Cryptography

cryptography has 2 layers: recipes that need few decisions, and low-level primitives it calls the "hazmat" layer. Its docs recommend the recipes layer whenever possible, and hazmat only when necessary. For data you encrypt with a key, the recipe is Fernet: a message encrypted with it can't be read or changed without the key. To encrypt with a password, run it through a key derivation function first. The docs recommend Argon2id, and you keep the salt to derive the same key again. When Fernet doesn't fit, the docs point you to authenticated encryption before any raw cipher, since encryption alone keeps data secret but doesn't stop tampering. The recipes also cover X.509 certificates, from signing requests to self-signed certs.

PyNaCl is a binding to libsodium, a fork of NaCl. cryptography's FAQ explains the split: cryptography is general purpose and interoperable with existing systems, while NaCl gives you a set of hand-selected algorithms. If you prefer NaCl's design, the FAQ recommends PyNaCl. With a shared key, encrypt through SecretBox or Aead and let PyNaCl generate a random nonce for each message, which its docs strongly recommend. Between 2 parties, Box authenticates both sides, and SealedBox sends a message only the recipient can decrypt, without proving who sent it. To store passwords, nacl.pwhash.str() hashes with argon2id by default, and nacl.pwhash.verify() checks a password against the hash.

Paramiko implements SSHv2 in pure Python, as both client and server. For common client jobs like running remote commands or transferring files, its homepage recommends a higher-level library built on it. Use Paramiko directly for low-level primitives or to run an SSH server in Python. Its client API starts with SSHClient, and checking the server's host key is your job: call load_system_host_keys() before connect(). A host key it can't find is rejected by default with an SSHException. open_sftp() opens an SFTP session on the same connection.

ItsDangerous signs data, so you can send it somewhere untrusted and get it back: the receiver can see the data but can't modify it without your key. Flask's default sessions are cookies signed with it. Signing hides nothing, so when the data must stay secret, encrypt it with Fernet instead. Its docs say you'll typically want a serializer, not a signer. URLSafeSerializer turns data into a URL-safe string, and URLSafeTimedSerializer rejects tokens older than the max_age you pass to loads(). Give each use its own salt, so an activation link's signature won't pass as an upgrade link's.

Whichever pick you use, keep secret keys out of your code. ItsDangerous's docs say the key shouldn't be saved in source code or committed to version control, and suggest reading it from an environment variable. When you generate a key or token yourself, use os.urandom(), never the random module, which isn't cryptographically secure. Plan for rotation, too: cryptography's MultiFernet and ItsDangerous both take a list of keys, so old tokens keep working after you add a new key.