[1.6.x] Increased default PBKDF2 iterations

Increases the default PBKDF2 iterations, since computers have gotten
faster since 2011. In the future, we plan to increment by 10% per
major version.

Backport of a075e2ad0d from master

1 files changed, 7 insertions, 0 deletions

diff --git a/docs/internals/howto-release-django.txt b/docs/internals/howto-release-django.txt
index 5bda2e8add..1bd357ee2d 100644
--- a/docs/internals/howto-release-django.txt
+++ b/docs/internals/howto-release-django.txt
@@ -88,6 +88,13 @@ any time leading up to the actual release:
    emails at *FIXME WHERE?*. This email should be signed by the key you'll use
    for the release, and should include patches for each issue being fixed.
 
+#. If this is a major release, make sure the tests pass, then increase
+   the default PBKDF2 iterations in
+   ``django.contrib.auth.hashers.PBKDF2PasswordHasher`` by about 10%
+   (pick a round number). Run the tests, and update the 3 failing
+   hasher tests with the new values. Make sure this gets noted in the
+   release notes (see release notes on 1.6 for an example).
+
 #. As the release approaches, watch Trac to make sure no release blockers
    are left for the upcoming release.