"Chris Angelico" wrote in message
news:captjjmpppgm+_ut_amtnb7vgo0vrgptu6iagyjqwvpxg5yp...@mail.gmail.com...
On Fri, Dec 23, 2016 at 9:19 PM, Frank Millman <fr...@chagford.com> wrote:
> 3. Generate the password from the string supplied by the user as
> follows -
> from hashlib import blake2b
> password = blake2b('my_password'.encode('utf-8'), salt=salt).digest()
>
> The hashlib docs have the following warning -
>
> "Salted hashing (or just hashing) with BLAKE2 or any other
> general-purpose
> cryptographic hash function, such as SHA-256, is not suitable for
> hashing
> passwords. See BLAKE2 FAQ for more information."
>
> I propose to ignore this warning. I feel that, for my purposes, the
> above
> procedure is adequate.
>
> Does all this sound reasonable?
Check out some prior art. When I build a web app using Flask, I
generally use Werkzeug's password management features:
http://werkzeug.pocoo.org/docs/0.11/utils/#werkzeug.security.generate_password_hash
http://werkzeug.pocoo.org/docs/0.11/utils/#werkzeug.security.check_password_hash
As well as doing everything I said above about salting and hashing and
having signatures, it pushes the responsibility onto someone else. You
just give it a password and get back an ASCII string that you stash in
the database. If there's a security flaw, Werkzeug can push a new
version that fixes it - it's not your problem.
At very least, be aware of what these kinds of libraries are doing.
I'm not saying you should blindly trust them or automatically reach
for a dependency, but they're worth looking at.
All excellent advice - thanks very much.
It seems that Werkzeug (which looks great, by the way) uses something called
pbkdf2.
The new kid on the block seems to be Argon2. A python implementation called
argon2_cffi has been released by Hynek Schlawack, who has written this
article -
https://hynek.me/articles/storing-passwords/
This is his preamble - "if you’re hashing your passwords with
bcrypt/scrypt/PBKDF2 today, there’s nothing to worry about in the immediate
future. This article is for you if you’re choosing a password hash today and
want a future-proof solution."
I eventually got argon2_cffi installed, and it works very nicely, so I will
run with that for now.
Thanks again
Frank
--
https://mail.python.org/mailman/listinfo/python-list
