[1.4.x] Fixed #21138 -- Increased the performance of our PBKDF2 implementation.

Thanks go to Michael Gebetsroither for pointing out this issue and help on
the patch.

Backport of 68540fe4df44492571bc610a0a043d3d02b3d320 from master.

1 files changed, 7 insertions, 3 deletions

diff --git a/django/utils/crypto.py b/django/utils/crypto.py
index 44b7faf492..5d138d0c1d 100644
--- a/django/utils/crypto.py
+++ b/django/utils/crypto.py
@@ -111,9 +111,8 @@ def _fast_hmac(key, msg, digest):
     A trimmed down version of Python's HMAC implementation
     """
     dig1, dig2 = digest(), digest()
-    if len(key) > dig1.block_size:
-        key = digest(key).digest()
-    key += chr(0) * (dig1.block_size - len(key))
+    if len(key) != dig1.block_size:
+        raise ValueError('Key size needs to match the block_size of the digest.')
     dig1.update(key.translate(_trans_36))
     dig1.update(msg)
     dig2.update(key.translate(_trans_5c))
@@ -146,6 +145,11 @@ def pbkdf2(password, salt, iterations, dklen=0, digest=None):
 
     hex_format_string = "%%0%ix" % (hlen * 2)
 
+    inner_digest_size = digest().block_size
+    if len(password) > inner_digest_size:
+        password = digest(password).digest()
+    password += b'\x00' * (inner_digest_size - len(password))
+
     def F(i):
         def U():
             u = salt + struct.pack('>I', i)