GeezerVison is showing github.com — ValueError: [Provider routines] invalid salt length in test_hashlibtest_pbkdf2_hmac_c on FIPS w/ OpenSSL 4.0.3 · Issue #161739 · python/cpython
ValueError: [Provider routines] invalid salt length in test_hashlibtest_pbkdf2_hmac_c on FIPS w/ OpenSSL 4.0.3 #161739DescriptionBug report
So far reproduced on Fedora 45+ in Python 3.15.2 and 3.16.0a1. I plan to build Python from main branch as well and report back.
Fedora 45+ has OpenSSL 4.
When working on https://discuss.python.org/t/running-test-hashlib-test-hmac-test-ssl-with-openssl-force-fips-mode-1-on-ci/109971 I realized a test fails.
$ rpm -q openssl-libs python3-test python3.16-test
openssl-libs-4.0.3-1.fc45.x86_64
python3-test-3.15.2-1.fc45.x86_64
python3.16-test-3.16.0~a1-1.fc45.x86_64
$ OPENSSL_FORCE_FIPS_MODE=1 python3.16 -m test test_hashlib # or python3.15
Using random seed: 3310403751
0:00:00 load avg: 6.69 mem: 20.6 MiB Run 1 test sequentially in a single process
0:00:00 load avg: 6.69 mem: 20.6 MiB [1/1] test_hashlib
test test_hashlib failed -- Traceback (most recent call last):
File "/usr/lib64/python3.16/test/test_hashlib.py", line 1330, in test_pbkdf2_hmac_c
self._test_pbkdf2_hmac(openssl_hashlib.pbkdf2_hmac, openssl_md_meth_names)
~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/python3.16/test/test_hashlib.py", line 1288, in _test_pbkdf2_hmac
out = pbkdf2(digest_name, password, salt, rounds, dklen)
ValueError: [Provider routines] invalid salt length
0:00:01 load avg: 6.69 mem: 42.6 MiB [1/1/1] test_hashlib failed (1 error)
== Tests result: FAILURE ==
1 test failed:
test_hashlib
Total duration: 1.1 sec
Total tests: run=94 skipped=20
Total test files: run=1/1 failed=1
Result: FAILURE
CPython versions tested on:
3.16, 3.15, CPython main branch
Operating systems tested on:
Linux
Linked PRs
Activityhroncok commented on Nov 10, 2026 ContributorAuthor More actions picnixz commented on Nov 10, 2026 FIPS builds are really a pain to maintain in tests. I'm assuming it's because we are using either a too small value or something like that? hroncok commented on Nov 10, 2026 ContributorAuthor More actions hroncok commented on Nov 10, 2026 ContributorAuthor More actions I suppose keeping the tests, adding:
if self.is_fips_mode and len(salt) < 16:
self.skipTest("skip in FIPS mode")and possibly adding a few more with longer salt? picnixz commented on Nov 10, 2026 Yeah I think so. Or just change the salt to something longer if this doesn't slow the tests too much. But some tests might exercise very small salts maybe. hroncok commented on Nov 10, 2026 ContributorAuthor More actions $ OPENSSL_FORCE_FIPS_MODE=1 python3
Python 3.15.2 (3.15.2-1.fc45.x86_64, Oct 26 2026, 00:00:00) [GCC 16.2.1 20260819 (Red Hat 16.2.1-2)] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import _hashlib
... for n in range(0, 20):
... salt = b'x' * n
... try:
... out = _hashlib.pbkdf2_hmac('sha1', b'password', salt, 4096, 20)
... print(n, 'OK')
... except Exception as e:
... print(n, 'FAIL', e)
...
0 FAIL [Provider routines] invalid salt length
1 FAIL [Provider routines] invalid salt length
2 FAIL [Provider routines] invalid salt length
3 FAIL [Provider routines] invalid salt length
4 FAIL [Provider routines] invalid salt length
5 FAIL [Provider routines] invalid salt length
6 FAIL [Provider routines] invalid salt length
7 FAIL [Provider routines] invalid salt length
8 FAIL [Provider routines] invalid salt length
9 FAIL [Provider routines] invalid salt length
10 FAIL [Provider routines] invalid salt length
11 FAIL [Provider routines] invalid salt length
12 FAIL [Provider routines] invalid salt length
13 FAIL [Provider routines] invalid salt length
14 FAIL [Provider routines] invalid salt length
15 FAIL [Provider routines] invalid salt length
16 OK
17 OK
18 OK
19 OK
hroncok commented on Nov 10, 2026 ContributorAuthor More actions
Or just change the salt to something longer
Some of the tests say official test vectors from RFC 6070 so I don't want to change them picnixz commented on Nov 10, 2026 Yeah official test vectors must be skipped for that. I'd appreciate if the fix uses a decorator-approach or some self.pbkdf2_hmac_check_fips_compatibility(salt)
MetadataMetadataDevelopmentNo branches or pull requestsIssue actions
|