PyOTP 2.2.6__py2.py3-none-any.whl → 2.2.8__py2.py3-none-any.whl

pyotp/__init__.py

@@ -1,16 +1,22 @@
 from __future__ import (absolute_import, division,
                         print_function, unicode_literals)
 
-import random as _random
-
 from pyotp.hotp import HOTP  # noqa
 from pyotp.otp import OTP  # noqa
 from pyotp.totp import TOTP  # noqa
 from . import utils  # noqa
 
-
-def random_base32(length=16, random=_random.SystemRandom(),
+def random_base32(length=16, random=None,
                   chars=list('ABCDEFGHIJKLMNOPQRSTUVWXYZ234567')):
+
+    # Use secrets module if available (Python version >= 3.6) per PEP 506
+    try:
+        import secrets
+        random = secrets.SystemRandom()
+    except ImportError:
+        import random as _random
+        random = _random.SystemRandom()
+
     return ''.join(
         random.choice(chars)
         for _ in range(length)

pyotp/hotp.py

@@ -21,7 +21,7 @@ class HOTP(OTP):
 
     def verify(self, otp, counter):
         """
-        Verifies the OTP passed in against the current time OTP.
+        Verifies the OTP passed in against the current counter OTP.
 
         :param otp: the OTP to check against
         :type otp: str

pyotp/utils.py

@@ -85,12 +85,12 @@ def _compare_digest(s1, s2):
         differences |= ord(c1) ^ ord(c2)
     return differences == 0
 
+
 try:
     # Python 3.3+ and 2.7.7+ include a timing-attack-resistant
     # comparison function, which is probably more reliable than ours.
     # Use it if available.
     from hmac import compare_digest
-
 except ImportError:
     compare_digest = _compare_digest
 
@@ -106,4 +106,4 @@ def strings_equal(s1, s2):
     """
     s1 = unicodedata.normalize('NFKC', s1)
     s2 = unicodedata.normalize('NFKC', s2)
-    return compare_digest(s1, s2)
+    return compare_digest(s1.encode(), s2.encode())

pyotp-2.2.8.dist-info/LICENSE

@@ -0,0 +1,21 @@
+Copyright (C) 2011-2017 Mark Percival <m@mdp.im>,
+Nathan Reynolds <email@nreynolds.co.uk>, Andrey Kislyuk <kislyuk@gmail.com>,
+and PyOTP contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

{pyotp-2.2.6.dist-info → pyotp-2.2.8.dist-info}/METADATA

@@ -1,21 +1,23 @@
-Metadata-Version: 2.0
+Metadata-Version: 2.1
 Name: pyotp
-Version: 2.2.6
+Version: 2.2.8
 Summary: Python One Time Password Library
 Home-page: https://github.com/pyotp/pyotp
 Author: PyOTP contributors
 Author-email: kislyuk@gmail.com
-License: BSD License
+License: MIT License
 Platform: MacOS X
 Platform: Posix
 Classifier: Intended Audience :: Developers
-Classifier: License :: OSI Approved :: BSD License
+Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: MacOS :: MacOS X
 Classifier: Operating System :: POSIX
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 2.7
-Classifier: Programming Language :: Python :: 3.3
 Classifier: Programming Language :: Python :: 3.4
+Classifier: Programming Language :: Python :: 3.5
+Classifier: Programming Language :: Python :: 3.6
+Classifier: Programming Language :: Python :: 3.7
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 
 PyOTP - The Python One-Time Password Library
@@ -32,7 +34,27 @@ Authenticator <https://en.wikipedia.org/wiki/Google_Authenticator>`_, `Authy <ht
 compatible app. Users can set up auth tokens in their apps easily by using their phone camera to scan `otpauth://
 <https://github.com/google/google-authenticator/wiki/Key-Uri-Format>`_ QR codes provided by PyOTP.
 
-We recommend that implementers read the `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_ and `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of authentication best practices.
+Implementers should read and follow the `HOTP security requirements <https://tools.ietf.org/html/rfc4226#section-7>`_
+and `TOTP security considerations <https://tools.ietf.org/html/rfc6238#section-5>`_ sections of the relevant RFCs. At
+minimum, application implementers should follow this checklist:
+
+- Ensure transport confidentiality by using HTTPS
+- Ensure HOTP/TOTP secret confidentiality by storing secrets in a controlled access database
+- Deny replay attacks by rejecting one-time passwords that have been used by the client (this requires storing the most 
+  recently authenticated timestamp, OTP, or hash of the OTP in your database, and rejecting the OTP when a match is seen)
+- Throttle brute-force attacks against your application's login functionality
+- When implementing a "greenfield" application, consider supporting
+  `FIDO U2F <https://en.wikipedia.org/wiki/Universal_2nd_Factor>`_/`WebAuthn <https://www.w3.org/TR/webauthn/>`_ in
+  addition to HOTP/TOTP. U2F uses asymmetric cryptography to avoid using a shared secret design, which strengthens your
+  MFA solution against server-side attacks. Hardware U2F also sequesters the client secret in a dedicated single-purpose
+  device, which strengthens your clients against client-side attacks. And by automating scoping of credentials to
+  relying party IDs (application origin/domain names), U2F adds protection against phishing attacks. One implementation of
+  FIDO U2F/WebAuthn is PyOTP's sister project, `PyWARP <https://github.com/pyauth/pywarp>`_.
+
+We also recommend that implementers read the
+`OWASP Authentication Cheat Sheet <https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md>`_ and
+`NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of
+authentication best practices.
 
 Quick overview of using One Time Passwords on your phone
 --------------------------------------------------------
@@ -56,25 +78,25 @@ Time-based OTPs
 ::
 
     totp = pyotp.TOTP('base32secret3232')
-    totp.now() # => 492039
+    totp.now() # => '492039'
 
     # OTP verified for current time
-    totp.verify(492039) # => True
+    totp.verify('492039') # => True
     time.sleep(30)
-    totp.verify(492039) # => False
+    totp.verify('492039') # => False
 
 Counter-based OTPs
 ~~~~~~~~~~~~~~~~~~
 ::
 
     hotp = pyotp.HOTP('base32secret3232')
-    hotp.at(0) # => 260182
-    hotp.at(1) # => 55283
-    hotp.at(1401) # => 316439
+    hotp.at(0) # => '260182'
+    hotp.at(1) # => '055283'
+    hotp.at(1401) # => '316439'
 
     # OTP verified with a counter
-    hotp.verify(316439, 1401) # => True
-    hotp.verify(316439, 1402) # => False
+    hotp.verify('316439', 1401) # => True
+    hotp.verify('316439', 1402) # => False
 
 Generating a base32 Secret Key
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -104,7 +126,7 @@ Working example
 
 Scan the following barcode with your phone's OTP app (e.g. Google Authenticator):
 
-.. image:: http://chart.apis.google.com/chart?cht=qr&chs=250x250&chl=otpauth%3A%2F%2Ftotp%2Falice%40google.com%3Fsecret%3DJBSWY3DPEHPK3PXP
+.. image:: https://chart.apis.google.com/chart?cht=qr&chs=250x250&chl=otpauth%3A%2F%2Ftotp%2Falice%40google.com%3Fsecret%3DJBSWY3DPEHPK3PXP
 
 Now run the following and compare the output::
 
@@ -123,9 +145,14 @@ Links
 * `RFC 6238: TOTP: Time-Based One-Time Password Algorithm <https://tools.ietf.org/html/rfc6238>`_
 * `ROTP <https://github.com/mdp/rotp>`_ - Original Ruby OTP library by `Mark Percival <https://github.com/mdp>`_
 * `OTPHP <https://github.com/lelag/otphp>`_ - PHP port of ROTP by `Le Lag <https://github.com/lelag>`_
-* `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_
+* `OWASP Authentication Cheat Sheet <https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md>`_
 * `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_
 
+For new applications:
+
+* `WebAuthn <https://www.w3.org/TR/webauthn/>`_
+* `PyWARP <https://github.com/pyauth/pywarp>`_
+
 .. image:: https://img.shields.io/travis/pyotp/pyotp.svg
         :target: https://travis-ci.org/pyotp/pyotp
 .. image:: https://img.shields.io/codecov/c/github/pyotp/pyotp/master.svg

pyotp-2.2.8.dist-info/RECORD

@@ -0,0 +1,11 @@
+pyotp/__init__.py,sha256=hamm6NeVXq0-y6jlBlVnO7oct5n5EHWltinaBxge8xk,685
+pyotp/compat.py,sha256=QVb4buImn4PyP0qe5uLiXsO2-p4ItTGl01Vbt2dILNE,222
+pyotp/hotp.py,sha256=Jotukhsjpwpbx05iHHPYgH0HzpAFUvRAnWauQ_4N69M,1772
+pyotp/otp.py,sha256=QPyHxZ7fY7_zlrMVVveGQrCfn6gatpaHO3-ok9XwCaU,2344
+pyotp/totp.py,sha256=EHnv9irTDDt2cLUIxy3w_80QaqtduAM08Xq7rU2bIm0,3168
+pyotp/utils.py,sha256=smffRHfGU9fwpzmkLrKz6Z3xt07-PEJ2lf8mJ1Tvn7I,3513
+pyotp-2.2.8.dist-info/LICENSE,sha256=f1C5lELlDYN3777_-tBjT7mgRr6HCXrzppnWNwsOG2M,1174
+pyotp-2.2.8.dist-info/METADATA,sha256=OHVMnmqShG3BbmFJPG9C6bi50zdvLZ27XJHr_NOq148,8004
+pyotp-2.2.8.dist-info/WHEEL,sha256=h_aVn5OB2IERUjMbi2pucmR_zzWJtk303YXvhh60NJ8,110
+pyotp-2.2.8.dist-info/top_level.txt,sha256=rFDgz6Sm4nbkYk6tlSRiMcJPyYdnY6LcZiAaYTxVc5k,6
+pyotp-2.2.8.dist-info/RECORD,,

{pyotp-2.2.6.dist-info → pyotp-2.2.8.dist-info}/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: bdist_wheel (0.29.0)
+Generator: bdist_wheel (0.33.4)
 Root-Is-Purelib: true
 Tag: py2-none-any
 Tag: py3-none-any

pyotp-2.2.6.dist-info/DESCRIPTION.rst

@@ -1,120 +0,0 @@
-PyOTP - The Python One-Time Password Library
-============================================
-
-PyOTP is a Python library for generating and verifying one-time passwords. It can be used to implement two-factor (2FA)
-or multi-factor (MFA) authentication methods in web applications and in other systems that require users to log in.
-
-Open MFA standards are defined in `RFC 4226 <https://tools.ietf.org/html/rfc4226>`_ (HOTP: An HMAC-Based One-Time
-Password Algorithm) and in `RFC 6238 <https://tools.ietf.org/html/rfc6238>`_ (TOTP: Time-Based One-Time Password
-Algorithm). PyOTP implements server-side support for both of these standards. Client-side support can be enabled by
-sending authentication codes to users over SMS or email (HOTP) or, for TOTP, by instructing users to use `Google
-Authenticator <https://en.wikipedia.org/wiki/Google_Authenticator>`_, `Authy <https://www.authy.com/>`_, or another
-compatible app. Users can set up auth tokens in their apps easily by using their phone camera to scan `otpauth://
-<https://github.com/google/google-authenticator/wiki/Key-Uri-Format>`_ QR codes provided by PyOTP.
-
-We recommend that implementers read the `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_ and `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of authentication best practices.
-
-Quick overview of using One Time Passwords on your phone
---------------------------------------------------------
-
-* OTPs involve a shared secret, stored both on the phone and the server
-* OTPs can be generated on a phone without internet connectivity
-* OTPs should always be used as a second factor of authentication (if your phone is lost, you account is still secured with a password)
-* Google Authenticator and other OTP client apps allow you to store multiple OTP secrets and provision those using a QR Code
-
-Installation
-------------
-::
-
-    pip install pyotp
-
-Usage
------
-
-Time-based OTPs
-~~~~~~~~~~~~~~~
-::
-
-    totp = pyotp.TOTP('base32secret3232')
-    totp.now() # => 492039
-
-    # OTP verified for current time
-    totp.verify(492039) # => True
-    time.sleep(30)
-    totp.verify(492039) # => False
-
-Counter-based OTPs
-~~~~~~~~~~~~~~~~~~
-::
-
-    hotp = pyotp.HOTP('base32secret3232')
-    hotp.at(0) # => 260182
-    hotp.at(1) # => 55283
-    hotp.at(1401) # => 316439
-
-    # OTP verified with a counter
-    hotp.verify(316439, 1401) # => True
-    hotp.verify(316439, 1402) # => False
-
-Generating a base32 Secret Key
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-::
-
-    pyotp.random_base32() # returns a 16 character base32 secret. Compatible with Google Authenticator and other OTP apps
-
-Google Authenticator Compatible
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-PyOTP works with the Google Authenticator iPhone and Android app, as well as other OTP apps like Authy. PyOTP includes the
-ability to generate provisioning URIs for use with the QR Code scanner built into these MFA client apps::
-
-    pyotp.totp.TOTP('JBSWY3DPEHPK3PXP').provisioning_uri("alice@google.com", issuer_name="Secure App")
-
-    >>> 'otpauth://totp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure%20App'
-
-    pyotp.hotp.HOTP('JBSWY3DPEHPK3PXP').provisioning_uri("alice@google.com", initial_count=0, issuer_name="Secure App")
-
-    >>> 'otpauth://hotp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure%20App&counter=0'
-
-This URL can then be rendered as a QR Code (for example, using https://github.com/neocotic/qrious) which can then be scanned
-and added to the users list of OTP credentials.
-
-Working example
-~~~~~~~~~~~~~~~
-
-Scan the following barcode with your phone's OTP app (e.g. Google Authenticator):
-
-.. image:: http://chart.apis.google.com/chart?cht=qr&chs=250x250&chl=otpauth%3A%2F%2Ftotp%2Falice%40google.com%3Fsecret%3DJBSWY3DPEHPK3PXP
-
-Now run the following and compare the output::
-
-    import pyotp
-    totp = pyotp.TOTP("JBSWY3DPEHPK3PXP")
-    print("Current OTP:", totp.now())
-
-Links
-~~~~~
-
-* `Project home page (GitHub) <https://github.com/pyotp/pyotp>`_
-* `Documentation (Read the Docs) <https://pyotp.readthedocs.io/en/latest/>`_
-* `Package distribution (PyPI) <https://pypi.python.org/pypi/pyotp>`_
-* `Change log <https://github.com/pyotp/pyotp/blob/master/Changes.rst>`_
-* `RFC 4226: HOTP: An HMAC-Based One-Time Password <https://tools.ietf.org/html/rfc4226>`_
-* `RFC 6238: TOTP: Time-Based One-Time Password Algorithm <https://tools.ietf.org/html/rfc6238>`_
-* `ROTP <https://github.com/mdp/rotp>`_ - Original Ruby OTP library by `Mark Percival <https://github.com/mdp>`_
-* `OTPHP <https://github.com/lelag/otphp>`_ - PHP port of ROTP by `Le Lag <https://github.com/lelag>`_
-* `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_
-* `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_
-
-.. image:: https://img.shields.io/travis/pyotp/pyotp.svg
-        :target: https://travis-ci.org/pyotp/pyotp
-.. image:: https://img.shields.io/codecov/c/github/pyotp/pyotp/master.svg
-        :target: https://codecov.io/github/pyotp/pyotp?branch=master
-.. image:: https://img.shields.io/pypi/v/pyotp.svg
-        :target: https://pypi.python.org/pypi/pyotp
-.. image:: https://img.shields.io/pypi/l/pyotp.svg
-        :target: https://pypi.python.org/pypi/pyotp
-.. image:: https://readthedocs.org/projects/pyotp/badge/?version=latest
-        :target: https://pyotp.readthedocs.io/
-
-

pyotp-2.2.6.dist-info/RECORD

@@ -1,12 +0,0 @@
-pyotp/__init__.py,sha256=3I4NkdbXw4iHBbtfL7-dbNv8XZn0EUzS0Fc1riI1CJ8,485
-pyotp/compat.py,sha256=QVb4buImn4PyP0qe5uLiXsO2-p4ItTGl01Vbt2dILNE,222
-pyotp/hotp.py,sha256=IE8W055gBBV1kQv4v7prJ_L58IvZe9mUMIcjF13pyNk,1769
-pyotp/otp.py,sha256=QPyHxZ7fY7_zlrMVVveGQrCfn6gatpaHO3-ok9XwCaU,2344
-pyotp/totp.py,sha256=EHnv9irTDDt2cLUIxy3w_80QaqtduAM08Xq7rU2bIm0,3168
-pyotp/utils.py,sha256=yNbD4BeXUs1mv5muOwxp8dtnaqlBt4NC4ImLSjB6OGQ,3495
-pyotp-2.2.6.dist-info/DESCRIPTION.rst,sha256=KI0U6tvZaxBYmlD_VyLpHeyNm5elafwC0eCMmFsfCP0,5471
-pyotp-2.2.6.dist-info/METADATA,sha256=ntbqIw2lOH8-JFl68J5Fj2h6GjUjPG2aY0WNBx0FLNk,6167
-pyotp-2.2.6.dist-info/RECORD,,
-pyotp-2.2.6.dist-info/WHEEL,sha256=o2k-Qa-RMNIJmUdIc7KU6VWR_ErNRbWNlxDIpl7lm34,110
-pyotp-2.2.6.dist-info/metadata.json,sha256=AFaiADRx4xZYCktiIUacspllTHRVobY-tyltQMD_0Hs,825
-pyotp-2.2.6.dist-info/top_level.txt,sha256=rFDgz6Sm4nbkYk6tlSRiMcJPyYdnY6LcZiAaYTxVc5k,6

pyotp-2.2.6.dist-info/metadata.json

@@ -1 +0,0 @@
-{"classifiers": ["Intended Audience :: Developers", "License :: OSI Approved :: BSD License", "Operating System :: MacOS :: MacOS X", "Operating System :: POSIX", "Programming Language :: Python", "Programming Language :: Python :: 2.7", "Programming Language :: Python :: 3.3", "Programming Language :: Python :: 3.4", "Topic :: Software Development :: Libraries :: Python Modules"], "extensions": {"python.details": {"contacts": [{"email": "kislyuk@gmail.com", "name": "PyOTP contributors", "role": "author"}], "document_names": {"description": "DESCRIPTION.rst"}, "project_urls": {"Home": "https://github.com/pyotp/pyotp"}}}, "generator": "bdist_wheel (0.29.0)", "license": "BSD License", "metadata_version": "2.0", "name": "pyotp", "platform": "MacOS X", "summary": "Python One Time Password Library", "version": "2.2.6"}