classification
Title: Allow to specify the number of rounds for SHA-* hashing in crypt
Type: enhancement Stage: resolved
Components: Library (Lib) Versions: Python 3.7
process
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: Nosy List: christian.heimes, dstufft, gregory.p.smith, jafo, pitrou, serhiy.storchaka, vstinner
Priority: normal Keywords: patch

Created on 2017-10-05 12:32 by serhiy.storchaka, last changed 2017-11-16 11:23 by serhiy.storchaka. This issue is now closed.

Pull Requests
URL Status Linked Edit
PR 4110 merged serhiy.storchaka, 2017-10-24 18:25
Messages (5)
msg303760 - (view) Author: Serhiy Storchaka (serhiy.storchaka) * (Python committer) Date: 2017-10-05 12:32
Blowfish salt should contain the binary logarithm of the number of rounds (from 4 to 31) (see issue31664). SHA-* salt can contain an explicit number of rounds in the form '$rounds={value}$'. It is bound to the range from 1000 to 999999999, the default is 5000.

I propose to allow to specify the number of rounds in generated salt for SHA-* methods as well as for Blowfish. For unifying interface we can specify the number of rounds instead of its logarithm for Blowfish, and calculate the logarithm internally.

The question is what to do with the value that is not a power of two for Blowfish. Should we raise an error or silently replace it with the upper power of two?
msg304942 - (view) Author: Gregory P. Smith (gregory.p.smith) * (Python committer) Date: 2017-10-24 20:48
I'd raise a ValueError in that case.
msg305002 - (view) Author: Serhiy Storchaka (serhiy.storchaka) * (Python committer) Date: 2017-10-25 16:36
What to do with values outside of the valid range (2**4 to 2**31 for Blowfish, 1000 to 999999999 for SHA*). Raise ValueError, OverflowError, or bound it, or just generate an invalid salt and allow crypt() to handle it?
msg305013 - (view) Author: Gregory P. Smith (gregory.p.smith) * (Python committer) Date: 2017-10-25 22:46
I'd stick with ValueError in that case as well.  if someone dislikes the
valueerrors because they _want_ to use an invalid one, they can file a bug
and we'll reconsider only if they have a meaningful use case.

On Wed, Oct 25, 2017 at 9:36 AM Serhiy Storchaka <report@bugs.python.org>
wrote:

>
> Serhiy Storchaka <storchaka+cpython@gmail.com> added the comment:
>
> What to do with values outside of the valid range (2**4 to 2**31 for
> Blowfish, 1000 to 999999999 for SHA*). Raise ValueError, OverflowError, or
> bound it, or just generate an invalid salt and allow crypt() to handle it?
>
> ----------
> nosy: +haypo, pitrou
>
> _______________________________________
> Python tracker <report@bugs.python.org>
> <https://bugs.python.org/issue31702>
> _______________________________________
>
msg306352 - (view) Author: Serhiy Storchaka (serhiy.storchaka) * (Python committer) Date: 2017-11-16 11:22
New changeset cede8c9edb408321b493d8d5e73be9e1018020e4 by Serhiy Storchaka in branch 'master':
bpo-31702: Allow to specify rounds for SHA-2 hashing in crypt.mksalt(). (#4110)
https://github.com/python/cpython/commit/cede8c9edb408321b493d8d5e73be9e1018020e4
History
Date User Action Args
2017-11-16 11:23:51serhiy.storchakasetstatus: open -> closed
resolution: fixed
stage: patch review -> resolved
2017-11-16 11:22:53serhiy.storchakasetmessages: + msg306352
2017-10-25 22:46:49gregory.p.smithsetmessages: + msg305013
2017-10-25 16:36:47serhiy.storchakasetnosy: + pitrou, vstinner
messages: + msg305002
2017-10-24 20:48:33gregory.p.smithsetmessages: + msg304942
2017-10-24 18:25:13serhiy.storchakasetkeywords: + patch
stage: patch review
pull_requests: + pull_request4080
2017-10-05 12:32:52serhiy.storchakacreate