#862009 pbkdf2_bin() is incomplete, pbkdf2_hex() completly broken

#862009#5
Date:
2017-05-07 12:08:40 UTC
From:
To:
pbkdf2_bin() doesn't have arguments to configure the number of
iterations and the key length, which renders it completely useless.

pbkdf2_hex() has these arguments, but always fails with a TypeError
(even if iterations and keylen are not given) since it tries to pass
them to pbkdf2_bin() which does not support them.
I did not check whether this is an upstream bug, or Debian specific.
But either way I suggest to implement the "iterations" and "keylen"
arguments for pbkdf2_bin().

Alternatively, you might want to consider just removing this package
from Debian. In its current state, it just causes any package that
might depend on it, being broken as well. And a PBKDF2 implementation
in plain Python isn't very useful in the first place, as with any
reasonable amount of iterations, it will run unreasonably long.

#862009#10
Date:
2024-11-29 07:52:20 UTC
From:
To:
Hi,

the package python3-pbkdf2 used to be on collab-maint on Alioth but was
not uploaded by the maintainer since the migration to Salsa.  Thus I
took the liberty to not migrate to the debian/ team but rather to Debian
Python team where the package sensibly belongs to.[1]

It seems upstream is inactive since there was no response on sensible
PRs (I applied one as a quilt patch).

I addressed this bug report in README.Debian[2] mentioning the option
for a removal of the package.  You might like to bump the severity of
this bug if you think this should happen even before Trixie release.

Kind regards
   Andreas.

[1] https://salsa.debian.org/python-team/packages/python-pbkdf2
[2] https://salsa.debian.org/python-team/packages/python-pbkdf2/-/blob/master/debian/README.Debian?ref_type=heads