Comments (10)
in the wild
That particular aspect is incorrect, but I agree we should change the default.
from itsdangerous.
Are we okay with SHA-256? Should be fine, just want to make sure. Could also just go all the way to SHA-512.
from itsdangerous.
SHA-512 performs 80 rounds with a blocksize of 1024 bits, whilst SHA-256 performs 64 rounds with a blocksize of 512 bits. This leads to SHA-512 being faster on 64-bit machines for message lengths of more than a few hundred bits.
There are potential legacy client support issues with SHA-512 vs SHA-256, but performance at least should not be a reason to only use SHA-256 (and in fact may be a reason to use SHA-512).
from itsdangerous.
Hmm, looks like this already came up before in #66, which I closed because hash security isn't representative of HMAC security. Is there actually any issue with SHA-1 as it's used in this library?
from itsdangerous.
Looks like you're right about that, closing.
from itsdangerous.
See this chat transcript for more discussion: http://chat.stackoverflow.com/transcript/message/35836840#35836840
from itsdangerous.
I would vote to still upgrade to sha256 for added security.
from itsdangerous.
Unfortunately, I'm out of my element here. Is it actually adding any security as opposed to just taking longer to generate longer hashes? I emailed the cryptography-dev mailinglist to see if some devs with more experience in this area could weigh in. (Hopefully that was the right place to ask.)
from itsdangerous.
With current knowledge it doesn't change anything, but it just seems generally safer should that knowledge change.
from itsdangerous.
See #80, I'm upgrading this to SHA-512 after more discussion.
from itsdangerous.
Related Issues (20)
- pgAdmin4 broken using itsdangerous > 2.0.0a1 HOT 1
- base64encode should be injected as a dependency in Signer class HOT 1
- Outdated pip link HOT 2
- Different lenght of tokens from 0.26 to 2.0.1? HOT 4
- ImportError: cannot import name 'json' from 'itsdangerous' HOT 5
- Incompatibility with Flask 1.1.1 (cannot import name 'json' from 'itsdangerous') HOT 4
- ImportError: cannot import name 'json' from 'itsdangerous' HOT 2
- Migration guide for deprecated JSONWebSignatureSerializer HOT 2
- Document that itsdangerous does not follow semver HOT 2
- ImportError: cannot import name 'TimedJSONWebSignatureSerializer' from 'itsdangerous' HOT 2
- catch overflow error on 32bit platforms
- Support async
- Issue with importing TimedJSONWebSignatureSerializer when updating db with Flask. HOT 1
- TimedJSONWebSignatureSerializer HOT 1
- Consider making `Serializer` generic in `t.AnyStr` for type checking to avoid overly ambiguous return types HOT 6
- Last character of serialized/signed data not robust HOT 1
- deprecate `__version__`
- use of `hashlib.sha1` causes issue in FIPS build
- Support digest_size when using blake2s or blake2b HOT 1
- serializer_kwargs are missing in load_payload function
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from itsdangerous.