NewYour coding agent can read the release notes before it upgrades.Set up the MCP server →
PyPI · #436 most downloaded on PyPI
Cryptographic library for Python
Last release today
04 Oct 2026
Release timing varies
gaps range from 2 weeks to 1.4 years
Nearly every release is documented
notes for 50 of 52 stable releases
Nothing withdrawn
no release was ever pulled
11 years old
52 releases · first in 2016
Nothing published for this version
Added cipher modes Key Wrap (KW, RFC3394) and Key Wrap with Padding (KWP, RFC5649). Both are defined also in NIST SP 800-38F.
Added support for HPKE (RFC 9180).
One column per quarter.
By setting the PYCRYPTODOME_DISABLE_GMP environment variable, the GMP library will not be used even if detected.
curve to EccPoint and EccXPoint classes,Added support for TurboSHAKE128 and TurboSHAKE256.
Crypto.Hash.new() to generate a hashprot_params dictionaryFixed a side-channel leakage with OAEP decryption that could be exploited to carry out a Manger attack. Thanks to Hubert Kario.
Fixed a side-channel leakage with OAEP decryption that could be exploited to carry out a Manger attack (CVE-2023-52323). Thanks to Hubert Kario.
The update() methods of TupleHash128 and TupleHash256 objects can now hash multiple items (byte strings) at once. Thanks to Sylvain Pelissier.
The update() methods of TupleHash128 and TupleHash256 objects can now hash multiple items (byte strings) at once. Thanks to Sylvain Pelissier.
Added support for ECDH, with Crypto.Protocol.DH.
GH#754: due to a bug in cffi, do not use it on Windows with Python 3.12+.
Added support for DER BOOLEAN encodings.
Added support for DER BOOLEAN encodings.
The library now compiles on Windows ARM64. Thanks to Niyas Sait.
GH#722: nonce attribute was not correctly set for XChaCha20_Poly1305 ciphers. Thanks to Liam Haber.
GH#728: Workaround for a possible x86 emulator bug in Windows for ARM64.
GH#739: OID encoding for arc 2 didn't accept children larger than 39. Thanks to James.
Correctly check that the scalar matches the point when importing an ECC private key.
Nothing published for this version
Build wheels for musl Linux. Thanks to Ben Raz.
Build wheels for musl Linux. Thanks to Ben Raz.
GH#639: ARC4 now also works with 'keys' as short as 8 bits.
GH#669: fix segfaults when running in a manylinux2010 i686 image.
Add support for curves Ed25519 and Ed448, including export and import of keys.
Add support for curves Ed25519 and Ed448, including export and import of keys.
Add support for EdDSA signatures.
Add support for Asymmetric Key Packages (RFC5958) to import private keys.
GH#620: for Crypto.Util.number.getPrime , do not sequentially scan numbers searching for a prime.
GH#595: Fixed memory leak for GMP integers. Thanks to Witalij Siebert and Pablo Quílez.
GH#595: Fixed memory leak for GMP integers. Thanks to Witalij Siebert and Pablo Quílez.
Add support for curve NIST P-192.
Add support for curve NIST P-192.
Add support for curve NIST P-224.
Add support for curve NIST P-224.
GH#590: Fixed typing info for Crypto.PublicKey.ECC.
Relaxed ECDSA requirements for FIPS 186 signatures and accept any SHA-2 or SHA-3 hash. sign() and verify() will be performed even if the hash is stronger than the ECC key.
ECC keys in the SEC1 format can be exported and imported.
ECC keys in the SEC1 format can be exported and imported.
Add support for KMAC128, KMAC256, TupleHash128, and TupleHash256 (NIST SP-800 185).
Add support for KangarooTwelve.
GH#563: An asymmetric key could not be imported as a memoryview.
GH#566: cSHAKE128/256 generated a wrong output for customization strings longer than 255 bytes.
GH#582: CBC decryption generated the wrong plaintext when the input and the output were the same buffer. Thanks to Michael K. Ashburn.
GH#512: Especially for very small bit sizes, Crypto.Util.number.getPrime() was occasionally generating primes larger than given the bit size. Thanks t
GH#512: Especially for very small bit sizes, Crypto.Util.number.getPrime() was occasionally generating primes larger than given the bit size. Thanks to Koki Takahashi.
GH#552: Correct typing annotations for PKCS115_Cipher.decrypt().
GH#555: decrypt() method of a PKCS#1v1.5 cipher returned a bytearray instead of bytes.
GH#557: External DSA domain parameters were accepted even when the modulus (p) was not prime. This affected Crypto.PublicKey.DSA.generate() and Crypto.PublicKey.DSA.construct(). Thanks to Koki Takahashi.
Added cSHAKE128 and cSHAKE256 (of SHA-3 family). Thanks to Michael Schaffner.
GH#558: The flag RTLD_DEEPBIND passed to dlopen() is not well supported by address sanitizers. It is now possible to set the environment variable PYCRYPTDOME_DISABLE_DEEPBIND to drop that flag and allow security testing.
Output of Crypto.Util.number.long_to_bytes() was not always a multiple of blocksize.
Output of Crypto.Util.number.long_to_bytes() was not always a multiple of blocksize.
GH#376: Fixed symbol conflict between different versions of libgmp.
GH#376: Fixed symbol conflict between different versions of libgmp.
GH#481: Improved robustness of PKCS#1v1.5 decryption against timing attacks.
GH#506 and GH#509: Fixed segmentation faults on Apple M1 and other Aarch64 SoCs, when the GMP library was accessed via ctypes. Do not use GMP's own sscanf and snprintf routines: instead, use simpler conversion routines.
GH#510: Workaround for cffi calling ctypes.util.find_library(), which invokes gcc and ld on Linux, considerably slowing down all imports. On certain configurations, that may also leave temporary files behind.
GH#517: Fix RSAES-OAEP, as it didn't always fail when zero padding was incorrect.
Added support for SHA-3 hash functions to HMAC.
The Windows wheels of Python 2.7 now require the VS2015 runtime to be installed in the system, because Microsoft stopped distributing the VS2008 compiler in April 2021. VS2008 was used to compile the Python 2.7 extensions.
Python 3 wheels use abi3 ABI tag.
Python 3 wheels use abi3 ABI tag.
Remove Appveyor CI.
GH#435: Fixed Crypto.Util.number.size for negative numbers.
GH#435: Fixed Crypto.Util.number.size for negative numbers.
Build Python 3.9 wheels on Windows.
GH#426: The Shamir's secret sharing implementation is not actually compatible with ssss. Added an optional parameter to enable interoperability.
GH#426: The Shamir's secret sharing implementation is not actually compatible with ssss. Added an optional parameter to enable interoperability.
GH#427: Skip altogether loading of gmp.dll on Windows.
GH#420: Fix incorrect CFB decryption when the input and the output are the same buffer.
Speed up Shamir's secret sharing routines. Thanks to ncarve.
GH#381: Make notarization possible again on OS X when using wheels. Thanks to Colin Atkinson.
GH#381: Make notarization possible again on OS X when using wheels. Thanks to Colin Atkinson.
Fix building of wheels for OS X by explicitly setting sysroot location.
Fix building of wheels for OS X by explicitly setting sysroot location.
GH#341: Prevent key_to_english from creating invalid data when fed with keys of length not multiple of 8. Thanks to vstoykovbg.
GH#341: Prevent key_to_english from creating invalid data when fed with keys of length not multiple of 8. Thanks to vstoykovbg.
GH#347: Fix blocking RSA signing/decryption when key has very small factor. Thanks to Martijn Pieters.
GH#308: Align stack of functions using SSE2 intrinsics to avoid crashes, when compiled with gcc on 32-bit x86 platforms.
GH#308: Align stack of functions using SSE2 intrinsics to avoid crashes, when compiled with gcc on 32-bit x86 platforms.
GH#308: Avoid allocating arrays of __m128i on the stack, to cope with buggy compilers.
Add Python 3.8 wheels for Mac.
GH#308: Avoid allocating arrays of __m128i on the stack, to cope with buggy compilers.
GH#322: Remove blanket -O3 optimization for gcc and clang, to cope with buggy compilers.
GH#337: Fix typing stubs for signatures.
GH#338: Deal with gcc installations that don't have x86intrin.h.
Add Python 3.8 wheels for Linux and Windows.
Add Python 3.8 wheels for Linux and Windows.
GH#328: minor speed-up when importing RSA.
Add support for loading PEM files encrypted with AES256-CBC.
Add support for loading PEM files encrypted with AES256-CBC.
Add support for XChaCha20 and XChaCha20-Poly1305 ciphers.
Add support for bcrypt key derivation function (Crypto.Protocol.KDF.bcrypt).
Add support for left multiplication of an EC point by a scalar.
Add support for importing ECC and RSA keys in the new OpenSSH format.
GH#312: it was not possible to invert an EC point anymore.
GH#316: fix printing of DSA keys.
GH#317: DSA.generate() was not always using the randfunc input.
GH#285: the MD2 hash had block size of 64 bytes instead of 16; as result the HMAC construction gave incorrect results.
GH#291: fix strict aliasing problem, emerged with GCC 9.1.
GH#291: fix strict aliasing problem, emerged with GCC 9.1.
Add support for loading PEM files encrypted with AES192-CBC and AES256-GCM.
Add support for loading PEM files encrypted with AES192-CBC and AES256-GCM.
When importing ECC keys in PEM format, ignore the redundant EC PARAMS section that was included by certain openssl commands.
repr() did not work for ECC.EccKey objects.
Fix installation in development mode (setup install develop or pip install -e .).
Minimal length for Blowfish cipher is 32 bits, not 40 bits.
Various updates to docs.
Speed-up ECC performance. ECDSA is 33 times faster on the NIST P-256 curve.
Speed-up ECC performance. ECDSA is 33 times faster on the NIST P-256 curve.
Added support for NIST P-384 and P-521 curves.
EccKey has new methods size_in_bits() and size_in_bytes().
Support HMAC-SHA224, HMAC-SHA256, HMAC-SHA384, and HMAC-SHA512 in PBE2/PBKDF2.
DER objects were not rejected if their length field had a leading zero.
Allow legacy RC2 ciphers to have 40-bit keys.
ASN.1 Object IDs did not allow the value 0 in the path.
point_at_infinity() becomes an instance method for Crypto.PublicKey.ECC.EccKey, from a static one.
GH#258: False positive on PSS signatures when externally provided salt is too long.
GH#258: False positive on PSS signatures when externally provided salt is too long.
Include type stub files for Crypto.IO and Crypto.Util.
GH#242: Fixed compilation problem on ARM platforms.
GH#242: Fixed compilation problem on ARM platforms.
Added type stubs to enable static type checking with mypy. Thanks to Michael Nix.
Added type stubs to enable static type checking with mypy. Thanks to Michael Nix.
New update_after_digest flag for CMAC.
GH#232: Fixed problem with gcc 4.x when compiling ghash_clmul.c.
GH#238: Incorrect digest value produced by CMAC after cloning the object.
Method update() of an EAX cipher object was returning the underlying CMAC object, instead of the EAX object itself.
Method update() of a CMAC object was not throwing an exception after the digest was computed (with digest() or verify()).
Added support for Poly1305 MAC (with AES and ChaCha20 ciphers for key derivation).
Added support for Poly1305 MAC (with AES and ChaCha20 ciphers for key derivation).
Added support for ChaCha20-Poly1305 AEAD cipher.
New parameter output for Crypto.Util.strxor.strxor, Crypto.Util.strxor.strxor_c, encrypt and decrypt methods in symmetric ciphers (Crypto.Cipher package). output is a pre-allocated buffer (a bytearray or a writeable memoryview) where the result must be stored. This requires less memory for very large payloads; it is also more efficient when encrypting (or decrypting) several small payloads.
GH#266: AES-GCM hangs when processing more than 4GB at a time on x86 with PCLMULQDQ instruction.
Drop support for Python 3.3.
Remove Crypto.Util.py3compat.unhexlify and Crypto.Util.py3compat.hexlify.
With the old Python 2.6, use only ctypes (and not cffi) to interface to native code.
GH#198: Fix vulnerability on AESNI ECB with payloads smaller than 16 bytes (CVE-2018-15560).
GH#198: Fix vulnerability on AESNI ECB with payloads smaller than 16 bytes (CVE-2018-15560).
Fixed ResouceWarnings and DeprecationWarnings.
GH#187: Fixed incorrect AES encryption/decryption with AES acceleration on x86 due to gcc's optimization and strict aliasing rules.
GH#188: More prime number candidates than necessary where discarded as composite due to the limited way D values were searched in the Lucas test.
Fixed ResouceWarnings and DeprecationWarnings.
Workaround for Python 3.7.0 bug on Windows (https://bugs.python.org/issue34108).
Build Python 3.7 wheels on Linux, Windows and Mac.
Build Python 3.7 wheels on Linux, Windows and Mac.
GH#178: Rename _cpuid module to make upgrades more robust.
More meaningful exceptions in case of mismatch in IV length (CBC/OFB/CFB modes).
Fix compilation issues on Solaris 10/11.
GH#175: Fixed incorrect results for CTR encryption/decryption with more than 8 blocks.
GH#175: Fixed incorrect results for CTR encryption/decryption with more than 8 blocks.
Added Google Wycheproof tests (https://github.com/google/wycheproof) for RSA, DSA, ECDSA, GCM, SIV, EAX, CMAC.
Added Google Wycheproof tests (https://github.com/google/wycheproof) for RSA, DSA, ECDSA, GCM, SIV, EAX, CMAC.
New parameter mac_len (length of MAC tag) for CMAC.
In certain circumstances (at counter wrapping, which happens on average after 32 GB) AES GCM produced wrong ciphertexts.
Method encrypt() of AES SIV cipher could be still called, whereas only encrypt_and_digest() is allowed.
Introduced export_key and deprecated exportKey for DSA and RSA key objects.
Introduced export_key and deprecated exportKey for DSA and RSA key objects.
Ciphers and hash functions accept memoryview objects in input.
Added support for SHA-512/224 and SHA-512/256.
Reintroduced Crypto.__version__ variable as in PyCrypto.
Fixed compilation problem with MinGW.
GH#142. Fix mismatch with declaration and definition of addmul128.
GH#142. Fix mismatch with declaration and definition of addmul128.
GH#129. pycryptodomex could only be installed via wheels.
GH#129. pycryptodomex could only be installed via wheels.
GH#121. the record list was still not correct due to PEP3147 and __pycache__ directories. Thanks again to John O'Brien.
GH#121. the record list was still not correct due to PEP3147 and __pycache__ directories. Thanks again to John O'Brien.
More meaningful error messages while importing an ECC key.
More meaningful error messages while importing an ECC key.
GH#123 and #125. The SSE2 command line switch was not always passed on 32-bit x86 platforms.
GH#121. The record list (--record) was not always correctly filled for the pycryptodomex package. Thanks to John W. O'Brien.
Added a native extension in pure C for modular exponentiation, optimized for SSE2 on x86. In the process, we drop support for the arbitrary arithmetic
Added a native extension in pure C for modular exponentiation, optimized for SSE2 on x86. In the process, we drop support for the arbitrary arithmetic library MPIR on Windows, which is painful to compile and deploy. The custom modular exponentiation is 130% (160%) slower on an Intel CPU in 32-bit (64-bit) mode, compared to MPIR. Still, that is much faster that CPython's own pow() function which is 900% (855%) slower than MPIR. Support for the GMP library on Unix remains.
Added support for manylinux wheels.
Support for Python 3.7.
The DSA parameter 'p' prime was created with 255 bits cleared (but still with the correct strength).
GH#106. Not all docs were included in the tar ball. Thanks to Christopher Hoskin.
GH#109. ECDSA verification failed for DER encoded signatures. Thanks to Alastair Houghton.
Human-friendly messages for padding errors with ECB and CBC.
API documentation is made with sphinx instead of epydoc.
API documentation is made with sphinx instead of epydoc.
Start using importlib instead of imp where available.
GH#82. Fixed PEM header for RSA/DSA public keys.
GH#65. Keccak, SHA3, SHAKE and the seek functionality for ChaCha20 were not working on big endian machines. Fixed. Thanks to Mike Gilbert.
GH#65. Keccak, SHA3, SHAKE and the seek functionality for ChaCha20 were not working on big endian machines. Fixed. Thanks to Mike Gilbert.
A few fixes in the documentation.
The library can also be compiled using MinGW.
The library can also be compiled using MinGW.
Undefined warning was raised with libgmp version < 5
Undefined warning was raised with libgmp version < 5
Forgot inclusion of alloca.h
Fixed a warning about type mismatch raised by recent versions of cffi
Fix renaming of package for install command.
Fix renaming of package for install command.
Added option to install the library under the Cryptodome package (instead of Crypto).
Added option to install the library under the Cryptodome package (instead of Crypto).
Your coding agent can read these notes before it upgrades. Set up the MCP server →