15. Cryptographic Services

The modules described in this chapter implement various algorithms of a cryptographic nature. They are available at the discretion of the installation. On Unix systems, the crypt module may also be available. Here’s an overview:

• 15.1. hashlib — Secure hashes and message digests
  • 15.1.1. Hash algorithms
    • new()
    • algorithms_guaranteed
    • algorithms_available
    • hash.digest_size
    • hash.block_size
    • hash.name
    • hash.update()
    • hash.digest()
    • hash.hexdigest()
    • hash.copy()
  • 15.1.2. SHAKE variable length digests
    • shake.digest()
    • shake.hexdigest()
  • 15.1.3. Key derivation
    • pbkdf2_hmac()
    • scrypt()
  • 15.1.4. BLAKE2
    • 15.1.4.1. Creating hash objects
      • blake2b()
      • blake2s()
    • 15.1.4.2. Constants
      • blake2b.SALT_SIZE
      • blake2s.SALT_SIZE
      • blake2b.PERSON_SIZE
      • blake2s.PERSON_SIZE
      • blake2b.MAX_KEY_SIZE
      • blake2s.MAX_KEY_SIZE
      • blake2b.MAX_DIGEST_SIZE
      • blake2s.MAX_DIGEST_SIZE
    • 15.1.4.3. Examples
      • 15.1.4.3.1. Simple hashing
      • 15.1.4.3.2. Using different digest sizes
      • 15.1.4.3.3. Keyed hashing
      • 15.1.4.3.4. Randomized hashing
      • 15.1.4.3.5. Personalization
      • 15.1.4.3.6. Tree mode
    • 15.1.4.4. Credits
• 15.2. hmac — Keyed-Hashing for Message Authentication
  • new()
  • HMAC.update()
  • HMAC.digest()
  • HMAC.hexdigest()
  • HMAC.copy()
  • HMAC.digest_size
  • HMAC.block_size
  • HMAC.name
  • compare_digest()
• 15.3. secrets — Generate secure random numbers for managing secrets
  • 15.3.1. Random numbers
    • SystemRandom
    • choice()
    • randbelow()
    • randbits()
  • 15.3.2. Generating tokens
    • token_bytes()
    • token_hex()
    • token_urlsafe()
    • 15.3.2.1. How many bytes should tokens use?
  • 15.3.3. Other functions
    • compare_digest()
  • 15.3.4. Recipes and best practices