From c51258882bbf388f5c4cfc379340097ebe9beda9 Mon Sep 17 00:00:00 2001 From: Tim Graham Date: Fri, 16 Jan 2015 19:27:10 -0500 Subject: [PATCH] Increased the default PBKDF2 iterations. --- django/contrib/auth/hashers.py | 2 +- django/contrib/auth/tests/test_hashers.py | 6 +++--- docs/releases/1.9.txt | 5 ++++- 3 files changed, 8 insertions(+), 5 deletions(-) diff --git a/django/contrib/auth/hashers.py b/django/contrib/auth/hashers.py index 9a85ebbbade..44ebf89c36a 100644 --- a/django/contrib/auth/hashers.py +++ b/django/contrib/auth/hashers.py @@ -226,7 +226,7 @@ class PBKDF2PasswordHasher(BasePasswordHasher): safely but you must rename the algorithm if you change SHA256. """ algorithm = "pbkdf2_sha256" - iterations = 20000 + iterations = 24000 digest = hashlib.sha256 def encode(self, password, salt, iterations=None): diff --git a/django/contrib/auth/tests/test_hashers.py b/django/contrib/auth/tests/test_hashers.py index 10ab657ae55..e8b6d887b59 100644 --- a/django/contrib/auth/tests/test_hashers.py +++ b/django/contrib/auth/tests/test_hashers.py @@ -46,7 +46,7 @@ class TestUtilsHashPass(SimpleTestCase): def test_pkbdf2(self): encoded = make_password('lètmein', 'seasalt', 'pbkdf2_sha256') self.assertEqual(encoded, - 'pbkdf2_sha256$20000$seasalt$oBSd886ysm3AqYun62DOdin8YcfbU1z9cksZSuLP9r0=') + 'pbkdf2_sha256$24000$seasalt$V9DfCAVoweeLwxC/L2mb+7swhzF0XYdyQMqmusZqiTc=') self.assertTrue(is_password_usable(encoded)) self.assertTrue(check_password('lètmein', encoded)) self.assertFalse(check_password('lètmeinz', encoded)) @@ -210,14 +210,14 @@ class TestUtilsHashPass(SimpleTestCase): hasher = PBKDF2PasswordHasher() encoded = hasher.encode('lètmein', 'seasalt2') self.assertEqual(encoded, - 'pbkdf2_sha256$20000$seasalt2$Flpve/uAcyo6+IFI6YAhjeABGPVbRQjzHDxRhqxewgw=') + 'pbkdf2_sha256$24000$seasalt2$TUDkfilKHVC7BkaKSZgIKhm0aTtXlmcw/5C1FeS/DPk=') self.assertTrue(hasher.verify('lètmein', encoded)) def test_low_level_pbkdf2_sha1(self): hasher = PBKDF2SHA1PasswordHasher() encoded = hasher.encode('lètmein', 'seasalt2') self.assertEqual(encoded, - 'pbkdf2_sha1$20000$seasalt2$pJt86NmjAweBY1StBvxCu7l1o9o=') + 'pbkdf2_sha1$24000$seasalt2$L37ETdd9trqrsJDwapU3P+2Edhg=') self.assertTrue(hasher.verify('lètmein', encoded)) def test_upgrade(self): diff --git a/docs/releases/1.9.txt b/docs/releases/1.9.txt index f408e4987fd..80ad57c0538 100644 --- a/docs/releases/1.9.txt +++ b/docs/releases/1.9.txt @@ -38,7 +38,10 @@ Minor features :mod:`django.contrib.auth` ^^^^^^^^^^^^^^^^^^^^^^^^^^ -* ... +* The default iteration count for the PBKDF2 password hasher has been increased + by 20%. This backwards compatible change will not affect users who have + subclassed ``django.contrib.auth.hashers.PBKDF2PasswordHasher`` to change the + default value. :mod:`django.contrib.gis` ^^^^^^^^^^^^^^^^^^^^^^^^^^