53 lines
1.6 KiB
Python
53 lines
1.6 KiB
Python
|
"""密码哈希与校验。
|
|||
|
|
|
|||
|
|
当前实现使用 PBKDF2-HMAC-SHA256（内置 hashlib），以避免引入额外依赖。
|
|||
|
|
存储格式：
|
|||
|
|
pbkdf2_sha256$<iterations>$<salt_b64url>$<dk_b64url>
|
|||
|
|
"""
|
|||
|
|
|
|||
|
|
from __future__ import annotations
|
|||
|
|
|
|||
|
|
import base64
|
|||
|
|
import hashlib
|
|||
|
|
import hmac
|
|||
|
|
import secrets
|
|||
|
|
|
|||
|
|
|
|||
|
|
_ALGO = "pbkdf2_sha256"
|
|||
|
|
_ITERATIONS = 210_000
|
|||
|
|
_SALT_BYTES = 16
|
|||
|
|
_DKLEN = 32
|
|||
|
|
|
|||
|
|
|
|||
|
|
def hash_password(password: str) -> str:
|
|||
|
|
"""对明文密码进行哈希并返回可存储字符串。"""
|
|||
|
|
if not isinstance(password, str) or not password:
|
|||
|
|
raise ValueError("password required")
|
|||
|
|
salt = secrets.token_bytes(_SALT_BYTES)
|
|||
|
|
dk = hashlib.pbkdf2_hmac("sha256", password.encode("utf-8"), salt, _ITERATIONS, dklen=_DKLEN)
|
|||
|
|
salt_b64 = base64.urlsafe_b64encode(salt).decode("ascii").rstrip("=")
|
|||
|
|
dk_b64 = base64.urlsafe_b64encode(dk).decode("ascii").rstrip("=")
|
|||
|
|
return f"{_ALGO}${_ITERATIONS}${salt_b64}${dk_b64}"
|
|||
|
|
|
|||
|
|
|
|||
|
|
def verify_password(password: str, stored_hash: str) -> bool:
|
|||
|
|
"""校验明文密码是否匹配已存储的哈希。"""
|
|||
|
|
try:
|
|||
|
|
algo, iters_s, salt_b64, dk_b64 = stored_hash.split("$", 3)
|
|||
|
|
if algo != _ALGO:
|
|||
|
|
return False
|
|||
|
|
iterations = int(iters_s)
|
|||
|
|
salt = _b64url_decode(salt_b64)
|
|||
|
|
expected = _b64url_decode(dk_b64)
|
|||
|
|
except Exception:
|
|||
|
|
return False
|
|||
|
|
|
|||
|
|
dk = hashlib.pbkdf2_hmac("sha256", password.encode("utf-8"), salt, iterations, dklen=len(expected))
|
|||
|
|
return hmac.compare_digest(dk, expected)
|
|||
|
|
|
|||
|
|
|
|||
|
|
def _b64url_decode(value: str) -> bytes:
|
|||
|
|
"""解码不带 padding 的 base64url 字符串。"""
|
|||
|
|
padded = value + "=" * (-len(value) % 4)
|
|||
|
|
return base64.urlsafe_b64decode(padded.encode("ascii"))
|