[dependabot]

Updates the requirements on pycryptodome to permit the latest version.

Release notes

Sourced from pycryptodome's releases.

v4.3.0 - Kourou

New features

• CTR mode is 2.5-3.5x faster on large data (and GCM about 2x), on all platforms.
• On 64-bit ARM CPUs (Linux, macOS and Windows), AES and GHASH use the instructions of the ARMv8 Cryptography Extensions (AES and PMULL), when available. On a Graviton3, AES-ECB is about 35x faster, GCM 7x, OCB 10-12x, and CTR, CBC, CFB and OFB 3-6x.
• Integer.random_range() is about 2x faster when the bounds are public, with the same output: ECDSA signatures are about 13% faster (P-256), DSA signatures about 4%, and ECC key generation about 35%. The RSA modulus and the DSA subgroup order are now public Integer objects.
• Faster RSA: on x86-64, signatures and decryption are 35-40% faster (RSA-2048 to RSA-4096), verification and encryption 2-2.7x. Modular exponentiation with a public exponent (like the RSA public exponent) no longer uses the slower constant-time algorithm, which is only needed for secret exponents, and the Montgomery context of a modulus is kept with it. The RSA blinding factor is squared between uses (a new one every 32 uses, and after a fork).
• The Montgomery multiplication for x86-64 CPUs with BMI2 and ADX is about 20% faster: DSA signatures and verification are about 25% faster.
• ECDSA signatures are 3-6% faster for P-256 and P-384: the field inversion uses the faster power for public exponents (the exponent p - 2 is public).
• On 64-bit ARM CPUs, SHA-224 and SHA-256 use the SHA-256 instructions of the ARMv8 Cryptography Extensions, and SHA-384 and SHA-512 the SHA-512 instructions of ARMv8.2, when available. On a Graviton3, SHA-256 is about 3.8x faster, and SHA-512 2x.
• On 64-bit ARM CPUs, KangarooTwelve, ML-KEM and ML-DSA compute 4 Keccak states at once (2 with scalar code and 2 with NEON). On a Graviton3, KangarooTwelve is 1.9x faster, ML-DSA 7-20% and ML-KEM 7-8%.
• PKCS#1 v1.5 decryption (Crypto.Cipher.PKCS1_v1_5) performs implicit rejection, as defined in section 7.2 of draft-irtf-cfrg-rsa-guidance, when decrypt() is called without a sentinel (which is now optional): when the padding of a ciphertext is not correct, it returns a pseudo-random message, which only depends on the private key and on the ciphertext. With a sentinel, decrypt() behaves as before.

Other changes

• Updated the Wycheproof test vectors (new Ed25519 tests and the new chacha20_counter_test.json). XChaCha20 keeps the construction of draft-irtf-cfrg-xchacha (HChaCha20 and the ChaCha20 of RFC 8439), with a 32-bit block counter: the key stream ends after 256 GiB, whereas libsodium and Wycheproof use a 64-bit counter.

Resolved issues

• GH#481: PKCS#1 v1.5 decryption could be used as a Bleichenbacher oracle, through the sentinel returned for ciphertexts with incorrect padding. Calling decrypt() without sentinel (implicit rejection) is now

... (truncated)

Changelog

Sourced from pycryptodome's changelog.

4.3.0 (2 November 2026) ++++++++++++++++++++++++++

New features

• CTR mode is 2.5-3.5x faster on large data (and GCM about 2x), on all platforms.
• On 64-bit ARM CPUs (Linux, macOS and Windows), AES and GHASH use the instructions of the ARMv8 Cryptography Extensions (AES and PMULL), when available. On a Graviton3, AES-ECB is about 35x faster, GCM 7x, OCB 10-12x, and CTR, CBC, CFB and OFB 3-6x.
• Integer.random_range() is about 2x faster when the bounds are public, with the same output: ECDSA signatures are about 13% faster (P-256), DSA signatures about 4%, and ECC key generation about 35%. The RSA modulus and the DSA subgroup order are now public Integer objects.
• Faster RSA: on x86-64, signatures and decryption are 35-40% faster (RSA-2048 to RSA-4096), verification and encryption 2-2.7x. Modular exponentiation with a public exponent (like the RSA public exponent) no longer uses the slower constant-time algorithm, which is only needed for secret exponents, and the Montgomery context of a modulus is kept with it. The RSA blinding factor is squared between uses (a new one every 32 uses, and after a fork).
• The Montgomery multiplication for x86-64 CPUs with BMI2 and ADX is about 20% faster: DSA signatures and verification are about 25% faster.
• ECDSA signatures are 3-6% faster for P-256 and P-384: the field inversion uses the faster power for public exponents (the exponent p - 2 is public).
• On 64-bit ARM CPUs, SHA-224 and SHA-256 use the SHA-256 instructions of the ARMv8 Cryptography Extensions, and SHA-384 and SHA-512 the SHA-512 instructions of ARMv8.2, when available. On a Graviton3, SHA-256 is about 3.8x faster, and SHA-512 2x.
• On 64-bit ARM CPUs, KangarooTwelve, ML-KEM and ML-DSA compute 4 Keccak states at once (2 with scalar code and 2 with NEON). On a Graviton3, KangarooTwelve is 1.9x faster, ML-DSA 7-20% and ML-KEM 7-8%.
• PKCS#1 v1.5 decryption (Crypto.Cipher.PKCS1_v1_5) performs implicit rejection, as defined in section 7.2 of draft-irtf-cfrg-rsa-guidance, when decrypt() is called without a sentinel (which is now optional): when the padding of a ciphertext is not correct, it returns a pseudo-random message, which only depends on the private key and on the ciphertext. With a sentinel, decrypt() behaves as before.

Other changes

• Updated the Wycheproof test vectors (new Ed25519 tests and the new chacha20_counter_test.json). XChaCha20 keeps the construction of draft-irtf-cfrg-xchacha (HChaCha20 and the ChaCha20 of RFC 8439), with a 32-bit block counter: the key stream ends after 256 GiB, whereas libsodium and Wycheproof use a 64-bit counter.

Resolved issues

• GH#481: PKCS#1 v1.5 decryption could be used as a Bleichenbacher oracle,

... (truncated)

Commits

• 7c0fd09 Docs: add task-oriented guides
• 26d2257 Docs: document cipher objects of each mode of operation
• eec12bb Fix docs build: use python3, mock AESNI functions
• 565db25 Bump version
• 0515613 Merge branch 'pkcs1_implicit_rejection'
• ddcc44f Bump test vector version
• bc80919 Fix test_pkcs1_ct on ARM64: no comparison of secret positions with error values
• 4047081 Add the test vectors of draft-irtf-cfrg-rsa-guidance for implicit rejection
• 4751dfe Constant-time check of the PKCS#1 v1.5 and OAEP decoding
• f69dd13 Use implicit rejection for PKCS#1 v1.5 decryption
• Additional commits viewable in compare view

[dependabot]

Superseded by #1133.