Spring compatible scrypt password with python passlib

Question

How can I generate Spring compatible passwords from python?

I've got a spring application creating scrypt passwords that look like this in the db:

{scrypt}$e0801$QAqC0fvhY6iJPysiQsFnrcUg205njHo/6o+IDXDn33lxmZOCVBhb4NAqdafhuGmykCxQtMI5xP5zb7MYMUrU3Q==$sBeXCHOm6zQuGdSDKs+HeXnNQGg3bhRidmL+HU/ZTMM=

I'm trying to update the database directly with new passwords using python and passlib but cannot divine the correct setting_kwds for passlib from $e0801$ :

>>> from passlib.hash import scrypt
>>> scrypt.verify('wBkfoBsxj9u3wLOZ', '{scrypt}$e0801$QAqC0fvhY6iJPysiQsFnrcUg205njHo/6o+IDXDn33lxmZOCVBhb4NAqdafhuGmykCxQtMI5xP5zb7MYMUrU3Q==$sBeXCHOm6zQuGdSDKs+HeXnNQGg3bhRidmL+HU/ZTMM=')
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/gregn/.pyenv/versions/v2.7.16/lib/python2.7/site-packages/passlib/utils/handlers.py", line 789, in verify
    self = cls.from_string(hash, **context)
  File "/home/gregn/.pyenv/versions/v2.7.16/lib/python2.7/site-packages/passlib/handlers/scrypt.py", line 177, in from_string
    return cls(**cls.parse(hash))
  File "/home/gregn/.pyenv/versions/v2.7.16/lib/python2.7/site-packages/passlib/handlers/scrypt.py", line 181, in parse
    ident, suffix = cls._parse_ident(hash)
  File "/home/gregn/.pyenv/versions/v2.7.16/lib/python2.7/site-packages/passlib/utils/handlers.py", line 1207, in _parse_ident
    raise exc.InvalidHashError(cls)
ValueError: not a valid scrypt hash

Manually fiddling with the prefix format hasn't worked:

>>> scrypt.verify('wBkfoBsxj9u3wLOZ', '$scrypt$ln=1,r=8,p=1$QAqC0fvhY6iJPysiQsFnrcUg205njHo/6o+IDXDn33lxmZOCVBhb4NAqdafhuGmykCxQtMI5xP5zb7MYMUrU3Q==$sBeXCHOm6zQuGdSDKs+HeXnNQGg3bhRidmL+HU/ZTMM=')
False

I think ( but am not certain) Spring is using default SCryptPasswordEncoder settings because I found:

public static PasswordEncoder getPasswordEncoder() {
    final String encodingId = "scrypt";
    final Map<String, PasswordEncoder> encoders = new HashMap<>();
    encoders.put("bcrypt", new BCryptPasswordEncoder());
    encoders.put(encodingId, new SCryptPasswordEncoder());
    return new DelegatingPasswordEncoder(encodingId, encoders);
}

spring version:

  .   ____          _            __ _ _
 /\\ / ___'_ __ _ _(_)_ __  __ _ \ \ \ \
( ( )\___ | '_ | '_| | '_ \/ _` | \ \ \ \
 \\/  ___)| |_)| | | | | || (_| |  ) ) ) )
  '  |____| .__|_| |_|_| |_\__, | / / / /
 =========|_|==============|___/=/_/_/_/
 :: Spring Boot ::       (v1.5.18.RELEASE)

Thanks!

score 1 · Answer 1 · answered Mar 24 '20 at 12:59

The one you provided is not a valid scrypt hash

{scrypt}$e0801$QAqC0fvhY....

This is the right format (just substitute {scrypt} with $s0)

$s0$e0801$QAqC0fvhY6iJPysiQsFnrcUg205njHo/6o+IDXDn33lxmZOCVBhb4NAqdafhuGmykCxQtMI5xP5zb7MYMUrU3Q==$sBeXCHOm6zQuGdSDKs+HeXnNQGg3bhRidmL+HU/ZTMM=

If you try to get the configurations with Password4j:

SCryptFunction.getInstanceFromHash("$s0$e0801$QAqC0...");

you get N=16384, r=8 and p=1. Use this configuration in your Python implementation.

Spring compatible scrypt password with python passlib

1 Answers1