Upgrading cryptography 46 to 47
Breaking46.0.7 → 47.0.0Breaking6Deprecated6New11Changed2Fixed1
BreakingUpgrade verdict
6 breaking changes.
In plain terms
- The rarely used binary elliptic curves are gone, so code using them will stop working.
- Older OpenSSL 1.1.x is no longer supported; you need OpenSSL 3.0.0 or newer.
- LibreSSL below version 4.1 is no longer supported.
- Some key loading errors now raise a different exception type, so error handling code may need updating.
Must act Top 5 of 12 that need code or config changes
What you must change
Breaking6
Removes support for binary elliptic curves (SECT* classes).
SECT*Removes support for OpenSSL 1.1.x; OpenSSL 3.0.0 or later is now required.
Drops support for LibreSSL versions older than 4.1.
Loading keys with unsupported algorithms or explicit curve encodings now raises UnsupportedAlgorithm instead of ValueError.
UnsupportedAlgorithmload_pem_private_keyload_der_private_keyload_pem_public_keyload_der_public_keyCertificate.public_keyRejects elliptic curve private keys that incorrectly encode a private key of the wrong length.
public_bytes and private_bytes on keys now raise TypeError instead of ValueError for an invalid encoding for the given format.
public_bytesprivate_bytesDeprecations to plan for
Deprecated6
Deprecates support for Python 3.8, to be removed in the next release.
Deprecates passing 64-bit and 128-bit keys to TripleDES; only 192-bit keys will be accepted later.
TripleDESDeprecates support for x86_64 macOS, including wheels, to be removed next release in favor of arm64-only wheels.
Deprecates support for 32-bit Windows, including wheels, to be removed next release.
Moves CFB, OFB, and CFB8 into the decrepit module and deprecates them in the modes module, to be removed in 49.0.0.
CFBOFBCFB8Moves Camellia into the decrepit module and deprecates it in the cipher module, to be removed in 49.0.0.
CamelliaAPI changes
Generated by DepDelta from published Python source. Not mixed with prose notes.
- added:
export BitString - added:
export Default - added:
export Explicit - added:
export GeneralizedTime - added:
export IA5String - added:
export Implicit - added:
export Null - added:
export PrintableString - added:
export SetOf - added:
export Size - added:
export TLV - added:
export UTCTime - added:
export Variant - added:
export decode_der - added:
export set
- added:
class Default(typing.Generic[U]) - added:
class Variant(typing.Generic[U, Tag]) - added:
field Default.value: U - added:
field Variant.tag: str - added:
field Variant.value: U - added:
function set(cls: type[U]) -> type[U] - added:
variable Annotated - added:
variable BitString - added:
variable Explicit - added:
variable GeneralizedTime - added:
variable IA5String - added:
variable Implicit - added:
variable LiteralString - added:
variable NoneType - added:
variable Null - added:
variable PrintableString - added:
variable SetOf - added:
variable Size - added:
variable TLV - added:
variable Tag - added:
variable UTCTime - added:
variable decode_der - added:
variable get_type_args - added:
variable get_type_origin
- added:
method Backend.mldsa_supported() -> bool - added:
method Backend.mlkem_supported() -> bool
- changed:
field Binding.ffi → field Binding.ffi: typing.Any
- added:
class Camellia(BlockCipherAlgorithm) - added:
constructor Camellia(key: bytes) - added:
field Camellia.block_size - added:
field Camellia.key_sizes - added:
field Camellia.name - added:
property Camellia.key_size -> int
- added:
class CFB(ModeWithInitializationVector) - added:
class CFB8(ModeWithInitializationVector) - added:
class OFB(ModeWithInitializationVector) - added:
constructor CFB(initialization_vector: utils.Buffer) - added:
constructor CFB8(initialization_vector: utils.Buffer) - added:
constructor OFB(initialization_vector: utils.Buffer) - added:
field CFB.name - added:
field CFB.validate_for_algorithm - added:
field CFB8.name - added:
field CFB8.validate_for_algorithm - added:
field OFB.name - added:
field OFB.validate_for_algorithm - added:
property CFB.initialization_vector -> utils.Buffer - added:
property CFB8.initialization_vector -> utils.Buffer - added:
property OFB.initialization_vector -> utils.Buffer
- removed:
class SECT163K1(EllipticCurve) - removed:
class SECT163R2(EllipticCurve) - removed:
class SECT233K1(EllipticCurve) - removed:
class SECT233R1(EllipticCurve) - removed:
class SECT283K1(EllipticCurve) - removed:
class SECT283R1(EllipticCurve) - removed:
class SECT409K1(EllipticCurve) - removed:
class SECT409R1(EllipticCurve) - removed:
class SECT571K1(EllipticCurve) - removed:
class SECT571R1(EllipticCurve) - removed:
field EllipticCurveOID.SECT163K1 - removed:
field EllipticCurveOID.SECT163R2 - removed:
field EllipticCurveOID.SECT233K1 - removed:
field EllipticCurveOID.SECT233R1 - removed:
field EllipticCurveOID.SECT283K1 - removed:
field EllipticCurveOID.SECT283R1 - removed:
field EllipticCurveOID.SECT409K1 - removed:
field EllipticCurveOID.SECT409R1 - removed:
field EllipticCurveOID.SECT571K1 - removed:
field EllipticCurveOID.SECT571R1 - removed:
field SECT163K1.group_order - removed:
field SECT163K1.key_size - removed:
field SECT163K1.name - removed:
field SECT163R2.group_order - removed:
field SECT163R2.key_size - removed:
field SECT163R2.name - removed:
field SECT233K1.group_order - removed:
field SECT233K1.key_size - removed:
field SECT233K1.name - removed:
field SECT233R1.group_order - removed:
field SECT233R1.key_size - removed:
field SECT233R1.name - removed:
field SECT283K1.group_order - removed:
field SECT283K1.key_size - removed:
field SECT283K1.name - removed:
field SECT283R1.group_order - removed:
field SECT283R1.key_size - removed:
field SECT283R1.name - removed:
field SECT409K1.group_order - removed:
field SECT409K1.key_size - removed:
field SECT409K1.name - removed:
field SECT409R1.group_order - removed:
field SECT409R1.key_size - removed:
field SECT409R1.name - removed:
field SECT571K1.group_order - removed:
field SECT571K1.key_size - removed:
field SECT571K1.name - removed:
field SECT571R1.group_order - removed:
field SECT571R1.key_size - removed:
field SECT571R1.name
- added:
class MLDSA44PrivateKey - added:
class MLDSA44PublicKey - added:
class MLDSA65PrivateKey - added:
class MLDSA65PublicKey - added:
class MLDSA87PrivateKey - added:
class MLDSA87PublicKey - added:
method MLDSA44PrivateKey.private_bytes(encoding: _serialization.Encoding, format: _serialization.PrivateFormat, encryption_algorithm: _serialization.KeySerializationEncryption) -> bytes - added:
method MLDSA44PrivateKey.private_bytes_raw() -> bytes - added:
method MLDSA44PrivateKey.public_key() -> MLDSA44PublicKey - added:
method MLDSA44PrivateKey.sign(data: Buffer, context: Buffer | None=…) -> bytes - added:
method MLDSA44PublicKey.public_bytes(encoding: _serialization.Encoding, format: _serialization.PublicFormat) -> bytes - added:
method MLDSA44PublicKey.public_bytes_raw() -> bytes - added:
method MLDSA44PublicKey.verify(signature: Buffer, data: Buffer, context: Buffer | None=…) -> None - added:
method MLDSA65PrivateKey.private_bytes(encoding: _serialization.Encoding, format: _serialization.PrivateFormat, encryption_algorithm: _serialization.KeySerializationEncryption) -> bytes - added:
method MLDSA65PrivateKey.private_bytes_raw() -> bytes - added:
method MLDSA65PrivateKey.public_key() -> MLDSA65PublicKey - added:
method MLDSA65PrivateKey.sign(data: Buffer, context: Buffer | None=…) -> bytes - added:
method MLDSA65PublicKey.public_bytes(encoding: _serialization.Encoding, format: _serialization.PublicFormat) -> bytes - added:
method MLDSA65PublicKey.public_bytes_raw() -> bytes - added:
method MLDSA65PublicKey.verify(signature: Buffer, data: Buffer, context: Buffer | None=…) -> None - added:
method MLDSA87PrivateKey.private_bytes(encoding: _serialization.Encoding, format: _serialization.PrivateFormat, encryption_algorithm: _serialization.KeySerializationEncryption) -> bytes - added:
method MLDSA87PrivateKey.private_bytes_raw() -> bytes - added:
method MLDSA87PrivateKey.public_key() -> MLDSA87PublicKey - added:
method MLDSA87PrivateKey.sign(data: Buffer, context: Buffer | None=…) -> bytes - added:
method MLDSA87PublicKey.public_bytes(encoding: _serialization.Encoding, format: _serialization.PublicFormat) -> bytes - added:
method MLDSA87PublicKey.public_bytes_raw() -> bytes - added:
method MLDSA87PublicKey.verify(signature: Buffer, data: Buffer, context: Buffer | None=…) -> None - added:
static method MLDSA44PrivateKey.from_seed_bytes(data: Buffer) -> MLDSA44PrivateKey - added:
static method MLDSA44PrivateKey.generate() -> MLDSA44PrivateKey - added:
static method MLDSA44PublicKey.from_public_bytes(data: bytes) -> MLDSA44PublicKey - added:
static method MLDSA65PrivateKey.from_seed_bytes(data: Buffer) -> MLDSA65PrivateKey - added:
static method MLDSA65PrivateKey.generate() -> MLDSA65PrivateKey - added:
static method MLDSA65PublicKey.from_public_bytes(data: bytes) -> MLDSA65PublicKey - added:
static method MLDSA87PrivateKey.from_seed_bytes(data: Buffer) -> MLDSA87PrivateKey - added:
static method MLDSA87PrivateKey.generate() -> MLDSA87PrivateKey - added:
static method MLDSA87PublicKey.from_public_bytes(data: bytes) -> MLDSA87PublicKey
- added:
class MLKEM1024PrivateKey - added:
class MLKEM1024PublicKey - added:
class MLKEM768PrivateKey - added:
class MLKEM768PublicKey - added:
method MLKEM1024PrivateKey.decapsulate(ciphertext: Buffer) -> bytes - added:
method MLKEM1024PrivateKey.private_bytes(encoding: _serialization.Encoding, format: _serialization.PrivateFormat, encryption_algorithm: _serialization.KeySerializationEncryption) -> bytes - added:
method MLKEM1024PrivateKey.private_bytes_raw() -> bytes - added:
method MLKEM1024PrivateKey.public_key() -> MLKEM1024PublicKey - added:
method MLKEM1024PublicKey.encapsulate() -> tuple[bytes, bytes] - added:
method MLKEM1024PublicKey.public_bytes(encoding: _serialization.Encoding, format: _serialization.PublicFormat) -> bytes - added:
method MLKEM1024PublicKey.public_bytes_raw() -> bytes - added:
method MLKEM768PrivateKey.decapsulate(ciphertext: Buffer) -> bytes - added:
method MLKEM768PrivateKey.private_bytes(encoding: _serialization.Encoding, format: _serialization.PrivateFormat, encryption_algorithm: _serialization.KeySerializationEncryption) -> bytes - added:
method MLKEM768PrivateKey.private_bytes_raw() -> bytes - added:
method MLKEM768PrivateKey.public_key() -> MLKEM768PublicKey - added:
method MLKEM768PublicKey.encapsulate() -> tuple[bytes, bytes] - added:
method MLKEM768PublicKey.public_bytes(encoding: _serialization.Encoding, format: _serialization.PublicFormat) -> bytes - added:
method MLKEM768PublicKey.public_bytes_raw() -> bytes - added:
static method MLKEM1024PrivateKey.from_seed_bytes(data: Buffer) -> MLKEM1024PrivateKey - added:
static method MLKEM1024PrivateKey.generate() -> MLKEM1024PrivateKey - added:
static method MLKEM1024PublicKey.from_public_bytes(data: Buffer) -> MLKEM1024PublicKey - added:
static method MLKEM768PrivateKey.from_seed_bytes(data: Buffer) -> MLKEM768PrivateKey - added:
static method MLKEM768PrivateKey.generate() -> MLKEM768PrivateKey - added:
static method MLKEM768PublicKey.from_public_bytes(data: Buffer) -> MLKEM768PublicKey
- changed:
method RSAPrivateKey.sign(data: bytes, padding: AsymmetricPadding, algorithm: asym_utils.Prehashed | hashes.HashAlgorithm) -> bytes → method RSAPrivateKey.sign(data: bytes, padding: AsymmetricPadding, algorithm: asym_utils.Prehashed | hashes.HashAlgorithm | asym_utils.NoDigestInfo) -> bytes - changed:
method RSAPublicKey.recover_data_from_signature(signature: bytes, padding: AsymmetricPadding, algorithm: hashes.HashAlgorithm | None) -> bytes → method RSAPublicKey.recover_data_from_signature(signature: bytes, padding: AsymmetricPadding, algorithm: hashes.HashAlgorithm | asym_utils.NoDigestInfo | None) -> bytes
- added:
class NoDigestInfo
- removed:
class Camellia(BlockCipherAlgorithm) - removed:
constructor Camellia(key: utils.Buffer) - removed:
field Camellia.block_size - removed:
field Camellia.key_sizes - removed:
field Camellia.name - removed:
property Camellia.key_size -> int
- removed:
class CFB(ModeWithInitializationVector) - removed:
class CFB8(ModeWithInitializationVector) - removed:
class Mode - removed:
class ModeWithAuthenticationTag(Mode) - removed:
class ModeWithInitializationVector(Mode) - removed:
class ModeWithNonce(Mode) - removed:
class ModeWithTweak(Mode) - removed:
class OFB(ModeWithInitializationVector) - removed:
constructor CFB(initialization_vector: utils.Buffer) - removed:
constructor CFB8(initialization_vector: utils.Buffer) - removed:
constructor OFB(initialization_vector: utils.Buffer) - removed:
field CFB.name - removed:
field CFB.validate_for_algorithm - removed:
field CFB8.name - removed:
field CFB8.validate_for_algorithm - removed:
field OFB.name - removed:
field OFB.validate_for_algorithm - removed:
method Mode.validate_for_algorithm(algorithm: CipherAlgorithm) -> None - removed:
property CFB.initialization_vector -> utils.Buffer - removed:
property CFB8.initialization_vector -> utils.Buffer - removed:
property Mode.name -> str - removed:
property ModeWithAuthenticationTag.tag -> bytes | None - removed:
property ModeWithInitializationVector.initialization_vector -> utils.Buffer - removed:
property ModeWithNonce.nonce -> utils.Buffer - removed:
property ModeWithTweak.tweak -> utils.Buffer - removed:
property OFB.initialization_vector -> utils.Buffer
- added:
variable AEAD - added:
variable KDF - added:
variable KEM - added:
variable MLKEM1024P384PrivateKey - added:
variable MLKEM1024P384PublicKey - added:
variable MLKEM768X25519PrivateKey - added:
variable MLKEM768X25519PublicKey - added:
variable Suite
- added:
export Buffer - added:
method KeyDerivationFunction.derive_into(key_material: bytes, buffer: Buffer) -> None
- added:
variable Argon2d - added:
variable Argon2i
- removed:
class ConcatKDFHMAC(KeyDerivationFunction) - removed:
class ConcatKDFHash(KeyDerivationFunction) - removed:
constructor ConcatKDFHMAC(algorithm: hashes.HashAlgorithm, length: int, salt: bytes | None, otherinfo: bytes | None, backend: typing.Any=…) - removed:
constructor ConcatKDFHash(algorithm: hashes.HashAlgorithm, length: int, otherinfo: bytes | None, backend: typing.Any=…) - removed:
method ConcatKDFHMAC.derive(key_material: utils.Buffer) -> bytes - removed:
method ConcatKDFHMAC.verify(key_material: bytes, expected_key: bytes) -> None - removed:
method ConcatKDFHash.derive(key_material: utils.Buffer) -> bytes - removed:
method ConcatKDFHash.verify(key_material: bytes, expected_key: bytes) -> None - added:
variable ConcatKDFHMAC - added:
variable ConcatKDFHash
- removed:
class KBKDFCMAC(KeyDerivationFunction) - removed:
class KBKDFHMAC(KeyDerivationFunction) - removed:
constructor KBKDFCMAC(algorithm, mode: Mode, length: int, rlen: int, llen: int | None, location: CounterLocation, label: bytes | None, context: bytes | None, fixed: bytes | None, backend: typing.Any=…, *, break_location: int | None=…) - removed:
constructor KBKDFHMAC(algorithm: hashes.HashAlgorithm, mode: Mode, length: int, rlen: int, llen: int | None, location: CounterLocation, label: bytes | None, context: bytes | None, fixed: bytes | None, backend: typing.Any=…, *, break_location: int | None=…) - removed:
method KBKDFCMAC.derive(key_material: utils.Buffer) -> bytes - removed:
method KBKDFCMAC.verify(key_material: bytes, expected_key: bytes) -> None - removed:
method KBKDFHMAC.derive(key_material: utils.Buffer) -> bytes - removed:
method KBKDFHMAC.verify(key_material: bytes, expected_key: bytes) -> None - added:
variable KBKDFCMAC - added:
variable KBKDFHMAC
- removed:
class PBKDF2HMAC(KeyDerivationFunction) - removed:
constructor PBKDF2HMAC(algorithm: hashes.HashAlgorithm, length: int, salt: bytes, iterations: int, backend: typing.Any=…) - removed:
method PBKDF2HMAC.derive(key_material: utils.Buffer) -> bytes - removed:
method PBKDF2HMAC.verify(key_material: bytes, expected_key: bytes) -> None - added:
variable PBKDF2HMAC
- removed:
class X963KDF(KeyDerivationFunction) - removed:
constructor X963KDF(algorithm: hashes.HashAlgorithm, length: int, sharedinfo: bytes | None, backend: typing.Any=…) - removed:
method X963KDF.derive(key_material: utils.Buffer) -> bytes - removed:
method X963KDF.verify(key_material: bytes, expected_key: bytes) -> None - added:
variable X963KDF
- removed:
variable DeprecatedIn46 - added:
variable DeprecatedIn47
- added:
export oid
- removed:
class RevokedCertificate - removed:
property RevokedCertificate.extensions -> Extensions - removed:
property RevokedCertificate.revocation_date -> datetime.datetime - removed:
property RevokedCertificate.revocation_date_utc -> datetime.datetime - removed:
property RevokedCertificate.serial_number -> int - added:
variable RevokedCertificate
- changed:
constructor Name(attributes: Iterable[NameAttribute]) -> None | (attributes: Iterable[RelativeDistinguishedName]) -> None → constructor Name(attributes: Iterable[NameAttribute[str | bytes]]) -> None | (attributes: Iterable[RelativeDistinguishedName]) -> None - changed:
constructor RelativeDistinguishedName(attributes: Iterable[NameAttribute]) → constructor RelativeDistinguishedName(attributes: Iterable[NameAttribute[str | bytes]])