Last active
June 26, 2019 22:07
-
-
Save simonwhitaker/4474381 to your computer and use it in GitHub Desktop.
A Django password hasher that uses SHA512 instead of the default SHA256
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import hashlib | |
from django.contrib.auth.hashers import PBKDF2PasswordHasher | |
class PBKDF2SHA512PasswordHasher(PBKDF2PasswordHasher): | |
""" | |
Alternate PBKDF2 hasher which uses SHA512 instead of SHA256. | |
Note: As of Django 1.4.3, django.contrib.auth.models.User defines password | |
with max_length=128 | |
Our superclass (PBKDF2PasswordHasher) generates the entry for that field | |
using the following format (see | |
https://github.com/django/django/blob/1.4.3/django/contrib/auth/hashers.py#L187): | |
"%s$%d$%s$%s" % (self.algorithm, iterations, salt, hash) | |
The lengths of the various bits in that format are: | |
13 self.algorithm ("pbkdf2_sha512") | |
5 iterations ("10000" - inherited from superclass) | |
12 salt (generated using django.utils.crypto.get_random_string()) | |
89 hash (see below) | |
3 length of the three '$' separators | |
--- | |
122 TOTAL | |
122 <= 128, so we're all good. | |
NOTES | |
hash is the base-64 encoded output of django.utils.crypto.pbkdf2(password, salt, | |
iterations, digest=hashlib.sha512), which is 89 characters according to my tests. | |
>>> import hashlib | |
>>> from django.utils.crypto import pbkdf2 | |
>>> len(pbkdf2('t0ps3kr1t', 'saltsaltsalt', 10000, 0, hashlib.sha512).encode('base64').strip()) | |
89 | |
It's feasible that future versions of Django will increase the number of iterations | |
(but we only lose one character per power-of-ten increase), or the salt length. That | |
will cause problems if it leads to a password string longer than 128 characters, but | |
let's worry about that when it happens. | |
""" | |
algorithm = "pbkdf2_sha512" | |
digest = hashlib.sha512 | |
Ha! Cheers Sym. :)
where should i put it? :)
where should i put it? :)
https://docs.djangoproject.com/en/2.2/topics/auth/passwords/#auth-password-storage
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
You win all the comment to code ratio prizes!