Description
My Django==6.0.6 application is throwing a warning:
[redacted]/jwt/api_jwt.py:147: InsecureKeyLengthWarning: The HMAC key is 40 bytes long, which is below the minimum recommended length of 64 bytes for SHA512. See RFC 7518 Section 3.2
Relevant requirements:
duo_universal==2.2.0
PyJWT==2.13.0
Working backwards:
https://github.com/jpadilla/pyjwt/blob/2.13.0/jwt/api_jwt.py#L147-L154 is a call from PyJWT.encode() to self._jws.encode() where the second parameter is key.
https://github.com/duosecurity/duo_universal_python/blob/2.2.0/duo_universal/client.py#L254-L256 is a call to jwt.encode() where the second parameter is self._client_secret.
Client secrets from the Duo tenant are only 40 characters long, so they come up short on this.
Expected Behavior
No warnings
Actual Behavior
Warnings.
Workarounds
Ignoring the warnings and hoping it doesn't become an issue.
Description
My
Django==6.0.6application is throwing a warning:[redacted]/jwt/api_jwt.py:147: InsecureKeyLengthWarning: The HMAC key is 40 bytes long, which is below the minimum recommended length of 64 bytes for SHA512. See RFC 7518 Section 3.2Relevant requirements:
Working backwards:
https://github.com/jpadilla/pyjwt/blob/2.13.0/jwt/api_jwt.py#L147-L154 is a call from
PyJWT.encode()toself._jws.encode()where the second parameter iskey.https://github.com/duosecurity/duo_universal_python/blob/2.2.0/duo_universal/client.py#L254-L256 is a call to
jwt.encode()where the second parameter isself._client_secret.Client secrets from the Duo tenant are only 40 characters long, so they come up short on this.
Expected Behavior
No warnings
Actual Behavior
Warnings.
Workarounds
Ignoring the warnings and hoping it doesn't become an issue.