cryptography
Python cryptography library providing both high-level recipes (Fernet symmetric encryption, X.509 certificates) and low-level primitives (AES, RSA, ECDSA, HMAC, hashing). cryptography features: Fernet for symmetric encryption (AES-128-CBC + HMAC-SHA256), MultiFernet for key rotation, RSA/EC key generation and signing, X.509 certificate creation and parsing, PKCS12 for certificate bundles, Hazmat primitives for low-level crypto (AES-GCM, ChaCha20-Poly1305, HKDF, PBKDF2, scrypt, Argon2id), serialization (PEM/DER/PKCS8), and OpenSSL bindings via cffi.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
Cryptography library — security is the purpose. Use Hazmat primitives only with full understanding. Keep private keys encrypted at rest. Rotate keys regularly using MultiFernet. Nonce/IV uniqueness critical for AES-GCM. PBKDF2 iterations: minimum 600000 (OWASP 2023). Use scrypt or Argon2id for password KDF.
⚡ Reliability
Best When
Production-grade cryptography needing correct, maintained primitives — the cryptography package is maintained by PyCA and is the most trusted Python crypto library.
Avoid When
Password hashing for user accounts (use bcrypt/passlib), JWT (use PyJWT), or when Fernet's 1MB message limit or token expiry is a concern.
Use Cases
- • Agent symmetric encryption — from cryptography.fernet import Fernet; key = Fernet.generate_key(); f = Fernet(key); token = f.encrypt(b'sensitive data'); plain = f.decrypt(token) — Fernet; agent encrypts data for secure storage; Fernet tokens are self-contained (includes timestamp); decrypt() raises InvalidToken if tampered
- • Agent key rotation — from cryptography.fernet import MultiFernet; keys = [Fernet(k) for k in [key1, key2]]; mf = MultiFernet(keys); token = mf.encrypt(b'data'); mf.rotate(old_token) — rotation; agent rotates encryption keys while still decrypting old tokens; MultiFernet tries keys in order
- • Agent password hashing — from cryptography.hazmat.primitives.kdf.scrypt import Scrypt; kdf = Scrypt(salt=os.urandom(16), length=32, n=2**14, r=8, p=1); key = kdf.derive(password.encode()); kdf.verify(password.encode(), key) — KDF; agent derives key from password using Scrypt; verify() raises InvalidKey on mismatch
- • Agent RSA signing — from cryptography.hazmat.primitives.asymmetric import rsa, padding; private_key = rsa.generate_private_key(65537, 2048); signature = private_key.sign(message, padding.PSS(mgf=padding.MGF1(hashes.SHA256()), salt_length=padding.PSS.MAX_LENGTH), hashes.SHA256()) — signing; agent creates digital signatures
- • Agent X.509 certificate parsing — from cryptography import x509; cert = x509.load_pem_x509_certificate(cert_bytes); subject = cert.subject; not_after = cert.not_valid_after_utc; san = cert.extensions.get_extension_for_class(x509.SubjectAlternativeName) — cert parsing; agent inspects TLS certificates for automation
Not For
- • Password hashing for user auth — use bcrypt or passlib which provide simpler password-specific APIs with salting
- • JWT tokens — use python-jose or PyJWT for JWT; cryptography provides low-level primitives
- • Simple secrets — for simple secret storage use secrets module or keyring
Interface
Authentication
No auth — cryptography library. Implements auth primitives (HMAC, digital signatures).
Pricing
cryptography is Apache 2.0 and BSD licensed. Free for all use.
Agent Metadata
Known Gotchas
- ⚠ Fernet key must be kept secret and backed up — Fernet.generate_key() creates random 32-byte key encoded as urlsafe base64; losing key = losing all encrypted data permanently; agent code: store key in secrets manager (AWS Secrets Manager, HashiCorp Vault), NOT in code or config files; use MultiFernet for key rotation without losing access to old data
- ⚠ Fernet tokens have timestamp for TTL — f.decrypt(token, ttl=3600) raises InvalidToken if token older than 3600 seconds; default: no TTL (decrypt always works); agent code: use ttl= for time-sensitive tokens (session tokens, CSRF); for permanent encryption omit ttl=; f.extract_timestamp(token) to get encryption time
- ⚠ Hazmat primitives require domain knowledge — cryptography.hazmat (hazardous materials) requires correct usage; AES-GCM needs unique nonce per message; PBKDF2 needs appropriate iterations; agent code: prefer Fernet for symmetric encryption; use hazmat only when specific primitives needed; follow OWASP guidelines for parameters
- ⚠ PEM vs DER vs PKCS8 serialization — keys/certs have multiple serialization formats; load_pem_private_key() for PEM (-----BEGIN...-----); load_der_private_key() for binary DER; serialize: private_key.private_bytes(Encoding.PEM, PrivateFormat.PKCS8, NoEncryption()); agent code: PEM for human-readable storage; DER for binary efficiency
- ⚠ RSA vs EC key choice — RSA 2048+ for broad compatibility; EC P-256 for performance and smaller keys; RSA operations: sign=0.5ms, verify<0.1ms; EC P-256: sign<0.1ms, verify<0.1ms; agent code: prefer EC P-256/P-384 for new systems; RSA for legacy compatibility; Ed25519 for fastest modern signing
- ⚠ Random bytes for cryptography — os.urandom(32) for cryptographic random bytes (use for keys, IVs, salts); secrets.token_bytes(32) equivalent; random.randbytes() is NOT cryptographically secure; agent code: always use os.urandom() or secrets module for crypto material; never use random module for security-sensitive randomness
Alternatives
Full Evaluation Report
Comprehensive deep-dive: security analysis, reliability audit, agent experience review, cost modeling, competitive positioning, and improvement roadmap for cryptography.
AI-powered analysis · PDF + markdown · Delivered within 30 minutes
Package Brief
Quick verdict, integration guide, cost projections, gotchas with workarounds, and alternatives comparison.
Delivered within 10 minutes
Score Monitoring
Get alerted when this package's AF, security, or reliability scores change significantly. Stay ahead of regressions.
Continuous monitoring
Scores are editorial opinions as of 2026-03-06.