Skip to content

Upgrading cryptography 49 to 50

Review needed49.0.0 → 50.0.2Security1Deprecated1New10Changed9Fixed1

Full comparisonBack to cryptography
Review neededUpgrade verdict

1 deprecation and a security fix.

In plain terms
  • Decrypting untrusted PKCS7 messages no longer leaks information through different errors or timing, which could previously help an attacker recover secrets.
  • Finite-field Diffie-Hellman is being phased out; users should switch to a more modern key exchange algorithm.
Must act 2 items need code or config changes

What you must change

Security1
Fixes a Bleichenbacher oracle in pkcs7_decrypt_der and its PEM and S/MIME variants by substituting a random key on failure.
pkcs7_decrypt_der
50.0.0CHANGELOG.rstSummarizedView source

Deprecations to plan for

Deprecated1
Deprecates all Diffie-Hellman key exchange over finite fields (FFDH), including the dh module types and FFDH key/parameter loading.
cryptography.hazmat.primitives.asymmetric.dh
50.0.0CHANGELOG.rstSummarizedView source

API changes

Generated by DepDelta from published Python source. Not mixed with prose notes.

  • added: variable Cobblestone128Decryptor
  • added: variable Cobblestone128Encryptor
  • added: variable Cobblestone256Decryptor
  • added: variable Cobblestone256Encryptor
  • removed: method Backend.pbkdf2_hmac_supported(algorithm: hashes.HashAlgorithm) -> bool
  • removed: method Backend.pkcs7_supported() -> bool
  • added: variable MLDSAMuHasher
  • added: static method SHAKE128.xof()
  • added: static method SHAKE256.xof()
  • removed: function aes_key_unwrap(wrapping_key: bytes, wrapped_key: bytes, backend: typing.Any=…) -> bytes
  • removed: function aes_key_unwrap_with_padding(wrapping_key: bytes, wrapped_key: bytes, backend: typing.Any=…) -> bytes
  • removed: function aes_key_wrap(wrapping_key: bytes, key_to_wrap: bytes, backend: typing.Any=…) -> bytes
  • removed: function aes_key_wrap_with_padding(wrapping_key: bytes, key_to_wrap: bytes, backend: typing.Any=…) -> bytes
  • added: variable aes_key_unwrap
  • added: variable aes_key_unwrap_with_padding
  • added: variable aes_key_wrap
  • added: variable aes_key_wrap_with_padding
  • changed: function ssh_key_fingerprint(key: SSHPublicKeyTypes, hash_algorithm: hashes.MD5 | hashes.SHA256) -> bytes → function ssh_key_fingerprint(key: SSHPublicKeyTypes, hash_algorithm: hashes.MD5 | hashes.SHA1 | hashes.SHA256) -> bytes
  • removed: function cached_property(func: Callable) -> property
  • added: variable DeprecatedIn50
  • added: method CertificateBuilder.create_unsigned() -> Certificate