Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit cede8c9

Browse files
serhiy-storchakaserhiy-storchaka
authored
bpo-31702: Allow to specify rounds for SHA-2 hashing in crypt.mksalt(). (#4110)
The log_rounds parameter for Blowfish has been replaced with the rounds parameter.
1 parent ccb0442 commit cede8c9

5 files changed

Lines changed: 74 additions & 28 deletions

File tree

‎Doc/library/crypt.rst‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@ The :mod:`crypt` module defines the following functions:
116116
Accept ``crypt.METHOD_*`` values in addition to strings for *salt*.
117117

118118

119-
.. function:: mksalt(method=None, *, log_rounds=12)
119+
.. function:: mksalt(method=None, *, rounds=None)
120120

121121
Return a randomly generated salt of the specified method. If no
122122
*method* is given, the strongest method available as returned by
@@ -125,14 +125,18 @@ The :mod:`crypt` module defines the following functions:
125125
The return value is a string suitable for passing as the *salt* argument
126126
to :func:`crypt`.
127127

128-
*log_rounds* specifies the binary logarithm of the number of rounds
129-
for ``crypt.METHOD_BLOWFISH``, and is ignored otherwise. ``8`` specifies
130-
``256`` rounds.
128+
*rounds* specifies the number of rounds for ``METHOD_SHA256``,
129+
``METHOD_SHA512`` and ``METHOD_BLOWFISH``.
130+
For ``METHOD_SHA256`` and ``METHOD_SHA512`` it must be an integer between
131+
``1000`` and ``999_999_999``, the default is ``5000``. For
132+
``METHOD_BLOWFISH`` it must be a power of two between ``16`` (2\ :sup:`4`)
133+
and ``2_147_483_648`` (2\ :sup:`31`), the default is ``4096``
134+
(2\ :sup:`12`).
131135

132136
.. versionadded:: 3.3
133137

134138
.. versionchanged:: 3.7
135-
Added the *log_rounds* parameter.
139+
Added the *rounds* parameter.
136140

137141

138142
Examples

‎Doc/whatsnew/3.7.rst‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -280,6 +280,9 @@ crypt
280280
Added support for the Blowfish method.
281281
(Contributed by Serhiy Storchaka in :issue:`31664`.)
282282

283+
The :func:`~crypt.mksalt` function now allows to specify the number of rounds
284+
for hashing. (Contributed by Serhiy Storchaka in :issue:`31702`.)
285+
283286
dis
284287
---
285288

‎Lib/crypt.py‎

Lines changed: 28 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -19,20 +19,40 @@ def __repr__(self):
1919
return '<crypt.METHOD_{}>'.format(self.name)
2020

2121

22-
def mksalt(method=None, *, log_rounds=12):
22+
def mksalt(method=None, *, rounds=None):
2323
"""Generate a salt for the specified method.
2424
2525
If not specified, the strongest available method will be used.
2626
2727
"""
2828
if method is None:
2929
method = methods[0]
30-
if not method.ident:
30+
if rounds is not None and not isinstance(rounds, int):
31+
raise TypeError(f'{rounds.__class__.__name__} object cannot be '
32+
f'interpreted as an integer')
33+
if not method.ident: # traditional
3134
s = ''
32-
elif method.ident[0] == '2':
33-
s = f'${method.ident}${log_rounds:02d}$'
34-
else:
35+
else: # modular
3536
s = f'${method.ident}$'
37+
38+
if method.ident and method.ident[0] == '2': # Blowfish variants
39+
if rounds is None:
40+
log_rounds = 12
41+
else:
42+
log_rounds = int.bit_length(rounds-1)
43+
if rounds != 1 << log_rounds:
44+
raise ValueError('rounds must be a power of 2')
45+
if not 4 <= log_rounds <= 31:
46+
raise ValueError('rounds out of the range 2**4 to 2**31')
47+
s += f'{log_rounds:02d}$'
48+
elif method.ident in ('5', '6'): # SHA-2
49+
if rounds is not None:
50+
if not 1000 <= rounds <= 999_999_999:
51+
raise ValueError('rounds out of the range 1000 to 999_999_999')
52+
s += f'rounds={rounds}$'
53+
elif rounds is not None:
54+
raise ValueError(f"{method} doesn't support the rounds argument")
55+
3656
s += ''.join(_sr.choice(_saltchars) for char in range(method.salt_chars))
3757
return s
3858

@@ -55,10 +75,10 @@ def crypt(word, salt=None):
5575
# available salting/crypto methods
5676
methods = []
5777

58-
def _add_method(name, *args):
78+
def _add_method(name, *args, rounds=None):
5979
method = _Method(name, *args)
6080
globals()['METHOD_' + name] = method
61-
salt = mksalt(method, log_rounds=4)
81+
salt = mksalt(method, rounds=rounds)
6282
result = crypt('', salt)
6383
if result and len(result) == method.total_size:
6484
methods.append(method)
@@ -74,7 +94,7 @@ def _add_method(name, *args):
7494
# 'y' is the same as 'b', for compatibility
7595
# with openwall crypt_blowfish.
7696
for _v in 'b', 'y', 'a', '':
77-
if _add_method('BLOWFISH', '2' + _v, 22, 59 + len(_v)):
97+
if _add_method('BLOWFISH', '2' + _v, 22, 59 + len(_v), rounds=1<<4):
7898
break
7999

80100
_add_method('MD5', '1', 8, 34)

‎Lib/test/test_crypt.py‎

Lines changed: 32 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -39,31 +39,48 @@ def test_methods(self):
3939
else:
4040
self.assertEqual(crypt.methods[-1], crypt.METHOD_CRYPT)
4141

42+
@unittest.skipUnless(crypt.METHOD_SHA256 in crypt.methods or
43+
crypt.METHOD_SHA512 in crypt.methods,
44+
'requires support of SHA-2')
45+
def test_sha2_rounds(self):
46+
for method in (crypt.METHOD_SHA256, crypt.METHOD_SHA512):
47+
for rounds in 1000, 10_000, 100_000:
48+
salt = crypt.mksalt(method, rounds=rounds)
49+
self.assertIn('$rounds=%d$' % rounds, salt)
50+
self.assertEqual(len(salt) - method.salt_chars,
51+
11 + len(str(rounds)))
52+
cr = crypt.crypt('mypassword', salt)
53+
self.assertTrue(cr)
54+
cr2 = crypt.crypt('mypassword', cr)
55+
self.assertEqual(cr2, cr)
56+
4257
@unittest.skipUnless(crypt.METHOD_BLOWFISH in crypt.methods,
4358
'requires support of Blowfish')
44-
def test_log_rounds(self):
45-
self.assertEqual(len(crypt._saltchars), 64)
59+
def test_blowfish_rounds(self):
4660
for log_rounds in range(4, 11):
47-
salt = crypt.mksalt(crypt.METHOD_BLOWFISH, log_rounds=log_rounds)
61+
salt = crypt.mksalt(crypt.METHOD_BLOWFISH, rounds=1 << log_rounds)
4862
self.assertIn('$%02d$' % log_rounds, salt)
4963
self.assertIn(len(salt) - crypt.METHOD_BLOWFISH.salt_chars, {6, 7})
5064
cr = crypt.crypt('mypassword', salt)
5165
self.assertTrue(cr)
5266
cr2 = crypt.crypt('mypassword', cr)
5367
self.assertEqual(cr2, cr)
5468

55-
@unittest.skipUnless(crypt.METHOD_BLOWFISH in crypt.methods,
56-
'requires support of Blowfish')
57-
def test_invalid_log_rounds(self):
58-
for log_rounds in (1, -1, 999):
59-
salt = crypt.mksalt(crypt.METHOD_BLOWFISH, log_rounds=log_rounds)
60-
cr = crypt.crypt('mypassword', salt)
61-
if cr is not None:
62-
# On failure the openwall implementation returns a magic
63-
# string that is shorter than 13 characters and is guaranteed
64-
# to differ from a salt.
65-
self.assertNotEqual(cr, salt)
66-
self.assertLess(len(cr), 13)
69+
def test_invalid_rounds(self):
70+
for method in (crypt.METHOD_SHA256, crypt.METHOD_SHA512,
71+
crypt.METHOD_BLOWFISH):
72+
with self.assertRaises(TypeError):
73+
crypt.mksalt(method, rounds='4096')
74+
with self.assertRaises(TypeError):
75+
crypt.mksalt(method, rounds=4096.0)
76+
for rounds in (0, 1, -1, 1<<999):
77+
with self.assertRaises(ValueError):
78+
crypt.mksalt(method, rounds=rounds)
79+
with self.assertRaises(ValueError):
80+
crypt.mksalt(crypt.METHOD_BLOWFISH, rounds=1000)
81+
for method in (crypt.METHOD_CRYPT, crypt.METHOD_MD5):
82+
with self.assertRaisesRegex(ValueError, 'support'):
83+
crypt.mksalt(method, rounds=4096)
6784

6885

6986
if __name__ == "__main__":

‎Misc/NEWS.d/next/Library/2017-10-24-21-10-44.bpo-31702.SfwJDI.rst‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
crypt.mksalt() now allows to specify the number of rounds for SHA-256 and
2+
SHA-512 hashing.

0 commit comments

Comments
 (0)