PyOTP 2.2.5__tar.gz → 2.2.7__tar.gz

{pyotp-2.2.5 → pyotp-2.2.7}/LICENSE

@@ -1,5 +1,6 @@
-Copyright (C) 2011-2016 Mark Percival <m@mdp.im>,
-Nathan Reynolds <email@nreynolds.co.uk>, and PyOTP contributors
+Copyright (C) 2011-2017 Mark Percival <m@mdp.im>,
+Nathan Reynolds <email@nreynolds.co.uk>, Andrey Kislyuk <kislyuk@gmail.com>,
+and PyOTP contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

{pyotp-2.2.5/src/pyotp.egg-info → pyotp-2.2.7}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 1.1
 Name: pyotp
-Version: 2.2.5
+Version: 2.2.7
 Summary: Python One Time Password Library
 Home-page: https://github.com/pyotp/pyotp
 Author: PyOTP contributors
 Author-email: kislyuk@gmail.com
-License: BSD License
+License: MIT License
 Description: PyOTP - The Python One-Time Password Library
         ============================================
         
@@ -20,15 +20,33 @@ Description: PyOTP - The Python One-Time Password Library
         compatible app. Users can set up auth tokens in their apps easily by using their phone camera to scan `otpauth://
         <https://github.com/google/google-authenticator/wiki/Key-Uri-Format>`_ QR codes provided by PyOTP.
         
-        We recommend that implementers read the `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_ and `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of authentication best practices.
+        Implementers should read and follow the `HOTP security requirements <https://tools.ietf.org/html/rfc4226#section-7>`_
+        and `TOTP security considerations <https://tools.ietf.org/html/rfc6238#section-5>`_ sections of the relevant RFCs. At
+        minimum, application implementers should follow this checklist:
+        
+        - Ensure transport confidentiality by using HTTPS
+        - Ensure HOTP/TOTP secret confidentiality by storing secrets in a controlled access database
+        - Deny replay attacks by rejecting one-time passwords that have been used by the client (this requires storing the most 
+          recently authenticated timestamp, OTP, or hash of the OTP in your database, and rejecting the OTP when a match is seen)
+        - Throttle brute-force attacks against your application's login functionality
+        - When implementing a "green field" application, consider supporting
+          `FIDO U2F <https://en.wikipedia.org/wiki/Universal_2nd_Factor>`_ in addition to HOTP/TOTP. U2F uses asymmetric
+          cryptography to avoid using a shared secret design, which strengthens your MFA solution against server-side compromise.
+          Hardware U2F also sequesters the client secret in a dedicated single-purpose device, which strengthens your clients
+          against client-side compromise.
+        
+        We also recommend that implementers read the
+        `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_ and
+        `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of
+        authentication best practices.
         
         Quick overview of using One Time Passwords on your phone
         --------------------------------------------------------
         
         * OTPs involve a shared secret, stored both on the phone and the server
         * OTPs can be generated on a phone without internet connectivity
-        * OTPs should always be used as a second factor of authentication(if your phone is lost, you account is still secured with a password)
-        * Google Authenticator allows you to store multiple OTP secrets and provision those using a QR Code(no more typing in the secret)
+        * OTPs should always be used as a second factor of authentication (if your phone is lost, you account is still secured with a password)
+        * Google Authenticator and other OTP client apps allow you to store multiple OTP secrets and provision those using a QR Code
         
         Installation
         ------------
@@ -44,25 +62,25 @@ Description: PyOTP - The Python One-Time Password Library
         ::
         
             totp = pyotp.TOTP('base32secret3232')
-            totp.now() # => 492039
+            totp.now() # => '492039'
         
             # OTP verified for current time
-            totp.verify(492039) # => True
+            totp.verify('492039') # => True
             time.sleep(30)
-            totp.verify(492039) # => False
+            totp.verify('492039') # => False
         
         Counter-based OTPs
         ~~~~~~~~~~~~~~~~~~
         ::
         
             hotp = pyotp.HOTP('base32secret3232')
-            hotp.at(0) # => 260182
-            hotp.at(1) # => 55283
-            hotp.at(1401) # => 316439
+            hotp.at(0) # => '260182'
+            hotp.at(1) # => '055283'
+            hotp.at(1401) # => '316439'
         
             # OTP verified with a counter
-            hotp.verify(316439, 1401) # => True
-            hotp.verify(316439, 1402) # => False
+            hotp.verify('316439', 1401) # => True
+            hotp.verify('316439', 1402) # => False
         
         Generating a base32 Secret Key
         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -78,11 +96,11 @@ Description: PyOTP - The Python One-Time Password Library
         
             pyotp.totp.TOTP('JBSWY3DPEHPK3PXP').provisioning_uri("alice@google.com", issuer_name="Secure App")
         
-            >>> 'otpauth://totp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure+App'
+            >>> 'otpauth://totp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure%20App'
         
             pyotp.hotp.HOTP('JBSWY3DPEHPK3PXP').provisioning_uri("alice@google.com", initial_count=0, issuer_name="Secure App")
         
-            >>> 'otpauth://hotp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure+App&counter=0'
+            >>> 'otpauth://hotp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure%20App&counter=0'
         
         This URL can then be rendered as a QR Code (for example, using https://github.com/neocotic/qrious) which can then be scanned
         and added to the users list of OTP credentials.
@@ -128,7 +146,7 @@ Description: PyOTP - The Python One-Time Password Library
 Platform: MacOS X
 Platform: Posix
 Classifier: Intended Audience :: Developers
-Classifier: License :: OSI Approved :: BSD License
+Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: MacOS :: MacOS X
 Classifier: Operating System :: POSIX
 Classifier: Programming Language :: Python

{pyotp-2.2.5 → pyotp-2.2.7}/README.rst

@@ -12,15 +12,33 @@ Authenticator <https://en.wikipedia.org/wiki/Google_Authenticator>`_, `Authy <ht
 compatible app. Users can set up auth tokens in their apps easily by using their phone camera to scan `otpauth://
 <https://github.com/google/google-authenticator/wiki/Key-Uri-Format>`_ QR codes provided by PyOTP.
 
-We recommend that implementers read the `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_ and `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of authentication best practices.
+Implementers should read and follow the `HOTP security requirements <https://tools.ietf.org/html/rfc4226#section-7>`_
+and `TOTP security considerations <https://tools.ietf.org/html/rfc6238#section-5>`_ sections of the relevant RFCs. At
+minimum, application implementers should follow this checklist:
+
+- Ensure transport confidentiality by using HTTPS
+- Ensure HOTP/TOTP secret confidentiality by storing secrets in a controlled access database
+- Deny replay attacks by rejecting one-time passwords that have been used by the client (this requires storing the most 
+  recently authenticated timestamp, OTP, or hash of the OTP in your database, and rejecting the OTP when a match is seen)
+- Throttle brute-force attacks against your application's login functionality
+- When implementing a "green field" application, consider supporting
+  `FIDO U2F <https://en.wikipedia.org/wiki/Universal_2nd_Factor>`_ in addition to HOTP/TOTP. U2F uses asymmetric
+  cryptography to avoid using a shared secret design, which strengthens your MFA solution against server-side compromise.
+  Hardware U2F also sequesters the client secret in a dedicated single-purpose device, which strengthens your clients
+  against client-side compromise.
+
+We also recommend that implementers read the
+`OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_ and
+`NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of
+authentication best practices.
 
 Quick overview of using One Time Passwords on your phone
 --------------------------------------------------------
 
 * OTPs involve a shared secret, stored both on the phone and the server
 * OTPs can be generated on a phone without internet connectivity
-* OTPs should always be used as a second factor of authentication(if your phone is lost, you account is still secured with a password)
-* Google Authenticator allows you to store multiple OTP secrets and provision those using a QR Code(no more typing in the secret)
+* OTPs should always be used as a second factor of authentication (if your phone is lost, you account is still secured with a password)
+* Google Authenticator and other OTP client apps allow you to store multiple OTP secrets and provision those using a QR Code
 
 Installation
 ------------
@@ -36,25 +54,25 @@ Time-based OTPs
 ::
 
     totp = pyotp.TOTP('base32secret3232')
-    totp.now() # => 492039
+    totp.now() # => '492039'
 
     # OTP verified for current time
-    totp.verify(492039) # => True
+    totp.verify('492039') # => True
     time.sleep(30)
-    totp.verify(492039) # => False
+    totp.verify('492039') # => False
 
 Counter-based OTPs
 ~~~~~~~~~~~~~~~~~~
 ::
 
     hotp = pyotp.HOTP('base32secret3232')
-    hotp.at(0) # => 260182
-    hotp.at(1) # => 55283
-    hotp.at(1401) # => 316439
+    hotp.at(0) # => '260182'
+    hotp.at(1) # => '055283'
+    hotp.at(1401) # => '316439'
 
     # OTP verified with a counter
-    hotp.verify(316439, 1401) # => True
-    hotp.verify(316439, 1402) # => False
+    hotp.verify('316439', 1401) # => True
+    hotp.verify('316439', 1402) # => False
 
 Generating a base32 Secret Key
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -70,11 +88,11 @@ ability to generate provisioning URIs for use with the QR Code scanner built int
 
     pyotp.totp.TOTP('JBSWY3DPEHPK3PXP').provisioning_uri("alice@google.com", issuer_name="Secure App")
 
-    >>> 'otpauth://totp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure+App'
+    >>> 'otpauth://totp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure%20App'
 
     pyotp.hotp.HOTP('JBSWY3DPEHPK3PXP').provisioning_uri("alice@google.com", initial_count=0, issuer_name="Secure App")
 
-    >>> 'otpauth://hotp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure+App&counter=0'
+    >>> 'otpauth://hotp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure%20App&counter=0'
 
 This URL can then be rendered as a QR Code (for example, using https://github.com/neocotic/qrious) which can then be scanned
 and added to the users list of OTP credentials.

{pyotp-2.2.5 → pyotp-2.2.7}/setup.cfg

@@ -3,7 +3,7 @@ universal = 1
 
 [flake8]
 max-line-length = 120
-ignore = E301, E302, E305, E401, E226, F841
+ignore = E301, E302, W504
 
 [egg_info]
 tag_build = 

{pyotp-2.2.5 → pyotp-2.2.7}/setup.py

@@ -7,9 +7,9 @@ install_requires = [line.rstrip() for line in open(os.path.join(os.path.dirname(
 
 setup(
     name="pyotp",
-    version="2.2.5",
+    version="2.2.7",
     url="https://github.com/pyotp/pyotp",
-    license="BSD License",
+    license="MIT License",
     author="PyOTP contributors",
     author_email="kislyuk@gmail.com",
     description="Python One Time Password Library",
@@ -22,7 +22,7 @@ setup(
     test_suite="test",
     classifiers=[
         "Intended Audience :: Developers",
-        "License :: OSI Approved :: BSD License",
+        "License :: OSI Approved :: MIT License",
         "Operating System :: MacOS :: MacOS X",
         "Operating System :: POSIX",
         "Programming Language :: Python",

{pyotp-2.2.5 → pyotp-2.2.7}/src/pyotp/__init__.py

@@ -1,16 +1,22 @@
 from __future__ import (absolute_import, division,
                         print_function, unicode_literals)
 
-import random as _random
-
 from pyotp.hotp import HOTP  # noqa
 from pyotp.otp import OTP  # noqa
 from pyotp.totp import TOTP  # noqa
 from . import utils  # noqa
 
-
-def random_base32(length=16, random=_random.SystemRandom(),
+def random_base32(length=16, random=None,
                   chars=list('ABCDEFGHIJKLMNOPQRSTUVWXYZ234567')):
+
+    # Use secrets module if available (Python version >= 3.6) per PEP 506
+    try:
+        import secrets
+        random = secrets.SystemRandom()
+    except ImportError:
+        import random as _random
+        random = _random.SystemRandom()
+
     return ''.join(
         random.choice(chars)
         for _ in range(length)

{pyotp-2.2.5 → pyotp-2.2.7}/src/pyotp/hotp.py

@@ -21,7 +21,7 @@ class HOTP(OTP):
 
     def verify(self, otp, counter):
         """
-        Verifies the OTP passed in against the current time OTP.
+        Verifies the OTP passed in against the current counter OTP.
 
         :param otp: the OTP to check against
         :type otp: str
@@ -34,9 +34,10 @@ class HOTP(OTP):
         """
         Returns the provisioning URI for the OTP.  This can then be
         encoded in a QR Code and used to provision an OTP app like
-        Google Authenticator. See
-        https://github.com/google/google-authenticator/wiki/Key-Uri-Format
-        for more details.
+        Google Authenticator.
+
+        See also:
+            https://github.com/google/google-authenticator/wiki/Key-Uri-Format
 
         :param name: name of the user account
         :type name: str

{pyotp-2.2.5 → pyotp-2.2.7}/src/pyotp/totp.py

@@ -71,9 +71,10 @@ class TOTP(OTP):
         """
         Returns the provisioning URI for the OTP.  This can then be
         encoded in a QR Code and used to provision an OTP app like
-        Google Authenticator. See
-        https://github.com/google/google-authenticator/wiki/Key-Uri-Format
-        for more details.
+        Google Authenticator.
+
+        See also:
+            https://github.com/google/google-authenticator/wiki/Key-Uri-Format
 
         :param name: name of the user account
         :type name: str

{pyotp-2.2.5 → pyotp-2.2.7}/src/pyotp/utils.py

@@ -61,7 +61,7 @@ def build_uri(secret, name, initial_count=None, issuer_name=None,
     label = quote(name)
     if issuer_name is not None:
         label = quote(issuer_name) + ':' + label
-        url_args['issuer'] = quote(issuer_name)
+        url_args['issuer'] = issuer_name
 
     if is_initial_count_present:
         url_args['counter'] = initial_count
@@ -72,7 +72,7 @@ def build_uri(secret, name, initial_count=None, issuer_name=None,
     if is_period_set:
         url_args['period'] = period
 
-    uri = base_uri.format(otp_type, label, urlencode(url_args))
+    uri = base_uri.format(otp_type, label, urlencode(url_args).replace("+", "%20"))
     return uri
 
 
@@ -85,12 +85,12 @@ def _compare_digest(s1, s2):
         differences |= ord(c1) ^ ord(c2)
     return differences == 0
 
+
 try:
     # Python 3.3+ and 2.7.7+ include a timing-attack-resistant
     # comparison function, which is probably more reliable than ours.
     # Use it if available.
     from hmac import compare_digest
-
 except ImportError:
     compare_digest = _compare_digest
 

{pyotp-2.2.5 → pyotp-2.2.7/src/pyotp.egg-info}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 1.1
 Name: pyotp
-Version: 2.2.5
+Version: 2.2.7
 Summary: Python One Time Password Library
 Home-page: https://github.com/pyotp/pyotp
 Author: PyOTP contributors
 Author-email: kislyuk@gmail.com
-License: BSD License
+License: MIT License
 Description: PyOTP - The Python One-Time Password Library
         ============================================
         
@@ -20,15 +20,33 @@ Description: PyOTP - The Python One-Time Password Library
         compatible app. Users can set up auth tokens in their apps easily by using their phone camera to scan `otpauth://
         <https://github.com/google/google-authenticator/wiki/Key-Uri-Format>`_ QR codes provided by PyOTP.
         
-        We recommend that implementers read the `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_ and `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of authentication best practices.
+        Implementers should read and follow the `HOTP security requirements <https://tools.ietf.org/html/rfc4226#section-7>`_
+        and `TOTP security considerations <https://tools.ietf.org/html/rfc6238#section-5>`_ sections of the relevant RFCs. At
+        minimum, application implementers should follow this checklist:
+        
+        - Ensure transport confidentiality by using HTTPS
+        - Ensure HOTP/TOTP secret confidentiality by storing secrets in a controlled access database
+        - Deny replay attacks by rejecting one-time passwords that have been used by the client (this requires storing the most 
+          recently authenticated timestamp, OTP, or hash of the OTP in your database, and rejecting the OTP when a match is seen)
+        - Throttle brute-force attacks against your application's login functionality
+        - When implementing a "green field" application, consider supporting
+          `FIDO U2F <https://en.wikipedia.org/wiki/Universal_2nd_Factor>`_ in addition to HOTP/TOTP. U2F uses asymmetric
+          cryptography to avoid using a shared secret design, which strengthens your MFA solution against server-side compromise.
+          Hardware U2F also sequesters the client secret in a dedicated single-purpose device, which strengthens your clients
+          against client-side compromise.
+        
+        We also recommend that implementers read the
+        `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_ and
+        `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of
+        authentication best practices.
         
         Quick overview of using One Time Passwords on your phone
         --------------------------------------------------------
         
         * OTPs involve a shared secret, stored both on the phone and the server
         * OTPs can be generated on a phone without internet connectivity
-        * OTPs should always be used as a second factor of authentication(if your phone is lost, you account is still secured with a password)
-        * Google Authenticator allows you to store multiple OTP secrets and provision those using a QR Code(no more typing in the secret)
+        * OTPs should always be used as a second factor of authentication (if your phone is lost, you account is still secured with a password)
+        * Google Authenticator and other OTP client apps allow you to store multiple OTP secrets and provision those using a QR Code
         
         Installation
         ------------
@@ -44,25 +62,25 @@ Description: PyOTP - The Python One-Time Password Library
         ::
         
             totp = pyotp.TOTP('base32secret3232')
-            totp.now() # => 492039
+            totp.now() # => '492039'
         
             # OTP verified for current time
-            totp.verify(492039) # => True
+            totp.verify('492039') # => True
             time.sleep(30)
-            totp.verify(492039) # => False
+            totp.verify('492039') # => False
         
         Counter-based OTPs
         ~~~~~~~~~~~~~~~~~~
         ::
         
             hotp = pyotp.HOTP('base32secret3232')
-            hotp.at(0) # => 260182
-            hotp.at(1) # => 55283
-            hotp.at(1401) # => 316439
+            hotp.at(0) # => '260182'
+            hotp.at(1) # => '055283'
+            hotp.at(1401) # => '316439'
         
             # OTP verified with a counter
-            hotp.verify(316439, 1401) # => True
-            hotp.verify(316439, 1402) # => False
+            hotp.verify('316439', 1401) # => True
+            hotp.verify('316439', 1402) # => False
         
         Generating a base32 Secret Key
         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -78,11 +96,11 @@ Description: PyOTP - The Python One-Time Password Library
         
             pyotp.totp.TOTP('JBSWY3DPEHPK3PXP').provisioning_uri("alice@google.com", issuer_name="Secure App")
         
-            >>> 'otpauth://totp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure+App'
+            >>> 'otpauth://totp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure%20App'
         
             pyotp.hotp.HOTP('JBSWY3DPEHPK3PXP').provisioning_uri("alice@google.com", initial_count=0, issuer_name="Secure App")
         
-            >>> 'otpauth://hotp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure+App&counter=0'
+            >>> 'otpauth://hotp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure%20App&counter=0'
         
         This URL can then be rendered as a QR Code (for example, using https://github.com/neocotic/qrious) which can then be scanned
         and added to the users list of OTP credentials.
@@ -128,7 +146,7 @@ Description: PyOTP - The Python One-Time Password Library
 Platform: MacOS X
 Platform: Posix
 Classifier: Intended Audience :: Developers
-Classifier: License :: OSI Approved :: BSD License
+Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: MacOS :: MacOS X
 Classifier: Operating System :: POSIX
 Classifier: Programming Language :: Python

{pyotp-2.2.5 → pyotp-2.2.7}/test.py

@@ -67,7 +67,7 @@ class HOTPExampleValuesFromTheRFC(unittest.TestCase):
         self.assertEqual(url.path, '/FooCorp%21:mark%40percival')
         self.assertEqual(dict(parse_qsl(url.query)),
                          {'secret': 'wrn3pqx5uqxqvnqr', 'counter': '0',
-                          'issuer': 'FooCorp%21'})
+                          'issuer': 'FooCorp!'})
 
         key = 'c7uxuqhgflpw7oruedmglbrk7u6242vb'
         hotp = pyotp.HOTP(key, digits=8, digest=hashlib.sha256)
@@ -90,7 +90,7 @@ class HOTPExampleValuesFromTheRFC(unittest.TestCase):
         self.assertEqual(url.path, '/Foo%20Corp:baco%40peperina')
         self.assertEqual(dict(parse_qsl(url.query)),
                          {'secret': 'c7uxuqhgflpw7oruedmglbrk7u6242vb',
-                          'counter': '10', 'issuer': 'Foo%20Corp',
+                          'counter': '10', 'issuer': 'Foo Corp',
                           'digits': '8'})
 
     def test_other_secret(self):
@@ -199,7 +199,7 @@ class TOTPExampleValuesFromTheRFC(unittest.TestCase):
         self.assertEqual(url.path, '/FooCorp%21:mark%40percival')
         self.assertEqual(dict(parse_qsl(url.query)),
                          {'secret': 'wrn3pqx5uqxqvnqr',
-                          'issuer': 'FooCorp%21'})
+                          'issuer': 'FooCorp!'})
 
         key = 'c7uxuqhgflpw7oruedmglbrk7u6242vb'
         totp = pyotp.TOTP(key, digits=8, interval=60, digest=hashlib.sha256)