CVS commit: pkgsrc/security/py-cryptodome

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Sun Nov  8 17:41:36 UTC 2026

Modified Files:
        pkgsrc/security/py-cryptodome: Makefile PLIST distinfo

Log Message:
py-cryptodome: update to 4.4.0.

4.4.0 (7 November 2026)

New features

    Added the elliptic curve secp256k1 to Crypto.PublicKey.ECC: key generation, import and export, ECDSA with Crypto.Signature.DSS, and ECDH with Crypto.Protocol.DH.

    Added the mode 'sec1' to Crypto.Signature.DSS.new, for randomized ECDSA on all Weierstrass curves. Mode 'fips-186-3' does not accept secp256k1, which is not a curve of that standard.

    GH#759: Added the parameter low_s to Crypto.Signature.DSS.new, for ECDSA signatures in the low-S form (for all curves): signing normalizes s, and verifying rejects a high s.

    ECDSA signatures in DER encoding are about 5-8x faster.

Resolved issues

    ECC.import_key raised TypeError instead of ValueError for an OpenSSH public key with an unsupported curve or key type, or with a malformed body.

    ECC.import_key accepted an OpenSSH key (public or private) whose curve did not match its key type.

    GH#960: In HPKE, a message rejected by unseal() consumed a sequence number, so all later messages of that context failed too. The sequence number now only advances when unseal() succeeds (RFC 
9180, Section 5.2). Thanks to Zulfareen Shaikh.

    In HPKE, a seal() that raised an exception also consumed a sequence number, so the receiver could not unseal the messages that followed.

4.3.0 (2 November 2026)
New features

    CTR mode is 2.5-3.5x faster on large data (and GCM about 2x), on all platforms.

    On 64-bit ARM CPUs (Linux, macOS and Windows), AES and GHASH use the instructions of the ARMv8 Cryptography Extensions (AES and PMULL), when available. On a Graviton3, AES-ECB is about 35x 
faster, GCM 7x, OCB 10-12x, and CTR, CBC, CFB and OFB 3-6x.

    Integer.random_range() is about 2x faster when the bounds are public, with the same output: ECDSA signatures are about 13% faster (P-256), DSA signatures about 4%, and ECC key generation about 
35%. The RSA modulus and the DSA subgroup order are now public Integer objects.

    Faster RSA: on x86-64, signatures and decryption are 35-40% faster (RSA-2048 to RSA-4096), verification and encryption 2-2.7x. Modular exponentiation with a public exponent (like the RSA public 
exponent) no longer uses the slower constant-time algorithm, which is only needed for secret exponents, and the Montgomery context of a modulus is kept with it. The RSA blinding factor is squared 
between uses (a new one every 32 uses, and after a fork).

    The Montgomery multiplication for x86-64 CPUs with BMI2 and ADX is about 20% faster: DSA signatures and verification are about 25% faster.

    ECDSA signatures are 3-6% faster for P-256 and P-384: the field inversion uses the faster power for public exponents (the exponent p - 2 is public).

    On 64-bit ARM CPUs, SHA-224 and SHA-256 use the SHA-256 instructions of the ARMv8 Cryptography Extensions, and SHA-384 and SHA-512 the SHA-512 instructions of ARMv8.2, when available. On a 
Graviton3, SHA-256 is about 3.8x faster, and SHA-512 2x.

    On 64-bit ARM CPUs, KangarooTwelve, ML-KEM and ML-DSA compute 4 Keccak states at once (2 with scalar code and 2 with NEON). On a Graviton3, KangarooTwelve is 1.9x faster, ML-DSA 7-20% and ML-KEM 
7-8%.

    PKCS#1 v1.5 decryption (Crypto.Cipher.PKCS1_v1_5) performs implicit rejection, as defined in section 7.2 of draft-irtf-cfrg-rsa-guidance, when decrypt() is called without a sentinel (which is now 
optional): when the padding of a ciphertext is not correct, it returns a pseudo-random message, which only depends on the private key and on the ciphertext. With a sentinel, decrypt() behaves as 
before.

Other changes

    Updated the Wycheproof test vectors (new Ed25519 tests and the new chacha20_counter_test.json). XChaCha20 keeps the construction of draft-irtf-cfrg-xchacha (HChaCha20 and the ChaCha20 of RFC 
8439), with a 32-bit block counter: the key stream ends after 256 GiB, whereas libsodium and Wycheproof use a 64-bit counter.

Resolved issues

    GH#481: PKCS#1 v1.5 decryption could be used as a Bleichenbacher oracle, through the sentinel returned for ciphertexts with incorrect padding. Calling decrypt() without sentinel (implicit 
rejection) is now recommended. Thanks to tomato42 and eslerm.

    PKCS#1 v1.5 decrypt() never returned a sentinel that is not a byte string (such as None), and it returned an empty byte string instead.

    GH#954: Crypto.Util.asn1.DerObjectId accepted an ASN.1 OBJECT IDENTIFIER where an arc is encoded with the initial octet 0x80 (invalid, as that would violate the minimal encoding rule for BER) or 
where the last octet encoding the last arc has bit 7 set (invalid, and that arc would also be dropped). In those cases, decoding now fails. Thanks to Zulfareen Shaikh.


To generate a diff of this commit:
cvs rdiff -u -r1.64 -r1.65 pkgsrc/security/py-cryptodome/Makefile
cvs rdiff -u -r1.37 -r1.38 pkgsrc/security/py-cryptodome/PLIST
cvs rdiff -u -r1.51 -r1.52 pkgsrc/security/py-cryptodome/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/py-cryptodome/Makefile
diff -u pkgsrc/security/py-cryptodome/Makefile:1.64 pkgsrc/security/py-cryptodome/Makefile:1.65
--- pkgsrc/security/py-cryptodome/Makefile:1.64 Tue Oct 27 11:57:59 2026
+++ pkgsrc/security/py-cryptodome/Makefile      Sun Nov  8 17:41:36 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.64 2026/10/27 11:57:59 wiz Exp $
+# $NetBSD: Makefile,v 1.65 2026/11/08 17:41:36 wiz Exp $
 
-DISTNAME=      pycryptodome-4.2.0
+DISTNAME=      pycryptodome-4.4.0
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME:S/^py//}
 CATEGORIES=    security python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=p/pycryptodome/}
@@ -16,7 +16,7 @@ TOOL_DEPENDS+=        ${PYPKGPREFIX}-setuptools
 FORCE_C_STD=   c99
 
 # XXX is this needed?
-#CFLAGS.SunOS+=        -D_XOPEN_SOURCE=600
+CFLAGS.SunOS+= -D_XOPEN_SOURCE=600
 
 CHECK_PORTABILITY_SKIP=        appveyor/get_wheels.sh
 

Index: pkgsrc/security/py-cryptodome/PLIST
diff -u pkgsrc/security/py-cryptodome/PLIST:1.37 pkgsrc/security/py-cryptodome/PLIST:1.38
--- pkgsrc/security/py-cryptodome/PLIST:1.37    Fri Oct 30 18:49:36 2026
+++ pkgsrc/security/py-cryptodome/PLIST Sun Nov  8 17:41:36 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.37 2026/10/30 18:49:36 adam Exp $
+@comment $NetBSD: PLIST,v 1.38 2026/11/08 17:41:36 wiz Exp $
 ${PYSITELIB}/${WHEEL_INFODIR}/METADATA
 ${PYSITELIB}/${WHEEL_INFODIR}/RECORD
 ${PYSITELIB}/${WHEEL_INFODIR}/WHEEL
@@ -555,6 +555,9 @@ ${PYSITELIB}/Crypto/SelfTest/PublicKey/t
 ${PYSITELIB}/Crypto/SelfTest/PublicKey/test_ECC_NIST.py
 ${PYSITELIB}/Crypto/SelfTest/PublicKey/test_ECC_NIST.pyc
 ${PYSITELIB}/Crypto/SelfTest/PublicKey/test_ECC_NIST.pyo
+${PYSITELIB}/Crypto/SelfTest/PublicKey/test_ECC_secp256k1.py
+${PYSITELIB}/Crypto/SelfTest/PublicKey/test_ECC_secp256k1.pyc
+${PYSITELIB}/Crypto/SelfTest/PublicKey/test_ECC_secp256k1.pyo
 ${PYSITELIB}/Crypto/SelfTest/PublicKey/test_ElGamal.py
 ${PYSITELIB}/Crypto/SelfTest/PublicKey/test_ElGamal.pyc
 ${PYSITELIB}/Crypto/SelfTest/PublicKey/test_ElGamal.pyo

Index: pkgsrc/security/py-cryptodome/distinfo
diff -u pkgsrc/security/py-cryptodome/distinfo:1.51 pkgsrc/security/py-cryptodome/distinfo:1.52
--- pkgsrc/security/py-cryptodome/distinfo:1.51 Tue Oct 27 11:57:59 2026
+++ pkgsrc/security/py-cryptodome/distinfo      Sun Nov  8 17:41:36 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.51 2026/10/27 11:57:59 wiz Exp $
+$NetBSD: distinfo,v 1.52 2026/11/08 17:41:36 wiz Exp $
 
-BLAKE2s (pycryptodome-4.2.0.tar.gz) = 8fdec62f79414eb1c3a875b2aa6343ccd93d54834006f418c15e610c0125b982
-SHA512 (pycryptodome-4.2.0.tar.gz) = 194bc1e76b8eebdb457d0bb7cd5b21c121bda387556fec880976ca9aad81c3b8508facc6e6f5cca2415b9c24d705b96adf59a22e818fc72411555dcf2759e2dc
-Size (pycryptodome-4.2.0.tar.gz) = 1750332 bytes
+BLAKE2s (pycryptodome-4.4.0.tar.gz) = d3525a70640c12979df478eaf3923ebcf3a2a65615f3a40387b727ee2db6407b
+SHA512 (pycryptodome-4.4.0.tar.gz) = fa942d3d14f54f16481046fd71097b88cc87298f193da53c585faf0c60bcaf519d9d3768bf0fc3c0d36531e11c703ab8a4f3cb354f33fd735f0e5f0e675a0aaa
+Size (pycryptodome-4.4.0.tar.gz) = 1825611 bytes