Skip to content

[doc] hmac cannot be used with shake algorithms #72570

Closed
Closed
[doc] hmac cannot be used with shake algorithms#72570
Assignees
picnixz
Labels
docsDocumentation in the Doc dir

Description

@minrk
minrk
mannequin
opened on Oct 7, 2016
BPO 28384
Nosy @tiran, @takluyver, @minrk

Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

Show more details

GitHub fields:

assignee = None
closed_at = None
created_at = <Date 2016-10-07.11:50:44.279>
labels = ['type-bug', '3.9', '3.10', '3.11', 'extension-modules', 'docs']
title = '[doc] hmac cannot be used with shake algorithms'
updated_at = <Date 2022-01-17.23:14:46.268>
user = 'https://github.com/minrk'

bugs.python.org fields:

activity = <Date 2022-01-17.23:14:46.268>
actor = 'iritkatriel'
assignee = 'docs@python'
closed = False
closed_date = None
closer = None
components = ['Documentation', 'Extension Modules']
creation = <Date 2016-10-07.11:50:44.279>
creator = 'minrk'
dependencies = []
files = []
hgrepos = []
issue_num = 28384
keywords = []
message_count = 2.0
messages = ['278235', '278468']
nosy_count = 4.0
nosy_names = ['christian.heimes', 'docs@python', 'takluyver', 'minrk']
pr_nums = []
priority = 'normal'
resolution = None
stage = None
status = 'open'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue28384'
versions = ['Python 3.9', 'Python 3.10', 'Python 3.11']

Linked PRs

Activity

  1. minrk commented on Oct 7, 2016

    @minrk
    minrkmannequin
    on Oct 7, 2016
    MannequinAuthor

    HMAC digest methods call inner.digest() with no arguments, but new-in-3.6 shake algorithms require a length argument.

    possible solutions:

    1. add optional length argument to HMAC.[hex]digest, and pass through to inner hash object
    2. set hmac.digest_size, and use that to pass through to inner hash object if inner hash object has digest_size == 0
    3. give shake hashers a default value for length in digest methods (logically 32 for shake_256, 16 for shake_128, I think)

    test:

    import hmac, hashlib

h = hmac.HMAC(b'secret', digestmod=hashlib.shake_256)
h.hexdigest() # raises on self.inner.digest() requires length argument
  2. minrk
    added
    3.7 (EOL)end of life
    on Oct 7, 2016
  3. SilentGhost
    added
    extension-modulesC modules in the Modules dir
    type-bugAn unexpected behavior, bug, or error
    on Oct 7, 2016

  4. tiran commented on Oct 11, 2016

    @tiran
    tiran
    on Oct 11, 2016
    Member

    It's not a bug, but indented behavior. It does not make any sense to use SHAKE with the HMAC construct. In fact it does not make sense to combine Keccak sponge or Blake2 with HMAC at all. HMAC is only necessary for old, Merkle-Damgard hashing algorithms like MD5, SHA1 and SHA2, because they are subject to length extension attacks.

    The correct solution is
    4. improve documentation

  5. iritkatriel
    added
    3.9 (EOL)end of life
    3.10 (EOL)end of life
    3.11only security fixes
    docsDocumentation in the Doc dir
    and removed
    3.7 (EOL)end of life
    on Jan 17, 2022
  6. iritkatriel
    changed the title [-]hmac cannot be used with shake algorithms[/-] [+][doc] hmac cannot be used with shake algorithms[/+] on Jan 17, 2022
  7. iritkatriel
    assigned
    docspython
    on Jan 17, 2022
  8. ezio-melotti
    transferred this issue fromon Apr 10, 2022
  9. picnixz
    removed
    type-bugAn unexpected behavior, bug, or error
    extension-modulesC modules in the Modules dir
    on Jul 15, 2025

  10. 1 remaining item

  11. picnixz
    removed
    3.10 (EOL)end of life
    3.9 (EOL)end of life
    on Jul 15, 2025
  12. picnixz
    self-assigned this
    on Jul 15, 2025
  13. github-project-automation
    moved this to Todo in docs issueson Jul 15, 2025
  14. github-project-automation
    added this to docs issueson Jul 15, 2025
  15. picnixz
    added a commit that references this issue on Jul 15, 2025

    gh-72570: mention the incompatibility of XOFs with HMAC (#136676)

    a02cf19
  16. miss-islington
    added 2 commits that reference this issue on Jul 15, 2025

    pythongh-72570: mention the incompatibility of XOFs with HMAC (python…

    a4aea49

    pythongh-72570: mention the incompatibility of XOFs with HMAC (python…

    bc07959

  17. picnixz commented on Jul 15, 2025

    @picnixz
    picnixz
    on Jul 15, 2025
    Member

    Now that I've improved the docs, I'll also need to make the interface consistent (because if we use the pure Python HMAC, we raise a TypeError instead of a ValueError) but this will be a separate issue.

  18. picnixz
    added 2 commits that reference this issue on Jul 15, 2025

    [3.14] gh-72570: mention the incompatibility of XOFs with HMAC (GH-13…

    45b72c4

    [3.13] gh-72570: mention the incompatibility of XOFs with HMAC (GH-13…

    8517a89
  19. picnixz
    closed this as completedon Jul 15, 2025
  20. taegyunkim
    added a commit that references this issue on Aug 4, 2025

    pythongh-72570: mention the incompatibility of XOFs with HMAC (python…

    dc38a82
  21. Agent-Hellboy
    added a commit that references this issue on Aug 19, 2025

    pythongh-72570: mention the incompatibility of XOFs with HMAC (python…

    8f670a1
  22. kumaraditya303
    added a commit that references this issue on Sep 9, 2025

    [3.14] pythongh-72570: mention the incompatibility of XOFs with HMAC (p…

    a31ccb8
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

docsDocumentation in the Doc dir

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions