[PYTHON-CRYPTO] Advice on deriving a symmetric key from a password in Python

[Magnus Therning]

I hope I'm not entirely out of line posting this question to this
mailing list :-)

I am looking for a good way to convert a password entered by a user into
a key usable for a symmetric encryption algorithm. First I was thinking
of just hashing the password but that puts limitations on the length of
the keys that I can use for encryption later on. My next thought was to
use some sort of chained hashing, e.g.:

  h = SHA.new(pwd)
  symmetric_key = ''
  while len(symmentric_key) < desired_len:
  	symmetric_key = symmetric_key + h.digest()[:10]
	h.update(h.digest()[10:])
  return symmetric_key[:desired_len]

However, I'm not sure that's a good thing to do, from a cryptographical
point of view.

My "Secure Programming Cookbook for C and C++" suggests using PKCS5
(PBKDF2) but Google didn't turn up any Python implentation of it :(

The password won't be stored anywhere, it will only be used for
encrypting text, which will be stored. (So, if I'm thinking correctly I
don't really need to use a salt when constructing the symmetric key. Am
I right?)

Any suggestion/pointers?

/M

-- 
Magnus Therning                    (OpenPGP: 0xAB4DFBA4)
magnus at therning.org
http://magnus.therning.org/

Software is not manufactured, it is something you write and publish.
Keep Europe free from software patents, we do not want censorship
by patent law on written works.

Found in comp.lang.scheme:
> What's so great about the lambda calculus?           
In a profession plagued by, "when all you have is a hammer, everything
looks like a nail," we get really excited when someone is able to come
along and prove that everything really *is* a nail if lambda is the
hammer.
     -- brlewis at my-deja.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
URL: <http://mail.python.org/pipermail/python-crypto/attachments/20050506/b7eb0d4e/attachment.pgp>