Skip to content

Upgrading cryptography 0.8 to 0.9

Breaking0.8.2 → 0.9.3Security1Platform1Deprecated2New5Changed2Fixed1

Full comparisonBack to cryptography
BreakingUpgrade verdict

A platform requirement change and a security fix.

In plain terms
  • This version no longer works on Python 3.2. If you use Python 3.2, you need to move to Python 3.3 or newer.
  • A memory bug could crash programs that check DSA signatures, but only on PyPy 2.6.0 and unreleased CFFI versions newer than 1.1.0.
  • Python 2.6 is no longer officially supported, though it still works for now. You are strongly encouraged to upgrade your Python version.
  • The InvalidToken exception has a new home. The old import path still works but is deprecated.
Must act 4 items need code or config changes

What you must change

Security1
Fixes a double free in the OpenSSL backend when using DSA to verify signatures, affecting PyPy 2.6.0 and unreleased CFFI versions above 1.1.0.
0.9.1CHANGELOG.rstSummarizedView source
Platform1
Removes support for Python 3.2; affected users should upgrade to Python 3.3 or later.
0.9CHANGELOG.rstSummarizedView source

Deprecations to plan for

Deprecated2
Deprecates support for Python 2.6, with no timetable for dropping it, and encourages users to upgrade.
0.9CHANGELOG.rstSummarizedView source
Moves cryptography.exceptions.InvalidToken to cryptography.hazmat.primitives.twofactor.InvalidToken and deprecates the old location.
cryptography.exceptions.InvalidTokencryptography.hazmat.primitives.twofactor.InvalidTokencryptography.fernet.InvalidToken
0.9CHANGELOG.rstSummarizedView source

API changes

Generated by DepDelta from published Python source. Not mixed with prose notes.

  • removed: class InvalidToken(Exception)
  • added: variable InvalidToken
  • added: class DHBackend(object)
  • added: method DHBackend.dh_exchange_algorithm_supported(exchange_algorithm)
  • added: method DHBackend.dh_parameters_supported(p, g)
  • added: method DHBackend.generate_dh_parameters(key_size)
  • added: method DHBackend.generate_dh_private_key(parameters)
  • added: method DHBackend.generate_dh_private_key_and_parameters(key_size)
  • added: method DHBackend.load_dh_parameter_numbers(numbers)
  • added: method DHBackend.load_dh_private_numbers(numbers)
  • added: method DHBackend.load_dh_public_numbers(numbers)
  • added: method X509Backend.load_der_x509_csr(data)
  • added: method X509Backend.load_pem_x509_csr(data)
  • added: method MultiBackend.load_der_x509_csr(data)
  • added: method MultiBackend.load_pem_x509_csr(data)
  • added: method Backend.load_der_x509_csr(data)
  • added: method Backend.load_pem_x509_csr(data)
  • added: variable CONDITIONAL_NAMES
  • added: variable CUSTOMIZATIONS
  • added: variable FUNCTIONS
  • added: variable INCLUDES
  • added: variable MACROS
  • added: variable TYPES
  • removed: variable CUSTOMIZATIONS
  • removed: variable INCLUDES
  • removed: variable POSIX_CUSTOMIZATIONS
  • removed: variable WIN32_CUSTOMIZATIONS
  • added: class DHParameters(object)
  • added: class DHParametersWithSerialization(DHParameters)
  • added: class DHPrivateKey(object)
  • added: class DHPrivateKeyWithSerialization(DHPrivateKey)
  • added: class DHPublicKey(object)
  • added: class DHPublicKeyWithSerialization(DHPublicKey)
  • added: method DHParameters.generate_private_key()
  • added: method DHParametersWithSerialization.parameter_numbers()
  • added: method DHPrivateKey.key_size()
  • added: method DHPrivateKey.parameters()
  • added: method DHPrivateKey.public_key()
  • added: method DHPrivateKeyWithSerialization.private_numbers()
  • added: method DHPublicKey.key_size()
  • added: method DHPublicKey.parameters()
  • added: method DHPublicKeyWithSerialization.public_numbers()
  • added: class SECP256K1(object)
  • added: field SECP256K1.key_size
  • added: field SECP256K1.name
  • removed: variable CMACContext
  • added: class InvalidToken(Exception)
  • removed: variable DeprecatedIn07
  • added: variable DeprecatedIn09
  • added: class AccessDescription(object)
  • added: class AuthorityInformationAccess(object)
  • added: class AuthorityKeyIdentifier(object)
  • added: class BasicConstraints(object)
  • added: class CRLDistributionPoints(object)
  • added: class CertificatePolicies(object)
  • added: class CertificateSigningRequest(object)
  • added: class DNSName(object)
  • added: class DirectoryName(object)
  • added: class DistributionPoint(object)
  • added: class DuplicateExtension(Exception)
  • added: class ExtendedKeyUsage(object)
  • added: class Extension(object)
  • added: class ExtensionNotFound(Exception)
  • added: class Extensions(object)
  • added: class GeneralName(object)
  • added: class IPAddress(object)
  • added: class KeyUsage(object)
  • added: class NoticeReference(object)
  • added: class PolicyInformation(object)
  • added: class RFC822Name(object)
  • added: class ReasonFlags(Enum)
  • added: class RegisteredID(object)
  • added: class SubjectAlternativeName(object)
  • added: class SubjectKeyIdentifier(object)
  • added: class UniformResourceIdentifier(object)
  • added: class UnsupportedExtension(Exception)
  • added: class UnsupportedGeneralNameType(Exception)
  • added: class UserNotice(object)
  • added: constructor AccessDescription(access_method, access_location)
  • added: constructor AuthorityInformationAccess(descriptions)
  • added: constructor AuthorityKeyIdentifier(key_identifier, authority_cert_issuer, authority_cert_serial_number)
  • added: constructor BasicConstraints(ca, path_length)
  • added: constructor CRLDistributionPoints(distribution_points)
  • added: constructor CertificatePolicies(policies)
  • added: constructor DNSName(value)
  • added: constructor DirectoryName(value)
  • added: constructor DistributionPoint(full_name, relative_name, reasons, crl_issuer)
  • added: constructor DuplicateExtension(msg, oid)
  • added: constructor ExtendedKeyUsage(usages)
  • added: constructor Extension(oid, critical, value)
  • added: constructor ExtensionNotFound(msg, oid)
  • added: constructor Extensions(extensions)
  • added: constructor IPAddress(value)
  • added: constructor KeyUsage(digital_signature, content_commitment, key_encipherment, data_encipherment, key_agreement, key_cert_sign, crl_sign, encipher_only, decipher_only)
  • added: constructor NoticeReference(organization, notice_numbers)
  • added: constructor PolicyInformation(policy_identifier, policy_qualifiers)
  • added: constructor RFC822Name(value)
  • added: constructor RegisteredID(value)
  • added: constructor SubjectAlternativeName(general_names)
  • added: constructor SubjectKeyIdentifier(digest)
  • added: constructor UniformResourceIdentifier(value)
  • added: constructor UnsupportedExtension(msg, oid)
  • added: constructor UnsupportedGeneralNameType(msg, type)
  • added: constructor UserNotice(notice_reference, explicit_text)
  • added: field AccessDescription.access_location
  • added: field AccessDescription.access_method
  • added: field AuthorityKeyIdentifier.authority_cert_issuer
  • added: field AuthorityKeyIdentifier.authority_cert_serial_number
  • added: field AuthorityKeyIdentifier.key_identifier
  • added: field BasicConstraints.ca
  • added: field BasicConstraints.path_length
  • added: field DNSName.value
  • added: field DirectoryName.value
  • added: field DistributionPoint.crl_issuer
  • added: field DistributionPoint.full_name
  • added: field DistributionPoint.reasons
  • added: field DistributionPoint.relative_name
  • added: field Extension.critical
  • added: field Extension.oid
  • added: field Extension.value
  • added: field IPAddress.value
  • added: field KeyUsage.content_commitment
  • added: field KeyUsage.crl_sign
  • added: field KeyUsage.data_encipherment
  • added: field KeyUsage.digital_signature
  • added: field KeyUsage.key_agreement
  • added: field KeyUsage.key_cert_sign
  • added: field KeyUsage.key_encipherment
  • added: field NoticeReference.notice_numbers
  • added: field NoticeReference.organization
  • added: field PolicyInformation.policy_identifier
  • added: field PolicyInformation.policy_qualifiers
  • added: field RFC822Name.value
  • added: field ReasonFlags.aa_compromise
  • added: field ReasonFlags.affiliation_changed
  • added: field ReasonFlags.ca_compromise
  • added: field ReasonFlags.certificate_hold
  • added: field ReasonFlags.cessation_of_operation
  • added: field ReasonFlags.key_compromise
  • added: field ReasonFlags.privilege_withdrawn
  • added: field ReasonFlags.remove_from_crl
  • added: field ReasonFlags.superseded
  • added: field ReasonFlags.unspecified
  • added: field RegisteredID.value
  • added: field SubjectKeyIdentifier.digest
  • added: field UniformResourceIdentifier.value
  • added: field UserNotice.explicit_text
  • added: field UserNotice.notice_reference
  • added: function load_der_x509_csr(data, backend)
  • added: function load_pem_x509_csr(data, backend)
  • added: method CertificateSigningRequest.public_key()
  • added: method CertificateSigningRequest.signature_hash_algorithm()
  • added: method CertificateSigningRequest.subject()
  • added: method Extensions.get_extension_for_oid(oid)
  • added: method GeneralName.value()
  • added: method SubjectAlternativeName.get_values_for_type(type)
  • added: property KeyUsage.decipher_only
  • added: property KeyUsage.encipher_only
  • added: variable OID_AUTHORITY_INFORMATION_ACCESS
  • added: variable OID_AUTHORITY_KEY_IDENTIFIER
  • added: variable OID_BASIC_CONSTRAINTS
  • added: variable OID_CA_ISSUERS
  • added: variable OID_CERTIFICATE_POLICIES
  • added: variable OID_CLIENT_AUTH
  • added: variable OID_CODE_SIGNING
  • added: variable OID_CPS_QUALIFIER
  • added: variable OID_CPS_USER_NOTICE
  • added: variable OID_CRL_DISTRIBUTION_POINTS
  • added: variable OID_EMAIL_PROTECTION
  • added: variable OID_EXTENDED_KEY_USAGE
  • added: variable OID_FRESHEST_CRL
  • added: variable OID_INHIBIT_ANY_POLICY
  • added: variable OID_ISSUER_ALTERNATIVE_NAME
  • added: variable OID_KEY_USAGE
  • added: variable OID_NAME_CONSTRAINTS
  • added: variable OID_OCSP
  • added: variable OID_OCSP_NO_CHECK
  • added: variable OID_OCSP_SIGNING
  • added: variable OID_POLICY_CONSTRAINTS
  • added: variable OID_POLICY_MAPPINGS
  • added: variable OID_SERVER_AUTH
  • added: variable OID_SUBJECT_ALTERNATIVE_NAME
  • added: variable OID_SUBJECT_DIRECTORY_ATTRIBUTES
  • added: variable OID_SUBJECT_INFORMATION_ACCESS
  • added: variable OID_SUBJECT_KEY_IDENTIFIER
  • added: variable OID_TIME_STAMPING