{"action":"created","issue":{"url":"https://api.github.com/repos/pyca/cryptography/issues/1648","repository_url":"https://api.github.com/repos/pyca/cryptography","labels_url":"https://api.github.com/repos/pyca/cryptography/issues/1648/labels{/name}","comments_url":"https://api.github.com/repos/pyca/cryptography/issues/1648/comments","events_url":"https://api.github.com/repos/pyca/cryptography/issues/1648/events","html_url":"https://github.com/pyca/cryptography/issues/1648","id":56668718,"number":1648,"title":"API request: decouple hashing process from signature generation / verification","user":{"login":"catlee","id":54458,"avatar_url":"https://avatars.githubusercontent.com/u/54458?v=3","gravatar_id":"","url":"https://api.github.com/users/catlee","html_url":"https://github.com/catlee","followers_url":"https://api.github.com/users/catlee/followers","following_url":"https://api.github.com/users/catlee/following{/other_user}","gists_url":"https://api.github.com/users/catlee/gists{/gist_id}","starred_url":"https://api.github.com/users/catlee/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/catlee/subscriptions","organizations_url":"https://api.github.com/users/catlee/orgs","repos_url":"https://api.github.com/users/catlee/repos","events_url":"https://api.github.com/users/catlee/events{/privacy}","received_events_url":"https://api.github.com/users/catlee/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":31,"created_at":"2015-02-05T13:17:28Z","updated_at":"2016-08-29T02:24:16Z","closed_at":null,"body":"Currently to sign or verify a signature you need the entire message data and key in the same place so you can create the signer or verifier object. e.g. from the docs:\r\n\r\n```python\r\n>>> signer = private_key.signer(\r\n...     padding.PSS(\r\n...         mgf=padding.MGF1(hashes.SHA256()),\r\n...         salt_length=padding.PSS.MAX_LENGTH\r\n...     ),\r\n...     hashes.SHA256()\r\n... )\r\n>>> message = b\"A message I want to sign\"\r\n>>> signer.update(message)\r\n>>> signature = signer.finalize()\r\n```\r\n\r\nI'd like to be able to decouple this process so that I generate the hash of the message in one place, and then sign it in another place. So something like this:\r\n\r\n```python\r\n>>> message = b\"A message I want to sign\"\r\n>>> hasher = hashes.SHA256()\r\n>>> hasher.update(message)\r\n>>> digest = hasher.digest()\r\n\r\n# Elsewhere....\r\n\r\n>>> signer = private_key.signer(\r\n...     padding.PSS(\r\n...         mgf=padding.MGF1(hashes.SHA256()),\r\n...         salt_length=padding.PSS.MAX_LENGTH\r\n...     ),\r\n...     hashes.SHA256()\r\n... )\r\n>>> signature = signer.sign_digest(digest)\r\n```"},"comment":{"url":"https://api.github.com/repos/pyca/cryptography/issues/comments/243018592","html_url":"https://github.com/pyca/cryptography/issues/1648#issuecomment-243018592","issue_url":"https://api.github.com/repos/pyca/cryptography/issues/1648","id":243018592,"user":{"login":"Badg","id":6155386,"avatar_url":"https://avatars.githubusercontent.com/u/6155386?v=3","gravatar_id":"","url":"https://api.github.com/users/Badg","html_url":"https://github.com/Badg","followers_url":"https://api.github.com/users/Badg/followers","following_url":"https://api.github.com/users/Badg/following{/other_user}","gists_url":"https://api.github.com/users/Badg/gists{/gist_id}","starred_url":"https://api.github.com/users/Badg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Badg/subscriptions","organizations_url":"https://api.github.com/users/Badg/orgs","repos_url":"https://api.github.com/users/Badg/repos","events_url":"https://api.github.com/users/Badg/events{/privacy}","received_events_url":"https://api.github.com/users/Badg/received_events","type":"User","site_admin":false},"created_at":"2016-08-29T02:24:16Z","updated_at":"2016-08-29T02:24:16Z","body":"Ah, yeah, like @alex I was also getting confused re: use cases. I've just been considering pre-hashed data that still uses padding; I don't think I read up the chain far enough to realize padding removal was in the mix too.\r\n\r\nWhere the external API for pre-hashed data is concerned, is there a preference between:\r\n\r\n1. Passing an explicit None to ```private_key.sign()```, something like this:  \r\n    ```\r\n    private_key.sign(data=data, padding=padding, algorithm=None)\r\n    ```\r\n2. Passing an explicit noop hash to ```private_key.sign()```, something like this:  \r\n    ```\r\n    private_key.sign(data=data, padding=padding, algorithm=PreHashed(SHA256()))\r\n    ```"}}
{"actor":{"display_login":"Badg"}}