#32275 closed New feature (fixed)
Add scrypt password hasher
| Reported by: | Alex Gaynor | Owned by: | Anthony Wright |
|---|---|---|---|
| Component: | contrib.auth | Version: | dev |
| Severity: | Normal | Keywords: | |
| Cc: | Anthony Wright | Triage Stage: | Ready for checkin |
| Has patch: | yes | Needs documentation: | no |
| Needs tests: | no | Patch needs improvement: | no |
| Easy pickings: | no | UI/UX: | no |
| Pull Requests: | |||
Description ¶
Currently django defaults to PBKDF2, with options (using third party libraries) for bcrypt and argon2 (and then a large number of legacy options that should be avoided).
When PBKDF2 was originally chosen as the default, it was selected because it was the most secure option that could reasonably be implemented in pure Python with the stdlib.
As of Python 3.6, scrypt is available in the stdlib. scrypt is also substantially more secure than PBKDF2, because it is memory hard. See https://www.tarsnap.com/scrypt/scrypt.pdf (page 14) for a table that assess the relative cost-to-brute-force of scrypt vs. PBKDF2 at the interactive latency.
For these reasons, I think it'd be appropriate for Django to include an scrypt based hasher, and even to default to it for new installations.
Change History (12)
comment:1 by , 4 years ago
comment:2 by , 4 years ago
| Summary: | Offer an scrypt based password hasher → Add scrypt password hasher |
|---|---|
| Triage Stage: | Unreviewed → Accepted |
comment:3 by , 4 years ago
| Cc: | added |
|---|---|
| Owner: | changed from to |
| Status: | new → assigned |
comment:4 by , 4 years ago
Wrote scrypt function in crypto.py which uses the hashlib.scrypt function. Wrote ScryptPasswordHasher class in Hashers.py and added it as an option in global_settings. Currently working on tests.
comment:8 by , 4 years ago
| Patch needs improvement: | set |
|---|
comment:9 by , 4 years ago
| Needs documentation: | set |
|---|---|
| Patch needs improvement: | unset |
comment:10 by , 4 years ago
| Needs documentation: | unset |
|---|---|
| Triage Stage: | Accepted → Ready for checkin |
I should note, that while I can't make any commitments on behalf of a 3rd party, I think there's a reasonable chance this would qualify for a reward under Google's Patch Rewards program: https://www.google.com/about/appsecurity/patch-rewards/ (I have no affiliation with Google)
Link to the scrypt docs: https://docs.python.org/3/library/hashlib.html#hashlib.scrypt