miscreant

What it is and what it does

Miscreant is a Python library implementing misuse-resistant authenticated encryption schemes designed to remain secure even when cryptographic nonces are accidentally reused—a common failure mode in symmetric encryption. It provides three main constructions: AES-SIV (combining AES-CTR with AES-CMAC), AES-PMAC-SIV (a parallelizable variant using AES-PMAC for better performance), and STREAM (for online/streaming encryption that also defends against reordering and truncation attacks). The library is part of a larger cross-language Miscreant project and is intended for developers who need authenticated encryption for individual messages, encryption keys, message streams, or large files.

The package has no runtime dependencies, making installation straightforward, but it is abandoned—the repository is archived, the last commit was 2019-09-03, and the latest release dates to 2017-12-25. The codebase is marked Pre-Alpha, indicating it was never considered production-ready by its authors. No security vulnerabilities are currently recorded, but the lack of active maintenance means any future issues will not be addressed by the original developers.

Use it for:

• Encrypt sensitive configuration files or encryption keys where nonce reuse must not compromise security.
• Implement streaming encryption for large files or network streams with built-in protection against message reordering.
• Build cross-language cryptographic systems using the interoperable Miscreant implementations across Go, Rust, JavaScript, Ruby, or C#.
• Wrap encryption keys in a deterministic, authenticated manner as an alternative to traditional key-wrapping schemes.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Provides misuse-resistant authenticated encryption using AES-SIV, AES-PMAC-SIV, and STREAM constructions for encrypting messages, keys, and file streams.

No. The package is abandoned (last release 2017-12-25, repository archived, no commits since 2019-09-03) and marked Pre-Alpha. While the cryptographic constructions are theoretically sound and no known vulnerabilities exist, the lack of active maintenance means security issues and compatibility problems will not be addressed. Use only if maintaining legacy code already depending on it.

Install

miscreant on PyPI

pip install miscreant

uv add miscreant

poetry add miscreant

Installing miscreant

Before you install

High install friction with no runtime dependencies. The package is abandoned—last commit was 2019-09-03 and latest release was 2017-12-25. Repository is archived. Pre-Alpha status signals incomplete development.

License in practice

MIT license permits commercial and private use with minimal restrictions, though the abandoned status means no ongoing legal or security updates from maintainers.

Quickstart

pip install miscreant

from miscreant import AESSIV

cipher = AESSIV(key)
encrypted = cipher.seal(plaintext, associated_data)

Package is abandoned with no active maintenance; security issues will not be addressed by the original developers.

Verify before relying

• Whether the cryptographic constructions (AES-SIV, AES-PMAC-SIV, STREAM) have been independently audited or validated since the last release in 2017-12-25.
• Current compatibility with modern Python versions and whether the package installs without build errors on current systems.
• Whether interoperability with other Miscreant implementations (Go, Rust, JavaScript, Ruby, C#) is maintained across versions.
• Specific key size requirements and parameter constraints for the cipher implementations.

Package facts

Evidence: miscreant-0.3.0.tar.gz

Keywords: cryptography

Tags

More Cryptography packages