PyOTP 2.2.6__tar.gz → 2.2.8__tar.gz

{pyotp-2.2.6 → pyotp-2.2.8}/LICENSE

@@ -1,5 +1,6 @@
-Copyright (C) 2011-2016 Mark Percival <m@mdp.im>,
-Nathan Reynolds <email@nreynolds.co.uk>, and PyOTP contributors
+Copyright (C) 2011-2017 Mark Percival <m@mdp.im>,
+Nathan Reynolds <email@nreynolds.co.uk>, Andrey Kislyuk <kislyuk@gmail.com>,
+and PyOTP contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

{pyotp-2.2.6/src/pyotp.egg-info → pyotp-2.2.8}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 1.1
 Name: pyotp
-Version: 2.2.6
+Version: 2.2.8
 Summary: Python One Time Password Library
 Home-page: https://github.com/pyotp/pyotp
 Author: PyOTP contributors
 Author-email: kislyuk@gmail.com
-License: BSD License
+License: MIT License
 Description: PyOTP - The Python One-Time Password Library
         ============================================
         
@@ -20,7 +20,27 @@ Description: PyOTP - The Python One-Time Password Library
         compatible app. Users can set up auth tokens in their apps easily by using their phone camera to scan `otpauth://
         <https://github.com/google/google-authenticator/wiki/Key-Uri-Format>`_ QR codes provided by PyOTP.
         
-        We recommend that implementers read the `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_ and `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of authentication best practices.
+        Implementers should read and follow the `HOTP security requirements <https://tools.ietf.org/html/rfc4226#section-7>`_
+        and `TOTP security considerations <https://tools.ietf.org/html/rfc6238#section-5>`_ sections of the relevant RFCs. At
+        minimum, application implementers should follow this checklist:
+        
+        - Ensure transport confidentiality by using HTTPS
+        - Ensure HOTP/TOTP secret confidentiality by storing secrets in a controlled access database
+        - Deny replay attacks by rejecting one-time passwords that have been used by the client (this requires storing the most 
+          recently authenticated timestamp, OTP, or hash of the OTP in your database, and rejecting the OTP when a match is seen)
+        - Throttle brute-force attacks against your application's login functionality
+        - When implementing a "greenfield" application, consider supporting
+          `FIDO U2F <https://en.wikipedia.org/wiki/Universal_2nd_Factor>`_/`WebAuthn <https://www.w3.org/TR/webauthn/>`_ in
+          addition to HOTP/TOTP. U2F uses asymmetric cryptography to avoid using a shared secret design, which strengthens your
+          MFA solution against server-side attacks. Hardware U2F also sequesters the client secret in a dedicated single-purpose
+          device, which strengthens your clients against client-side attacks. And by automating scoping of credentials to
+          relying party IDs (application origin/domain names), U2F adds protection against phishing attacks. One implementation of
+          FIDO U2F/WebAuthn is PyOTP's sister project, `PyWARP <https://github.com/pyauth/pywarp>`_.
+        
+        We also recommend that implementers read the
+        `OWASP Authentication Cheat Sheet <https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md>`_ and
+        `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of
+        authentication best practices.
         
         Quick overview of using One Time Passwords on your phone
         --------------------------------------------------------
@@ -44,25 +64,25 @@ Description: PyOTP - The Python One-Time Password Library
         ::
         
             totp = pyotp.TOTP('base32secret3232')
-            totp.now() # => 492039
+            totp.now() # => '492039'
         
             # OTP verified for current time
-            totp.verify(492039) # => True
+            totp.verify('492039') # => True
             time.sleep(30)
-            totp.verify(492039) # => False
+            totp.verify('492039') # => False
         
         Counter-based OTPs
         ~~~~~~~~~~~~~~~~~~
         ::
         
             hotp = pyotp.HOTP('base32secret3232')
-            hotp.at(0) # => 260182
-            hotp.at(1) # => 55283
-            hotp.at(1401) # => 316439
+            hotp.at(0) # => '260182'
+            hotp.at(1) # => '055283'
+            hotp.at(1401) # => '316439'
         
             # OTP verified with a counter
-            hotp.verify(316439, 1401) # => True
-            hotp.verify(316439, 1402) # => False
+            hotp.verify('316439', 1401) # => True
+            hotp.verify('316439', 1402) # => False
         
         Generating a base32 Secret Key
         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -92,7 +112,7 @@ Description: PyOTP - The Python One-Time Password Library
         
         Scan the following barcode with your phone's OTP app (e.g. Google Authenticator):
         
-        .. image:: http://chart.apis.google.com/chart?cht=qr&chs=250x250&chl=otpauth%3A%2F%2Ftotp%2Falice%40google.com%3Fsecret%3DJBSWY3DPEHPK3PXP
+        .. image:: https://chart.apis.google.com/chart?cht=qr&chs=250x250&chl=otpauth%3A%2F%2Ftotp%2Falice%40google.com%3Fsecret%3DJBSWY3DPEHPK3PXP
         
         Now run the following and compare the output::
         
@@ -111,9 +131,14 @@ Description: PyOTP - The Python One-Time Password Library
         * `RFC 6238: TOTP: Time-Based One-Time Password Algorithm <https://tools.ietf.org/html/rfc6238>`_
         * `ROTP <https://github.com/mdp/rotp>`_ - Original Ruby OTP library by `Mark Percival <https://github.com/mdp>`_
         * `OTPHP <https://github.com/lelag/otphp>`_ - PHP port of ROTP by `Le Lag <https://github.com/lelag>`_
-        * `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_
+        * `OWASP Authentication Cheat Sheet <https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md>`_
         * `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_
         
+        For new applications:
+        
+        * `WebAuthn <https://www.w3.org/TR/webauthn/>`_
+        * `PyWARP <https://github.com/pyauth/pywarp>`_
+        
         .. image:: https://img.shields.io/travis/pyotp/pyotp.svg
                 :target: https://travis-ci.org/pyotp/pyotp
         .. image:: https://img.shields.io/codecov/c/github/pyotp/pyotp/master.svg
@@ -128,11 +153,13 @@ Description: PyOTP - The Python One-Time Password Library
 Platform: MacOS X
 Platform: Posix
 Classifier: Intended Audience :: Developers
-Classifier: License :: OSI Approved :: BSD License
+Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: MacOS :: MacOS X
 Classifier: Operating System :: POSIX
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 2.7
-Classifier: Programming Language :: Python :: 3.3
 Classifier: Programming Language :: Python :: 3.4
+Classifier: Programming Language :: Python :: 3.5
+Classifier: Programming Language :: Python :: 3.6
+Classifier: Programming Language :: Python :: 3.7
 Classifier: Topic :: Software Development :: Libraries :: Python Modules

{pyotp-2.2.6 → pyotp-2.2.8}/README.rst

@@ -12,7 +12,27 @@ Authenticator <https://en.wikipedia.org/wiki/Google_Authenticator>`_, `Authy <ht
 compatible app. Users can set up auth tokens in their apps easily by using their phone camera to scan `otpauth://
 <https://github.com/google/google-authenticator/wiki/Key-Uri-Format>`_ QR codes provided by PyOTP.
 
-We recommend that implementers read the `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_ and `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of authentication best practices.
+Implementers should read and follow the `HOTP security requirements <https://tools.ietf.org/html/rfc4226#section-7>`_
+and `TOTP security considerations <https://tools.ietf.org/html/rfc6238#section-5>`_ sections of the relevant RFCs. At
+minimum, application implementers should follow this checklist:
+
+- Ensure transport confidentiality by using HTTPS
+- Ensure HOTP/TOTP secret confidentiality by storing secrets in a controlled access database
+- Deny replay attacks by rejecting one-time passwords that have been used by the client (this requires storing the most 
+  recently authenticated timestamp, OTP, or hash of the OTP in your database, and rejecting the OTP when a match is seen)
+- Throttle brute-force attacks against your application's login functionality
+- When implementing a "greenfield" application, consider supporting
+  `FIDO U2F <https://en.wikipedia.org/wiki/Universal_2nd_Factor>`_/`WebAuthn <https://www.w3.org/TR/webauthn/>`_ in
+  addition to HOTP/TOTP. U2F uses asymmetric cryptography to avoid using a shared secret design, which strengthens your
+  MFA solution against server-side attacks. Hardware U2F also sequesters the client secret in a dedicated single-purpose
+  device, which strengthens your clients against client-side attacks. And by automating scoping of credentials to
+  relying party IDs (application origin/domain names), U2F adds protection against phishing attacks. One implementation of
+  FIDO U2F/WebAuthn is PyOTP's sister project, `PyWARP <https://github.com/pyauth/pywarp>`_.
+
+We also recommend that implementers read the
+`OWASP Authentication Cheat Sheet <https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md>`_ and
+`NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of
+authentication best practices.
 
 Quick overview of using One Time Passwords on your phone
 --------------------------------------------------------
@@ -36,25 +56,25 @@ Time-based OTPs
 ::
 
     totp = pyotp.TOTP('base32secret3232')
-    totp.now() # => 492039
+    totp.now() # => '492039'
 
     # OTP verified for current time
-    totp.verify(492039) # => True
+    totp.verify('492039') # => True
     time.sleep(30)
-    totp.verify(492039) # => False
+    totp.verify('492039') # => False
 
 Counter-based OTPs
 ~~~~~~~~~~~~~~~~~~
 ::
 
     hotp = pyotp.HOTP('base32secret3232')
-    hotp.at(0) # => 260182
-    hotp.at(1) # => 55283
-    hotp.at(1401) # => 316439
+    hotp.at(0) # => '260182'
+    hotp.at(1) # => '055283'
+    hotp.at(1401) # => '316439'
 
     # OTP verified with a counter
-    hotp.verify(316439, 1401) # => True
-    hotp.verify(316439, 1402) # => False
+    hotp.verify('316439', 1401) # => True
+    hotp.verify('316439', 1402) # => False
 
 Generating a base32 Secret Key
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -84,7 +104,7 @@ Working example
 
 Scan the following barcode with your phone's OTP app (e.g. Google Authenticator):
 
-.. image:: http://chart.apis.google.com/chart?cht=qr&chs=250x250&chl=otpauth%3A%2F%2Ftotp%2Falice%40google.com%3Fsecret%3DJBSWY3DPEHPK3PXP
+.. image:: https://chart.apis.google.com/chart?cht=qr&chs=250x250&chl=otpauth%3A%2F%2Ftotp%2Falice%40google.com%3Fsecret%3DJBSWY3DPEHPK3PXP
 
 Now run the following and compare the output::
 
@@ -103,9 +123,14 @@ Links
 * `RFC 6238: TOTP: Time-Based One-Time Password Algorithm <https://tools.ietf.org/html/rfc6238>`_
 * `ROTP <https://github.com/mdp/rotp>`_ - Original Ruby OTP library by `Mark Percival <https://github.com/mdp>`_
 * `OTPHP <https://github.com/lelag/otphp>`_ - PHP port of ROTP by `Le Lag <https://github.com/lelag>`_
-* `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_
+* `OWASP Authentication Cheat Sheet <https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md>`_
 * `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_
 
+For new applications:
+
+* `WebAuthn <https://www.w3.org/TR/webauthn/>`_
+* `PyWARP <https://github.com/pyauth/pywarp>`_
+
 .. image:: https://img.shields.io/travis/pyotp/pyotp.svg
         :target: https://travis-ci.org/pyotp/pyotp
 .. image:: https://img.shields.io/codecov/c/github/pyotp/pyotp/master.svg

{pyotp-2.2.6 → pyotp-2.2.8}/setup.cfg

@@ -3,7 +3,7 @@ universal = 1
 
 [flake8]
 max-line-length = 120
-ignore = E301, E302, E305, E401, E226, F841
+ignore = E301, E302, W504
 
 [egg_info]
 tag_build = 

{pyotp-2.2.6 → pyotp-2.2.8}/setup.py

@@ -7,9 +7,9 @@ install_requires = [line.rstrip() for line in open(os.path.join(os.path.dirname(
 
 setup(
     name="pyotp",
-    version="2.2.6",
+    version="2.2.8",
     url="https://github.com/pyotp/pyotp",
-    license="BSD License",
+    license="MIT License",
     author="PyOTP contributors",
     author_email="kislyuk@gmail.com",
     description="Python One Time Password Library",
@@ -22,13 +22,15 @@ setup(
     test_suite="test",
     classifiers=[
         "Intended Audience :: Developers",
-        "License :: OSI Approved :: BSD License",
+        "License :: OSI Approved :: MIT License",
         "Operating System :: MacOS :: MacOS X",
         "Operating System :: POSIX",
         "Programming Language :: Python",
         "Programming Language :: Python :: 2.7",
-        "Programming Language :: Python :: 3.3",
         "Programming Language :: Python :: 3.4",
+        "Programming Language :: Python :: 3.5",
+        "Programming Language :: Python :: 3.6",
+        "Programming Language :: Python :: 3.7",
         "Topic :: Software Development :: Libraries :: Python Modules"
     ]
 )

{pyotp-2.2.6 → pyotp-2.2.8}/src/pyotp/__init__.py

@@ -1,16 +1,22 @@
 from __future__ import (absolute_import, division,
                         print_function, unicode_literals)
 
-import random as _random
-
 from pyotp.hotp import HOTP  # noqa
 from pyotp.otp import OTP  # noqa
 from pyotp.totp import TOTP  # noqa
 from . import utils  # noqa
 
-
-def random_base32(length=16, random=_random.SystemRandom(),
+def random_base32(length=16, random=None,
                   chars=list('ABCDEFGHIJKLMNOPQRSTUVWXYZ234567')):
+
+    # Use secrets module if available (Python version >= 3.6) per PEP 506
+    try:
+        import secrets
+        random = secrets.SystemRandom()
+    except ImportError:
+        import random as _random
+        random = _random.SystemRandom()
+
     return ''.join(
         random.choice(chars)
         for _ in range(length)

{pyotp-2.2.6 → pyotp-2.2.8}/src/pyotp/hotp.py

@@ -21,7 +21,7 @@ class HOTP(OTP):
 
     def verify(self, otp, counter):
         """
-        Verifies the OTP passed in against the current time OTP.
+        Verifies the OTP passed in against the current counter OTP.
 
         :param otp: the OTP to check against
         :type otp: str

{pyotp-2.2.6 → pyotp-2.2.8}/src/pyotp/utils.py

@@ -85,12 +85,12 @@ def _compare_digest(s1, s2):
         differences |= ord(c1) ^ ord(c2)
     return differences == 0
 
+
 try:
     # Python 3.3+ and 2.7.7+ include a timing-attack-resistant
     # comparison function, which is probably more reliable than ours.
     # Use it if available.
     from hmac import compare_digest
-
 except ImportError:
     compare_digest = _compare_digest
 
@@ -106,4 +106,4 @@ def strings_equal(s1, s2):
     """
     s1 = unicodedata.normalize('NFKC', s1)
     s2 = unicodedata.normalize('NFKC', s2)
-    return compare_digest(s1, s2)
+    return compare_digest(s1.encode(), s2.encode())

{pyotp-2.2.6 → pyotp-2.2.8/src/pyotp.egg-info}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 1.1
 Name: pyotp
-Version: 2.2.6
+Version: 2.2.8
 Summary: Python One Time Password Library
 Home-page: https://github.com/pyotp/pyotp
 Author: PyOTP contributors
 Author-email: kislyuk@gmail.com
-License: BSD License
+License: MIT License
 Description: PyOTP - The Python One-Time Password Library
         ============================================
         
@@ -20,7 +20,27 @@ Description: PyOTP - The Python One-Time Password Library
         compatible app. Users can set up auth tokens in their apps easily by using their phone camera to scan `otpauth://
         <https://github.com/google/google-authenticator/wiki/Key-Uri-Format>`_ QR codes provided by PyOTP.
         
-        We recommend that implementers read the `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_ and `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of authentication best practices.
+        Implementers should read and follow the `HOTP security requirements <https://tools.ietf.org/html/rfc4226#section-7>`_
+        and `TOTP security considerations <https://tools.ietf.org/html/rfc6238#section-5>`_ sections of the relevant RFCs. At
+        minimum, application implementers should follow this checklist:
+        
+        - Ensure transport confidentiality by using HTTPS
+        - Ensure HOTP/TOTP secret confidentiality by storing secrets in a controlled access database
+        - Deny replay attacks by rejecting one-time passwords that have been used by the client (this requires storing the most 
+          recently authenticated timestamp, OTP, or hash of the OTP in your database, and rejecting the OTP when a match is seen)
+        - Throttle brute-force attacks against your application's login functionality
+        - When implementing a "greenfield" application, consider supporting
+          `FIDO U2F <https://en.wikipedia.org/wiki/Universal_2nd_Factor>`_/`WebAuthn <https://www.w3.org/TR/webauthn/>`_ in
+          addition to HOTP/TOTP. U2F uses asymmetric cryptography to avoid using a shared secret design, which strengthens your
+          MFA solution against server-side attacks. Hardware U2F also sequesters the client secret in a dedicated single-purpose
+          device, which strengthens your clients against client-side attacks. And by automating scoping of credentials to
+          relying party IDs (application origin/domain names), U2F adds protection against phishing attacks. One implementation of
+          FIDO U2F/WebAuthn is PyOTP's sister project, `PyWARP <https://github.com/pyauth/pywarp>`_.
+        
+        We also recommend that implementers read the
+        `OWASP Authentication Cheat Sheet <https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md>`_ and
+        `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of
+        authentication best practices.
         
         Quick overview of using One Time Passwords on your phone
         --------------------------------------------------------
@@ -44,25 +64,25 @@ Description: PyOTP - The Python One-Time Password Library
         ::
         
             totp = pyotp.TOTP('base32secret3232')
-            totp.now() # => 492039
+            totp.now() # => '492039'
         
             # OTP verified for current time
-            totp.verify(492039) # => True
+            totp.verify('492039') # => True
             time.sleep(30)
-            totp.verify(492039) # => False
+            totp.verify('492039') # => False
         
         Counter-based OTPs
         ~~~~~~~~~~~~~~~~~~
         ::
         
             hotp = pyotp.HOTP('base32secret3232')
-            hotp.at(0) # => 260182
-            hotp.at(1) # => 55283
-            hotp.at(1401) # => 316439
+            hotp.at(0) # => '260182'
+            hotp.at(1) # => '055283'
+            hotp.at(1401) # => '316439'
         
             # OTP verified with a counter
-            hotp.verify(316439, 1401) # => True
-            hotp.verify(316439, 1402) # => False
+            hotp.verify('316439', 1401) # => True
+            hotp.verify('316439', 1402) # => False
         
         Generating a base32 Secret Key
         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -92,7 +112,7 @@ Description: PyOTP - The Python One-Time Password Library
         
         Scan the following barcode with your phone's OTP app (e.g. Google Authenticator):
         
-        .. image:: http://chart.apis.google.com/chart?cht=qr&chs=250x250&chl=otpauth%3A%2F%2Ftotp%2Falice%40google.com%3Fsecret%3DJBSWY3DPEHPK3PXP
+        .. image:: https://chart.apis.google.com/chart?cht=qr&chs=250x250&chl=otpauth%3A%2F%2Ftotp%2Falice%40google.com%3Fsecret%3DJBSWY3DPEHPK3PXP
         
         Now run the following and compare the output::
         
@@ -111,9 +131,14 @@ Description: PyOTP - The Python One-Time Password Library
         * `RFC 6238: TOTP: Time-Based One-Time Password Algorithm <https://tools.ietf.org/html/rfc6238>`_
         * `ROTP <https://github.com/mdp/rotp>`_ - Original Ruby OTP library by `Mark Percival <https://github.com/mdp>`_
         * `OTPHP <https://github.com/lelag/otphp>`_ - PHP port of ROTP by `Le Lag <https://github.com/lelag>`_
-        * `OWASP Authentication Cheat Sheet <https://www.owasp.org/index.php/Authentication_Cheat_Sheet>`_
+        * `OWASP Authentication Cheat Sheet <https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md>`_
         * `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_
         
+        For new applications:
+        
+        * `WebAuthn <https://www.w3.org/TR/webauthn/>`_
+        * `PyWARP <https://github.com/pyauth/pywarp>`_
+        
         .. image:: https://img.shields.io/travis/pyotp/pyotp.svg
                 :target: https://travis-ci.org/pyotp/pyotp
         .. image:: https://img.shields.io/codecov/c/github/pyotp/pyotp/master.svg
@@ -128,11 +153,13 @@ Description: PyOTP - The Python One-Time Password Library
 Platform: MacOS X
 Platform: Posix
 Classifier: Intended Audience :: Developers
-Classifier: License :: OSI Approved :: BSD License
+Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: MacOS :: MacOS X
 Classifier: Operating System :: POSIX
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 2.7
-Classifier: Programming Language :: Python :: 3.3
 Classifier: Programming Language :: Python :: 3.4
+Classifier: Programming Language :: Python :: 3.5
+Classifier: Programming Language :: Python :: 3.6
+Classifier: Programming Language :: Python :: 3.7
 Classifier: Topic :: Software Development :: Libraries :: Python Modules

{pyotp-2.2.6 → pyotp-2.2.8}/test.py

@@ -261,6 +261,9 @@ class StringComparisonTest(CompareDigestTest):
     def test_fullwidth_input(self):
         self.assertTrue(self.method("ｘs１２３45", "xs12345"))
 
+    def test_unicode_equal(self):
+        self.assertTrue(self.method("ěšč45", "ěšč45"))
+
 
 class CounterOffsetTest(unittest.TestCase):
     def test_counter_offset(self):