-
Eli Collins authored
bcrypt ------ * added support & UT for $2b$ hash format. not making it the default yet, for backward compat. * large refactor of how bcrypt backends are loaded: instead of per-backend workarounds within each _calc_checksum_<backend>() function: now using runtime detection of specific capabilities & workarounds, that runs whenever set_backend() is called, combined with consolidated workaround code within _calc_checksum(), controlled by the flags set by set_backend(). this detection now looks for: - the 8bit bug: throws a PasslibSecurityError - the wraparound bug: issues warning, sets flag enabling a workaround. - support for 2/2y/2b: if backend lacks support for particular variants, sets flag enabling workaround to add support. * os_crypt backend now just issues error if it can't handle a password encoding; rather than trying fallbacks first -- edge case anyways, and likely to not have any fallbacks when it does happen. simplifies backend code. * added UTs to make sure wraparound-vulnerable passwords are hashed correctly (as a 72char string, not a 1-3 char string that's repeated). * internal blowfish code's ident parsing clarified. other ----- * added exc.PasslibSecurityError for fatal runtime errors. * test framework: os_crypt backends no longer expected to use *any* backend as fallback, just ones with lower priority than os_crypt. * test framework: crypt_stub() wrapper now subclasses the handler, so it can use an independant backend, instead of changing global backend for duration of call (made parallel testing hard) docs ---- * added entry to bcrypt page, writing down wraparound bug details, and how passlib is handling it. * all versions of pybcrypt & bcryptor seem to be vulnerable to wraparound bug. starting process of deprecating these backends: marked bcrypt backend as 'preferred' throughout the documentation. --HG-- branch : stable
7adbe5f07f56
To learn more about this project, read the wiki.