mirrors
/
cpython
mirror of https://github.com/python/cpython.git
2
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge heads.

This commit is contained in:
Georg Brandl 2012-06-24 16:10:47 +02:00
parent a1bc35f07f 9df73dac84
commit 3b44d81cf9
1 changed files with 9 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
Doc/library/hmac.rst
View File

@ -54,11 +54,10 @@ An HMAC object has the following methods:
.. warning:: .. warning::
The output of :meth:`hexdigest` should not be compared directly to an When comparing the output of :meth:`hexdigest` to an externally-supplied
externally-supplied digest during a verification routine. Instead, the digest during a verification routine, it is recommended to use the
externally supplied digest should be converted to a :class:`bytes` :func:`compare_digest` function instead of the ``==`` operator
value and compared to the output of :meth:`digest` with to reduce the vulnerability to timing attacks.
:func:`compare_digest`.
.. method:: HMAC.copy() .. method:: HMAC.copy()
@ -72,11 +71,11 @@ This module also provides the following helper function:
.. function:: compare_digest(a, b) .. function:: compare_digest(a, b)
Return ``a == b``. This function uses an approach designed to prevent timing Return ``a == b``. This function uses an approach designed to prevent timing
analysis by avoiding content based short circuiting behaviour. The inputs analysis by avoiding content based short circuiting behaviour, making it
must either both support the buffer protocol (e.g. :class:`bytes` and appropriate for cryptography. *a* and *b*
:class:`bytearray` instances) or be ASCII-only :class:`str` instances as must both be of the same type: either :class:`str` (ASCII only, as e.g.
returned by :meth:`hexdigest`. :class:`bytes` and :class:`str` instances returned by :meth:`HMAC.hexdigest`), or any type that supports the
can't be mixed. :term:`buffer protocol` (e.g. :class:`bytes`).
Using a short circuiting comparison (that is, one that terminates as soon as Using a short circuiting comparison (that is, one that terminates as soon as
it finds any difference between the values) to check digests for correctness it finds any difference between the values) to check digests for correctness