"Steve D'Aprano" wrote in message
news:585d57d5$0$1587$c3e8da3$54964...@news.astraweb.com...
There is a stdlib PBKDF2. If you want to avoid third-party dependencies,
use that.
https://docs.python.org/3.4/library/hashlib.html#hashlib.pbkdf2_hmac
Thanks for the pointer.
From the docs - 15.1.3. Key derivation -
"The number of iterations should be chosen based on the hash algorithm and
computing power. As of 2013, at least 100,000 iterations of SHA-256 are
suggested."
So FWIW, this is what I have come up with -
from hashlib import pbkdf2_hmac as kdf
from secrets import token_bytes
from json import loads, dumps
def gen_password(pwd):
hash_name = 'sha256'
salt = token_bytes(16)
iterations = 100000
dk = kdf(hash_name, pwd.encode('utf-8'), salt, iterations)
return dumps([hash_name, salt.hex(), iterations, dk.hex()])
def chk_password(pwd_hash, pwd):
hash_name, salt, iterations, dk = loads(pwd_hash)
return (kdf(hash_name, pwd.encode('utf-8'), bytes.fromhex(salt),
iterations)
== bytes.fromhex(dk))
pwd = 'this is my secret passphrase'
pwd_hash = gen_password(pwd)
print(pwd_hash)
print(chk_password(pwd_hash, pwd))
["sha256", "2cd1150b98dab7219136c8deceda00e3", 100000,
"6301857d79554c3e2035fc779e4903f098ba2df36536028b72952426a5773f0a"]
True
I know that 'rolling your own' is a no-no when it comes to security. I don't
know whether this falls into that category or not, but I will run with it
for now.
Frank
--
https://mail.python.org/mailman/listinfo/python-list
