diff options
| author | Tim Graham <timograham@gmail.com> | 2015-01-16 19:27:10 -0500 |
|---|---|---|
| committer | Tim Graham <timograham@gmail.com> | 2015-01-16 19:27:10 -0500 |
| commit | c51258882bbf388f5c4cfc379340097ebe9beda9 (patch) | |
| tree | 75136e3fb2c5131962ad7f383d6a470faa092d8d | |
| parent | d4689034becf3bc519dbddd22f702406c5cbe5b1 (diff) | |
Increased the default PBKDF2 iterations.
| -rw-r--r-- | django/contrib/auth/hashers.py | 2 | ||||
| -rw-r--r-- | django/contrib/auth/tests/test_hashers.py | 6 | ||||
| -rw-r--r-- | docs/releases/1.9.txt | 5 |
3 files changed, 8 insertions, 5 deletions
diff --git a/django/contrib/auth/hashers.py b/django/contrib/auth/hashers.py index 9a85ebbbad..44ebf89c36 100644 --- a/django/contrib/auth/hashers.py +++ b/django/contrib/auth/hashers.py @@ -226,7 +226,7 @@ class PBKDF2PasswordHasher(BasePasswordHasher): safely but you must rename the algorithm if you change SHA256. """ algorithm = "pbkdf2_sha256" - iterations = 20000 + iterations = 24000 digest = hashlib.sha256 def encode(self, password, salt, iterations=None): diff --git a/django/contrib/auth/tests/test_hashers.py b/django/contrib/auth/tests/test_hashers.py index 10ab657ae5..e8b6d887b5 100644 --- a/django/contrib/auth/tests/test_hashers.py +++ b/django/contrib/auth/tests/test_hashers.py @@ -46,7 +46,7 @@ class TestUtilsHashPass(SimpleTestCase): def test_pkbdf2(self): encoded = make_password('lètmein', 'seasalt', 'pbkdf2_sha256') self.assertEqual(encoded, - 'pbkdf2_sha256$20000$seasalt$oBSd886ysm3AqYun62DOdin8YcfbU1z9cksZSuLP9r0=') + 'pbkdf2_sha256$24000$seasalt$V9DfCAVoweeLwxC/L2mb+7swhzF0XYdyQMqmusZqiTc=') self.assertTrue(is_password_usable(encoded)) self.assertTrue(check_password('lètmein', encoded)) self.assertFalse(check_password('lètmeinz', encoded)) @@ -210,14 +210,14 @@ class TestUtilsHashPass(SimpleTestCase): hasher = PBKDF2PasswordHasher() encoded = hasher.encode('lètmein', 'seasalt2') self.assertEqual(encoded, - 'pbkdf2_sha256$20000$seasalt2$Flpve/uAcyo6+IFI6YAhjeABGPVbRQjzHDxRhqxewgw=') + 'pbkdf2_sha256$24000$seasalt2$TUDkfilKHVC7BkaKSZgIKhm0aTtXlmcw/5C1FeS/DPk=') self.assertTrue(hasher.verify('lètmein', encoded)) def test_low_level_pbkdf2_sha1(self): hasher = PBKDF2SHA1PasswordHasher() encoded = hasher.encode('lètmein', 'seasalt2') self.assertEqual(encoded, - 'pbkdf2_sha1$20000$seasalt2$pJt86NmjAweBY1StBvxCu7l1o9o=') + 'pbkdf2_sha1$24000$seasalt2$L37ETdd9trqrsJDwapU3P+2Edhg=') self.assertTrue(hasher.verify('lètmein', encoded)) def test_upgrade(self): diff --git a/docs/releases/1.9.txt b/docs/releases/1.9.txt index f408e4987f..80ad57c053 100644 --- a/docs/releases/1.9.txt +++ b/docs/releases/1.9.txt @@ -38,7 +38,10 @@ Minor features :mod:`django.contrib.auth` ^^^^^^^^^^^^^^^^^^^^^^^^^^ -* ... +* The default iteration count for the PBKDF2 password hasher has been increased + by 20%. This backwards compatible change will not affect users who have + subclassed ``django.contrib.auth.hashers.PBKDF2PasswordHasher`` to change the + default value. :mod:`django.contrib.gis` ^^^^^^^^^^^^^^^^^^^^^^^^^^ |