MediumPro challengePython

Fix Weak Password Hashing

PythonSecurityCryptography

The function below "hashes" passwords with plain, unsalted MD5 — fast, and completely broken for password storage.

The bug: MD5 was designed to be *fast* — the opposite of what you want for password hashing. Modern GPUs compute billions of MD5 hashes per second, making brute-force and rainbow-table attacks trivial. Worse, with no salt, two users with the same password get the *same* hash, and a single precomputed rainbow table cracks every account in the database at once.

Your task: fix hash_password(password, salt) to use hashlib.pbkdf2_hmac — a deliberately *slow*, salted key-derivation function — with at least 100,000 iterations.

solve then checks that your fix has the properties a real password hash needs: correct output length, deterministic given the same password+salt, sensitive to the salt, and different from the naive MD5 hash.

Sample tests

Test #1Common weak password, distinct salts
Input: ["hunter2","00112233445566778899aabbccddeeff","ffffffffffffffffffffffffffffffff"]
Output: {"length_ok":true,"deterministic":true,"not_plain_md5":true,"salt_changes_output":true}
Test #2Longer passphrase, distinct salts
Input: ["correct horse battery staple","aa11bb22cc33dd44ee55ff6600112233","bb22cc33dd44ee55ff660011223344aa"]
Output: {"length_ok":true,"deterministic":true,"not_plain_md5":true,"salt_changes_output":true}
Test #3Password with mixed symbols and digits
Input: ["P@ssw0rd!123","11111111111111111111111111111111","22222222222222222222222222222222"]
Output: {"length_ok":true,"deterministic":true,"not_plain_md5":true,"salt_changes_output":true}