3 ms·
Django provides this and you don't have to worry about it. However, they did not for a bit, even as the discussions raged on about how salt + SHA1 is bad. The r
by IgorPartola 11y ago
Django provides this and you don't have to worry about it. However, they did not for a bit, even as the discussions raged on about how salt + SHA1 is bad. The reason was that Django is 100% pure Python and at the time the only available implementations of any of this were C Python extensions. Ideally, I'd love to see bcrypt, scrypt, and PBKDF2 included directly in Python's stdlib so that people wouldn't have to re-invent the wheel every time they use the language.
- masklinn 11y agopbkdf2 is included in Python's stdlib since 2.7.8[0] and 3.4[1], though sadly the interface isn't great: it outputs the hash only, not a modular crypt[2] and it requires a salt instead of generating one. Passlib[3] provides more algorithms, a much better interface and handles hash migrations[4] ridiculously cleanly. [0] https://docs.python.org/2/library/hashlib.html#hashlib.pbkdf2_hmac https://docs.python.org/2/library/hashlib.html#hashlib.pbkdf... [1] https://docs.python.org/3.5/library/hashlib.html#hashlib.pbkdf2_hmac https://docs.python.org/3.5/library/hashlib.html#hashlib.pbk... [2] http://pythonhosted.org/passlib/modular_crypt_format.html#modular-crypt-format http://pythonhosted.org/passlib/modular_crypt_format.html#mo... [3] http://pythonhosted.org/passlib http://pythonhosted.org/passlib [4] increase of rounds # or KDF change http://pythonhosted.org/passlib/lib/passlib.context-tutorial.html#deprecation-hash-migration http://pythonhosted.org/passlib/lib/passlib.context-tutorial...