Ë
|
ñúh" ã ó d dl mZ d dlZd dlmZmZ ddlmZmZm Z m
|
Z
|
ddl m Z ddl mZmZmZ ddlmZ e« Zej( Zej, Zej0 Zej4 Zej8 Z d d Z G d
|
d « Z y) é )Ú annotationsN)ÚClassVarÚLiteralé )Ú
|
ParametersÚ _check_typesÚextract_parametersÚ validate_params_for_platform)ÚInvalidHashError)ÚTypeÚ hash_secretÚ verify_secret)Úget_default_parametersc óH t | t « r| S | j |« S )zM
|
Ensure *s* is a bytes string. Encode using *encoding* if it isn't.
|
)Ú
|
isinstanceÚbytesÚencode)ÚsÚencodings úJH:\Change_password\venv_build\Lib\site-packages\argon2/_password_hasher.pyÚ _ensure_bytesr s" ô !UÔØØ 88HÓ Ð ó c ón e Zd ZU dZddgZded< ded< eeee e
|
de j f ddZ edd« Zedd « Zedd
|
« Zedd « Zedd « Zedd « Zedd« ZddddZe j0 e j2 e j dZded< d dZd dZ y) ÚPasswordHashera¯
|
High level class to hash passwords with sensible defaults.
|
|
Uses Argon2\ **id** by default and uses a random salt_ for hashing. But it
|
can verify any type of Argon2 as long as the hash is correctly encoded.
|
|
The reason for this being a class is both for convenience to carry
|
parameters and to verify the parameters only *once*. Any unnecessary
|
slowdown when hashing is a tangible advantage for a brute-force attacker.
|
|
Args:
|
time_cost:
|
Defines the amount of computation realized and therefore the
|
execution time, given in number of iterations.
|
|
memory_cost: Defines the memory usage, given in kibibytes_.
|
|
parallelism:
|
Defines the number of parallel threads (*changes* the resulting
|
hash value).
|
|
hash_len: Length of the hash in bytes.
|
|
salt_len: Length of random salt to be generated for each password.
|
|
encoding:
|
The Argon2 C library expects bytes. So if :meth:`hash` or
|
:meth:`verify` are passed a ``str``, it will be encoded using this
|
encoding.
|
|
type:
|
Argon2 type to use. Only change for interoperability with legacy
|
systems.
|
|
.. versionadded:: 16.0.0
|
.. versionchanged:: 18.2.0
|
Switch from Argon2i to Argon2id based on the recommendation by the
|
current RFC draft. See also :doc:`parameters`.
|
.. versionchanged:: 18.2.0
|
Changed default *memory_cost* to 100 MiB and default *parallelism* to 8.
|
.. versionchanged:: 18.2.0 ``verify`` now will determine the type of hash.
|
.. versionchanged:: 18.3.0 The Argon2 type is configurable now.
|
.. versionadded:: 21.2.0 :meth:`from_parameters`
|
.. versionchanged:: 21.2.0
|
Changed defaults to :data:`argon2.profiles.RFC_9106_LOW_MEMORY`.
|
|
.. _salt: https://en.wikipedia.org/wiki/Salt_(cryptography)
|
.. _kibibytes: https://en.wikipedia.org/wiki/Binary_prefix#kibi
|
Ú _parametersr r Ústrzutf-8c
|
óì t |t f|t f|t f|t f|t f|t f|t f¬« }|r t |« t |d|||||¬« } t | « | | _ || _ y )N)Ú time_costÚ memory_costÚ parallelismÚhash_lenÚsalt_lenr Útypeé )r# Úversionr" r! r r r ) r Úintr r Ú TypeErrorr r
|
r r )
|
Úselfr r r r! r" r r# ÚeÚparamss
|
r Ú__init__zPasswordHasher.__init__^ s ô Ø ¤#Ð&Ø$¤cÐ*Ø$¤cÐ*Ø ¤_Ø ¤_Ø ¤_Ø ô
|
ñ ÜA,Ð äØØØ Ø Ø Ø#Ø#ô
|
ô % VÔ,ð "ÔØ r c ó | |j |j |j |j |j |j
|
¬« S )z¼
|
Construct a `PasswordHasher` from *params*.
|
|
Returns:
|
A `PasswordHasher` instance with the parameters from *params*.
|
|
.. versionadded:: 21.2.0
|
©r r r r! r" r# r- )Úclsr* s r Úfrom_parametersz PasswordHasher.from_parameters sA ñ Ø ×&Ñ&Ø ×*Ñ*Ø ×*Ñ*Ø__Ø__Øô
|
ð
|
r c ó. | j j S ©N)r r ©r( s r r zPasswordHasher.time_cost s à× Ñ ×)Ñ)Ð)r c ó. | j j S r1 )r r r2 s r r zPasswordHasher.memory_cost ó à× Ñ ×+Ñ+Ð+r c ó. | j j S r1 )r r r2 s r r zPasswordHasher.parallelism r4 r c ó. | j j S r1 )r r! r2 s r r! zPasswordHasher.hash_len¤ ó à× Ñ ×(Ñ(Ð(r c ó. | j j S r1 )r r" r2 s r r" zPasswordHasher.salt_len¨ r7 r c ó. | j j S r1 )r r# r2 s r r# zPasswordHasher.type¬ s à× Ñ ×$Ñ$Ð$r N)Úsaltc ó t t || j « |xs t j | j
|
« | j | j | j | j | j ¬« j d« S )a
|
Hash *password* and return an encoded hash.
|
|
Args:
|
password: Password to hash.
|
|
salt:
|
If None, a random salt is securely created.
|
|
.. danger::
|
|
You should **not** pass a salt unless you really know what
|
you are doing.
|
|
Raises:
|
argon2.exceptions.HashingError: If hashing fails.
|
|
Returns:
|
Hashed *password*.
|
|
.. versionadded:: 23.1.0 *salt* parameter
|
)Úsecretr: r r r r! r# Úascii) r r r ÚosÚurandomr" r r r r! r# Údecode)r( Úpasswordr: s r ÚhashzPasswordHasher.hash° sf ô. Ü ¨4¯=©=Ó9ØÒ2 D§M¡MÓ2ØnnØ ×(Ñ(Ø ×(Ñ(Ø]]Øô
|
÷ &/ð r )s $argon2i$s $argon2d$s $argon2idzClassVar[dict[bytes, Type]]Ú_header_to_typec óª t |d« } | j |dd }t |t || j
|
« |« S # t $ r t dw xY w)ak
|
Verify that *password* matches *hash*.
|
|
.. warning::
|
|
It is assumed that the caller is in full control of the hash. No
|
other parsing than the determination of the hash type is done by
|
*argon2-cffi*.
|
|
Args:
|
hash: An encoded hash as returned from :meth:`PasswordHasher.hash`.
|
|
password: The password to verify.
|
|
Raises:
|
argon2.exceptions.VerifyMismatchError:
|
If verification fails because *hash* is not valid for
|
*password*.
|
|
argon2.exceptions.VerificationError:
|
If verification fails for other reasons.
|
|
argon2.exceptions.InvalidHashError:
|
If *hash* is so clearly invalid, that it couldn't be passed to
|
Argon2.
|
|
Returns:
|
``True`` on success, otherwise an exception is raised.
|
|
.. versionchanged:: 16.1.0
|
Raise :exc:`~argon2.exceptions.VerifyMismatchError` on mismatches
|
instead of its more generic superclass.
|
.. versionadded:: 18.2.0 Hash type agility.
|
r= Né )r rC Ú LookupErrorr r r )r( rB rA Ú hash_types r ÚverifyzPasswordHasher.verify× sf ôJ T 7Ó+ð -Ø ×,Ñ,¨T°"°1¨XÑ6Iô Ø - ¨$¯-©-Ó8¸)ó
|
ð
|
øô ò -Ü"¨Ð ,ð -ús A ÁAc ót t |t « r|j d« }| j t |« k7 S )a
|
Check whether *hash* was created using the instance's parameters.
|
|
Whenever your Argon2 parameters -- or *argon2-cffi*'s defaults! --
|
change, you should rehash your passwords at the next opportunity. The
|
common approach is to do that whenever a user logs in, since that
|
should be the only time when you have access to the cleartext
|
password.
|
|
Therefore it's best practice to check -- and if necessary rehash --
|
passwords after each successful authentication.
|
|
Args:
|
hash: An encoded Argon2 password hash.
|
|
Returns:
|
Whether *hash* was created using the instance's parameters.
|
|
.. versionadded:: 18.2.0
|
.. versionchanged:: 24.1.0 Accepts bytes for *hash*.
|
r= )r r r@ r r )r( rB s r Úcheck_needs_rehashz!PasswordHasher.check_needs_rehash s3 ô, dEÔ "Ø;;wÓ'Dà× Ñ Ô#5°dÓ#;Ñ;Ð;r )r r& r r& r r& r! r& r" r& r r r# r )r* r Úreturnr )rK r& )rK r )rA ú str | bytesr: z bytes | NonerK r )rB rL rA rL rK z Literal[True])rB rL rK Úbool) Ú__name__Ú
|
__module__Ú __qualname__Ú__doc__Ú __slots__Ú__annotations__ÚDEFAULT_TIME_COSTÚDEFAULT_MEMORY_COSTÚDEFAULT_PARALLELISMÚDEFAULT_HASH_LENGTHÚDEFAULT_RANDOM_SALT_LENGTHr ÚIDr+ Ú classmethodr/ Úpropertyr r r r! r" r# rB ÚIÚDrC rH rJ © r r r r & sf
ñ0ðd
|
Ð+IàÓØMð +Ø.Ø.Ø+Ø2Ø ØWWð$!àð$!ð ð$!ð ð $!ð
|
ð $!ð ð $!ð ð$!ð ó$!ðL ò
|
ó ð
|
ð& ò*ó ð*ð ò,ó ð,ð ò,ó ð,ð ò)ó ð)ð ò)ó ð)ð ò%ó ð%ð CGõ ðD ffØffØggñ4OÐ0ó ð -
|
Ø ð-
|
Ø+6ð-
|
à ó-
|
ô^<r r )r z bytes | strr r rK r ) Ú
|
__future__r r> Útypingr r Ú_utilsr r r r
|
Ú
|
exceptionsr Ú low_levelr r r Úprofilesr Údefault_paramsr" rX r! rW r rT r rU r rV r r r^ r r ú<module>rf s ðõ #ã ç $÷ó õ )ß 7Ñ 7Ý ,ñ (Ó)à +× 4Ñ 4Ð Ø$×-Ñ-Ð Ø"×,Ñ,Ð Ø$×0Ñ0Ð Ø$×0Ñ0Ð ó ÷y<ò y<r
|
