Passwords and secret tokens for web apps

# Ten stolen records, stored in three ways. Five accounts have a password that a person chose from a list of likely
# passwords, and five have a token that the server made. A thief tries the same twelve likely passwords on every record.
# Every value is invented for this lab, and the PBKDF2 rounds are lab-sized: real settings are far higher.
import hashlib
import hmac
import secrets

LIKELY = [
    "teapot-9", "blue-moon-1", "sun-flower-3", "river-stone", "paper-kite-7", "lemon-tree-2",
    "north-star-5", "green-door-8", "silver-fish", "summer-rain-4", "quiet-owl-6", "brick-road-1",
]
CHOSEN = [2, 7, 2, 9, 4]  # which likely password each of the five accounts chose; accounts 0 and 2 chose the same one
ROUNDS = 2_000


def sha256(text):
    return hashlib.sha256(text.encode()).digest()


def kdf(password, salt, rounds):
    """PBKDF2-HMAC-SHA-256 with a 32-byte result. hashlib.pbkdf2_hmac does it where the runtime has it; the same steps are
    written out for a browser runtime, which does not."""
    if hasattr(hashlib, "pbkdf2_hmac"):
        return hashlib.pbkdf2_hmac("sha256", password, salt, rounds, 32)
    base = hmac.new(password, digestmod="sha256")
    first = base.copy()
    first.update(salt)
    first.update(b"\x00\x00\x00\x01")
    block = first.digest()
    total = int.from_bytes(block, "big")
    for _ in range(1, rounds):
        step = base.copy()
        step.update(block)
        block = step.digest()
        total ^= int.from_bytes(block, "big")
    return total.to_bytes(32, "big")


def pbkdf2(text, salt):
    return kdf(text.encode(), salt, ROUNDS)


def salted(text):
    """A record with its own random salt, as a password store keeps it."""
    salt = secrets.token_bytes(16)
    return salt, pbkdf2(text, salt)


passwords = [LIKELY[i] for i in CHOSEN]
tokens = [secrets.token_urlsafe(32) for _ in range(5)]

plain_passwords = [sha256(p) for p in passwords]
salted_passwords = [salted(p) for p in passwords]
hashed_tokens = [sha256(t) for t in tokens]

# The thief hashes each guess once and looks it up in the whole table, because nothing is salted.
guess_hashes = {sha256(g): g for g in LIKELY}
opened_plain = sum(h in guess_hashes for h in plain_passwords)
calls_plain = len(LIKELY)
opened_tokens = sum(h in guess_hashes for h in hashed_tokens)

# With a salt per record, every guess must be hashed again for every record.
opened_salted = sum(any(pbkdf2(g, salt) == h for g in LIKELY) for salt, h in salted_passwords)
calls_salted = len(salted_passwords) * len(LIKELY) * ROUNDS

print(f"{'stored as':<42}{'different values':>17}{'hash calls':>12}  opened")
print(f"{'password, plain SHA-256':<42}{len(set(plain_passwords)):>17}{calls_plain:>12,}  {opened_plain} of 5")
print(f"{'password, salted PBKDF2, 2,000 rounds':<42}{len({h for _, h in salted_passwords}):>17}{calls_salted:>12,}  {opened_salted} of 5")
print(f"{'token, plain SHA-256':<42}{len(set(hashed_tokens)):>17}{calls_plain:>12,}  {opened_tokens} of 5")

BAR = 100_000
print(f"\nbar for a password table: at least {BAR:,} hash calls for the list")
print(f"  plain SHA-256 meets it: {calls_plain >= BAR}; salted PBKDF2 meets it: {calls_salted >= BAR}")
print(f"bar for a token table: no token opened: {opened_tokens == 0}")

stored as                                  different values  hash calls  opened
password, plain SHA-256                                   4          12  5 of 5
password, salted PBKDF2, 2,000 rounds                     5     120,000  5 of 5
token, plain SHA-256                                      5          12  0 of 5

bar for a password table: at least 100,000 hash calls for the list
  plain SHA-256 meets it: False; salted PBKDF2 meets it: True
bar for a token table: no token opened: True