Skip to main content

Password manager utility using bcrypt or pbkdf2 encoding. Useful in combination with zope.password

Project description

z3c.bcrypt

z3c.bcrypt provides zope.password compatible “password manager” utilities that use bcrypt (or alternatively pbkdf2) encoding for storing passwords.

Both encoding schemes are implemented in the cryptacular library that is a dependency for this package.

Using z3c.bcrypt

>>> from zope.interface.verify import verifyObject
>>> from zope.password.interfaces import IPasswordManager
>>> from z3c.bcrypt import BcryptPasswordManager
>>> manager = BcryptPasswordManager()
>>> verifyObject(IPasswordManager, manager)
True
>>> password = u"right \N{CYRILLIC CAPITAL LETTER A}"
>>> encoded = manager.encodePassword(password)
>>> encoded
'$2a$...'
>>> manager.checkPassword(encoded, password)
True
>>> manager.checkPassword(encoded, password + u"wrong")
False
>>> from z3c.bcrypt import PBKDF2PasswordManager
>>> manager = PBKDF2PasswordManager()
>>> verifyObject(IPasswordManager, manager)
True
>>> encoded = manager.encodePassword(password)
>>> encoded
u'$p5k2$...'
>>> manager.checkPassword(encoded, password)
True
>>> manager.checkPassword(encoded, password + u"wrong")
False
>>> # A previously encoded password, should be decodable even if the
>>> # current encoding of the same password is different::
>>> previouslyencoded = (
...     '$p5k2$1000$LgAFPIlc9CgrlSaxHyTUMA='
...     '=$IuUYplhMkR4qCl8-ONRVjEgJNwE=')
>>> encoded == previouslyencoded
False
>>> manager.checkPassword(previouslyencoded , password)
True

Excessively long “passwords” will take up a lot of computation time that can be used as a DOS attack vector. The password managers in z3c.bcrypt will only use the first 4096 characters of the incoming password for checking.

This is inspired by:

https://www.djangoproject.com/weblog/2013/sep/15/security/

This test would take significantly longer if the 4096 length limit would not be in place. XXX how to test that reliably?

>>> incomming = '$p5k2$1000$' + 'a' * 1024 * 1024 * 100  # lot of data.
>>> manager.checkPassword(encoded, incomming)
False

Configuration

This package provides a configure.zcml which installs implementations of the IPasswordManager as utilities:

>>> from zope.configuration import xmlconfig
>>> _ = xmlconfig.string("""
... <configure
...    xmlns="http://namespaces.zope.org/zope">
...
...    <include package="z3c.bcrypt" />
... </configure>
... """)
>>> from zope import component
>>> from zope.password.interfaces import IPasswordManager
>>> component.getUtility(IPasswordManager, name='bcrypt')
<z3c.bcrypt.passwordmanager.BcryptPasswordManager object at ...>
>>> component.getUtility(IPasswordManager, name='pbkdf2')
<z3c.bcrypt.passwordmanager.PBKDF2PasswordManager object at ...>

Changelog of z3c.bcrypt

2.0.1 (2018-08-01)

2.0.0 (2017-05-10)

  • Standardize namespace __init__.

  • Add support for Python 3.4, 3.5, 3.6 and PyPy.

1.2 (2013-10-10)

1.1 (2010-02-22)

  • Fixes in the configure.zcml.

1.0 (2010-02-18)

  • Initial public release.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

z3c.bcrypt-2.0.1.tar.gz (7.6 kB view details)

Uploaded Source

File details

Details for the file z3c.bcrypt-2.0.1.tar.gz.

File metadata

  • Download URL: z3c.bcrypt-2.0.1.tar.gz
  • Upload date:
  • Size: 7.6 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: Python-urllib/2.7

File hashes

Hashes for z3c.bcrypt-2.0.1.tar.gz
Algorithm Hash digest
SHA256 3f12b07769d71596babb553a172088426ca2b92c28a034ecb948a138056c1f1f
MD5 9d87b828fba7303e18c8d1cdcea41b6c
BLAKE2b-256 c36944e1fd04b264e9efc670f4d55e3da34ddfbf827d6bcdcb617f7f9c958a2f

See more details on using hashes here.

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page