Danger
This is a “Hazardous Materials” module. You should ONLY use it if you’re 100% absolutely sure that you know what you’re doing because this module is full of land mines, dragons, and dinosaurs with laser guns.
Message digests (Hashing)¶

class
cryptography.hazmat.primitives.hashes.
Hash
(algorithm, backend)[source]¶ A cryptographic hash function takes an arbitrary block of data and calculates a fixedsize bit string (a digest), such that different data results (with a high probability) in different digests.
This is an implementation of
HashContext
meant to be used withHashAlgorithm
implementations to provide an incremental interface to calculating various message digests.>>> from cryptography.hazmat.backends import default_backend >>> from cryptography.hazmat.primitives import hashes >>> digest = hashes.Hash(hashes.SHA256(), backend=default_backend()) >>> digest.update(b"abc") >>> digest.update(b"123") >>> digest.finalize() b'l\xa1=R\xcap\xc8\x83\xe0\xf0\xbb\x10\x1eBZ\x89\xe8bM\xe5\x1d\xb2\xd29%\x93\xafj\x84\x11\x80\x90'
If the backend doesn’t support the requested
algorithm
anUnsupportedAlgorithm
exception will be raised.Keep in mind that attacks against cryptographic hashes only get stronger with time, and that often algorithms that were once thought to be strong, become broken. Because of this it’s important to include a plan for upgrading the hash algorithm you use over time. For more information, see Lifetimes of cryptographic hash functions.
Parameters:  algorithm – A
HashAlgorithm
instance such as those described in below.  backend – A
HashBackend
instance.
Raises: cryptography.exceptions.UnsupportedAlgorithm – This is raised if the provided
backend
does not implementHashBackend

update
(data)[source]¶ Parameters: data (bytes) – The bytes to be hashed.
Raises:  cryptography.exceptions.AlreadyFinalized – See
finalize()
.  TypeError – This exception is raised if
data
is notbytes
.
 cryptography.exceptions.AlreadyFinalized – See

copy
()[source]¶ Copy this
Hash
instance, usually so that you may callfinalize()
to get an intermediate digest value while we continue to callupdate()
on the original instance.Returns: A new instance of Hash
that can be updated and finalized independently of the original instance.Raises: cryptography.exceptions.AlreadyFinalized – See finalize()
.

finalize
()[source]¶ Finalize the current context and return the message digest as bytes.
After
finalize
has been called this object can no longer be used andupdate()
,copy()
, andfinalize()
will raise anAlreadyFinalized
exception.Return bytes: The message digest as bytes.
 algorithm – A
SHA2 family¶

class
cryptography.hazmat.primitives.hashes.
SHA224
[source]¶ SHA224 is a cryptographic hash function from the SHA2 family and is standardized by NIST. It produces a 224bit message digest.

class
cryptography.hazmat.primitives.hashes.
SHA256
[source]¶ SHA256 is a cryptographic hash function from the SHA2 family and is standardized by NIST. It produces a 256bit message digest.

class
cryptography.hazmat.primitives.hashes.
SHA384
[source]¶ SHA384 is a cryptographic hash function from the SHA2 family and is standardized by NIST. It produces a 384bit message digest.

class
cryptography.hazmat.primitives.hashes.
SHA512
[source]¶ SHA512 is a cryptographic hash function from the SHA2 family and is standardized by NIST. It produces a 512bit message digest.
BLAKE2¶
BLAKE2 is a cryptographic hash function specified in RFC 7693. BLAKE2’s design makes it immune to lengthextension attacks, an advantage over the SHAfamily of hashes.
Note
While the RFC specifies keying, personalization, and salting features, these are not supported at this time due to limitations in OpenSSL 1.1.0.

class
cryptography.hazmat.primitives.hashes.
BLAKE2b
(digest_size)[source]¶ BLAKE2b is optimized for 64bit platforms and produces an 1 to 64byte message digest.
Parameters: digest_size (int) – The desired size of the hash output in bytes. Only 64
is supported at this time.Raises: ValueError – If the digest_size
is invalid.

class
cryptography.hazmat.primitives.hashes.
BLAKE2s
(digest_size)[source]¶ BLAKE2s is optimized for 8 to 32bit platforms and produces a 1 to 32byte message digest.
Parameters: digest_size (int) – The desired size of the hash output in bytes. Only 32
is supported at this time.Raises: ValueError – If the digest_size
is invalid.
SHA3 family¶
SHA3 is the most recent NIST secure hash algorithm standard. Despite the larger number SHA3 is not considered to be better than SHA2. Instead, it uses a significantly different internal structure so that if an attack appears against SHA2 it is unlikely to apply to SHA3. SHA3 is significantly slower than SHA2 so at this time most users should choose SHA2.

class
cryptography.hazmat.primitives.hashes.
SHA3_224
[source]¶ New in version 2.5.
SHA3/224 is a cryptographic hash function from the SHA3 family and is standardized by NIST. It produces a 224bit message digest.

class
cryptography.hazmat.primitives.hashes.
SHA3_256
[source]¶ New in version 2.5.
SHA3/256 is a cryptographic hash function from the SHA3 family and is standardized by NIST. It produces a 256bit message digest.

class
cryptography.hazmat.primitives.hashes.
SHA3_384
[source]¶ New in version 2.5.
SHA3/384 is a cryptographic hash function from the SHA3 family and is standardized by NIST. It produces a 384bit message digest.

class
cryptography.hazmat.primitives.hashes.
SHA3_512
[source]¶ New in version 2.5.
SHA3/512 is a cryptographic hash function from the SHA3 family and is standardized by NIST. It produces a 512bit message digest.

class
cryptography.hazmat.primitives.hashes.
SHAKE128
(digest_size)[source]¶ New in version 2.5.
SHAKE128 is an extendable output function (XOF) based on the same core permutations as SHA3. It allows the caller to obtain an arbitrarily long digest length. Longer lengths, however, do not increase security or collision resistance and lengths shorter than 128 bit (16 bytes) will decrease it.
Parameters: digest_size (int) – The length of output desired. Must be greater than zero. Raises: ValueError – If the digest_size
is invalid.

class
cryptography.hazmat.primitives.hashes.
SHAKE256
(digest_size)[source]¶ New in version 2.5.
SHAKE256 is an extendable output function (XOF) based on the same core permutations as SHA3. It allows the caller to obtain an arbitrarily long digest length. Longer lengths, however, do not increase security or collision resistance and lengths shorter than 256 bit (32 bytes) will decrease it.
Parameters: digest_size (int) – The length of output desired. Must be greater than zero. Raises: ValueError – If the digest_size
is invalid.
SHA1¶
Warning
SHA1 is a deprecated hash algorithm that has practical known collision attacks. You are strongly discouraged from using it. Existing applications should strongly consider moving away.
MD5¶
Warning
MD5 is a deprecated hash algorithm that has practical known collision attacks. You are strongly discouraged from using it. Existing applications should strongly consider moving away.
Interfaces¶

class
cryptography.hazmat.primitives.hashes.
HashAlgorithm
[source]¶ 
name
¶ Type: str The standard name for the hash algorithm, for example:
"sha256"
or"blake2b"
.

digest_size
¶ Type: int The size of the resulting digest in bytes.


class
cryptography.hazmat.primitives.hashes.
HashContext
[source]¶ 
algorithm
¶ A
HashAlgorithm
that will be used by this context.

copy
()[source]¶ Returns: A HashContext
that is a copy of the current context.
