exdjango v0.3.3 ExDjango.Pbkdf2

Module to handle django pbkdf2_sha256 and pbkdf2_sha512 authentication.

Comeonin didn’t want to support pbkdf2_sha256 so copied to here.

Comeonin password hashes start with $ it will work with both Django and Comeonin password hashes.

To generate a password hash, use the hashpwsalt function:

ExDjango.Pbkdf2.hashpwsalt("hard to guess")
ExDjango.Pbkdf2.hashpwsalt("hard to guess", 20_000, :sha256)

To check the password against a password hash, use the checkpw function:

ExDjango.Pbkdf2.checkpw("hard to guess", stored_hash)

There is also a dummy_checkpw, which can be used to stop an attacker guessing a username by timing the responses.

See the documentation for each function for more details.

Most users will not need to use any of the other functions in this module.

Pbkdf2

Pbkdf2 is a password-based key derivation function that uses a password, a variable-length salt and an iteration count and applies a pseudorandom function to these to produce a key.

The original implementation used SHA-1 as the pseudorandom function, but this version uses HMAC-SHA-256.

Summary

Functions

Check the password

Perform a dummy check for a user that does not exist. This always returns false. The reason for implementing this check is in order to make user enumeration by timing responses more difficult

Generate a salt for use with the hashpass function

Hash the password with a salt which is randomly generated

Calculate pbkdf2 hash

Functions

checkpw(password, hash)

Check the password.

The check is performed in constant time to avoid timing attacks.

dummy_checkpw()

Perform a dummy check for a user that does not exist. This always returns false. The reason for implementing this check is in order to make user enumeration by timing responses more difficult.

gen_salt(salt_length \\ 12)

Generate a salt for use with the hashpass function.

The minimum length of the salt is 16 and the maximum length is 1024. The default is 16.

hashpass(password, salt, rounds \\ 20000, algorithm \\ :sha256)

Hash the password using pbkdf2_sha256.

hashpwsalt(password, rounds \\ 20000, algorithm \\ :sha256)

Hash the password with a salt which is randomly generated.

To change the complexity (and the time taken) of the password hash calculation, you need to change the value for pbkdf2_rounds in the config file.

pbkdf2(atom, password, salt, rounds)

Calculate pbkdf2 hash