bcb-0024

# BigCodeBench/24

Implement a file **`solution.py`** that completes the function below. Keep the given name and signature; define `task_func` at module level.

Allowed libraries: `base64`, `hashlib`, `os`.

```python
import base64
import hashlib
import os

def task_func(password, SALT_LENGTH = 32):
    """
    Hashes a password using the PBKDF2 HMAC algorithm with SHA-256 as the hashing algorithm, 
    combined with a randomly generated salt, and returns both the salt and the hashed password, 
    each base64-encoded.

    Parameters:
    password (str): The password to be hashed.
    SALT_LENGTH (int): the length of the randomly generated salt.

    Returns:
    tuple[bytes, bytes]: A tuple containing the base64-encoded salt and the base64-encoded hashed password as byte strings.

    Raises:
    ValueError if the password is None or empty

    Requirements:
    - base64
    - hashlib
    - os

    Example:
    >>> salt, hashed_password = task_func('my_password')
    >>> isinstance(salt, bytes)
    True
    >>> isinstance(hashed_password, bytes)
    True
    """
```

<!-- imported from BigCodeBench (BigCodeBench/24) -->

# Auto-generated from BigCodeBench BigCodeBench/24. Do not edit by hand.
import pathlib as _pathlib
exec(_pathlib.Path(__file__).with_name("solution.py").read_text(), globals())

import unittest
import base64
import hashlib
import os
class TestCases(unittest.TestCase):
    def decode_and_regenerate_password(self, encoded_salt, encoded_hashed_password, original_password):
        """ Helper function to decode base64 encoded salt and password, and regenerate the hashed password. """
        decoded_salt = base64.b64decode(encoded_salt)
        decoded_hashed_password = base64.b64decode(encoded_hashed_password)
        regenerated_hashed_password = hashlib.pbkdf2_hmac('sha256', original_password.encode(), decoded_salt, 100000)
        return regenerated_hashed_password, decoded_hashed_password
    def test_case_1(self):
        """ Testing with a simple password """
        salt, hashed_password = task_func('password123')
        self.assertTrue(isinstance(salt, bytes) and isinstance(hashed_password, bytes))
        regenerated, original = self.decode_and_regenerate_password(salt, hashed_password, 'password123')
        self.assertEqual(regenerated, original)
    def test_case_2(self):
        """ Testing with a password containing special characters """
        salt, hashed_password = task_func('p@ssw0rd$%^&*')
        self.assertTrue(isinstance(salt, bytes) and isinstance(hashed_password, bytes))
        regenerated, original = self.decode_and_regenerate_password(salt, hashed_password, 'p@ssw0rd$%^&*')
        self.assertEqual(regenerated, original)
    def test_case_3(self):
        """ Testing with a long password """
        long_password = 'a' * 1000
        salt, hashed_password = task_func(long_password)
        self.assertTrue(isinstance(salt, bytes) and isinstance(hashed_password, bytes))
        regenerated, original = self.decode_and_regenerate_password(salt, hashed_password, long_password)
        self.assertEqual(regenerated, original)
    def test_case_4(self):
        """ Testing with a short password """
        short_password = 'a'
        salt, hashed_password = task_func(short_password)
        self.assertTrue(isinstance(salt, bytes) and isinstance(hashed_password, bytes))
        regenerated, original = self.decode_and_regenerate_password(salt, hashed_password, short_password)
        self.assertEqual(regenerated, original)
    def test_case_5(self):
        """ Testing with a password that is a number """
        number_password = '1234567890'
        salt, hashed_password = task_func(number_password)
        self.assertTrue(isinstance(salt, bytes) and isinstance(hashed_password, bytes))
        regenerated, original = self.decode_and_regenerate_password(salt, hashed_password, number_password)
        self.assertEqual(regenerated, original)
    def test_invalid_input(self):
        """ Testing with invalid input such as None or empty string """
        with self.assertRaises(ValueError):
            task_func(None)

You are an expert programmer. Solve the task exactly as specified. Output your solution as fenced code blocks using the required file name(s) and the exact function/type signatures requested. Prefer correctness; do not include prose outside code unless asked.

To solve this problem, we need to implement a function that hashes a given password using the PBKDF2 HMAC algorithm with SHA-256 as the hashing algorithm. The function should also generate a random salt of a specified length, and return both the salt and the hashed password, each base64-encoded.

### Approach
1. **Input Validation**: Check if the provided password is valid (not None or empty). If not, raise a ValueError.
2. **Salt Generation**: Use the `os.urandom` function to generate a random salt of the specified length.
3. **Password Hashing**: Use the `hashlib.pbkdf2_hmac` function to hash the password with the generated salt, using SHA-256 as the hashing algorithm. A fixed number of iterations (100,000) is used for hashing to ensure security.
4. **Base64 Encoding**: Encode both the salt and the hashed password using base64 encoding to convert them into byte strings.
5. **Return Values**: Return a tuple containing the base64-encoded salt and the base64-encoded hashed password.

### Solution Code
```python
import base64
import hashlib
import os

def task_func(password, SALT_LENGTH=32):
    """
    Hashes a password using the PBKDF2 HMAC algorithm with SHA-256 as the hashing algorithm, 
    combined with a randomly generated salt, and returns both the salt and the hashed password, 
    each base64-encoded.

    Parameters:
    password (str): The password to be hashed.
    SALT_LENGTH (int): the length of the randomly generated salt.

    Returns:
    tuple[bytes, bytes]: A tuple containing the base64-encoded salt and the base64-encoded hashed password as byte strings.

    Raises:
    ValueError if the password is None or empty
    """
    if not password:
        raise ValueError("Password cannot be None or empty.")
    
    # Generate a random salt
    salt = os.urandom(SALT_LENGTH)
    
    # Compute the PBKDF2-HMAC-SHA256 hash
    hashed_password = hashlib.pbkdf2_hmac(
        'sha256',
        password.encode('utf-8'),
        salt,
        100000  # iterations
    )
    
    # Base64 encode the salt and hashed password
    salt_b64 = base64.b64encode(salt)
    hashed_b64 = base64.b64encode(hashed_password)
    
    return (salt_b64, hashed_b64)
```

### Explanation
- **Input Validation**: The function first checks if the password is valid. If it is None or an empty string, a ValueError is raised.
- **Salt Generation**: The salt is generated using `os.urandom`, which provides a secure source of random bytes.
- **Hashing**: The password is hashed using PBKDF2 with SHA-256, which is a secure method for password hashing. The number of iterations is set to 100,000 to ensure the hashing process is computationally intensive and secure.
- **Base64 Encoding**: Both the salt and the hashed password are converted to base64-encoded byte strings to facilitate storage and transmission.

This approach ensures that the password is securely hashed and the salt is randomly generated, providing a robust security mechanism.

Okay, I need to implement the task_func function as described. Let's see what the function is supposed to do.

The function takes a password and an optional SALT_LENGTH, which defaults to 32. It should hash the password using PBKDF2 with HMAC SHA-256. Then, it should generate a random salt of the given length, and return both the salt and the hashed password, each base64-encoded as bytes.

First, I should check if the password is valid. The function raises a ValueError if the password is None or empty. So, I'll add a condition at the beginning to check if password is None or len(password) == 0. If so, raise ValueError.

Next, I need to generate a random salt. The salt length is given by SALT_LENGTH. Since the allowed libraries include os, I can use the os.urandom function to generate random bytes. So, salt = os.urandom(SALT_LENGTH). That should give me a bytes object of the specified length.

Then, I need to hash the password using PBKDF2. The parameters for PBKDF2 are: algorithm='sha256', salt, iterations, and the password. How many iterations should I use? Well, the example doesn't specify, but in practice, a higher number of iterations is better for security. Maybe 100,000 iterations is a good default. So, I'll set iterations=100000.

Wait, but the function doesn't specify the number of iterations in the parameters. So, I'll hardcode it, perhaps as a constant. Or maybe the function should allow it as a parameter? The problem statement doesn't mention it, so I'll proceed with a default of 100,000.

So, using hashlib's pbkdf2_hmac function. The syntax is hashlib.pbkdf2_hmac(algorithm, password, salt, iterations, dklen). What's dklen? It's the length of the derived key. Since we're using SHA-256, the output will be 32 bytes, which is the standard. So, dklen=32.

Putting it together: hashed = hashlib.pbkdf2_hmac('sha256', password.encode(), salt, 100000, 32). Wait, but wait: the password is a string, so I need to encode it. So, password.encode()—what encoding? The default is utf-8, which should be fine.

Once I have the salt and the hashed password, I need to base64 encode both. But base64.b64encode takes bytes and returns bytes. So, I'll encode each:

salt_b64 = base64.b64encode(salt)
hashed_b64 = base64.b64encode(hashed)

Wait, no. Wait, the salt is already in bytes, so base64 encoding it is correct. The hashed password is also in bytes, so same thing.

So, the function will return a tuple of (salt_b64, hashed_b64), both as bytes.

Putting it all together:

- Check if password is invalid.
- Generate salt.
- Compute PBKDF2 hash.
- Base64 encode both.
- Return the tuple.

Wait, but what about the encoding of the password? For example, if the password has non-ASCII characters, using encode() without specifying the encoding might cause issues. But the problem statement says the password is a string, so perhaps it's expected to encode it as utf-8.

So, the steps in code:

def task_func(password, SALT_LENGTH=32):
    if not password or len(password) == 0:
        raise ValueError("Password cannot be None or empty.")
    # Generate salt
    salt = os.urandom(SALT_LENGTH)
    # Compute hash
    hashed = hashlib.pbkdf2_hmac('sha256', password.encode('utf-8'), salt, 100000, 32)
    # Encode to base64
    salt_b64 = base64.b64encode(salt)
    hashed_b64 = base64.b64encode(hashed)
    return (salt_b64, hashed_b64)

Wait, but wait: the function is supposed to return a tuple of bytes. The base64 functions return bytes, so that's correct.

Testing the example: when called with 'my_password', it returns salt and hashed_password as bytes. The isinstance checks should pass.

What about edge cases? For example, if SALT_LENGTH is zero? Well, the function allows SALT_LENGTH as a parameter, but the default is 32. But if someone passes 0, os.urandom(0) would return an empty bytes object. Is that acceptable? Well, the problem statement says SALT_LENGTH is the length, so perhaps it's assumed to be positive. But the function doesn't check that. Hmm, but the function's docstring says SALT_LENGTH is the length of the randomly generated salt, so perhaps it's expected that it's a positive integer. So, the function may not handle cases where SALT_LENGTH is zero or negative, but that's beyond the scope of the problem.

Another point: the function uses a fixed number of iterations. It's common practice to use a high number, like 100,000, but sometimes people use more. But the problem statement doesn't specify, so 100,000 is acceptable.

So, the code should look like that.