Yeah, we can wait until an actual user complains before dealing with "SHA1
is not available" IMO


On Tue, Jan 28, 2014 at 1:22 PM, Paul Kehrer <notifications@github.com>wrote:

> In cryptography/hazmat/backends/openssl/backend.py:
>
> > @@ -133,6 +134,47 @@ def create_symmetric_encryption_ctx(self, cipher, mode):
> >      def create_symmetric_decryption_ctx(self, cipher, mode):
> >          return _CipherContext(self, cipher, mode, _CipherContext._DECRYPT)
> >
> > +    def pbkdf2_hash_supported(self, algorithm):
> > +        if self._lib.Cryptography_HAS_PBKDF2_HMAC:
> > +            digest = self._lib.EVP_get_digestbyname(
> > +                algorithm.name.encode("ascii"))
> > +            return digest != self._ffi.NULL
> > +        else:
> > +            return isinstance(algorithm, hashes.SHA1)
>
> !@#$ OpenSSL. I don't think we should try to handle the cases where people
> go wildly outside the bounds of sanity. It strains us enough just to try to
> support the configurations shipped by OS vendors.
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/pyca/cryptography/pull/520/files#r9240191>
> .
>



-- 
"I disapprove of what you say, but I will defend to the death your right to
say it." -- Evelyn Beatrice Hall (summarizing Voltaire)
"The people's good is the highest law." -- Cicero
GPG Key fingerprint: 125F 5C67 DFE9 4084