saymrwulf/cryptography
1
0
Fork 0
mirror of https://github.com/saymrwulf/cryptography.git synced 2026-05-14 20:37:55 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Update recommended PBKDF2HMAC iteration counts (#12243)

Browse source 
This uses the current (as of 2025-01-07) default of 1,000,000
iterations used by Django.
This commit is contained in:
MajorTanya 2025-01-07 05:42:29 +01:00 committed by GitHub
parent 89efecbdb9
commit 5f160b90fe
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
docs/fernet.rst
View file

@ -237,7 +237,7 @@ password through a key derivation function such as
... algorithm=hashes.SHA256(),
... length=32,
... salt=salt,
... iterations=480000,
... iterations=1_000_000,
... )
>>> key = base64.urlsafe_b64encode(kdf.derive(password))
>>> f = Fernet(key)
@ -251,8 +251,8 @@ In this scheme, the salt has to be stored in a retrievable location in order
to derive the same key from the password in the future.
The iteration count used should be adjusted to be as high as your server can
tolerate. A good default is at least 480,000 iterations, which is what `Django
recommends as of December 2022`_.
tolerate. A good default is at least 1,000,000 iterations, which is what `Django
recommends as of January 2025`_.
Implementation
--------------
@ -280,5 +280,5 @@ unsuitable for very large files at this time.
.. _`Fernet`: https://github.com/fernet/spec/
.. _`Django recommends as of December 2022`: https://github.com/django/django/blob/main/django/contrib/auth/hashers.py
.. _`Django recommends as of January 2025`: https://github.com/django/django/blob/main/django/contrib/auth/hashers.py
.. _`specification`: https://github.com/fernet/spec/blob/master/Spec.md

4
docs/hazmat/primitives/key-derivation-functions.rst
View file

@ -162,7 +162,7 @@ PBKDF2
... algorithm=hashes.SHA256(),
... length=32,
... salt=salt,
... iterations=480000,
... iterations=1_000_000,
... )
>>> key = kdf.derive(b"my great password")
>>> # verify
@ -170,7 +170,7 @@ PBKDF2
... algorithm=hashes.SHA256(),
... length=32,
... salt=salt,
... iterations=480000,
... iterations=1_000_000,
... )
>>> kdf.verify(b"my great password", key)