#32275: Offer an scrypt based password hasher
----------------------------------------+------------------------
Reporter: Alex Gaynor | Owner: nobody
Type: New feature | Status: new
Component: contrib.auth | Version: master
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
----------------------------------------+------------------------
Currently django defaults to PBKDF2, with options (using third party
libraries) for bcrypt and argon2 (and then a large number of legacy
options that should be avoided).
When PBKDF2 was originally chosen as the default, it was selected because
it was the most secure option that could reasonably be implemented in pure
Python with the stdlib.
As of Python 3.6, scrypt is available in the stdlib. scrypt is also
substantially more secure than PBKDF2, because it is memory hard. See
https://www.tarsnap.com/scrypt/scrypt.pdf (page 14) for a table that
assess the relative cost-to-brute-force of scrypt vs. PBKDF2 at the
interactive latency.
For these reasons, I think it'd be appropriate for Django to include an
scrypt based hasher, and even to default to it for new installations.
--
Ticket URL: <https://code.djangoproject.com/ticket/32275>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/047.2e98935a9af3714bcf6d1a5e9fc5b47b%40djangoproject.com.
