Skip to content

passlib.hash.mssql2005 - MS SQL 2005 password hash

Danger

This algorithm is not considered secure by modern standards. It should only be used when verifying existing hashes, or when interacting with applications that require this format. For new code, see the list of recommended hashes.

This class implements the hash algorithm used by Microsoft SQL Server 2005 to store its user account passwords, replacing the slightly less secure mssql2000 variant. This class can be used directly as follows:

from passlib.hash import mssql2005 as m25

# hash password
h = m25.hash("password")
print(h)
# > '0x01006ACDF9FF5D2E211B392EEF1175EFFE13B3A368CE2F94038B'

# verify password
print(m25.verify("password", h))
# > True
print(m25.verify("letmein", h))
# > False

Tip

  • See the PasswordHash usage examples for more usage details.
  • mssql2000 -- the predecessor to this hash.

Interface

mssql2005 

mssql2005(salt=None, **kwds)

This class implements the password hash used by MS-SQL 2005, and follows the :ref:password-hash-api.

It supports a fixed-length salt.

The :meth:~passlib.ifc.PasswordHash.using method accepts the following optional keywords:

Parameters:

  • salt (bytes, default: None ) –

    Optional salt string. If not specified, one will be autogenerated (this is recommended). If specified, it must be 4 bytes in length.

  • relaxed (bool) –

    By default, providing an invalid value for one of the other keywords will result in a :exc:ValueError. If relaxed=True, and the error can be corrected, a :exc:~passlib.exc.PasslibHashWarning will be issued instead. Correctable errors include salt strings that are too long.

encrypt classmethod 

encrypt(*args, **kwds)

Legacy alias for :meth:hash.

.. deprecated:: 1.7 This method was renamed to :meth:!hash in version 1.7. This alias will be removed in version 2.0, and should only be used for compatibility with Passlib 1.3 - 1.6.

parsehash classmethod 

parsehash(hash, checksum=True, sanitize=False)

[experimental method] parse hash into dictionary of settings.

this essentially acts as the inverse of :meth:hash: for most cases, if hash = cls.hash(secret, **opts), then cls.parsehash(hash) will return a dict matching the original options (with the extra keyword checksum).

this method may not work correctly for all hashes, and may not be available on some few. its interface may change in future releases, if it's kept around at all.

Parameters:

  • hash –

    hash to parse

  • checksum –

    include checksum keyword? (defaults to True)

  • sanitize –

    mask data for sensitive fields? (defaults to False)

bitsize classmethod 

bitsize(salt_size=None, **kwds)

[experimental method] return info about bitsizes of hash

default_salt_size 

default_salt_size()

default salt size (defaults to max_salt_size)

default_salt_chars 

default_salt_chars()

charset used to generate new salt strings (defaults to salt_chars)

Format & Algorithm

MSSQL 2005 hashes are usually presented as a series of 52 upper-case hexadecimal characters, prefixed by 0x. An example MSSQL 2005 hash (of "password"):

0x01006ACDF9FF5D2E211B392EEF1175EFFE13B3A368CE2F94038B

This encodes 26 bytes of raw data, consisting of:

  • a 2-byte constant 0100
  • 4 byte of salt (6ACDF9FF in the example)
  • 20 byte digest (5D2E211B392EEF1175EFFE13B3A368CE2F94038B in the example).

The digest is generated by encoding the unicode password using UTF-16-LE, and calculating SHA1(encoded_secret + salt).

This format and algorithm is identical to mssql2000, except that this hash omits the 2nd case-insensitive digest used by MSSQL 2000.

Note

MSSQL 2005 hashes do not actually have a native textual format, as they are stored as raw bytes in an SQL table. However, when external programs deal with them, MSSQL generally encodes raw bytes as upper-case hexadecimal, prefixed with 0x. This is the representation Passlib uses.

Security Issues

This algorithm is reasonably weak, and shouldn't be used for any purpose besides manipulating existing MSSQL 2005 hashes. This mainly due to its simplicity, and years of research on high-speed SHA1 implementations, which makes efficient brute force attacks feasible. 1

  1. Overview hash algorithms used by MSSQL - https://blogs.msdn.com/b/lcris/archive/2007/04/30/sql-server-2005-about-login-password-hashes.aspx?Redirected=true. See also the description of the MSSQL 2000/2005 algorithm. ↩