Danger

This is a “Hazardous Materials” module. You should ONLY use it if you’re 100% absolutely sure that you know what you’re doing because this module is full of land mines, dragons, and dinosaurs with laser guns.

Message digests (Hashing)

class cryptography.hazmat.primitives.hashes.Hash(algorithm, backend)[source]

A cryptographic hash function takes an arbitrary block of data and calculates a fixed-size bit string (a digest), such that different data results (with a high probability) in different digests.

This is an implementation of HashContext meant to be used with HashAlgorithm implementations to provide an incremental interface to calculating various message digests.

>>> from cryptography.hazmat.backends import default_backend
>>> from cryptography.hazmat.primitives import hashes
>>> digest = hashes.Hash(hashes.SHA256(), backend=default_backend())
>>> digest.update(b"abc")
>>> digest.update(b"123")
>>> digest.finalize()
'l\xa1=R\xcap\xc8\x83\xe0\xf0\xbb\x10\x1eBZ\x89\xe8bM\xe5\x1d\xb2\xd29%\x93\xafj\x84\x11\x80\x90'

If the backend doesn’t support the requested algorithm an UnsupportedAlgorithm exception will be raised.

Keep in mind that attacks against cryptographic hashes only get stronger with time, and that often algorithms that were once thought to be strong, become broken. Because of this it’s important to include a plan for upgrading the hash algorithm you use over time. For more information, see Lifetimes of cryptographic hash functions.

Parameters:
Raises:

cryptography.exceptions.UnsupportedAlgorithm – This is raised if the provided backend does not implement HashBackend

update(data)[source]
Parameters:

data (bytes) – The bytes to be hashed.

Raises:
copy()[source]

Copy this Hash instance, usually so that you may call finalize() to get an intermediate digest value while we continue to call update() on the original instance.

Returns:A new instance of Hash that can be updated and finalized independently of the original instance.
Raises:cryptography.exceptions.AlreadyFinalized – See finalize().
finalize()[source]

Finalize the current context and return the message digest as bytes.

After finalize has been called this object can no longer be used and update(), copy(), and finalize() will raise an AlreadyFinalized exception.

Return bytes:The message digest as bytes.

SHA-2 family

class cryptography.hazmat.primitives.hashes.SHA224[source]

SHA-224 is a cryptographic hash function from the SHA-2 family and is standardized by NIST. It produces a 224-bit message digest.

class cryptography.hazmat.primitives.hashes.SHA256[source]

SHA-256 is a cryptographic hash function from the SHA-2 family and is standardized by NIST. It produces a 256-bit message digest.

class cryptography.hazmat.primitives.hashes.SHA384[source]

SHA-384 is a cryptographic hash function from the SHA-2 family and is standardized by NIST. It produces a 384-bit message digest.

class cryptography.hazmat.primitives.hashes.SHA512[source]

SHA-512 is a cryptographic hash function from the SHA-2 family and is standardized by NIST. It produces a 512-bit message digest.

BLAKE2

BLAKE2 is a cryptographic hash function specified in RFC 7693. BLAKE2’s design makes it immune to length-extension attacks, an advantage over the SHA-family of hashes.

Note

While the RFC specifies keying, personalization, and salting features, these are not supported at this time due to limitations in OpenSSL 1.1.0.

class cryptography.hazmat.primitives.hashes.BLAKE2b(digest_size)[source]

BLAKE2b is optimized for 64-bit platforms and produces an 1 to 64-byte message digest.

Parameters:digest_size (int) – The desired size of the hash output in bytes. Only 64 is supported at this time.
Raises:ValueError – If the digest_size is invalid.
class cryptography.hazmat.primitives.hashes.BLAKE2s(digest_size)[source]

BLAKE2s is optimized for 8 to 32-bit platforms and produces a 1 to 32-byte message digest.

Parameters:digest_size (int) – The desired size of the hash output in bytes. Only 32 is supported at this time.
Raises:ValueError – If the digest_size is invalid.

SHA-1

Warning

SHA-1 is a deprecated hash algorithm that has practical known collision attacks. You are strongly discouraged from using it. Existing applications should strongly consider moving away.

class cryptography.hazmat.primitives.hashes.SHA1[source]

SHA-1 is a cryptographic hash function standardized by NIST. It produces an 160-bit message digest. Cryptanalysis of SHA-1 has demonstrated that it is vulnerable to practical collision attacks, and collisions have been demonstrated.

MD5

Warning

MD5 is a deprecated hash algorithm that has practical known collision attacks. You are strongly discouraged from using it. Existing applications should strongly consider moving away.

class cryptography.hazmat.primitives.hashes.MD5[source]

MD5 is a deprecated cryptographic hash function. It produces a 128-bit message digest and has practical known collision attacks.

Interfaces

class cryptography.hazmat.primitives.hashes.HashAlgorithm[source]
name
Type:str

The standard name for the hash algorithm, for example: "sha256" or "blake2b".

digest_size
Type:int

The size of the resulting digest in bytes.

block_size
Type:int

The internal block size of the hash algorithm in bytes.

class cryptography.hazmat.primitives.hashes.HashContext[source]
algorithm

A HashAlgorithm that will be used by this context.

update(data)[source]
Parameters:data (bytes) – The data you want to hash.
finalize()[source]
Returns:The final digest as bytes.
copy()[source]
Returns:A HashContext that is a copy of the current context.