Re: Password Hash Validation (Posting On Python-List Prohibited)

Lawrence D'Oliveiro <ldo@nz.invalid> writes:

However, one language that does seem able to keep up to date is Perl.
So here’s my current password validation function:...
        outhash = subprocess.check_output \
          (
            args = ("perl", "-e", "print crypt.... )

Ugh!  Better to re-implement the function in Python.  I'll take a look:

https://www.openwall.com/yescrypt/

In fact that site links to Python bindings for Yescrypt:

https://github.com/0xcb/pyescrypt

I guess C bindings rather than a pure Python implementation are
necessary, since part of the idea of the function is to impede brute
force attacks by burning a lot of CPU and memory on each hash.