ó
èŽXc @À sñ d Z d d l m Z m Z d d l Z e j e ƒ Z d d l Z d d l Z d d l
m Z e Z
e a d d l m Z d d l m Z d d l m Z d d l m Z m Z d d l m Z m Z m Z d d l j j Z d
g Z y d d l! Z
Wn e" k
re Z
n Xe# e
d e ƒ Z$ e$ rBe$ ƒ Z% e
j& j' Z( n d f d
„ ƒ YZ% d Z( d e j) e j* e j+ e j, e j- e j. f d „ ƒ YZ/ d e/ f d „ ƒ YZ0 d e/ f d „ ƒ YZ1 d e/ f d „ ƒ YZ2 d
e0 e/ f d „ ƒ YZ! d S( sá passlib.handlers.argon2 -- argon2 password hash wrapper
References
==========
* argon2
- home: https://github.com/P-H-C/phc-winner-argon2
- whitepaper: https://github.com/P-H-C/phc-winner-argon2/blob/master/argon2-specs.pdf
* argon2 cffi wrapper
- pypi: https://pypi.python.org/pypi/argon2_cffi
- home: https://github.com/hynek/argon2_cffi
* argon2 pure python
- pypi: https://pypi.python.org/pypi/argon2pure
- home: https://github.com/bwesterb/argon2pure
i ( t with_statementt absolute_importN( t warn( t exc( t
MAX_UINT32( t to_bytes( t b64s_encodet b64s_decode( t ut unicodet
bascii_to_strt argon2t PasswordHashert _default_settingsc BÀ s, e Z d Z d Z d Z d Z d Z d Z RS( s†
dummy object to use as source of defaults when argon2 mod not present.
synced w/ argon2 16.1 as of 2016-6-16
i i i ( t __name__t
__module__t __doc__t time_costt memory_costt parallelismt salt_lent hash_len( ( ( s; /usr/lib/python2.7/site-packages/passlib/handlers/argon2.pyR
: s i t
_Argon2Commonc BÀ s— e Z d Z d Z d Z e d ƒ Z e j Z e d ƒ e d
ƒ f Z
e j Z d Z
e Z e j Z d Z e Z d Z d" Z e Z d# Z d Z d Z e Z e j Z e Z e j Z e Z! d# Z" e# d# d# d# d# d# d# d# d „ ƒ Z$ e# d „ ƒ Z% e# d „ ƒ Z& e' j( d e' j) ƒ Z* e# d „ ƒ Z+ d „ Z, e d# d# d# d „ Z- e# d „ ƒ Z. e# e d „ ƒ Z/ d „ Z0 d Z1 e# d „ ƒ Z2 e# d# d# d „ ƒ Z3 RS($ s&
Base class which implements brunt of Argon2 code.
This is then subclassed by the various backends,
to override w/ backend-specific methods.
When a backend is loaded, the bases of the 'argon2' class proper
are modified to prepend the correct backend-specific subclass.
R t saltt salt_sizeR t roundsR R R t digest_sizeR s $argon2is $argon2i$s $argon2d$i i t lineari iÿÿÿÿc KÀ s | d k r4 d | k r' t d ƒ ‚ n | | d <n | d k rh d | k r[ t d ƒ ‚ n | | d <n | d k r˜ | d k r t d ƒ ‚ n | } n | d k rÈ | d k r¿ t d ƒ ‚ n | } n t t | ƒ j | } | j d ƒ }
| d k rLt | t j ƒ r t | ƒ } n t j
| | d d d
t d d d |
ƒ| _ n | d k r”t | t j ƒ ryt | ƒ } n | j
| d |
ƒ| _ n | j | j | j ƒ | d k rt | t j ƒ r×t | ƒ } n | d
k r| d k rt d | f ƒ ‚ n | | _ n | S( NR s/ 'time_cost' and 'rounds' are mutually exclusiveR s1 'salt_len' and 'salt_size' are mutually exclusives3 'hash_len' and 'digest_size' are mutually exclusives8 'checksum_size' and 'digest_size' are mutually exclusivet relaxedt mini t maxt paramR i iÿÿÿÿs7 max_threads (%d) must be -1 (unlimited), or at least 1.( t Nonet TypeErrort superR t usingt gett
isinstancet uht native_string_typest intt norm_integerR t
checksum_sizet _norm_memory_costR t _validate_constraintsR t
ValueErrort max_threads( t clsR R R R R* R R. t kwdst subclsR ( ( s; /usr/lib/python2.7/site-packages/passlib/handlers/argon2.pyR# º sH
c CÀ s< d | } | | k r8 t d | j | | | f ƒ ‚ n d S( Ni sO %s: memory_cost (%d) is too low, must be at least 8 * parallelism (8 * %d = %d)( R- t name( R/ R R t min_memory_cost( ( s; /usr/lib/python2.7/site-packages/passlib/handlers/argon2.pyR, ò s
c CÀ s t j | ƒ } | j | j ƒ S( N( R& t to_unicode_for_identifyt
startswitht ident_values( R/ t hash( ( s; /usr/lib/python2.7/site-packages/passlib/handlers/argon2.pyt identify s s÷
^
\$argon2(?P<type>[id])\$
(?:
v=(?P<version>\d+)
\$
)?
m=(?P<memory_cost>\d+)
,
t=(?P<time_cost>\d+)
,
p=(?P<parallelism>\d+)
(?:
,keyid=(?P<keyid>[^,$]+)
)?
(?:
,data=(?P<data>[^,$]+)
)?
(?:
\$
(?P<salt>[^$]+)
(?:
\$
(?P<digest>.+)
)?
)?
$
c CÀ s| t | t ƒ r! | j d ƒ } n t | t ƒ sE t j | d ƒ ‚ n | j j | ƒ } | so t j | ƒ ‚ n | j d d d d d d d d
d ƒ \ } } } } } } } }
} | d k sÐ t
d | f ƒ ‚ | rå t d ƒ ‚ n | d | d
k d | r t | ƒ n d d t | ƒ d t | ƒ d t | ƒ d
|
rEt
|
ƒ n d d | r]t
| ƒ n d d | rut
| ƒ n d ƒ S( Ns utf-8R7 t typet versionR R R t keyidt dataR t digestt it ds unexpected type code: %rs& argon2 'keyid' parameter not supportedt type_di R t checksum( R> R? ( R% R t encodet bytesR t ExpectedStringErrort _hash_regext matcht MalformedHashErrort groupt AssertionErrort NotImplementedErrorR( R R ( R/ R7 t mR9 R: R R R R; R< R R= ( ( s; /usr/lib/python2.7/site-packages/passlib/handlers/argon2.pyt from_string8 s* - c CÀ s¶ t | j | j ƒ } | j } | d k r4 d } n
d | } | j } | ri d t t | j ƒ ƒ } n d } d | | | j | j | j | t t | j
ƒ ƒ t t | j ƒ ƒ f S( Ni t s v=%d$s ,data=s %s%sm=%d,t=%d,p=%d%s$%s$%s( t strR6 R@ R: R< R
R R R R R RA ( t selft identR: t vstrR< t kdstr( ( s; /usr/lib/python2.7/site-packages/passlib/handlers/argon2.pyt to_stringS s
c KÀ s7 | j d ƒ } | d k r- t | ƒ | _ n t t | ƒ j | | | _ | d k r‚ t j | | j
| j d d ƒs” t ‚ n | j | ƒ | _
| d k rÊ t j | | j
| j d d ƒsÜ t ‚ n | j | ƒ | _
| d k r | j d k s3t ‚ n3 t | t ƒ s*t j j | d d ƒ ‚ n | | _ d S( NRA R R: R RC R< ( R$ R t lenR* R" R t __init__R@ R& t validate_default_valueR: t
_norm_versionRI R R+ R< R% RC R t ExpectedTypeError( RO R@ R: R R< R0 RA ( ( s; /usr/lib/python2.7/site-packages/passlib/handlers/argon2.pyRU i s$ c CÀ sŸ t | t j ƒ s- t j j | d d ƒ ‚ n | d k r[ | d k r[ t d | f ƒ ‚ n | j ƒ } | | j k r› t d | j | | | j f ƒ ‚ n | S( Nt integerR: i i s invalid argon2 hash version: %dsk %s: hash version 0x%X not supported by %r backend (max version is 0x%X); try updating or switching backends( R% R& t int_typesR RX R- t get_backendt max_versionR2 ( R/ R: t backend( ( s; /usr/lib/python2.7/site-packages/passlib/handlers/argon2.pyRW ’ s c CÀ s% t j | | d | j d d d | ƒS( NR R R R ( R& R) R3 ( R/ R R ( ( s; /usr/lib/python2.7/site-packages/passlib/handlers/argon2.pyR+ £ s c KÀ sž t | ƒ } | j r t S| j } | d k s= | | j k rI | j } n | j | k r\ t S| j | j k rr t S| j | j k rˆ t St t
| ƒ j | S( N( R9 R@ t Truet min_desired_versionR R\ R: R R* R" R t _calc_needs_update( RO R0 R/ t minver( ( s; /usr/lib/python2.7/site-packages/passlib/handlers/argon2.pyR` ² s s> -- recommend you install one (e.g. 'pip install argon2_cffi')c CÀ sT | j } t | t ƒ r$ | d k s* t ‚ | d k rP t d | t j j ƒ n t S( sØ
helper called by from backend mixin classes' _load_backend_mixin() --
invoked after backend imports have been loaded, and performs
feature detection & testing common to all backends.
i i s6 %r doesn't support argon2 v1.3, and should be upgraded( R\ R% R( RI R R& R t PasslibSecurityWarningR^ ( t mixin_clsR2 t dryrunR\ ( ( s; /usr/lib/python2.7/site-packages/passlib/handlers/argon2.pyt _finalize_backend_mixinÉ s !
c CÀ sØ | j ƒ } | d k r6 | d k r6 | j | ƒ } n | d k r… | j | j | j ƒ | d k r… | j d k r… t d ƒ ‚ q… n t | ƒ } | d k r³ d | | | f } n t | ƒ } t
j | d | ƒ‚ d S( s}
internal helper invoked when backend has hash/verification error;
used to adapt to passlib message.
t argon2_cffis8 argon2_cffi backend doesn't support the 'data' parameters Decoding faileds %s reported: %s: hash=%rt reasonN( s Decoding failed( R[ R RL R, R R R< RJ RN t reprR RG ( R/ t errR7 RO R] t textRg ( ( s; /usr/lib/python2.7/site-packages/passlib/handlers/argon2.pyt _adapt_backend_error× s ( s salts salt_sizes salt_lens roundss time_costs memory_costs parallelisms digest_sizes hash_leni iÿÿÿ N(4 R R R R2 t setting_kwdsR RP R
R R* R6 R t default_salt_sizet
min_salt_sizeR t
max_salt_sizeR t default_roundst
min_roundst
max_roundst rounds_costt max_parallelismt _default_versionR\ R R_ R3 R. t Falset pure_use_threadsR R: R R@ R< t classmethodR# R, R8 t ret compilet XRE RL RS RU RW R+ R` t _no_backend_suggestionRe Rk ( ( ( s; /usr/lib/python2.7/site-packages/passlib/handlers/argon2.pyR I sd
6 ) t
_NoBackendc BÀ s\ e Z d Z e d „ ƒ Z e d „ ƒ Z e j d d d d ƒ e d „ ƒ ƒ Z d „ Z RS( s€
mixin used before any backend has been loaded.
contains stubs that force loading of one of the available backends.
c CÀ s | j ƒ | j | ƒ S( N( t _stub_requires_backendR7 ( R/ t secret( ( s; /usr/lib/python2.7/site-packages/passlib/handlers/argon2.pyR7 s
c CÀ s | j ƒ | j | | ƒ S( N( R~ t verify( R/ R R7 ( ( s; /usr/lib/python2.7/site-packages/passlib/handlers/argon2.pyR€ s
t
deprecateds 1.7t removeds 2.0c CÀ s | j ƒ | j | | ƒ S( N( R~ t genhash( R/ R t config( ( s; /usr/lib/python2.7/site-packages/passlib/handlers/argon2.pyRƒ s
c CÀ s | j ƒ t t | ƒ j | ƒ S( N( R~ R" R t _calc_checksum( RO R ( ( s; /usr/lib/python2.7/site-packages/passlib/handlers/argon2.pyR… s
(
R R R Rx R7 R€ R& t deprecated_methodRƒ R… ( ( ( s; /usr/lib/python2.7/site-packages/passlib/handlers/argon2.pyR} þ s t _CffiBackendc BÀ sS e Z d Z e d „ ƒ Z e d „ ƒ Z e d „ ƒ Z e d „ ƒ Z d „ Z RS( s
argon2_cffi backend
c CÀ sR t d k r t St j j } t j d t j | ƒ | | _ | _ | j
| | ƒ S( NsO detected 'argon2_cffi' backend, version %r, with support for 0x%x argon2 hashes( t _argon2_cffiR Rv t low_levelt ARGON2_VERSIONt logt debugt __version__R: R\ Re ( Rc R2 Rd R\ ( ( s; /usr/lib/python2.7/site-packages/passlib/handlers/argon2.pyt _load_backend_mixin0 s
c CÀ s t j | ƒ t | d ƒ } yb t t j j d t j j j d | j d | j
d | j d t | j ƒ ƒ d | j
d | ƒ ƒ SWn( t j j k
r¨ } | j | ƒ ‚ n Xd S( Ns utf-8R9 R R R R R R ( R& t validate_secretR R
Rˆ R‰ t hash_secrett Typet IR Rp R t _generate_saltR* t
exceptionst HashingErrorRk ( R/ R Ri ( ( s; /usr/lib/python2.7/site-packages/passlib/handlers/argon2.pyR7 > s
c CÀ sÙ t j | ƒ t | d ƒ } t | d ƒ } | j d ƒ rL t j j j } n t j j j } y2 t j j | | | ƒ } | t
k sˆ t ‚ t
SWnE t j j
k
r§ t St j j k
rÔ } | j | d | ƒ‚ n Xd S( Ns utf-8t asciis $argon2d$R7 ( R& R R R5 Rˆ R‰ R‘ t DR’ t
verify_secretR^ RI R” t VerifyMismatchErrorRv t VerificationErrorRk ( R/ R R7 R9 t resultRi ( ( s; /usr/lib/python2.7/site-packages/passlib/handlers/argon2.pyR€ Q s
c CÀ s t j | ƒ t | d ƒ } | j | ƒ } | j rF t j j j } n t j j j } ya t
t j j d | d | j d | j
d | j d t | j ƒ d | j d | d | j ƒ ƒ } Wn. t j j k
ræ } | j | d
| ƒ‚ n X| j d k r | j d d
ƒ } n | S( Ns utf-8R9 R R R R R R R: R7 i s $v=16$t $( R& R R RL R@ Rˆ R‰ R‘ R— R’ R
R R R R R R* R: R” R• Rk t replace( R/ R R„ RO R9 R› Ri ( ( s; /usr/lib/python2.7/site-packages/passlib/handlers/argon2.pyRƒ f s*
c CÀ s t d ƒ ‚ d S( Ns- shouldn't be called under argon2_cffi backend( RI ( RO R ( ( s; /usr/lib/python2.7/site-packages/passlib/handlers/argon2.pyR… † s ( R R R Rx RŽ R7 R€ Rƒ R… ( ( ( s; /usr/lib/python2.7/site-packages/passlib/handlers/argon2.pyR‡ ( s t _PureBackendc BÀ s& e Z d Z e d „ ƒ Z d „ Z RS( s
argon2pure backend
c CÀ s¤ y d d l a Wn t k
r$ t SXy d d l m } Wn t k
rZ t j d ƒ t SXt j d | ƒ | s„ t d t j
ƒ n | | _ | _ | j
| | ƒ S( Ni ( t ARGON2_DEFAULT_VERSIONs\ detected 'argon2pure' backend, but package is too old (passlib requires argon2pure >= 1.2.3)sB detected 'argon2pure' backend, with support for 0x%x argon2 hashess¦ Using argon2pure backend, which is 100x+ slower than is required for adequate security. Installing argon2_cffi (via 'pip install argon2_cffi') is strongly recommended( t
argon2puret _argon2puret ImportErrorRv RŸ R‹ t warningRŒ R R Rb R: R\ Re ( Rc R2 Rd R\ ( ( s; /usr/lib/python2.7/site-packages/passlib/handlers/argon2.pyRŽ ˜ s
c CÀ s t j | ƒ t | d ƒ } | j r1 t j } n t j } t d | d | j d | j d | j
d | j d | j d | d | j
ƒ } | j d
k r¤ | j | d <n | j rº t | d <n | j rÓ | j | d
<n y t j | SWn+ t j k
r} | j | d | ƒ‚ n Xd S( Ns utf-8t passwordR R R R t
tag_lengtht type_codeR: i t threadst use_threadst associated_dataRO ( R& R R R@ R¡ t ARGON2Dt ARGON2It dictR R R R R* R: R. Rw R^ R< R t Argon2ErrorRk ( RO R R9 R0 Ri ( ( s; /usr/lib/python2.7/site-packages/passlib/handlers/argon2.pyR… ½ s0
( R R R Rx RŽ R… ( ( ( s; /usr/lib/python2.7/site-packages/passlib/handlers/argon2.pyRž s %c BÀ s5 e Z d Z d Z e Z i e d 6e d 6e d 6Z
RS( s[
This class implements the Argon2 password hash [#argon2-home]_, and follows the :ref:`password-hash-api`.
(This class only supports generating "Type I" argon2 hashes).
Argon2 supports a variable-length salt, and variable time & memory cost,
and a number of other configurable parameters.
The :meth:`~passlib.ifc.PasswordHash.replace` method accepts the following optional keywords:
:type salt: str
:param salt:
Optional salt string.
If specified, the length must be between 0-1024 bytes.
If not specified, one will be auto-generated (this is recommended).
:type salt_size: int
:param salt_size:
Optional number of bytes to use when autogenerating new salts.
:type rounds: int
:param rounds:
Optional number of rounds to use.
This corresponds linearly to the amount of time hashing will take.
:type time_cost: int
:param time_cost:
An alias for **rounds**, for compatibility with underlying argon2 library.
:param int memory_cost:
Defines the memory usage in kibibytes.
This corresponds linearly to the amount of memory hashing will take.
:param int parallelism:
Defines the parallelization factor.
*NOTE: this will affect the resulting hash value.*
:param int digest_size:
Length of the digest in bytes.
:param int max_threads:
Maximum number of threads that will be used.
-1 means unlimited; otherwise hashing will use ``min(parallelism, max_threads)`` threads.
.. note::
This option is currently only honored by the argon2pure backend.
:type relaxed: bool
:param relaxed:
By default, providing an invalid value for one of the other
keywords will result in a :exc:`ValueError`. If ``relaxed=True``,
and the error can be corrected, a :exc:`~passlib.exc.PasslibHashWarning`
will be issued instead. Correctable errors include ``rounds``
that are too small or too large, and ``salt`` strings that are too long.
.. todo::
* Support configurable threading limits.
Rf R ( s argon2_cffis
argon2pureN( R R R t backendsR^ t _backend_mixin_targetR} R R‡ Rž t _backend_mixin_map( ( ( s; /usr/lib/python2.7/site-packages/passlib/handlers/argon2.pyR á s ; (3 R t
__future__R R t loggingt getLoggerR R‹ Ry t typest warningsR R Rˆ R¡ t passlibR t passlib.crypto.digestR t
passlib.utilsR t passlib.utils.binaryR R t passlib.utils.compatR R R
t passlib.utils.handlerst utilst handlersR& t __all__R R¢ t getattrt _PasswordHasherR
R‰ RŠ Ru t SubclassBackendMixint ParallelismMixint HasRoundst
HasRawSaltt HasRawChecksumt GenericHandlerR R} R‡ Rž ( ( ( s; /usr/lib/python2.7/site-packages/passlib/handlers/argon2.pyt <module> sB
ÿ ´*hQ