Folks (incl @kattni)

It appears that there are a number of things that are slightly out of kilter with the function definition...

As noted above, it appears that Optional is not accurate as the code is written
Beyond that... The docstring seems incorrect. There is a sign() function that Hashes the message, then signs the hash with the given key whereas this function appears to require that the input be a hash that is precomputed.
Thus, it appears that the second line of the docstring should be revised to remove the reference to "Hashes the message" since this function does NOT do that. (it appears that the docstring message was copy-pasted from the docstring associated with the sign() function).
It is not clear whether the system will accept hash_values that are empty bytes (b""). If we feed in an empty bytes object, then the system will sign the asn1code all by itself.
If we want some logic in this function to recognize that a hash_value should not be empty, then we could add some logic to check for None OR b"" and raise an Error indicating that the function won't properly sign a hash if there is no hash????

Conversely we could just leave this function logic as is and update the docstring to say that the hash_value should be a bytes object, and edit the second line to remove all references to hashing messages.

PLEASE ADVISE.

Adafruit_CircuitPython_RSA/adafruit_rsa/pkcs1.py

Line 266 in 1a6f1e2

def sign_hash(

def sign_hash(
    hash_value: Optional[bytes],
    priv_key: PrivateKey,
    hash_method: Literal["MD5", "SHA-1", "SHA-224", "SHA-256", "SHA-384", "SHA-512"],
) -> bytes:
    """Signs a precomputed hash with the private key.

    Hashes the message, then signs the hash with the given key. This is known
    as a "detached signature", because the message itself isn't altered.

    :param bytes hash_value: A precomputed hash to sign (ignores message). Should be
        set to ``None`` if needing to hash and sign message.
    :param PrivateKey priv_key: the :py:class:`adafruit_rsaPrivateKey` to sign with
    :param hash_method: the hash method used on the message. Use 'MD5', 'SHA-1',
        'SHA-224', SHA-256', 'SHA-384' or 'SHA-512'.
    :return: a message signature block.
    :raise OverflowError: if the private key is too small to contain the
        requested hash.

    """

    # Get the ASN1 code for this hash method
    if hash_method not in HASH_ASN1:
        raise ValueError("Invalid hash method: %s" % hash_method)
    asn1code = HASH_ASN1[hash_method]

    # Encrypt the hash with the private key
    cleartext = asn1code + hash_value
    keylength = common.byte_size(priv_key.n)
    padded = _pad_for_signing(cleartext, keylength)

    payload = transform.bytes2int(padded)
    encrypted = priv_key.blinded_encrypt(payload)
    block = transform.int2bytes(encrypted, keylength)
    ```

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions