make HMAC work in strict FIPS mode #355
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
tomato42
added
enhancement
tomato42
force-pushed
the
fips-hmac
branch
2 times, most recently
from
606516b
to
6f0327e
Compare
tomato42
changed the title
on new FIPS compliant Python HMAC is implemented as a thin wrapper around openssl implementation of HMAC, that makes it impossible to add a field to the hmac object, but they actually do have the block_size field and set it to correct values
|
I am still getting the following error: |
|
@The-Mule that function should never get the '_hmacopenssl.HMAC' object if the second patch is applied... |
|
Sorry for false alarm. It was human error, thankfully. Anyway, fixes seem to be working fine. Thanks! First commit is simple enough for me to review it. As for second commit (HMAC implementation), is it completely new code or something already reviewed elsewhere? (noticed 2015 in licence headed). |
as new python uses OpenSSL to implement HMAC (so that it is FIPS compliant), using MD5 for HMAC will not work as we need it for older ciphers (and to verify that those old ciphers don't work in FIPS mode) we need to overwrite that limitation
it's new code, fixed |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
on new FIPS compliant Python HMAC is implemented as a thin wrapper around
openssl implementation of HMAC, that makes it impossible to add a
field to the hmac object or use MD5 for hmac-ing in FIPS mode
so re-implement HMAC in pure python (still use native hash implementations)
leave implementation of fallback for later: #356
This change is