SaQura for Python

Post-quantum-ready cryptography for Python. Wire-compatible with SaQura for .NET, Swift and Kotlin — data encrypted or signed on one platform decrypts and verifies on every other.

SaQura is async-first (await saqura.aes.encrypt(...)) with a synchronous facade (saqura.sync), mirroring the Swift (async) and Kotlin (suspend) SDKs.

Features

Install

pip install saqura            # AES / RSA / Hybrid / Licensing / Password
pip install "saqura[quantum]" # + post-quantum (pulls liboqs-python)

Requires Python 3.10+. Wheels are shipped compiled (no .py source).

Windows + post-quantum: liboqs-python's default MSVC build miscompiles the FIPS-205 SLH-DSA path. After installing the quantum extra, run the bundled helper once — powershell -ExecutionPolicy Bypass -File tools\setup_liboqs_windows.ps1 — to install a correct (clang-cl) liboqs. macOS and Linux are unaffected.

Tested liboqs version: this release is tested against native liboqs 0.15.0. liboqs-python uses an already installed liboqs, or builds one on first import. To use the tested version, install liboqs 0.15.0 beforehand, or set PYOQS_VERSION=0.15.0 before the first import oqs (the Windows helper above already installs 0.15.0).

Usage

import asyncio, saqura

async def main():
    # symmetric
    blob = await saqura.aes.encrypt("hello", "my-key")
    assert await saqura.aes.decrypt(blob, "my-key") == "hello"

    # asymmetric — new_key_pair() returns (private_pem, public_pem)
    priv, pub = await saqura.rsa.new_key_pair()
    sig = await saqura.rsa.sign("invoice #42", priv)
    assert await saqura.rsa.verify("invoice #42", sig, pub)

asyncio.run(main())

Synchronous facade — same names, no await:

import saqura
blob = saqura.sync.aes.encrypt("hello", "my-key")
text = saqura.sync.aes.decrypt(blob, "my-key")

Interoperability

All SaQura libraries share the same wire formats (AES-GCM nonce‖ct‖tag, RSA-OAEP/PSS-SHA256, hybrid envelope, FrodoKEM / Classic-McEliece / ML-KEM blobs, ML-DSA / SLH-DSA signatures, PBKDF2-SHA512, .lic license files). Cross-language round-trips are verified against a shared test corpus, so a .lic issued for .NET validates in Python and an AES blob from Swift decrypts in Python.

© 2025–2026 KyotoTech LLC. Proprietary.