Clinic signatures of HACL* hash functions are inconsistent with OpenSSL implementation

[8R0WNI3]

Bug description:

According to its docstring, the function hashlib.shake_128(...).hexdigest() should accept an argument length, either as positional or as keyword argument. However, since Python 3.14, the function only accepts positional arguments and fails with TypeError: shake_128.hexdigest() takes no keyword arguments otherwise.

I narrowed the root cause for this behaviour down to the following two commits (I'm not 100% sure though as I don't have any C-background):

• 1f77739
• 061e50f

Reproducer:

import hashlib
hashlib.shake_128(b'').hexdigest(1) # working
hashlib.shake_128(b'').hexdigest(length=1) # not working anymore, but was working before

For example, on Python Python 3.13.3 (main, Apr 8 2025, 13:54:08) [Clang 17.0.0 (clang-1700.0.13.3)] on my mac I can still use the keyword argument, but on alpine:edge Python 3.12.10 (main, May 21 2025, 16:23:36) [GCC 14.2.0] on linux it is expecting positional arguments only.

CPython versions tested on:

CPython main branch, 3.14, 3.13, 3.12

Operating systems tested on:

Linux, macOS

Linked PRs

• gh-134696: align OpenSSL and HACL*-based hash functions constructors AC signatures #134713
• gh-134696: fix hashlib FIPS-only BLAKE-2 buildbot  #134968
• [3.14] gh-134696: align OpenSSL and HACL*-based hash functions constructors AC signatures (GH-134713) #134961
• [3.13] gh-134696: align OpenSSL and HACL*-based hash functions constructors AC signatures (GH-134713) #134962

[picnixz]

I cannot reproduce the issue. On Python 3.15, it works well and I don't think I change anything between 3.14 and 3.15 (namely I can use a keyword argument). If you cannot use a keyword argument on 3.12, then I think it's ok? I mean, the recent behavior is an extension of the old one.

[8R0WNI3]

On alpine:3 running Python 3.12.10 (main, May 21 2025, 20:03:03) [GCC 14.2.0], the keyword argument is allowed (this was the behaviour in the past and seems to be the case in 3.15 as well. However, on alpine:edge running Python 3.12.10 (main, May 21 2025, 16:23:36) [GCC 14.2.0], the keyword argument is not allowed anymore.

[picnixz]

3.12 is security-only so we won't fix this IMO (it's not a security issue). In your comment, you're linking 3.12.10 twice so I don't really understand which one is 3.12 or not (only the timestamps change and I don't know which correspond to what)

[encukou]

Could you share how you're installing dependencies & building CPython on alpine:edge?

[8R0WNI3]

Reproducer:

> docker run -it alpine:edge
  > apk add python3
  > python3 -c "import hashlib; print(hashlib.shake_128(b'').hexdigest(length=1))"

However, in the meantime I figured if I run apk upgrade libcrypto3, the keyword argument is accepted again, so this might be an issue between Python and openssl?

[picnixz]

I may have an idea. What's the output of type(hashlib.shak_128(b''). If OpenSSl is not installed, then we may have fell back on the HACL* implementation

[picnixz]

And indeed there is some issue here:

This is in _sha3module. So the HACL* implementation doesn't allow for keyword arguments. Thanks for spotting this disparity.