Skip to content

passlib.hash.apr_md5_crypt - Apache's MD5-Crypt variant

Danger

This algorithm is not considered secure by modern standards. It should only be used when verifying existing hashes, or when interacting with applications that require this format. For new code, see the list of recommended hashes.

This hash is a variation of md5_crypt, primarily used by the Apache webserver in htpasswd files. It contains only minor changes to the MD5-Crypt algorithm, and should be considered just as weak as MD5-Crypt itself.

Tip

  • password hash usage -- for examples of how to use this class via the common hash interface.
  • passlib.apache -- routines for manipulating htpasswd files.

Interface

apr_md5_crypt 

apr_md5_crypt(salt=None, **kwds)

This class implements the Apr-MD5-Crypt password hash, and follows the :ref:password-hash-api.

It supports a variable-length salt.

The :meth:~passlib.ifc.PasswordHash.using method accepts the following optional keywords:

Parameters:

  • salt (str, default: None ) –

    Optional salt string. If not specified, one will be autogenerated (this is recommended). If specified, it must be 0-8 characters, drawn from the regexp range [./0-9A-Za-z].

  • relaxed (bool) –

    By default, providing an invalid value for one of the other keywords will result in a :exc:ValueError. If relaxed=True, and the error can be corrected, a :exc:~passlib.exc.PasslibHashWarning will be issued instead. Correctable errors include salt strings that are too long.

    .. versionadded:: 1.6

encrypt classmethod 

encrypt(*args, **kwds)

Legacy alias for :meth:hash.

.. deprecated:: 1.7 This method was renamed to :meth:!hash in version 1.7. This alias will be removed in version 2.0, and should only be used for compatibility with Passlib 1.3 - 1.6.

parsehash classmethod 

parsehash(hash, checksum=True, sanitize=False)

[experimental method] parse hash into dictionary of settings.

this essentially acts as the inverse of :meth:hash: for most cases, if hash = cls.hash(secret, **opts), then cls.parsehash(hash) will return a dict matching the original options (with the extra keyword checksum).

this method may not work correctly for all hashes, and may not be available on some few. its interface may change in future releases, if it's kept around at all.

Parameters:

  • hash –

    hash to parse

  • checksum –

    include checksum keyword? (defaults to True)

  • sanitize –

    mask data for sensitive fields? (defaults to False)

bitsize classmethod 

bitsize(salt_size=None, **kwds)

[experimental method] return info about bitsizes of hash

default_salt_size 

default_salt_size()

default salt size (defaults to max_salt_size)

default_salt_chars 

default_salt_chars()

charset used to generate new salt strings (defaults to salt_chars)

Format & Algorithm

This format and algorithm of Apache's MD5-Crypt is identical to the original MD5-Crypt, except for two changes:

  1. The encoded string uses $apr1$ as its prefix, while md5-crypt uses $1$.

  2. The algorithm uses $apr1$ as a constant in the step where md5-crypt uses $1$ in its calculation of digest B (see the md5-crypt algorithm). Because of this change, even raw checksums generated by apr-md5-crypt and md5-crypt are not compatible with each other.

See md5_crypt for the format & algorithm descriptions, as well as security notes.

References