)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"e7d25c5749a4c40be58f4f313d25c708eea701d0","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"c5114a68_74bccc5c","updated":"2026-06-02 11:28:13.000000000","message":"In this patch there is a very useful functionality of rehashing secrets. This problem already came up a couple times with other algorithm changes.\n\nI am wondering if the patch could be broken up into two separate patches - one for the rehashing functionality and one for the increase of iterations.","commit_id":"940fc312df7d9f23f2cbd2df13e5e15854a7ce2d"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"b3a0c0e3288e186752addddfe056e5faef7d5664","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"b489a1e5_e5a85958","in_reply_to":"c5114a68_74bccc5c","updated":"2026-06-03 10:18:28.000000000","message":"Good point, @b.bobrov@sap.com, agreed. I\u0027ll split this into two patches:\n\n1. Patch 1: Add transparent password rehashing on login (needs_rehash() + _rehash_password() in authenticate(), covering both iteration-count upgrades and algorithm changes).\n\n2. Patch 2: Increase PBKDF2-SHA512 default iterations to 600,000 (depends on patch 1 for the transparent upgrade path).\n\nI\u0027ll resubmit as a series later on.","commit_id":"940fc312df7d9f23f2cbd2df13e5e15854a7ce2d"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"ee80876e91bc7383a20aba662e671c56a6300744","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"8f346af3_68312bed","updated":"2026-06-11 16:16:01.000000000","message":"recheck","commit_id":"015f553df726415cbc2cb78ae1a831e4aa519b8c"}],"keystone/tests/unit/common/test_password_hashing.py":[{"author":{"_account_id":34120,"name":"Andre Aranha","display_name":"afariasa","email":"afariasa@redhat.com","username":"afariasa"},"change_message_id":"c54439c54111eaed1dfea106b3df53699bfc67b0","unresolved":true,"context_lines":[{"line_number":139,"context_line":"        self.assertFalse(password_hashing.needs_rehash(\"\"))"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"    def test_pbkdf2_sha512_default_rounds_is_owasp_recommendation(self):"},{"line_number":142,"context_line":"        self.assertEqual(600000, pbkdf2.DEFAULT_ROUNDS)"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"    def test_pbkdf2_sha512_hash_embeds_iteration_count(self):"},{"line_number":145,"context_line":"        hashed \u003d pbkdf2.Sha512.hash(b\"password\", rounds\u003d600000)"}],"source_content_type":"text/x-python","patch_set":5,"id":"85a42e7a_fe948571","line":142,"updated":"2026-07-22 12:42:13.000000000","message":"Do we need these tests here? Since they are hard coded next time we update the default rounds we will need to remember to also update here, and I don\u0027t think they add anything to this change.","commit_id":"b75ee7ffd955b8d31f792de89a6832860d9b9d6e"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"10943b5c3f730eec0f9e0db64de00db09e54975f","unresolved":false,"context_lines":[{"line_number":139,"context_line":"        self.assertFalse(password_hashing.needs_rehash(\"\"))"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"    def test_pbkdf2_sha512_default_rounds_is_owasp_recommendation(self):"},{"line_number":142,"context_line":"        self.assertEqual(600000, pbkdf2.DEFAULT_ROUNDS)"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"    def test_pbkdf2_sha512_hash_embeds_iteration_count(self):"},{"line_number":145,"context_line":"        hashed \u003d pbkdf2.Sha512.hash(b\"password\", rounds\u003d600000)"}],"source_content_type":"text/x-python","patch_set":5,"id":"1d32136e_b6ef47ba","line":142,"in_reply_to":"85a42e7a_fe948571","updated":"2026-07-29 10:24:55.000000000","message":"Agreed, removed in the next patchset. The existing tests using `pbkdf2.DEFAULT_ROUNDS` and `rounds\u003d10000` already cover both sides (current iterations don\u0027t trigger rehash, low iterations do), so these hardcoded assertions were redundant.","commit_id":"b75ee7ffd955b8d31f792de89a6832860d9b9d6e"}]}