Secure Systems Library

1.3.1 · active · verified Thu Apr 16

Securesystemslib is a Python library that provides cryptographic and general-purpose routines for Secure Systems Lab projects at NYU. It serves as a cryptography interface for signing and verifying digital signatures, particularly developed for the TUF and in-toto projects. The library is actively maintained, with a recent major focus on a new 'signer' API. Its release cadence is driven by new feature additions, security enhancements, and deprecations related to key management and signing systems.

Common errors

Warnings

Install

Imports

Quickstart

This quickstart demonstrates how to generate an RSA key pair, sign arbitrary data, and then verify that signature using the recommended `securesystemslib.signer.CryptoSigner` API. The private key is saved locally, and a placeholder passphrase is used for demonstration purposes. In a production environment, private keys should be securely managed, potentially using a Key Management System (KMS).

import os
import json
from securesystemslib.signer import CryptoSigner, Key
from securesystemslib.formats import encode_canonical_json

# 1. Generate a new key pair using the CryptoSigner (e.g., RSA)
# In a real scenario, you'd protect the private key with a strong password
# or use a KMS. For quickstart, we'll use a placeholder password.

# Create a temporary directory for keys
if not os.path.exists("temp_keys"): os.makedirs("temp_keys")

passphrase = os.environ.get('SECURESYSTEMSLIB_PASSPHRASE', 'secret-password')

# Generate an RSA key pair
private_key_path = os.path.join("temp_keys", "example_key")
signer = CryptoSigner.generate_and_write_key(private_key_path, keytype="rsa", algorithm="rsassa-pss-sha256", passphrase=passphrase)

# The public key details are part of the signer object
public_key = signer.public_key

print(f"Generated public key ID: {public_key.keyid}")

# 2. Prepare some data to sign
data_to_sign = {"message": "Hello, securesystemslib!", "timestamp": 1678886400}
canonical_data = encode_canonical_json(data_to_sign).encode("utf-8")

# 3. Sign the data
signature = signer.sign(canonical_data)

print(f"Generated signature: {signature.signature[:20]}...")

# 4. Verify the signature
# A Key object can be created from the public_key dictionary
verifier_key = Key.from_dict(public_key.keyid, public_key.to_dict())

# Verify using the signer and the original data
try:
    CryptoSigner.verify_signature(signature, verifier_key, canonical_data)
    print("Signature verification successful!")
except Exception as e:
    print(f"Signature verification failed: {e}")

# Clean up temporary files (optional)
os.remove(private_key_path)
os.remove(private_key_path + ".pub")
os.rmdir("temp_keys")

view raw JSON →