Recommended Python cryptographic module?

Question

I've been exploring what cryptographic modules are available to Python, and I've found 3: ezPyCrypt, yawPyCrypt and KeyCzar (which actually supports a few languages, but Python is included amongst them). The first two rely on the PyCrypto module.

Are there choices I am missing? Is there a clear front-runner for ease and features or does it simply come down to a manner of one's comfort level?

I'm currently leaning towards KeyCzar, with ezPyCrypt close behind.

I would be using the library for digital signature signing and verification, and potentially for key creation (although I won't cry if I have to make a call to something else for that functionality).

I am using Python 3.x and have access to GPG.

Answer 1

If you are in an environment which includes GnuPG and Python >= 2.4, then you could also consider a tool such as python-gnupg. (Disclaimer: I'm the maintainer of this project.) It leaves the heavy lifting to gpg and provides a fairly straightforward API.

Overview of API:

>>> import gnupg
>>> gpg = gnupg.GPG(gnupghome='/path/to/keyring/directory')
>>> gpg.list_keys()

[{
  ...
  'fingerprint': 'F819EE7705497D73E3CCEE65197D5DAC68F1AAB2',
  'keyid': '197D5DAC68F1AAB2',
  'length': '1024',
  'type': 'pub',
  'uids': ['', 'Gary Gross (A test user) ']},
 {
  ...
  'fingerprint': '37F24DD4B918CC264D4F31D60C5FEFA7A921FC4A',
  'keyid': '0C5FEFA7A921FC4A',
  'length': '1024',
  ...
  'uids': ['', 'Danny Davis (A test user) ']}]
>>> encrypted = gpg.encrypt("Hello, world!", ['0C5FEFA7A921FC4A'])
>>> str(encrypted)

'-----BEGIN PGP MESSAGE-----\nVersion: GnuPG v1.4.9 (GNU/Linux)\n
\nhQIOA/6NHMDTXUwcEAf
...
-----END PGP MESSAGE-----\n'
>>> decrypted = gpg.decrypt(str(encrypted), passphrase='secret')
>>> str(decrypted)
'Hello, world!'
>>> signed = gpg.sign("Goodbye, world!", passphrase='secret')
>>> verified = verified = gpg.verify(str(signed))
>>> print "Verified" if verified else "Not verified"

'Verified' 

Answer 2

How about http://www.amk.ca/python/code/crypto.html??

Answer 3

pycrypt is actually a simple AES encrypt/decrypt module built on top of pycrypto like other modules you mention -- note that the latter is transitioning to the pycrypto.org URL as it's changing maintainers, and stable versions and docs are still at the original author's site. In addition to the easier-to-use wrappers you mention, one plus of pycrypto is that a pure-python subset of it is supplied with Google's App Engine, so getting familiar with it would be useful if you ever want to deploy any code there.

The major alternative (another powerful and complex project, like pycrypto) is pyopenssl, which is a fairly regular wrapping (a "thin wrapper", as the author describes it) of OpenSSL (that may be a plus if you're used to coding in C with calls to OpenSSL). An alternative packaging that's complete (comes with the needed libraries) and possibly legally safer (excludes parts on which there are patent disputes or doubts) is distributed by egenix.

Both main projects (pycrypto and pyopenssl) went through long periods of more or less inactivity as the original authors went on to other things, but both are actively developed and maintained again, which is always a good sign.

I am not aware of easy-to-use wrappers on top of pyopenssl (there most likely are, but they haven't been publicized like those on top of pycrypto) and so, if as it seems you do care about ease of use and aren't looking to write wrappers yourself, the ones on top of pycrypto appear to be a better choice.

Answer 4

I've just done such a survey last week and adopted M2Crypto that seems to be the most advanced wrapper today above openssl (found it in several recommandation lists while googling). I also tried pycrypto but it miss certificates management and standard key file format management that M2Crypto has (with pycrypto you have to pickle/unpicle your keys or write your own key manager for common formats).

I found M2Crypto was quite easy to use and was quicly able to develop what I needed (a signed and encrypted package format).

However I recommand to download full package, not just easy installing it, because in the package you also get nice exemples (look at demo directory).

Here is the link http://pypi.python.org/pypi/M2Crypto/0.20.1

A drawback could be that you are using python 3.0, I'm stuck with 2.5 at job (hopefully 2.6 soon) and don't know if M2Crypto works with python 3.0

I've not much practice with it yet, put if you have specific problems with it just ask here. Someone may answer.