Package: blake2signer
Blake2SignerThe goal of this project is to provide a simple and straightforward way to securely sign data usingBLAKE in keyed hashing mode, using a secret key. This can be used, in example, when you need to send some data that could be tampered by the user, like a payment authorization, or a login token. This data travels in plaintext, and can be read, but it can't be modified in any way once signed!.Why would I need to use it?To sign data that needs to be sent through an untrusted channel, like signing a cookie with user data and providing it to the user, so the user can identify themselves with the rest of the system safely.To save database lookups by checking signed data, like an account activation or password reset link where you can sign the user id and then verify it securely without using a database.To prevent data tampering, like signing some value that goes in a form hidden field such as the user type (admin or regular) so that the user can't trick the value.To easily express intent when signing data, like sharing a single secret key between signers to simplify app configuration and use thepersonalisationparameter to prevent signed data misuse.In short,never trustuser input,always verify. This module helps you do that.Why would I want to use it?Because it is a relativelysmall(around 900 logical lines of code, core around 400),simple(the public API has only a couple of methods) yet verycustomizableandfastdata signer. My idea is to keep it as uncomplicated as possible without much room to become afootgun. Alldefaults are very correct(secure), and everythingjust worksout of the box.There are much better packages for other or more general use cases, so if you feel this doesn't satisfy your needs, pleaseleave a feature requestor consider usingitsdangerous,Django's signer,pypaseto,pyjwtor others like those.GoalsBe safe and secure.Be simple and straightforward.Followsemver.Be always typed.No dependencies (besides dev).100% coverage.Secondary goalsIf possible, maintain current active Python versions (3.8+).If possible, support Python implementations other than CPython.InstallingThis package is hosted onPyPiso just:python3 -m pip install blake2signerpoetry add blake2signerpipenv install blake2signerYou can check thereleases' pagefor package hashes and signatures.Note: if you want to use BLAKE3, you need to install theblake3package, until it arrives to core (which may or may not happen). Alternatively, you can install this package with extras:python3 -m pip install blake2signer[blake3]poetry add blake2signer[blake3]pipenv install blake2signer[blake3]RequirementsOnly Python is required; this module doesn't have dependencies besides those used for development, and the optionalblake3.Versions currently tested (check thepipelines):CPython 3.8CPython 3.9CPython 3.10CPython 3.11CPython 3.12CPython 3.13-prePyPy3.8If you are contributing to this project under PyPy,read the contrib notes first.PyPy3.9If you are contributing to this project under PyPy,read the contrib notes first.PyPy3.10If you are contributing to this project under PyPy,read the contrib notes first.Stackless3.8If you are contributing to this project under Stackless,read the contrib notes first.Tl; Dr Example"""Tl;dr example."""fromdatetimeimporttimedeltafromblake2signerimportBlake2SerializerSignerfromblake2signerimporterrorssecret=b'secure-secret-that-nobody-knows!'# Some arbitrary data to signdata={'user_id':1,'is_admin':True,'username':'hackan'}signer=Blake2SerializerSigner(secret,max_age=timedelta(days=1),# Add a timestamp to the signaturepersonalisation=b'the-cookie-signer',)# Sign and i.e. store the data in a cookiesigned=signer.dumps(data)# Compression is enabled by default# If compressing data turns out to be detrimental then data won't be# compressed. If you know that from beforehand and don't need compression, you# can disable it:# signed = signer.dumps(data, compress=False)# Additionally, you can force compression nevertheless:# signed = signer.dumps(data, force_compression=True)cookie={'data':signed}# To verify and recover data simply use `loads`: you will either get the data or# a `SignerError` subclass exception.try:unsigned=signer.loads(cookie.get('data',''))excepterrors.SignedDataError:# See more about errors in the docs# Can't trust on given dataunsigned={}print(unsigned)# {'user_id': 1, 'is_admin': True, 'username': 'hackan'}Find moredetailsandexamplesin the docs.Tip: all modules, classes, methods and functions are documented so don't doubt asking forhelp().SignersThis module provides three signer classes:Blake2SerializerSigner: a signer class that handles data serialization, compression and encoding along with salted signing and salted timestamped signing. Its public methods aredumps,loads,dumps_partsandloads_parts, anddumpandloadfor files.Blake2Signer: a signer class that signs plainbytesorstrdata. Its public methods aresign,unsign,sign_partsandunsign_parts.Blake2TimestampSigner: a signer class that timestamp signs plainbytesorstrdata. Its public methods aresign,unsign,sign_partsandunsign_parts.You should generally go for Blake2SerializerSigner, given that it's the most versatile of the three, unless you need to deal with plainbytesor strings. Checkdetails about signersandusage examplesto learn more.DocumentationCheck out thisproject docs online, or locally withinv docs. Alternatively, build them locally usinginv docs --build.Getting helpFor help, support, and discussions, come to ourMatrix room. For issues, please use theGitlab issue tracker.NoticeI'm not a cryptoexpert, sothis project needs a security review. If you are one and can do it, pleasecontact me.ContributorsIn alphabetical ordering, with short description about contribution:Erus: docs title logo, code review.NoonSleeper: project icons.LicenseBlake2Signeris made byHacKanunder MPL v2.0. You are free to use, share, modify and share modifications under the terms of thatlicense.  Derived works may link back to the canonical repository:https://gitlab.com/hackancuba/blake2signer.Copyright (C) 2020 - 2024 HacKan (https://hackan.net)
This Source Code Form is subject to the terms of the Mozilla Public
License, v. 2.0. If a copy of the MPL was not distributed with this
file, You can obtain one at https://mozilla.org/MPL/2.0/.Blake2Signer iconsbyNoonSleeperare licensed under aCreative Commons Attribution-ShareAlike 4.0 International License. You are free to use, share, modify and share modifications under the terms of thatlicense. They were based onBlake2Signer logobyHacKanwhich was based onthis swordbyHamza Wahbiandthis signaturebyNick Bluth, both licensed underCC BY 3.0, and inspired byIt's dangerous logo.Check them out in theiconssubdir.Blake2Signer with LogobyErusis licensed under aCreative Commons Attribution-ShareAlike 4.0 International License. You are free to use, share, modify and share modifications under the terms of thatlicense. It uses OFL licensedBilbo font.