29 lines
830 B
Python
29 lines
830 B
Python
"""Argon2id-Passwort-Hashing (siehe Konzept 6.2)."""
|
|
from __future__ import annotations
|
|
|
|
from argon2 import PasswordHasher
|
|
from argon2.exceptions import VerifyMismatchError, InvalidHash
|
|
|
|
# Parameter angelehnt an aktuelle OWASP-Empfehlung; in Produktion je nach
|
|
# Server-Hardware kalibrieren (siehe Konzept 6.2).
|
|
_hasher = PasswordHasher(time_cost=2, memory_cost=19 * 1024, parallelism=1)
|
|
|
|
|
|
def hash_password(password: str) -> str:
|
|
return _hasher.hash(password)
|
|
|
|
|
|
def verify_password(password_hash: str, password: str) -> bool:
|
|
try:
|
|
_hasher.verify(password_hash, password)
|
|
except (VerifyMismatchError, InvalidHash):
|
|
return False
|
|
return True
|
|
|
|
|
|
def needs_rehash(password_hash: str) -> bool:
|
|
try:
|
|
return _hasher.check_needs_rehash(password_hash)
|
|
except InvalidHash:
|
|
return True
|