... k, they could suffer from an XSS attack. CVE-2016-2513: User enumeration through timing difference on password hasher work factor upgrade ¶ In each major version of Django since 1.6, the default number of iterations for the PBKDF2PasswordHasher and its ... g difference. The new BasePasswordHasher.harden_runtime() method allows hashers to bridge the runtime gap between the work factor (e.g. iterations) supplied in existing encoded passwords and the default work factor of the hasher. This method is impleme ... r of rounds for the latter hasher hasn't changed since Django 1.4, but some projects may subclass it and increase the work factor as needed. A warning will be emitted for any third-party password hashers that don't implement a harden_runtime() method. ... ... k, they could suffer from an XSS attack. CVE-2016-2513: User enumeration through timing difference on password hasher work factor upgrade ¶ In each major version of Django since 1.6, the default number of iterations for the PBKDF2PasswordHasher and its ... g difference. The new BasePasswordHasher.harden_runtime() method allows hashers to bridge the runtime gap between the work factor (e.g. iterations) supplied in existing encoded passwords and the default work factor of the hasher. This method is impleme ... r of rounds for the latter hasher hasn't changed since Django 1.4, but some projects may subclass it and increase the work factor as needed. A warning will be emitted for any third-party password hashers that don't implement a harden_runtime() method. ... ... k, they could suffer from an XSS attack. CVE-2016-2513: User enumeration through timing difference on password hasher work factor upgrade ¶ In each major version of Django since 1.6, the default number of iterations for the PBKDF2PasswordHasher and its ... g difference. The new BasePasswordHasher.harden_runtime() method allows hashers to bridge the runtime gap between the work factor (e.g. iterations) supplied in existing encoded passwords and the default work factor of the hasher. This method is impleme ... r of rounds for the latter hasher hasn't changed since Django 1.4, but some projects may subclass it and increase the work factor as needed. A warning will be emitted for any third-party password hashers that don't implement a harden_runtime() method. ... ... k, they could suffer from an XSS attack. CVE-2016-2513: User enumeration through timing difference on password hasher work factor upgrade ¶ In each major version of Django since 1.6, the default number of iterations for the PBKDF2PasswordHasher and its ... g difference. The new BasePasswordHasher.harden_runtime() method allows hashers to bridge the runtime gap between the work factor (e.g. iterations) supplied in existing encoded passwords and the default work factor of the hasher. This method is impleme ... r of rounds for the latter hasher hasn't changed since Django 1.4, but some projects may subclass it and increase the work factor as needed. A warning will be emitted for any third-party password hashers that don't implement a harden_runtime() method. ... ... rd, separated by the dollar-sign character and consist of: the hashing algorithm, the number of algorithm iterations (work factor), the random salt, and the resulting password hash. The algorithm is one of a number of one-way hashing or password storag ... salt_entropy 値は実際には最小値です。たとえば、128という値は実際には131ビットのエントロピーを含むソルトを提供します。 work factor を増やす ¶ PBKDF2 と bcrypt ¶ PBKDF2 と bcrypt アルゴリズムは、ハッシュ化に何度もイテレート（ラウンド）します。これは意図的 ... BKDF2 を使ってパスワードを保存する際に、より多くのイテレーションを使うようになります。 注釈 bcrypt の rounds は対数の work factor で、たとえば 12 ラウンドは 2 ** 12 のイテレーションを意味します。 Argon2 ¶ Argon2には、カスタマイズ可能な以下の属性がありま ... ... rd, separated by the dollar-sign character and consist of: the hashing algorithm, the number of algorithm iterations (work factor), the random salt, and the resulting password hash. The algorithm is one of a number of one-way hashing or password storag ... salt_entropy 値は実際には最小値です。たとえば、128という値は実際には131ビットのエントロピーを含むソルトを提供します。 work factor を増やす ¶ PBKDF2 と bcrypt ¶ PBKDF2 と bcrypt アルゴリズムは、ハッシュ化に何度もイテレート（ラウンド）します。これは意図的 ... BKDF2 を使ってパスワードを保存する際に、より多くのイテレーションを使うようになります。 注釈 bcrypt の rounds は対数の work factor で、たとえば 12 ラウンドは 2 ** 12 のイテレーションを意味します。 Argon2 ¶ Argon2には、カスタマイズ可能な以下の属性がありま ... ... tch) Django 1.8 (patch) March 1, 2016 - CVE 2016-2513 ¶ User enumeration through timing difference on password hasher work factor upgrade. Full description 影響を受けるバージョン ¶ Django 1.9 (patch) Django 1.8 (patch) March 1, 2016 - CVE 2016-2512 ¶ M ... ... tch) Django 1.8 (patch) March 1, 2016 - CVE 2016-2513 ¶ User enumeration through timing difference on password hasher work factor upgrade. Full description 影響を受けるバージョン ¶ Django 1.9 (patch) Django 1.8 (patch) March 1, 2016 - CVE 2016-2512 ¶ M ... 2026年10月08日