Another security question
frank at chagford.com
Fri Dec 23 08:52:41 EST 2016
"Chris Angelico" wrote in message
news:CAPTjJmpPPGM+_ut_AMTNb7vgo0vRgPtu6iAgYjqWVpXG5ypd_A at mail.gmail.com...
> On Fri, Dec 23, 2016 at 9:19 PM, Frank Millman <frank at chagford.com> wrote:
> > 3. Generate the password from the string supplied by the user as
> > follows -
> > from hashlib import blake2b
> > password = blake2b('my_password'.encode('utf-8'), salt=salt).digest()
> > The hashlib docs have the following warning -
> > "Salted hashing (or just hashing) with BLAKE2 or any other
> > general-purpose
> > cryptographic hash function, such as SHA-256, is not suitable for
> > hashing
> > passwords. See BLAKE2 FAQ for more information."
> > I propose to ignore this warning. I feel that, for my purposes, the
> > above
> > procedure is adequate.
> > Does all this sound reasonable?
> Check out some prior art. When I build a web app using Flask, I
> generally use Werkzeug's password management features:
> As well as doing everything I said above about salting and hashing and
> having signatures, it pushes the responsibility onto someone else. You
> just give it a password and get back an ASCII string that you stash in
> the database. If there's a security flaw, Werkzeug can push a new
> version that fixes it - it's not your problem.
> At very least, be aware of what these kinds of libraries are doing.
> I'm not saying you should blindly trust them or automatically reach
> for a dependency, but they're worth looking at.
All excellent advice - thanks very much.
It seems that Werkzeug (which looks great, by the way) uses something called
The new kid on the block seems to be Argon2. A python implementation called
argon2_cffi has been released by Hynek Schlawack, who has written this
This is his preamble - "if you’re hashing your passwords with
bcrypt/scrypt/PBKDF2 today, there’s nothing to worry about in the immediate
future. This article is for you if you’re choosing a password hash today and
want a future-proof solution."
I eventually got argon2_cffi installed, and it works very nicely, so I will
run with that for now.
More information about the Python-list