Skip to main content

Password manager utility using bcrypt or pbkdf2 encoding. Useful in combination with zope.password

Project description

z3c.bcrypt

z3c.bcrypt provides zope.password compatible “password manager” utilities that use bcrypt (or alternatively pbkdf2) encoding for storing passwords.

Both encoding schemes are implemented in the cryptacular library that is a dependency for this pacakge.

Using z3c.bcrypt

>>> from zope.interface.verify import verifyObject
>>> from zope.password.interfaces import IPasswordManager
>>> from z3c.bcrypt import BcryptPasswordManager
>>> manager = BcryptPasswordManager()
>>> verifyObject(IPasswordManager, manager)
True
>>> password = u"right \N{CYRILLIC CAPITAL LETTER A}"
>>> encoded = manager.encodePassword(password)
>>> encoded
'$2a$...'
>>> manager.checkPassword(encoded, password)
True
>>> manager.checkPassword(encoded, password + u"wrong")
False
>>> from z3c.bcrypt import PBKDF2PasswordManager
>>> manager = PBKDF2PasswordManager()
>>> verifyObject(IPasswordManager, manager)
True
>>> encoded = manager.encodePassword(password)
>>> encoded
u'$p5k2$...'
>>> manager.checkPassword(encoded, password)
True
>>> manager.checkPassword(encoded, password + u"wrong")
False
>>> # A previously encoded password, should be decodable even if the
>>> # current encoding of the same password is different::
>>> previouslyencoded = (
...     '$p5k2$1000$LgAFPIlc9CgrlSaxHyTUMA='
...     '=$IuUYplhMkR4qCl8-ONRVjEgJNwE=')
>>> encoded == previouslyencoded
False
>>> manager.checkPassword(previouslyencoded , password)
True

Excessively long “passwords” will take up a lot of computation time that can be used as a DOS attack vector. The password managers in z3c.bcrypt will only use the first 4096 characters of the incoming password for checking.

This is inspired by:

https://www.djangoproject.com/weblog/2013/sep/15/security/

This test would take significantly longer if the 4096 length limit would not be in place. XXX how to test that reliably?

>>> incomming = '$p5k2$1000$' + 'a' * 1024 * 1024 * 100  # lot of data.
>>> manager.checkPassword(encoded, incomming)
False

Configuration

This package provides a configure.zcml which installs implementations of the IPasswordManager as utilities:

>>> from zope.configuration import xmlconfig
>>> _ = xmlconfig.string("""
... <configure
...    xmlns="http://namespaces.zope.org/zope">
...
...    <include package="z3c.bcrypt" />
... </configure>
... """)
>>> from zope import component
>>> from zope.password.interfaces import IPasswordManager
>>> component.getUtility(IPasswordManager, name='bcrypt')
<z3c.bcrypt.passwordmanager.BcryptPasswordManager object at ...>
>>> component.getUtility(IPasswordManager, name='pbkdf2')
<z3c.bcrypt.passwordmanager.PBKDF2PasswordManager object at ...>

Changelog of z3c.bcrypt

2.0.0 (2017-05-10)

  • Standardize namespace __init__.
  • Add support for Python 3.4, 3.5, 3.6 and PyPy.

1.2 (2013-10-10)

1.1 (2010-02-22)

  • Fixes in the configure.zcml.

1.0 (2010-02-18)

  • Initial public release.

Project details


Release history Release notifications

This version
History Node

2.0.0

History Node

1.2

History Node

1.1

History Node

1.0

History Node

1.0dev

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Filename, size & hash SHA256 hash help File type Python version Upload date
z3c.bcrypt-2.0.0-py2.py3-none-any.whl (9.6 kB) Copy SHA256 hash SHA256 Wheel py2.py3 May 10, 2017
z3c.bcrypt-2.0.0.tar.gz (6.9 kB) Copy SHA256 hash SHA256 Source None May 10, 2017

Supported by

Elastic Elastic Search Pingdom Pingdom Monitoring Google Google BigQuery Sentry Sentry Error logging CloudAMQP CloudAMQP RabbitMQ AWS AWS Cloud computing Fastly Fastly CDN DigiCert DigiCert EV certificate StatusPage StatusPage Status page