The patch provides a Python implementation of pbkdf2_hmac with Python's hmac module. Although I'm using some tricks it's more than six times slower than OpenSSL's implementation.

Here is an optimized version with inline HMAC.

Contrary to the implementations in OpenSSL, PyCrypto, and pbkdf2.py the length of the password has almost no impact on the runtime of my implementation.

I have optimized XOR and now it's even faster than OpenSSL's code for reasonable long passwords. :(

> I have optimized XOR and now it's even faster than OpenSSL's code for
> reasonable long passwords. :(

Uh... and it gives the right results? Perhaps OpenSSL should be reimplemented in Python :-)

If your code is resistant to timing attacks, I suppose we don't need the C implementation anymore? Or does it have a larger startup cost?
(what is a "reasonably long password" for you? 10 chars or 64? :-))

Christian, does you noticed my comments on Rietveld?

New changeset e73627483d2f by Christian Heimes in branch 'default':
Issue #19254: Provide an optimized Python implementation of PBKDF2_HMAC
http://hg.python.org/cpython/rev/e73627483d2f

Serhiy, I have taken your review into account. I still need to use memoryview() in order to handle all types that are supported by the format char "y*".