Password truncation must trigger an exception
Created originally on Bitbucket by Anonymous
As a security API, passlib should fail noisily rather than possibly truncate passwords silently.
As such, the following should not even be possible with passlib:
In [11]: h = bcrypt.encrypt('a'*72 + 'a')
In [12]: bcrypt.verify('a'*72 + 'a', h)
Out[12]: True
In [13]: bcrypt.verify('a'*72 + 'b', h)
Out[13]: True
I understand it is by design (of the bcrypt algorithm) and that the bcrypt_sha256 implementation does not suffer from this problem. However, bcrypt.encrypt()
of a string longer than 72 characters should fail as should bcrypt.verify()
(independently).