import warnings

hasher_changed = hasher.algorithm != preferred.algorithm

must_update = hasher_changed or preferred.must_update(encoded)

# If the hasher didn't change (we don't protect against enumeration if it

# does) and the password should get updated, try to close the timing gap

# between the work factor of the current encoded password and the default

# work factor.

if not is_correct and not hasher_changed and must_update:

hasher.harden_runtime(password, encoded)

def harden_runtime(self, password, encoded):

"""

warnings.warn('subclasses of BasePasswordHasher should provide a harden_runtime() method')

def harden_runtime(self, password, encoded):

algorithm, iterations, salt, hash = encoded.split('$', 3)

extra_iterations = self.iterations - int(iterations)

if extra_iterations > 0:

self.encode(password, salt, extra_iterations)

encoded_2 = self.encode(password, force_bytes(data))

return constant_time_compare(encoded, encoded_2)

def harden_runtime(self, password, encoded):

_, data = encoded.split('$', 1)

salt = data[:29] # Length of the salt in bcrypt.

rounds = data.split('$')[2]

# work factor is logarithmic, adding one doubles the load.

diff = 2**(self.rounds - int(rounds)) - 1

while diff > 0:

self.encode(password, force_bytes(salt))

diff -= 1

def harden_runtime(self, password, encoded):

pass

def harden_runtime(self, password, encoded):

pass

def harden_runtime(self, password, encoded):

pass

def harden_runtime(self, password, encoded):

pass

def harden_runtime(self, password, encoded):

pass

CVE-2016-2513: User enumeration through timing difference on password hasher work factor upgrade

================================================================================================

In each major version of Django since 1.6, the default number of iterations for

the ``PBKDF2PasswordHasher`` and its subclasses has increased. This improves

the security of the password as the speed of hardware increases, however, it

also creates a timing difference between a login request for a user with a

password encoded in an older number of iterations and login request for a

nonexistent user (which runs the default hasher's default number of iterations

since Django 1.6).

This only affects users who haven't logged in since the iterations were

increased. The first time a user logs in after an iterations increase, their

password is updated with the new iterations and there is no longer a timing

difference.

The new ``BasePasswordHasher.harden_runtime()`` method allows hashers to bridge

the runtime gap between the work factor (e.g. iterations) supplied in existing

encoded passwords and the default work factor of the hasher. This method

is implemented for ``PBKDF2PasswordHasher`` and ``BCryptPasswordHasher``.

The number of rounds for the latter hasher hasn't changed since Django 1.4, but

some projects may subclass it and increase the work factor as needed.

A warning will be emitted for any :ref:`third-party password hashers that don't

implement <write-your-own-password-hasher>` a ``harden_runtime()`` method.

If you have different password hashes in your database (such as SHA1 hashes

from users who haven't logged in since the default hasher switched to PBKDF2

in Django 1.4), the timing difference on a login request for these users may be

even greater and this fix doesn't remedy that difference (or any difference

when changing hashers). You may be able to :ref:`upgrade those hashes

<wrapping-password-hashers>` to prevent a timing attack for that case.

Be aware that if all the passwords in your database aren't encoded in the

default hasher's algorithm, you may be vulnerable to a user enumeration timing

attack due to a difference between the duration of a login request for a user

with a password encoded in a non-default algorithm and the duration of a login

request for a nonexistent user (which runs the default hasher). You may be able

to mitigate this by :ref:`upgrading older password hashes

<wrapping-password-hashers>`.

.. _write-your-own-password-hasher:

Writing your own hasher

-----------------------

.. versionadded:: 1.8.10

If you write your own password hasher that contains a work factor such as a

number of iterations, you should implement a

``harden_runtime(self, password, encoded)`` method to bridge the runtime gap

between the work factor supplied in the ``encoded`` password and the default

work factor of the hasher. This prevents a user enumeration timing attack due

to difference between a login request for a user with a password encoded in an

older number of iterations and a nonexistent user (which runs the default

hasher's default number of iterations).

Taking PBKDF2 as example, if ``encoded`` contains 20,000 iterations and the

hasher's default ``iterations`` is 30,000, the method should run ``password``

through another 10,000 iterations of PBKDF2.

If your hasher doesn't have a work factor, implement the method as a no-op

(``pass``).

from django.test import SimpleTestCase, mock

from django.utils.encoding import force_bytes

@skipUnless(bcrypt, "bcrypt not installed")

def test_bcrypt_harden_runtime(self):

hasher = get_hasher('bcrypt')

self.assertEqual('bcrypt', hasher.algorithm)

with mock.patch.object(hasher, 'rounds', 4):

encoded = make_password('letmein', hasher='bcrypt')

with mock.patch.object(hasher, 'rounds', 6), \

mock.patch.object(hasher, 'encode', side_effect=hasher.encode):

hasher.harden_runtime('wrong_password', encoded)

# Increasing rounds from 4 to 6 means an increase of 4 in workload,

# therefore hardening should run 3 times to make the timing the

# same (the original encode() call already ran once).

self.assertEqual(hasher.encode.call_count, 3)

# Get the original salt (includes the original workload factor)

algorithm, data = encoded.split('$', 1)

expected_call = (('wrong_password', force_bytes(data[:29])),)

self.assertEqual(hasher.encode.call_args_list, [expected_call] * 3)

def test_pbkdf2_harden_runtime(self):

hasher = get_hasher('default')

self.assertEqual('pbkdf2_sha256', hasher.algorithm)

with mock.patch.object(hasher, 'iterations', 1):

encoded = make_password('letmein')

with mock.patch.object(hasher, 'iterations', 6), \

mock.patch.object(hasher, 'encode', side_effect=hasher.encode):

hasher.harden_runtime('wrong_password', encoded)

# Encode should get called once ...

self.assertEqual(hasher.encode.call_count, 1)

# ... with the original salt and 5 iterations.

algorithm, iterations, salt, hash = encoded.split('$', 3)

expected_call = (('wrong_password', salt, 5),)

self.assertEqual(hasher.encode.call_args, expected_call)

def test_check_password_calls_harden_runtime(self):

hasher = get_hasher('default')

encoded = make_password('letmein')

with mock.patch.object(hasher, 'harden_runtime'), \

mock.patch.object(hasher, 'must_update', return_value=True):

# Correct password supplied, no hardening needed

check_password('letmein', encoded)

self.assertEqual(hasher.harden_runtime.call_count, 0)

# Wrong password supplied, hardening needed

check_password('wrong_password', encoded)

self.assertEqual(hasher.harden_runtime.call_count, 1)