[Zope-dev] PAS, AuthEncoding and zope.password

[Martijn Pieters]

I was looking into bcrypt[1] support for PAS I found z3c.bcrypt, which
implements zope.password compontents (named utilities).

PAS, however, uses Zope2's AccessControl.AuthEncoding module to handle
password encryption / hashing schemes. Now, while AuthEncoding
certainly supports extending the available schemes, it does need
additional glue-code to be able to reuse zope.password components.
Moreover, we now have two places to maintain the various hashing and
encryption schemes.

We should at the very least convert PAS to use zope.password instead
of AccessControl.AuthEncoding. With that change it is then at least
trivial to support bcrypt as well, you simply install the additional
z3c.bcrypt egg and be done with it. But would it make sense to convert
Zope2 itself as well? We could make the AuthEncodings module simply a
proxy (with deprecation warnings if need be) for zope.password
components.

Any objections to reworking both AuthEncoding and PAS?

-- 
Martijn Pieters

[1] see http://codahale.com/how-to-safely-store-a-password/ and
http://stackoverflow.com/questions/1561174/sha512-vs-blowfish-and-bcrypt