Added codec: scrypt

Author: dhondta

README.md

@@ -436,6 +436,7 @@ This category also contains `ascii85`, `adobe`, `[x]btoa`, `zeromq` with the `ba
 - [X] `oracle10`: legacy Oracle 10g password hash (parametrized with the user name) ; `oracle11` for the 11g version
 - [X] `phpass`: portable PHP password hash (parametrized with the iteration count ; used e.g. by WordPress)
 - [X] `ripemd160`: aka RIPEMD-160 (relies on `hashlib` when available, pure Python otherwise)
+- [X] `scrypt`: aka scrypt (RFC 7914), parameterized with its cost ln, block size r and parallelism p (relies on `hashlib`)
 - [X] `sha`: aka Secure Hash Algorithms ; includes SHA0, SHA1, 224, 256, 384, 512 (Python2/3) but also SHA3-224, -256, -384 and -512 (Python 3 only ; relies on `hashlib`)
 - [X] `shake`: aka SHAKE hashing (Python 3 only ; relies on `hashlib`)
 - [X] `snefru`: aka Snefru (Merkle's hash function) in 32 to 480 bits, with 2 to 8 passes

docs/pages/enc/hashing.md

@@ -362,6 +362,19 @@ This one-way transformation function, used e.g. in Bitcoin addresses, relies on
 'f0c90bd665512fc158f3c47d6de76b58783c404c'
 ```
 
+### Scrypt
+
+These one-way transformation functions compute the scrypt password hash ([RFC 7914](https://datatracker.ietf.org/doc/html/rfc7914)), a memory-hard key derivation function. The result is written in the modular crypt format `$scrypt$ln=...,r=...,p=...$salt$digest` (as [passlib](https://passlib.readthedocs.io/en/stable/lib/passlib.hash.scrypt.html) does). The cost parameters are given with the codec name, in the order ln (the base-2 logarithm of the CPU/memory cost N), r (the block size) and p (the parallelism) ; they default to ln=16, r=8 and p=1. A random salt is generated each time. It relies on [`hashlib`](https://docs.python.org/3/library/hashlib.html).
+
+**Codec** | **Conversions** | **Aliases** | **Comment**
+:---: | :---: | --- | ---
+`scrypt` | data --> scrypt(data) | `scrypt-14`, `scrypt-14-8-2`, ... | parametrized with ln, r and p ; random salt
+
+```python
+>>> codext.encode("password", "scrypt")[:21]
+'$scrypt$ln=16,r=8,p=1'
+```
+
 -----
 
 ### Secure Hash Algorithm

src/codext/hashing/__init__.py

@@ -20,6 +20,7 @@
 from .phpass import *
 from .postgres import *
 from .ripemd import *
+from .scrypt import *
 from .sha import *
 from .shake import *
 from .snefru import *

src/codext/hashing/scrypt.py

@@ -0,0 +1,44 @@
+# -*- coding: UTF-8 -*-
+"""Scrypt Hashing Codec - string hashing with scrypt.
+
+scrypt, designed by Colin Percival in 2009 (RFC 7914), is a memory-hard password-based key derivation function whose
+ cost is set by three parameters: the CPU/memory cost N (a power of two, given as its base-2 logarithm), the block size
+ r and the parallelism p. The result is written in the modular crypt format
+ "$scrypt$ln=<log2n>,r=<r>,p=<p>$<salt>$<digest>", with the 16-byte salt and the 32-byte digest encoded in base64
+ (without padding). The parameters are given in the codec name (e.g. "scrypt-14" or "scrypt-14-8-2" ; they default to
+ ln=16, r=8, p=1) and a random salt is generated each time, hence the output differs between calls. This codec returns
+ the hash string (one-way), for use with other codecs in encoding chains.
+
+This codec:
+- transforms strings from str to str
+- transforms strings from bytes to bytes
+- transforms file content from str to bytes (write)
+
+Reference: https://datatracker.ietf.org/doc/html/rfc7914
+"""
+import os
+from base64 import b64encode
+
+from ..__common__ import *
+
+
+def _b64(data):
+    return b64encode(data).decode().rstrip("=")
+
+
+def scrypt(ln=None, r=None, p=None):
+    ln = int(ln) if ln not in (None, "") else 16
+    r = int(r) if r not in (None, "") else 8
+    p = int(p) if p not in (None, "") else 1
+    if not 1 <= ln <= 31:
+        raise LookupError("Bad parameter for encoding 'scrypt': ln must be between 1 and 31")
+    if r < 1 or p < 1:
+        raise LookupError("Bad parameter for encoding 'scrypt': r and p must be strictly positive")
+    def _hash(text, errors="strict"):
+        salt, n = os.urandom(16), 1 << ln
+        digest = hashlib.scrypt(b(ensure_str(text)), salt=salt, n=n, r=r, p=p, dklen=32, maxmem=128 * r * (n + p + 2))
+        return "$scrypt$ln=%d,r=%d,p=%d$%s$%s" % (ln, r, p, _b64(salt), _b64(digest)), len(text)
+    return _hash
+
+
+add("scrypt", scrypt, pattern=r"^scrypt(?:[-_](\d{1,2}))?(?:[-_](\d+))?(?:[-_](\d+))?$", guess=None)

tests/test_manual.py

@@ -968,6 +968,11 @@ def fixed(data):
             ("sun-md5-crypt-0", bytes([38, 39, 40, 41, 42, 43, 44, 45]), "$md5$abcdefgh$$ZxccX5lio58EZKsCI/Peg0"),
             ("sun-md5-crypt-100", bytes([38, 39, 40, 41, 42, 43, 44, 45]),
              "$md5,rounds=100$abcdefgh$$M/k9.q5540c7/LWDsTI8I."),
+            # scrypt uses a 16-byte random salt and hashlib.scrypt (reference vectors of passlib)
+            ("scrypt", bytes(range(16)),
+             "$scrypt$ln=16,r=8,p=1$AAECAwQFBgcICQoLDA0ODw$jWPkcxERY25E9gwism7ggXZkARLbUPyOZiOM5ZQx95s"),
+            ("scrypt-10-4-2", bytes(range(16)),
+             "$scrypt$ln=10,r=4,p=2$AAECAwQFBgcICQoLDA0ODw$i6PwKXRFGHVv2momDm8VxbF0U/YH0gT8dlATuDEwOQQ"),
         ]
         for e, data, r in salted:
             with patch("os.urandom", fixed(data)):
@@ -976,7 +981,7 @@ def fixed(data):
         self.assertNotEqual(codecs.encode(PW, "mssql2000"), codecs.encode(PW, "mssql2000"))
         for e in ["ldap-md5", "cisco-pix", "postgres-md5-x", "oracle10-x", "mscash-x", "mscash2-x", "mssql2000",
                   "mssql2005", "oracle11", "phpass", "bigcrypt", "crypt16", "bsdi-crypt", "bsd-nthash",
-                  "sun-md5-crypt"]:
+                  "sun-md5-crypt", "scrypt"]:
             self.assertRaises(NotImplementedError, codecs.decode, PW, e)
         # long passwords exercise the multi-block paths of bigcrypt and bsdi-crypt
         with patch("os.urandom", fixed(bytes([38, 39]))):
@@ -987,6 +992,8 @@ def fixed(data):
         self.assertRaises(LookupError, codecs.encode, PW, "phpass-6")
         self.assertRaises(LookupError, codecs.encode, PW, "bsdi-crypt-0")
         self.assertRaises(LookupError, codecs.encode, "a" * 17, "cisco-pix")
+        self.assertRaises(LookupError, codecs.encode, PW, "scrypt-0")
+        self.assertRaises(LookupError, codecs.encode, PW, "scrypt-10-0")
 
     def test_codec_argon2(self):
         # Argon2, through the argon2-cffi package (skipped when it is not installed)