Mark non-security md5 usage to allow for compatibility with fips environments#1288
Mark non-security md5 usage to allow for compatibility with fips environments#1288lratc wants to merge 1 commit intoapache:trunkfrom
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates the Cassandra driver’s MD5-based token hashing to explicitly mark MD5 usage as non-security-related, improving compatibility with FIPS-140 environments where MD5 may be disallowed for security purposes.
Changes:
- Replace
from hashlib import md5withimport hashlib. - Update
MD5Token.hash_fnto callhashlib.md5(..., usedforsecurity=False).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| if isinstance(key, str): | ||
| key = key.encode('UTF-8') | ||
| return abs(varint_unpack(md5(key).digest())) | ||
| return abs(varint_unpack(hashlib.md5(key,usedforsecurity=False).digest())) |
There was a problem hiding this comment.
PEP8/style: add a space after the comma in hashlib.md5(key,usedforsecurity=False) for readability/consistency (i.e., key, usedforsecurity=False).
| return abs(varint_unpack(hashlib.md5(key,usedforsecurity=False).digest())) | |
| return abs(varint_unpack(hashlib.md5(key, usedforsecurity=False).digest())) |
| if isinstance(key, str): | ||
| key = key.encode('UTF-8') | ||
| return abs(varint_unpack(md5(key).digest())) | ||
| return abs(varint_unpack(hashlib.md5(key,usedforsecurity=False).digest())) |
There was a problem hiding this comment.
hashlib.md5(..., usedforsecurity=False) is not supported by all Python implementations (e.g., PyPy may raise TypeError: md5() takes no keyword arguments), which would break token hashing at runtime. Consider feature-detecting support once (e.g., try calling with usedforsecurity=False and fall back to a call without the kwarg) so the driver remains compatible while still fixing FIPS on CPython/OpenSSL builds that honor the flag.
As per python/cpython#53462 hashlib.md5() takes an implicit "usedforsecurity=True" argument. In a FIPS-140 environment, this causes the cassandra-python-driver to error as md5 is not permitted for security usage.
ModuleNotFoundError: No module named 'md5'Within the context of this package, the token is not used for security - this is used for an internal hashing function only, so marking it as usedforsecurity=False is a straightforward method to permit its usage without affecting compatibility.