Disable identities if blake2b is not available

[mivds]

Resolves #2354

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sumit-gupta-sgt]

Hi @mivds, Thank you for addressing the FIPS compatibility issue in soda-core by removing the digest_size argument from hashlib.blake2b(). This change is crucial for ensuring the library functions correctly in FIPS-enabled environments.

To further enhance compatibility and avoid potential issues with openssl_blake2b, I recommend implementing a fallback mechanism that attempts to use hashlib.blake2b() without the digest_size argument. If that fails, the system should gracefully fall back to hashlib.sha256() or return None if hashing isn't feasible. This approach ensures that the library remains functional across various environments, including those with strict cryptographic standards.

import hashlib
from typing import Optional

def get_identity(data: str, digest_size: int = 16) -> Optional[str]:
"""
Generate a FIPS-safe identity hash for the given data.

- Uses blake2b with digest_size if supported.
- Falls back to default blake2b if digest_size not supported.
- Falls back to SHA256 if blake2b is unavailable (e.g., FIPS mode).
- Returns None if no hash can be generated.
"""
encoded_data = data.encode("utf-8")

# Try blake2b with digest_size
try:
    return hashlib.blake2b(encoded_data, digest_size=digest_size).hexdigest()
except (TypeError, ValueError):
    pass  # Likely FIPS/OpenSSL restriction

# Try default blake2b
try:
    return hashlib.blake2b(encoded_data).hexdigest()
except (AttributeError, ValueError):
    pass  # Blake2b unavailable

# Fallback to SHA256 (FIPS-safe)
try:
    return hashlib.sha256(encoded_data).hexdigest()
except Exception:
    pass  # Extremely unlikely

# Return None if everything fails
return None

Implementing this fallback mechanism will enhance the robustness of soda-core in diverse environments. Please let me know if you need assistance integrating this solution or if you have any questions.

[mark-boyle-sp]

What is the downside to none Identity ?