summaryrefslogtreecommitdiff
path: root/docs/lib
diff options
context:
space:
mode:
authorEli Collins <elic@assurancetechnologies.com>2011-03-14 17:36:41 -0400
committerEli Collins <elic@assurancetechnologies.com>2011-03-14 17:36:41 -0400
commit5076cf146f56122ed712f17849dfbc782ca36e93 (patch)
tree1d1527de8b50554ed9a641599e61f9ede557e23e /docs/lib
parente7d9b1e3513c69df6ff580d499c5e4615cff069e (diff)
downloadpasslib-5076cf146f56122ed712f17849dfbc782ca36e93.tar.gz
supporting hashes added
======================= * added unix_fallback scheme, for detecting wildcard/disabled passwords in /etc/shadow files * added plaintext scheme, for migrating existing application * added hex md4/md5/sha1/sha256/sha512 schemes, for migrating existing applications * docs & UTs added for above schemes
Diffstat (limited to 'docs/lib')
-rw-r--r--docs/lib/passlib.hash.hex_digests.rst49
-rw-r--r--docs/lib/passlib.hash.plaintext.rst35
-rw-r--r--docs/lib/passlib.hash.rst22
-rw-r--r--docs/lib/passlib.hash.unix_fallback.rst36
4 files changed, 138 insertions, 4 deletions
diff --git a/docs/lib/passlib.hash.hex_digests.rst b/docs/lib/passlib.hash.hex_digests.rst
new file mode 100644
index 0000000..7224069
--- /dev/null
+++ b/docs/lib/passlib.hash.hex_digests.rst
@@ -0,0 +1,49 @@
+==================================================================
+:samp:`passlib.hash.hex_{digest}` - Hexdecimal Standard Digests
+==================================================================
+
+.. currentmodule:: passlib.hash
+
+Some existing applications store passwords by storing them using
+hexidecimal-encoded message digests, such as MD5 or SHA1.
+Such schemes are *extremely* vulnerable to pre-computed brute-force attacks,
+and should not be used in new applications. However, for the sake
+of backwards compatibility when converting existing applications,
+Passlib provides wrappers for few of the common hashes.
+
+Usage
+=====
+These classes all wrap the underlying hashlib implementations,
+and are mainly useful only for plugging them into a :class:`passlib.base.CryptContext`.
+However, they can be used directly as follows::
+
+ >>> from passlib.hash import hex_sha1 as hs
+
+ >>> #encrypt password
+ >>> h = hs.encrypt("password")
+ >>> h
+ '5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8'
+
+ >>> hs.identify(h) #check if hash is recognized
+ True
+ >>> hs.identify('JQMuyS6H.AGMo') #check if some other hash is recognized
+ False
+
+ >>> hs.verify("password", h) #verify correct password
+ True
+ >>> hs.verify("secret", h) #verify incorrect password
+ False
+
+Interface
+=========
+.. autoclass:: hex_md4()
+.. autoclass:: hex_md5()
+.. autoclass:: hex_sha1()
+.. autoclass:: hex_sha256()
+.. autoclass:: hex_sha512()
+
+Format & Algorithm
+==================
+All of these classes just report the result of the specified digest,
+encoded as a series of lowercase hexidecimal characters;
+though upper case is accepted as input.
diff --git a/docs/lib/passlib.hash.plaintext.rst b/docs/lib/passlib.hash.plaintext.rst
new file mode 100644
index 0000000..d0ad62d
--- /dev/null
+++ b/docs/lib/passlib.hash.plaintext.rst
@@ -0,0 +1,35 @@
+==================================================================
+:class:`passlib.hash.plaintext` - Plaintext
+==================================================================
+
+.. currentmodule:: passlib.hash
+
+This class stores passwords in plaintext.
+This is, of course, ridiculously insecure;
+it is provided for backwards compatibility when migrating
+existing applications. *It should not be used* for any other purpose.
+
+Usage
+=====
+This class is mainly useful only for plugging into a :class:`passlib.base.CryptContext`.
+When used, it should always be the last scheme in the list,
+as it will recognize all hashes.
+It can be used directly as follows::
+
+ >>> from passlib.hash import plaintext as pt
+
+ >>> #"encrypt" password
+ >>> pt.encrypt("password")
+ 'password'
+
+ >>> nt.identify('password') #check if hash is recognized (all hashes are recognized)
+ True
+
+ >>> nt.verify("password", "password") #verify correct password
+ True
+ >>> nt.verify("secret", "password") #verify incorrect password
+ False
+
+Interface
+=========
+.. autoclass:: plaintext
diff --git a/docs/lib/passlib.hash.rst b/docs/lib/passlib.hash.rst
index d0dbf0b..2cece32 100644
--- a/docs/lib/passlib.hash.rst
+++ b/docs/lib/passlib.hash.rst
@@ -75,10 +75,11 @@ the modular crypt format.
passlib.hash.phpass
passlib.hash.nthash
-Other Schemes
--------------
-The following schemes are used in very specified contexts,
-and have encoding schemes and other requirements
+Database Schemes
+----------------
+The following schemes are used by various SQL databases
+to encode their own user accounts.
+These schemes have encoding and contextual requirements
not seen outside those specific contexts:
.. toctree::
@@ -87,3 +88,16 @@ not seen outside those specific contexts:
passlib.hash.mysql323
passlib.hash.mysql41
passlib.hash.postgres_md5
+
+
+Other Schemes
+-------------
+The following schemes are used in various contexts,
+mainly for legacy compatibility purposes.
+
+.. toctree::
+ :maxdepth: 1
+
+ passlib.hash.hex_digests
+ passlib.hash.plaintext
+ passlib.hash.unix_fallback
diff --git a/docs/lib/passlib.hash.unix_fallback.rst b/docs/lib/passlib.hash.unix_fallback.rst
new file mode 100644
index 0000000..d534546
--- /dev/null
+++ b/docs/lib/passlib.hash.unix_fallback.rst
@@ -0,0 +1,36 @@
+==================================================================
+:class:`passlib.hash.unix_fallback` - Unix Fallback Helper
+==================================================================
+
+.. currentmodule:: passlib.hash
+
+This class does not provide an encryption scheme,
+but instead provides a helper for handling disabled / wildcard
+password fields as found in unix ``/etc/shadow`` files.
+
+Usage
+=====
+This class is mainly useful only for plugging into a :class:`passlib.base.CryptContext`.
+When used, it should always be the last scheme in the list,
+as it is designed to provide a fallback behavior.
+It can be used directly as follows::
+
+ >>> from passlib.hash import unix_fallback as uf
+
+ >>> #'encrypting' a password always results in "!", the default reject hash.
+ >>> uf.encrypt("password")
+ '!'
+
+ >>> uf.identify('!') #check if hash is recognized (all hashes are recognized)
+ True
+ >>> uf.identify('')
+ True
+
+ >>> uf.verify("password", "") #verify against empty string - all password allowed
+ True
+ >>> uf.verify("password", "!") #verify against non-empty string - no passwords allowed
+ False
+
+Interface
+=========
+.. autoclass:: unix_fallback