I have modified my thinkpad's BIOS to remove the wifi whitelist and plan to flash the modified bios back to the eeprom. To do that I have to use a tool called thinkpad-uefi-sign which signs the image so it can boot. Thinkpad-uefi-sign requires using pycryptodome. I installed that using

apt install python3-pycryptodome

However it still didn't work and have the error

ModuleNotFoundError: No module named 'Crypto'

when I run thinkpad-uefi-sign/verify.py. I am using Debian Testing Trixie with up to date packages and Python 3.11.5.

Another thing I tried was to install it using

pip install pycryptodome

however that gave a warning that it could break packages and to install it instead using apt install python-xyz. I then installed python3-full and set up a venv (virtual environment) using python3 -m venv /path/to/venv. I installed pycryptodome in the venv using

/path/to/venv/bin/pip3 install pycryptodome

I then ran the script thinkpad-uefi-sign/verify.py with

/path/to/venv/bin/python3 thinkpad-uefi-sign/verify.py Bios_Modded.bin

and still ran into the same error. After that I tried installing pycryptodomex, Crypto, and pycrypto using pip3 from the venv but still ran into the error when running the program. I additionally tried to try the answers from this other post, but it didn't help much. I also tried using a macbook and it seemed to work there for some reason so it might be a packaging-related issue. Encase this could be helpful, this is the command and the full output.

$ ./python3_venv_with_pycryptodome/bin/python3 thinkpad-uefi-sign/verify.py Bios_Modded.bin
Traceback (most recent call last):
  File "/home/witherslayer/Sowa/ThkpX1CG2_UEFIs/workflow/thinkpad-uefi-sign/verify.py", line 19, in <module>
    from Crypto.PublicKey import RSA
ModuleNotFoundError: No module named 'Crypto'

  • apt install will install it for the default system python, but not for a virtual env. You will have to activate the venv, then install the library in there with pip . Also, you are not working with venvs correctly - you should not call those paths directly! activate the venv instead!
    – Panki
    Sep 18, 2023 at 8:46
  • Thank you. I was able to get it to work after activating it with the instructions from [here] (docs.python.org/3/library/venv.html). Sep 18, 2023 at 9:10

2 Answers 2


I was able to run the signing software after activating the python venv as stated from Panki's comment. I did that for bash using the command

$ source <venv>/bin/activate

from the python documentation.


This library has a feature since 3.4.1:

3.4.1 (21 February 2016)

New features

  • Added option to install the library under the Cryptodome package (instead of Crypto).

And indeed that's needed to avoid a conflict with the old PyCrypto library if both are installed or used at the same time, as documented in the sources:


An almost drop-in replacement for the old PyCrypto library.

You install it with::

pip install pycryptodome
In this case, all modules are installed under the `Crypto` package. You can test everything is right with::
pip install pycryptodome-test-vectors
python -m Crypto.SelfTest

One must avoid having both PyCrypto and PyCryptodome installed at the same time, as they will interfere with each other. This option is therefore recommended only when you are sure that the whole application is deployed in a virtualenv.


library independent of the old PyCrypto.

You install it with::

pip install pycryptodomex
You can test everything is right with::

pip install pycryptodome-test-vectors
python -m Cryptodome.SelfTest

In this case, all modules are installed under the Cryptodome package. The old PyCrypto and PyCryptodome can coexist.

Debian as a a distributor chose this option to avoid any potential clash (even if it doesn't provide the old PyCrypto at all):


touch .separate_namespace


use_separate_namespace = os.path.isfile(".separate_namespace")
other_project = "pycryptodomex"
other_root = "Cryptodome"
if use_separate_namespace:
    project_name, other_project = other_project, project_name
    package_root, other_root = other_root, package_root 

In the end it's also possible to use Debian's packaged library (without venv): replace Crypto with Cryptodome in sign.py and verify.py.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .