id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
32275	Add scrypt password hasher	Alex Gaynor	Anthony Wright	"Currently django defaults to PBKDF2, with options (using third party libraries) for bcrypt and argon2 (and then a large number of legacy options that should be avoided).

When PBKDF2 was originally chosen as the default, it was selected because it was the most secure option that could reasonably be implemented in pure Python with the stdlib.

As of Python 3.6, scrypt is available in the stdlib. scrypt is also substantially more secure than PBKDF2, because it is memory hard. See https://www.tarsnap.com/scrypt/scrypt.pdf (page 14) for a table that assess the relative cost-to-brute-force of scrypt vs. PBKDF2 at the interactive latency.

For these reasons, I think it'd be appropriate for Django to include an scrypt based hasher, and even to default to it for new installations."	New feature	closed	contrib.auth	dev	Normal	fixed		Anthony Wright	Ready for checkin	1	0	0	0	0	0