New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
hmac algorithm fallback is broken #103256
Labels
3.11
only security fixes
extension-modules
C modules in the Modules dir
topic-SSL
type-bug
An unexpected behavior, bug, or error
Comments
corona10
added a commit
to corona10/cpython
that referenced
this issue
Apr 5, 2023
corona10
added a commit
to corona10/cpython
that referenced
this issue
Apr 5, 2023
corona10
added a commit
that referenced
this issue
Apr 7, 2023
…103286) Co-authored-by: Gregory P. Smith <greg@krypto.org>
miss-islington
pushed a commit
to miss-islington/cpython
that referenced
this issue
Apr 7, 2023
pythongh-103286) (cherry picked from commit efb0a2c) Co-authored-by: Dong-hee Na <donghee.na@python.org> Co-authored-by: Gregory P. Smith <greg@krypto.org>
miss-islington
added a commit
that referenced
this issue
Apr 7, 2023
warsaw
pushed a commit
to warsaw/cpython
that referenced
this issue
Apr 11, 2023
pythongh-103286) Co-authored-by: Gregory P. Smith <greg@krypto.org>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
3.11
only security fixes
extension-modules
C modules in the Modules dir
topic-SSL
type-bug
An unexpected behavior, bug, or error
hmacwon't fall back if OpenSSL is available, the requested algorithm isn't in OpenSSL, but the algorithm is inhashlib.If you [monkey]patch
hashlibto include a new algorithm, you can't use that algorithm fromhmacby name.It appears that the OpenSSL implementation (known as
_hashlibfrom insidehashlib, or_hashopensslfrom insidehmac) doesn't actually return anUnsupportedDigestmodError, but rather it's base classValueError.MRE
# The following is MRE-specific to easily introduce a new name # My use case involves a monkeypatch, but imagine any algorithm NOT implemented by OpenSSL, ONLY by hashlib >>> hashlib.__builtin_constructor_cache['myhashalg'] = hashlib.md5 >>> hashlib.new('myhashalg', b'').digest().hex() # confirm hashlib can use that name 'd41d8cd98f00b204e9800998ecf8427e' >>> hmac.digest(b'key', b'message', 'myhashalg') Traceback (most recent call last): File "<pyshell#nnn>", line 1, in <module> hmac.digest(b'key', b'message', 'myhashalg') File "C:\Python311\Lib\hmac.py", line 198, in digest return _hashopenssl.hmac_digest(key, msg, digest) ValueError: unsupported hash type myhashalgThe exception goes unhandled at
cpython/Lib/hmac.py
Line 199 in 933dfd7
hashlibhandle it.This also shows up in the stateful (non-oneshot) code at
cpython/Lib/hmac.py
Line 61 in 933dfd7
Passing a callable works as intended with my monkeypatch, so I have a workaround. However, I'd argue that either
hmacis trying to catch the wrong thing, or OpenSSL is throwing the wrong thing, so some sort of fix is called for.Environment
Windows 10 64-bit
Python 3.11.2
Possible fixes
_hashopenssl.hmac_digestto correctly raise anUnsupportedDigestmodError(this looks like what was intended, given bpo-40645: use C implementation of HMAC #24920)ValueErrorinstead (asUnsupportedDigestmodErroris derived fromValueErrorthis would work, but may not be what is truly intended)Linked PRs
The text was updated successfully, but these errors were encountered: