cryptography.hazmat.primitives.ciphers.algorithms import TripleDES
 from cryptography.hazmat.primitives.ciphers.modes import CBC, CTR

+with warnings.catch_warnings():
+    warnings.simplefilter('ignore')
+
+    from cryptography.hazmat.primitives.ciphers.algorithms import Blowfish
+    from cryptography.hazmat.primitives.ciphers.algorithms import CAST5
+    from cryptography.hazmat.primitives.ciphers.algorithms import SEED
+

 _CipherAlgs = Tuple[Any, Any, int]
 _CipherParams = Tuple[int, int, int]

In a quick test against 37.0.1, that seems to work here.

It’s unfortunate that CryptographyDeprecationWarning is derived from UserWarning instead of DeprecationWarning. If it were a DeprecationWarning, these warnings would already be disabled by default in non-debug builds.

[ronf]

That works too. 😃

If needed, the proposed change above is now available in the “develop” library for anyone who wants it. It also updates the minimum cryptography version documented in the README, and corrects for a change in the cryptography type stubs which was causing mypy to complain about some code in the crypto/x509 module.