From fa8d7368ae045e7c82e4229dccb9efa1345aea24 Mon Sep 17 00:00:00 2001 From: Alex Willmer Date: Mon, 10 Jun 2019 22:24:32 +0100 Subject: [PATCH 1/2] bpo-37218: Change digestmod deprecation notice to versionchanged Code change was made in https://github.com/python/cpython/pull/7063, for https://bugs.python.org/issue33604. --- Doc/library/hmac.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Doc/library/hmac.rst b/Doc/library/hmac.rst index dc994b07c35c00..81fac5aa1e3f40 100644 --- a/Doc/library/hmac.rst +++ b/Doc/library/hmac.rst @@ -26,8 +26,8 @@ This module implements the HMAC algorithm as described by :rfc:`2104`. Parameter *msg* can be of any type supported by :mod:`hashlib`. Parameter *digestmod* can be the name of a hash algorithm. - .. deprecated-removed:: 3.4 3.8 - MD5 as implicit default digest for *digestmod* is deprecated. + .. versionchanged:: 3.8 + Parameter *digestmod* is required. .. function:: digest(key, msg, digest) From a4864e96e0b3e282d229ea1dbbda73327740022a Mon Sep 17 00:00:00 2001 From: Alex Willmer Date: Mon, 10 Jun 2019 22:39:59 +0100 Subject: [PATCH 2/2] bpo-37218: Change example HMAC.name, to a stronger hash In case readers of the documentation are taking this exmaple as some form of recommendation, change it to a hashing alogrithm without known collision attacks. As https://tools.ietf.org/html/rfc6151 notes "attacks on HMAC-MD5 do not seem to indicate a practical vulnerability when used as a message authentication code", but "for a new protocol design, a ciphersuite with HMAC-MD5 should not be included". On this basis I think it's best not to mention it here. --- Doc/library/hmac.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Doc/library/hmac.rst b/Doc/library/hmac.rst index 81fac5aa1e3f40..76cd748f2fb75d 100644 --- a/Doc/library/hmac.rst +++ b/Doc/library/hmac.rst @@ -106,7 +106,7 @@ A hash object has the following attributes: .. attribute:: HMAC.name - The canonical name of this HMAC, always lowercase, e.g. ``hmac-md5``. + The canonical name of this HMAC, always lowercase, e.g. ``hmac-sha256``. .. versionadded:: 3.4