Machina Client SDK Version 2.1.2
Ionic Security Machina Client SDK for Python users
Crypto Overview

Introduction

The Crypto module contains all of the cryptographic algorithm code used throughout the SDK. The underlying cryptographic algorithm code is FIPS 140-2 Level 1 certified.

This module can be used directly by the application, but it is also used very heavily by the SDK internally when securely communicating with Ionic servers, encrypting / decrypting files, etc.


Crypto Thread Safety

Crypto is not thread-safe. All classes in the Crypto module are not thread-safe and should not be used as a shared resource between concurrent threads. In order to use objects in a multi-threaded environment, it is recommended to create one object per thread.


Crypto Module Shared Libraries

Starting with version 2.1, the SDK has the ability to load alternate crypto engines. It ships with a FIPS style module and a non-FIPS module. The FIPS module relies on the FIPS approved OpenSSL library for all crypto tasks except secret share. The non-FIPS module uses CryptoPP for most crypto tasks and operating system API's for entropy and the deterministic random bit generator. Some organizations will need a FIPS approved module. However, the FIPS approved module is older code as FIPS approval takes significant time and lasts for three years. It also has a much stricter entropy collection process that can stall in low entropy situations, like a cloud based machine. This module is loaded when needed or when ionicsdk.cryptoutil.initialize() is called, and can be unloaded with ionicsdk.cryptoutil.shutdown(). You should not attempt to load the crypto module in startup code, for example, calling a crypto function within the constructor of a globally declared variable.

See the ionicsdk.cryptoutil page for details on functions that can potentially control which module is loaded. These must be called before the module loaded. The FIPS style module is loaded by default.

Note: while loading, unloading, and reloading a different module is possible, it is also dangerous and unsupported. The Crypto module can returned allocated structures, like an RSA key, and internal storage of these objects will be unique to the module loaded. This object would have undefined behavior with a different module and even releasing it with a reloaded identical module can have undefined behavior.


AES Algorithm Classes


Utility Classes (includes hashing and transcoding utilities)