Add documentation
This commit is contained in:
Hynek Schlawack
parent
bda2af1720
commit
6b5cfc29bd
1
.gitignore
vendored
1
.gitignore
vendored
@ -11,3 +11,4 @@ __pycache__
|
||||
*.dylib
|
||||
*.so
|
||||
.hypothesis
|
||||
_build
|
||||
|
||||
13
AUTHORS.rst
13
AUTHORS.rst
@ -1,7 +1,7 @@
|
||||
Credits
|
||||
=======
|
||||
Credits & License
|
||||
=================
|
||||
|
||||
``argon2_cffi`` is written and maintained by Hynek Schlawack.
|
||||
``argon2_cffi`` is maintained by Hynek Schlawack and released under the `MIT license <https://github.com/hynek/argon2_cffi/blob/master/LICENSE>`_.
|
||||
|
||||
The development is kindly supported by `Variomedia AG <https://www.variomedia.de/>`_.
|
||||
|
||||
@ -16,14 +16,15 @@ Argon2
|
||||
|
||||
The original Argon2 repo can be found at https://github.com/P-H-C/phc-winner-argon2/.
|
||||
|
||||
Except for the components listed below, the Argon2 code in this repository is copyright (c) 2015 Daniel Dinu, Dmitry Khovratovich (main authors), Jean-Philippe Aumasson and Samuel Neves, and under CC0 license.
|
||||
Except for the components listed below, the Argon2 code in this repository is copyright (c) 2015 Daniel Dinu, Dmitry Khovratovich (main authors), Jean-Philippe Aumasson and Samuel Neves, and under CC0_ license.
|
||||
|
||||
The string encoding routines in src/encoding.c are copyright (c) 2015 Thomas Pornin, and under CC0 license.
|
||||
The string encoding routines in src/encoding.c are copyright (c) 2015 Thomas Pornin, and under CC0_ license.
|
||||
|
||||
The BLAKE2 code in src/blake2/ is copyright (c) Samuel Neves, 2013-2015, and under CC0 license.
|
||||
The `BLAKE2 <https://blake2.net>_` code in ``src/blake2/`` is copyright (c) Samuel Neves, 2013-2015, and under CC0_ license.
|
||||
|
||||
The authors of Argon2 also were very helpful to get the library to compile on ancient versions of Visual Studio for ancient versions of Python.
|
||||
|
||||
.. _CC0: https://creativecommons.org/publicdomain/zero/1.0/
|
||||
|
||||
msinttypes
|
||||
^^^^^^^^^^
|
||||
|
||||
@ -11,6 +11,8 @@ Here are a few guidelines to get you started:
|
||||
If you lack some Python version, you can can always limit the environments like ``tox -e py27,py35`` (in that case you may want to look into pyenv_ that makes it very easy to install many different Python versions in parallel).
|
||||
- Make sure your changes pass our CI.
|
||||
You won't get any feedback until it's green unless you ask for it.
|
||||
- If you address review feedback, make sure to bump the pull request.
|
||||
Maintainers don’t receive notifications if you push new commits.
|
||||
- If your change is noteworthy, add an entry to the changelog_.
|
||||
Use present tense, semantic newlines, and add link to your pull request.
|
||||
- No contribution is too small; please submit as many fixes for typos and grammar bloopers as you can!
|
||||
@ -19,8 +21,6 @@ Here are a few guidelines to get you started:
|
||||
This is a hard rule; patches with missing tests or documentation won’t be merged.
|
||||
- Write `good test docstrings`_.
|
||||
- Obey `PEP 8`_ and `PEP 257`_.
|
||||
- If you address review feedback, make sure to bump the pull request.
|
||||
Maintainers don’t receive notifications if you push new commits.
|
||||
|
||||
Please note that this project is released with a Contributor `Code of Conduct`_.
|
||||
By participating in this project you agree to abide by its terms.
|
||||
|
||||
@ -3,3 +3,5 @@ exclude src/argon2/_ffi.py .gitmodules extras/libargon2/.git appveyor.yml
|
||||
graft tests
|
||||
recursive-exclude tests *.pyc
|
||||
graft extras
|
||||
graft docs
|
||||
prune docs/_build
|
||||
|
||||
94
README.rst
94
README.rst
@ -2,6 +2,10 @@
|
||||
CFFI-based Argon2 Bindings for Python
|
||||
=====================================
|
||||
|
||||
.. image:: https://readthedocs.org/projects/argon2-cffi/badge/?version=latest
|
||||
:target: http://argon2-cffi.readthedocs.org/en/latest/?badge=latest
|
||||
:alt: Documentation Status
|
||||
|
||||
.. image:: https://travis-ci.org/hynek/argon2_cffi.svg?branch=master
|
||||
:target: https://travis-ci.org/hynek/argon2_cffi
|
||||
|
||||
@ -14,11 +18,9 @@ CFFI-based Argon2 Bindings for Python
|
||||
.. image:: https://www.irccloud.com/invite-svg?channel=%23cryptography-dev&hostname=irc.freenode.net&port=6697&ssl=1
|
||||
:target: https://www.irccloud.com/invite?channel=%23cryptography-dev&hostname=irc.freenode.net&port=6697&ssl=1
|
||||
|
||||
.. begin
|
||||
.. teaser-begin
|
||||
|
||||
|
||||
`Argon2 <https://github.com/p-h-c/phc-winner-argon2>`_ won the `Password Hashing Competition <https://password-hashing.net/>`_ in 2015.
|
||||
``argon2_cffi`` is the simplest way to use it in Python and PyPy:
|
||||
`Argon2 <https://github.com/p-h-c/phc-winner-argon2>`_ won the `Password Hashing Competition <https://password-hashing.net/>`_ and ``argon2_cffi`` is the simplest way to use it in Python and PyPy:
|
||||
|
||||
.. code-block:: pycon
|
||||
|
||||
@ -37,86 +39,10 @@ You can omit the ``salt`` argument for a secure random salt of length ``argon2.D
|
||||
|
||||
.. code-block:: pycon
|
||||
|
||||
>>> argon2.DEFAULT_RANDOM_SALT_LENGTH
|
||||
16
|
||||
>>> argon2.hash_password(b"secret") # doctest: +SKIP
|
||||
b'$argon2i$m=512,t=2,p=2$c29tZXNhbHQ$2IdoNVglVTxb9w4YVJqW8w'
|
||||
|
||||
|
||||
Installation
|
||||
============
|
||||
|
||||
A working C compiler is required because the official Argon2 C implementation is shipped along with the Python CFFI bindings.
|
||||
Otherwise a plain ``pip install argon2_cffi`` should just work.
|
||||
Binary `wheels <http://pythonwheels.com>`_ are offered for OS X and Windows.
|
||||
|
||||
|
||||
Hands-on
|
||||
========
|
||||
|
||||
``argon2_cffi`` comes with hopefully reasonable defaults for Argon2 parameters that result in a verification time of between 0.5ms and 1ms on reasonably recent hardware.
|
||||
But of course, you can set them yourself if you wish:
|
||||
|
||||
.. code-block:: pycon
|
||||
|
||||
>>> argon2.hash_password(
|
||||
... b"secret", b"somesalt",
|
||||
... time_cost=1, # number of iterations
|
||||
... memory_cost=8, # used memory in KiB
|
||||
... parallelism=1, # number of threads used; changes hash!
|
||||
... hash_len=64, # length of resulting raw hash
|
||||
... type=argon2.Type.D, # choose Argon2i or Argon2d
|
||||
... )
|
||||
b'$argon2d$m=8,t=1,p=1$c29tZXNhbHQ$H0oN1/L3H8t8hcg47pAyJZ8toBh2UbgcMt0zRFrqt4mEJCeKSEWGxt+KpZrMwxvr7M5qktNcc/bk/hvbinueJA'
|
||||
|
||||
The raw hash can also be computed.
|
||||
The function takes the same parameters as ``hash_password()``:
|
||||
|
||||
.. code-block:: pycon
|
||||
|
||||
>>> argon2.hash_password_raw(b"secret", b"somesalt")
|
||||
b'\xd8\x87h5X%U<[\xf7\x0e\x18T\x9a\x96\xf3'
|
||||
|
||||
|
||||
Choosing Parameters
|
||||
-------------------
|
||||
|
||||
Finding the right parameters for a password hashing algorithm is a daunting task.
|
||||
The authors of Argon2 specified a method in their `paper <https://github.com/P-H-C/phc-winner-argon2/blob/master/argon2-specs.pdf>`_ but it should be noted that they also mention that no value for ``time_cost`` or ``memory_cost`` is actually insecure (cf. section 6.4).
|
||||
|
||||
|
||||
#. Choose whether you want Argon2i or Argon2d (``type``).
|
||||
If you don't know what that means, choose Argon2i (``Type.I``).
|
||||
#. Figure out how many threads can be used on each call to Argon2 (``parallelism``).
|
||||
They recommend twice as many as the number of cores dedicated to hashing passwords.
|
||||
#. Figure out how much memory each call can afford (``memory_cost``).
|
||||
#. Choose a salt length.
|
||||
16 Bytes are fine.
|
||||
#. Choose a hash length (``hash_len``).
|
||||
16 Bytes are fine.
|
||||
#. Figure out how long each call can take.
|
||||
One `recommendation <https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2015/march/enough-with-the-salts-updates-on-secure-password-schemes/>`_ for concurent user logins is to keep it under 0.5ms.
|
||||
#. Measure the time for hashing using your chosen parameters.
|
||||
Find a ``time_cost`` that is within your accounted time.
|
||||
If ``time_cost=1`` takes too long, lower ``memory_cost``.
|
||||
|
||||
|
||||
CLI
|
||||
^^^
|
||||
|
||||
To aid you with finding the parameters, ``argon2_cffi`` offers a CLI interface that can be accessed using ``python -m argon2``.
|
||||
It will benchmark Argon2’s *password verification* in the current environment.
|
||||
You can use command line arguments to set hashing parameters:
|
||||
|
||||
.. code-block:: text
|
||||
|
||||
$ python -m argon2 -t 1 -m 512 -p 2
|
||||
Running Argon2i 100 times with:
|
||||
hash_len: 16
|
||||
memory_cost: 512
|
||||
parallelism: 2
|
||||
time_cost: 1
|
||||
|
||||
Measuring...
|
||||
|
||||
0.418ms per password verification
|
||||
|
||||
This should make it much easier to determine the right parameters for your use case and your environment.
|
||||
``argon2_cffi``\ ’s documentation lives at `Read the Docs <https://argon2-cffi.readthedocs.org/>`_, the code on `GitHub <https://github.com/hynek/argon2_cffi>`_.
|
||||
It’s rigorously tested on Python 2.6, 2.7, 3.3+, and PyPy.
|
||||
|
||||
177
docs/Makefile
Normal file
177
docs/Makefile
Normal file
@ -0,0 +1,177 @@
|
||||
# Makefile for Sphinx documentation
|
||||
#
|
||||
|
||||
# You can set these variables from the command line.
|
||||
SPHINXOPTS =
|
||||
SPHINXBUILD = sphinx-build
|
||||
PAPER =
|
||||
BUILDDIR = _build
|
||||
|
||||
# User-friendly check for sphinx-build
|
||||
ifeq ($(shell which $(SPHINXBUILD) >/dev/null 2>&1; echo $$?), 1)
|
||||
$(error The '$(SPHINXBUILD)' command was not found. Make sure you have Sphinx installed, then set the SPHINXBUILD environment variable to point to the full path of the '$(SPHINXBUILD)' executable. Alternatively you can add the directory with the executable to your PATH. If you don't have Sphinx installed, grab it from http://sphinx-doc.org/)
|
||||
endif
|
||||
|
||||
# Internal variables.
|
||||
PAPEROPT_a4 = -D latex_paper_size=a4
|
||||
PAPEROPT_letter = -D latex_paper_size=letter
|
||||
ALLSPHINXOPTS = -d $(BUILDDIR)/doctrees $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) .
|
||||
# the i18n builder cannot share the environment and doctrees with the others
|
||||
I18NSPHINXOPTS = $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) .
|
||||
|
||||
.PHONY: help clean html dirhtml singlehtml pickle json htmlhelp qthelp devhelp epub latex latexpdf text man changes linkcheck doctest gettext
|
||||
|
||||
help:
|
||||
@echo "Please use \`make <target>' where <target> is one of"
|
||||
@echo " html to make standalone HTML files"
|
||||
@echo " dirhtml to make HTML files named index.html in directories"
|
||||
@echo " singlehtml to make a single large HTML file"
|
||||
@echo " pickle to make pickle files"
|
||||
@echo " json to make JSON files"
|
||||
@echo " htmlhelp to make HTML files and a HTML help project"
|
||||
@echo " qthelp to make HTML files and a qthelp project"
|
||||
@echo " devhelp to make HTML files and a Devhelp project"
|
||||
@echo " epub to make an epub"
|
||||
@echo " latex to make LaTeX files, you can set PAPER=a4 or PAPER=letter"
|
||||
@echo " latexpdf to make LaTeX files and run them through pdflatex"
|
||||
@echo " latexpdfja to make LaTeX files and run them through platex/dvipdfmx"
|
||||
@echo " text to make text files"
|
||||
@echo " man to make manual pages"
|
||||
@echo " texinfo to make Texinfo files"
|
||||
@echo " info to make Texinfo files and run them through makeinfo"
|
||||
@echo " gettext to make PO message catalogs"
|
||||
@echo " changes to make an overview of all changed/added/deprecated items"
|
||||
@echo " xml to make Docutils-native XML files"
|
||||
@echo " pseudoxml to make pseudoxml-XML files for display purposes"
|
||||
@echo " linkcheck to check all external links for integrity"
|
||||
@echo " doctest to run all doctests embedded in the documentation (if enabled)"
|
||||
|
||||
clean:
|
||||
rm -rf $(BUILDDIR)/*
|
||||
|
||||
html:
|
||||
$(SPHINXBUILD) -b html $(ALLSPHINXOPTS) $(BUILDDIR)/html
|
||||
@echo
|
||||
@echo "Build finished. The HTML pages are in $(BUILDDIR)/html."
|
||||
|
||||
dirhtml:
|
||||
$(SPHINXBUILD) -b dirhtml $(ALLSPHINXOPTS) $(BUILDDIR)/dirhtml
|
||||
@echo
|
||||
@echo "Build finished. The HTML pages are in $(BUILDDIR)/dirhtml."
|
||||
|
||||
singlehtml:
|
||||
$(SPHINXBUILD) -b singlehtml $(ALLSPHINXOPTS) $(BUILDDIR)/singlehtml
|
||||
@echo
|
||||
@echo "Build finished. The HTML page is in $(BUILDDIR)/singlehtml."
|
||||
|
||||
pickle:
|
||||
$(SPHINXBUILD) -b pickle $(ALLSPHINXOPTS) $(BUILDDIR)/pickle
|
||||
@echo
|
||||
@echo "Build finished; now you can process the pickle files."
|
||||
|
||||
json:
|
||||
$(SPHINXBUILD) -b json $(ALLSPHINXOPTS) $(BUILDDIR)/json
|
||||
@echo
|
||||
@echo "Build finished; now you can process the JSON files."
|
||||
|
||||
htmlhelp:
|
||||
$(SPHINXBUILD) -b htmlhelp $(ALLSPHINXOPTS) $(BUILDDIR)/htmlhelp
|
||||
@echo
|
||||
@echo "Build finished; now you can run HTML Help Workshop with the" \
|
||||
".hhp project file in $(BUILDDIR)/htmlhelp."
|
||||
|
||||
qthelp:
|
||||
$(SPHINXBUILD) -b qthelp $(ALLSPHINXOPTS) $(BUILDDIR)/qthelp
|
||||
@echo
|
||||
@echo "Build finished; now you can run "qcollectiongenerator" with the" \
|
||||
".qhcp project file in $(BUILDDIR)/qthelp, like this:"
|
||||
@echo "# qcollectiongenerator $(BUILDDIR)/qthelp/prometheus_async.qhcp"
|
||||
@echo "To view the help file:"
|
||||
@echo "# assistant -collectionFile $(BUILDDIR)/qthelp/prometheus_async.qhc"
|
||||
|
||||
devhelp:
|
||||
$(SPHINXBUILD) -b devhelp $(ALLSPHINXOPTS) $(BUILDDIR)/devhelp
|
||||
@echo
|
||||
@echo "Build finished."
|
||||
@echo "To view the help file:"
|
||||
@echo "# mkdir -p $$HOME/.local/share/devhelp/prometheus_async"
|
||||
@echo "# ln -s $(BUILDDIR)/devhelp $$HOME/.local/share/devhelp/prometheus_async"
|
||||
@echo "# devhelp"
|
||||
|
||||
epub:
|
||||
$(SPHINXBUILD) -b epub $(ALLSPHINXOPTS) $(BUILDDIR)/epub
|
||||
@echo
|
||||
@echo "Build finished. The epub file is in $(BUILDDIR)/epub."
|
||||
|
||||
latex:
|
||||
$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
|
||||
@echo
|
||||
@echo "Build finished; the LaTeX files are in $(BUILDDIR)/latex."
|
||||
@echo "Run \`make' in that directory to run these through (pdf)latex" \
|
||||
"(use \`make latexpdf' here to do that automatically)."
|
||||
|
||||
latexpdf:
|
||||
$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
|
||||
@echo "Running LaTeX files through pdflatex..."
|
||||
$(MAKE) -C $(BUILDDIR)/latex all-pdf
|
||||
@echo "pdflatex finished; the PDF files are in $(BUILDDIR)/latex."
|
||||
|
||||
latexpdfja:
|
||||
$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
|
||||
@echo "Running LaTeX files through platex and dvipdfmx..."
|
||||
$(MAKE) -C $(BUILDDIR)/latex all-pdf-ja
|
||||
@echo "pdflatex finished; the PDF files are in $(BUILDDIR)/latex."
|
||||
|
||||
text:
|
||||
$(SPHINXBUILD) -b text $(ALLSPHINXOPTS) $(BUILDDIR)/text
|
||||
@echo
|
||||
@echo "Build finished. The text files are in $(BUILDDIR)/text."
|
||||
|
||||
man:
|
||||
$(SPHINXBUILD) -b man $(ALLSPHINXOPTS) $(BUILDDIR)/man
|
||||
@echo
|
||||
@echo "Build finished. The manual pages are in $(BUILDDIR)/man."
|
||||
|
||||
texinfo:
|
||||
$(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo
|
||||
@echo
|
||||
@echo "Build finished. The Texinfo files are in $(BUILDDIR)/texinfo."
|
||||
@echo "Run \`make' in that directory to run these through makeinfo" \
|
||||
"(use \`make info' here to do that automatically)."
|
||||
|
||||
info:
|
||||
$(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo
|
||||
@echo "Running Texinfo files through makeinfo..."
|
||||
make -C $(BUILDDIR)/texinfo info
|
||||
@echo "makeinfo finished; the Info files are in $(BUILDDIR)/texinfo."
|
||||
|
||||
gettext:
|
||||
$(SPHINXBUILD) -b gettext $(I18NSPHINXOPTS) $(BUILDDIR)/locale
|
||||
@echo
|
||||
@echo "Build finished. The message catalogs are in $(BUILDDIR)/locale."
|
||||
|
||||
changes:
|
||||
$(SPHINXBUILD) -b changes $(ALLSPHINXOPTS) $(BUILDDIR)/changes
|
||||
@echo
|
||||
@echo "The overview file is in $(BUILDDIR)/changes."
|
||||
|
||||
linkcheck:
|
||||
$(SPHINXBUILD) -b linkcheck $(ALLSPHINXOPTS) $(BUILDDIR)/linkcheck
|
||||
@echo
|
||||
@echo "Link check complete; look for any errors in the above output " \
|
||||
"or in $(BUILDDIR)/linkcheck/output.txt."
|
||||
|
||||
doctest:
|
||||
$(SPHINXBUILD) -b doctest $(ALLSPHINXOPTS) $(BUILDDIR)/doctest
|
||||
@echo "Testing of doctests in the sources finished, look at the " \
|
||||
"results in $(BUILDDIR)/doctest/output.txt."
|
||||
|
||||
xml:
|
||||
$(SPHINXBUILD) -b xml $(ALLSPHINXOPTS) $(BUILDDIR)/xml
|
||||
@echo
|
||||
@echo "Build finished. The XML files are in $(BUILDDIR)/xml."
|
||||
|
||||
pseudoxml:
|
||||
$(SPHINXBUILD) -b pseudoxml $(ALLSPHINXOPTS) $(BUILDDIR)/pseudoxml
|
||||
@echo
|
||||
@echo "Build finished. The pseudo-XML files are in $(BUILDDIR)/pseudoxml."
|
||||
32
docs/api.rst
Normal file
32
docs/api.rst
Normal file
@ -0,0 +1,32 @@
|
||||
API Reference
|
||||
=============
|
||||
|
||||
.. module:: argon2
|
||||
|
||||
``argon2_cffi`` comes with hopefully reasonable defaults for Argon2 parameters that result in a verification time of between 0.5ms and 1ms on recent-ish hardware.
|
||||
But of course, you can set them yourself if you wish:
|
||||
|
||||
|
||||
.. autofunction:: hash_password
|
||||
|
||||
.. code-block:: pycon
|
||||
|
||||
>>> import argon2
|
||||
>>> argon2.hash_password(
|
||||
... b"secret", b"somesalt",
|
||||
... time_cost=1, # number of iterations
|
||||
... memory_cost=8, # used memory in KiB
|
||||
... parallelism=1, # number of threads used; changes hash!
|
||||
... hash_len=64, # length of resulting raw hash
|
||||
... type=argon2.Type.D, # choose Argon2i or Argon2d
|
||||
... )
|
||||
b'$argon2d$m=8,t=1,p=1$c29tZXNhbHQ$H0oN1/L3H8t8hcg47pAyJZ8toBh2UbgcMt0zRFrqt4mEJCeKSEWGxt+KpZrMwxvr7M5qktNcc/bk/hvbinueJA'
|
||||
|
||||
The raw hash can also be computed:
|
||||
|
||||
.. autofunction:: hash_password_raw
|
||||
|
||||
.. code-block:: pycon
|
||||
|
||||
>>> argon2.hash_password_raw(b"secret", b"somesalt")
|
||||
b'\xd8\x87h5X%U<[\xf7\x0e\x18T\x9a\x96\xf3'
|
||||
52
docs/argon2.rst
Normal file
52
docs/argon2.rst
Normal file
@ -0,0 +1,52 @@
|
||||
Argon2
|
||||
======
|
||||
|
||||
.. note::
|
||||
|
||||
**TL;DR**: Use Argon2\ **i** to securely hash your passwords.
|
||||
|
||||
Argon2 is a secure password hashing algorithm.
|
||||
It is designed to have both a configurable runtime as well as memory consumption.
|
||||
|
||||
This means that you can decide how long it takes to hash a password and how much memory is required.
|
||||
|
||||
Argon2 comes in two variants:
|
||||
Argon2\ **d** is faster and uses data-depending memory access, which makes it suitable for cryptocurrencies and applications with no threats from side-channel timing attacks.
|
||||
Argon2\ **i** uses data-independent memory access, which is preferred for password hashing and password-based key derivation. Argon2i is slower as it makes more passes over the memory to protect from tradeoff attacks.
|
||||
|
||||
|
||||
Why “just use bcrypt” Is Not the Answer
|
||||
---------------------------------------
|
||||
|
||||
There's an unfortunate meme to respond to questions of storage of secrets like passwords to “just use bcrypt_”.
|
||||
The problem is, neither bcrypt nor its closest NIST-approved competitor PBKDF2_ are fit for hashing passwords in the days of ASIC_ password breakers.
|
||||
In a nutshell, password crackers are able to create highly parallelized hardware specifically tailored to crack computationally expensive password hashes.
|
||||
|
||||
An effective measure against extreme parallelism proved making computation of password hashes also *memory* hard.
|
||||
The best known implementation of that approach is to date scrypt_.
|
||||
However according to the `Argon2 paper`_, page 2:
|
||||
|
||||
[…] the existence of a trivial time-memory tradeoff allows compact implementations with the same energy cost.
|
||||
|
||||
|
||||
Therefore a new algorithm was needed.
|
||||
|
||||
.. _bcrypt: https://en.wikipedia.org/wiki/Bcrypt
|
||||
.. _PBKDF2: https://en.wikipedia.org/wiki/PBKDF2
|
||||
.. _ASIC: https://en.wikipedia.org/wiki/Application-specific_integrated_circuit
|
||||
.. _scrypt: https://en.wikipedia.org/wiki/Scrypt
|
||||
.. _Argon2 paper: https://password-hashing.net/argon2-specs.pdf
|
||||
|
||||
|
||||
Password Hashing Competition
|
||||
----------------------------
|
||||
|
||||
The `Password Hashing Competition`_ took place between 2012 and 2015 to find a new, secure, and future-proof password hashing algorithm.
|
||||
Previously the NIST was in charge but after certain events and revelations_ their integrity has been put into question by the general public.
|
||||
So a group of independent cryptographers and security researchers came together.
|
||||
|
||||
In the end, Argon2 was announced_ as the winner.
|
||||
|
||||
.. _Password Hashing Competition: https://password-hashing.net/
|
||||
.. _revelations: https://en.wikipedia.org/wiki/Dual_EC_DRBG
|
||||
.. _announced: https://groups.google.com/forum/#!topic/crypto-competitions/3QNdmwBS98o
|
||||
15
docs/backward-compatibility.rst
Normal file
15
docs/backward-compatibility.rst
Normal file
@ -0,0 +1,15 @@
|
||||
Backward Compatibility
|
||||
======================
|
||||
|
||||
``argon2_cffi`` has a very strong backward compatibility policy.
|
||||
Generally speaking, you shouldn't ever be afraid of updating.
|
||||
|
||||
If breaking changes are needed do be done, they are:
|
||||
|
||||
#. …announced in the changelog_.
|
||||
#. …the old behavior raises a :exc:`DeprecationWarning` for a year.
|
||||
#. …are done with another announcement in the changelog_.
|
||||
|
||||
What explicitly *may* change over time are the default hashing parameters.
|
||||
|
||||
.. _changelog: https://argon2-cffi.readthedocs.org/en/stable/changelog.html
|
||||
1
docs/changelog.rst
Normal file
1
docs/changelog.rst
Normal file
@ -0,0 +1 @@
|
||||
.. include:: ../CHANGELOG.rst
|
||||
21
docs/cli.rst
Normal file
21
docs/cli.rst
Normal file
@ -0,0 +1,21 @@
|
||||
CLI
|
||||
===
|
||||
|
||||
To aid you with finding the parameters, ``argon2_cffi`` offers a CLI interface that can be accessed using ``python -m argon2``.
|
||||
It will benchmark Argon2’s password *verification* in the current environment.
|
||||
You can use command line arguments to set hashing parameters:
|
||||
|
||||
.. code-block:: text
|
||||
|
||||
$ python -m argon2 -t 1 -m 512 -p 2
|
||||
Running Argon2i 100 times with:
|
||||
hash_len: 16
|
||||
memory_cost: 512
|
||||
parallelism: 2
|
||||
time_cost: 1
|
||||
|
||||
Measuring...
|
||||
|
||||
0.418ms per password verification
|
||||
|
||||
This should make it much easier to determine the right parameters for your use case and your environment.
|
||||
308
docs/conf.py
Normal file
308
docs/conf.py
Normal file
@ -0,0 +1,308 @@
|
||||
# -*- coding: utf-8 -*-
|
||||
#
|
||||
# argon2_cffi documentation build configuration file, created by
|
||||
# sphinx-quickstart on Sun May 11 16:17:15 2014.
|
||||
#
|
||||
# This file is execfile()d with the current directory set to its
|
||||
# containing dir.
|
||||
#
|
||||
# Note that not all possible configuration values are present in this
|
||||
# autogenerated file.
|
||||
#
|
||||
# All configuration values have a default; values that are commented out
|
||||
# serve to show the default.
|
||||
|
||||
import codecs
|
||||
import datetime
|
||||
import os
|
||||
import re
|
||||
|
||||
try:
|
||||
import sphinx_rtd_theme
|
||||
except ImportError:
|
||||
sphinx_rtd_theme = None
|
||||
|
||||
|
||||
def read(*parts):
|
||||
"""
|
||||
Build an absolute path from *parts* and and return the contents of the
|
||||
resulting file. Assume UTF-8 encoding.
|
||||
"""
|
||||
here = os.path.abspath(os.path.dirname(__file__))
|
||||
with codecs.open(os.path.join(here, *parts), "rb", "utf-8") as f:
|
||||
return f.read()
|
||||
|
||||
|
||||
def find_version(*file_paths):
|
||||
"""
|
||||
Build a path from *file_paths* and search for a ``__version__``
|
||||
string inside.
|
||||
"""
|
||||
version_file = read(*file_paths)
|
||||
version_match = re.search(r"^__version__ = ['\"]([^'\"]*)['\"]",
|
||||
version_file, re.M)
|
||||
if version_match:
|
||||
return version_match.group(1)
|
||||
raise RuntimeError("Unable to find version string.")
|
||||
|
||||
# If extensions (or modules to document with autodoc) are in another directory,
|
||||
# add these directories to sys.path here. If the directory is relative to the
|
||||
# documentation root, use os.path.abspath to make it absolute, like shown here.
|
||||
# sys.path.insert(0, os.path.abspath('.'))
|
||||
|
||||
# -- General configuration ------------------------------------------------
|
||||
|
||||
# If your documentation needs a minimal Sphinx version, state it here.
|
||||
# needs_sphinx = '1.0'
|
||||
|
||||
# Add any Sphinx extension module names here, as strings. They can be
|
||||
# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
|
||||
# ones.
|
||||
extensions = [
|
||||
'sphinx.ext.autodoc',
|
||||
'sphinx.ext.doctest',
|
||||
'sphinx.ext.intersphinx',
|
||||
'sphinx.ext.todo',
|
||||
]
|
||||
|
||||
|
||||
# Add any paths that contain templates here, relative to this directory.
|
||||
templates_path = ['_templates']
|
||||
|
||||
# The suffix of source filenames.
|
||||
source_suffix = '.rst'
|
||||
|
||||
# The encoding of source files.
|
||||
# source_encoding = 'utf-8-sig'
|
||||
|
||||
# The master toctree document.
|
||||
master_doc = 'index'
|
||||
|
||||
# General information about the project.
|
||||
project = u'argon2_cffi'
|
||||
year = datetime.date.today().year
|
||||
copyright = u'2015{0}, Hynek Schlawack'.format(
|
||||
u'-{0}'.format(year) if year != 2015 else u""
|
||||
)
|
||||
|
||||
# The version info for the project you're documenting, acts as replacement for
|
||||
# |version| and |release|, also used in various other places throughout the
|
||||
# built documents.
|
||||
#
|
||||
# The short X.Y version.
|
||||
release = find_version("..", "src", "argon2", "__init__.py")
|
||||
version = release.rsplit(u".", 1)[0]
|
||||
# The full version, including alpha/beta/rc tags.
|
||||
|
||||
# The language for content autogenerated by Sphinx. Refer to documentation
|
||||
# for a list of supported languages.
|
||||
# language = None
|
||||
|
||||
# There are two options for replacing |today|: either, you set today to some
|
||||
# non-false value, then it is used:
|
||||
# today = ''
|
||||
# Else, today_fmt is used as the format for a strftime call.
|
||||
# today_fmt = '%B %d, %Y'
|
||||
|
||||
# List of patterns, relative to source directory, that match files and
|
||||
# directories to ignore when looking for source files.
|
||||
exclude_patterns = ['_build']
|
||||
|
||||
# The reST default role (used for this markup: `text`) to use for all
|
||||
# documents.
|
||||
# default_role = None
|
||||
|
||||
# If true, '()' will be appended to :func: etc. cross-reference text.
|
||||
# add_function_parentheses = True
|
||||
|
||||
# If true, the current module name will be prepended to all description
|
||||
# unit titles (such as .. function::).
|
||||
# add_module_names = True
|
||||
|
||||
# If true, sectionauthor and moduleauthor directives will be shown in the
|
||||
# output. They are ignored by default.
|
||||
# show_authors = False
|
||||
|
||||
# The name of the Pygments (syntax highlighting) style to use.
|
||||
pygments_style = 'sphinx'
|
||||
|
||||
# A list of ignored prefixes for module index sorting.
|
||||
# modindex_common_prefix = []
|
||||
|
||||
# If true, keep warnings as "system message" paragraphs in the built documents.
|
||||
# keep_warnings = False
|
||||
|
||||
|
||||
# -- Options for HTML output ----------------------------------------------
|
||||
|
||||
# The theme to use for HTML and HTML Help pages. See the documentation for
|
||||
# a list of builtin themes.
|
||||
|
||||
if sphinx_rtd_theme:
|
||||
html_theme = "sphinx_rtd_theme"
|
||||
html_theme_path = [sphinx_rtd_theme.get_html_theme_path()]
|
||||
else:
|
||||
html_theme = "default"
|
||||
|
||||
# Theme options are theme-specific and customize the look and feel of a theme
|
||||
# further. For a list of options available for each theme, see the
|
||||
# documentation.
|
||||
# html_theme_options = {}
|
||||
|
||||
# Add any paths that contain custom themes here, relative to this directory.
|
||||
# html_theme_path = []
|
||||
|
||||
# The name for this set of Sphinx documents. If None, it defaults to
|
||||
# "<project> v<release> documentation".
|
||||
# html_title = None
|
||||
|
||||
# A shorter title for the navigation bar. Default is the same as html_title.
|
||||
# html_short_title = None
|
||||
|
||||
# The name of an image file (relative to this directory) to place at the top
|
||||
# of the sidebar.
|
||||
# html_logo = None
|
||||
|
||||
# The name of an image file (within the static path) to use as favicon of the
|
||||
# docs. This file should be a Windows icon file (.ico) being 16x16 or 32x32
|
||||
# pixels large.
|
||||
# html_favicon = None
|
||||
|
||||
# Add any paths that contain custom static files (such as style sheets) here,
|
||||
# relative to this directory. They are copied after the builtin static files,
|
||||
# so a file named "default.css" will overwrite the builtin "default.css".
|
||||
# html_static_path = ['_static']
|
||||
|
||||
# Add any extra paths that contain custom files (such as robots.txt or
|
||||
# .htaccess) here, relative to this directory. These files are copied
|
||||
# directly to the root of the documentation.
|
||||
# html_extra_path = []
|
||||
|
||||
# If not '', a 'Last updated on:' timestamp is inserted at every page bottom,
|
||||
# using the given strftime format.
|
||||
# html_last_updated_fmt = '%b %d, %Y'
|
||||
|
||||
# If true, SmartyPants will be used to convert quotes and dashes to
|
||||
# typographically correct entities.
|
||||
# html_use_smartypants = True
|
||||
|
||||
# Custom sidebar templates, maps document names to template names.
|
||||
# html_sidebars = {}
|
||||
|
||||
# Additional templates that should be rendered to pages, maps page names to
|
||||
# template names.
|
||||
# html_additional_pages = {}
|
||||
|
||||
# If false, no module index is generated.
|
||||
# html_domain_indices = True
|
||||
|
||||
# If false, no index is generated.
|
||||
# html_use_index = True
|
||||
|
||||
# If true, the index is split into individual pages for each letter.
|
||||
# html_split_index = False
|
||||
|
||||
# If true, links to the reST sources are added to the pages.
|
||||
# html_show_sourcelink = True
|
||||
|
||||
# If true, "Created using Sphinx" is shown in the HTML footer. Default is True.
|
||||
# html_show_sphinx = True
|
||||
|
||||
# If true, "(C) Copyright ..." is shown in the HTML footer. Default is True.
|
||||
# html_show_copyright = True
|
||||
|
||||
# If true, an OpenSearch description file will be output, and all pages will
|
||||
# contain a <link> tag referring to it. The value of this option must be the
|
||||
# base URL from which the finished HTML is served.
|
||||
# html_use_opensearch = ''
|
||||
|
||||
# This is the file name suffix for HTML files (e.g. ".xhtml").
|
||||
# html_file_suffix = None
|
||||
|
||||
# Output file base name for HTML help builder.
|
||||
htmlhelp_basename = 'argon2_cffidoc'
|
||||
|
||||
|
||||
# -- Options for LaTeX output ---------------------------------------------
|
||||
|
||||
latex_elements = {
|
||||
# The paper size ('letterpaper' or 'a4paper').
|
||||
# 'papersize': 'letterpaper',
|
||||
|
||||
# The font size ('10pt', '11pt' or '12pt').
|
||||
# 'pointsize': '10pt',
|
||||
|
||||
# Additional stuff for the LaTeX preamble.
|
||||
# 'preamble': '',
|
||||
}
|
||||
|
||||
# Grouping the document tree into LaTeX files. List of tuples
|
||||
# (source start file, target name, title,
|
||||
# author, documentclass [howto, manual, or own class]).
|
||||
latex_documents = [
|
||||
('index', 'argon2_cffi.tex', u'argon2_cffi Documentation',
|
||||
u'Hynek Schlawack', 'manual'),
|
||||
]
|
||||
|
||||
# The name of an image file (relative to this directory) to place at the top of
|
||||
# the title page.
|
||||
# latex_logo = None
|
||||
|
||||
# For "manual" documents, if this is true, then toplevel headings are parts,
|
||||
# not chapters.
|
||||
# latex_use_parts = False
|
||||
|
||||
# If true, show page references after internal links.
|
||||
# latex_show_pagerefs = False
|
||||
|
||||
# If true, show URL addresses after external links.
|
||||
# latex_show_urls = False
|
||||
|
||||
# Documents to append as an appendix to all manuals.
|
||||
# latex_appendices = []
|
||||
|
||||
# If false, no module index is generated.
|
||||
# latex_domain_indices = True
|
||||
|
||||
|
||||
# -- Options for manual page output ---------------------------------------
|
||||
|
||||
# One entry per manual page. List of tuples
|
||||
# (source start file, name, description, authors, manual section).
|
||||
man_pages = [
|
||||
('index', 'argon2_cffi', u'argon2_cffi Documentation',
|
||||
[u'Hynek Schlawack'], 1)
|
||||
]
|
||||
|
||||
# If true, show URL addresses after external links.
|
||||
# man_show_urls = False
|
||||
|
||||
|
||||
# -- Options for Texinfo output -------------------------------------------
|
||||
|
||||
# Grouping the document tree into Texinfo files. List of tuples
|
||||
# (source start file, target name, title, author,
|
||||
# dir menu entry, description, category)
|
||||
texinfo_documents = [
|
||||
('index', 'argon2_cffi', u'argon2_cffi Documentation',
|
||||
u'Hynek Schlawack', 'argon2_cffi',
|
||||
'One line description of project.', 'Miscellaneous'),
|
||||
]
|
||||
|
||||
# Documents to append as an appendix to all manuals.
|
||||
# texinfo_appendices = []
|
||||
|
||||
# If false, no module index is generated.
|
||||
# texinfo_domain_indices = True
|
||||
|
||||
# How to display URL addresses: 'footnote', 'no', or 'inline'.
|
||||
# texinfo_show_urls = 'footnote'
|
||||
|
||||
# If true, do not generate a @detailmenu in the "Top" node's menu.
|
||||
# texinfo_no_detailmenu = False
|
||||
|
||||
|
||||
# Example configuration for intersphinx: refer to the Python standard library.
|
||||
intersphinx_mapping = {
|
||||
"https://docs.python.org/3": None,
|
||||
}
|
||||
5
docs/contributing.rst
Normal file
5
docs/contributing.rst
Normal file
@ -0,0 +1,5 @@
|
||||
.. _contributing:
|
||||
|
||||
.. include:: ../CONTRIBUTING.rst
|
||||
|
||||
.. include:: ../CODE_OF_CONDUCT.rst
|
||||
41
docs/index.rst
Normal file
41
docs/index.rst
Normal file
@ -0,0 +1,41 @@
|
||||
argon2_cffi
|
||||
===========
|
||||
|
||||
Release v\ |release| (:doc:`What's new? <changelog>`).
|
||||
|
||||
|
||||
.. include:: ../README.rst
|
||||
:start-after: teaser-begin
|
||||
|
||||
|
||||
User's Guide
|
||||
------------
|
||||
|
||||
.. toctree::
|
||||
:maxdepth: 1
|
||||
|
||||
argon2
|
||||
installation
|
||||
api
|
||||
parameters
|
||||
cli
|
||||
|
||||
|
||||
Project Information
|
||||
-------------------
|
||||
|
||||
.. toctree::
|
||||
:maxdepth: 1
|
||||
|
||||
backward-compatibility
|
||||
contributing
|
||||
changelog
|
||||
license
|
||||
|
||||
|
||||
|
||||
Indices and tables
|
||||
==================
|
||||
|
||||
* :ref:`genindex`
|
||||
* :ref:`search`
|
||||
6
docs/installation.rst
Normal file
6
docs/installation.rst
Normal file
@ -0,0 +1,6 @@
|
||||
Installation
|
||||
============
|
||||
|
||||
A working C compiler is required because the official Argon2 C implementation is shipped along with the Python CFFI bindings.
|
||||
Otherwise a plain ``pip install argon2_cffi`` should just work.
|
||||
Binary `wheels <http://pythonwheels.com>`_ are offered for OS X and Windows.
|
||||
1
docs/license.rst
Normal file
1
docs/license.rst
Normal file
@ -0,0 +1 @@
|
||||
.. include:: ../AUTHORS.rst
|
||||
21
docs/parameters.rst
Normal file
21
docs/parameters.rst
Normal file
@ -0,0 +1,21 @@
|
||||
Choosing Parameters
|
||||
===================
|
||||
|
||||
Finding the right parameters for a password hashing algorithm is a daunting task.
|
||||
The authors of Argon2 specified a method in their `paper <https://github.com/P-H-C/phc-winner-argon2/blob/master/argon2-specs.pdf>`_ but it should be noted that they also mention that no value for ``time_cost`` or ``memory_cost`` is actually insecure (cf. section 6.4).
|
||||
|
||||
|
||||
#. Choose whether you want Argon2i or Argon2d (``type``).
|
||||
If you don't know what that means, choose Argon2i (``Type.I``).
|
||||
#. Figure out how many threads can be used on each call to Argon2 (``parallelism``).
|
||||
They recommend twice as many as the number of cores dedicated to hashing passwords.
|
||||
#. Figure out how much memory each call can afford (``memory_cost``).
|
||||
#. Choose a salt length.
|
||||
16 Bytes are fine.
|
||||
#. Choose a hash length (``hash_len``).
|
||||
16 Bytes are fine.
|
||||
#. Figure out how long each call can take.
|
||||
One `recommendation <https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2015/march/enough-with-the-salts-updates-on-secure-password-schemes/>`_ for concurent user logins is to keep it under 0.5ms.
|
||||
#. Measure the time for hashing using your chosen parameters.
|
||||
Find a ``time_cost`` that is within your accounted time.
|
||||
If ``time_cost=1`` takes too long, lower ``memory_cost``.
|
||||
@ -46,6 +46,8 @@ def hash_password_raw(password, salt=None,
|
||||
type=Type.I):
|
||||
"""
|
||||
Hash *password* and return a *raw* hash.
|
||||
|
||||
The function takes the same parameters as :func:`hash_password`.
|
||||
"""
|
||||
return _hash(password, salt, time_cost, memory_cost, parallelism, hash_len,
|
||||
type, False)
|
||||
|
||||
6
tox.ini
6
tox.ini
@ -12,8 +12,10 @@ commands =
|
||||
|
||||
[testenv:docs]
|
||||
basepython = python3.5
|
||||
deps =
|
||||
commands = python -m doctest README.rst
|
||||
deps = sphinx
|
||||
commands =
|
||||
sphinx-build -W -b html -d {envtmpdir}/doctrees docs docs/_build/html
|
||||
sphinx-build -W -b doctest -d {envtmpdir}/doctrees docs docs/_build/html
|
||||
|
||||
|
||||
[testenv:flake8]
|
||||
|
||||
Loading…
Reference in New Issue
Block a user