Skip to main content

Password manager utility using bcrypt or pbkdf2 encoding. Useful in combination with zope.password

Project description

z3c.bcrypt

Warning

z3c.bcrypt has been superseeded with the new version of zope.password as it now includes bcrypt support based on the well-maintained bcrypt library. Please don’t use this package in new projects.

z3c.bcrypt provides zope.password compatible “password manager” utilities that use bcrypt (or alternatively pbkdf2) encoding for storing passwords.

Both encoding schemes are implemented in the cryptacular library that is a dependency for this package.

Using z3c.bcrypt

>>> from zope.interface.verify import verifyObject
>>> from zope.password.interfaces import IPasswordManager
>>> from z3c.bcrypt import BcryptPasswordManager
>>> manager = BcryptPasswordManager()
>>> verifyObject(IPasswordManager, manager)
True
>>> password = u"right \N{CYRILLIC CAPITAL LETTER A}"
>>> encoded = manager.encodePassword(password)
>>> encoded
'$2a$...'
>>> manager.checkPassword(encoded, password)
True
>>> manager.checkPassword(encoded, password + u"wrong")
False
>>> from z3c.bcrypt import PBKDF2PasswordManager
>>> manager = PBKDF2PasswordManager()
>>> verifyObject(IPasswordManager, manager)
True
>>> encoded = manager.encodePassword(password)
>>> encoded
u'$p5k2$...'
>>> manager.checkPassword(encoded, password)
True
>>> manager.checkPassword(encoded, password + u"wrong")
False
>>> # A previously encoded password, should be decodable even if the
>>> # current encoding of the same password is different::
>>> previouslyencoded = (
...     '$p5k2$1000$LgAFPIlc9CgrlSaxHyTUMA='
...     '=$IuUYplhMkR4qCl8-ONRVjEgJNwE=')
>>> encoded == previouslyencoded
False
>>> manager.checkPassword(previouslyencoded , password)
True

Excessively long “passwords” will take up a lot of computation time that can be used as a DOS attack vector. The password managers in z3c.bcrypt will only use the first 4096 characters of the incoming password for checking.

This is inspired by:

https://www.djangoproject.com/weblog/2013/sep/15/security/

This test would take significantly longer if the 4096 length limit would not be in place. XXX how to test that reliably?

>>> incomming = '$p5k2$1000$' + 'a' * 1024 * 1024 * 100  # lot of data.
>>> manager.checkPassword(encoded, incomming)
False

Configuration

This package provides a configure.zcml which installs implementations of the IPasswordManager as utilities:

>>> from zope.configuration import xmlconfig
>>> _ = xmlconfig.string("""
... <configure
...    xmlns="http://namespaces.zope.org/zope">
...
...    <include package="z3c.bcrypt" />
... </configure>
... """)
>>> from zope import component
>>> from zope.password.interfaces import IPasswordManager
>>> component.getUtility(IPasswordManager, name='bcrypt')
<z3c.bcrypt.passwordmanager.BcryptPasswordManager object at ...>
>>> component.getUtility(IPasswordManager, name='pbkdf2')
<z3c.bcrypt.passwordmanager.PBKDF2PasswordManager object at ...>

Changelog of z3c.bcrypt

2.0.1 (2018-08-01)

2.0.0 (2017-05-10)

  • Standardize namespace __init__.
  • Add support for Python 3.4, 3.5, 3.6 and PyPy.

1.2 (2013-10-10)

1.1 (2010-02-22)

  • Fixes in the configure.zcml.

1.0 (2010-02-18)

  • Initial public release.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for z3c.bcrypt, version 2.0.1
Filename, size File type Python version Upload date Hashes
Filename, size z3c.bcrypt-2.0.1.tar.gz (7.6 kB) File type Source Python version None Upload date Hashes View hashes

Supported by

Elastic Elastic Search Pingdom Pingdom Monitoring Google Google BigQuery Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN DigiCert DigiCert EV certificate StatusPage StatusPage Status page