0
$\begingroup$

Fernet symmetric-key encryption

To encrypt and provide data — e.g. JSON strings in a database — using Python I'm wondering what is a good approach (package) for symmetric-key encryption.

The Python standard modules are only about hashes and secure random numbers: https://docs.python.org/3/library/crypto.html, so I started with https://github.com/pyca/cryptography as https://github.com/pycrypto/pycrypto looks rather stalled. Former refers to Fernet, but strangely I cannot find a Wikipedia entry, neither much background nor 3rd-party investigation on it (see also https://github.com/fernet/spec/ and https://cryptography.io/).

Given the key is exchanged securely

  • Is there an issue with the https://github.com/pyca/cryptography Fernet implementation?
  • Is there further reading (maybe under another name than 'Fernet') that supports, it is fine data-security wise?
$\endgroup$
3
  • $\begingroup$ NaCL and Python API of it. Use 256-bit key. $\endgroup$
    – kelalaka
    Oct 19, 2021 at 8:45
  • $\begingroup$ Thank you! After your hint I also found their reference cryptography.io/en/latest/faq/…. If you'd put your comment as answer, I'd accept it, since doc.libsodium.org looks better documented (...and has more GitHub stars, but I do not see a reason to argue against cryptography.io). $\endgroup$
    – thoku
    Oct 23, 2021 at 7:20
  • $\begingroup$ NaCL core team includes Bernstein. My comment can't be an answer since you were asking about issues with the Fernet. See the features of their page. $\endgroup$
    – kelalaka
    Oct 23, 2021 at 7:27

1 Answer 1

1
$\begingroup$

I’m not sure where the name Fernet encryption comes from, but their spec indicates that they are using AES-128 in CBC mode and then authenticating the cipher text with a SHA256 HMAC. They then base64 encode everything so that the cryptogram is printable ASCII.

I won’t claim to have done a code review, but their starting point is using good cryptographic primitives in a sensible way.

$\endgroup$
1
  • $\begingroup$ This is not exactly the answer I expected security-wise, but together with @kelalaka's comments above, and the usage (dependent packages) comparison of both libs pyca/cryptography vs. libsodium I feel safe enough now. $\endgroup$
    – thoku
    Oct 23, 2021 at 13:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.