sha digest can contain NUL bytes

[pyca]

sha digest can contain NUL bytes

[reaperhulk]

Very good catch (and apologies for taking so long on responding to this!). The digest needs to be encoded to prevent null bytes, but doing something like encoding a 64 byte SHA512 hash will exceed the limit so either you accept some limited truncation there or switch to a shorter hash function. I'll put in a PR to update the docs on this front.

[alex]

Hex sha256 is a good compromise IMO
On Nov 29, 2015 12:41 PM, "Paul Kehrer" [email protected] wrote:

Very good catch (and apologies for taking so long on responding to this!).
The digest needs to be encoded to prevent null bytes, but doing something
like encoding a 64 byte SHA512 hash will exceed the limit so either you
accept some limited truncation there or switch to a shorter hash function.
I'll put in a PR to update the docs on this front.

—
Reply to this email directly or view it on GitHub
#55 (comment).

[hyperknot]

In the meantime I've reviewed this issue, and the solution for me was to use the passlib wrapper for bcrypt. passlib has a well tested built-in method called: bcrypt_sha256
https://pythonhosted.org/passlib/lib/passlib.hash.bcrypt_sha256.html

Implementation line:
b64encode(sha256(secret).digest())
https://bitbucket.org/ecollins/passlib/src/fa26802fc88fbc6b2d4b9676970bed7e6d53fc9d/passlib/handlers/bcrypt.py?at=default&fileviewer=file-view-default#bcrypt.py-677

[reaperhulk]

#57 addresses this.

[reaperhulk]

This appears to be resolved so I'll close this now. If there's still an issue feel free to reopen.