What does itsdangerous do to sign the string?

Question

I want a client to send me a signature which I can "unsign" I found a cool package written in Python called itsdangerous which does everything I need...

>>> from itsdangerous import Signer
>>> s = Signer('secret-key')
>>> s.sign('Things you and me should only know')
'my string.wh6tMHxLgJqB6oY1uT73iMlyrOA'
>>> s.unsign('my string.wh6tMHxLgJqB6oY1uT73iMlyrOA')
'my string'

It works perfectly, however my client is not using Python so how do they sign the string i.e. what does itsdangerous actually do to hash the sting that my client needs to recreate.

@CoryKramer so is it safe to say itsdangerous can only be used with Python? What alternatives are there, is there a standard which all languages use? — Prometheus, Jun 19 '15 at 12:50
It is all here https://github.com/mitsuhiko/itsdangerous/blob/master/itsdangerous.py#L272 — Padraic Cunningham, Jun 19 '15 at 12:51
So is it safe to say itsdangerous is Python only? If so what alternatives are there? Any standard all languages use? — Prometheus, Jun 19 '15 at 12:51
If you look at the methods in the class you can see exactly how it is implemented, all the information you need is in the link above — Padraic Cunningham, Jun 19 '15 at 12:53

score 3 · Accepted Answer · edited Jun 20 '20 at 09:12

From their documentation

class itsdangerous.Signer(secret_key, salt=None, sep='.', key_derivation=None, digest_method=None, algorithm=None)

This class can sign bytes and unsign it and validate the signature provided.

Salt can be used to namespace the hash, so that a signed string is only valid for a given namespace. Leaving this at the default value or re-using a salt value across different parts of your application where the same signed value in one part can mean something different in another part is a security risk.

Then to actually hash (emphasis mine)

default_digest_method()
The digest method to use for the signer. This defaults to sha1 but can be changed for any other function in the hashlib module.

So assuming you only hash, and don't salt afterward, they can reproduce this result with a SHA-1 hash.

I see, perfect SHA-1 hash I see this can be done in JS too http://www.movable-type.co.uk/scripts/sha1.html thanks — Prometheus, Jun 19 '15 at 12:53

What does itsdangerous do to sign the string?

1 Answers1