diff options
| author | Mariusz Felisiak <felisiak.mariusz@gmail.com> | 2023-02-04 13:37:44 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-02-04 13:37:44 +0100 |
| commit | 5e9aded33f46dd78c5b6050186ba54ff9b02e986 (patch) | |
| tree | d82d881836bd986c561709142f205952a4650f54 | |
| parent | 017fa23d3b0aee9142f531c2a0002fc86c82a54c (diff) | |
Increased the default PBKDF2 iterations for Django 5.0.
Follow up to 9a1848f48c1f7f627a52b2063a8a8428e77765d6.
| -rw-r--r-- | django/contrib/auth/hashers.py | 2 | ||||
| -rw-r--r-- | docs/releases/4.2.txt | 2 | ||||
| -rw-r--r-- | docs/releases/5.0.txt | 2 | ||||
| -rw-r--r-- | tests/auth_tests/test_hashers.py | 8 |
4 files changed, 7 insertions, 7 deletions
diff --git a/django/contrib/auth/hashers.py b/django/contrib/auth/hashers.py index c1de2597ad..e6544c7b55 100644 --- a/django/contrib/auth/hashers.py +++ b/django/contrib/auth/hashers.py @@ -295,7 +295,7 @@ class PBKDF2PasswordHasher(BasePasswordHasher): """ algorithm = "pbkdf2_sha256" - iterations = 580000 + iterations = 720000 digest = hashlib.sha256 def encode(self, password, salt, iterations=None): diff --git a/docs/releases/4.2.txt b/docs/releases/4.2.txt index 2f91282e73..9f3ddfd3ff 100644 --- a/docs/releases/4.2.txt +++ b/docs/releases/4.2.txt @@ -141,7 +141,7 @@ Minor features ~~~~~~~~~~~~~~~~~~~~~~~~~~ * The default iteration count for the PBKDF2 password hasher is increased from - 390,000 to 480,000. + 390,000 to 600,000. * :class:`~django.contrib.auth.forms.UserCreationForm` now saves many-to-many form fields for a custom user model. diff --git a/docs/releases/5.0.txt b/docs/releases/5.0.txt index 05dded1226..8146f3bb67 100644 --- a/docs/releases/5.0.txt +++ b/docs/releases/5.0.txt @@ -54,7 +54,7 @@ Minor features ~~~~~~~~~~~~~~~~~~~~~~~~~~ * The default iteration count for the PBKDF2 password hasher is increased from - 480,000 to 580,000. + 600,000 to 720,000. :mod:`django.contrib.contenttypes` ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/tests/auth_tests/test_hashers.py b/tests/auth_tests/test_hashers.py index 71f2864063..e41fbf9b78 100644 --- a/tests/auth_tests/test_hashers.py +++ b/tests/auth_tests/test_hashers.py @@ -74,7 +74,7 @@ class TestUtilsHashPass(SimpleTestCase): encoded = make_password("lètmein", "seasalt", "pbkdf2_sha256") self.assertEqual( encoded, - "pbkdf2_sha256$580000$seasalt$2sMWfhmkPY33gxRmJ4qOvKMhbLEWgy9yOGCMmzRG4v4=", + "pbkdf2_sha256$720000$seasalt$eDupbcisD1UuIiou3hMuMu8oe/XwnpDw45r6AA5iv0E=", ) self.assertTrue(is_password_usable(encoded)) self.assertTrue(check_password("lètmein", encoded)) @@ -379,8 +379,8 @@ class TestUtilsHashPass(SimpleTestCase): encoded = hasher.encode("lètmein", "seasalt2") self.assertEqual( encoded, - "pbkdf2_sha256$580000$" - "seasalt2$BLfRdHlAvfDMYcb+HhJhZe849VzO7vuXgxGLqx3hwI0=", + "pbkdf2_sha256$720000$" + "seasalt2$e8hbsPnTo9qWhT3xYfKWoRth0h0J3360yb/tipPhPtY=", ) self.assertTrue(hasher.verify("lètmein", encoded)) @@ -388,7 +388,7 @@ class TestUtilsHashPass(SimpleTestCase): hasher = PBKDF2SHA1PasswordHasher() encoded = hasher.encode("lètmein", "seasalt2") self.assertEqual( - encoded, "pbkdf2_sha1$580000$seasalt2$KLjMFKSPXZb6nco1W2hi/NtT4gk=" + encoded, "pbkdf2_sha1$720000$seasalt2$2DDbzziqCtfldrRSNAaF8oA9OMw=" ) self.assertTrue(hasher.verify("lètmein", encoded)) |