[feat] use OpenSSL backend for scrypt if available

This needs OpenSSL >= 1.1, otherwise it will keep using the scrypt
dependency.

We should think about deprecating scrypt as a dependency when we can be
sure that the adoption of libssl 1.1 is wide enough. I think that at
some point (soledad 0.11 or so) we can drop the scrypt dependency, which
was being somehow problematic at times (the _scrypt.so was not appearing
when installing with pip, needed workarounds). From that moment on, we
can raise an error if an old libssl is found and no scrypt can be
imported - leaving that to the user/packager.

In debian stretch and afterwards, you can get that version by installing
libssl-dev

- Related: #8472

2 files changed, 5 insertions, 6 deletions

diff --git a/src/leap/soledad/client/_secrets/__init__.py b/src/leap/soledad/client/_secrets/__init__.py
index b6c81cda..c92b9905 100644
--- a/src/leap/soledad/client/_secrets/__init__.py
+++ b/src/leap/soledad/client/_secrets/__init__.py
@@ -16,13 +16,13 @@
 # along with this program. If not, see <http://www.gnu.org/licenses/>.
 
 import os
-import scrypt
 
 from leap.soledad.common.log import getLogger
 
 from leap.soledad.client._secrets.storage import SecretsStorage
 from leap.soledad.client._secrets.crypto import SecretsCrypto
 from leap.soledad.client._secrets.util import emit, UserDataMixin
+from leap.soledad.client import _scrypt
 
 
 logger = getLogger(__name__)
@@ -121,9 +121,8 @@ class Secrets(UserDataMixin):
     def local_key(self):
         # local storage key is scrypt-derived from `local_secret` and
         # `local_salt` above
-        secret = scrypt.hash(
-            password=self.local_secret,
+        return _scrypt.hash(
+            self.local_secret,
             salt=self.local_salt,
             buflen=32,  # we need a key with 256 bits (32 bytes)
         )
-        return secret
diff --git a/src/leap/soledad/client/_secrets/crypto.py b/src/leap/soledad/client/_secrets/crypto.py
index 8148151d..975b790b 100644
--- a/src/leap/soledad/client/_secrets/crypto.py
+++ b/src/leap/soledad/client/_secrets/crypto.py
@@ -18,13 +18,13 @@
 import binascii
 import json
 import os
-import scrypt
 
 from leap.soledad.common import soledad_assert
 from leap.soledad.common.log import getLogger
 
 from leap.soledad.client._crypto import encrypt_sym, decrypt_sym, ENC_METHOD
 from leap.soledad.client._secrets.util import SecretsError
+from leap.soledad.client import _scrypt
 
 
 logger = getLogger(__name__)
@@ -39,7 +39,7 @@ class SecretsCrypto(object):
 
     def _get_key(self, salt):
         passphrase = self._soledad.passphrase.encode('utf8')
-        key = scrypt.hash(passphrase, salt, buflen=32)
+        key = _scrypt.hash(passphrase, salt, buflen=32)
         return key
 
     #