Danger

This is a “Hazardous Materials” module. You should ONLY use it if you’re 100% absolutely sure that you know what you’re doing because this module is full of land mines, dragons, and dinosaurs with laser guns.

# Message digests (Hashing)

class cryptography.hazmat.primitives.hashes.Hash(algorithm, backend=None)

  A cryptographic hash function takes an arbitrary block of data and calculates a fixed-size bit string (a digest), such that different data results (with a high probability) in different digests.

  This is an implementation of `HashContext` meant to be used with `HashAlgorithm` implementations to provide an incremental interface to calculating various message digests.

      >>> from cryptography.hazmat.primitives import hashes
      >>> digest = hashes.Hash(hashes.SHA256())
      >>> digest.update(b"abc")
      >>> digest.update(b"123")
      >>> digest.finalize()
      b'l\xa1=R\xcap\xc8\x83\xe0\xf0\xbb\x10\x1eBZ\x89\xe8bM\xe5\x1d\xb2\xd29%\x93\xafj\x84\x11\x80\x90'

  If the backend doesn’t support the requested `algorithm` an `UnsupportedAlgorithm` exception will be raised.

  Keep in mind that attacks against cryptographic hashes only get stronger with time, and that often algorithms that were once thought to be strong, become broken. Because of this it’s important to include a plan for upgrading the hash algorithm you use over time. For more information, see Lifetimes of cryptographic hash functions.

  Parameters

    - algorithm – A `HashAlgorithm` instance such as those described in below.

    - backend – An optional `HashBackend` instance.

  Raises

    cryptography.exceptions.UnsupportedAlgorithm – This is raised if the provided `backend` does not implement `HashBackend`

  update(data)
    Parameters

      data (bytes) – The bytes to be hashed.

    Raises

      - cryptography.exceptions.AlreadyFinalized – See `finalize()`.

      - TypeError – This exception is raised if `data` is not `bytes`.

  copy()

    Copy this `Hash` instance, usually so that you may call `finalize()` to get an intermediate digest value while we continue to call `update()` on the original instance.

    Returns

      A new instance of `Hash` that can be updated and finalized independently of the original instance.

    Raises

      cryptography.exceptions.AlreadyFinalized – See `finalize()`.

  finalize()

    Finalize the current context and return the message digest as bytes.

    After `finalize` has been called this object can no longer be used and `update()`, `copy()`, and `finalize()` will raise an `AlreadyFinalized` exception.

    Return bytes

      The message digest as bytes.

## SHA-2 family

class cryptography.hazmat.primitives.hashes.SHA224

  SHA-224 is a cryptographic hash function from the SHA-2 family and is standardized by NIST. It produces a 224-bit message digest.

class cryptography.hazmat.primitives.hashes.SHA256

  SHA-256 is a cryptographic hash function from the SHA-2 family and is standardized by NIST. It produces a 256-bit message digest.

class cryptography.hazmat.primitives.hashes.SHA384

  SHA-384 is a cryptographic hash function from the SHA-2 family and is standardized by NIST. It produces a 384-bit message digest.

class cryptography.hazmat.primitives.hashes.SHA512

  SHA-512 is a cryptographic hash function from the SHA-2 family and is standardized by NIST. It produces a 512-bit message digest.

class cryptography.hazmat.primitives.hashes.SHA512_224

  New in version 2.5.

  SHA-512/224 is a cryptographic hash function from the SHA-2 family and is standardized by NIST. It produces a 224-bit message digest.

class cryptography.hazmat.primitives.hashes.SHA512_256

  New in version 2.5.

  SHA-512/256 is a cryptographic hash function from the SHA-2 family and is standardized by NIST. It produces a 256-bit message digest.

## BLAKE2

BLAKE2 is a cryptographic hash function specified in RFC 7693. BLAKE2’s design makes it immune to length-extension attacks, an advantage over the SHA-family of hashes.

Note

While the RFC specifies keying, personalization, and salting features, these are not supported at this time due to limitations in OpenSSL 1.1.0.

class cryptography.hazmat.primitives.hashes.BLAKE2b(digest_size)

  BLAKE2b is optimized for 64-bit platforms and produces an 1 to 64-byte message digest.

  Parameters

    digest_size (int) – The desired size of the hash output in bytes. Only `64` is supported at this time.

  Raises

    ValueError – If the `digest_size` is invalid.

class cryptography.hazmat.primitives.hashes.BLAKE2s(digest_size)

  BLAKE2s is optimized for 8 to 32-bit platforms and produces a 1 to 32-byte message digest.

  Parameters

    digest_size (int) – The desired size of the hash output in bytes. Only `32` is supported at this time.

  Raises

    ValueError – If the `digest_size` is invalid.

## SHA-3 family

SHA-3 is the most recent NIST secure hash algorithm standard. Despite the larger number SHA-3 is not considered to be better than SHA-2. Instead, it uses a significantly different internal structure so that if an attack appears against SHA-2 it is unlikely to apply to SHA-3. SHA-3 is significantly slower than SHA-2 so at this time most users should choose SHA-2.

class cryptography.hazmat.primitives.hashes.SHA3_224

  New in version 2.5.

  SHA3/224 is a cryptographic hash function from the SHA-3 family and is standardized by NIST. It produces a 224-bit message digest.

class cryptography.hazmat.primitives.hashes.SHA3_256

  New in version 2.5.

  SHA3/256 is a cryptographic hash function from the SHA-3 family and is standardized by NIST. It produces a 256-bit message digest.

class cryptography.hazmat.primitives.hashes.SHA3_384

  New in version 2.5.

  SHA3/384 is a cryptographic hash function from the SHA-3 family and is standardized by NIST. It produces a 384-bit message digest.

class cryptography.hazmat.primitives.hashes.SHA3_512

  New in version 2.5.

  SHA3/512 is a cryptographic hash function from the SHA-3 family and is standardized by NIST. It produces a 512-bit message digest.

class cryptography.hazmat.primitives.hashes.SHAKE128(digest_size)

  New in version 2.5.

  SHAKE128 is an extendable output function (XOF) based on the same core permutations as SHA3. It allows the caller to obtain an arbitrarily long digest length. Longer lengths, however, do not increase security or collision resistance and lengths shorter than 128 bit (16 bytes) will decrease it.

  Parameters

    digest_size (int) – The length of output desired. Must be greater than zero.

  Raises

    ValueError – If the `digest_size` is invalid.

class cryptography.hazmat.primitives.hashes.SHAKE256(digest_size)

  New in version 2.5.

  SHAKE256 is an extendable output function (XOF) based on the same core permutations as SHA3. It allows the caller to obtain an arbitrarily long digest length. Longer lengths, however, do not increase security or collision resistance and lengths shorter than 256 bit (32 bytes) will decrease it.

  Parameters

    digest_size (int) – The length of output desired. Must be greater than zero.

  Raises

    ValueError – If the `digest_size` is invalid.

## SHA-1

Warning

SHA-1 is a deprecated hash algorithm that has practical known collision attacks. You are strongly discouraged from using it. Existing applications should strongly consider moving away.

class cryptography.hazmat.primitives.hashes.SHA1

  SHA-1 is a cryptographic hash function standardized by NIST. It produces an 160-bit message digest. Cryptanalysis of SHA-1 has demonstrated that it is vulnerable to practical collision attacks, and collisions have been demonstrated.

## MD5

Warning

MD5 is a deprecated hash algorithm that has practical known collision attacks. You are strongly discouraged from using it. Existing applications should strongly consider moving away.

class cryptography.hazmat.primitives.hashes.MD5

  MD5 is a deprecated cryptographic hash function. It produces a 128-bit message digest and has practical known collision attacks.

## Interfaces

class cryptography.hazmat.primitives.hashes.HashAlgorithm
  name
    Type

      str

    The standard name for the hash algorithm, for example: `"sha256"` or `"blake2b"`.

  digest_size
    Type

      int

    The size of the resulting digest in bytes.

class cryptography.hazmat.primitives.hashes.HashContext
  algorithm

    A `HashAlgorithm` that will be used by this context.

  update(data)
    Parameters

      data (bytes) – The data you want to hash.

  finalize()
    Returns

      The final digest as bytes.

  copy()
    Returns

      A `HashContext` that is a copy of the current context.