[dependabot]

Bumps pycryptodome from 3.23.0 to 4.4.0.

Release notes

Sourced from pycryptodome's releases.

v4.4.0 - Lyon

New features

• Added the elliptic curve secp256k1 to Crypto.PublicKey.ECC: key generation, import and export, ECDSA with Crypto.Signature.DSS, and ECDH with Crypto.Protocol.DH.
• Added the mode 'sec1' to Crypto.Signature.DSS.new, for randomized ECDSA on all Weierstrass curves. Mode 'fips-186-3' does not accept secp256k1, which is not a curve of that standard.
• GH#759: Added the parameter low_s to Crypto.Signature.DSS.new, for ECDSA signatures in the low-S form (for all curves): signing normalizes s, and verifying rejects a high s.
• ECDSA signatures in DER encoding are about 5-8x faster.

Resolved issues

• ECC.import_key raised TypeError instead of ValueError for an OpenSSH public key with an unsupported curve or key type, or with a malformed body.
• ECC.import_key accepted an OpenSSH key (public or private) whose curve did not match its key type.
• GH#960: In HPKE, a message rejected by unseal() consumed a sequence number, so all later messages of that context failed too. The sequence number now only advances when unseal() succeeds (RFC 9180, Section 5.2). Thanks to Zulfareen Shaikh.
• In HPKE, a seal() that raised an exception also consumed a sequence number, so the receiver could not unseal the messages that followed.

v4.3.0 - Kourou

New features

• CTR mode is 2.5-3.5x faster on large data (and GCM about 2x), on all platforms.
• On 64-bit ARM CPUs (Linux, macOS and Windows), AES and GHASH use the instructions of the ARMv8 Cryptography Extensions (AES and PMULL), when available. On a Graviton3, AES-ECB is about 35x faster, GCM 7x, OCB 10-12x, and CTR, CBC, CFB and OFB 3-6x.
• Integer.random_range() is about 2x faster when the bounds are public, with the same output: ECDSA signatures are about 13% faster (P-256), DSA signatures about 4%, and ECC key generation about 35%. The RSA modulus and the DSA subgroup order are now public Integer objects.
• Faster RSA: on x86-64, signatures and decryption are 35-40% faster (RSA-2048 to RSA-4096), verification and encryption 2-2.7x. Modular exponentiation with a public exponent (like the RSA public exponent) no longer uses the slower constant-time algorithm, which is only needed for secret exponents, and the Montgomery context of a modulus is kept with it. The RSA blinding factor is squared between uses (a new one every 32 uses, and after a fork).
• The Montgomery multiplication for x86-64 CPUs with BMI2 and ADX is about 20% faster: DSA signatures and verification are about 25% faster.
• ECDSA signatures are 3-6% faster for P-256 and P-384: the field inversion uses the faster power for public exponents (the exponent p - 2 is public).
• On 64-bit ARM CPUs, SHA-224 and SHA-256 use the SHA-256 instructions of the ARMv8 Cryptography Extensions, and SHA-384 and SHA-512 the SHA-512 instructions of ARMv8.2, when available.

... (truncated)

Changelog

Sourced from pycryptodome's changelog.

4.4.0 (7 November 2026) +++++++++++++++++++++++++++

New features

• Added the elliptic curve secp256k1 to Crypto.PublicKey.ECC: key generation, import and export, ECDSA with Crypto.Signature.DSS, and ECDH with Crypto.Protocol.DH.
• Added the mode 'sec1' to Crypto.Signature.DSS.new, for randomized ECDSA on all Weierstrass curves. Mode 'fips-186-3' does not accept secp256k1, which is not a curve of that standard.
• GH#759: Added the parameter low_s to Crypto.Signature.DSS.new, for ECDSA signatures in the low-S form (for all curves): signing normalizes s, and verifying rejects a high s.
• ECDSA signatures in DER encoding are about 5-8x faster.

Resolved issues

• ECC.import_key raised TypeError instead of ValueError for an OpenSSH public key with an unsupported curve or key type, or with a malformed body.
• ECC.import_key accepted an OpenSSH key (public or private) whose curve did not match its key type.
• GH#960: In HPKE, a message rejected by unseal() consumed a sequence number, so all later messages of that context failed too. The sequence number now only advances when unseal() succeeds (RFC 9180, Section 5.2). Thanks to Zulfareen Shaikh.
• In HPKE, a seal() that raised an exception also consumed a sequence number, so the receiver could not unseal the messages that followed.

4.3.0 (2 November 2026) ++++++++++++++++++++++++++

New features

• CTR mode is 2.5-3.5x faster on large data (and GCM about 2x), on all platforms.
• On 64-bit ARM CPUs (Linux, macOS and Windows), AES and GHASH use the instructions of the ARMv8 Cryptography Extensions (AES and PMULL), when available. On a Graviton3, AES-ECB is about 35x faster, GCM 7x, OCB 10-12x, and CTR, CBC, CFB and OFB 3-6x.
• Integer.random_range() is about 2x faster when the bounds are public, with the same output: ECDSA signatures are about 13% faster (P-256), DSA signatures about 4%, and ECC key generation about 35%. The RSA modulus and the DSA subgroup order are now public Integer objects.
• Faster RSA: on x86-64, signatures and decryption are 35-40% faster (RSA-2048 to RSA-4096), verification and encryption 2-2.7x. Modular exponentiation with a public exponent (like the RSA public exponent) no longer uses the slower constant-time algorithm, which is only needed for secret exponents, and the Montgomery context of a modulus is kept with it. The RSA blinding factor is squared between uses (a new one every 32 uses, and after a fork).
• The Montgomery multiplication for x86-64 CPUs with BMI2 and ADX is about 20% faster: DSA signatures and verification are about 25% faster.
• ECDSA signatures are 3-6% faster for P-256 and P-384: the field inversion

... (truncated)

Commits

• 3a016ab Merge branch 'hpke-unseal-seq'
• ac2397d DSS: make low_s keyword-only
• 18134a5 Bump version
• 34d90a7 Update docs
• a7df203 HPKE: only advance the sequence number when unseal() succeeds
• d093eee Merge branch 'secp256k1'
• 10382a1 Update docs
• 9a309e7 More comments
• b8277e0 Add 'sec1' mode for ECC signatures
• 153084c Bump version of test vectors
• Additional commits viewable in compare view

[content-bot]

Docker Image Ready - Dev

Docker automatic build has deployed your docker image: devdemisto/py3-tools:1.0.0.14605338
It is available now on docker hub at: https://hub.docker.com/r/devdemisto/py3-tools/tags
Get started by pulling the image:

docker pull devdemisto/py3-tools:1.0.0.14605338

Docker Metadata

• Image Size: 75.20M
• Image ID: sha256:e4e5573fa4531aac724cf31ccbf7c8e4b54c5f57a8d2664e987fb6dc278c64fe
• Created: 2026-11-10T15:02:17.657704718Z
• Arch: linux/amd64
• Command: ["python3"]
• Environment:
  • PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
  • LANG=C.UTF-8
  • GPG_KEY=7169605F62C751356D054A26A821E680E5FA6305
  • PYTHON_VERSION=3.12.15
  • PYTHON_SHA256=c2c4321961fab0fb999d66e0cecf521c2ab3994c7992873ea99e306c1094fd5a
  • DOCKER_IMAGE=devdemisto/py3-tools:1.0.0.14605338
• Labels:
  • io.buildah.version:1.37.5
  • org.opencontainers.image.authors:Demisto <containers@demisto.com>
  • org.opencontainers.image.revision:cecfc6676d5a94c64d845b354536762f909d79a5
  • org.opencontainers.image.version:1.0.0.14605338
  • panw.builtby.pipeline:14069232
  • panw.builtby.project:xdr/cortex-content/dockerfiles
  • panw.builtby.template:build-scan-publish

[content-bot]

🔍 AI Triage Report Available

An automated triage report has been generated for this pipeline.

Status: success
Report ID: dc62be52aa10b661

📋 Triage Report

⚠️ AI-generated triage. Validate before acting.