diff --git a/.gitignore b/.gitignore
index 258afbe..f66525f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -25,3 +25,5 @@
 /cryptography-3.2.1.tar.gz.asc
 /cryptography-3.3.1.tar.gz
 /cryptography-3.3.1.tar.gz.asc
+/cryptography-3.4.tar.gz
+/cryptography-3.4.tar.gz.asc
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..c100762
--- /dev/null
+++ b/README.md
@@ -0,0 +1,98 @@
+# PyCA cryptography
+
+https://cryptography.io/en/latest/
+
+## Packaging python-cryptography
+
+The example assumes
+
+* Fedora Rawhide (f34)
+* PyCA cryptography release ``3.4``
+* Update Bugzilla issues are ``RHBZ#00000001`` and ``RHBZ#00000002``
+* Build side tag is ``f34-build-side-12345``
+
+### Request a side tag for building
+
+python-cryptography builds depend on python-cryptography-vectors
+package. Both packages must be build in a side tag.
+
+```shell
+fedpkg request-side-tag --base-tag f34-build
+```
+
+### Build new python-cryptography-vectors first
+
+```shell
+pushd ../python-cryptography-vectors
+```
+
+Switch and update branch
+
+```shell
+fedpkg switch-branch rawhide
+fedpkg pull
+```
+
+Bump version and get sources
+
+```shell
+rpmdev-bumpspec -c "Update to 3.4 (#00000001)" -n 3.4 python-cryptography-vectors.spec
+spectool -gf python-cryptography-vectors.spec
+```
+
+Upload sources
+
+```shell
+fedpkg new-sources cryptography_vectors-3.4.tar.gz
+```
+
+Commit changes
+
+```shell
+git add sources .gitignore python-cryptography-vectors.spec
+fedpkg commit --clog
+fedpkg push
+```
+
+Build and wait for repo to regenerate
+
+```shell
+fedpkg build --target=f34-build-side-12345
+koji wait-repo --build python-cryptography-vectors-3.4-1 f34-build-side-12345
+```
+
+### Build new python-cryptography
+
+Switch and update branch
+
+```shell
+fedpkg switch-branch rawhide
+fedpkg pull
+```
+
+Bump version and get sources
+
+```shell
+rpmdev-bumpspec -c "Update to 3.4 (#00000002)" -n 3.4 python-cryptography.spec
+spectool -gf python-cryptography.spec
+```
+
+Upload new sources (**two files!**)
+
+```shell
+fedpkg new-sources cryptography-3.4.tar.gz cryptography-3.4.tar.gz.asc
+```
+
+Commit changes
+
+```shell
+git add sources .gitignore python-cryptography.spec
+fedpkg commit --clog
+fedpkg push
+```
+
+Build
+
+```shell
+fedpkg build --target=f34-build-side-12345
+```
diff --git a/python-cryptography.spec b/python-cryptography.spec
index dab9ad2..4ff1761 100644
--- a/python-cryptography.spec
+++ b/python-cryptography.spec
@@ -1,26 +1,13 @@
-%if 0%{?fedora} || 0%{?rhel} > 7
-# Enable python3 build by default
-%bcond_without python3
-%else
-%bcond_with python3
-%endif
-
-%if 0%{?fedora} > 31 || 0%{?rhel} > 7
-# Disable python2 build by default
-%bcond_with python2
-%else
-%bcond_without python2
-%endif
-
 %bcond_without tests
 
 %{!?python3_pkgversion:%global python3_pkgversion 3}
 
 %global srcname cryptography
+%global pyo3_version 0.13.1
 
 Name:           python-%{srcname}
-Version:        3.3.1
-Release:        2%{?dist}
+Version:        3.4
+Release:        1%{?dist}
 Summary:        PyCA's cryptography library
 
 License:        ASL 2.0 or BSD
@@ -36,31 +23,14 @@ Source2:        gpgkey-05FD_9FA1_6CF7_5735_0D91_A560_235A_E5F1_29F9_ED98.gpg
 BuildRequires:  openssl-devel
 BuildRequires:  gcc
 BuildRequires:  gnupg2
+BuildRequires:  rust-packaging
+BuildRequires:  rust-pyo3+default-devel >= %{pyo3_version}
+BuildRequires:  rust-pyo3+extension-module-devel >= %{pyo3_version}
 
-%if 0%{?with_python2}
-BuildRequires:  python2-cffi >= 1.7
-BuildRequires:  python2-cryptography-vectors = %{version}
-BuildRequires:  python2-devel
-BuildRequires:  python2-enum34
-BuildRequires:  python2-idna >= 2.1
-BuildRequires:  python2-ipaddress
-BuildRequires:  python2-setuptools
-BuildRequires:  python2-six >= 1.4.1
-
-%if %{with tests}
-BuildRequires:  python2-hypothesis >= 1.11.4
-BuildRequires:  python2-iso8601
-BuildRequires:  python2-pretend
-BuildRequires:  python2-pytest >= 3.2.1
-BuildRequires:  python2-pytz
-%endif
-%endif
-
-%if 0%{?with_python3}
 BuildRequires:  python%{python3_pkgversion}-cffi >= 1.7
 BuildRequires:  python%{python3_pkgversion}-devel
-BuildRequires:  python%{python3_pkgversion}-idna >= 2.1
 BuildRequires:  python%{python3_pkgversion}-setuptools
+BuildRequires:  python%{python3_pkgversion}-setuptools-rust >= 0.11.3
 BuildRequires:  python%{python3_pkgversion}-six >= 1.4.1
 
 %if %{with tests}
@@ -71,105 +41,59 @@ BuildRequires:  python%{python3_pkgversion}-pretend
 BuildRequires:  python%{python3_pkgversion}-pytest >= 3.2.1
 BuildRequires:  python%{python3_pkgversion}-pytz
 %endif
-%endif
 
 %description
 cryptography is a package designed to expose cryptographic primitives and
 recipes to Python developers.
 
-%if 0%{?with_python2}
-%package -n  python2-%{srcname}
-Summary:        PyCA's cryptography library
-
-%if 0%{?with_python3}
-%{?python_provide:%python_provide python2-%{srcname}}
-%else
-Provides:       python-%{srcname}
-%endif
-
-Requires:       openssl-libs
-Requires:       python2-idna >= 2.1
-Requires:       python2-six >= 1.4.1
-Requires:       python2-cffi >= 1.7
-Requires:       python2-enum34
-Requires:       python2-ipaddress
-
-%description -n python2-%{srcname}
-cryptography is a package designed to expose cryptographic primitives and
-recipes to Python developers.
-%endif
-
-%if 0%{?with_python3}
 %package -n  python%{python3_pkgversion}-%{srcname}
 Summary:        PyCA's cryptography library
 %{?python_provide:%python_provide python%{python3_pkgversion}-%{srcname}}
 
 Requires:       openssl-libs
-Requires:       python%{python3_pkgversion}-idna >= 2.1
 Requires:       python%{python3_pkgversion}-six >= 1.4.1
 Requires:       python%{python3_pkgversion}-cffi >= 1.7
 
 %description -n python%{python3_pkgversion}-%{srcname}
 cryptography is a package designed to expose cryptographic primitives and
 recipes to Python developers.
-%endif
 
 %prep
 %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %autosetup -p1 -n %{srcname}-%{version}
+%cargo_prep
+rm -f src/rust/Cargo.lock
 
 %build
-%if 0%{?with_python2}
-%py2_build
-%endif
-%if 0%{?with_python3}
+export CARGO_NET_OFFLINE=true
 %py3_build
-%endif
 
 %install
 # Actually other *.c and *.h are appropriate
 # see https://github.com/pyca/cryptography/issues/1463
 find . -name .keep -print -delete
-
-%if 0%{?with_python2}
-%py2_install
-%endif
-%if 0%{?with_python3}
 %py3_install
-%endif
 
 %check
 %if %{with tests}
-%if 0%{?with_python2}
 # see https://github.com/pyca/cryptography/issues/4885 and
 # see https://bugzilla.redhat.com/show_bug.cgi?id=1761194 for deselected tests
-PYTHONPATH=%{buildroot}%{python2_sitearch} %{__python2} -m pytest -k "not (test_buffer_protocol_alternate_modes or test_dh_parameters_supported or test_load_ecdsa_no_named_curve)"
-%endif
-
-%if 0%{?with_python3}
 PYTHONPATH=%{buildroot}%{python3_sitearch} %{__python3} -m pytest -k "not (test_buffer_protocol_alternate_modes or test_dh_parameters_supported or test_load_ecdsa_no_named_curve)"
 %endif
-%endif
 
-
-%if 0%{?with_python2}
-%files -n python2-%{srcname}
-%doc LICENSE LICENSE.APACHE LICENSE.BSD README.rst docs
-%{python2_sitearch}/%{srcname}
-%{python2_sitearch}/%{srcname}-%{version}-py*.egg-info
-%endif
-
-
-%if 0%{?with_python3}
 %files -n python%{python3_pkgversion}-%{srcname}
 %doc README.rst docs
 %license LICENSE LICENSE.APACHE LICENSE.BSD
 %{python3_sitearch}/%{srcname}
 %{python3_sitearch}/%{srcname}-%{version}-py*.egg-info
-%endif
-
 
 %changelog
+* Sun Feb 07 2021 Christian Heimes <cheimes@redhat.com> - 3.4-1
+- Update to 3.4 (#1925953)
+- Remove Python 2 support
+- Remove unused python-idna dependency
+- Add Rust support
+
 * Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.1-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
 
diff --git a/sources b/sources
index 67acd25..0b150c5 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (cryptography-3.3.1.tar.gz) = 62192fe0fd3bb8844ccc0056ab72a42b038db2a4ecb0928543c520b85e1de93066dab0d604acf23d37395d68172b9618f81c6022a59ec49725bc1862096d15d1
-SHA512 (cryptography-3.3.1.tar.gz.asc) = 5ec77aa93142cafc7b8c4d2ba355da477ac403e73b30740bf4ef42ab8065efb7cc1efa6c007ae67a13b44cf43f715f1cc7fee005bfa89b5a490c0f968a7373ff
+SHA512 (cryptography-3.4.tar.gz) = 5d0d1b62d67e1722f19810738dcae7a9d9ca8b228c06b334486c37d836f20a37332aa59b975d0e4154e4ae91e18546280faf6e18bef8230da42948bc02920c9f
+SHA512 (cryptography-3.4.tar.gz.asc) = c26828fffa3db224d24dc1e4937bdd6061548e53d51a772743570e3896e9f1d0810fcafc8b6ad45c75ac8ebca6e97bf7a86c2de5133438856e6b8a3cafbc22e0