summaryrefslogtreecommitdiff
path: root/docs
diff options
context:
space:
mode:
Diffstat (limited to 'docs')
-rw-r--r--docs/lib/passlib.hash.pbkdf2_digests.rst31
1 files changed, 31 insertions, 0 deletions
diff --git a/docs/lib/passlib.hash.pbkdf2_digests.rst b/docs/lib/passlib.hash.pbkdf2_digests.rst
index d2906b5..666bd83 100644
--- a/docs/lib/passlib.hash.pbkdf2_digests.rst
+++ b/docs/lib/passlib.hash.pbkdf2_digests.rst
@@ -33,6 +33,11 @@ PassLib supports 5 PBKDF2-based hash schemes:
password hash [#grub]_, as generated by the :command:`grub-mkpasswd-pbkdf2` command,
and may be found in Grub2 configuration files.
+* :class:`!atlassian_pbkdf2_sha1` provides an implementation of
+ the PBKDF2 based hash used by Atlassian in Jira and other products.
+ Note that unlike the above PBKDF2 hashes, this one uses a fixed
+ number of rounds.
+
Usage
=====
These classes support both rounds and salts,
@@ -46,6 +51,7 @@ Interface
.. autoclass:: pbkdf2_sha512()
.. autoclass:: dlitz_pbkdf2_sha1()
.. autoclass:: grub_pbkdf2_sha512()
+.. autoclass:: atlassian_pbkdf2_sha1()
.. rst-class:: html-toggle
@@ -154,6 +160,31 @@ Other PBKDF2 Hashes
along with the decoded salt, and the number of rounds.
The result is then encoded into hexidecimal.
+:class:`!atlassian_pbkdf2_sha1`
+
+ All of this scheme's hashes have the format :``{PKCS5S2}<data>``,
+ where :samp:`<data>` is a 64 character base64 encoded string;
+ which (when decoded), contains a 16 byte salt,
+ and a 32 byte checksum.
+
+ A example hash (of ``password``) is:
+
+ ``{PKCS5S2}DQIXJU038u4P7FdsuFTY/+35bm41kfjZa57UrdxHp2Mu3qF2uy+ooD+jF5t1tb8J``
+
+ Once decoded, the salt value (in hexdecimal octets) is:
+
+ ``0d0217254d37f2ee0fec576cb854d8ff``
+
+ and the checksum value (in hexidecimal octets) is:
+
+ ``edf96e6e3591f8d96b9ed4addc47a7632edea176bb2fa8a03fa3179b75b5bf09``
+
+ When calculating the checksum:
+ the password is encoded into UTF-8 if not already encoded.
+ Using the specified salt, and a fixed 10000 rounds,
+ PBKDF2-HMAC-SHA1 is used to generate a 32 byte key,
+ which appended to the salt and encoded in base64.
+
Hash Translation
----------------
Note that despite encoding and format differences,