How to use hash function in Python

Hash algorithms

The hashlib module implements a common interface to many different secure hash and message digest algorithms. Included are the FIPS secure hash algorithms SHA1, SHA224, SHA256, SHA384, and SHA512 (defined in FIPS 180-2) as well as RSA’s MD5 algorithm.

#!/usr/bin/env python3

# Import module
import hashlib

m = hashlib.sha256()
m.update(b"Sony Invests $1 Billion")
b = m.digest()
print(b)
# a string object
# b = m.hexdigest()
print(f'digest_size:{m.digest_size}')
print(f'block_size: {m.block_size}')

b'W\xe2\xcab\xf7\xd7|\xe4\xe5%\x05R\xef\xa9\xb7F@,\xc1\xb0d\xbcN5/\xd0r4\x02x\x18\xb2'
digest_size:32
block_size: 64

The named constructors are much faster than new() and should be preferred.

A set containing the names of the hash algorithms that are available in the running Python interpreter.

#!/usr/bin/env python3

# Import module
import hashlib

m = hashlib.algorithms_available
for name in m:
	print(name)

blake2b
sha
shake_256
ecdsa-with-SHA1
md4
sha1
dsaWithSHA
sha224
sha3_384
sha3_256
sha384
md5
sha3_224
ripemd160
sha512
sha3_512
whirlpool
shake_128
sha256
dsaEncryption
blake2s

Cryptographic hash Function

BLAKE2 is a cryptographic hash function faster than MD5, SHA-1, SHA-2, and SHA-3, yet is at least as secure as the latest standard SHA-3. BLAKE2 has been adopted by many projects due to its high speed, security, and simplicity.

• BLAKE2b, optimized for 64-bit platforms and produces digests of any size between 1 and 64 bytes.
• BLAKE2s, optimized for 8- to 32-bit platforms and produces digests of any size between 1 and 32 bytes.

#!/usr/bin/env python3

# Import module
from hashlib import blake2b

h = blake2b()
h.update(b'123456')
s = h.hexdigest()
print(s)

b3910b0f4b6f1aede44da90bb7705a868b265861b36e6f7f29dba7223f6f1ce7b10e0dd25e47deb70bd7f3b24f7da653409cd9014f8715e4013c15fee38ab418

BLAKE2 supports keyed mode (a faster and simpler replacement for HMAC), salted hashing, personalization, and tree hashing.

Examples

Using different digest sizes

produce 20-byte digests:

#!/usr/bin/env python3

# Import module
from hashlib import blake2b

h = blake2b(digest_size=20)
h.update(b'123456')
s = h.hexdigest()
print(s)

a0f92ddfdea4892ff18a48f7e0f9fcffc55745f5

Keyed hashing

Keyed hashing can be used for authentication as a faster and simpler replacement for Hash-based message authentication code (HMAC).

#!/usr/bin/env python3

# Import module
from hashlib import blake2b

h = blake2b(key=b'pseudorandom', digest_size=20)
h.update(b'123456')
s = h.hexdigest()
print(s)

3ee7c11a5b81e04e30cbcbf87aa0179a35289b5d

Randomized hashing

In BLAKE2 the salt is processed as a one-time input to the hash function during initialization, rather than as an input to each compression function.

#!/usr/bin/env python3

# Import module
import os
from hashlib import blake2b

salt = os.urandom(blake2b.SALT_SIZE)
h = blake2b(salt=salt)
h.update(b'123456')
s = h.hexdigest()
print(s)

660d796feb633b636b1e0110a22b073227775cd10895dac25dd5a8a93b624869ec79774a0707db1635f2d297f55c7973500c6c22cf3982e11a74af09208befae
bb644b1d0970050c40ddb5c8047f46269c369e5deea50c0ba53e49172722d14e6264f14d29085a00203947739a870dfc6d4c4eb0395f59c23f9faee314b344e7

Q: So I shouldn't use BLAKE2 for hashing user passwords?

A: You shouldn't use *any* general-purpose hash function for user passwords, not BLAKE2, and not MD5, SHA-1, SHA-256, or SHA-3. Instead you should use a password hashing function such as the PHC winner Argon2 with appropriate time and memory cost parameters, to mitigate the risk of bruteforce attacks—Argon2's core uses a variant of BLAKE2's permutation.