SECURITY Signal 409
Shipping post-quantum cryptography to Python
↗
The pyca/cryptography library now offers pip-installable post-quantum primitives ML-KEM and ML-DSA, giving the Python ecosystem direct access to NIST-standard key encapsulation and signature algorithms.
Because virtually every Python cryptographic workflow goes through pyca/cryptography, projects such as Ansible, Certbot, Apache Airflow and paramiko can now start using quantum-resistant algorithms. The new primitives preserve the same security level but increase public key, private key and ciphertext sizes by one to two orders of magnitude and are somewhat slower, so existing protocols that assume fixed lengths must be updated. Adopting them therefore requires more than a simple algorithm swap; developers must adjust length fields, chunking logic and related code, although the runtime impact remains negligible on modern hardware.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Post-quantum support is available as a straightforward pip install in the latest cryptography release.
ML-KEM and ML-DSA provide NIST-standard key encapsulation and signatures with an API that mirrors the existing asymmetric primitives.
Using these primitives changes data sizes dramatically and requires updates to any wire format or protocol that hardcodes classical key or signature lengths.
THE CLUSTER