hmac — weak hash

Reversible One Way Hash in `hmac` Module

The Python module hmac provides a number of functions for creating and verifying message authentication codes (MACs). However, some of the hash algorithms supported by hmac are insecure and should not be used. These insecure hash algorithms include MD4, MD5, RIPEMD-160 and SHA-1.

The MD4 hash algorithm is a cryptographic hash function that was designed in the late 1980s. MD4 is no longer considered secure, and MACs created with MD4 can be easily cracked by attackers.

The MD5 hash algorithm is a cryptographic hash function that was designed in the early 1990s. MD5 is no longer considered secure, and MACs created with MD5 can be easily cracked by attackers.

RIPEMD-160 is a cryptographic hash function that was designed in 1996. It is considered to be a secure hash function, but it is not as secure as SHA-256, SHA-384, or SHA-512. In 2017, a collision attack was found for RIPEMD-160. This means that it is possible to find two different messages that have the same RIPEMD-160 hash. While this does not mean that RIPEMD-160 is completely insecure, it does mean that it is not as secure as it once was.

The SHA-1 hash algorithm is also a cryptographic hash function that was designed in the early 1990s. SHA-1 is no longer considered secure, and MACs created with SHA-1 can be easily cracked by attackers.

Example

hmac_new_digestmod_md5.py
import hmac


key = b"my-secret-key"
message = b"Hello, world!"
hmac.new(key, msg=message, digestmod="md5")

Example Output

> precli tests/unit/rules/python/stdlib/hmac/examples/hmac_new_digestmod_md5.py
⛔️ Error on line 6 in tests/unit/rules/python/stdlib/hmac/examples/hmac_new_digestmod_md5.py
PY006: Use of Weak Hash
The hash function 'md5' is vulnerable to collision and pre-image attacks.

Remediation

The recommendation is to swap the insecure hashing method to one of the more secure alternatives, SHA256, SHA-384, or SHA512.

hmac_new_digestmod_md5.py
import hmac


key = b"my-secret-key"
message = b"Hello, world!"
hmac.new(key, msg=message, digestmod="sha256")

Default Configuration

enabled = true
level = "error"
weak_hashes = [
  "md4",
  "md5",
  "md5-sha1",
  "ripemd160",
  "sha",
  "sha1",
]

hmac — weak hash

Reversible One Way Hash in hmac Module

Example

Remediation

Default Configuration

See also

Reversible One Way Hash in `hmac` Module