@tiran: I'm not sure about what I wrote: "the C implementation is safer". I don't know the rationale for removing the pure Python implementation. The docstring says that the Python implement is faster for long passwords. The deprecation message seems to say that the OpenSSL implementation is faster. So the removal is about performance, not safety?

@tiran: I'm not sure about what I wrote: "the C implementation is safer".

I replaced it with: "is faster" :-)

In this case faster is safer!

Please update documentation, too.

Please update documentation, too.

I updated the doc and I included your test change. Please review again.

PR rebased to fix a conflict on Doc/whatsnew/3.12.rst.

@tiran: Would you mind to review the completed PR? (updated doc)

PEP 399 says that we should have a pure python version when possible. That said if there is bona fide security risk, then it should be removed.

Also, do you know if PyPy relies on the pure python version or does it too build with OpenSSL?

PEP 399 says that we should have a pure python version when possible. That said if there is bona fide security risk, then it should be removed.

PyPy gets the C implementation of pbkdf2_hmac() from OpenSSL: https://foss.heptapod.net/pypy/pypy/-/blob/branch/py3.9/lib_pypy/_hashlib/__init__.py#L205

It has the same Python fallack implementation if the C implementation is missing: https://foss.heptapod.net/pypy/pypy/-/blob/branch/py3.9/lib-python/3/hashlib.py#L192

But I guess that the C implementaiton is always available on OpenSSL 1.1.1 and newer.