Skip to content

Consider migrating to Cryptography  #1998

@scdub

Description

@scdub

Explanation

I help maintain a large Python distribution, which would like to use pypdf for reading encrypted PDFs, but would prefer not to include the additional dependency of PyCryptodome as we already include Cryptography for numerous other dependencies. Cryptography includes the same cryptographic primitives used in pypdf (AES and RC4), but is typically a smaller and more secure installation as it calls well vetted implementations rather than implementing them directly. It also is a dependency of requests via urllib3, and is widely deployed. A quick check of conda-forge packages showed that PyCryptodome / PyCryptodomeEx was used in 25 packages versus 135 for Cryptography, and other packages such the pdfminer.six have made this migration earlier.

If this is something that seems worthwhile, I can work on creating a PR for this effort.

cc @exiledkingcc

Metadata

Metadata

Assignees

Labels

nf-securityNon-functional change: Security

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions