# HG changeset patch # User Martin Panter # Date 1456132909 0 # Mon Feb 22 09:21:49 2016 +0000 # Branch 3.5 # Node ID c8a0e6adf9e1147a8c95a0f13523437c51bb0f67 # Parent bbfbde6ee9d0c132bc003af3c8adc8bfdee3fecd Issue #26390: Fix and test pbkdf2_hmac() parameter names Based on patch by Daan Bakker. diff -r bbfbde6ee9d0 Doc/library/hashlib.rst --- a/Doc/library/hashlib.rst Thu Feb 18 17:34:32 2016 +0200 +++ b/Doc/library/hashlib.rst Mon Feb 22 09:43:10 2016 +0000 @@ -185,22 +185,23 @@ include a `salt `_. -.. function:: pbkdf2_hmac(name, password, salt, rounds, dklen=None) +.. function:: pbkdf2_hmac(hash_name, password, salt, iterations, dklen=None) The function provides PKCS#5 password-based key derivation function 2. It uses HMAC as pseudorandom function. - The string *name* is the desired name of the hash digest algorithm for + The string *hash_name* is the desired name of the hash digest algorithm for HMAC, e.g. 'sha1' or 'sha256'. *password* and *salt* are interpreted as buffers of bytes. Applications and libraries should limit *password* to - a sensible value (e.g. 1024). *salt* should be about 16 or more bytes from + a sensible length (e.g. 1024). *salt* should be about 16 or more bytes from a proper source, e.g. :func:`os.urandom`. - The number of *rounds* should be chosen based on the hash algorithm and - computing power. As of 2013, at least 100,000 rounds of SHA-256 is suggested. + The number of *iterations* should be chosen based on the hash algorithm and + computing power. As of 2013, at least 100,000 iterations of SHA-256 are + suggested. *dklen* is the length of the derived key. If *dklen* is ``None`` then the - digest size of the hash algorithm *name* is used, e.g. 64 for SHA-512. + digest size of the hash algorithm *hash_name* is used, e.g. 64 for SHA-512. >>> import hashlib, binascii >>> dk = hashlib.pbkdf2_hmac('sha256', b'password', b'salt', 100000) diff -r bbfbde6ee9d0 Lib/test/test_hashlib.py --- a/Lib/test/test_hashlib.py Thu Feb 18 17:34:32 2016 +0200 +++ b/Lib/test/test_hashlib.py Mon Feb 22 09:43:10 2016 +0000 @@ -513,6 +513,9 @@ self.assertRaises(ValueError, pbkdf2, 'sha1', b'pass', b'salt', 1, -1) with self.assertRaisesRegex(ValueError, 'unsupported hash type'): pbkdf2('unknown', b'pass', b'salt', 1) + out = pbkdf2(hash_name='sha1', password=b'password', salt=b'salt', + iterations=1, dklen=None) + self.assertEqual(out, self.pbkdf2_results['sha1'][0][0]) def test_pbkdf2_hmac_py(self): self._test_pbkdf2_hmac(py_hashlib.pbkdf2_hmac)