New in version 1.6.
This hash is not very secure, and should not be used for any purposes besides manipulating existing MSSQL 2005 password hashes.
This class implements the hash algorithm used by Microsoft SQL Server 2005 to store it’s user account passwords, replacing the slightly less secure mssql2000 variant. This class can be used directly as follows:
>>> from passlib.hash import mssql2005 as m25 >>> # encrypt password >>> h = m25.encrypt("password") >>> h '0x01006ACDF9FF5D2E211B392EEF1175EFFE13B3A368CE2F94038B' >>> # verify password >>> m25.verify("password", h) True >>> m25.verify("letmein", h) False
This class implements the password hash used by MS-SQL 2005, and follows the Password Hash Interface.
It supports a fixed-length salt.
MSSQL 2005 hashes are usually presented as a series of 52 upper-case hexidecimal characters, prefixed by 0x. An example MSSQL 2005 hash (of "password"):
This encodes 26 bytes of raw data, consisting of:
The digest is generated by encoding the unicode password using UTF-16-LE, and calculating SHA1(encoded_secret + salt).
This format and algorithm is identical to mssql2000, except that this hash omits the 2nd case-insensitive digest used by MSSQL 2000.
MSSQL 2005 hashes do not actually have a native textual format, as they are stored as raw bytes in an SQL table. However, when external programs deal with them, MSSQL generally encodes raw bytes as upper-case hexidecimal, prefixed with 0x. This is the representation Passlib uses.
This algorithm is reasonably weak, and shouldn’t be used for any purpose besides manipulating existing MSSQL 2005 hashes. This mainly due to it’s simplicity, and years of research on high-speed SHA1 implementations, which makes efficient brute force attacks feasible.
|||Overview hash algorithms used by MSSQL - https://blogs.msdn.com/b/lcris/archive/2007/04/30/sql-server-2005-about-login-password-hashes.aspx?Redirected=true.|
|||Description of MSSQL 2000/2005 algorithm - http://www.theregister.co.uk/2002/07/08/cracking_ms_sql_server_passwords/.|