PyOTP 1.4__tar.gz → 2.0.0__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- pyotp-2.0.0/MANIFEST.in +3 -0
- pyotp-2.0.0/PKG-INFO +130 -0
- pyotp-2.0.0/README.rst +110 -0
- pyotp-2.0.0/setup.cfg +8 -0
- pyotp-2.0.0/setup.py +33 -0
- pyotp-2.0.0/src/pyotp/__init__.py +18 -0
- {pyotp-1.4 → pyotp-2.0.0}/src/pyotp/hotp.py +40 -35
- {pyotp-1.4 → pyotp-2.0.0}/src/pyotp/otp.py +64 -54
- {pyotp-1.4 → pyotp-2.0.0}/src/pyotp/totp.py +58 -58
- pyotp-2.0.0/src/pyotp/utils.py +79 -0
- pyotp-2.0.0/src/pyotp.egg-info/PKG-INFO +130 -0
- pyotp-2.0.0/src/pyotp.egg-info/SOURCES.txt +16 -0
- pyotp-2.0.0/src/pyotp.egg-info/dependency_links.txt +1 -0
- pyotp-2.0.0/src/pyotp.egg-info/not-zip-safe +1 -0
- pyotp-2.0.0/src/pyotp.egg-info/top_level.txt +1 -0
- pyotp-2.0.0/test.py +171 -0
- pyotp-1.4/PKG-INFO +0 -10
- pyotp-1.4/README.markdown +0 -78
- pyotp-1.4/setup.py +0 -14
- pyotp-1.4/src/pyotp/__init__.py +0 -16
- pyotp-1.4/test.py +0 -89
- {pyotp-1.4 → pyotp-2.0.0}/LICENSE +0 -0
pyotp-2.0.0/MANIFEST.in
ADDED
pyotp-2.0.0/PKG-INFO
ADDED
|
@@ -0,0 +1,130 @@
|
|
|
1
|
+
Metadata-Version: 1.1
|
|
2
|
+
Name: pyotp
|
|
3
|
+
Version: 2.0.0
|
|
4
|
+
Summary: Python One Time Password Library
|
|
5
|
+
Home-page: https://github.com/pyotp/pyotp
|
|
6
|
+
Author: PyOTP contributors
|
|
7
|
+
Author-email: kislyuk@gmail.com
|
|
8
|
+
License: BSD License
|
|
9
|
+
Description: PyOTP - The Python One-Time Password Library
|
|
10
|
+
============================================
|
|
11
|
+
|
|
12
|
+
PyOTP is a Python library for generating and verifying one-time passwords. It can be used to implement two-factor (2FA)
|
|
13
|
+
or multi-factor (MFA) authentication methods in web applications and in other systems that require users to log in.
|
|
14
|
+
|
|
15
|
+
Open MFA standards are defined in `RFC 4226 <https://tools.ietf.org/html/rfc4226>`_ (HOTP: An HMAC-Based One-Time
|
|
16
|
+
Password Algorithm) and in `RFC 6238 <https://tools.ietf.org/html/rfc6238>`_ (TOTP: Time-Based One-Time Password
|
|
17
|
+
Algorithm). PyOTP implements server-side support for both of these standards. Client-side support can be enabled by
|
|
18
|
+
sending authentication codes to users over SMS or email (HOTP) or, for TOTP, by instructing users to use `Google
|
|
19
|
+
Authenticator <https://en.wikipedia.org/wiki/Google_Authenticator>`_, `Authy <https://www.authy.com/>`_, or another
|
|
20
|
+
compatible app. Users can set up auth tokens in their apps easily by using their phone camera to scan `otpauth://
|
|
21
|
+
<https://github.com/google/google-authenticator/wiki/Key-Uri-Format>`_ QR codes provided by PyOTP.
|
|
22
|
+
|
|
23
|
+
Quick overview of using One Time Passwords on your phone
|
|
24
|
+
--------------------------------------------------------
|
|
25
|
+
|
|
26
|
+
* OTPs involve a shared secret, stored both on the phone and the server
|
|
27
|
+
* OTPs can be generated on a phone without internet connectivity
|
|
28
|
+
* OTPs should always be used as a second factor of authentication(if your phone is lost, you account is still secured with a password)
|
|
29
|
+
* Google Authenticator allows you to store multiple OTP secrets and provision those using a QR Code(no more typing in the secret)
|
|
30
|
+
|
|
31
|
+
Installation
|
|
32
|
+
------------
|
|
33
|
+
::
|
|
34
|
+
|
|
35
|
+
pip install pyotp
|
|
36
|
+
|
|
37
|
+
Usage
|
|
38
|
+
-----
|
|
39
|
+
|
|
40
|
+
Time based OTPs
|
|
41
|
+
~~~~~~~~~~~~~~~
|
|
42
|
+
::
|
|
43
|
+
|
|
44
|
+
totp = pyotp.TOTP('base32secret3232')
|
|
45
|
+
totp.now() # => 492039
|
|
46
|
+
|
|
47
|
+
# OTP verified for current time
|
|
48
|
+
totp.verify(492039) # => True
|
|
49
|
+
time.sleep(30)
|
|
50
|
+
totp.verify(492039) # => False
|
|
51
|
+
|
|
52
|
+
Counter-based OTPs
|
|
53
|
+
~~~~~~~~~~~~~~~~~~
|
|
54
|
+
::
|
|
55
|
+
|
|
56
|
+
hotp = pyotp.HOTP('base32secret3232')
|
|
57
|
+
hotp.at(0) # => 260182
|
|
58
|
+
hotp.at(1) # => 55283
|
|
59
|
+
hotp.at(1401) # => 316439
|
|
60
|
+
|
|
61
|
+
# OTP verified with a counter
|
|
62
|
+
hotp.verify(316439, 1401) # => True
|
|
63
|
+
hotp.verify(316439, 1402) # => False
|
|
64
|
+
|
|
65
|
+
Generating a base32 Secret Key
|
|
66
|
+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
67
|
+
::
|
|
68
|
+
|
|
69
|
+
pyotp.random_base32() # returns a 16 character base32 secret. Compatible with Google Authenticator
|
|
70
|
+
|
|
71
|
+
Google Authenticator Compatible
|
|
72
|
+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
73
|
+
|
|
74
|
+
The library works with the Google Authenticator iPhone and Android app, and also includes the ability to generate
|
|
75
|
+
provisioning URI's for use with the QR Code scanner built into the app::
|
|
76
|
+
|
|
77
|
+
totp.provisioning_uri("alice@google.com") # => 'otpauth://totp/alice@google.com?secret=JBSWY3DPEHPK3PXP'
|
|
78
|
+
hotp.provisioning_uri("alice@google.com", 0) # => 'otpauth://hotp/alice@google.com?secret=JBSWY3DPEHPK3PXP&counter=0'
|
|
79
|
+
|
|
80
|
+
This can then be rendered as a QR Code which can then be scanned and added to the users list of OTP credentials.
|
|
81
|
+
|
|
82
|
+
Working example
|
|
83
|
+
~~~~~~~~~~~~~~~
|
|
84
|
+
|
|
85
|
+
Scan the following barcode with your phone, using Google Authenticator
|
|
86
|
+
|
|
87
|
+

|
|
88
|
+
|
|
89
|
+
Now run the following and compare the output::
|
|
90
|
+
|
|
91
|
+
import pyotp
|
|
92
|
+
totp = pyotp.TOTP("JBSWY3DPEHPK3PXP")
|
|
93
|
+
print "Current OTP: %s" % totp.now()
|
|
94
|
+
|
|
95
|
+
Links
|
|
96
|
+
~~~~~
|
|
97
|
+
|
|
98
|
+
* `Project home page (GitHub) <https://github.com/pyotp/pyotp>`_
|
|
99
|
+
* `Documentation (Read the Docs) <https://pyotp.readthedocs.org/en/latest/>`_
|
|
100
|
+
* `Package distribution (PyPI) <https://pypi.python.org/pypi/pyotp>`_
|
|
101
|
+
* `Change log <https://github.com/pyotp/pyotp/blob/master/Changes.rst>`_
|
|
102
|
+
* `RFC 4226: HOTP: An HMAC-Based One-Time Password <https://tools.ietf.org/html/rfc4226>`_
|
|
103
|
+
* `RFC 6238: TOTP: Time-Based One-Time Password Algorithm <https://tools.ietf.org/html/rfc6238>`_
|
|
104
|
+
* `ROTP <https://github.com/mdp/rotp>`_ - Original Ruby OTP library by `Mark Percival <https://github.com/mdp>`_
|
|
105
|
+
* `OTPHP <https://github.com/lelag/otphp>`_ - PHP port of ROTP by `Le Lag <https://github.com/lelag>`_
|
|
106
|
+
|
|
107
|
+
.. image:: https://img.shields.io/travis/pyotp/pyotp.svg
|
|
108
|
+
:target: https://travis-ci.org/pyotp/pyotp
|
|
109
|
+
.. image:: https://img.shields.io/coveralls/pyotp/pyotp.svg
|
|
110
|
+
:target: https://coveralls.io/r/pyotp/pyotp?branch=master
|
|
111
|
+
.. image:: https://img.shields.io/pypi/v/pyotp.svg
|
|
112
|
+
:target: https://pypi.python.org/pypi/pyotp
|
|
113
|
+
.. image:: https://img.shields.io/pypi/dm/pyotp.svg
|
|
114
|
+
:target: https://pypi.python.org/pypi/pyotp
|
|
115
|
+
.. image:: https://img.shields.io/pypi/l/pyotp.svg
|
|
116
|
+
:target: https://pypi.python.org/pypi/pyotp
|
|
117
|
+
.. image:: https://readthedocs.org/projects/pyotp/badge/?version=latest
|
|
118
|
+
:target: https://pyotp.readthedocs.org/
|
|
119
|
+
|
|
120
|
+
Platform: MacOS X
|
|
121
|
+
Platform: Posix
|
|
122
|
+
Classifier: Intended Audience :: Developers
|
|
123
|
+
Classifier: License :: OSI Approved :: BSD License
|
|
124
|
+
Classifier: Operating System :: MacOS :: MacOS X
|
|
125
|
+
Classifier: Operating System :: POSIX
|
|
126
|
+
Classifier: Programming Language :: Python
|
|
127
|
+
Classifier: Programming Language :: Python :: 2.7
|
|
128
|
+
Classifier: Programming Language :: Python :: 3.3
|
|
129
|
+
Classifier: Programming Language :: Python :: 3.4
|
|
130
|
+
Classifier: Topic :: Software Development :: Libraries :: Python Modules
|
pyotp-2.0.0/README.rst
ADDED
|
@@ -0,0 +1,110 @@
|
|
|
1
|
+
PyOTP - The Python One-Time Password Library
|
|
2
|
+
============================================
|
|
3
|
+
|
|
4
|
+
PyOTP is a Python library for generating and verifying one-time passwords. It can be used to implement two-factor (2FA)
|
|
5
|
+
or multi-factor (MFA) authentication methods in web applications and in other systems that require users to log in.
|
|
6
|
+
|
|
7
|
+
Open MFA standards are defined in `RFC 4226 <https://tools.ietf.org/html/rfc4226>`_ (HOTP: An HMAC-Based One-Time
|
|
8
|
+
Password Algorithm) and in `RFC 6238 <https://tools.ietf.org/html/rfc6238>`_ (TOTP: Time-Based One-Time Password
|
|
9
|
+
Algorithm). PyOTP implements server-side support for both of these standards. Client-side support can be enabled by
|
|
10
|
+
sending authentication codes to users over SMS or email (HOTP) or, for TOTP, by instructing users to use `Google
|
|
11
|
+
Authenticator <https://en.wikipedia.org/wiki/Google_Authenticator>`_, `Authy <https://www.authy.com/>`_, or another
|
|
12
|
+
compatible app. Users can set up auth tokens in their apps easily by using their phone camera to scan `otpauth://
|
|
13
|
+
<https://github.com/google/google-authenticator/wiki/Key-Uri-Format>`_ QR codes provided by PyOTP.
|
|
14
|
+
|
|
15
|
+
Quick overview of using One Time Passwords on your phone
|
|
16
|
+
--------------------------------------------------------
|
|
17
|
+
|
|
18
|
+
* OTPs involve a shared secret, stored both on the phone and the server
|
|
19
|
+
* OTPs can be generated on a phone without internet connectivity
|
|
20
|
+
* OTPs should always be used as a second factor of authentication(if your phone is lost, you account is still secured with a password)
|
|
21
|
+
* Google Authenticator allows you to store multiple OTP secrets and provision those using a QR Code(no more typing in the secret)
|
|
22
|
+
|
|
23
|
+
Installation
|
|
24
|
+
------------
|
|
25
|
+
::
|
|
26
|
+
|
|
27
|
+
pip install pyotp
|
|
28
|
+
|
|
29
|
+
Usage
|
|
30
|
+
-----
|
|
31
|
+
|
|
32
|
+
Time based OTPs
|
|
33
|
+
~~~~~~~~~~~~~~~
|
|
34
|
+
::
|
|
35
|
+
|
|
36
|
+
totp = pyotp.TOTP('base32secret3232')
|
|
37
|
+
totp.now() # => 492039
|
|
38
|
+
|
|
39
|
+
# OTP verified for current time
|
|
40
|
+
totp.verify(492039) # => True
|
|
41
|
+
time.sleep(30)
|
|
42
|
+
totp.verify(492039) # => False
|
|
43
|
+
|
|
44
|
+
Counter-based OTPs
|
|
45
|
+
~~~~~~~~~~~~~~~~~~
|
|
46
|
+
::
|
|
47
|
+
|
|
48
|
+
hotp = pyotp.HOTP('base32secret3232')
|
|
49
|
+
hotp.at(0) # => 260182
|
|
50
|
+
hotp.at(1) # => 55283
|
|
51
|
+
hotp.at(1401) # => 316439
|
|
52
|
+
|
|
53
|
+
# OTP verified with a counter
|
|
54
|
+
hotp.verify(316439, 1401) # => True
|
|
55
|
+
hotp.verify(316439, 1402) # => False
|
|
56
|
+
|
|
57
|
+
Generating a base32 Secret Key
|
|
58
|
+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
59
|
+
::
|
|
60
|
+
|
|
61
|
+
pyotp.random_base32() # returns a 16 character base32 secret. Compatible with Google Authenticator
|
|
62
|
+
|
|
63
|
+
Google Authenticator Compatible
|
|
64
|
+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
65
|
+
|
|
66
|
+
The library works with the Google Authenticator iPhone and Android app, and also includes the ability to generate
|
|
67
|
+
provisioning URI's for use with the QR Code scanner built into the app::
|
|
68
|
+
|
|
69
|
+
totp.provisioning_uri("alice@google.com") # => 'otpauth://totp/alice@google.com?secret=JBSWY3DPEHPK3PXP'
|
|
70
|
+
hotp.provisioning_uri("alice@google.com", 0) # => 'otpauth://hotp/alice@google.com?secret=JBSWY3DPEHPK3PXP&counter=0'
|
|
71
|
+
|
|
72
|
+
This can then be rendered as a QR Code which can then be scanned and added to the users list of OTP credentials.
|
|
73
|
+
|
|
74
|
+
Working example
|
|
75
|
+
~~~~~~~~~~~~~~~
|
|
76
|
+
|
|
77
|
+
Scan the following barcode with your phone, using Google Authenticator
|
|
78
|
+
|
|
79
|
+

|
|
80
|
+
|
|
81
|
+
Now run the following and compare the output::
|
|
82
|
+
|
|
83
|
+
import pyotp
|
|
84
|
+
totp = pyotp.TOTP("JBSWY3DPEHPK3PXP")
|
|
85
|
+
print "Current OTP: %s" % totp.now()
|
|
86
|
+
|
|
87
|
+
Links
|
|
88
|
+
~~~~~
|
|
89
|
+
|
|
90
|
+
* `Project home page (GitHub) <https://github.com/pyotp/pyotp>`_
|
|
91
|
+
* `Documentation (Read the Docs) <https://pyotp.readthedocs.org/en/latest/>`_
|
|
92
|
+
* `Package distribution (PyPI) <https://pypi.python.org/pypi/pyotp>`_
|
|
93
|
+
* `Change log <https://github.com/pyotp/pyotp/blob/master/Changes.rst>`_
|
|
94
|
+
* `RFC 4226: HOTP: An HMAC-Based One-Time Password <https://tools.ietf.org/html/rfc4226>`_
|
|
95
|
+
* `RFC 6238: TOTP: Time-Based One-Time Password Algorithm <https://tools.ietf.org/html/rfc6238>`_
|
|
96
|
+
* `ROTP <https://github.com/mdp/rotp>`_ - Original Ruby OTP library by `Mark Percival <https://github.com/mdp>`_
|
|
97
|
+
* `OTPHP <https://github.com/lelag/otphp>`_ - PHP port of ROTP by `Le Lag <https://github.com/lelag>`_
|
|
98
|
+
|
|
99
|
+
.. image:: https://img.shields.io/travis/pyotp/pyotp.svg
|
|
100
|
+
:target: https://travis-ci.org/pyotp/pyotp
|
|
101
|
+
.. image:: https://img.shields.io/coveralls/pyotp/pyotp.svg
|
|
102
|
+
:target: https://coveralls.io/r/pyotp/pyotp?branch=master
|
|
103
|
+
.. image:: https://img.shields.io/pypi/v/pyotp.svg
|
|
104
|
+
:target: https://pypi.python.org/pypi/pyotp
|
|
105
|
+
.. image:: https://img.shields.io/pypi/dm/pyotp.svg
|
|
106
|
+
:target: https://pypi.python.org/pypi/pyotp
|
|
107
|
+
.. image:: https://img.shields.io/pypi/l/pyotp.svg
|
|
108
|
+
:target: https://pypi.python.org/pypi/pyotp
|
|
109
|
+
.. image:: https://readthedocs.org/projects/pyotp/badge/?version=latest
|
|
110
|
+
:target: https://pyotp.readthedocs.org/
|
pyotp-2.0.0/setup.cfg
ADDED
pyotp-2.0.0/setup.py
ADDED
|
@@ -0,0 +1,33 @@
|
|
|
1
|
+
#!/usr/bin/env python
|
|
2
|
+
|
|
3
|
+
import os, glob
|
|
4
|
+
from setuptools import setup, find_packages
|
|
5
|
+
|
|
6
|
+
install_requires = [line.rstrip() for line in open(os.path.join(os.path.dirname(__file__), "requirements.txt"))]
|
|
7
|
+
|
|
8
|
+
setup(
|
|
9
|
+
name='pyotp',
|
|
10
|
+
version='2.0.0',
|
|
11
|
+
url='https://github.com/pyotp/pyotp',
|
|
12
|
+
license='BSD License',
|
|
13
|
+
author='PyOTP contributors',
|
|
14
|
+
author_email='kislyuk@gmail.com',
|
|
15
|
+
description='Python One Time Password Library',
|
|
16
|
+
long_description=open('README.rst').read(),
|
|
17
|
+
install_requires=install_requires,
|
|
18
|
+
packages=['pyotp'],
|
|
19
|
+
package_dir={'': 'src'},
|
|
20
|
+
platforms=['MacOS X', 'Posix'],
|
|
21
|
+
zip_safe=False,
|
|
22
|
+
classifiers=[
|
|
23
|
+
'Intended Audience :: Developers',
|
|
24
|
+
'License :: OSI Approved :: BSD License',
|
|
25
|
+
'Operating System :: MacOS :: MacOS X',
|
|
26
|
+
'Operating System :: POSIX',
|
|
27
|
+
'Programming Language :: Python',
|
|
28
|
+
'Programming Language :: Python :: 2.7',
|
|
29
|
+
'Programming Language :: Python :: 3.3',
|
|
30
|
+
'Programming Language :: Python :: 3.4',
|
|
31
|
+
'Topic :: Software Development :: Libraries :: Python Modules'
|
|
32
|
+
]
|
|
33
|
+
)
|
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
from __future__ import print_function, unicode_literals, division, absolute_import
|
|
2
|
+
|
|
3
|
+
import random as _random
|
|
4
|
+
|
|
5
|
+
from pyotp.hotp import HOTP
|
|
6
|
+
from pyotp.otp import OTP
|
|
7
|
+
from pyotp.totp import TOTP
|
|
8
|
+
from . import utils
|
|
9
|
+
|
|
10
|
+
VERSION = '1.4.2'
|
|
11
|
+
|
|
12
|
+
|
|
13
|
+
def random_base32(length=16, random=_random.SystemRandom(),
|
|
14
|
+
chars=list('ABCDEFGHIJKLMNOPQRSTUVWXYZ234567')):
|
|
15
|
+
return ''.join(
|
|
16
|
+
random.choice(chars)
|
|
17
|
+
for _ in range(length)
|
|
18
|
+
)
|
|
@@ -1,35 +1,40 @@
|
|
|
1
|
-
from
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
@
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
1
|
+
from __future__ import print_function, unicode_literals, division, absolute_import
|
|
2
|
+
|
|
3
|
+
from pyotp.otp import OTP
|
|
4
|
+
from pyotp import utils
|
|
5
|
+
|
|
6
|
+
|
|
7
|
+
class HOTP(OTP):
|
|
8
|
+
def at(self, count):
|
|
9
|
+
"""
|
|
10
|
+
Generates the OTP for the given count
|
|
11
|
+
@param [Integer] count counter
|
|
12
|
+
@returns [Integer] OTP
|
|
13
|
+
"""
|
|
14
|
+
return self.generate_otp(count)
|
|
15
|
+
|
|
16
|
+
def verify(self, otp, counter):
|
|
17
|
+
"""
|
|
18
|
+
Verifies the OTP passed in against the current time OTP
|
|
19
|
+
@param [String/Integer] otp the OTP to check against
|
|
20
|
+
@param [Integer] counter the counter of the OTP
|
|
21
|
+
"""
|
|
22
|
+
return utils.strings_equal(str(otp), str(self.at(counter)))
|
|
23
|
+
|
|
24
|
+
def provisioning_uri(self, name, initial_count=0, issuer_name=None):
|
|
25
|
+
"""
|
|
26
|
+
Returns the provisioning URI for the OTP
|
|
27
|
+
This can then be encoded in a QR Code and used
|
|
28
|
+
to provision the Google Authenticator app
|
|
29
|
+
@param [String] name of the account
|
|
30
|
+
@param [Integer] initial_count starting counter value, defaults to 0
|
|
31
|
+
@param [String] the name of the OTP issuer; this will be the
|
|
32
|
+
organization title of the OTP entry in Authenticator
|
|
33
|
+
@return [String] provisioning uri
|
|
34
|
+
"""
|
|
35
|
+
return utils.build_uri(
|
|
36
|
+
self.secret,
|
|
37
|
+
name,
|
|
38
|
+
initial_count=initial_count,
|
|
39
|
+
issuer_name=issuer_name,
|
|
40
|
+
)
|
|
@@ -1,54 +1,64 @@
|
|
|
1
|
-
import
|
|
2
|
-
|
|
3
|
-
import
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
self.
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
self.
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
1
|
+
from __future__ import print_function, unicode_literals, division, absolute_import
|
|
2
|
+
|
|
3
|
+
import base64
|
|
4
|
+
import hashlib
|
|
5
|
+
import hmac
|
|
6
|
+
|
|
7
|
+
|
|
8
|
+
class OTP(object):
|
|
9
|
+
def __init__(self, s, digits=6, digest=hashlib.sha1):
|
|
10
|
+
"""
|
|
11
|
+
@param [String] secret in the form of base32
|
|
12
|
+
@option options digits [Integer] (6)
|
|
13
|
+
Number of integers in the OTP
|
|
14
|
+
Google Authenticate only supports 6 currently
|
|
15
|
+
@option options digest [Callable] (hashlib.sha1)
|
|
16
|
+
Digest used in the HMAC
|
|
17
|
+
Google Authenticate only supports 'sha1' currently
|
|
18
|
+
@returns [OTP] OTP instantiation
|
|
19
|
+
"""
|
|
20
|
+
self.digits = digits
|
|
21
|
+
self.digest = digest
|
|
22
|
+
self.secret = s
|
|
23
|
+
|
|
24
|
+
def generate_otp(self, input):
|
|
25
|
+
"""
|
|
26
|
+
@param [Integer] input the number used seed the HMAC
|
|
27
|
+
Usually either the counter, or the computed integer
|
|
28
|
+
based on the Unix timestamp
|
|
29
|
+
"""
|
|
30
|
+
hmac_hash = hmac.new(
|
|
31
|
+
self.byte_secret(),
|
|
32
|
+
self.int_to_bytestring(input),
|
|
33
|
+
self.digest,
|
|
34
|
+
).digest()
|
|
35
|
+
|
|
36
|
+
hmac_hash = bytearray(hmac_hash)
|
|
37
|
+
offset = hmac_hash[-1] & 0xf
|
|
38
|
+
code = ((hmac_hash[offset] & 0x7f) << 24 |
|
|
39
|
+
(hmac_hash[offset + 1] & 0xff) << 16 |
|
|
40
|
+
(hmac_hash[offset + 2] & 0xff) << 8 |
|
|
41
|
+
(hmac_hash[offset + 3] & 0xff))
|
|
42
|
+
str_code = str(code % 10 ** self.digits)
|
|
43
|
+
while len(str_code) < self.digits:
|
|
44
|
+
str_code = '0' + str_code
|
|
45
|
+
|
|
46
|
+
return str_code
|
|
47
|
+
|
|
48
|
+
def byte_secret(self):
|
|
49
|
+
return base64.b32decode(self.secret, casefold=True)
|
|
50
|
+
|
|
51
|
+
@staticmethod
|
|
52
|
+
def int_to_bytestring(i, padding=8):
|
|
53
|
+
"""
|
|
54
|
+
Turns an integer to the OATH specified
|
|
55
|
+
bytestring, which is fed to the HMAC
|
|
56
|
+
along with the secret
|
|
57
|
+
"""
|
|
58
|
+
result = bytearray()
|
|
59
|
+
while i != 0:
|
|
60
|
+
result.append(i & 0xFF)
|
|
61
|
+
i >>= 8
|
|
62
|
+
# It's necessary to convert the final result from bytearray to bytes because
|
|
63
|
+
# the hmac functions in python 2.6 and 3.3 don't work with bytearray
|
|
64
|
+
return bytes(bytearray(reversed(result)).rjust(padding, b'\0'))
|
|
@@ -1,58 +1,58 @@
|
|
|
1
|
-
from
|
|
2
|
-
|
|
3
|
-
import
|
|
4
|
-
import
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
"""
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
"""
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
"""
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
def timecode(self, for_time):
|
|
57
|
-
i = time.mktime(for_time.timetuple())
|
|
58
|
-
return int(i / self.interval)
|
|
1
|
+
from __future__ import print_function, unicode_literals, division, absolute_import
|
|
2
|
+
|
|
3
|
+
import datetime
|
|
4
|
+
import time
|
|
5
|
+
|
|
6
|
+
from pyotp import utils
|
|
7
|
+
from pyotp.otp import OTP
|
|
8
|
+
|
|
9
|
+
|
|
10
|
+
class TOTP(OTP):
|
|
11
|
+
def __init__(self, *args, **kwargs):
|
|
12
|
+
"""
|
|
13
|
+
@option options [Integer] interval (30) the time interval in seconds
|
|
14
|
+
for OTP This defaults to 30 which is standard.
|
|
15
|
+
"""
|
|
16
|
+
self.interval = kwargs.pop('interval', 30)
|
|
17
|
+
super(TOTP, self).__init__(*args, **kwargs)
|
|
18
|
+
|
|
19
|
+
def at(self, for_time):
|
|
20
|
+
"""
|
|
21
|
+
Accepts either a Unix timestamp integer or a Time object.
|
|
22
|
+
Time objects will be adjusted to UTC automatically
|
|
23
|
+
@param [Time/Integer] time the time to generate an OTP for
|
|
24
|
+
"""
|
|
25
|
+
if not isinstance(for_time, datetime.datetime):
|
|
26
|
+
for_time = datetime.datetime.fromtimestamp(int(for_time))
|
|
27
|
+
return self.generate_otp(self.timecode(for_time))
|
|
28
|
+
|
|
29
|
+
def now(self):
|
|
30
|
+
"""
|
|
31
|
+
Generate the current time OTP
|
|
32
|
+
@return [Integer] the OTP as an integer
|
|
33
|
+
"""
|
|
34
|
+
return self.generate_otp(self.timecode(datetime.datetime.now()))
|
|
35
|
+
|
|
36
|
+
def verify(self, otp, for_time=None):
|
|
37
|
+
"""
|
|
38
|
+
Verifies the OTP passed in against the current time OTP
|
|
39
|
+
@param [String/Integer] otp the OTP to check against
|
|
40
|
+
"""
|
|
41
|
+
if for_time is None:
|
|
42
|
+
for_time = datetime.datetime.now()
|
|
43
|
+
|
|
44
|
+
return utils.strings_equal(str(otp), str(self.at(for_time)))
|
|
45
|
+
|
|
46
|
+
def provisioning_uri(self, name, issuer_name=None):
|
|
47
|
+
"""
|
|
48
|
+
Returns the provisioning URI for the OTP
|
|
49
|
+
This can then be encoded in a QR Code and used
|
|
50
|
+
to provision the Google Authenticator app
|
|
51
|
+
@param [String] name of the account
|
|
52
|
+
@return [String] provisioning uri
|
|
53
|
+
"""
|
|
54
|
+
return utils.build_uri(self.secret, name, issuer_name=issuer_name)
|
|
55
|
+
|
|
56
|
+
def timecode(self, for_time):
|
|
57
|
+
i = time.mktime(for_time.timetuple())
|
|
58
|
+
return int(i / self.interval)
|
|
@@ -0,0 +1,79 @@
|
|
|
1
|
+
from __future__ import print_function, unicode_literals, division, absolute_import
|
|
2
|
+
|
|
3
|
+
try:
|
|
4
|
+
from urllib.parse import quote
|
|
5
|
+
except ImportError:
|
|
6
|
+
from urllib import quote
|
|
7
|
+
|
|
8
|
+
|
|
9
|
+
def build_uri(secret, name, initial_count=None, issuer_name=None):
|
|
10
|
+
"""
|
|
11
|
+
Returns the provisioning URI for the OTP; works for either TOTP or HOTP.
|
|
12
|
+
|
|
13
|
+
This can then be encoded in a QR Code and used to provision the Google
|
|
14
|
+
Authenticator app.
|
|
15
|
+
|
|
16
|
+
For module-internal use.
|
|
17
|
+
|
|
18
|
+
See also:
|
|
19
|
+
http://code.google.com/p/google-authenticator/wiki/KeyUriFormat
|
|
20
|
+
|
|
21
|
+
@param [String] the hotp/totp secret used to generate the URI
|
|
22
|
+
@param [String] name of the account
|
|
23
|
+
@param [Integer] initial_count starting counter value, defaults to None.
|
|
24
|
+
If none, the OTP type will be assumed as TOTP.
|
|
25
|
+
@param [String] the name of the OTP issuer; this will be the
|
|
26
|
+
organization title of the OTP entry in Authenticator
|
|
27
|
+
@return [String] provisioning uri
|
|
28
|
+
"""
|
|
29
|
+
# initial_count may be 0 as a valid param
|
|
30
|
+
is_initial_count_present = (initial_count is not None)
|
|
31
|
+
|
|
32
|
+
otp_type = 'hotp' if is_initial_count_present else 'totp'
|
|
33
|
+
base = 'otpauth://%s/' % otp_type
|
|
34
|
+
|
|
35
|
+
if issuer_name:
|
|
36
|
+
issuer_name = quote(issuer_name)
|
|
37
|
+
base += '%s:' % issuer_name
|
|
38
|
+
|
|
39
|
+
uri = '%(base)s%(name)s?secret=%(secret)s' % {
|
|
40
|
+
'name': quote(name, safe='@'),
|
|
41
|
+
'secret': secret,
|
|
42
|
+
'base': base,
|
|
43
|
+
}
|
|
44
|
+
|
|
45
|
+
if is_initial_count_present:
|
|
46
|
+
uri += '&counter=%s' % initial_count
|
|
47
|
+
|
|
48
|
+
if issuer_name:
|
|
49
|
+
uri += '&issuer=%s' % issuer_name
|
|
50
|
+
|
|
51
|
+
return uri
|
|
52
|
+
|
|
53
|
+
|
|
54
|
+
def strings_equal(s1, s2):
|
|
55
|
+
"""
|
|
56
|
+
Timing-attack resistant string comparison.
|
|
57
|
+
|
|
58
|
+
Normal comparison using == will short-circuit on the first mismatching
|
|
59
|
+
character. This avoids that by scanning the whole string, though we
|
|
60
|
+
still reveal to a timing attack whether the strings are the same
|
|
61
|
+
length.
|
|
62
|
+
"""
|
|
63
|
+
try:
|
|
64
|
+
# Python 3.3+ and 2.7.7+ include a timing-attack-resistant
|
|
65
|
+
# comparison function, which is probably more reliable than ours.
|
|
66
|
+
# Use it if available.
|
|
67
|
+
from hmac import compare_digest
|
|
68
|
+
|
|
69
|
+
return compare_digest(s1, s2)
|
|
70
|
+
except ImportError:
|
|
71
|
+
pass
|
|
72
|
+
|
|
73
|
+
if len(s1) != len(s2):
|
|
74
|
+
return False
|
|
75
|
+
|
|
76
|
+
differences = 0
|
|
77
|
+
for c1, c2 in zip(s1, s2):
|
|
78
|
+
differences |= ord(c1) ^ ord(c2)
|
|
79
|
+
return differences == 0
|
|
@@ -0,0 +1,130 @@
|
|
|
1
|
+
Metadata-Version: 1.1
|
|
2
|
+
Name: pyotp
|
|
3
|
+
Version: 2.0.0
|
|
4
|
+
Summary: Python One Time Password Library
|
|
5
|
+
Home-page: https://github.com/pyotp/pyotp
|
|
6
|
+
Author: PyOTP contributors
|
|
7
|
+
Author-email: kislyuk@gmail.com
|
|
8
|
+
License: BSD License
|
|
9
|
+
Description: PyOTP - The Python One-Time Password Library
|
|
10
|
+
============================================
|
|
11
|
+
|
|
12
|
+
PyOTP is a Python library for generating and verifying one-time passwords. It can be used to implement two-factor (2FA)
|
|
13
|
+
or multi-factor (MFA) authentication methods in web applications and in other systems that require users to log in.
|
|
14
|
+
|
|
15
|
+
Open MFA standards are defined in `RFC 4226 <https://tools.ietf.org/html/rfc4226>`_ (HOTP: An HMAC-Based One-Time
|
|
16
|
+
Password Algorithm) and in `RFC 6238 <https://tools.ietf.org/html/rfc6238>`_ (TOTP: Time-Based One-Time Password
|
|
17
|
+
Algorithm). PyOTP implements server-side support for both of these standards. Client-side support can be enabled by
|
|
18
|
+
sending authentication codes to users over SMS or email (HOTP) or, for TOTP, by instructing users to use `Google
|
|
19
|
+
Authenticator <https://en.wikipedia.org/wiki/Google_Authenticator>`_, `Authy <https://www.authy.com/>`_, or another
|
|
20
|
+
compatible app. Users can set up auth tokens in their apps easily by using their phone camera to scan `otpauth://
|
|
21
|
+
<https://github.com/google/google-authenticator/wiki/Key-Uri-Format>`_ QR codes provided by PyOTP.
|
|
22
|
+
|
|
23
|
+
Quick overview of using One Time Passwords on your phone
|
|
24
|
+
--------------------------------------------------------
|
|
25
|
+
|
|
26
|
+
* OTPs involve a shared secret, stored both on the phone and the server
|
|
27
|
+
* OTPs can be generated on a phone without internet connectivity
|
|
28
|
+
* OTPs should always be used as a second factor of authentication(if your phone is lost, you account is still secured with a password)
|
|
29
|
+
* Google Authenticator allows you to store multiple OTP secrets and provision those using a QR Code(no more typing in the secret)
|
|
30
|
+
|
|
31
|
+
Installation
|
|
32
|
+
------------
|
|
33
|
+
::
|
|
34
|
+
|
|
35
|
+
pip install pyotp
|
|
36
|
+
|
|
37
|
+
Usage
|
|
38
|
+
-----
|
|
39
|
+
|
|
40
|
+
Time based OTPs
|
|
41
|
+
~~~~~~~~~~~~~~~
|
|
42
|
+
::
|
|
43
|
+
|
|
44
|
+
totp = pyotp.TOTP('base32secret3232')
|
|
45
|
+
totp.now() # => 492039
|
|
46
|
+
|
|
47
|
+
# OTP verified for current time
|
|
48
|
+
totp.verify(492039) # => True
|
|
49
|
+
time.sleep(30)
|
|
50
|
+
totp.verify(492039) # => False
|
|
51
|
+
|
|
52
|
+
Counter-based OTPs
|
|
53
|
+
~~~~~~~~~~~~~~~~~~
|
|
54
|
+
::
|
|
55
|
+
|
|
56
|
+
hotp = pyotp.HOTP('base32secret3232')
|
|
57
|
+
hotp.at(0) # => 260182
|
|
58
|
+
hotp.at(1) # => 55283
|
|
59
|
+
hotp.at(1401) # => 316439
|
|
60
|
+
|
|
61
|
+
# OTP verified with a counter
|
|
62
|
+
hotp.verify(316439, 1401) # => True
|
|
63
|
+
hotp.verify(316439, 1402) # => False
|
|
64
|
+
|
|
65
|
+
Generating a base32 Secret Key
|
|
66
|
+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
67
|
+
::
|
|
68
|
+
|
|
69
|
+
pyotp.random_base32() # returns a 16 character base32 secret. Compatible with Google Authenticator
|
|
70
|
+
|
|
71
|
+
Google Authenticator Compatible
|
|
72
|
+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
73
|
+
|
|
74
|
+
The library works with the Google Authenticator iPhone and Android app, and also includes the ability to generate
|
|
75
|
+
provisioning URI's for use with the QR Code scanner built into the app::
|
|
76
|
+
|
|
77
|
+
totp.provisioning_uri("alice@google.com") # => 'otpauth://totp/alice@google.com?secret=JBSWY3DPEHPK3PXP'
|
|
78
|
+
hotp.provisioning_uri("alice@google.com", 0) # => 'otpauth://hotp/alice@google.com?secret=JBSWY3DPEHPK3PXP&counter=0'
|
|
79
|
+
|
|
80
|
+
This can then be rendered as a QR Code which can then be scanned and added to the users list of OTP credentials.
|
|
81
|
+
|
|
82
|
+
Working example
|
|
83
|
+
~~~~~~~~~~~~~~~
|
|
84
|
+
|
|
85
|
+
Scan the following barcode with your phone, using Google Authenticator
|
|
86
|
+
|
|
87
|
+

|
|
88
|
+
|
|
89
|
+
Now run the following and compare the output::
|
|
90
|
+
|
|
91
|
+
import pyotp
|
|
92
|
+
totp = pyotp.TOTP("JBSWY3DPEHPK3PXP")
|
|
93
|
+
print "Current OTP: %s" % totp.now()
|
|
94
|
+
|
|
95
|
+
Links
|
|
96
|
+
~~~~~
|
|
97
|
+
|
|
98
|
+
* `Project home page (GitHub) <https://github.com/pyotp/pyotp>`_
|
|
99
|
+
* `Documentation (Read the Docs) <https://pyotp.readthedocs.org/en/latest/>`_
|
|
100
|
+
* `Package distribution (PyPI) <https://pypi.python.org/pypi/pyotp>`_
|
|
101
|
+
* `Change log <https://github.com/pyotp/pyotp/blob/master/Changes.rst>`_
|
|
102
|
+
* `RFC 4226: HOTP: An HMAC-Based One-Time Password <https://tools.ietf.org/html/rfc4226>`_
|
|
103
|
+
* `RFC 6238: TOTP: Time-Based One-Time Password Algorithm <https://tools.ietf.org/html/rfc6238>`_
|
|
104
|
+
* `ROTP <https://github.com/mdp/rotp>`_ - Original Ruby OTP library by `Mark Percival <https://github.com/mdp>`_
|
|
105
|
+
* `OTPHP <https://github.com/lelag/otphp>`_ - PHP port of ROTP by `Le Lag <https://github.com/lelag>`_
|
|
106
|
+
|
|
107
|
+
.. image:: https://img.shields.io/travis/pyotp/pyotp.svg
|
|
108
|
+
:target: https://travis-ci.org/pyotp/pyotp
|
|
109
|
+
.. image:: https://img.shields.io/coveralls/pyotp/pyotp.svg
|
|
110
|
+
:target: https://coveralls.io/r/pyotp/pyotp?branch=master
|
|
111
|
+
.. image:: https://img.shields.io/pypi/v/pyotp.svg
|
|
112
|
+
:target: https://pypi.python.org/pypi/pyotp
|
|
113
|
+
.. image:: https://img.shields.io/pypi/dm/pyotp.svg
|
|
114
|
+
:target: https://pypi.python.org/pypi/pyotp
|
|
115
|
+
.. image:: https://img.shields.io/pypi/l/pyotp.svg
|
|
116
|
+
:target: https://pypi.python.org/pypi/pyotp
|
|
117
|
+
.. image:: https://readthedocs.org/projects/pyotp/badge/?version=latest
|
|
118
|
+
:target: https://pyotp.readthedocs.org/
|
|
119
|
+
|
|
120
|
+
Platform: MacOS X
|
|
121
|
+
Platform: Posix
|
|
122
|
+
Classifier: Intended Audience :: Developers
|
|
123
|
+
Classifier: License :: OSI Approved :: BSD License
|
|
124
|
+
Classifier: Operating System :: MacOS :: MacOS X
|
|
125
|
+
Classifier: Operating System :: POSIX
|
|
126
|
+
Classifier: Programming Language :: Python
|
|
127
|
+
Classifier: Programming Language :: Python :: 2.7
|
|
128
|
+
Classifier: Programming Language :: Python :: 3.3
|
|
129
|
+
Classifier: Programming Language :: Python :: 3.4
|
|
130
|
+
Classifier: Topic :: Software Development :: Libraries :: Python Modules
|
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
LICENSE
|
|
2
|
+
MANIFEST.in
|
|
3
|
+
README.rst
|
|
4
|
+
setup.cfg
|
|
5
|
+
setup.py
|
|
6
|
+
test.py
|
|
7
|
+
src/pyotp/__init__.py
|
|
8
|
+
src/pyotp/hotp.py
|
|
9
|
+
src/pyotp/otp.py
|
|
10
|
+
src/pyotp/totp.py
|
|
11
|
+
src/pyotp/utils.py
|
|
12
|
+
src/pyotp.egg-info/PKG-INFO
|
|
13
|
+
src/pyotp.egg-info/SOURCES.txt
|
|
14
|
+
src/pyotp.egg-info/dependency_links.txt
|
|
15
|
+
src/pyotp.egg-info/not-zip-safe
|
|
16
|
+
src/pyotp.egg-info/top_level.txt
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
pyotp
|
pyotp-2.0.0/test.py
ADDED
|
@@ -0,0 +1,171 @@
|
|
|
1
|
+
#!/usr/bin/env python
|
|
2
|
+
|
|
3
|
+
from __future__ import print_function, unicode_literals, division, absolute_import
|
|
4
|
+
|
|
5
|
+
import base64
|
|
6
|
+
import datetime
|
|
7
|
+
import hashlib
|
|
8
|
+
import os
|
|
9
|
+
import sys
|
|
10
|
+
import unittest
|
|
11
|
+
|
|
12
|
+
sys.path.insert(0, os.path.join(os.path.dirname(__file__), 'src'))
|
|
13
|
+
import pyotp
|
|
14
|
+
|
|
15
|
+
|
|
16
|
+
class HOTPExampleValuesFromTheRFC(unittest.TestCase):
|
|
17
|
+
def testMatchTheRFC(self):
|
|
18
|
+
# 12345678901234567890 in Bas32
|
|
19
|
+
# GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ
|
|
20
|
+
hotp = pyotp.HOTP('GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ')
|
|
21
|
+
self.assertEqual(hotp.at(0), '755224')
|
|
22
|
+
self.assertEqual(hotp.at(1), '287082')
|
|
23
|
+
self.assertEqual(hotp.at(2), '359152')
|
|
24
|
+
self.assertEqual(hotp.at(3), '969429')
|
|
25
|
+
self.assertEqual(hotp.at(4), '338314')
|
|
26
|
+
self.assertEqual(hotp.at(5), '254676')
|
|
27
|
+
self.assertEqual(hotp.at(6), '287922')
|
|
28
|
+
self.assertEqual(hotp.at(7), '162583')
|
|
29
|
+
self.assertEqual(hotp.at(8), '399871')
|
|
30
|
+
self.assertEqual(hotp.at(9), '520489')
|
|
31
|
+
|
|
32
|
+
def testVerifyAnOTPAndNowAllowReuse(self):
|
|
33
|
+
hotp = pyotp.HOTP('GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ')
|
|
34
|
+
self.assertTrue(hotp.verify('520489', 9))
|
|
35
|
+
self.assertFalse(hotp.verify('520489', 10))
|
|
36
|
+
self.assertFalse(hotp.verify('520489', 10))
|
|
37
|
+
|
|
38
|
+
def testProvisioningURI(self):
|
|
39
|
+
hotp = pyotp.HOTP('wrn3pqx5uqxqvnqr')
|
|
40
|
+
|
|
41
|
+
self.assertEqual(
|
|
42
|
+
hotp.provisioning_uri('mark@percival'),
|
|
43
|
+
'otpauth://hotp/mark@percival?secret=wrn3pqx5uqxqvnqr&counter=0')
|
|
44
|
+
|
|
45
|
+
self.assertEqual(
|
|
46
|
+
hotp.provisioning_uri('mark@percival', initial_count=12),
|
|
47
|
+
'otpauth://hotp/mark@percival?secret=wrn3pqx5uqxqvnqr&counter=12')
|
|
48
|
+
|
|
49
|
+
self.assertEqual(
|
|
50
|
+
hotp.provisioning_uri('mark@percival', issuer_name='FooCorp!'),
|
|
51
|
+
'otpauth://hotp/FooCorp%21:mark@percival?secret=wrn3pqx5uqxqvnqr&counter=0&issuer=FooCorp%21')
|
|
52
|
+
|
|
53
|
+
|
|
54
|
+
class TOTPExampleValuesFromTheRFC(unittest.TestCase):
|
|
55
|
+
RFC_VALUES = {
|
|
56
|
+
(hashlib.sha1, b'12345678901234567890'): (
|
|
57
|
+
(59, '94287082'),
|
|
58
|
+
(1111111109, '07081804'),
|
|
59
|
+
(1111111111, '14050471'),
|
|
60
|
+
(1234567890, '89005924'),
|
|
61
|
+
(2000000000, '69279037'),
|
|
62
|
+
(20000000000, '65353130'),
|
|
63
|
+
),
|
|
64
|
+
|
|
65
|
+
(hashlib.sha256, b'12345678901234567890123456789012'): (
|
|
66
|
+
(59, 46119246),
|
|
67
|
+
(1111111109, '68084774'),
|
|
68
|
+
(1111111111, '67062674'),
|
|
69
|
+
(1234567890, '91819424'),
|
|
70
|
+
(2000000000, '90698825'),
|
|
71
|
+
(20000000000, '77737706'),
|
|
72
|
+
),
|
|
73
|
+
|
|
74
|
+
(hashlib.sha512, b'1234567890123456789012345678901234567890123456789012345678901234'): (
|
|
75
|
+
(59, 90693936),
|
|
76
|
+
(1111111109, '25091201'),
|
|
77
|
+
(1111111111, '99943326'),
|
|
78
|
+
(1234567890, '93441116'),
|
|
79
|
+
(2000000000, '38618901'),
|
|
80
|
+
(20000000000, '47863826'),
|
|
81
|
+
),
|
|
82
|
+
}
|
|
83
|
+
|
|
84
|
+
def testMatchTheRFC(self):
|
|
85
|
+
for digest, secret in self.RFC_VALUES:
|
|
86
|
+
totp = pyotp.TOTP(base64.b32encode(secret), 8, digest)
|
|
87
|
+
for utime, code in self.RFC_VALUES[(digest, secret)]:
|
|
88
|
+
value = totp.at(utime)
|
|
89
|
+
msg = "%s != %s (%s, time=%d)"
|
|
90
|
+
msg %= (value, code, digest().name, utime)
|
|
91
|
+
self.assertEqual(value, str(code), msg)
|
|
92
|
+
|
|
93
|
+
def testMatchTheRFCDigitLength(self):
|
|
94
|
+
totp = pyotp.TOTP('GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ')
|
|
95
|
+
self.assertEqual(totp.at(1111111111), '050471')
|
|
96
|
+
self.assertEqual(totp.at(1234567890), '005924')
|
|
97
|
+
self.assertEqual(totp.at(2000000000), '279037')
|
|
98
|
+
|
|
99
|
+
def testMatchTheGoogleAuthenticatorOutput(self):
|
|
100
|
+
totp = pyotp.TOTP('wrn3pqx5uqxqvnqr')
|
|
101
|
+
with Timecop(1297553958):
|
|
102
|
+
self.assertEqual(totp.now(), '102705')
|
|
103
|
+
|
|
104
|
+
def testValidateATimeBasedOTP(self):
|
|
105
|
+
totp = pyotp.TOTP('wrn3pqx5uqxqvnqr')
|
|
106
|
+
with Timecop(1297553958):
|
|
107
|
+
self.assertTrue(totp.verify('102705'))
|
|
108
|
+
self.assertTrue(totp.verify('102705'))
|
|
109
|
+
with Timecop(1297553958 + 30):
|
|
110
|
+
self.assertFalse(totp.verify('102705'))
|
|
111
|
+
|
|
112
|
+
def testValidateATimeBasedOTPWithDigitLength(self):
|
|
113
|
+
totp = pyotp.TOTP('GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ')
|
|
114
|
+
with Timecop(1111111111):
|
|
115
|
+
self.assertTrue(totp.verify('050471'))
|
|
116
|
+
with Timecop(1297553958 + 30):
|
|
117
|
+
self.assertFalse(totp.verify('050471'))
|
|
118
|
+
|
|
119
|
+
def testProvisioningURI(self):
|
|
120
|
+
totp = pyotp.TOTP('wrn3pqx5uqxqvnqr')
|
|
121
|
+
self.assertEqual(
|
|
122
|
+
totp.provisioning_uri('mark@percival'),
|
|
123
|
+
'otpauth://totp/mark@percival?secret=wrn3pqx5uqxqvnqr')
|
|
124
|
+
|
|
125
|
+
self.assertEqual(
|
|
126
|
+
totp.provisioning_uri('mark@percival', issuer_name='FooCorp!'),
|
|
127
|
+
'otpauth://totp/FooCorp%21:mark@percival?secret=wrn3pqx5uqxqvnqr&issuer=FooCorp%21')
|
|
128
|
+
|
|
129
|
+
def testRandomKeyGeneration(self):
|
|
130
|
+
self.assertEqual(len(pyotp.random_base32()), 16)
|
|
131
|
+
self.assertEqual(len(pyotp.random_base32(length=20)), 20)
|
|
132
|
+
|
|
133
|
+
|
|
134
|
+
class StringComparisonTest(unittest.TestCase):
|
|
135
|
+
def testComparisons(self):
|
|
136
|
+
self.assertTrue(pyotp.utils.strings_equal("", ""))
|
|
137
|
+
self.assertTrue(pyotp.utils.strings_equal("a", "a"))
|
|
138
|
+
self.assertTrue(pyotp.utils.strings_equal("a" * 1000, "a" * 1000))
|
|
139
|
+
|
|
140
|
+
self.assertFalse(pyotp.utils.strings_equal("", "a"))
|
|
141
|
+
self.assertFalse(pyotp.utils.strings_equal("a", ""))
|
|
142
|
+
self.assertFalse(pyotp.utils.strings_equal("a" * 999 + "b", "a" * 1000))
|
|
143
|
+
|
|
144
|
+
|
|
145
|
+
class Timecop(object):
|
|
146
|
+
"""
|
|
147
|
+
Half-assed clone of timecop.rb, just enough to pass our tests.
|
|
148
|
+
"""
|
|
149
|
+
|
|
150
|
+
def __init__(self, freeze_timestamp):
|
|
151
|
+
self.freeze_timestamp = freeze_timestamp
|
|
152
|
+
|
|
153
|
+
def __enter__(self):
|
|
154
|
+
self.real_datetime = datetime.datetime
|
|
155
|
+
datetime.datetime = self.frozen_datetime()
|
|
156
|
+
|
|
157
|
+
def __exit__(self, type, value, traceback):
|
|
158
|
+
datetime.datetime = self.real_datetime
|
|
159
|
+
|
|
160
|
+
def frozen_datetime(self):
|
|
161
|
+
class FrozenDateTime(datetime.datetime):
|
|
162
|
+
@classmethod
|
|
163
|
+
def now(cls, **kwargs):
|
|
164
|
+
return cls.fromtimestamp(timecop.freeze_timestamp)
|
|
165
|
+
|
|
166
|
+
timecop = self
|
|
167
|
+
return FrozenDateTime
|
|
168
|
+
|
|
169
|
+
|
|
170
|
+
if __name__ == '__main__':
|
|
171
|
+
unittest.main()
|
pyotp-1.4/PKG-INFO
DELETED
|
@@ -1,10 +0,0 @@
|
|
|
1
|
-
Metadata-Version: 1.0
|
|
2
|
-
Name: pyotp
|
|
3
|
-
Version: 1.4
|
|
4
|
-
Summary: https://github.com/nathforge/pyotp
|
|
5
|
-
Home-page: https://github.com/nathforge/pyotp
|
|
6
|
-
Author: Mark Percival (ported by Nathan Reynolds to Python)
|
|
7
|
-
Author-email: nath@nreynolds.co.uk
|
|
8
|
-
License: UNKNOWN
|
|
9
|
-
Description: UNKNOWN
|
|
10
|
-
Platform: UNKNOWN
|
pyotp-1.4/README.markdown
DELETED
|
@@ -1,78 +0,0 @@
|
|
|
1
|
-
# PYOTP - The Python One Time Password Library
|
|
2
|
-
|
|
3
|
-
A Python library for generating one time passwords according to[ RFC 4226 ](http://tools.ietf.org/html/rfc4226) and the [ HOTP RFC ](http://tools.ietf.org/html/draft-mraihi-totp-timebased-00), ported from Mark Percival's [ ROTP ](https://github.com/mdp/rotp).
|
|
4
|
-
|
|
5
|
-
This is compatible with Google Authenticator apps available for Android and iPhone, and now in use on GMail
|
|
6
|
-
|
|
7
|
-
## Quick overview of using One Time Passwords on your phone
|
|
8
|
-
|
|
9
|
-
* OTP's involve a shared secret, stored both on the phone and the server
|
|
10
|
-
* OTP's can be generated on a phone without internet connectivity(AT&T mode)
|
|
11
|
-
* OTP's should always be used as a second factor of authentication(if your phone is lost, you account is still secured with a password)
|
|
12
|
-
* Google Authenticator allows you to store multiple OTP secrets and provision those using a QR Code(no more typing in the secret)
|
|
13
|
-
|
|
14
|
-
## Installation
|
|
15
|
-
|
|
16
|
-
pip install pyotp
|
|
17
|
-
|
|
18
|
-
## Use
|
|
19
|
-
|
|
20
|
-
### Time based OTP's
|
|
21
|
-
|
|
22
|
-
totp = pyotp.TOTP('base32secret3232')
|
|
23
|
-
totp.now() # => 492039
|
|
24
|
-
|
|
25
|
-
# OTP verified for current time
|
|
26
|
-
totp.verify(492039) # => True
|
|
27
|
-
time.sleep(30)
|
|
28
|
-
totp.verify(492039) # => False
|
|
29
|
-
|
|
30
|
-
### Counter based OTP's
|
|
31
|
-
|
|
32
|
-
hotp = pyotp.HOTP('base32secret3232')
|
|
33
|
-
hotp.at(0) # => 260182
|
|
34
|
-
hotp.at(1) # => 55283
|
|
35
|
-
hotp.at(1401) # => 316439
|
|
36
|
-
|
|
37
|
-
# OTP verified with a counter
|
|
38
|
-
hotp.verify(316439, 1401) # => True
|
|
39
|
-
hotp.verify(316439, 1402) # => False
|
|
40
|
-
|
|
41
|
-
### Generating a Base32 Secret key
|
|
42
|
-
|
|
43
|
-
pyotp.random_base32() # returns a 16 character base32 secret. Compatible with Google Authenticator
|
|
44
|
-
|
|
45
|
-
### Google Authenticator Compatible
|
|
46
|
-
|
|
47
|
-
The library works with the Google Authenticator iPhone and Android app, and also
|
|
48
|
-
includes the ability to generate provisioning URI's for use with the QR Code scanner
|
|
49
|
-
built into the app.
|
|
50
|
-
|
|
51
|
-
totp.provisioning_uri("alice@google.com") # => 'otpauth://totp/alice@google.com?secret=JBSWY3DPEHPK3PXP'
|
|
52
|
-
hotp.provisioning_uri("alice@google.com", 0) # => 'otpauth://hotp/alice@google.com?secret=JBSWY3DPEHPK3PXP&counter=0'
|
|
53
|
-
|
|
54
|
-
This can then be rendered as a QR Code which can then be scanned and added to the users
|
|
55
|
-
list of OTP credentials.
|
|
56
|
-
|
|
57
|
-
#### Working example
|
|
58
|
-
|
|
59
|
-
Scan the following barcode with your phone, using Google Authenticator
|
|
60
|
-
|
|
61
|
-

|
|
62
|
-
|
|
63
|
-
Now run the following and compare the output
|
|
64
|
-
|
|
65
|
-
import pyotp
|
|
66
|
-
totp = pyotp.TOTP("JBSWY3DPEHPK3PXP")
|
|
67
|
-
print "Current OTP: %s" % totp.now()
|
|
68
|
-
|
|
69
|
-
### Changelog
|
|
70
|
-
|
|
71
|
-
####1.3.0
|
|
72
|
-
|
|
73
|
-
- Ported to Python
|
|
74
|
-
|
|
75
|
-
### See also:
|
|
76
|
-
|
|
77
|
-
Original Ruby version of ROTP by [Mark Percival](https://github.com/mdp) - [ROTP](https://github.com/mdp/rotp)
|
|
78
|
-
PHP port of ROTP by [Le Lag](https://github.com/lelag) - [OTPHP](https://github.com/lelag/otphp)
|
pyotp-1.4/setup.py
DELETED
|
@@ -1,14 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python
|
|
2
|
-
|
|
3
|
-
from distutils.core import setup
|
|
4
|
-
|
|
5
|
-
setup(
|
|
6
|
-
version='1.4',
|
|
7
|
-
url='https://github.com/nathforge/pyotp',
|
|
8
|
-
name='pyotp',
|
|
9
|
-
description='https://github.com/nathforge/pyotp',
|
|
10
|
-
author='Mark Percival (ported by Nathan Reynolds to Python)',
|
|
11
|
-
author_email='nath@nreynolds.co.uk',
|
|
12
|
-
packages=['pyotp'],
|
|
13
|
-
package_dir={'': 'src'},
|
|
14
|
-
)
|
pyotp-1.4/src/pyotp/__init__.py
DELETED
|
@@ -1,16 +0,0 @@
|
|
|
1
|
-
from pyotp.otp import OTP
|
|
2
|
-
from pyotp.hotp import HOTP
|
|
3
|
-
from pyotp.totp import TOTP
|
|
4
|
-
import base64
|
|
5
|
-
import random
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
VERSION = '1.3.0'
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
def random_base32(length=16, random=random.SystemRandom(),
|
|
12
|
-
chars=base64._b32alphabet.values()):
|
|
13
|
-
return ''.join(
|
|
14
|
-
random.choice(chars)
|
|
15
|
-
for i in xrange(length)
|
|
16
|
-
)
|
pyotp-1.4/test.py
DELETED
|
@@ -1,89 +0,0 @@
|
|
|
1
|
-
from __future__ import with_statement
|
|
2
|
-
import datetime
|
|
3
|
-
import os
|
|
4
|
-
import sys
|
|
5
|
-
import unittest
|
|
6
|
-
|
|
7
|
-
sys.path.insert(0, os.path.join(os.path.dirname(__file__), 'src'))
|
|
8
|
-
import pyotp
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
class HOTPExampleValuesFromTheRFC(unittest.TestCase):
|
|
12
|
-
def testMatchTheRFC(self):
|
|
13
|
-
# 12345678901234567890 in Bas32
|
|
14
|
-
# GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ
|
|
15
|
-
hotp = pyotp.HOTP('GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ')
|
|
16
|
-
self.assertEqual(hotp.at(0), 755224)
|
|
17
|
-
self.assertEqual(hotp.at(1), 287082)
|
|
18
|
-
self.assertEqual(hotp.at(2), 359152)
|
|
19
|
-
self.assertEqual(hotp.at(3), 969429)
|
|
20
|
-
self.assertEqual(hotp.at(4), 338314)
|
|
21
|
-
self.assertEqual(hotp.at(5), 254676)
|
|
22
|
-
self.assertEqual(hotp.at(6), 287922)
|
|
23
|
-
self.assertEqual(hotp.at(7), 162583)
|
|
24
|
-
self.assertEqual(hotp.at(8), 399871)
|
|
25
|
-
self.assertEqual(hotp.at(9), 520489)
|
|
26
|
-
|
|
27
|
-
def testVerifyAnOTPAndNowAllowReuse(self):
|
|
28
|
-
hotp = pyotp.HOTP('GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ')
|
|
29
|
-
self.assertTrue(hotp.verify(520489, 9))
|
|
30
|
-
self.assertFalse(hotp.verify(520489, 10))
|
|
31
|
-
self.assertFalse(hotp.verify("520489", 10))
|
|
32
|
-
|
|
33
|
-
def testProvisioningURI(self):
|
|
34
|
-
hotp = pyotp.HOTP('wrn3pqx5uqxqvnqr')
|
|
35
|
-
self.assertEqual(hotp.provisioning_uri('mark@percival'), 'otpauth://hotp/mark@percival?secret=wrn3pqx5uqxqvnqr&counter=0')
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
class TOTPExampleValuesFromTheRFC(unittest.TestCase):
|
|
39
|
-
def testMatchTheRFC(self):
|
|
40
|
-
totp = pyotp.TOTP('GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ')
|
|
41
|
-
self.assertEqual(totp.at(1111111111), 50471)
|
|
42
|
-
self.assertEqual(totp.at(1234567890), 5924)
|
|
43
|
-
self.assertEqual(totp.at(2000000000), 279037)
|
|
44
|
-
|
|
45
|
-
def testMatchTheGoogleAuthenticatorOutput(self):
|
|
46
|
-
totp = pyotp.TOTP('wrn3pqx5uqxqvnqr')
|
|
47
|
-
with Timecop(1297553958):
|
|
48
|
-
self.assertEqual(totp.now(), 102705)
|
|
49
|
-
|
|
50
|
-
def testValidateATimeBasedOTP(self):
|
|
51
|
-
totp = pyotp.TOTP('wrn3pqx5uqxqvnqr')
|
|
52
|
-
with Timecop(1297553958):
|
|
53
|
-
self.assertTrue(totp.verify(102705))
|
|
54
|
-
self.assertTrue(totp.verify("102705"))
|
|
55
|
-
with Timecop(1297553958 + 30):
|
|
56
|
-
self.assertFalse(totp.verify(102705))
|
|
57
|
-
|
|
58
|
-
def testProvisioningURI(self):
|
|
59
|
-
totp = pyotp.TOTP('wrn3pqx5uqxqvnqr')
|
|
60
|
-
self.assertEqual(totp.provisioning_uri('mark@percival'), 'otpauth://totp/mark@percival?secret=wrn3pqx5uqxqvnqr')
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
class Timecop(object):
|
|
64
|
-
"""
|
|
65
|
-
Half-assed clone of timecop.rb, just enough to pass our tests.
|
|
66
|
-
"""
|
|
67
|
-
|
|
68
|
-
def __init__(self, freeze_timestamp):
|
|
69
|
-
self.freeze_timestamp = freeze_timestamp
|
|
70
|
-
|
|
71
|
-
def __enter__(self):
|
|
72
|
-
self.real_datetime = datetime.datetime
|
|
73
|
-
datetime.datetime = self.frozen_datetime()
|
|
74
|
-
|
|
75
|
-
def __exit__(self, type, value, traceback):
|
|
76
|
-
datetime.datetime = self.real_datetime
|
|
77
|
-
|
|
78
|
-
def frozen_datetime(self):
|
|
79
|
-
class FrozenDateTime(datetime.datetime):
|
|
80
|
-
@classmethod
|
|
81
|
-
def now(cls):
|
|
82
|
-
return cls.fromtimestamp(timecop.freeze_timestamp)
|
|
83
|
-
|
|
84
|
-
timecop = self
|
|
85
|
-
return FrozenDateTime
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
if __name__ == '__main__':
|
|
89
|
-
unittest.main()
|
|
File without changes
|