'_EllipticCurvePublicKey' object has no attribute 'verifier'

[sbradnick]

python:       3.10
cryptography: 37.0.4
cffi:         1.15.0
pip:          22.0.4
setuptools:   58.3.0

I'm making use of cryptography through an implementation setup through Xpra, which is using pyu2f with a[n oldschool blue] Yubikey, but getting the following error:

Exception in thread authenticate connection:
Traceback (most recent call last):
  File "/usr/lib64/python3.10/threading.py", line 1016, in _bootstrap_inner
    self.run()
  File "/usr/lib64/python3.10/threading.py", line 953, in run
    self._target(*self._args, **self._kwargs)
  File "/usr/lib64/python3.10/site-packages/xpra/server/server_core.py", line 2038, in verify_auth
    if not authenticator.authenticate(c):
  File "/usr/lib64/python3.10/site-packages/xpra/server/auth/sys_auth_base.py", line 118, in authenticate
    r = self.do_authenticate(caps)
  File "/usr/lib64/python3.10/site-packages/xpra/server/auth/sys_auth_base.py", line 140, in do_authenticate
    return self.authenticate_check(challenge_response, client_salt)
  File "/usr/lib64/python3.10/site-packages/xpra/server/auth/u2f_auth.py", line 119, in authenticate_check
    verifier = public_key.verifier(sig, ec.ECDSA(hashes.SHA256()))
AttributeError: '_EllipticCurvePublicKey' object has no attribute 'verifier'

I understand that saying something akin to 'debug an error in program X somehow tangentially related to your project' is a terrible idea so that's not my intention :)

I'm mainly looking for any insight into the cause of AttributeError: '_EllipticCurvePublicKey' object has no attribute 'verifier' and if it has more to do w/ cryptography or it's pointing to something Yubikey/pyu2f (or a slight possiblity, Xpra) related.

Thanks for your time!

[reaperhulk]

In 37.0 we removed the verifier and signer constructors in favor of verify and sign one shot methods. We originally deprecated these constructor methods in 2017, but unsurprisingly there are still a few consumers out there. Switching to the new methods is very easy, reduces the amount of code they need, and is backwards compatible to version 1.4.

[reaperhulk]

The issue is here:

https://github.com/Xpra-org/xpra/blob/598ca2c667511146b4ef2704ba09daca9c24120a/xpra/server/auth/u2f_auth.py#L118-L121

And can be fixed with:

try:
    public_key.verify(sig, param, ec.ECDSA(hashes.SHA256()))
    # success occurs if the previous didn't raise an exception so log success here
except InvalidSignature:
    # do failure handling

[sbradnick]

Great info Paul, thank you so much! I'll pass that along and/or give it a go myself in a build.

[reaperhulk]

Glad it worked out!