keystone.common.password_hashers.pbkdf2 module

class keystone.common.password_hashers.pbkdf2.Sha512

Bases: PasswordHasher

passlib transition class for PBKDF2 Sha512 password hashing

static hash(password: bytes, salt_size: int = 16, rounds: int = 25000) → str

Generate password hash string with ident and params.

https://cryptography.io/en/stable/hazmat/primitives/key-derivation-functions/#pbkdf2

Parameters:

• password (bytes) – Password to be hashed.

• salt_size (int) – Number of random bytes to use as salt.

• rounds (int) – PBKDF2 iteration count.

Returns:

String in format $pbkdf2-sha512$<rounds>$<salt>$<digest>

hash_algo = <cryptography.hazmat.primitives.hashes.SHA512 object>

ident: str = '$pbkdf2-sha512$'

name: str = 'pbkdf2_sha512'

static needs_rehash(hashed: str, rounds: int = 25000, **kwargs) → bool

Return True if hashed used fewer rounds than rounds.

Parameters:

• hashed (str) – Stored password hash.

• rounds (int) – Target iteration count (defaults to DEFAULT_ROUNDS; callers should pass the operator-configured value).

Returns:

True when the hash should be upgraded on next login.

static verify(password: bytes, hashed: str) → bool

Verify hashing password would be equal to the hashed value

Parameters:

• password (bytes) – Password to verify

• hashed (string) – Hashed password. Used to extract hashing parameters

Returns:

boolean whether hashing password with the same parameters would match hashed value