saqura 1.0.9

=?utf-8?q?SaQura_=E2=80=94_post-quantum-ready_cryptography_for_Python=2E_Wire-compatible_with_SaQura_for_=2ENET=2C_Swift_and_Kotlin=2E?=

SaQura for Python

Post-quantum-ready cryptography for Python. Wire-compatible with SaQura for .NET, Swift and Kotlin — data encrypted or signed on one platform decrypts and verifies on every other.

SaQura is async-first (await saqura.aes.encrypt(...)) with a synchronous facade (saqura.sync), mirroring the Swift (async) and Kotlin (suspend) SDKs.

Features

Module	What it does
AES	AES-256-GCM (auto-detects legacy CBC+HMAC on decrypt)
RSA	RSA-4096 — OAEP-SHA256 encryption, PSS-SHA256 signatures
Hybrid	RSA+AES envelope for large payloads (new + legacy HYBR)
Quantum	Post-quantum KEMs (FrodoKEM / Classic-McEliece / ML-KEM, Generations 2–8) and ML-DSA (FIPS 204) / SLH-DSA (FIPS 205) signatures, via liboqs
Licensing	Offline .lic verification (public-key-only)
Password	PBKDF2-HMAC-SHA512, 210 000 iterations

Install

pip install saqura            # AES / RSA / Hybrid / Licensing / Password
pip install "saqura[quantum]" # + post-quantum (pulls liboqs-python)

Requires Python 3.10+. Wheels are shipped compiled (no .py source).

Windows + post-quantum: liboqs-python's default MSVC build miscompiles the FIPS-205 SLH-DSA path. After installing the quantum extra, run the bundled helper once — powershell -ExecutionPolicy Bypass -File tools\setup_liboqs_windows.ps1 — to install a correct (clang-cl) liboqs. macOS and Linux are unaffected.

Usage

import asyncio, saqura

async def main():
    # symmetric
    blob = await saqura.aes.encrypt("hello", "my-key")
    assert await saqura.aes.decrypt(blob, "my-key") == "hello"

    # asymmetric — new_key_pair() returns (private_pem, public_pem)
    priv, pub = await saqura.rsa.new_key_pair()
    sig = await saqura.rsa.sign("invoice #42", priv)
    assert await saqura.rsa.verify("invoice #42", sig, pub)

asyncio.run(main())

Synchronous facade — same names, no await:

import saqura
blob = saqura.sync.aes.encrypt("hello", "my-key")
text = saqura.sync.aes.decrypt(blob, "my-key")

Interoperability

All SaQura libraries share the same wire formats (AES-GCM nonce‖ct‖tag, RSA-OAEP/PSS-SHA256, hybrid envelope, FrodoKEM / Classic-McEliece / ML-KEM blobs, ML-DSA / SLH-DSA signatures, PBKDF2-SHA512, .lic license files). Cross-language round-trips are verified against a shared test corpus, so a .lic issued for .NET validates in Python and an AES blob from Swift decrypts in Python.

---

© 2025–2026 KyotoTech LLC. Proprietary.