Secure Password Storage

# bcrypt_demo.py
import bcrypt
import time

def hash_password(password: str, cost: int = 12) -> bytes:
    """Hash a password with bcrypt. Returns bytes including salt."""
    salt = bcrypt.gensalt(rounds=cost)
    return bcrypt.hashpw(password.encode("utf-8"), salt)

def verify_password(password: str, hashed: bytes) -> bool:
    """Verify a password against a bcrypt hash."""
    return bcrypt.checkpw(password.encode("utf-8"), hashed)

# Hash a password
password = "MyS3cur3P@ssw0rd!"
start = time.perf_counter()
hashed = hash_password(password, cost=12)
elapsed = time.perf_counter() - start

print(f"Password: {password}")
print(f"Hash:     {hashed.decode()}")
print(f"Time:     {elapsed:.3f}s at cost=12")
print(f"Hash prefix: $2b$12$ = bcrypt v2b, cost 12")

# Verify correct password
is_valid = verify_password(password, hashed)
print(f"\nValid password: {is_valid}")   # True

# Verify wrong password
is_valid_wrong = verify_password("wrong_password", hashed)
print(f"Wrong password: {is_valid_wrong}")   # False

# Show that two hashes of the same password differ (different salts)
hash2 = hash_password(password, cost=12)
print(f"\nSame password, different hashes (different salts):")
print(f"  Hash 1: {hashed.decode()[:29]}...")
print(f"  Hash 2: {hash2.decode()[:29]}...")
print(f"  Equal?  {hashed == hash2}")   # False

# argon2_demo.py
from argon2 import PasswordHasher
from argon2.exceptions import VerifyMismatchError, VerificationError

# OWASP-recommended Argon2id parameters (2024)
ph = PasswordHasher(
    time_cost=2,        # Number of iterations
    memory_cost=65536,  # 64 MB of RAM required
    parallelism=1,      # Threads
    hash_len=32,        # Output length in bytes
    salt_len=16,        # Salt length in bytes
)

password = "AnotherS3cur3P@ss!"

# Hash
hash_value = ph.hash(password)
print(f"Argon2id hash:")
print(f"  {hash_value}")

# Verify
try:
    ph.verify(hash_value, password)
    print("\nPassword verification: PASSED ✅")
except VerifyMismatchError:
    print("\nPassword verification: FAILED ❌")

# Argon2 supports rehashing if parameters change
needs_rehash = ph.check_needs_rehash(hash_value)
print(f"Needs rehash: {needs_rehash}")  # False (just generated)

# Wrong password
try:
    ph.verify(hash_value, "wrong_password")
except VerifyMismatchError:
    print("Wrong password rejected ✅")

# pbkdf2_pepper_demo.py
import hashlib
import hmac
import os
import secrets

# PEPPER: application-level secret, stored in environment / secrets manager
# NOT stored in the database, different from the salt
PEPPER = os.environ.get("PASSWORD_PEPPER", secrets.token_hex(32))

def hash_password_pbkdf2(password: str) -> tuple[bytes, bytes]:
    """
    Hash password with PBKDF2-SHA256 + pepper + automatic salt.
    Returns (salt, hash), store both in the database.
    """
    # Apply pepper before hashing (HMAC prevents length extension)
    peppered = hmac.new(PEPPER.encode(), password.encode(), hashlib.sha256).digest()

    salt = secrets.token_bytes(32)   # 256-bit random salt
    iterations = 600_000             # NIST SP 800-63B 2024 recommendation

    key = hashlib.pbkdf2_hmac(
        "sha256",
        peppered,
        salt,
        iterations,
        dklen=32,
    )
    return salt, key

def verify_password_pbkdf2(password: str, salt: bytes, stored_hash: bytes) -> bool:
    """Verify a PBKDF2-hashed password."""
    peppered = hmac.new(PEPPER.encode(), password.encode(), hashlib.sha256).digest()
    key = hashlib.pbkdf2_hmac("sha256", peppered, salt, 600_000, dklen=32)
    return hmac.compare_digest(key, stored_hash)

# Usage
password = "SecretP@ss2024!"
salt, pw_hash = hash_password_pbkdf2(password)

print(f"Salt (hex):  {salt.hex()[:32]}...")
print(f"Hash (hex):  {pw_hash.hex()}")
print(f"\nVerification correct: {verify_password_pbkdf2(password, salt, pw_hash)}")
print(f"Verification wrong:   {verify_password_pbkdf2('wrongpass', salt, pw_hash)}")
print("\n✅ Pepper stored in environment variable, not in DB")
print("✅ Salt stored alongside hash in DB")
print("✅ 600,000 PBKDF2 iterations (NIST 2024 recommendation)")