25

Today I saw PySNMP installing pycryptodomex. The x in that name looked suspicious and surprising.

I tried to track it down, but it looks like both pycryptodome and pycryptodomex are owned by the same account and point back to the same Github repository.

Especially because a cryptography library is a core security feature, I'm suspicious of the duplication.

What's the purpose of this duplication? Could I have discovered this information from open sources?

Jason R. Coombs
  • 41,115
  • 10
  • 83
  • 93
  • The only reason I could see is to provide back compatibility when renaming a project, so as to not break everyone who used it at the old name. – the_storyteller Jan 08 '18 at 17:41
  • 2
    The pycryptodome page says "Check the pycryptodomex project for the equivalent library that works under the Cryptodome package" and the pycryptodomex page says "Check the pycryptodome project for the equivalent library that works under the Crypto package" –  Jan 08 '18 at 17:42

1 Answers1

36

It's the same code, just different names.

  • pycryptodome has some association to pyCrypto and can be considered a drop in replacement when migrating from PyCrypto to PyCryptodome.

  • pycryptodomex is a standalone version of PyCryptodome with a different naming convention; instead of the package Crypto, you have to use Cryptodome. In the case that PyCrypto is required for legacy purposes, pycryptodome should be used.

Per the repository:

The installation procedure depends on the package you want the library in. PyCryptodome can be used as:

  1. an almost drop-in replacement for the old PyCrypto library. You install it with:

     pip install pycryptodome

    In this case, all modules are installed under the Crypto package.

    One must avoid having both PyCrypto and PyCryptodome installed at the same time, as they will interfere with each other.

    This option is therefore recommended only when you are sure that the whole application is deployed in a virtualenv.

  2. a library independent of the old PyCrypto. You install it with:

     pip install pycryptodomex

    In this case, all modules are installed under the Cryptodome package. PyCrypto and PyCryptodomex can coexist.

XRBtoTheMOON
  • 141
  • 7
Emmanuel Ferran
  • 666
  • 6
  • 9