cpython/Doc/library/hashlib.rst

139 lines
4.7 KiB
ReStructuredText
Raw Normal View History

2007-08-15 11:28:22 -03:00
:mod:`hashlib` --- Secure hashes and message digests
====================================================
.. module:: hashlib
:synopsis: Secure hash and message digest algorithms.
.. moduleauthor:: Gregory P. Smith <greg@users.sourceforge.net>
.. sectionauthor:: Gregory P. Smith <greg@users.sourceforge.net>
.. index::
single: message digest, MD5
single: secure hash algorithm, SHA1, SHA224, SHA256, SHA384, SHA512
This module implements a common interface to many different secure hash and
message digest algorithms. Included are the FIPS secure hash algorithms SHA1,
SHA224, SHA256, SHA384, and SHA512 (defined in FIPS 180-2) as well as RSA's MD5
algorithm (defined in Internet :rfc:`1321`). The terms "secure hash" and
"message digest" are interchangeable. Older algorithms were called message
digests. The modern term is secure hash.
2007-08-15 11:28:22 -03:00
Merged revisions 61538-61540,61556,61559-61560,61563,61565,61571,61575-61576,61580-61582,61586,61591,61593,61595,61605-61606,61613-61616,61618,61621-61623,61625,61627,61631-61634 via svnmerge from svn+ssh://pythondev@svn.python.org/python/trunk ........ r61538 | steven.bethard | 2008-03-18 20:03:50 +0100 (Di, 18 Mär 2008) | 1 line cell_compare needs to return -2 instead of NULL. ........ r61539 | steven.bethard | 2008-03-18 20:04:32 +0100 (Di, 18 Mär 2008) | 1 line _have_soundcard() is a bad check for winsound.Beep, since you can have a soundcard but have the beep driver disabled. This revision basically disables the beep tests by wrapping them in a try/except. The Right Way To Do It is to come up with a _have_enabled_beep_driver() and use that. ........ r61540 | gregory.p.smith | 2008-03-18 20:05:32 +0100 (Di, 18 Mär 2008) | 8 lines Fix chown on 64-bit linux. It needed to take a long (64-bit on 64bit linux) as uid and gid input to accept values >=2**31 as valid while still accepting negative numbers to pass -1 to chown for "no change". Fixes issue1747858. This should be backported to release25-maint. ........ r61556 | steven.bethard | 2008-03-18 20:59:14 +0100 (Di, 18 Mär 2008) | 1 line Fix test_atexit so that it still passes when -3 is supplied. (It was catching the warning messages on stdio from using the reload() function.) ........ r61559 | neal.norwitz | 2008-03-18 21:30:38 +0100 (Di, 18 Mär 2008) | 1 line Import the test properly. This is especially important for py3k. ........ r61560 | gregory.p.smith | 2008-03-18 21:40:01 +0100 (Di, 18 Mär 2008) | 2 lines news entry for the chown fix ........ r61563 | brett.cannon | 2008-03-18 22:12:42 +0100 (Di, 18 Mär 2008) | 2 lines Ignore BIG5HKSCS-2004.TXT which is downloaded as part of a test. ........ r61565 | steven.bethard | 2008-03-18 22:30:13 +0100 (Di, 18 Mär 2008) | 1 line Have regrtest skip test_py3kwarn when the -3 flag is missing. ........ r61571 | gregory.p.smith | 2008-03-18 23:27:41 +0100 (Di, 18 Mär 2008) | 4 lines Add a test to make sure zlib.crc32 and binascii.crc32 return the same thing. Fix a buglet in binascii.crc32, the second optional argument could previously have a signedness mismatch with the C variable its going into. ........ r61575 | raymond.hettinger | 2008-03-19 00:22:29 +0100 (Mi, 19 Mär 2008) | 1 line Speed-up isinstance() for one easy case. ........ r61576 | raymond.hettinger | 2008-03-19 00:33:08 +0100 (Mi, 19 Mär 2008) | 1 line Issue: 2354: Add 3K warning for the cmp argument to list.sort() and sorted(). ........ r61580 | andrew.kuchling | 2008-03-19 02:05:35 +0100 (Mi, 19 Mär 2008) | 1 line Add Jeff Rush ........ r61581 | gregory.p.smith | 2008-03-19 02:38:35 +0100 (Mi, 19 Mär 2008) | 3 lines Mention that crc32 and adler32 are available in a different module (zlib). Some people look for them in hashlib. ........ r61582 | gregory.p.smith | 2008-03-19 02:46:10 +0100 (Mi, 19 Mär 2008) | 3 lines Use zlib's crc32 routine instead of binascii when available. zlib's is faster when compiled properly optimized and about the same speed otherwise. ........ r61586 | david.wolever | 2008-03-19 03:26:57 +0100 (Mi, 19 Mär 2008) | 1 line Added my name to ACKS ........ r61591 | gregory.p.smith | 2008-03-19 04:14:41 +0100 (Mi, 19 Mär 2008) | 5 lines Fix the struct module DeprecationWarnings that zipfile was triggering by removing all use of signed struct values. test_zipfile and test_zipfile64 pass. no more warnings. ........ r61593 | raymond.hettinger | 2008-03-19 04:56:59 +0100 (Mi, 19 Mär 2008) | 1 line Fix compiler warning. ........ r61595 | martin.v.loewis | 2008-03-19 05:39:13 +0100 (Mi, 19 Mär 2008) | 2 lines Issue #2400: Allow relative imports to "import *". ........ r61605 | martin.v.loewis | 2008-03-19 07:00:28 +0100 (Mi, 19 Mär 2008) | 2 lines Import relimport using a relative import. ........ r61606 | trent.nelson | 2008-03-19 07:28:24 +0100 (Mi, 19 Mär 2008) | 1 line Issue2290: Support x64 Windows builds that live in pcbuild/amd64. Without it, sysutils._python_build() returns the wrong directory, which causes the test_get_config_h_filename method in Lib/distutils/tests/test_sysconfig.py to fail. ........ r61613 | trent.nelson | 2008-03-19 08:45:19 +0100 (Mi, 19 Mär 2008) | 3 lines Refine the Visual Studio 2008 build solution in order to improve how we deal with external components, as well as fixing outstanding issues with Windows x64 build support. Introduce two new .vcproj files, _bsddb44.vcproj and sqlite3.vcproj, which replace the previous pre-link event scripts for _bsddb and _sqlite3 respectively. The new project files inherit from our property files as if they were any other Python module. This has numerous benefits. First, the components get built with exactly the same compiler flags and settings as the rest of Python. Second, it makes it much easier to debug problems in the external components when they're part of the build system. Third, they'll benefit from profile guided optimisation in the release builds, just like the rest of Python core. I've also introduced a slightly new pattern for managing externals in subversion. New components get checked in as <name>-<version>.x, where <version> matches the exact vendor version string. After the initial import of the external component, the .x is tagged as .0 (i.e. tcl-8.4.18.x -> tcl-8.4.18.0). Some components may not need any tweaking, whereas there are others that might (tcl/tk fall into this bucket). In that case, the relevant modifications are made to the .x branch, which will be subsequently tagged as .1 (and then n+1 going forward) when they build successfully and all tests pass. Buildbots will be converted to rely on these explicit tags only, which makes it easy for us to switch them over to a new version as and when required. (Simple change to external(-amd64).bat: if we've bumped tcl to 8.4.18.1, change the .bat to rmdir 8.4.18.0 if it exists and check out a new .1 copy.) ........ r61614 | trent.nelson | 2008-03-19 08:56:39 +0100 (Mi, 19 Mär 2008) | 1 line Remove extraneous apostrophe and semi-colon from AdditionalIncludeDirectories. ........ r61615 | georg.brandl | 2008-03-19 08:56:40 +0100 (Mi, 19 Mär 2008) | 2 lines Remove footnote from versionchanged as it upsets LaTeX. ........ r61616 | georg.brandl | 2008-03-19 08:57:57 +0100 (Mi, 19 Mär 2008) | 2 lines Another one. ........ r61618 | trent.nelson | 2008-03-19 09:06:03 +0100 (Mi, 19 Mär 2008) | 1 line Fix the tcl-8.4.18.1 path and make sure we cd into the right directory when building tcl/tk. ........ r61621 | trent.nelson | 2008-03-19 10:23:08 +0100 (Mi, 19 Mär 2008) | 1 line Lets have another try at getting the Windows buildbots in a consistent state before rebuilding using the new process. ........ r61622 | eric.smith | 2008-03-19 13:09:55 +0100 (Mi, 19 Mär 2008) | 2 lines Use test.test_support.captured_stdout instead of a custom contextmanager. Thanks Nick Coghlan. ........ r61623 | eric.smith | 2008-03-19 13:15:10 +0100 (Mi, 19 Mär 2008) | 1 line Trivial typo. ........ r61625 | thomas.heller | 2008-03-19 17:10:57 +0100 (Mi, 19 Mär 2008) | 2 lines Checkout sqlite-source when it is not there. ........ r61627 | brett.cannon | 2008-03-19 17:50:13 +0100 (Mi, 19 Mär 2008) | 5 lines test_nis would fail if test.test_support.verbose was true but NIS was not set up on the machine. Closes issue2411. Thanks Michael Bishop. ........ r61631 | brett.cannon | 2008-03-19 18:37:43 +0100 (Mi, 19 Mär 2008) | 2 lines Use sys.py3kwarning instead of trying to trigger a Py3k-related warning. ........ r61632 | raymond.hettinger | 2008-03-19 18:45:19 +0100 (Mi, 19 Mär 2008) | 1 line Issue 2354: Fix-up compare warning. Patch contributed by Jeff Balogh. ........ r61633 | raymond.hettinger | 2008-03-19 18:58:59 +0100 (Mi, 19 Mär 2008) | 1 line The filter() function does support a None argument in Py3.0. ........ r61634 | raymond.hettinger | 2008-03-19 19:01:58 +0100 (Mi, 19 Mär 2008) | 1 line Remove itertools warnings I had added before the 2-to-3 handled the migration. ........
2008-03-19 18:50:51 -03:00
.. note::
If you want the adler32 or crc32 hash functions they are available in
the :mod:`zlib` module.
2007-08-15 11:28:22 -03:00
.. warning::
Some algorithms have known hash collision weaknesses, see the FAQ at the end.
There is one constructor method named for each type of :dfn:`hash`. All return
a hash object with the same simple interface. For example: use :func:`sha1` to
create a SHA1 hash object. You can now feed this object with objects conforming
to the buffer interface (normally :class:`bytes` objects) using the
:meth:`update` method. At any point you can ask it for the :dfn:`digest` of the
concatenation of the data fed to it so far using the :meth:`digest` or
:meth:`hexdigest` methods.
.. note::
Feeding string objects is to :meth:`update` is not supported, as hashes work
on bytes, not on characters.
2007-08-15 11:28:22 -03:00
Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from svn+ssh://pythondev@svn.python.org/python/trunk ........ r58096 | brett.cannon | 2007-09-10 23:38:27 +0200 (Mon, 10 Sep 2007) | 4 lines Fix a possible segfault from recursing too deep to get the repr of a list. Closes issue #1096. ........ r58097 | bill.janssen | 2007-09-10 23:51:02 +0200 (Mon, 10 Sep 2007) | 33 lines More work on SSL support. * Much expanded test suite: All protocols tested against all other protocols. All protocols tested with all certificate options. Tests for bad key and bad cert. Test of STARTTLS functionality. Test of RAND_* functions. * Fixes for threading/malloc bug. * Issue 1065 fixed: sslsocket class renamed to SSLSocket. sslerror class renamed to SSLError. Function "wrap_socket" now used to wrap an existing socket. * Issue 1583946 finally fixed: Support for subjectAltName added. Subject name now returned as proper DN list of RDNs. * SSLError exported from socket as "sslerror". * RAND_* functions properly exported from ssl.py. * Documentation improved: Example of how to create a self-signed certificate. Better indexing. ........ r58098 | guido.van.rossum | 2007-09-11 00:02:25 +0200 (Tue, 11 Sep 2007) | 9 lines Patch # 1140 (my code, approved by Effbot). Make sure the type of the return value of re.sub(x, y, z) is the type of y+x (i.e. unicode if either is unicode, str if they are both str) even if there are no substitutions or if x==z (which triggered various special cases in join_list()). Could be backported to 2.5; no need to port to 3.0. ........ r58099 | guido.van.rossum | 2007-09-11 00:36:02 +0200 (Tue, 11 Sep 2007) | 8 lines Patch # 1026 by Benjamin Aranguren (with Alex Martelli): Backport abc.py and isinstance/issubclass overloading to 2.6. I had to backport test_typechecks.py myself, and make one small change to abc.py to avoid duplicate work when x.__class__ and type(x) are the same. ........ r58100 | bill.janssen | 2007-09-11 01:41:24 +0200 (Tue, 11 Sep 2007) | 3 lines A better way of finding an open port to test with. ........ r58101 | bill.janssen | 2007-09-11 03:09:19 +0200 (Tue, 11 Sep 2007) | 4 lines Make sure test_ssl doesn't reference the ssl module in a context where it can't be imported. ........ r58102 | bill.janssen | 2007-09-11 04:42:07 +0200 (Tue, 11 Sep 2007) | 3 lines Fix some documentation bugs. ........ r58103 | nick.coghlan | 2007-09-11 16:01:18 +0200 (Tue, 11 Sep 2007) | 1 line Always use the -E flag when spawning subprocesses in test_cmd_line (Issue 1056) ........ r58106 | thomas.heller | 2007-09-11 21:17:48 +0200 (Tue, 11 Sep 2007) | 3 lines Disable some tests that fail on the 'ppc Debian unstable' buildbot to find out if they cause the segfault on the 'alpha Debian' machine. ........ r58108 | brett.cannon | 2007-09-11 23:02:28 +0200 (Tue, 11 Sep 2007) | 6 lines Generators had their throw() method allowing string exceptions. That's a no-no. Fixes issue #1147. Need to fix 2.5 to raise a proper warning if a string exception is passed in. ........ r58112 | georg.brandl | 2007-09-12 20:03:51 +0200 (Wed, 12 Sep 2007) | 3 lines New documentation page for the bdb module. (This doesn't need to be merged to Py3k.) ........ r58114 | georg.brandl | 2007-09-12 20:05:57 +0200 (Wed, 12 Sep 2007) | 2 lines Bug #1152: use non-deprecated name in example. ........ r58115 | georg.brandl | 2007-09-12 20:08:33 +0200 (Wed, 12 Sep 2007) | 2 lines Fix #1122: wrong return type documented for various _Size() functions. ........ r58117 | georg.brandl | 2007-09-12 20:10:56 +0200 (Wed, 12 Sep 2007) | 2 lines Fix #1139: PyFile_Encoding really is PyFile_SetEncoding. ........ r58119 | georg.brandl | 2007-09-12 20:29:18 +0200 (Wed, 12 Sep 2007) | 2 lines bug #1154: release memory allocated by "es" PyArg_ParseTuple format specifier. ........ r58121 | bill.janssen | 2007-09-12 20:52:05 +0200 (Wed, 12 Sep 2007) | 1 line root certificate for https://svn.python.org/, used in test_ssl ........ r58122 | georg.brandl | 2007-09-12 21:00:07 +0200 (Wed, 12 Sep 2007) | 3 lines Bug #1153: repr.repr() now doesn't require set and dictionary items to be orderable to properly represent them. ........ r58125 | georg.brandl | 2007-09-12 21:29:28 +0200 (Wed, 12 Sep 2007) | 4 lines #1120: put explicit version in the shebang lines of pydoc, idle and smtpd.py scripts that are installed by setup.py. That way, they work when only "make altinstall" is used. ........ r58139 | mark.summerfield | 2007-09-13 16:54:30 +0200 (Thu, 13 Sep 2007) | 9 lines Replaced variable o with obj in operator.rst because o is easy to confuse. Added a note about Python 3's collections.Mapping etc., above section that describes isMappingType() etc. Added xrefs between os, os.path, fileinput, and open(). ........ r58143 | facundo.batista | 2007-09-13 20:13:15 +0200 (Thu, 13 Sep 2007) | 7 lines Merged the decimal-branch (revisions 54886 to 58140). Decimal is now fully updated to the latests Decimal Specification (v1.66) and the latests test cases (v2.56). Thanks to Mark Dickinson for all his help during this process. ........ r58145 | facundo.batista | 2007-09-13 20:42:09 +0200 (Thu, 13 Sep 2007) | 7 lines Put the parameter watchexp back in (changed watchexp from an int to a bool). Also second argument to watchexp is now converted to Decimal, just as with all the other two-argument operations. Thanks Mark Dickinson. ........ r58147 | andrew.kuchling | 2007-09-14 00:49:34 +0200 (Fri, 14 Sep 2007) | 1 line Add various items ........ r58148 | andrew.kuchling | 2007-09-14 00:50:10 +0200 (Fri, 14 Sep 2007) | 1 line Make target unique ........ r58154 | facundo.batista | 2007-09-14 20:58:34 +0200 (Fri, 14 Sep 2007) | 3 lines Included the new functions, and new descriptions. ........ r58155 | thomas.heller | 2007-09-14 21:40:35 +0200 (Fri, 14 Sep 2007) | 2 lines ctypes.util.find_library uses dump(1) instead of objdump(1) on Solaris. Fixes issue #1777530; will backport to release25-maint. ........ r58159 | facundo.batista | 2007-09-14 23:29:52 +0200 (Fri, 14 Sep 2007) | 3 lines Some additions (examples and a bit on the tutorial). ........ r58160 | georg.brandl | 2007-09-15 18:53:36 +0200 (Sat, 15 Sep 2007) | 2 lines Remove bdb from the "undocumented modules" list. ........ r58164 | bill.janssen | 2007-09-17 00:06:00 +0200 (Mon, 17 Sep 2007) | 15 lines Add support for asyncore server-side SSL support. This requires adding the 'makefile' method to ssl.SSLSocket, and importing the requisite fakefile class from socket.py, and making the appropriate changes to it to make it use the SSL connection. Added sample HTTPS server to test_ssl.py, and test that uses it. Change SSL tests to use https://svn.python.org/, instead of www.sf.net and pop.gmail.com. Added utility function to ssl module, get_server_certificate, to wrap up the several things to be done to pull a certificate from a remote server. ........ r58173 | bill.janssen | 2007-09-17 01:16:46 +0200 (Mon, 17 Sep 2007) | 1 line use binary mode when reading files for testAsyncore to make Windows happy ........ r58175 | raymond.hettinger | 2007-09-17 02:55:00 +0200 (Mon, 17 Sep 2007) | 7 lines Sync-up named tuples with the latest version of the ASPN recipe. Allows optional commas in the field-name spec (help when named tuples are used in conjuction with sql queries). Adds the __fields__ attribute for introspection and to support conversion to dictionary form. Adds a __replace__() method similar to str.replace() but using a named field as a target. Clean-up spelling and presentation in doc-strings. ........ r58176 | brett.cannon | 2007-09-17 05:28:34 +0200 (Mon, 17 Sep 2007) | 5 lines Add a bunch of GIL release/acquire points in tp_print implementations and for PyObject_Print(). Closes issue #1164. ........ r58177 | sean.reifschneider | 2007-09-17 07:45:04 +0200 (Mon, 17 Sep 2007) | 2 lines issue1597011: Fix for bz2 module corner-case error due to error checking bug. ........ r58180 | facundo.batista | 2007-09-17 18:26:50 +0200 (Mon, 17 Sep 2007) | 3 lines Decimal is updated, :) ........ r58181 | facundo.batista | 2007-09-17 19:30:13 +0200 (Mon, 17 Sep 2007) | 5 lines The methods always return Decimal classes, even if they're executed through a subclass (thanks Mark Dickinson). Added a bit of testing for this. ........ r58183 | sean.reifschneider | 2007-09-17 22:53:21 +0200 (Mon, 17 Sep 2007) | 2 lines issue1082: Fixing platform and system for Vista. ........ r58185 | andrew.kuchling | 2007-09-18 03:36:16 +0200 (Tue, 18 Sep 2007) | 1 line Add item; sort properly ........ r58186 | raymond.hettinger | 2007-09-18 05:33:19 +0200 (Tue, 18 Sep 2007) | 1 line Handle corner cased on 0-tuples and 1-tuples. Add verbose option so people can see how it works. ........ r58192 | georg.brandl | 2007-09-18 09:24:40 +0200 (Tue, 18 Sep 2007) | 2 lines A bit of reordering, also show more subheadings in the lang ref index. ........ r58193 | facundo.batista | 2007-09-18 18:53:18 +0200 (Tue, 18 Sep 2007) | 4 lines Speed up of the various division operations (remainder, divide, divideint and divmod). Thanks Mark Dickinson. ........ r58197 | raymond.hettinger | 2007-09-19 00:18:02 +0200 (Wed, 19 Sep 2007) | 1 line Cleanup docs for NamedTuple. ........
2007-09-19 00:06:30 -03:00
.. index:: single: OpenSSL; (use in module hashlib)
2007-08-15 11:28:22 -03:00
Constructors for hash algorithms that are always present in this module are
:func:`md5`, :func:`sha1`, :func:`sha224`, :func:`sha256`, :func:`sha384`, and
:func:`sha512`. Additional algorithms may also be available depending upon the
OpenSSL library that Python uses on your platform.
For example, to obtain the digest of the byte string ``b'Nobody inspects the
spammish repetition'``::
2007-08-15 11:28:22 -03:00
>>> import hashlib
>>> m = hashlib.md5()
>>> m.update(b"Nobody inspects")
>>> m.update(b" the spammish repetition")
2007-08-15 11:28:22 -03:00
>>> m.digest()
b'\xbbd\x9c\x83\xdd\x1e\xa5\xc9\xd9\xde\xc9\xa1\x8d\xf0\xff\xe9'
>>> m.digest_size
16
>>> m.block_size
64
2007-08-15 11:28:22 -03:00
More condensed::
>>> hashlib.sha224(b"Nobody inspects the spammish repetition").hexdigest()
b'a4337bc45a8fc544c03f52dc550cd6e1e87021bc896588bd79e901e2'
2007-08-15 11:28:22 -03:00
A generic :func:`new` constructor that takes the string name of the desired
algorithm as its first parameter also exists to allow access to the above listed
hashes as well as any other algorithms that your OpenSSL library may offer. The
named constructors are much faster than :func:`new` and should be preferred.
Using :func:`new` with an algorithm provided by OpenSSL::
>>> h = hashlib.new('ripemd160')
>>> h.update(b"Nobody inspects the spammish repetition")
2007-08-15 11:28:22 -03:00
>>> h.hexdigest()
b'cc4a5ce1b3df48aec5d22d1f16b894a0b894eccc'
2007-08-15 11:28:22 -03:00
The following values are provided as constant attributes of the hash objects
returned by the constructors:
.. data:: digest_size
The size of the resulting hash in bytes.
.. data:: block_size
The internal block size of the hash algorithm in bytes.
2007-08-15 11:28:22 -03:00
A hash object has the following methods:
.. method:: hash.update(arg)
Update the hash object with the object *arg*, which must be interpretable as
a buffer of bytes. Repeated calls are equivalent to a single call with the
concatenation of all the arguments: ``m.update(a); m.update(b)`` is
equivalent to ``m.update(a+b)``.
2007-08-15 11:28:22 -03:00
.. method:: hash.digest()
Return the digest of the data passed to the :meth:`update` method so far.
This is a bytes array of size :attr:`digest_size` which may contain bytes in
the whole range from 0 to 255.
2007-08-15 11:28:22 -03:00
.. method:: hash.hexdigest()
Like :meth:`digest` except the digest is returned as a string object of
double length, containing only hexadecimal digits. This may be used to
exchange the value safely in email or other non-binary environments.
2007-08-15 11:28:22 -03:00
.. method:: hash.copy()
Return a copy ("clone") of the hash object. This can be used to efficiently
compute the digests of data sharing a common initial substring.
2007-08-15 11:28:22 -03:00
.. seealso::
Module :mod:`hmac`
A module to generate message authentication codes using hashes.
Module :mod:`base64`
Another way to encode binary hashes for non-binary environments.
http://csrc.nist.gov/publications/fips/fips180-2/fips180-2.pdf
The FIPS 180-2 publication on Secure Hash Algorithms.
http://www.cryptography.com/cnews/hash.html
Hash Collision FAQ with information on which algorithms have known issues and
what that means regarding their use.