exdjango v0.3.1 ExDjango.Pbkdf2
Module to handle django pbkdf2_sha256 and pbkdf2_sha512 authentication.
Comeonin didn’t want to support pbkdf2_sha256 so copied to here.
Comeonin password hashes start with $ it will work with both Django and Comeonin password hashes.
To generate a password hash, use the hashpwsalt
function:
ExDjango.Pbkdf2.hashpwsalt("hard to guess")
ExDjango.Pbkdf2.hashpwsalt("hard to guess", 20_000, :sha256)
To check the password against a password hash, use the checkpw
function:
ExDjango.Pbkdf2.checkpw("hard to guess", stored_hash)
There is also a dummy_checkpw
, which can be used to stop an attacker guessing
a username by timing the responses.
See the documentation for each function for more details.
Most users will not need to use any of the other functions in this module.
Pbkdf2
Pbkdf2 is a password-based key derivation function that uses a password, a variable-length salt and an iteration count and applies a pseudorandom function to these to produce a key.
The original implementation used SHA-1 as the pseudorandom function, but this version uses HMAC-SHA-256.
Summary
Functions
Check the password
Perform a dummy check for a user that does not exist. This always returns false. The reason for implementing this check is in order to make user enumeration by timing responses more difficult
Generate a salt for use with the hashpass
function
Hash the password using pbkdf2_sha256
Hash the password with a salt which is randomly generated
Calculate pbkdf2 hash
Functions
Check the password.
The check is performed in constant time to avoid timing attacks.
Perform a dummy check for a user that does not exist. This always returns false. The reason for implementing this check is in order to make user enumeration by timing responses more difficult.
Generate a salt for use with the hashpass
function.
The minimum length of the salt is 16 and the maximum length is 1024. The default is 16.
Hash the password using pbkdf2_sha256.
Hash the password with a salt which is randomly generated.
To change the complexity (and the time taken) of the password hash
calculation, you need to change the value for pbkdf2_rounds
in the config file.