72 lines
1.8 KiB
Python
72 lines
1.8 KiB
Python
|
"""密码哈希 (T6.1).
|
|||
|
|
|
|||
|
|
使用 PBKDF2-HMAC-SHA256（200k 迭代）。salt 16B hex；hash 64B hex。
|
|||
|
|
不依赖 bcrypt/argon2 等第三方库，保持项目"零运行时第三方"约束。
|
|||
|
|
|
|||
|
|
存储格式: "<salt_hex>$<hash_hex>"（便于单字段持久化）。
|
|||
|
|
"""
|
|||
|
|
|
|||
|
|
from __future__ import annotations
|
|||
|
|
|
|||
|
|
import hashlib
|
|||
|
|
import hmac
|
|||
|
|
import secrets
|
|||
|
|
|
|||
|
|
_PBKDF2_ALGO = "sha256"
|
|||
|
|
_PBKDF2_ITERATIONS = 200_000
|
|||
|
|
_SALT_BYTES = 16
|
|||
|
|
_HASH_BYTES = 32
|
|||
|
|
_STORED_SEPARATOR = "$"
|
|||
|
|
|
|||
|
|
|
|||
|
|
def hash_password(plain: str) -> str:
|
|||
|
|
"""对明文密码进行 PBKDF2 哈希。
|
|||
|
|
|
|||
|
|
Args:
|
|||
|
|
plain: 明文密码
|
|||
|
|
|
|||
|
|
Returns:
|
|||
|
|
形如 "<salt_hex>$<hash_hex>" 的字符串，可直接入库
|
|||
|
|
"""
|
|||
|
|
if not plain:
|
|||
|
|
raise ValueError("password cannot be empty")
|
|||
|
|
salt = secrets.token_bytes(_SALT_BYTES)
|
|||
|
|
digest = hashlib.pbkdf2_hmac(
|
|||
|
|
_PBKDF2_ALGO,
|
|||
|
|
plain.encode("utf-8"),
|
|||
|
|
salt,
|
|||
|
|
_PBKDF2_ITERATIONS,
|
|||
|
|
dklen=_HASH_BYTES,
|
|||
|
|
)
|
|||
|
|
return f"{salt.hex()}{_STORED_SEPARATOR}{digest.hex()}"
|
|||
|
|
|
|||
|
|
|
|||
|
|
def verify_password(plain: str, stored: str) -> bool:
|
|||
|
|
"""校验明文密码与存储哈希是否匹配。
|
|||
|
|
|
|||
|
|
使用恒定时间比较避免时序攻击。
|
|||
|
|
|
|||
|
|
Args:
|
|||
|
|
plain: 明文密码
|
|||
|
|
stored: 数据库存储的 "<salt>$<hash>" 字符串
|
|||
|
|
|
|||
|
|
Returns:
|
|||
|
|
True 表示匹配
|
|||
|
|
"""
|
|||
|
|
if not plain or not stored or _STORED_SEPARATOR not in stored:
|
|||
|
|
return False
|
|||
|
|
salt_hex, hash_hex = stored.split(_STORED_SEPARATOR, 1)
|
|||
|
|
try:
|
|||
|
|
salt = bytes.fromhex(salt_hex)
|
|||
|
|
expected = bytes.fromhex(hash_hex)
|
|||
|
|
except ValueError:
|
|||
|
|
return False
|
|||
|
|
candidate = hashlib.pbkdf2_hmac(
|
|||
|
|
_PBKDF2_ALGO,
|
|||
|
|
plain.encode("utf-8"),
|
|||
|
|
salt,
|
|||
|
|
_PBKDF2_ITERATIONS,
|
|||
|
|
dklen=_HASH_BYTES,
|
|||
|
|
)
|
|||
|
|
return hmac.compare_digest(candidate, expected)
|