[feat] use OpenSSL backend for scrypt if available

This needs OpenSSL >= 1.1, otherwise it will keep using the scrypt
dependency.

We should think about deprecating scrypt as a dependency when we can be
sure that the adoption of libssl 1.1 is wide enough. I think that at
some point (soledad 0.11 or so) we can drop the scrypt dependency, which
was being somehow problematic at times (the _scrypt.so was not appearing
when installing with pip, needed workarounds). From that moment on, we
can raise an error if an old libssl is found and no scrypt can be
imported - leaving that to the user/packager.

In debian stretch and afterwards, you can get that version by installing
libssl-dev

- Related: #8472

1 files changed, 33 insertions, 0 deletions

diff --git a/src/leap/soledad/client/_scrypt.py b/src/leap/soledad/client/_scrypt.py
new file mode 100644
index 00000000..2de3ab5e
--- /dev/null
+++ b/src/leap/soledad/client/_scrypt.py
@@ -0,0 +1,33 @@
+# -*- coding: utf-8 -*-
+# _scrypt.py
+# Copyright (C) 2017 LEAP Encryption Access Project
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+from cryptography.hazmat.backends.interfaces import ScryptBackend
+from cryptography.hazmat.backends import default_backend
+
+backend = default_backend()
+OPENSSL_HAS_SCRYPT = isinstance(backend, ScryptBackend)
+
+if OPENSSL_HAS_SCRYPT:
+    from cryptography.hazmat.primitives.kdf.scrypt import Scrypt
+
+    def hash(secret, salt, buflen=32):
+        return Scrypt(salt, buflen, 16384, 8, 1, backend).derive(secret)
+else:
+    import scrypt
+
+    def hash(secret, salt, buflen=32):
+        return scrypt.hash(secret, salt, buflen=buflen)