DEV Community

[Comment from a deleted post]
Collapse
 
paragoniescott profile image
Scott Arciszewski • Edited

It has to do with the mapping of infinity -> 2512, then 2512 -> (some value smaller than 2512), etc.

The easy patch is to concatenate the original password with pass_hash before passing back to passlib.

The correct patch is to use HMAC-SHA3 instead of just SHA3.