35.5. crypt — 校验 Unix 密码的函数 ¶

35.5.1. 哈希方法 ¶

crypt module defines the list of hashing methods (not all methods are available on all platforms):

crypt. METHOD_SHA512 ¶

A Modular Crypt Format method with 16 character salt and 86 character hash. This is the strongest method.

crypt. METHOD_SHA256 ¶

Another Modular Crypt Format method with 16 character salt and 43 character hash.

crypt. METHOD_MD5 ¶

Another Modular Crypt Format method with 8 character salt and 22 character hash.

crypt. METHOD_CRYPT ¶

The traditional method with a 2 character salt and 13 characters of hash. This is the weakest method.

35.5.2. 模块属性 ¶

crypt. methods ¶

A list of available password hashing algorithms, as crypt.METHOD_* objects. This list is sorted from strongest to weakest.

35.5.3. 模块函数 ¶

crypt 模块定义了下列函数：

crypt. crypt ( word , salt=None ) ¶

word will usually be a user’s password as typed at a prompt or in a graphical interface. The optional salt is either a string as returned from mksalt() , one of the crypt.METHOD_* values (though not all may be available on all platforms), or a full encrypted password including salt, as returned by this function. If salt is not provided, the strongest method will be used (as returned by methods() ).

Checking a password is usually done by passing the plain-text password as word and the full results of a previous crypt() call, which should be the same as the results of this call.

salt (either a random 2 or 16 character string, possibly prefixed with $digit$ to indicate the method) which will be used to perturb the encryption algorithm. The characters in salt must be in the set [./a-zA-Z0-9] , with the exception of Modular Crypt Format which prefixes a $digit$ .

Returns the hashed password as a string, which will be composed of characters from the same alphabet as the salt.

Since a few crypt(3) extensions allow different values, with different sizes in the salt , it is recommended to use the full crypted password as salt when checking for a password.

3.3 版改变： Accept crypt.METHOD_* values in addition to strings for salt .

crypt. mksalt ( method=None ) ¶

Return a randomly generated salt of the specified method. If no 方法 is given, the strongest method available as returned by methods() 被使用。

The return value is a string either of 2 characters in length for crypt.METHOD_CRYPT , or 19 characters starting with $digit$ and 16 random characters from the set [./a-zA-Z0-9] , suitable for passing as the salt 自变量为 crypt() .

3.3 版新增。

35.5.4. 范例 ¶

A simple example illustrating typical use (a constant-time comparison operation is needed to limit exposure to timing attacks. hmac.compare_digest() is suitable for this purpose):

import pwd
import crypt
import getpass
from hmac import compare_digest as compare_hash
def login():
    username = input('Python login: ')
    cryptedpasswd = pwd.getpwnam(username)[1]
    if cryptedpasswd:
        if cryptedpasswd == 'x' or cryptedpasswd == '*':
            raise ValueError('no support for shadow passwords')
        cleartext = getpass.getpass()
        return compare_hash(crypt.crypt(cleartext, cryptedpasswd), cryptedpasswd)
    else:
        return True
								

To generate a hash of a password using the strongest available method and check it against the original:

import crypt
from hmac import compare_digest as compare_hash
hashed = crypt.crypt(plaintext)
if not compare_hash(hashed, crypt.crypt(plaintext, hashed)):
    raise ValueError("hashed version doesn't validate against original")