disclude.ioPyPI / pycryptodome / 4.1.0
pycryptodome 4.1.0
- Source
- https://github.com/Legrandin/pycryptodome
- Artifact scanned
pycryptodome-4.1.0.tar.gz- Compared with
pycryptodome-4.0.1.tar.gz(3 signals introduced since)- Files
- 480 scanned, 48 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 1 warn · 85 info
- Scan time
- 46.7 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 55 of 55 warn and critical signals; 54 demoted to info.
- Disclude version
- 4.3.0
- Scanned (UTC)
- 2026-10-23 11:09
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
const word_t a = ; word_t ar, lo, hi; /** Their reflections (by linearity for the third one) **/likely benign Two short variable names in a GHASH implementation that fold to the same visual skeleton.Reasoning
Two identifiers that look alike after confusable folding are a common accidental naming collision in cryptographic code with short variable names like lo, hi and ar. The snippet shows only ordinary GHASH arithmetic and no sign of homoglyph-based code hiding. Some residual doubt remains, since the collision could be deliberate.
-
info
warn→ info by reviewencoding-base64lib/Crypto/SelfTest/IO/test_PKCS8.py:726:9new in this release=likely benign RFC 8410 PKCS#8 key test vector encoded in base64 inside a test.Reasoning
The base64 text is an RFC 8410 test vector for a PKCS#8 key, stored as a multi-line string in a test module. This is standard test data.
-
info
warn→ info by reviewencoding-base64lib/Crypto/SelfTest/PublicKey/test_import_ECC.py:2937:1new in this release=dismissed PKCS#8 PEM private key fixture used in an encoding test.Reasoning
A PKCS#8 PRIVATE KEY (Ed25519/curve-style OID) PEM block in an encoding test. The base64 is a standard key container, so the flag is a false positive.
-
-
= = %likely benign Docs build script evaluates a version tuple read from a version_info line.Reasoning
Module-scope eval on a line split from a version_info assignment is a known pattern for reading a version tuple from a header file in a docs build script. The input is a local source file rather than network or user data, so it looks like a fragile but legitimate parse, not a dropper.
-
likely benign Base64-encoded PGP public key embedded in INSTALL.rst documentation.
Reasoning
The base64 block is a PGP public key block in a reStructuredText install guide. Its line structure and content fit an embedded key, which is ordinary documentation content.
-
= 0x1000000000000000000000000000000014DEF9DEA2F79CD65812631A5CF5D3ED = 0x216936D3CD6E53FEC0A4E231FDD6DC5C692CC7609525A7B2C9562D608F25D51A = 0x6666666666666666666666666666666666666666666666666666666666666658 -
= 0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF = 0x5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B = 0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551 = 0x6B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296 -
# The threaded code is the same for all ciphers: same output as without threads = =likely benign Self-test dynamically imports a Crypto.Cipher module chosen from a test loop variable.Reasoning
This is a self-test that imports cipher modules by name from a fixed list of cipher names. The dynamic import is a test-harness convenience with no external input.
-
"""-----BEGIN RSA PRIVATE KEY----- MIICXAIBAAKBgQDAiAnvIAOvqVwJTaYzsKnefZftgtXGE2hPJppGsWl78yz9jeXY W/FxX/gTPURArNhdnhP6n3p2ZaDIBrO2zizbgIXs0IsljTTcr4vnI8fMXzyNUOjA zP3nzMqZDZK6757XQAobOssMkBFqRWwilT/3DsBhRpl3iMUhF+wvpTSHewIDAQABlikely benign Test-vector RSA private key in PEM form inside a self-test.Reasoning
The block is a PEM-armored RSA private key used as a fixed test vector inside a test string, which is expected in a cryptography library's test suite.
-
= returnlikely benign Test builder looks up a digestmod object by name through globals().Reasoning
globals() lookup of a digest module name is a simple way to build a parametrized test table from names in the test file. It does not hide behaviour and the names come from the test's own data.
-
= 17**100 = b assert ==likely benign Expected binary output bytes for a modular multiplication test assertion.Reasoning
The bytes literal is an expected modular-multiplication output, a large-integer result written as escapes. Binary-looking constants like this are normal in arithmetic test vectors.
-
, -
, -
returnlikely benign Test helper dynamically imports a Crypto.Hash module by name.Reasoning
The helper loads a Crypto.Hash submodule by name, with the name coming from the test's own calls. This is a standard test utility and nothing here is attacker-controlled.
-
=likely benign ECC private key PEM test vector in an ECDH self-test.Reasoning
This is a PEM-encoded ECC private key used as a fixed test vector for ECDH in a cryptography test suite.
-
=likely benign Ephemeral ECC private key PEM test vector in an ECDH self-test.Reasoning
This is a PEM-encoded ephemeral ECC private key used as a fixed test vector for ECDH in a cryptography test suite.
-
=likely benign Second ephemeral ECC private key PEM test vector in an ECDH self-test.Reasoning
Same ephemeral PEM test vector as the adjacent finding on the same line, used in an ECDH test case.
-
=likely benign ECC public/private key PEM test vector in an ECDH self-test.Reasoning
This is a PEM-encoded ECC key used as a fixed test vector in an ECDH self-test. Test keys like this are expected in the suite.
-
=likely benign Inline PEM EC private key test vector in an ECDH self-test.Reasoning
The base64 blob is a PEM-encoded EC private key used as a test vector in PyCryptodome's ECDH self-tests. Key material in a crypto library's test suite is expected, and the raw-pass base64 signal has a high false-positive rate.
-
, , , , -
= 0x09FA78B39B00A72930BCD8039BE789A0997830BB99F79AEEB93493715390B4E8 = 0x15210F12786811D3F4B7959D0538AE2C31DBE7106FC03C3EFC4CD549C715A493 -
= 0x09FA78B39B00A72930BCD8039BE789A0997830BB99F79AEEB93493715390B4E8 = 0x15210F12786811D3F4B7959D0538AE2C31DBE7106FC03C3EFC4CD549C715A493 -
= 0x09FA78B39B00A72930BCD8039BE789A0997830BB99F79AEEB93493715390B4E8 = 0x15210F12786811D3F4B7959D0538AE2C31DBE7106FC03C3EFC4CD549C715A493 -
= 0x09FA78B39B00A72930BCD8039BE789A0997830BB99F79AEEB93493715390B4E8 = 0x15210F12786811D3F4B7959D0538AE2C31DBE7106FC03C3EFC4CD549C715A493 -
= -
0xDE2444BEBC8D36E682EDD27E0F271508617519B3221A8FA0B77CAB3989DA97C9, 0xC093AE7FF36E5380FC01A5AAD1E66659702DE80F53CEC576B6350B243042A256, ) -
= -
0x55A8B00F8DA1D44E62F6B3B25316212E39540DC861C89575BB8CF92E35E0986B, 0x5421C3209C2D6C704835D82AC4C3DD90F61A8A52598B9E7AB656E9D8C8B24316, ) -
= 0x72B13DD4354B6B81745195E98CC5BA6970349191AC476BD4553CF35A545A067E = 0x8D585CBB2E1327D75241A8A122D7620DC33B13315AA5C9D46D013011744AC264 -
= 0x72B13DD4354B6B81745195E98CC5BA6970349191AC476BD4553CF35A545A067E = 0x8D585CBB2E1327D75241A8A122D7620DC33B13315AA5C9D46D013011744AC264 -
= 0x7669E6901606EE3BA1A8EEF1E0024C33DF6C22F3B17481B82A860FFCDB6127B0 = 0xFA878162187A54F6C39F6EE0072F33DE389EF3EECD03023DE10CA2C1DB61D0C7 -
= 0x7669E6901606EE3BA1A8EEF1E0024C33DF6C22F3B17481B82A860FFCDB6127B0 = 0xFA878162187A54F6C39F6EE0072F33DE389EF3EECD03023DE10CA2C1DB61D0C7 = -
= 0xC51E4753AFDEC1E6B6C6A5B992F43F8DD0C7A8933072708B6522468B2FFB06FD = 0x51D08D5F2D4278882946D88D83C97D11E62BECC3CFC18BEDACC89BA34EECA03F = 0x75EE68EB8BF626AA5B673AB51F6E744E06F8FCF8A6C0CF3035BECA956A7B41D5 -
= 0x51D08D5F2D4278882946D88D83C97D11E62BECC3CFC18BEDACC89BA34EECA03F = 0x75EE68EB8BF626AA5B673AB51F6E744E06F8FCF8A6C0CF3035BECA956A7B41D5 = * -
= 0xC51E4753AFDEC1E6B6C6A5B992F43F8DD0C7A8933072708B6522468B2FFB06FD = 0xD37F628ECE72A462F0145CBEFE3F0B355EE8332D37ACDD83A358016AEA029DB7 = 0xD867B4679221009234939221B8046245EFCF58413DAACBEFF857B8588341F6B8 -
= 0xD37F628ECE72A462F0145CBEFE3F0B355EE8332D37ACDD83A358016AEA029DB7 = 0xD867B4679221009234939221B8046245EFCF58413DAACBEFF857B8588341F6B8 = 0xF2504055C03CEDE12D22720DAD69C745106B6607EC7E50DD35D54BD80F615275 -
= 0x72B13DD4354B6B81745195E98CC5BA6970349191AC476BD4553CF35A545A067E = 0x8D585CBB2E1327D75241A8A122D7620DC33B13315AA5C9D46D013011744AC264 -
----- ----- / // /2likely benign Embedded PEM DSA public key test fixture.Reasoning
This is a PEM public key block inside a DSA import self-test. Test fixtures like this are normal in a cryptography library, and nothing in the snippet is executed or hidden.
-
----- ----- // 7JFWl9p075FPzRsFZg4kGcdh1jn0XS15uALb0j56uLgbR5o4Dh8wkyWEuioLlVAy +likely benign Embedded PEM DSA private key test fixture.Reasoning
A PEM DSA private key used as a test vector for importing keys. It is expected test data in a crypto library's self-test suite.
-
----- ----- ///likely benign Embedded PKCS#8 DSA private key test fixture.Reasoning
A PKCS#8 PEM private key block used as a parsing test vector in the DSA import self-tests. It is ordinary fixture data.
-
=likely benign SSH DSA public key string used as an import test vector.Reasoning
An ssh-dss public key string literal used to test OpenSSH format import. The base64 is the standard key encoding and the context is a unit test.
-
4V6GHRDpCrdZ8MBjbyp5AlGUrjvr2Pn2e2zVxy5RBt4FBj9/ + //+likely benign Base64 DSA key fixture data in the import self-tests.Reasoning
A continuation of a base64-encoded DSA key fixture within the import self-tests. No executable or evasive content is present.
-
----- ----- / 7ryiW+5ihtF2Ekurq3e408GYSAu5smJjN2bvQXmzRFBz8W38K8eMf1sbWroZ4+ ++//likely benign Encrypted PEM private key test fixture.Reasoning
A PEM encrypted PKCS#8 private key used to test decryption on import. Encrypted key fixtures are expected in this test module.
-
----- -----likely benign Embedded X.509 certificate test fixture.Reasoning
A PEM X.509 certificate used as a test input for DSA key extraction. Certificates in test fixtures are normal.
-
info
warn→ info by reviewdynamic-attributelib/Crypto/SelfTest/PublicKey/test_import_DSA.py:511:24= = assert ==likely benign Test code that uses locals() and getattr to compare key components by name.Reasoning
The loop reads local variables by name (for example y_str and p_str) and then compares them against key attributes with getattr. It is a test-helper idiom with bounded, hardcoded names and no dynamic execution, network use or obfuscated payload.
-
----- -----likely benign Embedded test CA X.509 certificate fixture.Reasoning
A PEM X.509 certificate with a test CA subject and email, used as a parsing fixture in the DSA import tests. It is test data and not a payload.
-
info
warn→ info by reviewdynamic-attributelib/Crypto/SelfTest/PublicKey/test_import_DSA.py:594:24= = assert ==likely benign Test code that uses locals() and getattr to compare key components by name.Reasoning
This is the same locals() plus getattr comparison pattern as the earlier finding in this file. It is a bounded test-helper idiom with no malicious behaviour.
-
= assert == 0x5C4E4320EF260F91ED9FC597AEE98C8236B60E0CED692CC7A057D5E45798A052 -
= assert == 0x5C4E4320EF260F91ED9FC597AEE98C8236B60E0CED692CC7A057D5E45798A052 -
= assert == 0x5C4E4320EF260F91ED9FC597AEE98C8236B60E0CED692CC7A057D5E45798A052 -
=likely benign Embedded PEM EC private key test fixture.Reasoning
A short PEM EC private key fixture in the ECC import tests. It is expected test data in a crypto library.
-
=dismissed Embedded PEM EC private key test vector in a PyCryptodome self-test.Reasoning
The blob is a PEM-encoded EC private key inside a self-test string literal. Base64 is the normal format for PEM, and the test file exists to exercise key import, so the match reflects expected test data, not hidden payload.
-
=dismissed PEM EC private key fixture used to test key parsing.Reasoning
This is a PEM EC private key literal in a cryptographic import test. The base64 content is a key structure, which is expected in this file and does not indicate obfuscation.
-
=dismissed Second PEM EC private key fixture in the import self-test.Reasoning
Same pattern as the neighbouring fixture: a PEM-encoded EC private key in a self-test. The raw base64 heuristic fires on ordinary key encoding.
-
=dismissed Short PEM EC private key test vector.Reasoning
A short PEM EC private key with BEGIN/END markers in a test module. This is a standard test vector and the flag comes from base64 structure alone.
-
=dismissed Paired PEM EC private key test vector.Reasoning
Paired PEM EC private key fixture with proper BEGIN/END armour, consistent with a key-import test suite. No decoding or execution is involved.
-
=dismissed PEM EC private key fixture for import testing.Reasoning
A PEM EC private key in a test string, using the standard header and the ASN.1 structure expected for this kind of key. The match is a raw base64 false positive.
-
=dismissed Second PEM EC private key fixture for import testing.Reasoning
Second PEM EC private key in the same test table style. It is ordinary key data inside a self-test, not an encoded dropper.
-
=dismissed Larger PEM EC private key test vector.Reasoning
A PEM EC private key with a secp384-style parameter block, appropriate for a cryptographic test suite. The base64 length is typical of key material.
-
=dismissed Paired larger PEM EC private key test vector.Reasoning
Paired larger PEM EC key fixture in the same self-test file. Consistent with expected test data and not obfuscated code.
-
=dismissed PEM RSA private key fixture for RSA import tests.Reasoning
A PEM RSA private key literal in the RSA import self-test. The base64 structure matches an ASN.1 RSA key, which is expected in this test module.
-
=likely benign Embedded PEM-encoded RSA private key test fixture.Reasoning
The raw pass flagged a base64 body, but the snippet is a PKCS#8 PRIVATE KEY PEM literal in a cryptography library's self-test module. Test key fixtures like this are expected, and the content is an ordinary DER structure.
-
+ + /+/likely benign Continuation of an embedded RSA private key PEM test fixture.Reasoning
Continuation lines of another PEM key literal inside a crypto library's test suite. Raw base64 matching on key material is a known false positive here.
-
"""-----BEGIN ENCRYPTED PRIVATE KEY----- MIIBpjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIeZIsbW3O+JcCAggA MBQGCCqGSIb3DQMHBAgSM2p0D8FilgSCAWBhFyP2tiGKVpGj3mO8qIBzinU60ApR 3unvP+N6j7LVgnV2lFGaXbJ6a1PbQXe+2D6DUyBLo8EMXrKKVLqOMGkFMHc0UaV6likely benign Encrypted PKCS#8 private key test vector.Reasoning
Body of an ENCRYPTED PRIVATE KEY PEM test vector used to exercise the importer's password-decryption path. The base64 is a standard PKCS#8 encrypted container, not a hidden payload.
-
=likely benign RSA public key PEM test fixture.Reasoning
Standard PUBLIC KEY PEM block in a crypto library's import tests. The compression ratio is high only because the content is random-looking key data.
-
# Obtained using 'ssh-keygen -i -m PKCS8 -f rsaPublicKeyPEM' = b # The private key, in PKCS#1 format encoded with DERlikely benign OpenSSH-format RSA public key literal used as a test vector.Reasoning
The string is an OpenSSH ssh-rsa public key that the comment says was produced by ssh-keygen. High compression ratio is expected for random key bytes in test data.
-
# Obtained using 'ssh-keygen -i -m PKCS8 -f rsaPublicKeyPEM' = b # The private key, in PKCS#1 format encoded with DERlikely benign Base64 body of an OpenSSH RSA public key test vector.Reasoning
Same OpenSSH public key literal as the adjacent finding, flagged again by the base64 heuristic. It is test data for key import.
-
----- -----likely benign X.509 certificate PEM fixture for certificate-import tests.Reasoning
Begins with a CERTIFICATE PEM header and a subject containing 'Acme' and 'spam@acme.org', which are fixed test identities in a certificate-parsing test. The base64 is an X.509 certificate.
-
----- -----likely benign Test X.509 certificate PEM fixture.Reasoning
X.509 certificate PEM fixture with a test CA subject ('Test CA', test@example.com) in a crypto library's test suite. Nothing suggests a payload or obfuscation.
-
returnlikely benign Test helper that dynamically imports a Crypto.Hash submodule by name.Reasoning
The helper builds a module name from a hash name and imports it from Crypto.Hash. The name comes from the test's own vector table, not untrusted input, and the module namespace is fixed. This is a typical test-helper pattern in pycryptodome, though a non-literal __import__ is worth a note since the prefix is concatenated at runtime.
-
=likely benign EC public key PEM test fixture.Reasoning
A PUBLIC KEY PEM for an EC key used in a DSS signature test. Standard test fixture with no decoding or execution attached.
-
= = -
, , , -
returnlikely benign Test helper that dynamically imports a Crypto.Hash submodule by name.Reasoning
Same helper as in test_dss.py: a hash module is loaded by name from the Crypto.Hash package for parametrized signature tests. The argument comes from test vectors. The snippet is identical to the other file, so the same reading applies.
-
=likely benign Embedded RSA private key PEM test fixture.Reasoning
A RSA PRIVATE KEY PEM literal in a signature test. Key material in test fixtures is normal for this library.
-
returnlikely benign A test helper that imports a Crypto.Hash submodule by name.Reasoning
The helper loads a hash module by name under the fixed prefix Crypto.Hash., which is a common way for a self-test to iterate over hash implementations. The input comes from test code, not untrusted data, and nothing in the snippet is hidden or encoded.
-
= blikely benign An embedded PEM RSA key used as a test fixture.Reasoning
The base64 lines form a PEM-encoded RSA private key embedded as a test vector in a self-test module. This is standard test data for a cryptography library, not an encoded payload.
-
= blikely benign A binary tag stored as a bytes literal for a known-answer test.Reasoning
A bytes literal full of \x escapes is a binary known-answer test vector (a signature or tag) in a crypto test suite. Such literals are expected there and do not execute anything.
-
= returnlikely benign A test harness importing a Crypto.Hash module by name to build a XOF.Reasoning
The same pattern as the other test file: a hash module is imported by name under the Crypto.Hash. prefix inside a self-test. The name comes from the test's own table, so this is a legitimate test-harness idiom.
-
likely benign A portability header mapping the inline keyword to a compiler-specific spelling.
Reasoning
Redefining inline to _inline in a portability header is a standard compiler-compatibility shim, typically for older or nonstandard MSVC or C toolchains. It has no runtime effect beyond renaming a keyword spelling.
-
likely benign The alternate branch of the inline compatibility shim in the same header.
Reasoning
This is the alternate branch of the same compatibility header, mapping inline to __inline for another compiler. It is the usual conditional-compilation pattern and is benign.
-
const uint8_t Gx = "\x21\x69\x36\xd3\xcd\x6e\x53\xfe\xc0\xa4\xe2\x31\xfd\xd6\xdc\x5c\x69\x2c\xc7\x60\x95\x25\xa7\xb2\xc9\x56\x2d\x60\x8f\x25\xd5\x1a"; const uint8_t Gy = "\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x58";likely benign Ed25519 base point coordinates written as byte literals in a performance test.Reasoning
The escape sequences encode the Ed25519 base point coordinates Gx and Gy, which are published curve constants. Writing them as byte-string literals is normal for a crypto performance test.
Reproduce This Scan
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
|
&&