15,000 lines of verified cryptography now in Python

Re:15,000 lines of verified cryptography now in Python by kccqzy on Friday April 18, 2025 @05:33PM (#43732053)

Who uses its built-in cryptographic modules though? I wrote a fair bit of cryptographic code in Python more than five years ago and most people recommended the cryptography package https://pypi.org/project/cryptography/ over whatever that's built-in.

[ Parent | on HN ]

Re:15,000 lines of verified cryptography now in Python by Retr0id on Friday April 18, 2025 @05:41PM (#43732105)

I'm a big fan of pyca/cryptography and I use it for any serious project, but if I just need hashing I tend to use the standard library hashlib - it saves a somewhat heavy dependency, and the API is less verbose.

Also, pyca/cryptography uses OpenSSL. OpenSSL is fine, but has the same "problem" as the previous python stdlib implementation. (Personally I think it's an acceptable risk. If anything, swapping in 15,000 lines of new code is the greater risk, even if it's "verified")

[ Parent | on HN ]

Re:15,000 lines of verified cryptography now in Python by frumplestlatz on Friday April 18, 2025 @09:12PM (#43733360)

I'm curious why you put "verified" in scare-quotes, and why you think adopting formally verified code is a greater risk.

[ Parent | on HN ]

Re:15,000 lines of verified cryptography now in Python by Retr0id on Friday April 18, 2025 @09:18PM (#43733385)

I don't think formal verification is bad, I just don't think it's a silver bullet. i.e. we should not get complacent and assume that formally verified code is 100% safe.

[ Parent | on HN ]