Use cryptography.io instead of pycrypto

steemit / steem-python

The official Python (3) library for the Steem Blockchain.

https://steem.io

MIT License

153 stars 99 forks source link

Use cryptography.io instead of pycrypto #250

Open john-g-g opened 6 years ago

john-g-g commented 6 years ago

we use pycrypto for aes encryption, but we should use cryptography instead for following reasons:

pycrypto is dead project with last commit in 2014
multiple outstanding exploits (CVE-2013-7459)[https://www.cvedetails.com/cve/CVE-2013-7459/],(CVE-2018-6594)[https://www.cvedetails.com/cve/CVE-2018-6594/)

holgern commented 6 years ago

You can check here: https://github.com/holgern/beem/blob/master/beem/aes.py how to implement this.

Mattwmaster58 commented 6 years ago

@holgern @john-g-g pycryptodome is a maintained drop-in replacement for pycrypto

MarcelBeining commented 5 years ago

please exchange pycrypto for pycryptodome because as @Mattwmaster58 said it is still maintained and they actually interfere with each other when both are installed (which they are in my case) !

tpaixao commented 5 years ago

You can just replace pycrypto by pycryptodome. After installing steem-python, you can simply pip uninstall pycrypto and pip install pycryptodome and it just works (tm). But yes, this should be listed as a requirement.