Password Hash Validation (Posting On Python-List Prohibited)

[Lawrence D'Oliveiro]

I am writing code to validate entered user passwords against hashes
served up from /etc/shadow via LDAP. I had previously used passlib
<https://passlib.readthedocs.io> to do the hashing. But now I discover
it is not keeping up; for example, Debian and other distros are now
using yescrypt (hashes with “$y$” prefix), but passlib has no support
for that.

However, one language that does seem able to keep up to date is Perl.
So here’s my current password validation function:

def validate_password(password, hash) :
"hashes password using the algorithm and salt prefix from hash, and" \
" returns whether the result matches hash."
outhash = subprocess.check_output \
(
args = ("perl", "-e", "print crypt($ENV{\"PW\"}, $ENV{\"HASH\"});"),
env = {"PW" : password, "HASH" : hash},
text = True
).strip()
return \
outhash == hash
#end validate_password

[Gordinator]

Post by Lawrence D'Oliveiro
I am writing code to validate entered user passwords against hashes
served up from /etc/shadow via LDAP. I had previously used passlib
<https://passlib.readthedocs.io> to do the hashing. But now I discover
it is not keeping up; for example, Debian and other distros are now
using yescrypt (hashes with “$y$” prefix), but passlib has no support
for that.
However, one language that does seem able to keep up to date is Perl.
"hashes password using the algorithm and salt prefix from hash, and" \
" returns whether the result matches hash."
outhash = subprocess.check_output \
(
args = ("perl", "-e", "print crypt($ENV{\"PW\"}, $ENV{\"HASH\"});"),
env = {"PW" : password, "HASH" : hash},
text = True
).strip()
return \
outhash == hash
#end validate_password

What an...interesting commenting method. I would personally use
"""triple quotes""" to allow for multi-line comments, but between you
and me, that's just creating a string and allocating it nowhere.

[Lawrence D'Oliveiro]

Post by Gordinator
What an...interesting commenting method. I would personally use
"""triple quotes""" to allow for multi-line comments ...

But then you end up with extra space for indentation inside the strings,
and you need additional processing to strip it out afterwards.

It always seemed to me that multiline strings should follow a similar
indentation rule to statement blocks: lines after the first one must be at
least as indented as the first line, and that initial indentation is
stripped from the start of all of the lines, at compile time.

[Paul Rubin]

Post by Lawrence D'Oliveiro
However, one language that does seem able to keep up to date is Perl.
So here’s my current password validation function:...
outhash = subprocess.check_output \
(
args = ("perl", "-e", "print crypt.... )

Ugh! Better to re-implement the function in Python. I'll take a look:

https://www.openwall.com/yescrypt/

In fact that site links to Python bindings for Yescrypt:

https://github.com/0xcb/pyescrypt

I guess C bindings rather than a pure Python implementation are
necessary, since part of the idea of the function is to impede brute
force attacks by burning a lot of CPU and memory on each hash.

[Lawrence D'Oliveiro]

Post by Paul Rubin

Post by Lawrence D'Oliveiro
However, one language that does seem able to keep up to date is Perl.
So here’s my current password validation function:...
outhash = subprocess.check_output \
(
args = ("perl", "-e", "print crypt.... )

Ugh! Better to re-implement the function in Python.

I want a wrapper for crypt(3) and friends, so I automatically support any
password hashes that the system implements, now or in the future. I don’t
want to have to worry about specific hash algorithms in my code.

passlib meant well, but I think it was over-engineered for this purpose.

I think I will create my own wrapper using ctypes.

[Lawrence D'Oliveiro]

Post by Lawrence D'Oliveiro
I think I will create my own wrapper using ctypes.

Done <https://gitlab.com/ldo/nixcrypt>.

[Lawrence D'Oliveiro]

Post by Lawrence D'Oliveiro

Post by Lawrence D'Oliveiro
I think I will create my own wrapper using ctypes.

Done <https://gitlab.com/ldo/nixcrypt>.

The repo now includes an example script that exercises the various
functions of the module.