The Passlib documentation has moved to https://passlib.readthedocs.io

Passlib 1.5

1.5.3 (2011-10-08)

Bugfix release – fixes BCrypt padding/verification issue (issue 25)

This release fixes a single issue with Passlib’s BCrypt support: Many BCrypt hashes generated by Passlib (<= 1.5.2) will not successfully verify under some of the other BCrypt implementations, such as OpenBSD’s /etc/master.passwd.

In detail:

BCrypt hashes contain 4 “padding” bits in the encoded salt, and Passlib (<= 1.5.2) generated salts in a manner which frequently set some of the padding bits to 1. While Passlib ignores these bits, many BCrypt implementations perform password verification in a way which rejects all passwords if any of the padding bits are set. Thus Passlib’s BCrypt salt generation needed to be fixed to ensure compatibility, and a route provided to correct existing hashes already out in the wild issue 25.

Changes in this release:

  • BCrypt hashes generated by Passlib now have all padding bits cleared.
  • Passlib will continue to accept BCrypt hashes that have padding bits set, but when it encounters them, it will issue a UserWarning recommending that the hash should be fixed (see below).
  • Applications which use CryptContext.verify_and_update() will have any such hashes automatically re-encoded the next time the user logs in.

To fix existing hashes:

If you have BCrypt hashes which might have their padding bits set, you can import passlib.hash.bcrypt, and call clean_hash = bcrypt.normhash(hash). This function will clear the padding bits of any BCrypt hashes, and should leave all other strings alone.

1.5.2 (2011-09-19)

Minor bugfix release – mainly Django-related fixes

Hashes

  • bugfix: django_des_crypt now accepts all hash64 characters in its salts; previously it accepted only lower-case hexadecimal characters (issue 22).
  • Additional unittests added for all standard Django hashes.
  • django_des_crypt now rejects hashes where salt and checksum containing mismatched salt characters.

CryptContext

1.5.1 (2011-08-17)

Minor bugfix release – now compatible with Google App Engine.

  • bugfix: make passlib.hash.__loader__ attribute writable - needed by Google App Engine (GAE) issue 19.
  • bugfix: provide fallback for loading passlib/default.cfg if pkg_resources is not present, such as for GAE issue 19.
  • bugfix: fixed error thrown by CryptContext.verify when issuing min_verify_time warning issue 17.
  • removed min_verify_time setting from custom_app_context, min_verify_time is too host & load dependant to be hardcoded issue 17.
  • under GAE, disable all unittests which require writing to filesystem.
  • more unittest coverage for passlib.apps and passlib.hosts.
  • improved version datestamps in build script.

1.5.0 (2011-07-11)

“20% more unicode than the leading breakfast cereal”

The main new feature in this release is that Passlib now supports Python 3 (via the 2to3 tool). Everything has been recoded to have better separation between unicode and bytes, and to use unicode internally where possible. When run under Python 2, Passlib 1.5 attempts to provide the same behavior as Passlib 1.4; but when run under Python 3, most functions will return unicode instead of ascii bytes.

Besides this major change, there have been some other additions:

Hashes

  • added support for Cryptacular’s PBKDF2 format.
  • added support for the FSHP family of hashes.
  • added support for using BCryptor as BCrypt backend.
  • added support for all of Django’s hash formats.

CryptContext

  • interpolation deprecation:

    CryptPolicy.from_path() and CryptPolicy.from_string() now use SafeConfigParser instead of ConfigParser. This may cause some existing config files containing unescaped % to result in errors; Passlib 1.5 will demote these to warnings, but any extant config files should be updated, as the errors will be fatal in Passlib 1.6.

  • added encoding keyword to CryptPolicy‘s .from_path(), .from_string(), and .to_string() methods.

  • both classes in passlib.apache now support specifying an encoding for the username/realm.

Documentation

  • Password Hash API expanded to include explicit unicode vs bytes policy.
  • Added quickstart guide to documentation.
  • Various minor improvements.

Internal Changes

  • Added more handler utility functions to reduce code duplication.
  • Expanded kdf helpers in passlib.utils.pbkdf2.
  • Removed deprecated parts of passlib.utils.handlers.
  • Various minor changes to passlib.utils.handlers.HasManyBackends; main change is that multi-backend handlers now raise MissingBackendError if no backends are available.
  • Builtin tests now use unittest2 if available.
  • Setup script no longer requires distribute or setuptools.
  • added (undocumented, experimental) Django app for overriding Django’s default hash format, see docs/lib/passlib.ext.django.rst for more.