PyOTP 2.2.5__py2.py3-none-any.whl → 2.2.7__py2.py3-none-any.whl

pyotp/__init__.py

@@ -1,16 +1,22 @@
 from __future__ import (absolute_import, division,
                         print_function, unicode_literals)
 
-import random as _random
-
 from pyotp.hotp import HOTP  # noqa
 from pyotp.otp import OTP  # noqa
 from pyotp.totp import TOTP  # noqa
 from . import utils  # noqa
 
-
-def random_base32(length=16, random=_random.SystemRandom(),
+def random_base32(length=16, random=None,
                   chars=list('ABCDEFGHIJKLMNOPQRSTUVWXYZ234567')):
+
+    # Use secrets module if available (Python version >= 3.6) per PEP 506
+    try:
+        import secrets
+        random = secrets.SystemRandom()
+    except ImportError:
+        import random as _random
+        random = _random.SystemRandom()
+
     return ''.join(
         random.choice(chars)
         for _ in range(length)

pyotp/hotp.py

@@ -21,7 +21,7 @@ class HOTP(OTP):
 
     def verify(self, otp, counter):
         """
-        Verifies the OTP passed in against the current time OTP.
+        Verifies the OTP passed in against the current counter OTP.
 
         :param otp: the OTP to check against
         :type otp: str
@@ -34,9 +34,10 @@ class HOTP(OTP):
         """
         Returns the provisioning URI for the OTP.  This can then be
         encoded in a QR Code and used to provision an OTP app like
-        Google Authenticator. See
-        https://github.com/google/google-authenticator/wiki/Key-Uri-Format
-        for more details.
+        Google Authenticator.
+
+        See also:
+            https://github.com/google/google-authenticator/wiki/Key-Uri-Format
 
         :param name: name of the user account
         :type name: str

pyotp/totp.py

@@ -71,9 +71,10 @@ class TOTP(OTP):
         """
         Returns the provisioning URI for the OTP.  This can then be
         encoded in a QR Code and used to provision an OTP app like
-        Google Authenticator. See
-        https://github.com/google/google-authenticator/wiki/Key-Uri-Format
-        for more details.
+        Google Authenticator.
+
+        See also:
+            https://github.com/google/google-authenticator/wiki/Key-Uri-Format
 
         :param name: name of the user account
         :type name: str

pyotp/utils.py

@@ -61,7 +61,7 @@ def build_uri(secret, name, initial_count=None, issuer_name=None,
     label = quote(name)
     if issuer_name is not None:
         label = quote(issuer_name) + ':' + label
-        url_args['issuer'] = quote(issuer_name)
+        url_args['issuer'] = issuer_name
 
     if is_initial_count_present:
         url_args['counter'] = initial_count
@@ -72,7 +72,7 @@ def build_uri(secret, name, initial_count=None, issuer_name=None,
     if is_period_set:
         url_args['period'] = period
 
-    uri = base_uri.format(otp_type, label, urlencode(url_args))
+    uri = base_uri.format(otp_type, label, urlencode(url_args).replace("+", "%20"))
     return uri
 
 
@@ -85,12 +85,12 @@ def _compare_digest(s1, s2):
         differences |= ord(c1) ^ ord(c2)
     return differences == 0
 
+
 try:
     # Python 3.3+ and 2.7.7+ include a timing-attack-resistant
     # comparison function, which is probably more reliable than ours.
     # Use it if available.
     from hmac import compare_digest
-
 except ImportError:
     compare_digest = _compare_digest
 

{pyotp-2.2.5.dist-info → pyotp-2.2.7.dist-info}/METADATA

@@ -1,15 +1,15 @@
-Metadata-Version: 2.0
+Metadata-Version: 2.1
 Name: pyotp
-Version: 2.2.5
+Version: 2.2.7
 Summary: Python One Time Password Library
 Home-page: https://github.com/pyotp/pyotp
 Author: PyOTP contributors
 Author-email: kislyuk@gmail.com
-License: BSD License
+License: MIT License
 Platform: MacOS X
 Platform: Posix
 Classifier: Intended Audience :: Developers
-Classifier: License :: OSI Approved :: BSD License
+Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: MacOS :: MacOS X
 Classifier: Operating System :: POSIX
 Classifier: Programming Language :: Python
@@ -32,15 +32,33 @@ Authenticator <https://en.wikipedia.org/wiki/Google_Authenticator>`_, `Authy <ht
 compatible app. Users can set up auth tokens in their apps easily by using their phone camera to scan `otpauth://
 <https://github.com/google/google-authenticator/wiki/Key-Uri-Format>`_ QR codes provided by PyOTP.
 
-We recommend that implementers read the `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_ and `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of authentication best practices.
+Implementers should read and follow the `HOTP security requirements <https://tools.ietf.org/html/rfc4226#section-7>`_
+and `TOTP security considerations <https://tools.ietf.org/html/rfc6238#section-5>`_ sections of the relevant RFCs. At
+minimum, application implementers should follow this checklist:
+
+- Ensure transport confidentiality by using HTTPS
+- Ensure HOTP/TOTP secret confidentiality by storing secrets in a controlled access database
+- Deny replay attacks by rejecting one-time passwords that have been used by the client (this requires storing the most 
+  recently authenticated timestamp, OTP, or hash of the OTP in your database, and rejecting the OTP when a match is seen)
+- Throttle brute-force attacks against your application's login functionality
+- When implementing a "green field" application, consider supporting
+  `FIDO U2F <https://en.wikipedia.org/wiki/Universal_2nd_Factor>`_ in addition to HOTP/TOTP. U2F uses asymmetric
+  cryptography to avoid using a shared secret design, which strengthens your MFA solution against server-side compromise.
+  Hardware U2F also sequesters the client secret in a dedicated single-purpose device, which strengthens your clients
+  against client-side compromise.
+
+We also recommend that implementers read the
+`OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_ and
+`NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of
+authentication best practices.
 
 Quick overview of using One Time Passwords on your phone
 --------------------------------------------------------
 
 * OTPs involve a shared secret, stored both on the phone and the server
 * OTPs can be generated on a phone without internet connectivity
-* OTPs should always be used as a second factor of authentication(if your phone is lost, you account is still secured with a password)
-* Google Authenticator allows you to store multiple OTP secrets and provision those using a QR Code(no more typing in the secret)
+* OTPs should always be used as a second factor of authentication (if your phone is lost, you account is still secured with a password)
+* Google Authenticator and other OTP client apps allow you to store multiple OTP secrets and provision those using a QR Code
 
 Installation
 ------------
@@ -56,25 +74,25 @@ Time-based OTPs
 ::
 
     totp = pyotp.TOTP('base32secret3232')
-    totp.now() # => 492039
+    totp.now() # => '492039'
 
     # OTP verified for current time
-    totp.verify(492039) # => True
+    totp.verify('492039') # => True
     time.sleep(30)
-    totp.verify(492039) # => False
+    totp.verify('492039') # => False
 
 Counter-based OTPs
 ~~~~~~~~~~~~~~~~~~
 ::
 
     hotp = pyotp.HOTP('base32secret3232')
-    hotp.at(0) # => 260182
-    hotp.at(1) # => 55283
-    hotp.at(1401) # => 316439
+    hotp.at(0) # => '260182'
+    hotp.at(1) # => '055283'
+    hotp.at(1401) # => '316439'
 
     # OTP verified with a counter
-    hotp.verify(316439, 1401) # => True
-    hotp.verify(316439, 1402) # => False
+    hotp.verify('316439', 1401) # => True
+    hotp.verify('316439', 1402) # => False
 
 Generating a base32 Secret Key
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -90,11 +108,11 @@ ability to generate provisioning URIs for use with the QR Code scanner built int
 
     pyotp.totp.TOTP('JBSWY3DPEHPK3PXP').provisioning_uri("alice@google.com", issuer_name="Secure App")
 
-    >>> 'otpauth://totp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure+App'
+    >>> 'otpauth://totp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure%20App'
 
     pyotp.hotp.HOTP('JBSWY3DPEHPK3PXP').provisioning_uri("alice@google.com", initial_count=0, issuer_name="Secure App")
 
-    >>> 'otpauth://hotp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure+App&counter=0'
+    >>> 'otpauth://hotp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure%20App&counter=0'
 
 This URL can then be rendered as a QR Code (for example, using https://github.com/neocotic/qrious) which can then be scanned
 and added to the users list of OTP credentials.

pyotp-2.2.7.dist-info/RECORD

@@ -0,0 +1,10 @@
+pyotp/__init__.py,sha256=hamm6NeVXq0-y6jlBlVnO7oct5n5EHWltinaBxge8xk,685
+pyotp/compat.py,sha256=QVb4buImn4PyP0qe5uLiXsO2-p4ItTGl01Vbt2dILNE,222
+pyotp/hotp.py,sha256=Jotukhsjpwpbx05iHHPYgH0HzpAFUvRAnWauQ_4N69M,1772
+pyotp/otp.py,sha256=QPyHxZ7fY7_zlrMVVveGQrCfn6gatpaHO3-ok9XwCaU,2344
+pyotp/totp.py,sha256=EHnv9irTDDt2cLUIxy3w_80QaqtduAM08Xq7rU2bIm0,3168
+pyotp/utils.py,sha256=1v--gUDj8GLvwKElYp-HeElWQZAHHHMDhqHGo800VGg,3495
+pyotp-2.2.7.dist-info/METADATA,sha256=OFpNjao385Qg5ALlw8z5wF4ooHE8AX0gC-Mm0A2NA8g,7411
+pyotp-2.2.7.dist-info/RECORD,,
+pyotp-2.2.7.dist-info/WHEEL,sha256=J3CsTk7Mf2JNUyhImI-mjX-fmI4oDjyiXgWT4qgZiCE,110
+pyotp-2.2.7.dist-info/top_level.txt,sha256=rFDgz6Sm4nbkYk6tlSRiMcJPyYdnY6LcZiAaYTxVc5k,6

{pyotp-2.2.5.dist-info → pyotp-2.2.7.dist-info}/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: bdist_wheel (0.29.0)
+Generator: bdist_wheel (0.31.0)
 Root-Is-Purelib: true
 Tag: py2-none-any
 Tag: py3-none-any

pyotp-2.2.5.dist-info/DESCRIPTION.rst

@@ -1,120 +0,0 @@
-PyOTP - The Python One-Time Password Library
-============================================
-
-PyOTP is a Python library for generating and verifying one-time passwords. It can be used to implement two-factor (2FA)
-or multi-factor (MFA) authentication methods in web applications and in other systems that require users to log in.
-
-Open MFA standards are defined in `RFC 4226 <https://tools.ietf.org/html/rfc4226>`_ (HOTP: An HMAC-Based One-Time
-Password Algorithm) and in `RFC 6238 <https://tools.ietf.org/html/rfc6238>`_ (TOTP: Time-Based One-Time Password
-Algorithm). PyOTP implements server-side support for both of these standards. Client-side support can be enabled by
-sending authentication codes to users over SMS or email (HOTP) or, for TOTP, by instructing users to use `Google
-Authenticator <https://en.wikipedia.org/wiki/Google_Authenticator>`_, `Authy <https://www.authy.com/>`_, or another
-compatible app. Users can set up auth tokens in their apps easily by using their phone camera to scan `otpauth://
-<https://github.com/google/google-authenticator/wiki/Key-Uri-Format>`_ QR codes provided by PyOTP.
-
-We recommend that implementers read the `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_ and `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of authentication best practices.
-
-Quick overview of using One Time Passwords on your phone
---------------------------------------------------------
-
-* OTPs involve a shared secret, stored both on the phone and the server
-* OTPs can be generated on a phone without internet connectivity
-* OTPs should always be used as a second factor of authentication(if your phone is lost, you account is still secured with a password)
-* Google Authenticator allows you to store multiple OTP secrets and provision those using a QR Code(no more typing in the secret)
-
-Installation
-------------
-::
-
-    pip install pyotp
-
-Usage
------
-
-Time-based OTPs
-~~~~~~~~~~~~~~~
-::
-
-    totp = pyotp.TOTP('base32secret3232')
-    totp.now() # => 492039
-
-    # OTP verified for current time
-    totp.verify(492039) # => True
-    time.sleep(30)
-    totp.verify(492039) # => False
-
-Counter-based OTPs
-~~~~~~~~~~~~~~~~~~
-::
-
-    hotp = pyotp.HOTP('base32secret3232')
-    hotp.at(0) # => 260182
-    hotp.at(1) # => 55283
-    hotp.at(1401) # => 316439
-
-    # OTP verified with a counter
-    hotp.verify(316439, 1401) # => True
-    hotp.verify(316439, 1402) # => False
-
-Generating a base32 Secret Key
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-::
-
-    pyotp.random_base32() # returns a 16 character base32 secret. Compatible with Google Authenticator and other OTP apps
-
-Google Authenticator Compatible
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-PyOTP works with the Google Authenticator iPhone and Android app, as well as other OTP apps like Authy. PyOTP includes the
-ability to generate provisioning URIs for use with the QR Code scanner built into these MFA client apps::
-
-    pyotp.totp.TOTP('JBSWY3DPEHPK3PXP').provisioning_uri("alice@google.com", issuer_name="Secure App")
-
-    >>> 'otpauth://totp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure+App'
-
-    pyotp.hotp.HOTP('JBSWY3DPEHPK3PXP').provisioning_uri("alice@google.com", initial_count=0, issuer_name="Secure App")
-
-    >>> 'otpauth://hotp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure+App&counter=0'
-
-This URL can then be rendered as a QR Code (for example, using https://github.com/neocotic/qrious) which can then be scanned
-and added to the users list of OTP credentials.
-
-Working example
-~~~~~~~~~~~~~~~
-
-Scan the following barcode with your phone's OTP app (e.g. Google Authenticator):
-
-.. image:: http://chart.apis.google.com/chart?cht=qr&chs=250x250&chl=otpauth%3A%2F%2Ftotp%2Falice%40google.com%3Fsecret%3DJBSWY3DPEHPK3PXP
-
-Now run the following and compare the output::
-
-    import pyotp
-    totp = pyotp.TOTP("JBSWY3DPEHPK3PXP")
-    print("Current OTP:", totp.now())
-
-Links
-~~~~~
-
-* `Project home page (GitHub) <https://github.com/pyotp/pyotp>`_
-* `Documentation (Read the Docs) <https://pyotp.readthedocs.io/en/latest/>`_
-* `Package distribution (PyPI) <https://pypi.python.org/pypi/pyotp>`_
-* `Change log <https://github.com/pyotp/pyotp/blob/master/Changes.rst>`_
-* `RFC 4226: HOTP: An HMAC-Based One-Time Password <https://tools.ietf.org/html/rfc4226>`_
-* `RFC 6238: TOTP: Time-Based One-Time Password Algorithm <https://tools.ietf.org/html/rfc6238>`_
-* `ROTP <https://github.com/mdp/rotp>`_ - Original Ruby OTP library by `Mark Percival <https://github.com/mdp>`_
-* `OTPHP <https://github.com/lelag/otphp>`_ - PHP port of ROTP by `Le Lag <https://github.com/lelag>`_
-* `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_
-* `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_
-
-.. image:: https://img.shields.io/travis/pyotp/pyotp.svg
-        :target: https://travis-ci.org/pyotp/pyotp
-.. image:: https://img.shields.io/codecov/c/github/pyotp/pyotp/master.svg
-        :target: https://codecov.io/github/pyotp/pyotp?branch=master
-.. image:: https://img.shields.io/pypi/v/pyotp.svg
-        :target: https://pypi.python.org/pypi/pyotp
-.. image:: https://img.shields.io/pypi/l/pyotp.svg
-        :target: https://pypi.python.org/pypi/pyotp
-.. image:: https://readthedocs.org/projects/pyotp/badge/?version=latest
-        :target: https://pyotp.readthedocs.io/
-
-

pyotp-2.2.5.dist-info/RECORD

@@ -1,12 +0,0 @@
-pyotp/__init__.py,sha256=3I4NkdbXw4iHBbtfL7-dbNv8XZn0EUzS0Fc1riI1CJ8,485
-pyotp/compat.py,sha256=QVb4buImn4PyP0qe5uLiXsO2-p4ItTGl01Vbt2dILNE,222
-pyotp/hotp.py,sha256=BsY90HvawLuye4PuY7Q5DY0_HmR-83N1FVfwuw-SunI,1776
-pyotp/otp.py,sha256=QPyHxZ7fY7_zlrMVVveGQrCfn6gatpaHO3-ok9XwCaU,2344
-pyotp/totp.py,sha256=C734M9EaFqCFa2G0bzpJ6sW1M9bIwJj8Ib3BMuztHGE,3175
-pyotp/utils.py,sha256=op4qfvo-b4sE5zFeRIOW7jhC6LXXLuODjNaEFYdZh-4,3482
-pyotp-2.2.5.dist-info/DESCRIPTION.rst,sha256=FASDLIZAvjB-IGhzvwZRnNvFvh7KroZk0cvfezrj9JA,5471
-pyotp-2.2.5.dist-info/METADATA,sha256=uVlep_WEqWdYGLTAo528H7ZJI-XKCgTNCM1yHMth3co,6167
-pyotp-2.2.5.dist-info/RECORD,,
-pyotp-2.2.5.dist-info/WHEEL,sha256=o2k-Qa-RMNIJmUdIc7KU6VWR_ErNRbWNlxDIpl7lm34,110
-pyotp-2.2.5.dist-info/metadata.json,sha256=pG8Q257aEUFTs4h1opMfmDLYhP6Cl2RawF1ZFBOdY8M,825
-pyotp-2.2.5.dist-info/top_level.txt,sha256=rFDgz6Sm4nbkYk6tlSRiMcJPyYdnY6LcZiAaYTxVc5k,6

pyotp-2.2.5.dist-info/metadata.json

@@ -1 +0,0 @@
-{"classifiers": ["Intended Audience :: Developers", "License :: OSI Approved :: BSD License", "Operating System :: MacOS :: MacOS X", "Operating System :: POSIX", "Programming Language :: Python", "Programming Language :: Python :: 2.7", "Programming Language :: Python :: 3.3", "Programming Language :: Python :: 3.4", "Topic :: Software Development :: Libraries :: Python Modules"], "extensions": {"python.details": {"contacts": [{"email": "kislyuk@gmail.com", "name": "PyOTP contributors", "role": "author"}], "document_names": {"description": "DESCRIPTION.rst"}, "project_urls": {"Home": "https://github.com/pyotp/pyotp"}}}, "generator": "bdist_wheel (0.29.0)", "license": "BSD License", "metadata_version": "2.0", "name": "pyotp", "platform": "MacOS X", "summary": "Python One Time Password Library", "version": "2.2.5"}