NotificationsYou must be signed in to change notification settings
Fork33.3k
Star69.7k

Commit2bb7fb6

committed

always fallback to the pure Python implementation

1 parent1082bd5 commit2bb7fb6Copy full SHA for 2bb7fb6

File tree

3 files changed

+26

-33

lines changed

Lib
- hmac.py
- test
  - test_hmac.py
Misc/NEWS.d/next/Library
- 2025-07-21-11-56-47.gh-issue-136912.zWosAL.rst

3 files changed

+26

-33

lines changed

`‎Lib/hmac.py‎`

Lines changed: 12 additions & 10 deletions

Original file line number	Diff line number	Diff line change
`@@ -242,22 +242,24 @@ def digest(key, msg, digest):`
`242`	`242`	`try:`
`243`	`243`	`return_hashopenssl.hmac_digest(key,msg,digest)`
`244`	`244`	`exceptOverflowError:`
`245`		`-try:`
`246`		`-return_hashopenssl.hmac_new(key,msg,digest).digest()`
`247`		`-except_hashopenssl.UnsupportedDigestmodError:`
`248`		`-pass`
	`245`	`+# OpenSSL's HMAC limits the size of the key to INT_MAX.`
	`246`	`+# Instead of falling back to HACL* implementation which`
	`247`	`+# may still not be supported due to a too large key, we`
	`248`	`+# directly switch to the pure Python fallback instead`
	`249`	`+# even if we could have used streaming HMAC for small keys`
	`250`	`+# but large messages.`
	`251`	`+return_compute_digest_fallback(key,msg,digest)`
`249`	`252`	`except_hashopenssl.UnsupportedDigestmodError:`
`250`	`253`	`pass`
`251`	`254`
`252`	`255`	`if_hmacandisinstance(digest,str):`
`253`	`256`	`try:`
`254`	`257`	`return_hmac.compute_digest(key,msg,digest)`
`255`		`-exceptOverflowError:`
`256`		`-try:`
`257`		`-return_hmac.new(key,msg,digest).digest()`
`258`		`-except_hmac.UnknownHashError:`
`259`		`-pass`
`260`		`-except_hmac.UnknownHashError:`
	`258`	`+except (OverflowError,_hmac.UnknownHashError):`
	`259`	`+# HACL* HMAC limits the size of the key to UINT32_MAX`
	`260`	`+# so we fallback to the pure Python implementation even`
	`261`	`+# if streaming HMAC may have been used for small keys`
	`262`	`+# and large messages.`
`261`	`263`	`pass`
`262`	`264`
`263`	`265`	`return_compute_digest_fallback(key,msg,digest)`

`‎Lib/test/test_hmac.py‎`

Lines changed: 12 additions & 21 deletions

Original file line number	Diff line number	Diff line change
`@@ -1506,37 +1506,28 @@ def test_with_fallback(self):`
`1506`	`1506`	`@hashlib_helper.requires_openssl_hashdigest("md5")`
`1507`	`1507`	`@bigmemtest(size=_4G,memuse=2,dry_run=False)`
`1508`	`1508`	`deftest_hmac_digest_overflow_error_openssl_only(self,size):`
`1509`		`-self.do_test_hmac_digest_overflow_error_fast(size,openssl=True)`
	`1509`	`+hmac=import_fresh_module("hmac",blocked=["_hmac"])`
	`1510`	`+self.do_test_hmac_digest_overflow_error_switch_to_slow(hmac,size)`
`1510`	`1511`
`1511`	`1512`	`@hashlib_helper.requires_builtin_hashdigest("_md5","md5")`
`1512`	`1513`	`@bigmemtest(size=_4G ,memuse=2,dry_run=False)`
`1513`	`1514`	`deftest_hmac_digest_overflow_error_builtin_only(self,size):`
`1514`		`-self.do_test_hmac_digest_overflow_error_fast(size,openssl=False)`
`1515`		`-`
`1516`		`-defdo_test_hmac_digest_overflow_error_fast(self,size,*,openssl):`
`1517`		`-"""Check that C hmac.digest() works for large inputs."""`
`1518`		`-`
`1519`		`-ifopenssl:`
`1520`		`-hmac=import_fresh_module("hmac",blocked=["_hashlib"])`
`1521`		`-c_module_name,c_method_name="_hmac","new"`
`1522`		`-else:`
`1523`		`-hmac=import_fresh_module("hmac",blocked=["_hmac"])`
`1524`		`-c_module_name,c_method_name="_hashlib","hmac_new"`
	`1515`	`+hmac=import_fresh_module("hmac",blocked=["_hashlib"])`
	`1516`	`+self.do_test_hmac_digest_overflow_error_switch_to_slow(hmac,size)`
`1525`	`1517`
`1526`		`-cext=import_helper.import_module(c_module_name)`
`1527`		`-cnew=getattr(cext,c_method_name)`
	`1518`	`+defdo_test_hmac_digest_overflow_error_switch_to_slow(self,hmac,size):`
	`1519`	`+"""Check that hmac.digest() falls back to pure Python."""`
`1528`	`1520`
`1529`	`1521`	`bigkey=b'K'*size`
`1530`	`1522`	`bigmsg=b'M'*size`
`1531`	`1523`
`1532`	`1524`	`withpatch.object(hmac,"_compute_digest_fallback")asslow:`
`1533`		`-withpatch.object(cext,c_method_name,wraps=cnew)asnew:`
`1534`		`-self.assertIsInstance(hmac.digest(bigkey,b'm',"md5"),bytes)`
`1535`		`-new.assert_called_once()`
`1536`		`-withpatch.object(cext,c_method_name,wraps=cnew)asnew:`
`1537`		`-self.assertIsInstance(hmac.digest(b'k',bigmsg,"md5"),bytes)`
`1538`		`-new.assert_called_once()`
`1539`		`-slow.assert_not_called()`
	`1525`	`+self.assertIsInstance(hmac.digest(bigkey,b'm',"md5"),bytes)`
	`1526`	`+slow.assert_called_once()`
	`1527`	`+`
	`1528`	`+withpatch.object(hmac,"_compute_digest_fallback")asslow:`
	`1529`	`+self.assertIsInstance(hmac.digest(b'k',bigmsg,"md5"),bytes)`
	`1530`	`+slow.assert_called_once()`
`1540`	`1531`
`1541`	`1532`	`@hashlib_helper.requires_hashdigest("md5",openssl=True)`
`1542`	`1533`	`@bigmemtest(size=_4G,memuse=2,dry_run=False)`

`‎Misc/NEWS.d/next/Library/2025-07-21-11-56-47.gh-issue-136912.zWosAL.rst‎`

Lines changed: 2 additions & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -1,2 +1,2 @@`
`1`		-One-shot:func:`hmac.digest` now properly handles large keys and messages
`2`		-by delegating to:func:`hmac.new` when possible.Patch by Bénédikt Tran.
	`1`	+One-shot:func:`hmac.digest` now properly handles large keys and messages.
	`2`	`+Patch by Bénédikt Tran.`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Commit2bb7fb6

File tree

3 files changed

3 files changed

`‎Lib/hmac.py‎`

`‎Lib/test/test_hmac.py‎`

`‎Misc/NEWS.d/next/Library/2025-07-21-11-56-47.gh-issue-136912.zWosAL.rst‎`

0 commit comments