From 3f52aceca44bc52e0c8654f46c66073320109ae9 Mon Sep 17 00:00:00 2001
From: ReAnzu
Date: Sat, 24 Feb 2018 23:45:00 -0600
Subject: server/users: harden password hashes

- Changed password setup to use libsodium and argon2id (regular SHA256
  hashing for passwords is inadequate as modern GPU's can hash generate
  billions of hashes per second).
- Added code to auto migrate old passwords to the new password_hash if
  the existing password_hash matches either of the legacy password
  generation schemes (SHA1 or SHA256).
- Added migration to support new password_hash format length
- Added column password_revision. This field will default to 0, which
  all passwords will have till they're updated. After that each password
  hash method has a revision.
---
 server/requirements.txt | 1 +
 1 file changed, 1 insertion(+)

(limited to 'server/requirements.txt')

diff --git a/server/requirements.txt b/server/requirements.txt
index 2cd15ec..7cc4786 100644
--- a/server/requirements.txt
+++ b/server/requirements.txt
@@ -11,3 +11,4 @@ scipy>=0.18.1
 elasticsearch>=5.0.0
 elasticsearch-dsl>=5.0.0
 scikit-image>=0.12
+pynacl>=1.2.1
\ No newline at end of file
-- 
cgit v1.3