PyOTP 2.1.1__tar.gz → 2.2.4__tar.gz

{pyotp-2.1.1 → pyotp-2.2.4}/LICENSE

@@ -1,6 +1,5 @@
-Copyright (C) 2011 by Mark Percival <m@mdp.im>
-
-Python port copyright 2011 by Nathan Reynolds <email@nreynolds.co.uk>
+Copyright (C) 2011-2016 Mark Percival <m@mdp.im>,
+Nathan Reynolds <email@nreynolds.co.uk>, and PyOTP contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -18,4 +17,4 @@ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
+THE SOFTWARE.

{pyotp-2.1.1/src/pyotp.egg-info → pyotp-2.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 1.1
 Name: pyotp
-Version: 2.1.1
+Version: 2.2.4
 Summary: Python One Time Password Library
 Home-page: https://github.com/pyotp/pyotp
 Author: PyOTP contributors
@@ -20,6 +20,8 @@ Description: PyOTP - The Python One-Time Password Library
         compatible app. Users can set up auth tokens in their apps easily by using their phone camera to scan `otpauth://
         <https://github.com/google/google-authenticator/wiki/Key-Uri-Format>`_ QR codes provided by PyOTP.
         
+        We recommend that implementers read the `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_ and `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of authentication best practices.
+        
         Quick overview of using One Time Passwords on your phone
         --------------------------------------------------------
         
@@ -84,13 +86,13 @@ Description: PyOTP - The Python One-Time Password Library
         
         Scan the following barcode with your phone, using Google Authenticator
         
-        ![QR Code for OTP](http://chart.apis.google.com/chart?cht=qr&chs=250x250&chl=otpauth%3A%2F%2Ftotp%2Falice%40google.com%3Fsecret%3DJBSWY3DPEHPK3PXP)
+        .. image:: http://chart.apis.google.com/chart?cht=qr&chs=250x250&chl=otpauth%3A%2F%2Ftotp%2Falice%40google.com%3Fsecret%3DJBSWY3DPEHPK3PXP
         
         Now run the following and compare the output::
         
             import pyotp
             totp = pyotp.TOTP("JBSWY3DPEHPK3PXP")
-            print "Current OTP: %s" % totp.now()
+            print("Current OTP:", totp.now())
         
         Links
         ~~~~~
@@ -103,15 +105,15 @@ Description: PyOTP - The Python One-Time Password Library
         * `RFC 6238: TOTP: Time-Based One-Time Password Algorithm <https://tools.ietf.org/html/rfc6238>`_
         * `ROTP <https://github.com/mdp/rotp>`_ - Original Ruby OTP library by `Mark Percival <https://github.com/mdp>`_
         * `OTPHP <https://github.com/lelag/otphp>`_ - PHP port of ROTP by `Le Lag <https://github.com/lelag>`_
+        * `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_
+        * `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_
         
         .. image:: https://img.shields.io/travis/pyotp/pyotp.svg
                 :target: https://travis-ci.org/pyotp/pyotp
-        .. image:: https://img.shields.io/coveralls/pyotp/pyotp.svg
-                :target: https://coveralls.io/r/pyotp/pyotp?branch=master
+        .. image:: https://img.shields.io/codecov/c/github/pyotp/pyotp/master.svg
+                :target: https://codecov.io/github/pyotp/pyotp?branch=master
         .. image:: https://img.shields.io/pypi/v/pyotp.svg
                 :target: https://pypi.python.org/pypi/pyotp
-        .. image:: https://img.shields.io/pypi/dm/pyotp.svg
-                :target: https://pypi.python.org/pypi/pyotp
         .. image:: https://img.shields.io/pypi/l/pyotp.svg
                 :target: https://pypi.python.org/pypi/pyotp
         .. image:: https://readthedocs.org/projects/pyotp/badge/?version=latest

{pyotp-2.1.1 → pyotp-2.2.4}/README.rst

@@ -12,6 +12,8 @@ Authenticator <https://en.wikipedia.org/wiki/Google_Authenticator>`_, `Authy <ht
 compatible app. Users can set up auth tokens in their apps easily by using their phone camera to scan `otpauth://
 <https://github.com/google/google-authenticator/wiki/Key-Uri-Format>`_ QR codes provided by PyOTP.
 
+We recommend that implementers read the `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_ and `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of authentication best practices.
+
 Quick overview of using One Time Passwords on your phone
 --------------------------------------------------------
 
@@ -76,13 +78,13 @@ Working example
 
 Scan the following barcode with your phone, using Google Authenticator
 
-![QR Code for OTP](http://chart.apis.google.com/chart?cht=qr&chs=250x250&chl=otpauth%3A%2F%2Ftotp%2Falice%40google.com%3Fsecret%3DJBSWY3DPEHPK3PXP)
+.. image:: http://chart.apis.google.com/chart?cht=qr&chs=250x250&chl=otpauth%3A%2F%2Ftotp%2Falice%40google.com%3Fsecret%3DJBSWY3DPEHPK3PXP
 
 Now run the following and compare the output::
 
     import pyotp
     totp = pyotp.TOTP("JBSWY3DPEHPK3PXP")
-    print "Current OTP: %s" % totp.now()
+    print("Current OTP:", totp.now())
 
 Links
 ~~~~~
@@ -95,15 +97,15 @@ Links
 * `RFC 6238: TOTP: Time-Based One-Time Password Algorithm <https://tools.ietf.org/html/rfc6238>`_
 * `ROTP <https://github.com/mdp/rotp>`_ - Original Ruby OTP library by `Mark Percival <https://github.com/mdp>`_
 * `OTPHP <https://github.com/lelag/otphp>`_ - PHP port of ROTP by `Le Lag <https://github.com/lelag>`_
+* `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_
+* `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_
 
 .. image:: https://img.shields.io/travis/pyotp/pyotp.svg
         :target: https://travis-ci.org/pyotp/pyotp
-.. image:: https://img.shields.io/coveralls/pyotp/pyotp.svg
-        :target: https://coveralls.io/r/pyotp/pyotp?branch=master
+.. image:: https://img.shields.io/codecov/c/github/pyotp/pyotp/master.svg
+        :target: https://codecov.io/github/pyotp/pyotp?branch=master
 .. image:: https://img.shields.io/pypi/v/pyotp.svg
         :target: https://pypi.python.org/pypi/pyotp
-.. image:: https://img.shields.io/pypi/dm/pyotp.svg
-        :target: https://pypi.python.org/pypi/pyotp
 .. image:: https://img.shields.io/pypi/l/pyotp.svg
         :target: https://pypi.python.org/pypi/pyotp
 .. image:: https://readthedocs.org/projects/pyotp/badge/?version=latest

{pyotp-2.1.1 → pyotp-2.2.4}/setup.cfg

@@ -1,6 +1,10 @@
 [bdist_wheel]
 universal = 1
 
+[flake8]
+max-line-length = 120
+ignore = E301, E302, E305, E401, E226, F841
+
 [egg_info]
 tag_build = 
 tag_date = 0

pyotp-2.2.4/setup.py

@@ -0,0 +1,34 @@
+#!/usr/bin/env python
+
+import os
+from setuptools import setup
+
+install_requires = [line.rstrip() for line in open(os.path.join(os.path.dirname(__file__), "requirements.txt"))]
+
+setup(
+    name="pyotp",
+    version="2.2.4",
+    url="https://github.com/pyotp/pyotp",
+    license="BSD License",
+    author="PyOTP contributors",
+    author_email="kislyuk@gmail.com",
+    description="Python One Time Password Library",
+    long_description=open("README.rst").read(),
+    install_requires=install_requires,
+    packages=["pyotp"],
+    package_dir={"": "src"},
+    platforms=["MacOS X", "Posix"],
+    zip_safe=False,
+    test_suite="test",
+    classifiers=[
+        "Intended Audience :: Developers",
+        "License :: OSI Approved :: BSD License",
+        "Operating System :: MacOS :: MacOS X",
+        "Operating System :: POSIX",
+        "Programming Language :: Python",
+        "Programming Language :: Python :: 2.7",
+        "Programming Language :: Python :: 3.3",
+        "Programming Language :: Python :: 3.4",
+        "Topic :: Software Development :: Libraries :: Python Modules"
+    ]
+)

pyotp-2.2.4/src/pyotp/__init__.py

@@ -0,0 +1,17 @@
+from __future__ import (absolute_import, division,
+                        print_function, unicode_literals)
+
+import random as _random
+
+from pyotp.hotp import HOTP  # noqa
+from pyotp.otp import OTP  # noqa
+from pyotp.totp import TOTP  # noqa
+from . import utils  # noqa
+
+
+def random_base32(length=16, random=_random.SystemRandom(),
+                  chars=list('ABCDEFGHIJKLMNOPQRSTUVWXYZ234567')):
+    return ''.join(
+        random.choice(chars)
+        for _ in range(length)
+    )

pyotp-2.2.4/src/pyotp/compat.py

@@ -0,0 +1,10 @@
+from __future__ import absolute_import, division, print_function, unicode_literals
+
+import sys
+
+USING_PYTHON2 = True if sys.version_info < (3, 0) else False
+
+if USING_PYTHON2:
+    str = unicode  # noqa
+else:
+    str = str

{pyotp-2.1.1 → pyotp-2.2.4}/src/pyotp/hotp.py

@@ -1,8 +1,8 @@
-from __future__ import print_function, unicode_literals, division, absolute_import
+from __future__ import absolute_import, division, print_function, unicode_literals
 
-from pyotp.otp import OTP
-from pyotp import utils
-from future.builtins import str
+from . import utils
+from .otp import OTP
+from .compat import str
 
 class HOTP(OTP):
     def at(self, count):
@@ -37,4 +37,6 @@ class HOTP(OTP):
             name,
             initial_count=initial_count,
             issuer_name=issuer_name,
+            algorithm=self.digest().name,
+            digits=self.digits
         )

{pyotp-2.1.1 → pyotp-2.2.4}/src/pyotp/otp.py

@@ -1,9 +1,9 @@
-from __future__ import print_function, unicode_literals, division, absolute_import
+from __future__ import absolute_import, division, print_function, unicode_literals
 
 import base64
 import hashlib
 import hmac
-from future.builtins import str
+from .compat import str
 
 class OTP(object):
     def __init__(self, s, digits=6, digest=hashlib.sha1):
@@ -27,13 +27,8 @@ class OTP(object):
         Usually either the counter, or the computed integer
         based on the Unix timestamp
         """
-        hmac_hash = hmac.new(
-            self.byte_secret(),
-            self.int_to_bytestring(input),
-            self.digest,
-        ).digest()
-
-        hmac_hash = bytearray(hmac_hash)
+        hasher = hmac.new(self.byte_secret(), self.int_to_bytestring(input), self.digest)
+        hmac_hash = bytearray(hasher.digest())
         offset = hmac_hash[-1] & 0xf
         code = ((hmac_hash[offset] & 0x7f) << 24 |
                 (hmac_hash[offset + 1] & 0xff) << 16 |
@@ -62,6 +57,7 @@ class OTP(object):
         while i != 0:
             result.append(i & 0xFF)
             i >>= 8
-        # It's necessary to convert the final result from bytearray to bytes because
-        # the hmac functions in python 2.6 and 3.3 don't work with bytearray
+        # It's necessary to convert the final result from bytearray to bytes
+        # because the hmac functions in python 2.6 and 3.3 don't work with
+        # bytearray
         return bytes(bytearray(reversed(result)).rjust(padding, b'\0'))

{pyotp-2.1.1 → pyotp-2.2.4}/src/pyotp/totp.py

@@ -1,11 +1,11 @@
-from __future__ import print_function, unicode_literals, division, absolute_import
+from __future__ import absolute_import, division, print_function, unicode_literals
 
 import datetime
 import time
 
-from pyotp import utils
-from pyotp.otp import OTP
-from future.builtins import str
+from . import utils
+from .otp import OTP
+from .compat import str
 
 class TOTP(OTP):
     def __init__(self, *args, **kwargs):
@@ -19,9 +19,9 @@ class TOTP(OTP):
     def at(self, for_time, counter_offset=0):
         """
         Accepts either a Unix timestamp integer or a Time object.
-        Time objects will be adjusted to UTC automatically
         @param [Time/Integer] time the time to generate an OTP for
-        @param [Integer] counter_offset an amount of ticks to add to the time counter 
+        @param [Integer] counter_offset an amount of ticks to add to the time
+            counter
         """
         if not isinstance(for_time, datetime.datetime):
             for_time = datetime.datetime.fromtimestamp(int(for_time))
@@ -38,11 +38,12 @@ class TOTP(OTP):
         """
         Verifies the OTP passed in against the current time OTP
         @param [String/Integer] otp the OTP to check against
-        @param [Integer] valid_window extends the validity to this many counter ticks before and after the current one
+        @param [Integer] valid_window extends the validity to this many counter
+            ticks before and after the current one
         """
         if for_time is None:
             for_time = datetime.datetime.now()
-        
+
         if valid_window:
             for i in range(-valid_window, valid_window + 1):
                 if utils.strings_equal(str(otp), str(self.at(for_time, i))):
@@ -59,7 +60,9 @@ class TOTP(OTP):
         @param [String] name of the account
         @return [String] provisioning uri
         """
-        return utils.build_uri(self.secret, name, issuer_name=issuer_name)
+        return utils.build_uri(self.secret, name, issuer_name=issuer_name,
+                               algorithm=self.digest().name,
+                               digits=self.digits, period=self.interval)
 
     def timecode(self, for_time):
         i = time.mktime(for_time.timetuple())

pyotp-2.2.4/src/pyotp/utils.py

@@ -0,0 +1,101 @@
+from __future__ import absolute_import, division, print_function, unicode_literals
+
+import unicodedata
+try:
+    from itertools import izip_longest
+except ImportError:
+    from itertools import zip_longest as izip_longest
+
+try:
+    from urllib.parse import quote, urlencode
+except ImportError:
+    from urllib import quote, urlencode
+
+
+def build_uri(secret, name, initial_count=None, issuer_name=None,
+              algorithm=None, digits=None, period=None):
+    """
+    Returns the provisioning URI for the OTP; works for either TOTP or HOTP.
+
+    This can then be encoded in a QR Code and used to provision the Google
+    Authenticator app.
+
+    For module-internal use.
+
+    See also:
+        https://github.com/google/google-authenticator/wiki/Key-Uri-Format
+
+    @param [String] the hotp/totp secret used to generate the URI
+    @param [String] name of the account
+    @param [Integer] initial_count starting counter value, defaults to None.
+        If none, the OTP type will be assumed as TOTP.
+    @param [String] the name of the OTP issuer; this will be the
+        organization title of the OTP entry in Authenticator
+    @param [String] the algorithm used in the OTP generation.
+    @param [Integer] the length of the OTP generated code.
+    @param [Integer] the number of seconds the OTP generator is set to
+        expire every code.
+    @return [String] provisioning uri
+    """
+    # initial_count may be 0 as a valid param
+    is_initial_count_present = (initial_count is not None)
+
+    # Handling values different from defaults
+    is_algorithm_set = (algorithm is not None and algorithm != 'sha1')
+    is_digits_set = (digits is not None and digits != 6)
+    is_period_set = (period is not None and period != 30)
+
+    otp_type = 'hotp' if is_initial_count_present else 'totp'
+    base_uri = 'otpauth://{0}/{1}?{2}'
+
+    url_args = {'secret': secret}
+
+    label = quote(name)
+    if issuer_name is not None:
+        label = quote(issuer_name) + ':' + label
+        url_args['issuer'] = issuer_name
+
+    if is_initial_count_present:
+        url_args['counter'] = initial_count
+    if is_algorithm_set:
+        url_args['algorithm'] = algorithm.upper()
+    if is_digits_set:
+        url_args['digits'] = digits
+    if is_period_set:
+        url_args['period'] = period
+
+    uri = base_uri.format(otp_type, label, urlencode(url_args))
+    return uri
+
+
+def _compare_digest(s1, s2):
+    differences = 0
+    for c1, c2 in izip_longest(s1, s2):
+        if c1 is None or c2 is None:
+            differences = 1
+            continue
+        differences |= ord(c1) ^ ord(c2)
+    return differences == 0
+
+try:
+    # Python 3.3+ and 2.7.7+ include a timing-attack-resistant
+    # comparison function, which is probably more reliable than ours.
+    # Use it if available.
+    from hmac import compare_digest
+
+except ImportError:
+    compare_digest = _compare_digest
+
+
+def strings_equal(s1, s2):
+    """
+    Timing-attack resistant string comparison.
+
+    Normal comparison using == will short-circuit on the first mismatching
+    character. This avoids that by scanning the whole string, though we
+    still reveal to a timing attack whether the strings are the same
+    length.
+    """
+    s1 = unicodedata.normalize('NFKC', s1)
+    s2 = unicodedata.normalize('NFKC', s2)
+    return compare_digest(s1, s2)

{pyotp-2.1.1 → pyotp-2.2.4/src/pyotp.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 1.1
 Name: pyotp
-Version: 2.1.1
+Version: 2.2.4
 Summary: Python One Time Password Library
 Home-page: https://github.com/pyotp/pyotp
 Author: PyOTP contributors
@@ -20,6 +20,8 @@ Description: PyOTP - The Python One-Time Password Library
         compatible app. Users can set up auth tokens in their apps easily by using their phone camera to scan `otpauth://
         <https://github.com/google/google-authenticator/wiki/Key-Uri-Format>`_ QR codes provided by PyOTP.
         
+        We recommend that implementers read the `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_ and `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of authentication best practices.
+        
         Quick overview of using One Time Passwords on your phone
         --------------------------------------------------------
         
@@ -84,13 +86,13 @@ Description: PyOTP - The Python One-Time Password Library
         
         Scan the following barcode with your phone, using Google Authenticator
         
-        ![QR Code for OTP](http://chart.apis.google.com/chart?cht=qr&chs=250x250&chl=otpauth%3A%2F%2Ftotp%2Falice%40google.com%3Fsecret%3DJBSWY3DPEHPK3PXP)
+        .. image:: http://chart.apis.google.com/chart?cht=qr&chs=250x250&chl=otpauth%3A%2F%2Ftotp%2Falice%40google.com%3Fsecret%3DJBSWY3DPEHPK3PXP
         
         Now run the following and compare the output::
         
             import pyotp
             totp = pyotp.TOTP("JBSWY3DPEHPK3PXP")
-            print "Current OTP: %s" % totp.now()
+            print("Current OTP:", totp.now())
         
         Links
         ~~~~~
@@ -103,15 +105,15 @@ Description: PyOTP - The Python One-Time Password Library
         * `RFC 6238: TOTP: Time-Based One-Time Password Algorithm <https://tools.ietf.org/html/rfc6238>`_
         * `ROTP <https://github.com/mdp/rotp>`_ - Original Ruby OTP library by `Mark Percival <https://github.com/mdp>`_
         * `OTPHP <https://github.com/lelag/otphp>`_ - PHP port of ROTP by `Le Lag <https://github.com/lelag>`_
+        * `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_
+        * `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_
         
         .. image:: https://img.shields.io/travis/pyotp/pyotp.svg
                 :target: https://travis-ci.org/pyotp/pyotp
-        .. image:: https://img.shields.io/coveralls/pyotp/pyotp.svg
-                :target: https://coveralls.io/r/pyotp/pyotp?branch=master
+        .. image:: https://img.shields.io/codecov/c/github/pyotp/pyotp/master.svg
+                :target: https://codecov.io/github/pyotp/pyotp?branch=master
         .. image:: https://img.shields.io/pypi/v/pyotp.svg
                 :target: https://pypi.python.org/pypi/pyotp
-        .. image:: https://img.shields.io/pypi/dm/pyotp.svg
-                :target: https://pypi.python.org/pypi/pyotp
         .. image:: https://img.shields.io/pypi/l/pyotp.svg
                 :target: https://pypi.python.org/pypi/pyotp
         .. image:: https://readthedocs.org/projects/pyotp/badge/?version=latest

{pyotp-2.1.1 → pyotp-2.2.4}/src/pyotp.egg-info/SOURCES.txt

@@ -6,6 +6,7 @@ setup.cfg
 setup.py
 test.py
 src/pyotp/__init__.py
+src/pyotp/compat.py
 src/pyotp/hotp.py
 src/pyotp/otp.py
 src/pyotp/totp.py
@@ -14,5 +15,4 @@ src/pyotp.egg-info/PKG-INFO
 src/pyotp.egg-info/SOURCES.txt
 src/pyotp.egg-info/dependency_links.txt
 src/pyotp.egg-info/not-zip-safe
-src/pyotp.egg-info/requires.txt
 src/pyotp.egg-info/top_level.txt

pyotp-2.2.4/test.py

@@ -0,0 +1,293 @@
+#!/usr/bin/env python
+# coding: utf-8
+
+from __future__ import absolute_import, division, print_function, unicode_literals
+
+import base64, datetime, hashlib, os, sys, unittest
+from warnings import warn
+
+try:
+    from urllib.parse import urlparse, parse_qsl
+except ImportError:
+    from urlparse import urlparse, parse_qsl
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), 'src'))
+import pyotp  # noqa
+
+class HOTPExampleValuesFromTheRFC(unittest.TestCase):
+    def test_match_rfc(self):
+        # 12345678901234567890 in Bas32
+        # GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ
+        hotp = pyotp.HOTP('GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ')
+        self.assertEqual(hotp.at(0), '755224')
+        self.assertEqual(hotp.at(1), '287082')
+        self.assertEqual(hotp.at(2), '359152')
+        self.assertEqual(hotp.at(3), '969429')
+        self.assertEqual(hotp.at(4), '338314')
+        self.assertEqual(hotp.at(5), '254676')
+        self.assertEqual(hotp.at(6), '287922')
+        self.assertEqual(hotp.at(7), '162583')
+        self.assertEqual(hotp.at(8), '399871')
+        self.assertEqual(hotp.at(9), '520489')
+
+    def test_verify_otp_reuse(self):
+        hotp = pyotp.HOTP('GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ')
+        self.assertTrue(hotp.verify('520489', 9))
+        self.assertFalse(hotp.verify('520489', 10))
+        self.assertFalse(hotp.verify('520489', 10))
+
+    def test_provisioning_uri(self):
+        hotp = pyotp.HOTP('wrn3pqx5uqxqvnqr')
+
+        url = urlparse(
+            hotp.provisioning_uri('mark@percival'))
+        self.assertEqual(url.scheme, 'otpauth')
+        self.assertEqual(url.netloc, 'hotp')
+        self.assertEqual(url.path, '/mark%40percival')
+        self.assertEqual(dict(parse_qsl(url.query)),
+                         {'secret': 'wrn3pqx5uqxqvnqr', 'counter': '0'})
+
+        url = urlparse(
+            hotp.provisioning_uri('mark@percival', initial_count=12))
+        self.assertEqual(url.scheme, 'otpauth')
+        self.assertEqual(url.netloc, 'hotp')
+        self.assertEqual(url.path, '/mark%40percival')
+        self.assertEqual(dict(parse_qsl(url.query)),
+                         {'secret': 'wrn3pqx5uqxqvnqr', 'counter': '12'})
+
+        url = urlparse(
+            hotp.provisioning_uri('mark@percival', issuer_name='FooCorp!'))
+        self.assertEqual(url.scheme, 'otpauth')
+        self.assertEqual(url.netloc, 'hotp')
+        self.assertEqual(url.path, '/FooCorp%21:mark%40percival')
+        self.assertEqual(dict(parse_qsl(url.query)),
+                         {'secret': 'wrn3pqx5uqxqvnqr', 'counter': '0',
+                          'issuer': 'FooCorp!'})
+
+        key = 'c7uxuqhgflpw7oruedmglbrk7u6242vb'
+        hotp = pyotp.HOTP(key, digits=8, digest=hashlib.sha256)
+        url = urlparse(
+            hotp.provisioning_uri('baco@peperina', issuer_name='FooCorp'))
+        self.assertEqual(url.scheme, 'otpauth')
+        self.assertEqual(url.netloc, 'hotp')
+        self.assertEqual(url.path, '/FooCorp:baco%40peperina')
+        self.assertEqual(dict(parse_qsl(url.query)),
+                         {'secret': 'c7uxuqhgflpw7oruedmglbrk7u6242vb',
+                          'counter': '0', 'issuer': 'FooCorp',
+                          'digits': '8', 'algorithm': 'SHA256'})
+
+        hotp = pyotp.HOTP(key, digits=8)
+        url = urlparse(
+            hotp.provisioning_uri('baco@peperina', issuer_name='FooCorp',
+                                  initial_count=10))
+        self.assertEqual(url.scheme, 'otpauth')
+        self.assertEqual(url.netloc, 'hotp')
+        self.assertEqual(url.path, '/FooCorp:baco%40peperina')
+        self.assertEqual(dict(parse_qsl(url.query)),
+                         {'secret': 'c7uxuqhgflpw7oruedmglbrk7u6242vb',
+                          'counter': '10', 'issuer': 'FooCorp',
+                          'digits': '8'})
+
+    def test_other_secret(self):
+        hotp = pyotp.HOTP(
+            'N3OVNIBRERIO5OHGVCMDGS4V4RJ3AUZOUN34J6FRM4P6JIFCG3ZA')
+        self.assertEqual(hotp.at(0), '737863')
+        self.assertEqual(hotp.at(1), '390601')
+        self.assertEqual(hotp.at(2), '363354')
+        self.assertEqual(hotp.at(3), '936780')
+        self.assertEqual(hotp.at(4), '654019')
+
+
+class TOTPExampleValuesFromTheRFC(unittest.TestCase):
+    RFC_VALUES = {
+        (hashlib.sha1, b'12345678901234567890'): (
+            (59, '94287082'),
+            (1111111109, '07081804'),
+            (1111111111, '14050471'),
+            (1234567890, '89005924'),
+            (2000000000, '69279037'),
+            (20000000000, '65353130'),
+        ),
+
+        (hashlib.sha256, b'12345678901234567890123456789012'): (
+            (59, 46119246),
+            (1111111109, '68084774'),
+            (1111111111, '67062674'),
+            (1234567890, '91819424'),
+            (2000000000, '90698825'),
+            (20000000000, '77737706'),
+        ),
+
+        (hashlib.sha512,
+         b'1234567890123456789012345678901234567890123456789012345678901234'):
+        (
+            (59, 90693936),
+            (1111111109, '25091201'),
+            (1111111111, '99943326'),
+            (1234567890, '93441116'),
+            (2000000000, '38618901'),
+            (20000000000, '47863826'),
+        ),
+    }
+
+    def test_match_rfc(self):
+        for digest, secret in self.RFC_VALUES:
+            totp = pyotp.TOTP(base64.b32encode(secret), 8, digest)
+            for utime, code in self.RFC_VALUES[(digest, secret)]:
+                if utime > sys.maxsize:
+                    warn("32-bit platforms use native functions to handle timestamps, so they fail this test" +
+                         " (and will fail after 19 January 2038)")
+                    continue
+                value = totp.at(utime)
+                msg = "%s != %s (%s, time=%d)"
+                msg %= (value, code, digest().name, utime)
+                self.assertEqual(value, str(code), msg)
+
+    def test_match_rfc_digit_length(self):
+        totp = pyotp.TOTP('GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ')
+        self.assertEqual(totp.at(1111111111), '050471')
+        self.assertEqual(totp.at(1234567890), '005924')
+        self.assertEqual(totp.at(2000000000), '279037')
+
+    def test_match_google_authenticator_output(self):
+        totp = pyotp.TOTP('wrn3pqx5uqxqvnqr')
+        with Timecop(1297553958):
+            self.assertEqual(totp.now(), '102705')
+
+    def test_validate_totp(self):
+        totp = pyotp.TOTP('wrn3pqx5uqxqvnqr')
+        with Timecop(1297553958):
+            self.assertTrue(totp.verify('102705'))
+            self.assertTrue(totp.verify('102705'))
+        with Timecop(1297553958 + 30):
+            self.assertFalse(totp.verify('102705'))
+
+    def test_validate_totp_with_digit_length(self):
+        totp = pyotp.TOTP('GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ')
+        with Timecop(1111111111):
+            self.assertTrue(totp.verify('050471'))
+        with Timecop(1297553958 + 30):
+            self.assertFalse(totp.verify('050471'))
+
+    def test_provisioning_uri(self):
+        totp = pyotp.TOTP('wrn3pqx5uqxqvnqr')
+        url = urlparse(
+            totp.provisioning_uri('mark@percival'))
+        self.assertEqual(url.scheme, 'otpauth')
+        self.assertEqual(url.netloc, 'totp')
+        self.assertEqual(url.path, '/mark%40percival')
+        self.assertEqual(dict(parse_qsl(url.query)),
+                         {'secret': 'wrn3pqx5uqxqvnqr'})
+
+        url = urlparse(
+            totp.provisioning_uri('mark@percival', issuer_name='FooCorp!'))
+        self.assertEqual(url.scheme, 'otpauth')
+        self.assertEqual(url.netloc, 'totp')
+        self.assertEqual(url.path, '/FooCorp%21:mark%40percival')
+        self.assertEqual(dict(parse_qsl(url.query)),
+                         {'secret': 'wrn3pqx5uqxqvnqr',
+                          'issuer': 'FooCorp!'})
+
+        key = 'c7uxuqhgflpw7oruedmglbrk7u6242vb'
+        totp = pyotp.TOTP(key, digits=8, interval=60, digest=hashlib.sha256)
+        url = urlparse(totp.provisioning_uri('baco@peperina', issuer_name='FooCorp'))
+        self.assertEqual(url.scheme, 'otpauth')
+        self.assertEqual(url.netloc, 'totp')
+        self.assertEqual(url.path, '/FooCorp:baco%40peperina')
+        self.assertEqual(dict(parse_qsl(url.query)),
+                         {'secret': 'c7uxuqhgflpw7oruedmglbrk7u6242vb',
+                          'issuer': 'FooCorp',
+                          'digits': '8', 'period': '60',
+                          'algorithm': 'SHA256'})
+
+        totp = pyotp.TOTP(key, digits=8, interval=60)
+        url = urlparse(totp.provisioning_uri('baco@peperina', issuer_name='FooCorp'))
+        self.assertEqual(url.scheme, 'otpauth')
+        self.assertEqual(url.netloc, 'totp')
+        self.assertEqual(url.path, '/FooCorp:baco%40peperina')
+        self.assertEqual(dict(parse_qsl(url.query)),
+                         {'secret': 'c7uxuqhgflpw7oruedmglbrk7u6242vb',
+                          'issuer': 'FooCorp',
+                          'digits': '8', 'period': '60'})
+
+        totp = pyotp.TOTP(key, digits=8)
+        url = urlparse(totp.provisioning_uri('baco@peperina', issuer_name='FooCorp'))
+        self.assertEqual(url.scheme, 'otpauth')
+        self.assertEqual(url.netloc, 'totp')
+        self.assertEqual(url.path, '/FooCorp:baco%40peperina')
+        self.assertEqual(dict(parse_qsl(url.query)),
+                         {'secret': 'c7uxuqhgflpw7oruedmglbrk7u6242vb',
+                          'issuer': 'FooCorp',
+                          'digits': '8'})
+
+    def test_random_key_generation(self):
+        self.assertEqual(len(pyotp.random_base32()), 16)
+        self.assertEqual(len(pyotp.random_base32(length=20)), 20)
+
+
+class CompareDigestTest(unittest.TestCase):
+    method = staticmethod(pyotp.utils.compare_digest)
+
+    def test_comparisons(self):
+        self.assertTrue(self.method("", ""))
+        self.assertTrue(self.method("a", "a"))
+        self.assertTrue(self.method("a" * 1000, "a" * 1000))
+
+        self.assertFalse(self.method("", "a"))
+        self.assertFalse(self.method("a", ""))
+        self.assertFalse(self.method("a" * 999 + "b", "a" * 1000))
+
+
+class FallBackCompareDigestTest(CompareDigestTest):
+    method = staticmethod(pyotp.utils._compare_digest)
+
+
+class StringComparisonTest(CompareDigestTest):
+    method = staticmethod(pyotp.utils.strings_equal)
+
+    def test_fullwidth_input(self):
+        self.assertTrue(self.method("ｘs１２３45", "xs12345"))
+
+
+class CounterOffsetTest(unittest.TestCase):
+    def test_counter_offset(self):
+        totp = pyotp.TOTP("ABCDEFGH")
+        self.assertEqual(totp.at(200), "028307")
+        self.assertTrue(totp.at(200, 1), "681610")
+
+
+class ValidWindowTest(unittest.TestCase):
+    def test_valid_window(self):
+        totp = pyotp.TOTP("ABCDEFGH")
+        self.assertTrue(totp.verify("451564", 200, 1))
+        self.assertTrue(totp.verify("028307", 200, 1))
+        self.assertTrue(totp.verify("681610", 200, 1))
+        self.assertFalse(totp.verify("195979", 200, 1))
+
+
+class Timecop(object):
+    """
+    Half-assed clone of timecop.rb, just enough to pass our tests.
+    """
+
+    def __init__(self, freeze_timestamp):
+        self.freeze_timestamp = freeze_timestamp
+
+    def __enter__(self):
+        self.real_datetime = datetime.datetime
+        datetime.datetime = self.frozen_datetime()
+
+    def __exit__(self, type, value, traceback):
+        datetime.datetime = self.real_datetime
+
+    def frozen_datetime(self):
+        class FrozenDateTime(datetime.datetime):
+            @classmethod
+            def now(cls, **kwargs):
+                return cls.fromtimestamp(timecop.freeze_timestamp)
+
+        timecop = self
+        return FrozenDateTime
+
+if __name__ == '__main__':
+    unittest.main()

pyotp-2.1.1/requirements.txt

@@ -1 +0,0 @@
-future==0.15.2

pyotp-2.1.1/setup.py

@@ -1,33 +0,0 @@
-#!/usr/bin/env python
-
-import os, glob
-from setuptools import setup, find_packages
-
-install_requires = [line.rstrip() for line in open(os.path.join(os.path.dirname(__file__), "requirements.txt"))]
-
-setup(
-    name='pyotp',
-    version='2.1.1',
-    url='https://github.com/pyotp/pyotp',
-    license='BSD License',
-    author='PyOTP contributors',
-    author_email='kislyuk@gmail.com',
-    description='Python One Time Password Library',
-    long_description=open('README.rst').read(),
-    install_requires=install_requires,
-    packages=['pyotp'],
-    package_dir={'': 'src'},
-    platforms=['MacOS X', 'Posix'],
-    zip_safe=False,
-    classifiers=[
-        'Intended Audience :: Developers',
-        'License :: OSI Approved :: BSD License',
-        'Operating System :: MacOS :: MacOS X',
-        'Operating System :: POSIX',
-        'Programming Language :: Python',
-        'Programming Language :: Python :: 2.7',
-        'Programming Language :: Python :: 3.3',
-        'Programming Language :: Python :: 3.4',
-        'Topic :: Software Development :: Libraries :: Python Modules'
-    ]
-)

pyotp-2.1.1/src/pyotp/__init__.py

@@ -1,15 +0,0 @@
-from __future__ import print_function, unicode_literals, division, absolute_import
-
-import random as _random
-
-from pyotp.hotp import HOTP
-from pyotp.otp import OTP
-from pyotp.totp import TOTP
-from . import utils
-
-def random_base32(length=16, random=_random.SystemRandom(),
-                  chars=list('ABCDEFGHIJKLMNOPQRSTUVWXYZ234567')):
-    return ''.join(
-        random.choice(chars)
-        for _ in range(length)
-    )

pyotp-2.1.1/src/pyotp/utils.py

@@ -1,82 +0,0 @@
-from __future__ import print_function, unicode_literals, division, absolute_import
-
-import unicodedata
-
-try:
-    from urllib.parse import quote
-except ImportError:
-    from urllib import quote
-
-def build_uri(secret, name, initial_count=None, issuer_name=None):
-    """
-    Returns the provisioning URI for the OTP; works for either TOTP or HOTP.
-
-    This can then be encoded in a QR Code and used to provision the Google
-    Authenticator app.
-
-    For module-internal use.
-
-    See also:
-        http://code.google.com/p/google-authenticator/wiki/KeyUriFormat
-
-    @param [String] the hotp/totp secret used to generate the URI
-    @param [String] name of the account
-    @param [Integer] initial_count starting counter value, defaults to None.
-        If none, the OTP type will be assumed as TOTP.
-    @param [String] the name of the OTP issuer; this will be the
-        organization title of the OTP entry in Authenticator
-    @return [String] provisioning uri
-    """
-    # initial_count may be 0 as a valid param
-    is_initial_count_present = (initial_count is not None)
-
-    otp_type = 'hotp' if is_initial_count_present else 'totp'
-    base = 'otpauth://%s/' % otp_type
-
-    if issuer_name:
-        issuer_name = quote(issuer_name)
-        base += '%s:' % issuer_name
-
-    uri = '%(base)s%(name)s?secret=%(secret)s' % {
-        'name': quote(name, safe='@'),
-        'secret': secret,
-        'base': base,
-    }
-
-    if is_initial_count_present:
-        uri += '&counter=%s' % initial_count
-
-    if issuer_name:
-        uri += '&issuer=%s' % issuer_name
-
-    return uri
-
-
-def strings_equal(s1, s2):
-    """
-    Timing-attack resistant string comparison.
-
-    Normal comparison using == will short-circuit on the first mismatching
-    character. This avoids that by scanning the whole string, though we
-    still reveal to a timing attack whether the strings are the same
-    length.
-    """
-    s1 = unicodedata.normalize('NFKC', s1)
-    s2 = unicodedata.normalize('NFKC', s2)
-    try:
-        # Python 3.3+ and 2.7.7+ include a timing-attack-resistant
-        # comparison function, which is probably more reliable than ours.
-        # Use it if available.
-        from hmac import compare_digest
-
-        return compare_digest(s1, s2)
-    except ImportError:
-        pass
-
-    if len(s1) != len(s2):
-        return False
-
-    differences = 0
-    for c1, c2 in zip(s1, s2):
-        differences |= ord(c1) ^ ord(c2)
-    return differences == 0

pyotp-2.1.1/src/pyotp.egg-info/requires.txt

@@ -1 +0,0 @@
-future==0.15.2

pyotp-2.1.1/test.py

@@ -1,192 +0,0 @@
-#!/usr/bin/env python
-# coding: utf-8
-
-from __future__ import print_function, unicode_literals, division, absolute_import
-
-import base64
-import datetime
-import hashlib
-import os
-import sys
-import unittest
-
-sys.path.insert(0, os.path.join(os.path.dirname(__file__), 'src'))
-import pyotp
-
-class HOTPExampleValuesFromTheRFC(unittest.TestCase):
-    def test_match_rfc(self):
-        # 12345678901234567890 in Bas32
-        # GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ
-        hotp = pyotp.HOTP('GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ')
-        self.assertEqual(hotp.at(0), '755224')
-        self.assertEqual(hotp.at(1), '287082')
-        self.assertEqual(hotp.at(2), '359152')
-        self.assertEqual(hotp.at(3), '969429')
-        self.assertEqual(hotp.at(4), '338314')
-        self.assertEqual(hotp.at(5), '254676')
-        self.assertEqual(hotp.at(6), '287922')
-        self.assertEqual(hotp.at(7), '162583')
-        self.assertEqual(hotp.at(8), '399871')
-        self.assertEqual(hotp.at(9), '520489')
-
-    def test_verify_otp_reuse(self):
-        hotp = pyotp.HOTP('GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ')
-        self.assertTrue(hotp.verify('520489', 9))
-        self.assertFalse(hotp.verify('520489', 10))
-        self.assertFalse(hotp.verify('520489', 10))
-
-    def test_provisioning_uri(self):
-        hotp = pyotp.HOTP('wrn3pqx5uqxqvnqr')
-
-        self.assertEqual(
-            hotp.provisioning_uri('mark@percival'),
-            'otpauth://hotp/mark@percival?secret=wrn3pqx5uqxqvnqr&counter=0')
-
-        self.assertEqual(
-            hotp.provisioning_uri('mark@percival', initial_count=12),
-            'otpauth://hotp/mark@percival?secret=wrn3pqx5uqxqvnqr&counter=12')
-
-        self.assertEqual(
-            hotp.provisioning_uri('mark@percival', issuer_name='FooCorp!'),
-            'otpauth://hotp/FooCorp%21:mark@percival?secret=wrn3pqx5uqxqvnqr&counter=0&issuer=FooCorp%21')
-
-    def test_other_secret(self):
-        hotp = pyotp.HOTP('N3OVNIBRERIO5OHGVCMDGS4V4RJ3AUZOUN34J6FRM4P6JIFCG3ZA')
-        self.assertEqual(hotp.at(0), '737863')
-        self.assertEqual(hotp.at(1), '390601')
-        self.assertEqual(hotp.at(2), '363354')
-        self.assertEqual(hotp.at(3), '936780')
-        self.assertEqual(hotp.at(4), '654019')
-
-class TOTPExampleValuesFromTheRFC(unittest.TestCase):
-    RFC_VALUES = {
-        (hashlib.sha1, b'12345678901234567890'): (
-            (59, '94287082'),
-            (1111111109, '07081804'),
-            (1111111111, '14050471'),
-            (1234567890, '89005924'),
-            (2000000000, '69279037'),
-            (20000000000, '65353130'),
-        ),
-
-        (hashlib.sha256, b'12345678901234567890123456789012'): (
-            (59, 46119246),
-            (1111111109, '68084774'),
-            (1111111111, '67062674'),
-            (1234567890, '91819424'),
-            (2000000000, '90698825'),
-            (20000000000, '77737706'),
-        ),
-
-        (hashlib.sha512, b'1234567890123456789012345678901234567890123456789012345678901234'): (
-            (59, 90693936),
-            (1111111109, '25091201'),
-            (1111111111, '99943326'),
-            (1234567890, '93441116'),
-            (2000000000, '38618901'),
-            (20000000000, '47863826'),
-        ),
-    }
-
-    def test_match_rfc(self):
-        for digest, secret in self.RFC_VALUES:
-            totp = pyotp.TOTP(base64.b32encode(secret), 8, digest)
-            for utime, code in self.RFC_VALUES[(digest, secret)]:
-                value = totp.at(utime)
-                msg = "%s != %s (%s, time=%d)"
-                msg %= (value, code, digest().name, utime)
-                self.assertEqual(value, str(code), msg)
-
-    def test_match_rfc_digit_length(self):
-        totp = pyotp.TOTP('GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ')
-        self.assertEqual(totp.at(1111111111), '050471')
-        self.assertEqual(totp.at(1234567890), '005924')
-        self.assertEqual(totp.at(2000000000), '279037')
-
-    def test_match_google_authenticator_output(self):
-        totp = pyotp.TOTP('wrn3pqx5uqxqvnqr')
-        with Timecop(1297553958):
-            self.assertEqual(totp.now(), '102705')
-
-    def test_validate_totp(self):
-        totp = pyotp.TOTP('wrn3pqx5uqxqvnqr')
-        with Timecop(1297553958):
-            self.assertTrue(totp.verify('102705'))
-            self.assertTrue(totp.verify('102705'))
-        with Timecop(1297553958 + 30):
-            self.assertFalse(totp.verify('102705'))
-
-    def test_validate_totp_with_digit_length(self):
-        totp = pyotp.TOTP('GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ')
-        with Timecop(1111111111):
-            self.assertTrue(totp.verify('050471'))
-        with Timecop(1297553958 + 30):
-            self.assertFalse(totp.verify('050471'))
-
-    def test_provisioning_uri(self):
-        totp = pyotp.TOTP('wrn3pqx5uqxqvnqr')
-        self.assertEqual(
-            totp.provisioning_uri('mark@percival'),
-            'otpauth://totp/mark@percival?secret=wrn3pqx5uqxqvnqr')
-
-        self.assertEqual(
-            totp.provisioning_uri('mark@percival', issuer_name='FooCorp!'),
-            'otpauth://totp/FooCorp%21:mark@percival?secret=wrn3pqx5uqxqvnqr&issuer=FooCorp%21')
-
-    def test_random_key_generation(self):
-        self.assertEqual(len(pyotp.random_base32()), 16)
-        self.assertEqual(len(pyotp.random_base32(length=20)), 20)
-
-class StringComparisonTest(unittest.TestCase):
-    def test_comparisons(self):
-        self.assertTrue(pyotp.utils.strings_equal("", ""))
-        self.assertTrue(pyotp.utils.strings_equal("a", "a"))
-        self.assertTrue(pyotp.utils.strings_equal("a" * 1000, "a" * 1000))
-
-        self.assertFalse(pyotp.utils.strings_equal("", "a"))
-        self.assertFalse(pyotp.utils.strings_equal("a", ""))
-        self.assertFalse(pyotp.utils.strings_equal("a" * 999 + "b", "a" * 1000))
-
-    def test_fullwidth_input(self):
-        self.assertTrue(pyotp.utils.strings_equal("ｘs１２３45", "xs12345"))
-
-class CounterOffsetTest(unittest.TestCase):
-    def test_counter_offset(self):
-        totp = pyotp.TOTP("ABCDEFGH")
-        self.assertEqual(totp.at(200), "028307")
-        self.assertTrue(totp.at(200, 1), "681610")
-
-class ValidWindowTest(unittest.TestCase):
-    def test_valid_window(self):
-        totp = pyotp.TOTP("ABCDEFGH")
-        self.assertTrue(totp.verify("451564", 200, 1))
-        self.assertTrue(totp.verify("028307", 200, 1))
-        self.assertTrue(totp.verify("681610", 200, 1))
-        self.assertFalse(totp.verify("195979", 200, 1))
-
-class Timecop(object):
-    """
-    Half-assed clone of timecop.rb, just enough to pass our tests.
-    """
-
-    def __init__(self, freeze_timestamp):
-        self.freeze_timestamp = freeze_timestamp
-
-    def __enter__(self):
-        self.real_datetime = datetime.datetime
-        datetime.datetime = self.frozen_datetime()
-
-    def __exit__(self, type, value, traceback):
-        datetime.datetime = self.real_datetime
-
-    def frozen_datetime(self):
-        class FrozenDateTime(datetime.datetime):
-            @classmethod
-            def now(cls, **kwargs):
-                return cls.fromtimestamp(timecop.freeze_timestamp)
-
-        timecop = self
-        return FrozenDateTime
-
-if __name__ == '__main__':
-    unittest.main()