Skip to content

passlib.hash.grub_pbkdf2_sha512 - Grub's PBKDF2 Hash

This class provides an implementation of Grub's PBKDF2-HMAC-SHA512 password hash 1, as generated by the grub-mkpasswd-pbkdf2 command, and may be found in Grub2 configuration files. PBKDF2 is a key derivation function 2 that is ideally suited as the basis for a password hash, as it provides variable length salts, variable number of rounds.

Tip

  • password hash usage -- for examples of how to use this class via the common hash interface.

  • passlib.hash.pbkdf2_{digest} -- for some other PBKDF2-based hashes.

Interface

grub_pbkdf2_sha512 

grub_pbkdf2_sha512(rounds=None, **kwds)

This class implements Grub's pbkdf2-hmac-sha512 hash, and follows the :ref:password-hash-api.

It supports a variable-length salt, and a variable number of rounds.

The :meth:~passlib.ifc.PasswordHash.using method accepts the following optional keywords:

Parameters:

  • salt (bytes) –

    Optional salt bytes. If specified, the length must be between 0-1024 bytes. If not specified, a 64 byte salt will be autogenerated (this is recommended).

  • salt_size (int) –

    Optional number of bytes to use when autogenerating new salts. Defaults to 64 bytes, but can be any value between 0 and 1024.

  • rounds (int, default: None ) –

    Optional number of rounds to use. Defaults to 19000, but must be within range(1,1<<32).

  • relaxed (bool) –

    By default, providing an invalid value for one of the other keywords will result in a :exc:ValueError. If relaxed=True, and the error can be corrected, a :exc:~passlib.exc.PasslibHashWarning will be issued instead. Correctable errors include rounds that are too small or too large, and salt strings that are too long.

    .. versionadded:: 1.6

encrypt classmethod 

encrypt(*args, **kwds)

Legacy alias for :meth:hash.

.. deprecated:: 1.7 This method was renamed to :meth:!hash in version 1.7. This alias will be removed in version 2.0, and should only be used for compatibility with Passlib 1.3 - 1.6.

parsehash classmethod 

parsehash(hash, checksum=True, sanitize=False)

[experimental method] parse hash into dictionary of settings.

this essentially acts as the inverse of :meth:hash: for most cases, if hash = cls.hash(secret, **opts), then cls.parsehash(hash) will return a dict matching the original options (with the extra keyword checksum).

this method may not work correctly for all hashes, and may not be available on some few. its interface may change in future releases, if it's kept around at all.

Parameters:

  • hash –

    hash to parse

  • checksum –

    include checksum keyword? (defaults to True)

  • sanitize –

    mask data for sensitive fields? (defaults to False)

bitsize classmethod 

bitsize(rounds=None, vary_rounds=0.1, **kwds)

[experimental method] return info about bitsizes of hash

default_salt_chars 

default_salt_chars()

charset used to generate new salt strings (defaults to salt_chars)

Format & Algorithm

A example hash (of password) is :

grub.pbkdf2.sha512.10000.4483972AD2C52E1F590B3E2260795FDA9CA0B07B
96FF492814CA9775F08C4B59CD1707F10B269E09B61B1E2D11729BCA8D62B7827
B25B093EC58C4C1EAC23137.DF4FCB5DD91340D6D31E33423E4210AD47C7A4DF9
FA16F401663BF288C20BF973530866178FE6D134256E4DBEFBD984B652332EED3
ACAED834FEA7B73CAE851D

All of this scheme's hashes have the format grub.pbkdf2.sha512.{rounds}.{salt}.{checksum}, where {rounds} is the number of iteration stored in decimal, {salt} is the salt string encoded using upper-case hexadecimal, and {checksum} is the resulting 64-byte derived key, also encoded in upper-case hexadecimal. It can be identified by the prefix grub.pdkdf2.sha512..

The algorithm used is the same as pbkdf2_sha1: the password is encoded into UTF-8 if not already encoded, and passed through pbkdf1() along with the decoded salt, and the number of rounds. The result is then encoded into hexadecimal.

  1. Information about Grub's password hashes - http://grub.enbug.org/Authentication ↩

  2. The specification for the PBKDF2 algorithm - http://tools.ietf.org/html/rfc2898#section-5.2 ↩