litellm - 💡(How to fix) Fix FIPS compliance of hash algo scrypt [1 participants]

Summary

• After the supply chain attack, among the security measures taken, one was to use scrypt for internal user password hashing.
• In a FIPS-enforced environment, the underlying OpenSSL provider refuses to execute scrypt, causing internal-user creation and username/password login to fail at runtime with errors like: ValueError: [digital envelope routines] unsupported

Affected Versions

• Latest releases, including v1.83.14-stable have this issue.

Reproduction

• Run LiteLLM on FIPS enforced hosts.
• The issue can be observed while onboarding new internal users, or logging in with existing internal users.
• Admin login works without any issue.

Expected Behavior

• LiteLLM should support a FIPS-compliant password hashing scheme so that the proxy can be deployed in FIPS-enforced environments without runtime errors.

Proposed Solution

• Use hashlib.pbkdf2_hmac instead of hashlib.scrypt