Skip to content

Implement hashlib.new('sha256') and enable it for CLUE #10740

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tannewt merged 7 commits into from
Dec 9, 2025
Merged

Implement hashlib.new('sha256') and enable it for CLUE #10740

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
3453683
implement hashlib.new('sha256') support
samblenny Dec 5, 2025
f80d992
enable hashlib sha1 & sha256 for CLUE board
samblenny Dec 5, 2025
30c8dd6
default to enabling SHA256 when hashlib is enabled
samblenny Dec 8, 2025
f9d5778
turn on hashlib for all nrf52840 boards
samblenny Dec 8, 2025
fabe72b
remove redundant hashlib enable for CLUE
samblenny Dec 8, 2025
c1bd53d
remove CIRCUITPY_HASHLIB_SHA256 ifdef guards
samblenny Dec 8, 2025
39332eb
fix hashlib.new() documentation comment
samblenny Dec 8, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions ports/nordic/boards/clue_nrf52840_express/mpconfigboard.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,3 +7,6 @@ MCU_CHIP = nrf52840

QSPI_FLASH_FILESYSTEM = 1
EXTERNAL_FLASH_DEVICES = "GD25Q16C, W25Q16JVxQ"

CIRCUITPY_HASHLIB = 1
CIRCUITPY_HASHLIB_SHA256 = 1
Copy link
Member

@tannewt tannewt Dec 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Need this still? Looks like it fit everywhere.

Copy link
Collaborator

@dhalbert dhalbert Dec 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree maybe just take this out and take out the guards

Copy link
Author

@samblenny samblenny Dec 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's the bit that lets me actually use it on the board I'm implementing this for as the nordic port doesn't turn hashlib on by default. Are you suggesting maybe do a CIRCUITPY_HASHLIB = 1 at the port level for nordic?

Copy link
Member

@tannewt tannewt Dec 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, ok. This is fine then.

Copy link
Member

@tannewt tannewt Dec 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, maybe @dhalbert is saying to remove CIRCUITPY_HASHLIB_SHA256 which you also don't need. So, leave CIRCUITPY_HASHLIB here but remove the new _SHA256 define.

Copy link
Author

@samblenny samblenny Dec 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking at ports/nordic/mpconfigport.mk, I see a comment suggesting that space is tight on nrf52833. What if I just enable hashlib in the ifeq ($(MCU_CHIP),nrf52840) section for the nrf52840 boards?

Copy link
Author

@samblenny samblenny Dec 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I just pushed a couple commits to enable hashlib at the port level for nrf52840 boards (not nrf52833 though) and remove the redundant hashlib enable for CLUE.

Copy link
Collaborator

@dhalbert dhalbert Dec 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, maybe @dhalbert is saying to remove CIRCUITPY_HASHLIB_SHA256 which you also don't need. So, leave CIRCUITPY_HASHLIB here but remove the new _SHA256 define.

This is one of the things I was saying. If hashlib is enabled, don't do finegrain choices on the algorithms right now. I think if there's room for SHA1, there'd be room for SHA256.

Copy link
Author

@samblenny samblenny Dec 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

so, should I remove the ifdef guard for CIRCUITPY_HASHLIB_SHA256?

Copy link
Collaborator

@dhalbert dhalbert Dec 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, I think you can just get rid of it, if it fits on the Espressif and Pico W.

3 changes: 3 additions & 0 deletions py/circuitpy_mpconfig.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -343,6 +343,9 @@ CFLAGS += -DCIRCUITPY_HASHLIB_MBEDTLS=$(CIRCUITPY_HASHLIB_MBEDTLS)
CIRCUITPY_HASHLIB_MBEDTLS_ONLY ?= $(call enable-if-all,$(CIRCUITPY_HASHLIB_MBEDTLS) $(call enable-if-not,$(CIRCUITPY_SSL)))
CFLAGS += -DCIRCUITPY_HASHLIB_MBEDTLS_ONLY=$(CIRCUITPY_HASHLIB_MBEDTLS_ONLY)

CIRCUITPY_HASHLIB_SHA256 ?= $(CIRCUITPY_HASHLIB)
CFLAGS += -DCIRCUITPY_HASHLIB_SHA256=$(CIRCUITPY_HASHLIB_SHA256)

CIRCUITPY_I2CTARGET ?= $(CIRCUITPY_FULL_BUILD)
CFLAGS += -DCIRCUITPY_I2CTARGET=$(CIRCUITPY_I2CTARGET)

Expand Down
20 changes: 20 additions & 0 deletions shared-module/hashlib/Hash.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,12 @@ void common_hal_hashlib_hash_update(hashlib_hash_obj_t *self, const uint8_t *dat
mbedtls_sha1_update_ret(&self->sha1, data, datalen);
return;
}
#if CIRCUITPY_HASHLIB_SHA256
else if (self->hash_type == MBEDTLS_SSL_HASH_SHA256) {
mbedtls_sha256_update_ret(&self->sha256, data, datalen);
return;
}
#endif
}

void common_hal_hashlib_hash_digest(hashlib_hash_obj_t *self, uint8_t *data, size_t datalen) {
Expand All @@ -28,11 +34,25 @@ void common_hal_hashlib_hash_digest(hashlib_hash_obj_t *self, uint8_t *data, siz
mbedtls_sha1_finish_ret(&self->sha1, data);
mbedtls_sha1_clone(&self->sha1, &copy);
}
#if CIRCUITPY_HASHLIB_SHA256
else if (self->hash_type == MBEDTLS_SSL_HASH_SHA256) {
mbedtls_sha256_context copy;
mbedtls_sha256_clone(&copy, &self->sha256);
mbedtls_sha256_finish_ret(&self->sha256, data);
mbedtls_sha256_clone(&self->sha256, &copy);
}
#endif
}

size_t common_hal_hashlib_hash_get_digest_size(hashlib_hash_obj_t *self) {
if (self->hash_type == MBEDTLS_SSL_HASH_SHA1) {
return 20;
}
#if CIRCUITPY_HASHLIB_SHA256
else if (self->hash_type == MBEDTLS_SSL_HASH_SHA256) {
return 32;
}
#endif

return 0;
}
6 changes: 6 additions & 0 deletions shared-module/hashlib/Hash.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,11 +7,17 @@
#pragma once

#include "mbedtls/sha1.h"
#if CIRCUITPY_HASHLIB_SHA256
#include "mbedtls/sha256.h"
#endif

typedef struct {
mp_obj_base_t base;
union {
mbedtls_sha1_context sha1;
#if CIRCUITPY_HASHLIB_SHA256
mbedtls_sha256_context sha256;
#endif
};
// Of MBEDTLS_SSL_HASH_*
uint8_t hash_type;
Expand Down
8 changes: 8 additions & 0 deletions shared-module/hashlib/__init__.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,5 +17,13 @@ bool common_hal_hashlib_new(hashlib_hash_obj_t *self, const char *algorithm) {
mbedtls_sha1_starts_ret(&self->sha1);
return true;
}
#if CIRCUITPY_HASHLIB_SHA256
else if (strcmp(algorithm, "sha256") == 0) {
self->hash_type = MBEDTLS_SSL_HASH_SHA256;
mbedtls_sha256_init(&self->sha256);
mbedtls_sha256_starts_ret(&self->sha256, 0);
return true;
}
#endif
return false;
}
7 changes: 7 additions & 0 deletions shared-module/hashlib/__init__.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,4 +13,11 @@
#define mbedtls_sha1_starts_ret mbedtls_sha1_starts
#define mbedtls_sha1_update_ret mbedtls_sha1_update
#define mbedtls_sha1_finish_ret mbedtls_sha1_finish

#if CIRCUITPY_HASHLIB_SHA256
#define mbedtls_sha256_starts_ret mbedtls_sha256_starts
#define mbedtls_sha256_update_ret mbedtls_sha256_update
#define mbedtls_sha256_finish_ret mbedtls_sha256_finish
#endif

#endif