Skip to content

hmac algorithm fallback is broken #103256

Closed
Closed

Description

@geitda

hmac won't fall back if OpenSSL is available, the requested algorithm isn't in OpenSSL, but the algorithm is in hashlib.
If you [monkey]patch hashlib to include a new algorithm, you can't use that algorithm from hmac by name.
It appears that the OpenSSL implementation (known as _hashlib from inside hashlib, or _hashopenssl from inside hmac) doesn't actually return an UnsupportedDigestmodError, but rather it's base class ValueError.

MRE

# The following is MRE-specific to easily introduce a new name
# My use case involves a monkeypatch, but imagine any algorithm NOT implemented by OpenSSL, ONLY by hashlib
>>> hashlib.__builtin_constructor_cache['myhashalg'] = hashlib.md5
>>> hashlib.new('myhashalg', b'').digest().hex() # confirm hashlib can use that name
'd41d8cd98f00b204e9800998ecf8427e'
>>> hmac.digest(b'key', b'message', 'myhashalg')
Traceback (most recent call last):
  File "<pyshell#nnn>", line 1, in <module>
    hmac.digest(b'key', b'message', 'myhashalg')
  File "C:\Python311\Lib\hmac.py", line 198, in digest
    return _hashopenssl.hmac_digest(key, msg, digest)
ValueError: unsupported hash type myhashalg

The exception goes unhandled at

except _hashopenssl.UnsupportedDigestmodError:
instead of falling through to let hashlib handle it.

This also shows up in the stateful (non-oneshot) code at

except _hashopenssl.UnsupportedDigestmodError:

Passing a callable works as intended with my monkeypatch, so I have a workaround. However, I'd argue that either hmac is trying to catch the wrong thing, or OpenSSL is throwing the wrong thing, so some sort of fix is called for.

Environment

Windows 10 64-bit
Python 3.11.2

Possible fixes

Linked PRs

Activity

  1. added
    type-bugAn unexpected behavior, bug, or error
    on Apr 4, 2023
  2. added 2 commits that reference this issue on Apr 5, 2023
  3. self-assigned this
    on Apr 7, 2023
  4. added a commit that references this issue on Apr 7, 2023
  5. added 2 commits that reference this issue on Apr 7, 2023
  6. added a commit that references this issue on Apr 11, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Labels

3.11only security fixesextension-modulesC modules in the Modules dirtopic-SSLtype-bugAn unexpected behavior, bug, or error

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions