Implement hashlib.new('sha256') and enable it for CLUE #10740

samblenny · 2025-12-05T19:56:49Z

The point of this is to:

Make it possible to use a CLUE board as a TOTP token that supports the SHA1 and SHA256 hash algorithm options for fast updating (pure python hashes take 2+ seconds)
Add optional SHA256 support to hashlib that can be used by other things that need it (e.g. CircuitMatter)

List of specific changes:

Implement 'sha256' option for hashlib.new()
Gate SHA256 stuff behind #ifdef CIRCUITPY_HASHLIB_SHA256
Enable hashlib with 'sha1' and 'sha256' for ports/nordic/clue_nrf52840_express

Checklist:

pre-commit passed
builds without errors
test code runs on CLUE board with same results as CPython

Test Code:

Adafruit CircuitPython 10.1.0-beta.1-5-g108860a837-dirty on 2025-12-05; Adafruit CLUE nRF52840 Express with nRF52840
>>> import hashlib
>>> s1 = hashlib.new('sha1', b'SHA1 Hash')
>>> s2 = hashlib.new('sha256', b'SHA256 Hash')
>>> s1.digest().hex()
'a28191ff62cce66838e67c16dd48ab118c27b417'
>>> s2.digest().hex()
'2023b38445ae586b672848c31e3e13883f17fd07531c9aa2b8f212b3b7a0d11f'

samblenny · 2025-12-08T18:07:45Z

Open question: Should this be turned on for other boards/ports? Dan suggested on discord that it might be useful to try turning on the SHA256 option for stuff that already enables hashlib to see if it fits.

dhalbert · 2025-12-08T18:28:32Z

Open question: Should this be turned on for other boards/ports? Dan suggested on discord that it might be useful to try turning on the SHA256 option for stuff that already enables hashlib to see if it fits.

Go ahead and try it. Just set CIRCUITPY_HASHLIB_SHA256 = $(CIRCUITPY_HASHLIB) in circuitpy_mpconfig.mk, I think, and re-run the PR. If it doesn't fit we'll see failures. That's how we check in general.

samblenny · 2025-12-08T18:40:28Z

Just pushed a commit to have the SHA256 option take its default from CIRCUITPY_HASHLIB.

samblenny · 2025-12-08T18:53:20Z

Also tried local builds for a couple more nordic boards (nordic port defaults to hashlib off), and they fit fine:

clue_nrf52840_express FLASH_FIRMWARE %age Used: 76.93%
feather_nrf52840_express FLASH_FIRMWARE %age Used: 75.87%
feather_bluefruit_sense FLASH_FIRMWARE %age Used: 75.49%

samblenny · 2025-12-08T20:02:13Z

checks passed. I guess SHA256 fits fine then.

tannewt

One small thing. Looks great otherwise!

tannewt · 2025-12-08T20:02:16Z

ports/nordic/boards/clue_nrf52840_express/mpconfigboard.mk

+
+CIRCUITPY_HASHLIB = 1
+CIRCUITPY_HASHLIB_SHA256 = 1


Need this still? Looks like it fit everywhere.

I agree maybe just take this out and take out the guards

That's the bit that lets me actually use it on the board I'm implementing this for as the nordic port doesn't turn hashlib on by default. Are you suggesting maybe do a CIRCUITPY_HASHLIB = 1 at the port level for nordic?

Ah, ok. This is fine then.

Ah, maybe @dhalbert is saying to remove CIRCUITPY_HASHLIB_SHA256 which you also don't need. So, leave CIRCUITPY_HASHLIB here but remove the new _SHA256 define.

Looking at ports/nordic/mpconfigport.mk, I see a comment suggesting that space is tight on nrf52833. What if I just enable hashlib in the ifeq ($(MCU_CHIP),nrf52840) section for the nrf52840 boards?

I just pushed a couple commits to enable hashlib at the port level for nrf52840 boards (not nrf52833 though) and remove the redundant hashlib enable for CLUE.

Ah, maybe @dhalbert is saying to remove CIRCUITPY_HASHLIB_SHA256 which you also don't need. So, leave CIRCUITPY_HASHLIB here but remove the new _SHA256 define.

This is one of the things I was saying. If hashlib is enabled, don't do finegrain choices on the algorithms right now. I think if there's room for SHA1, there'd be room for SHA256.

so, should I remove the ifdef guard for CIRCUITPY_HASHLIB_SHA256?

yes, I think you can just get rid of it, if it fits on the Espressif and Pico W.

This turns on hashlib at the port level, but only for nrf52840 boards. There's a comment in mpconfigport.mk suggesting that space is already tight on nrf52833 boards.

This is enabled at the port level now.

dhalbert · 2025-12-08T21:44:39Z

There is some minor formatting thing to fix in the doc:

The algorithm is unsupported should not be on the next line like that.

Also maybe now list the algorithms available. That would be a good addition.

samblenny · 2025-12-08T22:30:47Z

@dhalbert I've got changes queued up to make the docs look like this:

If that looks acceptable, I'll commit and push them.

samblenny · 2025-12-08T22:44:33Z

okay, I went ahead and pushed the commit with the docs fix

samblenny · 2025-12-08T23:46:28Z

now Build CI / docs check is failing, but it looks unrelated, probably?

From the build log:

...
zephyr_i2c/__init__.pyi:127: error: Incompatible default for argument "in_end" (default has type "None", argument has type "int")  [assignment]
zephyr_i2c/__init__.pyi:127: note: PEP 484 prohibits implicit Optional. Accordingly, mypy has changed its default to no_implicit_optional=True
zephyr_i2c/__init__.pyi:127: note: Use https://github.com/hauntsaninja/no_implicit_optional to automatically upgrade your codebase
Found 2 errors in 1 file (checked 121 source files)
make: *** [Makefile:292: check-stubs] Error 1
Error: Process completed with exit code 2.

samblenny · 2025-12-09T00:36:44Z

Dan, you've mentioned turning hashlib on for boards that have wifi. From ripgrepping for CIRCUITPY_HASHLIB and CIRCUITPY_WEB_WORKFLOW, cross checked with circuitpython.org included modules lists, it seems the only ports which currently enable hashlib for at least some boards are:

ports/espressif
ports/nordic (after this PR)
ports/raspberrypi

So, that would seem to leave out:

M4 based PyPortal boards
M4/M7 AirLift boards
Various non-rp2/ESP32/nordic Feather boards (potentially to be combined with AirLift FeatherWing)
Various non-rp2/ESP32/nordic ItsyBitsy boards (potentially to be combined with AirLift Bitsy Add-On)
Metro M0 Express + AirLift Shield (but this might not have space for it)

dhalbert · 2025-12-09T01:16:54Z

@samblenny This is fine for now. I mean boards with native wifi. The current ones with hashlib depend on mbedtls. So what you did was add the SHA256 calls. It's consistent.

I am adding wifi/socketpool/ssl for boards that could support AirLift. I don't think I will need hashlib for those boards, because the cryptography is done in the co-processor. Right now PyPortal doesn't need or have hashlib, for instance.

@tannewt #10740 (comment) looks like some kind of type annotation nit in zephyr_i2c.

tannewt · 2025-12-09T17:52:01Z

@tannewt #10740 (comment) looks like some kind of type annotation nit in zephyr_i2c.

Fixed in #10746

tannewt

Looks good! I've fixed the docs issue in a separate PR.

samblenny added 2 commits December 5, 2025 19:39

implement hashlib.new('sha256') support

3453683

enable hashlib sha1 & sha256 for CLUE board

f80d992

samblenny mentioned this pull request Dec 6, 2025

Should we update Mbedtls submodule ref? #10738

Open

default to enabling SHA256 when hashlib is enabled

30c8dd6

tannewt requested changes Dec 8, 2025

View reviewed changes

samblenny added 2 commits December 8, 2025 20:36

turn on hashlib for all nrf52840 boards

f9d5778

This turns on hashlib at the port level, but only for nrf52840 boards. There's a comment in mpconfigport.mk suggesting that space is already tight on nrf52833 boards.

remove redundant hashlib enable for CLUE

fabe72b

This is enabled at the port level now.

remove CIRCUITPY_HASHLIB_SHA256 ifdef guards

c1bd53d

fix hashlib.new() documentation comment

39332eb

tannewt approved these changes Dec 9, 2025

View reviewed changes

tannewt merged commit 648aae0 into adafruit:main Dec 9, 2025
458 of 459 checks passed

Implement hashlib.new('sha256') and enable it for CLUE #10740

Implement hashlib.new('sha256') and enable it for CLUE #10740

Conversation

samblenny commented Dec 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

samblenny commented Dec 8, 2025

Uh oh!

dhalbert commented Dec 8, 2025

Uh oh!

samblenny commented Dec 8, 2025

Uh oh!

samblenny commented Dec 8, 2025

Uh oh!

samblenny commented Dec 8, 2025

Uh oh!

tannewt left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dhalbert commented Dec 8, 2025

Uh oh!

samblenny commented Dec 8, 2025

Uh oh!

samblenny commented Dec 8, 2025

Uh oh!

samblenny commented Dec 8, 2025

Uh oh!

samblenny commented Dec 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dhalbert commented Dec 9, 2025

Uh oh!

tannewt commented Dec 9, 2025

Uh oh!

tannewt left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

samblenny commented Dec 5, 2025 •

edited

Loading

samblenny commented Dec 9, 2025 •

edited

Loading