[issue2551145] consider adding scrypt or argon2 for password hashing to replace pbkdf2

New submission from John Rouillard:

Time marches on and pbkdf2 isn't as resilient against GPU processors.
Increasing the rounds will help but consider adding scrypt if the
module (https://pypi.org/project/scrypt/) is available.

At this time scrypt supports python 2.7 and 3.6+.

Consider argon2 as well https://pypi.org/project/argon2-cffi/. Simiar 
language support to scrypt.

ref:
https://medium.com/analytics-vidhya/password-hashing-pbkdf2-scrypt-
bcrypt-and-argon2-e25aaf41598e
https://stackoverflow.com/questions/4433216/password-hashing-pbkdf2-
using-sha512-x-1000-vs-bcrypt

----------
components: Database
messages: 7289
nosy: rouilj
severity: normal
status: new
title: consider adding scrypt or argon2 for password hashing to replace pbkdf2
type: security

_________________________________________________
Roundup tracker <[email protected]>
<https://issues.roundup-tracker.org/issue2551145>
_________________________________________________