retuned default_rounds for a few hashes based on benchmarks

4 files changed, 16 insertions, 12 deletions

diff --git a/passlib/handlers/fshp.py b/passlib/handlers/fshp.py
index 2e536ce..28be83c 100644
--- a/passlib/handlers/fshp.py
+++ b/passlib/handlers/fshp.py
@@ -68,7 +68,9 @@ class fshp(uh.HasRounds, uh.HasRawSalt, uh.HasRawChecksum, uh.GenericHandler):
     max_salt_size = None
 
     #--HasRounds--
-    default_rounds = 16384 #current passlib default, FSHP uses 4096
+    # FIXME: should probably use different default rounds
+    # based on the variant. setting for default variant (sha256) for now.
+    default_rounds = 50000 #current passlib default, FSHP uses 4096
     min_rounds = 1 #set by FSHP
     max_rounds = 4294967295 # 32-bit integer limit - not set by FSHP
     rounds_cost = "linear"
diff --git a/passlib/handlers/pbkdf2.py b/passlib/handlers/pbkdf2.py
index 662bdcd..20824b2 100644
--- a/passlib/handlers/pbkdf2.py
+++ b/passlib/handlers/pbkdf2.py
@@ -44,7 +44,7 @@ class Pbkdf2DigestHandler(uh.HasRounds, uh.HasRawSalt, uh.HasRawChecksum, uh.Gen
     max_salt_size = 1024
 
     #--HasRounds--
-    default_rounds = 6400
+    default_rounds = None # set by subclass
     min_rounds = 1
     max_rounds = 2**32-1
     rounds_cost = "linear"
@@ -84,7 +84,7 @@ class Pbkdf2DigestHandler(uh.HasRounds, uh.HasRawSalt, uh.HasRawChecksum, uh.Gen
             secret = secret.encode("utf-8")
         return pbkdf2(secret, self.salt, self.rounds, self.checksum_size, self._prf)
 
-def create_pbkdf2_hash(hash_name, digest_size, ident=None):
+def create_pbkdf2_hash(hash_name, digest_size, rounds=6400, ident=None):
     "create new Pbkdf2DigestHandler subclass for a specific hash"
     name = 'pbkdf2_' + hash_name
     if ident is None:
@@ -95,6 +95,7 @@ def create_pbkdf2_hash(hash_name, digest_size, ident=None):
         name=name,
         ident=ident,
         _prf = prf,
+        default_rounds=rounds,
         checksum_size=digest_size,
         encoded_checksum_size=(digest_size*4+2)//3,
         __doc__="""This class implements a generic ``PBKDF2-%(prf)s``-based password hash, and follows the :ref:`password-hash-api`.
@@ -121,9 +122,9 @@ def create_pbkdf2_hash(hash_name, digest_size, ident=None):
 #---------------------------------------------------------
 #derived handlers
 #---------------------------------------------------------
-pbkdf2_sha1 = create_pbkdf2_hash("sha1", 20, ident=u("$pbkdf2$"))
-pbkdf2_sha256 = create_pbkdf2_hash("sha256", 32)
-pbkdf2_sha512 = create_pbkdf2_hash("sha512", 64)
+pbkdf2_sha1 = create_pbkdf2_hash("sha1", 20, 32000, ident=u("$pbkdf2$"))
+pbkdf2_sha256 = create_pbkdf2_hash("sha256", 32, 4000)
+pbkdf2_sha512 = create_pbkdf2_hash("sha512", 64, 3200)
 
 ldap_pbkdf2_sha1 = uh.PrefixWrapper("ldap_pbkdf2_sha1", pbkdf2_sha1, "{PBKDF2}", "$pbkdf2$")
 ldap_pbkdf2_sha256 = uh.PrefixWrapper("ldap_pbkdf2_sha256", pbkdf2_sha256, "{PBKDF2-SHA256}", "$pbkdf2-sha256$")
@@ -173,8 +174,8 @@ class cta_pbkdf2_sha1(uh.HasRounds, uh.HasRawSalt, uh.HasRawChecksum, uh.Generic
     min_salt_size = 0
     max_salt_size = 1024
 
-    #--HasROunds--
-    default_rounds = 10000
+    #--HasRounds--
+    default_rounds = 20000
     min_rounds = 1
     max_rounds = 2**32-1
     rounds_cost = "linear"
@@ -260,8 +261,8 @@ class dlitz_pbkdf2_sha1(uh.HasRounds, uh.HasSalt, uh.GenericHandler):
     max_salt_size = 1024
     salt_chars = uh.HASH64_CHARS
 
-    #--HasROunds--
-    default_rounds = 10000
+    #--HasRounds--
+    default_rounds = 20000
     min_rounds = 1
     max_rounds = 2**32-1
     rounds_cost = "linear"
diff --git a/passlib/handlers/phpass.py b/passlib/handlers/phpass.py
index c093255..00a4e33 100644
--- a/passlib/handlers/phpass.py
+++ b/passlib/handlers/phpass.py
@@ -64,7 +64,7 @@ class phpass(uh.HasManyIdents, uh.HasRounds, uh.HasSalt, uh.GenericHandler):
     salt_chars = uh.HASH64_CHARS
 
     #--HasRounds--
-    default_rounds = 9
+    default_rounds = 16
     min_rounds = 7
     max_rounds = 30
     rounds_cost = "log2"
diff --git a/passlib/handlers/sha2_crypt.py b/passlib/handlers/sha2_crypt.py
index e344912..29a18de 100644
--- a/passlib/handlers/sha2_crypt.py
+++ b/passlib/handlers/sha2_crypt.py
@@ -253,7 +253,6 @@ class _SHA2_Common(uh.HasManyBackends, uh.HasRounds, uh.HasSalt,
     max_salt_size = 16
     salt_chars = uh.HASH64_CHARS
 
-    default_rounds = 40000 # current passlib default
     min_rounds = 1000 # bounds set by spec
     max_rounds = 999999999 # bounds set by spec
     rounds_cost = "linear"
@@ -393,6 +392,7 @@ class sha256_crypt(_SHA2_Common):
     name = "sha256_crypt"
     ident = u("$5$")
     checksum_size = 43
+    default_rounds = 80000 # current passlib default
 
     #=========================================================
     # backends
@@ -448,6 +448,7 @@ class sha512_crypt(_SHA2_Common):
     ident = u("$6$")
     checksum_size = 86
     _cdb_use_512 = True
+    default_rounds = 60000 # current passlib default
 
     #=========================================================
     # backend