#31358: Increase default password salt size -----------------------------------------+------------------------ Reporter: darakian | Owner: nobody Type: Uncategorized | Status: new Component: Uncategorized | Version: 3.0 Severity: Normal | Keywords: Triage Stage: Unreviewed | Has patch: 0 Needs documentation: 0 | Needs tests: 0 Patch needs improvement: 0 | Easy pickings: 0 UI/UX: 0 | -----------------------------------------+------------------------ I've made a patch for this here https://github.com/django/django/pull/12553 Which changes the default salt size from ~71 bits to ~131 bits
The rational is that modern guidance suggests a 128 bit minimum on salt sizes OWASP: https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Password_Storage_Cheat_Sheet.md#salting NIST: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-132.pdf In the case of NIST this is technically a hard requirement. -- Ticket URL: <https://code.djangoproject.com/ticket/31358> Django <https://code.djangoproject.com/> The Web framework for perfectionists with deadlines. -- You received this message because you are subscribed to the Google Groups "Django updates" group. To unsubscribe from this group and stop receiving emails from it, send an email to django-updates+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/django-updates/051.a8d04fd75600fd51fe6e8bb06601e49f%40djangoproject.com.