-
Notifications
You must be signed in to change notification settings - Fork 656
Open
Description
Issue Description:
The hasher function in tf_quant_finance/experimental/pricing_platform/framework/utils.py currently uses the MD5 hash algorithm, which is considered insecure for cryptographic purposes due to its vulnerability to collision attacks. While the function is described as returning a "non-cryptographic hash," it would be prudent to replace MD5 with a more secure hash function like SHA-256 to future-proof the code and align with best practices.
Current Code:
def hasher(obj):
"""Returns non-cryptographic hash of a JSON-serializable object."""
h = hashlib.md5(json.dumps(obj).encode())
return h.hexdigest()Proposed Change:
Replace hashlib.md5 with hashlib.sha256.
Proposed Code:
def hasher(obj):
"""Returns non-cryptographic hash of a JSON-serializable object."""
h = hashlib.sha256(json.dumps(obj).encode())
return h.hexdigest()Location:
utils.py#L20
Justification:
- SHA-256 is more secure and widely accepted for hashing purposes.
- This change would improve the robustness of the code without significantly impacting performance.
Additional Context:
- MD5 is still used in non-cryptographic contexts, but SHA-256 is a better choice for future-proofing and maintaining a higher security standard.
Conclusion:
Please consider updating the hasher function to use SHA-256 instead of MD5.
Thank you for your attention to this matter.
Metadata
Metadata
Assignees
Labels
No labels