PBKDF2 support

[tiran]

BPO	18582
Nosy	@pitrou, @tiran, @dstufft
Files	pbkdf2_3.patch

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2013-10-12.23:16:20.948>
created_at = <Date 2013-07-28.15:11:19.332>
labels = ['extension-modules', 'type-feature']
title = 'PBKDF2 support'
updated_at = <Date 2013-11-06.16:25:33.175>
user = 'https://github.com/tiran'

bugs.python.org fields:

activity = <Date 2013-11-06.16:25:33.175>
actor = 'python-dev'
assignee = 'none'
closed = True
closed_date = <Date 2013-10-12.23:16:20.948>
closer = 'christian.heimes'
components = ['Extension Modules']
creation = <Date 2013-07-28.15:11:19.332>
creator = 'christian.heimes'
dependencies = []
files = ['32071']
hgrepos = []
issue_num = 18582
keywords = ['patch']
message_count = 12.0
messages = ['193832', '193835', '199601', '199626', '199628', '199630', '199636', '199641', '200410', '200429', '200451', '202272']
nosy_count = 4.0
nosy_names = ['pitrou', 'christian.heimes', 'python-dev', 'dstufft']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'enhancement'
url = 'https://bugs.python.org/issue18582'
versions = ['Python 3.4']

[tiran]

The patch is a proof of concept for PBKDF2 support for the OpenSSL variant of hashlib. It's a thin wrapper around PKCS5_PBKDF2_HMAC() and is deliberately designed as low level API with bytes and input and output types. High level wrappers can do the conversation and choose sensible values for salt, iterations and key length.

[pitrou]

Please use the "y*" format, not "y#".
Also, I would lower-case "pbkdf2", just as we already lower-case "md5", "sha1", etc.

[tiran]

Done

[pitrou]

The patch looks good at first sight. It still needs docs and tests :)

Just one thing: are we sure PKCS5_PBKDF2_HMAC is defined on old OpenSSL versions, or does it need a #ifdef?

[tiran]

Here is a new patch with tests, documentation and some minor improvements. The last argument is now called dklen. If dklen is omitted or None than dklen is set to digest size of the hash algorithm.

[tiran]

Fixed copy n' paste bug in docs.

[python-dev]

New changeset 5fd56d6d3fce by Christian Heimes in branch 'default':
Issue bpo-18582: Add 'pbkdf2_hmac' to the hashlib module.
http://hg.python.org/cpython/rev/5fd56d6d3fce

[tiran]

Thanks Antoine!

[python-dev]

New changeset 0a26ef834a49 by Christian Heimes in branch 'default':
Issue bpo-18582: provide a faster C implementation of pbkdf2_hmac that works with OpenSSL < 1.0
http://hg.python.org/cpython/rev/0a26ef834a49

[python-dev]

New changeset 88fac1574049 by Christian Heimes in branch 'default':
Issue bpo-18582: HMAC_CTX_copy() is not available on OpenSSL < 1.0
http://hg.python.org/cpython/rev/88fac1574049

[python-dev]

New changeset a15fcb847515 by Christian Heimes in branch 'default':
Issue bpo-18582: skip test of _hashlib.pbkdf2_hmac if OpenSSL is not available or too old
http://hg.python.org/cpython/rev/a15fcb847515

[python-dev]

New changeset 07fa1ed0d551 by Christian Heimes in branch 'default':
Issue bpo-18582: fix memory leak in pbkdf2 code
http://hg.python.org/cpython/rev/07fa1ed0d551