| name | cryptography-46-0-0 |
| description | Comprehensive toolkit for Python cryptographic operations using the cryptography library. Use when implementing encryption, decryption, hashing, digital signatures, key derivation, X.509 certificate handling, and other cryptographic primitives in Python applications. |
| version | 0.1.0 |
| author | Tangled <noreply@tangledgroup.com> |
| license | MIT |
| tags | ["cryptography","encryption","hashing","asymmetric","symmetric","x509","tls","python","security"] |
| category | security |
| external_references | ["https://cryptography.io/en/latest/","https://github.com/pyca/cryptography"] |
cryptography 46.x
Overview
cryptography is a Python package that provides both high-level cryptographic recipes and low-level interfaces to common cryptographic algorithms including symmetric ciphers, message digests, key derivation functions, and asymmetric (public-key) cryptography. It is maintained by the Python Cryptographic Authority (PyCA).
The library is broadly divided into two layers:
- Recipes layer — High-level, safe-to-use APIs that require minimal configuration. These are the recommended starting point for most use cases. Includes
Fernet for symmetric encryption and x509 for certificate handling.
- Hazardous Materials (hazmat) layer — Low-level cryptographic primitives in
cryptography.hazmat. These are dangerous and can be used incorrectly, requiring deep knowledge of cryptographic concepts. Always prefer the recipes layer when possible.
The library is built on OpenSSL 3.x (or compatible backends like BoringSSL, LibreSSL, AWS-LC) with a Rust-based build system. It requires Python 3.9+.
When to Use
- Encrypting and decrypting data at rest or in transit
- Generating and verifying digital signatures
- Computing cryptographic hashes (SHA-2, SHA-3, BLAKE2)
- Deriving cryptographic keys from passwords (PBKDF2, Argon2, HKDF, scrypt)
- Creating, parsing, and verifying X.509 certificates and CSRs
- Implementing two-factor authentication (HOTP/TOTP)
- Performing asymmetric key operations (RSA, EC, Ed25519, X25519)
- Key wrapping (AES-KW)
- HPKE (Hybrid Public Key Encryption) for post-quantum-ready encryption
- Message authentication codes (HMAC, CMAC, Poly1305)
Core Concepts
Two-layer architecture: The library separates safe "recipes" from low-level "hazmat" primitives. Import paths starting with cryptography.hazmat signal that you are using dangerous building blocks.
Authenticated encryption: Plain encryption provides secrecy but not authenticity. Always use authenticated schemes (Fernet, AES-GCM, ChaCha20-Poly1305) to prevent tampering attacks.
Nonce uniqueness: For AEAD ciphers, never reuse a nonce with the same key — doing so compromises all messages encrypted with that key/nonce pair.
Secure random: Always use os.urandom() or the secrets module for cryptographic randomness. Never use the random module for security-sensitive values.
