PyOTP 2.2.6__tar.gz → 2.2.7__tar.gz

{pyotp-2.2.6 → pyotp-2.2.7}/LICENSE

@@ -1,5 +1,6 @@
-Copyright (C) 2011-2016 Mark Percival <m@mdp.im>,
-Nathan Reynolds <email@nreynolds.co.uk>, and PyOTP contributors
+Copyright (C) 2011-2017 Mark Percival <m@mdp.im>,
+Nathan Reynolds <email@nreynolds.co.uk>, Andrey Kislyuk <kislyuk@gmail.com>,
+and PyOTP contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

{pyotp-2.2.6/src/pyotp.egg-info → pyotp-2.2.7}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 1.1
 Name: pyotp
-Version: 2.2.6
+Version: 2.2.7
 Summary: Python One Time Password Library
 Home-page: https://github.com/pyotp/pyotp
 Author: PyOTP contributors
 Author-email: kislyuk@gmail.com
-License: BSD License
+License: MIT License
 Description: PyOTP - The Python One-Time Password Library
         ============================================
         
@@ -20,7 +20,25 @@ Description: PyOTP - The Python One-Time Password Library
         compatible app. Users can set up auth tokens in their apps easily by using their phone camera to scan `otpauth://
         <https://github.com/google/google-authenticator/wiki/Key-Uri-Format>`_ QR codes provided by PyOTP.
         
-        We recommend that implementers read the `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_ and `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of authentication best practices.
+        Implementers should read and follow the `HOTP security requirements <https://tools.ietf.org/html/rfc4226#section-7>`_
+        and `TOTP security considerations <https://tools.ietf.org/html/rfc6238#section-5>`_ sections of the relevant RFCs. At
+        minimum, application implementers should follow this checklist:
+        
+        - Ensure transport confidentiality by using HTTPS
+        - Ensure HOTP/TOTP secret confidentiality by storing secrets in a controlled access database
+        - Deny replay attacks by rejecting one-time passwords that have been used by the client (this requires storing the most 
+          recently authenticated timestamp, OTP, or hash of the OTP in your database, and rejecting the OTP when a match is seen)
+        - Throttle brute-force attacks against your application's login functionality
+        - When implementing a "green field" application, consider supporting
+          `FIDO U2F <https://en.wikipedia.org/wiki/Universal_2nd_Factor>`_ in addition to HOTP/TOTP. U2F uses asymmetric
+          cryptography to avoid using a shared secret design, which strengthens your MFA solution against server-side compromise.
+          Hardware U2F also sequesters the client secret in a dedicated single-purpose device, which strengthens your clients
+          against client-side compromise.
+        
+        We also recommend that implementers read the
+        `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_ and
+        `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of
+        authentication best practices.
         
         Quick overview of using One Time Passwords on your phone
         --------------------------------------------------------
@@ -44,25 +62,25 @@ Description: PyOTP - The Python One-Time Password Library
         ::
         
             totp = pyotp.TOTP('base32secret3232')
-            totp.now() # => 492039
+            totp.now() # => '492039'
         
             # OTP verified for current time
-            totp.verify(492039) # => True
+            totp.verify('492039') # => True
             time.sleep(30)
-            totp.verify(492039) # => False
+            totp.verify('492039') # => False
         
         Counter-based OTPs
         ~~~~~~~~~~~~~~~~~~
         ::
         
             hotp = pyotp.HOTP('base32secret3232')
-            hotp.at(0) # => 260182
-            hotp.at(1) # => 55283
-            hotp.at(1401) # => 316439
+            hotp.at(0) # => '260182'
+            hotp.at(1) # => '055283'
+            hotp.at(1401) # => '316439'
         
             # OTP verified with a counter
-            hotp.verify(316439, 1401) # => True
-            hotp.verify(316439, 1402) # => False
+            hotp.verify('316439', 1401) # => True
+            hotp.verify('316439', 1402) # => False
         
         Generating a base32 Secret Key
         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -128,7 +146,7 @@ Description: PyOTP - The Python One-Time Password Library
 Platform: MacOS X
 Platform: Posix
 Classifier: Intended Audience :: Developers
-Classifier: License :: OSI Approved :: BSD License
+Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: MacOS :: MacOS X
 Classifier: Operating System :: POSIX
 Classifier: Programming Language :: Python

{pyotp-2.2.6 → pyotp-2.2.7}/README.rst

@@ -12,7 +12,25 @@ Authenticator <https://en.wikipedia.org/wiki/Google_Authenticator>`_, `Authy <ht
 compatible app. Users can set up auth tokens in their apps easily by using their phone camera to scan `otpauth://
 <https://github.com/google/google-authenticator/wiki/Key-Uri-Format>`_ QR codes provided by PyOTP.
 
-We recommend that implementers read the `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_ and `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of authentication best practices.
+Implementers should read and follow the `HOTP security requirements <https://tools.ietf.org/html/rfc4226#section-7>`_
+and `TOTP security considerations <https://tools.ietf.org/html/rfc6238#section-5>`_ sections of the relevant RFCs. At
+minimum, application implementers should follow this checklist:
+
+- Ensure transport confidentiality by using HTTPS
+- Ensure HOTP/TOTP secret confidentiality by storing secrets in a controlled access database
+- Deny replay attacks by rejecting one-time passwords that have been used by the client (this requires storing the most 
+  recently authenticated timestamp, OTP, or hash of the OTP in your database, and rejecting the OTP when a match is seen)
+- Throttle brute-force attacks against your application's login functionality
+- When implementing a "green field" application, consider supporting
+  `FIDO U2F <https://en.wikipedia.org/wiki/Universal_2nd_Factor>`_ in addition to HOTP/TOTP. U2F uses asymmetric
+  cryptography to avoid using a shared secret design, which strengthens your MFA solution against server-side compromise.
+  Hardware U2F also sequesters the client secret in a dedicated single-purpose device, which strengthens your clients
+  against client-side compromise.
+
+We also recommend that implementers read the
+`OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_ and
+`NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of
+authentication best practices.
 
 Quick overview of using One Time Passwords on your phone
 --------------------------------------------------------
@@ -36,25 +54,25 @@ Time-based OTPs
 ::
 
     totp = pyotp.TOTP('base32secret3232')
-    totp.now() # => 492039
+    totp.now() # => '492039'
 
     # OTP verified for current time
-    totp.verify(492039) # => True
+    totp.verify('492039') # => True
     time.sleep(30)
-    totp.verify(492039) # => False
+    totp.verify('492039') # => False
 
 Counter-based OTPs
 ~~~~~~~~~~~~~~~~~~
 ::
 
     hotp = pyotp.HOTP('base32secret3232')
-    hotp.at(0) # => 260182
-    hotp.at(1) # => 55283
-    hotp.at(1401) # => 316439
+    hotp.at(0) # => '260182'
+    hotp.at(1) # => '055283'
+    hotp.at(1401) # => '316439'
 
     # OTP verified with a counter
-    hotp.verify(316439, 1401) # => True
-    hotp.verify(316439, 1402) # => False
+    hotp.verify('316439', 1401) # => True
+    hotp.verify('316439', 1402) # => False
 
 Generating a base32 Secret Key
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

{pyotp-2.2.6 → pyotp-2.2.7}/setup.cfg

@@ -3,7 +3,7 @@ universal = 1
 
 [flake8]
 max-line-length = 120
-ignore = E301, E302, E305, E401, E226, F841
+ignore = E301, E302, W504
 
 [egg_info]
 tag_build = 

{pyotp-2.2.6 → pyotp-2.2.7}/setup.py

@@ -7,9 +7,9 @@ install_requires = [line.rstrip() for line in open(os.path.join(os.path.dirname(
 
 setup(
     name="pyotp",
-    version="2.2.6",
+    version="2.2.7",
     url="https://github.com/pyotp/pyotp",
-    license="BSD License",
+    license="MIT License",
     author="PyOTP contributors",
     author_email="kislyuk@gmail.com",
     description="Python One Time Password Library",
@@ -22,7 +22,7 @@ setup(
     test_suite="test",
     classifiers=[
         "Intended Audience :: Developers",
-        "License :: OSI Approved :: BSD License",
+        "License :: OSI Approved :: MIT License",
         "Operating System :: MacOS :: MacOS X",
         "Operating System :: POSIX",
         "Programming Language :: Python",

{pyotp-2.2.6 → pyotp-2.2.7}/src/pyotp/__init__.py

@@ -1,16 +1,22 @@
 from __future__ import (absolute_import, division,
                         print_function, unicode_literals)
 
-import random as _random
-
 from pyotp.hotp import HOTP  # noqa
 from pyotp.otp import OTP  # noqa
 from pyotp.totp import TOTP  # noqa
 from . import utils  # noqa
 
-
-def random_base32(length=16, random=_random.SystemRandom(),
+def random_base32(length=16, random=None,
                   chars=list('ABCDEFGHIJKLMNOPQRSTUVWXYZ234567')):
+
+    # Use secrets module if available (Python version >= 3.6) per PEP 506
+    try:
+        import secrets
+        random = secrets.SystemRandom()
+    except ImportError:
+        import random as _random
+        random = _random.SystemRandom()
+
     return ''.join(
         random.choice(chars)
         for _ in range(length)

{pyotp-2.2.6 → pyotp-2.2.7}/src/pyotp/hotp.py

@@ -21,7 +21,7 @@ class HOTP(OTP):
 
     def verify(self, otp, counter):
         """
-        Verifies the OTP passed in against the current time OTP.
+        Verifies the OTP passed in against the current counter OTP.
 
         :param otp: the OTP to check against
         :type otp: str

{pyotp-2.2.6 → pyotp-2.2.7/src/pyotp.egg-info}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 1.1
 Name: pyotp
-Version: 2.2.6
+Version: 2.2.7
 Summary: Python One Time Password Library
 Home-page: https://github.com/pyotp/pyotp
 Author: PyOTP contributors
 Author-email: kislyuk@gmail.com
-License: BSD License
+License: MIT License
 Description: PyOTP - The Python One-Time Password Library
         ============================================
         
@@ -20,7 +20,25 @@ Description: PyOTP - The Python One-Time Password Library
         compatible app. Users can set up auth tokens in their apps easily by using their phone camera to scan `otpauth://
         <https://github.com/google/google-authenticator/wiki/Key-Uri-Format>`_ QR codes provided by PyOTP.
         
-        We recommend that implementers read the `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_ and `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of authentication best practices.
+        Implementers should read and follow the `HOTP security requirements <https://tools.ietf.org/html/rfc4226#section-7>`_
+        and `TOTP security considerations <https://tools.ietf.org/html/rfc6238#section-5>`_ sections of the relevant RFCs. At
+        minimum, application implementers should follow this checklist:
+        
+        - Ensure transport confidentiality by using HTTPS
+        - Ensure HOTP/TOTP secret confidentiality by storing secrets in a controlled access database
+        - Deny replay attacks by rejecting one-time passwords that have been used by the client (this requires storing the most 
+          recently authenticated timestamp, OTP, or hash of the OTP in your database, and rejecting the OTP when a match is seen)
+        - Throttle brute-force attacks against your application's login functionality
+        - When implementing a "green field" application, consider supporting
+          `FIDO U2F <https://en.wikipedia.org/wiki/Universal_2nd_Factor>`_ in addition to HOTP/TOTP. U2F uses asymmetric
+          cryptography to avoid using a shared secret design, which strengthens your MFA solution against server-side compromise.
+          Hardware U2F also sequesters the client secret in a dedicated single-purpose device, which strengthens your clients
+          against client-side compromise.
+        
+        We also recommend that implementers read the
+        `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_ and
+        `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of
+        authentication best practices.
         
         Quick overview of using One Time Passwords on your phone
         --------------------------------------------------------
@@ -44,25 +62,25 @@ Description: PyOTP - The Python One-Time Password Library
         ::
         
             totp = pyotp.TOTP('base32secret3232')
-            totp.now() # => 492039
+            totp.now() # => '492039'
         
             # OTP verified for current time
-            totp.verify(492039) # => True
+            totp.verify('492039') # => True
             time.sleep(30)
-            totp.verify(492039) # => False
+            totp.verify('492039') # => False
         
         Counter-based OTPs
         ~~~~~~~~~~~~~~~~~~
         ::
         
             hotp = pyotp.HOTP('base32secret3232')
-            hotp.at(0) # => 260182
-            hotp.at(1) # => 55283
-            hotp.at(1401) # => 316439
+            hotp.at(0) # => '260182'
+            hotp.at(1) # => '055283'
+            hotp.at(1401) # => '316439'
         
             # OTP verified with a counter
-            hotp.verify(316439, 1401) # => True
-            hotp.verify(316439, 1402) # => False
+            hotp.verify('316439', 1401) # => True
+            hotp.verify('316439', 1402) # => False
         
         Generating a base32 Secret Key
         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -128,7 +146,7 @@ Description: PyOTP - The Python One-Time Password Library
 Platform: MacOS X
 Platform: Posix
 Classifier: Intended Audience :: Developers
-Classifier: License :: OSI Approved :: BSD License
+Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: MacOS :: MacOS X
 Classifier: Operating System :: POSIX
 Classifier: Programming Language :: Python

{pyotp-2.2.6 → pyotp-2.2.7}/src/pyotp/utils.py

@@ -85,12 +85,12 @@ def _compare_digest(s1, s2):
         differences |= ord(c1) ^ ord(c2)
     return differences == 0
 
+
 try:
     # Python 3.3+ and 2.7.7+ include a timing-attack-resistant
     # comparison function, which is probably more reliable than ours.
     # Use it if available.
     from hmac import compare_digest
-
 except ImportError:
     compare_digest = _compare_digest