On Fri, Apr 15, 2016 at 10:26:31AM +0200, Victor Stinner wrote: > It's easy to implement this function (in the native language of your Python > implemenation), it's short. I'm not sure that a Python version is really > safe. > > The secrets module is for Python 3.6, in this version the hmac already > "requires" the compare_digest() function no?
The current version looks like this: try: from hmac import compare_digest except ImportError: # fallback version defined but I'm having second thoughts about this. I don't think it needs to support older versions of Python, but perhaps it needs to support implementations which don't include compare_digest? This isn't just a question about the secrets module. PEP 399 suggests than any C classes/functions should have a pure Python version as fallback, but compare_digest doesn't. I don't know whether it should or not. https://www.python.org/dev/peps/pep-0399/ -- Steve _______________________________________________ Python-Dev mailing list Python-Dev@python.org https://mail.python.org/mailman/listinfo/python-dev Unsubscribe: https://mail.python.org/mailman/options/python-dev/archive%40mail-archive.com
