cryptacular 1.6.2

cryptacular.core

cryptacular.core defines the DelegatingPasswordManager and the interfaces (abstract base classes) PasswordChecker and PasswordManager.

DelegatingPasswordManager is the recommended way to use cryptacular. DelegatingPasswordManager holds a preferred cryptacular.core.PasswordManager instance that can encode and check password hashes and a list of fallback cryptacular.core.PasswordChecker instances that are only required to be able to check password hashes (no need to implement InsecurePasswordHash.encode()). When asked to check a password hash against a plaintext password, DelegatingPasswordManager finds the first item in its list that understands the given hash format and uses it to check the password. If the password was correct but not in the preferred hash format, DelegatingPasswordManager will re-hash the given password using its preferred PasswordManager.

>>> import cryptacular.core
>>> import cryptacular.bcrypt
>>> import cryptacular.pbkdf2
>>> bcrypt = cryptacular.bcrypt.BCRYPTPasswordManager()
>>> pbkdf2 = cryptacular.pbkdf2.PBKDF2PasswordManager()
>>> delegator = cryptacular.core.DelegatingPasswordManager(preferred=bcrypt, fallbacks=(pbkdf2,))
>>> users = {'one':{'password':'xyzzy'}, 'two':{'password':u'hashy the \N{SNOWMAN}'}}
>>> for key in users: users[key]['hash'] = pbkdf2.encode(users[key]['password'])
>>> bcrypt.match(users['one']['password'])
False
>>> def set_hash(hash): users['one']['hash'] = hash
>>> delegator.check(users['one']['hash'], users['one']['password'], setter=set_hash)
True
>>> bcrypt.match(users['one']['hash'])
True
>>> def set_hash(hash): raise Exception("Should not re-set a preferred hash")
>>> delegator.check(users['one']['hash'], users['one']['password'], setter=set_hash)
True
>>> bcrypt.match(users['two']['hash'])
False
>>> pbkdf2.match(users['two']['hash'])
True
>>> delegator.check(users['two']['hash'], users['two']['password'])
True
>>> bcrypt.match(users['two']['hash'])
False
>>> pbkdf2.match(users['two']['hash'])
True

cryptacular.bcrypt

cryptacular.bcrypt uses a C extension module to call the public-domain crypt_blowfish (http://www.openwall.com/crypt/) which is bundled with cryptacular. You should use this if you can.

cryptacular.pbkdf2

cryptacular.pbkdf2 applies the pbkdf2 key derivation algorithm described in RFC 2898 as a password hash. It uses M2Crypto.EVP.pbkdf2 with a Python fallback when M2Crypto is not available. You can use this even if you cannot run C extension modules in your Python.

cryptacular.crypt

cryptacular.crypt uses Python’s builtin crypt module, available on Unix, to hash passwords. It takes a string such as ‘$1$’ as an argument to determine which kind of hash the underlying crypt() function will produce (see man crypt for details). crypt() can even provide bcrypt hashes if you are lucky; the SHA hashes invented for RedHat are also good.

On my Ubuntu system:

from cryptacular.crypt import CRYPTPasswordManager, SHA256CRYPT
manager = CRYPTPasswordManager(SHA256CRYPT)
manager.encode('secret')
>>> '$5$Ka9M/5GqJWMCnLI7$ZR0k9g2NlnXvgjjDYmobVUuLzfn/Tmo.vnW4WvW5Tx/'
manager.encode('secret')
>>> '$5$o4RUq2zuVWYWZpuq$35VyAVxfeL4sQ9//ODNw8jIDW7khJ5s0lUlXCHJ6WZ2'