Features

This page lists the algorithms and formats that PyCryptodome provides. If you are not sure which one to use, start from the guides, which recommend one for each common task.

These are low-level primitives: combining them into a secure system on your own requires a good understanding of cryptography.

Some primitives are obsolete (e.g. TDES) or even insecure (e.g. RC4). They are marked as legacy below, and they are provided only for backward compatibility.

Block ciphers

Traditional modes of operation for block ciphers

Authenticated encryption

Key wrapping

  • KW and KWP (AES only, NIST SP 800-38F)

Stream ciphers

Cryptographic hashes

Extendable-output functions (XOF)

Message Authentication Codes (MAC)

Asymmetric keys (generation, import and export)

  • RSA

  • ECC: NIST P-curves (P-192, P-224, P-256, P-384, P-521), secp256k1, Ed25519 and Ed448, Curve25519 (X25519) and Curve448 (X448)

  • ML-DSA (FIPS 204): ML-DSA-44, ML-DSA-65 and ML-DSA-87

  • ML-KEM (FIPS 203): ML-KEM-512, ML-KEM-768 and ML-KEM-1024, for use with HPKE only (no direct encapsulation or decapsulation)

  • Hybrid KEM: MLKEM768-X25519 (X-Wing), for use with HPKE only

  • DSA

  • ElGamal legacy

Formats for asymmetric keys

  • PEM (also with the legacy encryption of RFC 1423) and ASN.1 DER

  • PKCS#8, in clear or encrypted (with PBKDF2 or scrypt, and AES in CBC or GCM mode), also for ML-DSA and ML-KEM keys

  • PKCS#1 (RSA) and SEC1 (ECC)

  • X.509 SubjectPublicKeyInfo, and public keys in X.509 certificates (import only)

  • OpenSSH: public keys (import and export), and private keys of RSA and ECC, also encrypted (import only)

  • Raw encoding of Ed25519, Ed448, X25519 and X448 keys

Asymmetric encryption

  • HPKE (RFC 9180), in all four modes (base, PSK, auth, auth-PSK), with AES-GCM or ChaCha20-Poly1305, also post-quantum with ML-KEM or the hybrid KEM X-Wing (draft-ietf-hpke-pq)

  • RSAES-OAEP (PKCS#1)

  • RSAES-PKCS1-v1_5 (PKCS#1) legacy

Key encapsulation (only as part of HPKE)

Digital signatures

  • RSASSA-PSS and RSASSA-PKCS1-v1_5 (PKCS#1)

  • DSA and ECDSA, with random nonces (FIPS 186-3, or SEC 1 for ECDSA) or deterministic nonces (RFC 6979) and, for ECDSA, optionally in the low-S form

  • EdDSA with Ed25519 and Ed448 (RFC 8032), including the pre-hashed variants

  • ML-DSA and HashML-DSA (FIPS 204), hedged or deterministic, also with external mu

Key agreement

Key derivation

Secret sharing

Padding for block ciphers

  • PKCS#7

  • ISO 7816-4

  • X.923

Implementation

  • All the code runs in the package itself (C extensions and Python), with no system libraries. Randomness comes from the operating system.

  • The big integer arithmetic of RSA, DSA, ElGamal and ECC runs in constant time, in C. RSA private key operations are blinded, and the scalar multiplications on elliptic curves have further countermeasures (scalar blinding, randomized coordinates). If the C module for big integers cannot be loaded, the library falls back to pure Python, which is not constant time.

  • AES uses the hardware instructions of the CPU when present (see below). Without them, it uses lookup tables in software, which are not constant time and can be exposed to cache-timing attacks from code running on the same machine.

  • Long messages can be processed on several CPU cores (parameter threads): CTR, GCM, GCM-SIV and OCB modes, ChaCha20 and XChaCha20, KangarooTwelve, and scrypt.

These CPU extensions are used when present:

CPU extension

Speeds up

AES-NI and CLMUL

AES, GCM, GCM-SIV

ARMv8 Cryptography Extensions (64-bit ARM)

AES, GCM, GCM-SIV, SHA-2

NEON (64-bit ARM)

KangarooTwelve, ML-KEM, ML-DSA

SHA extensions

SHA-224, SHA-256

AVX2

SHA-3 and the other Keccak-based functions, ChaCha20, Salsa20, ML-KEM, ML-DSA

SSE2 (x86, selected at compile time)

ChaCha20, Salsa20, scrypt, big integers (32-bit only)

BMI2 and ADX

Big integers, NIST curves