Skip to main content
This is a pre-production deployment of Warehouse. Changes made here affect the production instance of PyPI (pypi.python.org).
Help us improve Python packaging - Donate today!

Password manager utility using bcrypt or pbkdf2 encoding. Useful in combination with zope.password

Project Description

z3c.bcrypt

z3c.bcrypt provides zope.password compatible “password manager” utilities that use bcrypt (or alternatively pbkdf2) encoding for storing passwords.

Both encoding schemes are implemented in the cryptacular library that is a dependency for this pacakge.

Using z3c.bcrypt

>>> from zope.interface.verify import verifyObject
>>> from zope.password.interfaces import IPasswordManager
>>> from z3c.bcrypt import BcryptPasswordManager
>>> manager = BcryptPasswordManager()
>>> verifyObject(IPasswordManager, manager)
True
>>> password = u"right \N{CYRILLIC CAPITAL LETTER A}"
>>> encoded = manager.encodePassword(password)
>>> encoded
'$2a$...'
>>> manager.checkPassword(encoded, password)
True
>>> manager.checkPassword(encoded, password + u"wrong")
False
>>> from z3c.bcrypt import PBKDF2PasswordManager
>>> manager = PBKDF2PasswordManager()
>>> verifyObject(IPasswordManager, manager)
True
>>> encoded = manager.encodePassword(password)
>>> encoded
u'$p5k2$...'
>>> manager.checkPassword(encoded, password)
True
>>> manager.checkPassword(encoded, password + u"wrong")
False
>>> # A previously encoded password, should be decodable even if the
>>> # current encoding of the same password is different::
>>> previouslyencoded = (
...     '$p5k2$1000$LgAFPIlc9CgrlSaxHyTUMA='
...     '=$IuUYplhMkR4qCl8-ONRVjEgJNwE=')
>>> encoded == previouslyencoded
False
>>> manager.checkPassword(previouslyencoded , password)
True

Excessively long “passwords” will take up a lot of computation time that can be used as a DOS attack vector. The password managers in z3c.bcrypt will only use the first 4096 characters of the incoming password for checking.

This is inspired by:

https://www.djangoproject.com/weblog/2013/sep/15/security/

This test would take significantly longer if the 4096 length limit would not be in place. XXX how to test that reliably?

>>> incomming = '$p5k2$1000$' + 'a' * 1024 * 1024 * 100  # lot of data.
>>> manager.checkPassword(encoded, incomming)
False

Configuration

This package provides a configure.zcml which installs implementations of the IPasswordManager as utilities:

>>> from zope.configuration import xmlconfig
>>> _ = xmlconfig.string("""
... <configure
...    xmlns="http://namespaces.zope.org/zope">
...
...    <include package="z3c.bcrypt" />
... </configure>
... """)
>>> from zope import component
>>> from zope.password.interfaces import IPasswordManager
>>> component.getUtility(IPasswordManager, name='bcrypt')
<z3c.bcrypt.passwordmanager.BcryptPasswordManager object at ...>
>>> component.getUtility(IPasswordManager, name='pbkdf2')
<z3c.bcrypt.passwordmanager.PBKDF2PasswordManager object at ...>

Changelog of z3c.bcrypt

2.0.0 (2017-05-10)

  • Standardize namespace __init__.
  • Add support for Python 3.4, 3.5, 3.6 and PyPy.

1.2 (2013-10-10)

1.1 (2010-02-22)

  • Fixes in the configure.zcml.

1.0 (2010-02-18)

  • Initial public release.
Release History

Release History

This version
History Node

2.0.0

History Node

1.2

History Node

1.1

History Node

1.0

History Node

1.0dev

Download Files

Download Files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

File Name & Checksum SHA256 Checksum Help Version File Type Upload Date
z3c.bcrypt-2.0.0-py2.py3-none-any.whl (9.6 kB) Copy SHA256 Checksum SHA256 py2.py3 Wheel May 10, 2017
z3c.bcrypt-2.0.0.tar.gz (6.9 kB) Copy SHA256 Checksum SHA256 Source May 10, 2017

Supported By

WebFaction WebFaction Technical Writing Elastic Elastic Search Pingdom Pingdom Monitoring Dyn Dyn DNS Sentry Sentry Error Logging CloudAMQP CloudAMQP RabbitMQ Heroku Heroku PaaS Kabu Creative Kabu Creative UX & Design Fastly Fastly CDN DigiCert DigiCert EV Certificate Rackspace Rackspace Cloud Servers DreamHost DreamHost Log Hosting