The rate at which we've increased this has not been keeping up with hardware (and software) improvements, and we're now considerably behind where we should be. The delta between our performance and an optimized implementation's performance prevents us from improving that further, but hopefully once Python 2.7.8 and 3.4+ get into more hands we can more aggressively increase this number.
Python 2.7.7 includes compare_digest in the hmac module, but it requires
both arguments to have the same type. This is usually not a problem on
Python 3 since everything is text, but we have mixed unicode and str on
Python 2 -- hence make sure everything is bytes before feeding it into
compare_digest.
This is a bit faster than ours, which is good, because it lets you increase
the iteration counts.
This will be used on Python 3.4+, and, pending the acceptance of PEP466, on
newer Python 2.7s.
* Renamed smart_unicode to smart_text (but kept the old name under
Python 2 for backwards compatibility).
* Renamed smart_str to smart_bytes.
* Re-introduced smart_str as an alias for smart_text under Python 3
and smart_bytes under Python 2 (which is backwards compatible).
Thus smart_str always returns a str objects.
* Used the new smart_str in a few places where both Python 2 and 3
want a str.
Improved the behavior of get_random_string to re-seed itself each time it is called
if the system does not have a secure random number generator. This will change the
properties of the random string produced, but will be unpredictable to an attacker.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17581 bcc190cf-cafb-0310-a4f2-bffc1f526a37
Removes several ad hoc implementations of get_random_string()
and removes an innapropriate use of settings.SECRET_KEY.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17580 bcc190cf-cafb-0310-a4f2-bffc1f526a37
Some existing user passwords may need to be reset or converted
after this change. See the 1.4-beta release notes for more details.
Thanks bhuztez for the report and initial patch, claudep for the test.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17418 bcc190cf-cafb-0310-a4f2-bffc1f526a37
sha_constructor was incorrectly used instead of sha_hmac (which only made a
difference under 2.4).
Thanks to Steffan Kaminski for report and patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14233 bcc190cf-cafb-0310-a4f2-bffc1f526a37
Claude Paroz
Mariusz Felisiak
Nick Pope
Дилян Палаузов
Anton Samarchyan
Tim Graham
Ramin Farajpour Cami
Michael Hall
Alex Gaynor
Florian Apolloner
MattBlack85
Alasdair Nicol
Paul McMillan
Simon Charette
Aymeric Augustin
Łukasz Langa
Paul McMillan
Adrian Holovaty
Luke Plant