Use argon2 or scrypt to hash password by default

issue10529
review359761002

CHANGELOG

@@ -1,3 +1,4 @@
+* Use argon2 or scrypt to hash password by default
 * Allow PYSON Expression as key for PYSON In with dict object
 * Add method to format warning name with records
 * Add option to trytond-console to start a readonly transaction

doc/topics/configuration.rst

@@ -442,7 +442,8 @@ passlib
 
 The path to the `INI file to load as CryptContext
 <https://passlib.readthedocs.io/en/stable/narr/context-tutorial.html#loading-saving-a-cryptcontext>`_.
-If not path is set, Tryton will use the schemes ``bcrypt`` or ``pbkdf2_sha512``.
+If no path is set, Tryton will use the schemes ``argon2``, ``scrypt``,
+``bcrypt`` or ``pbkdf2_sha512``.
 
 Default: ``None``
 

setup.py

@@ -171,6 +171,7 @@ setup(name=name,
         'graphviz': ['pydot'],
         'Levenshtein': ['python-Levenshtein'],
         'BCrypt': ['passlib[bcrypt]'],
+        'Argon2': ['passlib[argon2]'],
         'html2text': ['html2text'],
         'weasyprint': ['weasyprint'],
         'coroutine': ['gevent>=1.1'],

trytond/res/user.py

@@ -36,6 +36,10 @@ try:
     import bcrypt
 except ImportError:
     bcrypt = None
+try:
+    import argon2
+except ImportError:
+    argon2 = None
 
 from trytond.cache import Cache
 from trytond.config import config
@@ -66,6 +70,9 @@ else:
     schemes = ['pbkdf2_sha512']
     if bcrypt:
         schemes.insert(0, 'bcrypt')
+    schemes.insert(0, 'scrypt')
+    if argon2:
+        schemes.insert(0, 'argon2')
     CRYPT_CONTEXT = CryptContext(schemes=schemes)