For all practical purposes, PyCrypto, the Python Cryptography Toolkit, is dead. The package has several issues (manyof them with security implications) that will almost certainly never get fixed because the project hasn’t been updatedin multiple years. Despite that, I still see PyCrypto recommendations around every now and then — I just got it removedfrom the Awesome Cryptography list.
This unfixed, exploitable crashing bug should be goodreason to stop using PyCrypto. But that’s not the only security flaw by any means — just browse the issues list to find more. And that’s still not all theproblems. Last year I looked at the code and found a smallcryptographic flaw that I patched in PyCryptodome (the fork that’s continuing the project). The flaw still existsin PyCrypto, and I didn’t bother filing an issue there. There are probably many more flaws that have been discovered,publicly or privately, but aren’t listed.
This package had its day, but it’s beyond time to stop using it.
What are the Alternatives?
The new Python Cryptography package is quite nice. It has anAPI that’s designed to be easy to use securely.
If using a totally new API isn’t an option, there’s the PyCryptodome fork. Be aware, though, that the PyCrypto API is the exactopposite of “easy to use securely”. The example and all the defaults onthe AES documentation page are bad security practices. That’s a lot of nasty footguns on just one page ofdocumentation, which is kind of scary. Thankfully, the PyCryptodome project has been fixing many of these problems, butI still recommend and use Python Cryptography.
You can read more posts tagged Python and Security ,including these:
What Difference Can Order Make When Hashing?
I saw this thread about passwordhashing on the D language forums. The original post had a good question that didn’t get answered at the time: ifyou’re hashing a bunch of things, can it make any difference (for security) what order you do it?
The answer turns out to be yes, and it’s a neat example of the difference between theoretical ideals and real-worldsystems. Because I think this stuff is worth knowing if you’re using cryptographic hash functions for, you know,actual crypto, I thought I’d write up a blog post about why it can matter.
Code Jam 1A :/
Well, I started off round 1A feeling good.By the 6min mark I had solutions for the small and large inputs for problem A submitted, then… everything fell apart.It was my first time in a long while writing code under live competition conditions, and I’d forgotten just how toughit can be. Time for more practice.
Ignoring my total failure to get working solutions across the finish line, the next two problems weren’t actuallyhard – they could fit in as medium problems in a qualification round. In fact, so many people solved them thatgetting a perfect score wasn’t even enough to get to Round 2.
By the way, my Python solution for problem A brings me to 9 languages in this Code Jam. Will I keep going? Thatdepends on how jet-lagged I am for rounds 1B and 1C.
