passlib.hash.sha512_crypt - SHA-512 Crypt

Defined by the same specification as passlib.hash.sha256_crypt, SHA512-Crypt is identical to SHA256-Crypt in almost every way, including design and security issues. The only difference is the doubled digest size; while this provides some increase in security, it's also a bit slower 32 bit operating systems.

Tip

• password hash usage -- for examples of how to use this class via the common hash interface.

• sha256_crypt -- the companion 256-bit version of this hash.

Interface

sha512_crypt

sha512_crypt(implicit_rounds=None, **kwds)

This class implements the SHA512-Crypt password hash, and follows the :ref:password-hash-api.

It supports a variable-length salt, and a variable number of rounds.

The :meth:~passlib.ifc.PasswordHash.using method accepts the following optional keywords:

Parameters:

• salt (str) –

  Optional salt string. If not specified, one will be autogenerated (this is recommended). If specified, it must be 0-16 characters, drawn from the regexp range [./0-9A-Za-z].

• rounds (int) –

  Optional number of rounds to use. Defaults to 656000, must be between 1000 and 999999999, inclusive.

  .. note:: per the official specification, when the rounds parameter is set to 5000, it may be omitted from the hash string.

• relaxed (bool) –

  By default, providing an invalid value for one of the other keywords will result in a :exc:ValueError. If relaxed=True, and the error can be corrected, a :exc:~passlib.exc.PasslibHashWarning will be issued instead. Correctable errors include rounds that are too small or too large, and salt strings that are too long.

  .. versionadded:: 1.6
  

  .. commented out, currently only supported by :meth:hash, and not via :meth:using:

  :type implicit_rounds: bool
  :param implicit_rounds:
      this is an internal option which generally doesn't need to be touched.
  
      this flag determines whether the hash should omit the rounds parameter
      when encoding it to a string; this is only permitted by the spec for rounds=5000,
      and the flag is ignored otherwise. the spec requires the two different
      encodings be preserved as they are, instead of normalizing them.
  

encrypt classmethod

encrypt(*args, **kwds)

Legacy alias for :meth:hash.

.. deprecated:: 1.7 This method was renamed to :meth:!hash in version 1.7. This alias will be removed in version 2.0, and should only be used for compatibility with Passlib 1.3 - 1.6.

parsehash classmethod

parsehash(hash, checksum=True, sanitize=False)

[experimental method] parse hash into dictionary of settings.

this essentially acts as the inverse of :meth:hash: for most cases, if hash = cls.hash(secret, **opts), then cls.parsehash(hash) will return a dict matching the original options (with the extra keyword checksum).

this method may not work correctly for all hashes, and may not be available on some few. its interface may change in future releases, if it's kept around at all.

Parameters:

• hash –

  hash to parse

• checksum –

  include checksum keyword? (defaults to True)

• sanitize –

  mask data for sensitive fields? (defaults to False)

bitsize classmethod

bitsize(rounds=None, vary_rounds=0.1, **kwds)

[experimental method] return info about bitsizes of hash

default_salt_size

default_salt_size()

default salt size (defaults to max_salt_size)

default_salt_chars

default_salt_chars()

charset used to generate new salt strings (defaults to salt_chars)

get_backend classmethod

get_backend()

Return name of currently active backend. if no backend has been loaded, loads and returns name of default backend.

Returns:

• –

  name of active backend

Raises:

• passlib.exc.MissingBackendError –

  if no backends are available.

has_backend classmethod

has_backend(name='any')

Check if support is currently available for specified backend.

Parameters:

• name –

  name of backend to check for. can be any string accepted by :meth:set_backend.

Returns:

• –
  • True if backend is available.
  • False if it's available / can't be loaded.
  • None if it's present, but won't load due to a security issue.

Raises:

• ValueError –

  if backend name is unknown

set_backend classmethod

set_backend(name='any', dryrun=False)

Load specified backend.

Parameters:

• name –

  name of backend to load, can be any of the following:

  • "any" -- use current backend if one is loaded, otherwise load the first available backend.

  • "default" -- use the first available backend.

  • any string in :attr:backends, loads specified backend.

• dryrun –

  If True, this perform all setup actions except switching over to the new backend. (this flag is used to implement :meth:has_backend).

  .. versionadded:: 1.7

Raises:

• ValueError –

  If backend name is unknown.

• passlib.exc.MissingBackendError –

  If specific backend is missing; or in the case of "any" / "default", if no backends are available.

• passlib.exc.PasslibSecurityError –

  If "any" or "default" was specified, but the only backend available has a PasslibSecurityError.

Note

This class will use the first available of two possible backends:

• stdlib crypt(), if the host OS supports SHA512-Crypt (most Linux systems).
• a pure python implementation of SHA512-Crypt built into passlib.

You can see which backend is in use by calling the get_backend() method.

Format & Algorithm

SHA512-Crypt is defined by the same specification as SHA256-Crypt. The format and algorithm are exactly the same, except for the following notable differences:

• it uses the modular crypt prefix $6$, whereas SHA256-Crypt uses $5$.
• it uses the SHA-512 message digest in place of the SHA-256 message digest.
• its output hash is correspondingly larger in size, with an 86-character encoded checksum, instead of 43 characters.

See sha256_crypt for the format and algorithm descriptions, as well as security notes.