SUBTASK #86: Password hashing (BB-5)

Open Beginner friendly
  • Is something wrong?
#87 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Active
Tech stack
python
Domain
authentication, security

Research direction

Start with backend/black_boxes/password_hashing/password_hashing.py and the existing BB-3 black box's __init__.py, which shows the export style to copy. Add argon2-cffi to requirements.txt, then implement hash_password and verify_password as specified, with verify_password catching errors and returning False. Done when the tests in tests/black_boxes/test_password_hashing.py pass and nothing outside password_hashing/ imports argon2. Read the parent issue for the rules the issue refers to.

Written by the indexing model from the issue text.

Description

backend Low Priority subtask

What to do

A black box that hides the password hashing library: hash_password(password) -> str and verify_password(stored_hash, password) -> bool, using Argon2id from argon2-cffi. Nothing else in the project imports argon2, so the library could be swapped without touching the callers.

Background

  • System design 12: BB-5 uses argon2-cffi; 11.2: salted Argon2id, never plain text (SEC-02, CP-02); AT-14: only Argon2id hashes stored.
  • argon2-cffi's PasswordHasher makes a new random salt on every call and keeps it, with its settings, inside the hash string ($argon2id$v=19$m=65536,t=3,p=4$<salt>$<hash>). There's no separate salt column to manage.
  • app_user.password_hash is VARCHAR(255); an Argon2id hash is about 100 characters.
  • Rules are in #PARENT.

Steps

  • Add argon2-cffi to requirements.txt
  • backend/black_boxes/password_hashing/password_hashing.py:
    • hash_password(password: str) -> str: Argon2id with the library's default settings. Raises ValueError for an empty password.
    • verify_password(stored_hash: str, password: str) -> bool: never raises. Returns False for a wrong password, an empty or damaged hash, or a hash from another algorithm.
  • backend/black_boxes/password_hashing/__init__.py exports only those two functions, like BB-3
  • Unit tests:
    • The hash starts with $argon2id$ and doesn't contain the password
    • The same password hashed twice gives two different hashes (a different salt each time), and both verify
    • A wrong password returns False
    • An empty, cut-off or made-up hash returns False, not an exception
    • An empty password raises ValueError
    • A 128-character password and a non-English one ("pässwörd🔒") both work

Where

  • backend/black_boxes/password_hashing/__init__.py
  • backend/black_boxes/password_hashing/password_hashing.py
  • tests/black_boxes/test_password_hashing.py
  • requirements.txt

Done when

  • All the tests above pass
  • Nothing outside password_hashing/ imports argon2

Depends on

  • Nothing
Dominant language
Python
Stars
1
Forks
1
Avg merge
9h
Merged PRs (30d)
34

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Bearkat-Professionals/Software-Engineering-Project

All issues in Bearkat-Professionals/Software-Engineering-Project

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.