Use a global variable to adjust the number of bits used to generate the salt.

IPython/lib/security.py

@@ -5,6 +5,10 b' Password generation for the IPython notebook.'
 import hashlib
 import random
 
+# Length of the salt in nr of hex chars, which implies salt_len * 4
+# bits of randomness.
+salt_len = 12
+
 def passwd(passphrase, algorithm='sha1'):
     """Generate hashed password and salt for use in notebook configuration.
 
@@ -31,7 +35,7 b" def passwd(passphrase, algorithm='sha1'):"
 
     """
     h = hashlib.new(algorithm)
-    salt = '%04x' % random.getrandbits(16)
+    salt = ('%0' + str(salt_len) + 'x') % random.getrandbits(4 * salt_len)
     h.update(passphrase + salt)
 
     return ':'.join((algorithm, salt, h.hexdigest()))
@@ -74,7 +78,7 b' def passwd_check(hashed_passphrase, passphrase):'
     except ValueError:
         return False
 
-    if len(pw_digest) == 0 or len(salt) != 4:
+    if len(pw_digest) == 0 or len(salt) != salt_len:
         return False
 
     h.update(passphrase + salt)

IPython/lib/tests/test_security.py

@@ -1,12 +1,12 b''
 from IPython.lib import passwd
-from IPython.lib.security import passwd_check
+from IPython.lib.security import passwd_check, salt_len
 import nose.tools as nt
 
 def test_passwd_structure():
     p = passwd('passphrase')
     algorithm, salt, hashed = p.split(':')
     nt.assert_equals(algorithm, 'sha1')
-    nt.assert_equals(len(salt), 4)
+    nt.assert_equals(len(salt), salt_len)
     nt.assert_equals(len(hashed), 40)
 
 def test_roundtrip():