Matt Hamilton bacecb4249 Replace pbkdf2 with bcrypt (#16071) ...

* Replace pbkdf2 with bcrypt

bcrypt isn't inherently better than pbkdf2, but everything "just works"
out of the box.

  * the hash verification routine now only computes one hash per call
  * a per-user salt is built into the hash as opposed to the current
  global salt
  * bcrypt.checkpw() is immune to timing attacks regardless of input
  * hash strength is a function of real time benchmarks and a
  "difficulty" level, meaning we won't have to ever update the iteration
  count

* WIP: add hash upgrade mechanism

* WIP: clarify decode issue

* remove stale testing code

* Fix test

* Ensure incorrect legacy passwords fail

* Add better invalid legacy password test

* Lint

* Run tests in async scope

2018-08-26 22:50:31 +02:00

..

mfa_modules

Add Time-based Onetime Password Multi-factor Authentication Module (#16129)

2018-08-26 22:38:52 +02:00

providers

Replace pbkdf2 with bcrypt (#16071)

2018-08-26 22:50:31 +02:00

__init__.py

Reorg auth (#15443)

2018-07-13 11:43:08 +02:00

test_init.py

Add multi-factor authentication modules (#15489)

2018-08-22 09:52:34 +02:00