Skip to content

Upgrading cryptography 42 to 43

Breaking42.0.8 → 43.0.3Breaking2Security1Deprecated1New10Changed6Fixed1

Full comparisonBack to cryptography
BreakingUpgrade verdict

2 breaking changes and a security fix.

In plain terms
  • Older versions of the OpenSSL library are no longer supported, so users must upgrade OpenSSL.
  • Older LibreSSL versions are no longer supported.
  • pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels
  • Two legacy ciphers are relocated and deprecated; they will be removed from the cipher module in 48.0.0.
Must act 4 items need code or config changes

What you must change

Breaking2
Removes support for OpenSSL versions older than 1.1.1e.
43.0.0CHANGELOG.rstSummarizedView source
Drops support for LibreSSL versions below 3.8.
43.0.0CHANGELOG.rstSummarizedView source
Security1
pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels
Moderate
43.0.1GitHub AdvisoryOriginalView source

Deprecations to plan for

Deprecated1
Moves TripleDES and ARC4 into the decrepit module and deprecates them in the cipher module.
cryptography.hazmat.primitives.ciphers.algorithms.TripleDEScryptography.hazmat.primitives.ciphers.algorithms.ARC4
43.0.0CHANGELOG.rstSummarizedView source

API changes

Generated by DepDelta from published Python source. Not mixed with prose notes.

  • removed: class GetCipherByName
  • removed: constructor GetCipherByName(fmt: str)
  • removed: method Backend.aead_cipher_supported(cipher) -> bool
  • removed: method Backend.create_symmetric_decryption_ctx(cipher: CipherAlgorithm, mode: Mode) -> _CipherContext
  • removed: method Backend.create_symmetric_encryption_ctx(cipher: CipherAlgorithm, mode: Mode) -> _CipherContext
  • removed: method Backend.generate_rsa_parameters_supported(public_exponent: int, key_size: int) -> bool
  • removed: method Backend.load_key_and_certificates_from_pkcs12(data: bytes, password: bytes | None) -> tuple[PrivateKeyTypes | None, x509.Certificate | None, list[x509.Certificate]]
  • removed: method Backend.load_pkcs12(data: bytes, password: bytes | None) -> PKCS12KeyAndCertificates
  • removed: method Backend.register_cipher_adapter(cipher_cls, mode_cls, adapter) -> None
  • removed: method Backend.serialize_key_and_certificates_to_pkcs12(name: bytes | None, key: PKCS12PrivateKeyTypes | None, cert: x509.Certificate | None, cas: list[_PKCS12CATypes] | None, encryption_algorithm: serialization.KeySerializationEncryption) -> bytes
  • changed: method Backend.openssl_assert(ok: bool, errors: list[rust_openssl.OpenSSLError] | None=…) -> None → method Backend.openssl_assert(ok: bool) -> None
  • added: method Backend.ecdsa_deterministic_supported() -> bool
  • added: class ARC4(CipherAlgorithm)
  • added: class Blowfish(BlockCipherAlgorithm)
  • added: class CAST5(BlockCipherAlgorithm)
  • added: class IDEA(BlockCipherAlgorithm)
  • added: class RC2(BlockCipherAlgorithm)
  • added: class SEED(BlockCipherAlgorithm)
  • added: class TripleDES(BlockCipherAlgorithm)
  • added: constructor ARC4(key: bytes)
  • added: constructor Blowfish(key: bytes)
  • added: constructor CAST5(key: bytes)
  • added: constructor IDEA(key: bytes)
  • added: constructor RC2(key: bytes)
  • added: constructor SEED(key: bytes)
  • added: constructor TripleDES(key: bytes)
  • added: field ARC4.key_sizes
  • added: field ARC4.name
  • added: field Blowfish.block_size
  • added: field Blowfish.key_sizes
  • added: field Blowfish.name
  • added: field CAST5.block_size
  • added: field CAST5.key_sizes
  • added: field CAST5.name
  • added: field IDEA.block_size
  • added: field IDEA.key_sizes
  • added: field IDEA.name
  • added: field RC2.block_size
  • added: field RC2.key_sizes
  • added: field RC2.name
  • added: field SEED.block_size
  • added: field SEED.key_sizes
  • added: field SEED.name
  • added: field TripleDES.block_size
  • added: field TripleDES.key_sizes
  • added: field TripleDES.name
  • added: property ARC4.key_size -> int
  • added: property Blowfish.key_size -> int
  • added: property CAST5.key_size -> int
  • added: property IDEA.key_size -> int
  • added: property RC2.key_size -> int
  • added: property SEED.key_size -> int
  • added: property TripleDES.key_size -> int
  • changed: constructor ECDSA(algorithm: asym_utils.Prehashed | hashes.HashAlgorithm) → constructor ECDSA(algorithm: asym_utils.Prehashed | hashes.HashAlgorithm, deterministic_signing: bool=…)
  • added: property ECDSA.deterministic_signing -> bool
  • added: function rsa_recover_private_exponent(e: int, p: int, q: int) -> int
  • removed: class AESCCM
  • removed: class AESGCM
  • removed: constructor AESCCM(key: bytes, tag_length: int=…)
  • removed: constructor AESGCM(key: bytes)
  • removed: method AESCCM.decrypt(nonce: bytes, data: bytes, associated_data: bytes | None) -> bytes
  • removed: method AESCCM.encrypt(nonce: bytes, data: bytes, associated_data: bytes | None) -> bytes
  • removed: method AESGCM.decrypt(nonce: bytes, data: bytes, associated_data: bytes | None) -> bytes
  • removed: method AESGCM.encrypt(nonce: bytes, data: bytes, associated_data: bytes | None) -> bytes
  • removed: static method AESCCM.generate_key(bit_length: int) -> bytes
  • removed: static method AESGCM.generate_key(bit_length: int) -> bytes
  • added: variable AESCCM
  • added: variable AESGCM
  • removed: class ARC4(CipherAlgorithm)
  • removed: class Blowfish(BlockCipherAlgorithm)
  • removed: class CAST5(BlockCipherAlgorithm)
  • removed: class IDEA(BlockCipherAlgorithm)
  • removed: class SEED(BlockCipherAlgorithm)
  • removed: class TripleDES(BlockCipherAlgorithm)
  • removed: constructor ARC4(key: bytes)
  • removed: constructor Blowfish(key: bytes)
  • removed: constructor CAST5(key: bytes)
  • removed: constructor IDEA(key: bytes)
  • removed: constructor SEED(key: bytes)
  • removed: constructor TripleDES(key: bytes)
  • removed: field ARC4.key_sizes
  • removed: field ARC4.name
  • removed: field Blowfish.block_size
  • removed: field Blowfish.key_sizes
  • removed: field Blowfish.name
  • removed: field CAST5.block_size
  • removed: field CAST5.key_sizes
  • removed: field CAST5.name
  • removed: field IDEA.block_size
  • removed: field IDEA.key_sizes
  • removed: field IDEA.name
  • removed: field SEED.block_size
  • removed: field SEED.key_sizes
  • removed: field SEED.name
  • removed: field TripleDES.block_size
  • removed: field TripleDES.key_sizes
  • removed: field TripleDES.name
  • removed: property ARC4.key_size -> int
  • removed: property Blowfish.key_size -> int
  • removed: property CAST5.key_size -> int
  • removed: property IDEA.key_size -> int
  • removed: property SEED.key_size -> int
  • removed: property TripleDES.key_size -> int
  • added: method CipherContext.reset_nonce(nonce: bytes) -> None
  • removed: class PKCS12Certificate
  • removed: constructor PKCS12Certificate(cert: x509.Certificate, friendly_name: bytes | None)
  • removed: function load_key_and_certificates(data: bytes, password: bytes | None, backend: typing.Any=…) -> tuple[PrivateKeyTypes | None, x509.Certificate | None, list[x509.Certificate]]
  • removed: function load_pkcs12(data: bytes, password: bytes | None, backend: typing.Any=…) -> PKCS12KeyAndCertificates
  • removed: property PKCS12Certificate.certificate -> x509.Certificate
  • removed: property PKCS12Certificate.friendly_name -> bytes | None
  • added: variable PKCS12Certificate
  • added: variable load_key_and_certificates
  • added: variable load_pkcs12
  • added: class PKCS7EnvelopeBuilder
  • added: constructor PKCS7EnvelopeBuilder(*, _data: bytes | None=…, _recipients: list[x509.Certificate] | None=…)
  • added: method PKCS7EnvelopeBuilder.add_recipient(certificate: x509.Certificate) -> PKCS7EnvelopeBuilder
  • added: method PKCS7EnvelopeBuilder.encrypt(encoding: serialization.Encoding, options: typing.Iterable[PKCS7Options]) -> bytes
  • added: method PKCS7EnvelopeBuilder.set_data(data: bytes) -> PKCS7EnvelopeBuilder
  • added: function load_application(data) -> tuple[memoryview, memoryview]
  • added: variable DeprecatedIn43
  • added: export PublicKeyAlgorithmOID
  • added: property Certificate.public_key_algorithm_oid -> ObjectIdentifier
  • added: property InvalidityDate.invalidity_date_utc -> datetime.datetime
  • added: property OCSPResponse.next_update_utc -> datetime.datetime | None
  • added: property OCSPResponse.produced_at_utc -> datetime.datetime
  • added: property OCSPResponse.revocation_time_utc -> datetime.datetime | None
  • added: property OCSPResponse.this_update_utc -> datetime.datetime
  • added: property OCSPSingleResponse.next_update_utc -> datetime.datetime | None
  • added: property OCSPSingleResponse.revocation_time_utc -> datetime.datetime | None
  • added: property OCSPSingleResponse.this_update_utc -> datetime.datetime
  • added: export PublicKeyAlgorithmOID
  • added: variable ClientVerifier
  • added: variable VerifiedClient