1# Copyright 2017 Donald Stufft and individual contributors
2#
3# Licensed under the Apache License, Version 2.0 (the "License");
4# you may not use this file except in compliance with the License.
5# You may obtain a copy of the License at
6#
7# http://www.apache.org/licenses/LICENSE-2.0
8#
9# Unless required by applicable law or agreed to in writing, software
10# distributed under the License is distributed on an "AS IS" BASIS,
11# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12# See the License for the specific language governing permissions and
13# limitations under the License.
14
15
16from nacl.exceptions import CryptPrefixError
17
18from . import _argon2, argon2i, argon2id, scrypt
19
20STRPREFIX = argon2id.STRPREFIX
21
22PWHASH_SIZE = argon2id.PWHASH_SIZE
23
24assert _argon2.ALG_ARGON2_DEFAULT == _argon2.ALG_ARGON2ID13
25# since version 1.0.15 of libsodium
26
27PASSWD_MIN = argon2id.PASSWD_MIN
28PASSWD_MAX = argon2id.PASSWD_MAX
29MEMLIMIT_MAX = argon2id.MEMLIMIT_MAX
30MEMLIMIT_MIN = argon2id.MEMLIMIT_MIN
31OPSLIMIT_MAX = argon2id.OPSLIMIT_MAX
32OPSLIMIT_MIN = argon2id.OPSLIMIT_MIN
33OPSLIMIT_INTERACTIVE = argon2id.OPSLIMIT_INTERACTIVE
34MEMLIMIT_INTERACTIVE = argon2id.MEMLIMIT_INTERACTIVE
35OPSLIMIT_MODERATE = argon2id.OPSLIMIT_MODERATE
36MEMLIMIT_MODERATE = argon2id.MEMLIMIT_MODERATE
37OPSLIMIT_SENSITIVE = argon2id.OPSLIMIT_SENSITIVE
38MEMLIMIT_SENSITIVE = argon2id.MEMLIMIT_SENSITIVE
39
40str = argon2id.str
41
42assert argon2i.ALG != argon2id.ALG
43
44SCRYPT_SALTBYTES = scrypt.SALTBYTES
45SCRYPT_PWHASH_SIZE = scrypt.PWHASH_SIZE
46SCRYPT_OPSLIMIT_INTERACTIVE = scrypt.OPSLIMIT_INTERACTIVE
47SCRYPT_MEMLIMIT_INTERACTIVE = scrypt.MEMLIMIT_INTERACTIVE
48SCRYPT_OPSLIMIT_SENSITIVE = scrypt.OPSLIMIT_SENSITIVE
49SCRYPT_MEMLIMIT_SENSITIVE = scrypt.MEMLIMIT_SENSITIVE
50
51
52kdf_scryptsalsa208sha256 = scrypt.kdf
53scryptsalsa208sha256_str = scrypt.str
54verify_scryptsalsa208sha256 = scrypt.verify
55
56
57def verify(password_hash: bytes, password: bytes) -> bool:
58 """
59 Takes a modular crypt encoded stored password hash derived using one
60 of the algorithms supported by `libsodium` and checks if the user provided
61 password will hash to the same string when using the parameters saved
62 in the stored hash
63 """
64 if password_hash.startswith(argon2id.STRPREFIX):
65 return argon2id.verify(password_hash, password)
66 elif password_hash.startswith(argon2i.STRPREFIX):
67 return argon2id.verify(password_hash, password)
68 elif scrypt.AVAILABLE and password_hash.startswith(scrypt.STRPREFIX):
69 return scrypt.verify(password_hash, password)
70 else:
71 raise (
72 CryptPrefixError(
73 "given password_hash is not in a supported format"
74 )
75 )