Adding usedforsecurity var in get_imphash(self) function in pefile.py to bypass FIPS compliance #461
Description
We are proposing to add a new usedforsecurity variable in the get_imphash(self) function in pefile.py to allow bypassing FIPS compliance when calculating the imphash of a file. The pefile module currently uses the MD5 algorithm to calculate the imphash, but MD5 is banned in FIPS-compliant environments, which prevents pefile from running in those systems.
The usedforsecurity flag would be particularly useful in environments where FIPS is enabled, as MD5 is not allowed. After Python 3.9, the usedforsecurity variable can be set to False to bypass the FIPS restriction. We propose modifying the get_imphash() function to accept an optional usedforsecurity parameter, which would allow bypassing FIPS compliance when set to False (with the default remaining True). This change would ensure that the get_imphash() function can be used in both FIPS-compliant and non-compliant environments without issues, providing the flexibility to disable FIPS compliance for MD5 when necessary. This solution would address the current limitation and improve compatibility with systems that require MD5 hash functionality.
Ex. Add usedforsecurity variable in function and set default value to True:
def get_imphash(self, usedforsecurity=True)
Ex. Return md5 hash with usedforsecurity
return md5(",".join(impstrs).encode(), usedforsecurity=usedforsecurity).hexdigest()
Activity
[-]Adding `userforsecurity` var in `get_imphash(self)` function in `pefile.py` to bypass FIPS compliance[/-][+]Adding `usedforsecurity` var in `get_imphash(self)` function in `pefile.py` to bypass FIPS compliance[/+]nightlark commentedon Feb 3, 2026
PR merged. If we want to keep support for older Python versions, we could add a check for
sys.version_info >= (3, 9)that calls with the parameter in Python versions >= 3.9, otherwise call it without the parameter.