HMAC uses md5 by default
Bug #420528 reported by
gimli5009
This bug affects 2 people
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Python-Crypto |
Confirmed
|
Wishlist
|
Unassigned |
Bug Description
the HMAC module in Crypto.Hash.HMAC uses the md5 hash by default, md5 is a largely outdated hash with many known security vulnerabilities (see http://
To post a comment you must log in.
We can't change the default to SHA-2 without silently breaking people's code. The best we can do is to emit a warning when the default is relied upon, and eventually force the user to explicitly specify the hash function.