Opened 9 years ago

Closed 9 years ago

#26033 closed New feature (fixed)

Add argon2 password hasher

Reported by: Tim Graham Owned by: nobody
Component: contrib.auth Version: dev
Severity: Normal Keywords: 1.10
Cc: Adrian Moisey Triage Stage: Ready for checkin
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: no
Pull Requests:5876 merged, 6489 merged

Description

argon2 is the winner of the Password Hashing Competition and there was no objections on the mailing list to adding it.

PR

Change History (11)

comment:1 by Tim Graham, 9 years ago

Needs documentation: set

Patch is missing documentation.

comment:2 by Tim Graham, 9 years ago

Needs documentation: unset

comment:3 by Adrian Moisey, 9 years ago

Cc: Adrian Moisey added

comment:4 by Tim Graham, 9 years ago

Patch needs improvement: set

Left a few more comments for improvement.

comment:5 by Tim Graham, 9 years ago

Patch needs improvement: unset

comment:6 by Tim Graham <timograham@…>, 9 years ago

Resolution: fixed
Status: newclosed

In b4250ea:

Fixed #26033 -- Added Argon2 password hasher.

comment:7 by Tim Graham <timograham@…>, 9 years ago

In e47b5225:

Refs #26033 -- Temporarily pinned argon2-cffi test requirement.

The latest version (16.1) is backwards-incompatible for Django.

comment:8 by Tim Graham, 9 years ago

Has patch: unset
Keywords: 1.10 added
Resolution: fixed
Status: closednew

As discussed on the original pull request, Bas will provide a patch for compatibility with argon2-cffi 16.1.

comment:9 by Tim Graham, 9 years ago

Has patch: set
Triage Stage: AcceptedReady for checkin

PR for Argon2 1.3 support.

comment:10 by Tim Graham <timograham@…>, 9 years ago

In a5033db:

Refs #26033 -- Added password hasher support for Argon2 v1.3.

The previous version of Argon2 uses encoded hashes of the form:

$argon2d$m=8,t=1,p=1$<salt>$<data>

The new version of Argon2 adds its version into the hash:

$argon2d$v=19$m=8,t=1,p=1$<salt>$<data>

This lets Django handle both version properly.

comment:11 by Tim Graham, 9 years ago

Resolution: fixed
Status: newclosed
Note: See TracTickets for help on using tickets.
Back to Top