diff options
| author | Eli Collins <elic@assurancetechnologies.com> | 2011-03-14 17:36:41 -0400 |
|---|---|---|
| committer | Eli Collins <elic@assurancetechnologies.com> | 2011-03-14 17:36:41 -0400 |
| commit | 5076cf146f56122ed712f17849dfbc782ca36e93 (patch) | |
| tree | 1d1527de8b50554ed9a641599e61f9ede557e23e /docs | |
| parent | e7d9b1e3513c69df6ff580d499c5e4615cff069e (diff) | |
| download | passlib-5076cf146f56122ed712f17849dfbc782ca36e93.tar.gz | |
supporting hashes added
=======================
* added unix_fallback scheme, for detecting wildcard/disabled passwords in /etc/shadow files
* added plaintext scheme, for migrating existing application
* added hex md4/md5/sha1/sha256/sha512 schemes, for migrating existing applications
* docs & UTs added for above schemes
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/lib/passlib.hash.hex_digests.rst | 49 | ||||
| -rw-r--r-- | docs/lib/passlib.hash.plaintext.rst | 35 | ||||
| -rw-r--r-- | docs/lib/passlib.hash.rst | 22 | ||||
| -rw-r--r-- | docs/lib/passlib.hash.unix_fallback.rst | 36 |
4 files changed, 138 insertions, 4 deletions
diff --git a/docs/lib/passlib.hash.hex_digests.rst b/docs/lib/passlib.hash.hex_digests.rst new file mode 100644 index 0000000..7224069 --- /dev/null +++ b/docs/lib/passlib.hash.hex_digests.rst @@ -0,0 +1,49 @@ +================================================================== +:samp:`passlib.hash.hex_{digest}` - Hexdecimal Standard Digests +================================================================== + +.. currentmodule:: passlib.hash + +Some existing applications store passwords by storing them using +hexidecimal-encoded message digests, such as MD5 or SHA1. +Such schemes are *extremely* vulnerable to pre-computed brute-force attacks, +and should not be used in new applications. However, for the sake +of backwards compatibility when converting existing applications, +Passlib provides wrappers for few of the common hashes. + +Usage +===== +These classes all wrap the underlying hashlib implementations, +and are mainly useful only for plugging them into a :class:`passlib.base.CryptContext`. +However, they can be used directly as follows:: + + >>> from passlib.hash import hex_sha1 as hs + + >>> #encrypt password + >>> h = hs.encrypt("password") + >>> h + '5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8' + + >>> hs.identify(h) #check if hash is recognized + True + >>> hs.identify('JQMuyS6H.AGMo') #check if some other hash is recognized + False + + >>> hs.verify("password", h) #verify correct password + True + >>> hs.verify("secret", h) #verify incorrect password + False + +Interface +========= +.. autoclass:: hex_md4() +.. autoclass:: hex_md5() +.. autoclass:: hex_sha1() +.. autoclass:: hex_sha256() +.. autoclass:: hex_sha512() + +Format & Algorithm +================== +All of these classes just report the result of the specified digest, +encoded as a series of lowercase hexidecimal characters; +though upper case is accepted as input. diff --git a/docs/lib/passlib.hash.plaintext.rst b/docs/lib/passlib.hash.plaintext.rst new file mode 100644 index 0000000..d0ad62d --- /dev/null +++ b/docs/lib/passlib.hash.plaintext.rst @@ -0,0 +1,35 @@ +================================================================== +:class:`passlib.hash.plaintext` - Plaintext +================================================================== + +.. currentmodule:: passlib.hash + +This class stores passwords in plaintext. +This is, of course, ridiculously insecure; +it is provided for backwards compatibility when migrating +existing applications. *It should not be used* for any other purpose. + +Usage +===== +This class is mainly useful only for plugging into a :class:`passlib.base.CryptContext`. +When used, it should always be the last scheme in the list, +as it will recognize all hashes. +It can be used directly as follows:: + + >>> from passlib.hash import plaintext as pt + + >>> #"encrypt" password + >>> pt.encrypt("password") + 'password' + + >>> nt.identify('password') #check if hash is recognized (all hashes are recognized) + True + + >>> nt.verify("password", "password") #verify correct password + True + >>> nt.verify("secret", "password") #verify incorrect password + False + +Interface +========= +.. autoclass:: plaintext diff --git a/docs/lib/passlib.hash.rst b/docs/lib/passlib.hash.rst index d0dbf0b..2cece32 100644 --- a/docs/lib/passlib.hash.rst +++ b/docs/lib/passlib.hash.rst @@ -75,10 +75,11 @@ the modular crypt format. passlib.hash.phpass passlib.hash.nthash -Other Schemes -------------- -The following schemes are used in very specified contexts, -and have encoding schemes and other requirements +Database Schemes +---------------- +The following schemes are used by various SQL databases +to encode their own user accounts. +These schemes have encoding and contextual requirements not seen outside those specific contexts: .. toctree:: @@ -87,3 +88,16 @@ not seen outside those specific contexts: passlib.hash.mysql323 passlib.hash.mysql41 passlib.hash.postgres_md5 + + +Other Schemes +------------- +The following schemes are used in various contexts, +mainly for legacy compatibility purposes. + +.. toctree:: + :maxdepth: 1 + + passlib.hash.hex_digests + passlib.hash.plaintext + passlib.hash.unix_fallback diff --git a/docs/lib/passlib.hash.unix_fallback.rst b/docs/lib/passlib.hash.unix_fallback.rst new file mode 100644 index 0000000..d534546 --- /dev/null +++ b/docs/lib/passlib.hash.unix_fallback.rst @@ -0,0 +1,36 @@ +================================================================== +:class:`passlib.hash.unix_fallback` - Unix Fallback Helper +================================================================== + +.. currentmodule:: passlib.hash + +This class does not provide an encryption scheme, +but instead provides a helper for handling disabled / wildcard +password fields as found in unix ``/etc/shadow`` files. + +Usage +===== +This class is mainly useful only for plugging into a :class:`passlib.base.CryptContext`. +When used, it should always be the last scheme in the list, +as it is designed to provide a fallback behavior. +It can be used directly as follows:: + + >>> from passlib.hash import unix_fallback as uf + + >>> #'encrypting' a password always results in "!", the default reject hash. + >>> uf.encrypt("password") + '!' + + >>> uf.identify('!') #check if hash is recognized (all hashes are recognized) + True + >>> uf.identify('') + True + + >>> uf.verify("password", "") #verify against empty string - all password allowed + True + >>> uf.verify("password", "!") #verify against non-empty string - no passwords allowed + False + +Interface +========= +.. autoclass:: unix_fallback |
