{"slug": "pyca-cryptography", "name": "pyca/cryptography", "category": "dev-libs", "category_name": "Libraries and frameworks", "description": "", "recommenders": 3, "commenters": 4, "warners": 0, "score": 2.795, "rising": -0.98, "first": "2026-01-14", "latest": "2026-10-20", "why": "pyca/cryptography is a really excellent cryptography library", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 2, "neutral": 2, "compare": 0, "warn": 0}, "spark": [0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "pyca/cryptography is a really excellent cryptography library", "kind": "", "icon": true, "domain": "cryptography.io", "github_repo": null, "official_url": "https://cryptography.io", "pricing": "", "aliases": ["pyca/cryptography", "PyCA cryptography"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 746023569, "item_id": 46626473, "url": "https://news.ycombinator.com/item?id=46626473", "by": "woodruffw", "date": "2026-01-14", "version": null, "stance": "recommend", "quote": "I think one of the things that's interesting in the PyCA case is that it commits to doing a lot of cross-checking/policy work", "excerpt": "> It is extremely common that a correct implementation also has excellent performance. I think that's true in general, but in the case of X.509 path validation it's not a given: the path construction algorithm is non-trivial, and requires quadratic searches (e.g. of name constraints against subjects/SANs). An incorrect implementation could be faster by just not doing those things, which is often fine (for example, no", "context": "", "use_case": "", "switched_from": "", "story": "The State of OpenSSL for pyca/cryptography"}, {"id": 746014704, "item_id": 46625919, "url": "https://news.ycombinator.com/item?id=46625919", "by": "Retr0id", "date": "2026-01-14", "version": null, "stance": "recommend", "quote": "pyca/cryptography is a really excellent cryptography library", "excerpt": "By the way, pyca/cryptography is a really excellent cryptography library, and I have confidence that they're making the right decisions here. The python-level APIs are well thought-out and well documented. I've made a few minor contributions myself and it was a pleasant experience. And my personal \"new OpenSSL APIs suck\" anecdote: https://github.com/openssl/openssl/issues/19612 (not my gh issue but I ran into the exa", "context": "", "use_case": "Python crypto library", "switched_from": "", "story": "The State of OpenSSL for pyca/cryptography"}, {"id": 746003264, "item_id": 46625204, "url": "https://news.ycombinator.com/item?id=46625204", "by": "ak217", "date": "2026-01-14", "version": null, "stance": "recommend", "quote": "I trust the API design and test methodology of Cryptography and use it as a model to emulate", "excerpt": "I have a hacky piece of code that I used with 2.0 to inspect the state of digest objects. This was removed from the public API in 3.0 but in the process of finding that out I took a deep dive in the digests API and I can confirm it's incomprehensible. I imagined there must be some deep reason for the indirection but it's good to know the Cryptography maintainers don't think so. Speaking of which, as a library develop", "context": "library developer relying on Cryptography APIs", "use_case": "", "switched_from": "", "story": "The State of OpenSSL for pyca/cryptography"}]}], "caveats": [], "who": [{"by": "ak217", "context": "library developer relying on Cryptography APIs", "url": "https://news.ycombinator.com/item?id=46625204", "date": "2026-01-14"}], "tags": [], "use_cases": ["python crypto library"], "compared": [{"slug": "openssl", "name": "OpenSSL", "co": 4, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=46624352", "title": "The State of OpenSSL for pyca/cryptography", "mentions": 4}, {"url": "https://news.ycombinator.com/item?id=50166579", "title": "eMudhra intermediate CA compromise", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {"neutral": 1, "recommend": 2}, "2026-02": {}, "2026-03": {}, "2026-04": {}, "2026-05": {}, "2026-06": {}, "2026-07": {}, "2026-08": {}, "2026-09": {}, "2026-10": {"neutral": 1}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 802712995, "item_id": 50169562, "url": "https://news.ycombinator.com/item?id=50169562", "by": "arcfour", "date": "2026-10-20", "version": null, "stance": "neutral", "quote": "Python (pyca/cryptography) has full support", "excerpt": "Rare in public PKIs, yes; not so much in private ones, I would imagine. From my limited experience (using them at home) they seem to be fairly well supported in client libraries, actually! - OpenSSL has full support, https://docs.openssl.org/master/man5/x509v3_config/ - GnuTLS has full support, https://www.gnutls.org/manual/html_node/X509-certificate-API.html - go (crypto/x509) supports everything except DirectoryNam", "context": "", "use_case": "", "switched_from": "", "story": "eMudhra intermediate CA compromise"}, {"id": 746023569, "item_id": 46626473, "url": "https://news.ycombinator.com/item?id=46626473", "by": "woodruffw", "date": "2026-01-14", "version": null, "stance": "recommend", "quote": "I think one of the things that's interesting in the PyCA case is that it commits to doing a lot of cross-checking/policy work", "excerpt": "> It is extremely common that a correct implementation also has excellent performance. I think that's true in general, but in the case of X.509 path validation it's not a given: the path construction algorithm is non-trivial, and requires quadratic searches (e.g. of name constraints against subjects/SANs). An incorrect implementation could be faster by just not doing those things, which is often fine (for example, no", "context": "", "use_case": "", "switched_from": "", "story": "The State of OpenSSL for pyca/cryptography"}, {"id": 746014704, "item_id": 46625919, "url": "https://news.ycombinator.com/item?id=46625919", "by": "Retr0id", "date": "2026-01-14", "version": null, "stance": "recommend", "quote": "pyca/cryptography is a really excellent cryptography library", "excerpt": "By the way, pyca/cryptography is a really excellent cryptography library, and I have confidence that they're making the right decisions here. The python-level APIs are well thought-out and well documented. I've made a few minor contributions myself and it was a pleasant experience. And my personal \"new OpenSSL APIs suck\" anecdote: https://github.com/openssl/openssl/issues/19612 (not my gh issue but I ran into the exa", "context": "", "use_case": "Python crypto library", "switched_from": "", "story": "The State of OpenSSL for pyca/cryptography"}, {"id": 746003264, "item_id": 46625204, "url": "https://news.ycombinator.com/item?id=46625204", "by": "ak217", "date": "2026-01-14", "version": null, "stance": "recommend", "quote": "I trust the API design and test methodology of Cryptography and use it as a model to emulate", "excerpt": "I have a hacky piece of code that I used with 2.0 to inspect the state of digest objects. This was removed from the public API in 3.0 but in the process of finding that out I took a deep dive in the digests API and I can confirm it's incomprehensible. I imagined there must be some deep reason for the indirection but it's good to know the Cryptography maintainers don't think so. Speaking of which, as a library develop", "context": "library developer relying on Cryptography APIs", "use_case": "", "switched_from": "", "story": "The State of OpenSSL for pyca/cryptography"}, {"id": 746000817, "item_id": 46625051, "url": "https://news.ycombinator.com/item?id=46625051", "by": "woodruffw", "date": "2026-01-14", "version": null, "stance": "neutral", "quote": "the X.509 path validation library that PyCA cryptography now uses", "excerpt": "I think this part is really worth engaging with: > Later, moving public key parsing to our own Rust code made end-to-end X.509 path validation 60% faster \u2014 just improving key loading led to a 60% end-to-end improvement, that\u2019s how extreme the overhead of key parsing in OpenSSL was. > The fact that we are able to achieve better performance doing our own parsing makes clear that doing better is practical. And indeed, o", "context": "", "use_case": "", "switched_from": "", "story": "The State of OpenSSL for pyca/cryptography"}]}