Search code examples
pythonencryptionhashsha1

SHA1 hash clarification

I have the following python code:

from hashlib import sha1
secretString=b"this is the secret string"
publicData=b"x10291434"
hash=sha1(publicData+secretString).hexdigest()

Now if i send out the publicData and hash for public consumption. Is this safe? I want to check that when the user provides the publicData back it matches the hash i originally sent with my secretKey.

I just wanted to check that I'm doing this correctly

Solution

  • It looks like you are trying to do HMAC

    You should try using something like itsdangerous

    >>> from itsdangerous import Signer
>>> s = Signer('secret-key')
>>> s.sign('my string')
'my string.wh6tMHxLgJqB6oY1uT73iMlyrOA'
>>> s.unsign('my string.wh6tMHxLgJqB6oY1uT73iMlyrOA')
'my string'