sdtmf 2.0.1__tar.gz

sdtmf-2.0.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Nanda Winata
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

sdtmf-2.0.1/PKG-INFO

@@ -0,0 +1,161 @@
+Metadata-Version: 2.4
+Name: sdtmf
+Version: 2.0.1
+Summary: Authenticated, replay-protected encryption for DTMF tone frames (SDTMF v2)
+Author: Nanda Winata
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/ndawinata/SDTMF
+Project-URL: Specification, https://github.com/ndawinata/SDTMF/blob/main/SPEC.md
+Project-URL: Issues, https://github.com/ndawinata/SDTMF/issues
+Project-URL: DOI, https://doi.org/10.5281/zenodo.23637663
+Keywords: dtmf,encryption,hmac,authentication,mt8870,embedded
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Science/Research
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Communications :: Telephony
+Classifier: Topic :: Security :: Cryptography
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# sdtmf
+
+[![PyPI](https://img.shields.io/pypi/v/sdtmf)](https://pypi.org/project/sdtmf/)
+[![DOI](https://zenodo.org/badge/1432957615.svg)](https://doi.org/10.5281/zenodo.23637663)
+
+Authenticated, replay-protected encryption for DTMF tone frames (SDTMF v2).
+
+A sender turns a short message (`0-9A-D`) into a tone string such as
+`*015D0857C1CB#`. A receiver with the same key recovers the message and rejects
+replays, wrong keys, and flipped digits. The output uses only standard DTMF
+keys, so any tone generator or decoder (e.g. MT8870) can carry it.
+
+Frames are byte-for-byte compatible with the JavaScript, C/Arduino, and Go
+implementations in the [SDTMF repository](https://github.com/ndawinata/SDTMF).
+
+## Install
+
+```bash
+pip install sdtmf
+```
+
+Python 3.8+, standard library only.
+
+## Quick start
+
+```python
+from sdtmf import SecureDTMF
+
+tx = SecureDTMF("secret-key")   # sender
+rx = SecureDTMF("secret-key")   # receiver
+
+frame = tx.encrypt("1234")      # '*015D0857C1CB#'
+rx.decrypt(frame)               # '1234'
+rx.decrypt(frame)               # None  (replay rejected)
+
+nxt = tx.encrypt("1234")        # '*0275D6549036#'  (different every time)
+rx.decrypt(nxt)                 # '1234'
+
+SecureDTMF("wrong-key").decrypt(nxt)   # None  (wrong key)
+```
+
+`decrypt` returns `None` for any frame that is forged, modified, replayed,
+malformed, or encrypted with a different key. `encrypt` raises `ValueError` if
+the message contains characters outside `0-9 A-D`.
+
+## Frame format
+
+```
+start  counter  ciphertext  tag     end
+  *       01       5D08    57C1CB   #      ->  *015D0857C1CB#
+```
+
+Frame length = `start + ctr_tx + message length + tag_len + end`.
+
+## Options
+
+```python
+custom = SecureDTMF(
+    "secret-key",
+    ctr_tx=1,     # counter symbols per frame, 0..8   (default 2)
+    tag_len=4,    # tag symbols per frame, 1..8       (default 6)
+    start="#",    # '' or one char outside 0-9 A-D    (default '*')
+    end="*",      # '' or one char outside 0-9 A-D    (default '#')
+)
+
+custom.encrypt("1234")    # '#15D08C1CB*'
+custom.frame_len(4)       # 11
+```
+
+**Sender and receiver must use the same options.** They are not sent in the
+frame; a mismatch makes every frame fail to decrypt.
+
+| `ctr_tx` / `tag_len` | Tones for a 4-char message | Forgery chance per attempt | Lost frames tolerated |
+|---|---|---|---|
+| 2 / 6 (default) | 14 | 1 in 7,529,536 | 195 |
+| 2 / 8 | 16 | 1 in 1,475,789,056 | 195 |
+| 2 / 4 | 12 | 1 in 38,416 | 195 |
+| 1 / 4 | 11 | 1 in 38,416 | 13 |
+| 0 / 4 | 10 | 1 in 38,416 | 0 |
+
+## Persisting state
+
+Each side keeps a counter. Save it after every `encrypt` / successful
+`decrypt` and restore it on startup; otherwise old frames could be replayed
+and the keystream would repeat.
+
+```python
+state = tx.get_state()        # {'tx_ctr': 2, 'rx_last': -1}
+# ...store state, then after a restart:
+tx.set_state(state["tx_ctr"], state["rx_last"])
+```
+
+## Raw keys
+
+PBKDF2 (100,000 iterations) runs once in the constructor. To skip it, or to
+share keys with a microcontroller, derive the two 32-byte keys once and reuse
+them:
+
+```python
+from sdtmf import SecureDTMF, derive_keys
+
+k_enc, k_mac = derive_keys("secret-key")
+fast = SecureDTMF.from_keys(k_enc, k_mac, tag_len=8)
+```
+
+## API
+
+| Member | Description |
+|---|---|
+| `SecureDTMF(key, ctr_tx=2, tag_len=6, start="*", end="#")` | Create from a password. |
+| `SecureDTMF.from_keys(k_enc, k_mac, ...)` | Create from two 32-byte keys. |
+| `encrypt(msg)` | Return the next frame for `msg`. |
+| `decrypt(frame)` | Return the message, or `None` if the frame is rejected. |
+| `frame_len(n)` | Frame length for an `n`-symbol message. |
+| `get_state()` / `set_state(tx_ctr, rx_last)` | Read / restore the counters. |
+| `derive_keys(password)` | Return `(k_enc, k_mac)`. |
+| `ALPH`, `DEFAULT_*` | Payload alphabet and default options. |
+
+## Security notes
+
+- Built from standard primitives (PBKDF2-HMAC-SHA256, HMAC-SHA256, counter),
+  but the construction has **not been independently audited**.
+- Message length is visible from the frame length.
+- Never share one key between two senders.
+- Rate-limit failed frames on the receiver, especially with `tag_len` ≤ 4.
+- Prefer a random 32-byte key over a short password.
+- Encryption is not permitted on amateur radio bands.
+
+## Links
+
+- Specification: [SPEC.md](https://github.com/ndawinata/SDTMF/blob/main/SPEC.md)
+- Test vectors: [test-vectors.json](https://github.com/ndawinata/SDTMF/blob/main/test-vectors.json)
+- Other languages and full docs: [github.com/ndawinata/SDTMF](https://github.com/ndawinata/SDTMF)
+- Cite: [10.5281/zenodo.23637663](https://doi.org/10.5281/zenodo.23637663)
+
+## License
+
+MIT

sdtmf-2.0.1/README.md

@@ -0,0 +1,138 @@
+# sdtmf
+
+[![PyPI](https://img.shields.io/pypi/v/sdtmf)](https://pypi.org/project/sdtmf/)
+[![DOI](https://zenodo.org/badge/1432957615.svg)](https://doi.org/10.5281/zenodo.23637663)
+
+Authenticated, replay-protected encryption for DTMF tone frames (SDTMF v2).
+
+A sender turns a short message (`0-9A-D`) into a tone string such as
+`*015D0857C1CB#`. A receiver with the same key recovers the message and rejects
+replays, wrong keys, and flipped digits. The output uses only standard DTMF
+keys, so any tone generator or decoder (e.g. MT8870) can carry it.
+
+Frames are byte-for-byte compatible with the JavaScript, C/Arduino, and Go
+implementations in the [SDTMF repository](https://github.com/ndawinata/SDTMF).
+
+## Install
+
+```bash
+pip install sdtmf
+```
+
+Python 3.8+, standard library only.
+
+## Quick start
+
+```python
+from sdtmf import SecureDTMF
+
+tx = SecureDTMF("secret-key")   # sender
+rx = SecureDTMF("secret-key")   # receiver
+
+frame = tx.encrypt("1234")      # '*015D0857C1CB#'
+rx.decrypt(frame)               # '1234'
+rx.decrypt(frame)               # None  (replay rejected)
+
+nxt = tx.encrypt("1234")        # '*0275D6549036#'  (different every time)
+rx.decrypt(nxt)                 # '1234'
+
+SecureDTMF("wrong-key").decrypt(nxt)   # None  (wrong key)
+```
+
+`decrypt` returns `None` for any frame that is forged, modified, replayed,
+malformed, or encrypted with a different key. `encrypt` raises `ValueError` if
+the message contains characters outside `0-9 A-D`.
+
+## Frame format
+
+```
+start  counter  ciphertext  tag     end
+  *       01       5D08    57C1CB   #      ->  *015D0857C1CB#
+```
+
+Frame length = `start + ctr_tx + message length + tag_len + end`.
+
+## Options
+
+```python
+custom = SecureDTMF(
+    "secret-key",
+    ctr_tx=1,     # counter symbols per frame, 0..8   (default 2)
+    tag_len=4,    # tag symbols per frame, 1..8       (default 6)
+    start="#",    # '' or one char outside 0-9 A-D    (default '*')
+    end="*",      # '' or one char outside 0-9 A-D    (default '#')
+)
+
+custom.encrypt("1234")    # '#15D08C1CB*'
+custom.frame_len(4)       # 11
+```
+
+**Sender and receiver must use the same options.** They are not sent in the
+frame; a mismatch makes every frame fail to decrypt.
+
+| `ctr_tx` / `tag_len` | Tones for a 4-char message | Forgery chance per attempt | Lost frames tolerated |
+|---|---|---|---|
+| 2 / 6 (default) | 14 | 1 in 7,529,536 | 195 |
+| 2 / 8 | 16 | 1 in 1,475,789,056 | 195 |
+| 2 / 4 | 12 | 1 in 38,416 | 195 |
+| 1 / 4 | 11 | 1 in 38,416 | 13 |
+| 0 / 4 | 10 | 1 in 38,416 | 0 |
+
+## Persisting state
+
+Each side keeps a counter. Save it after every `encrypt` / successful
+`decrypt` and restore it on startup; otherwise old frames could be replayed
+and the keystream would repeat.
+
+```python
+state = tx.get_state()        # {'tx_ctr': 2, 'rx_last': -1}
+# ...store state, then after a restart:
+tx.set_state(state["tx_ctr"], state["rx_last"])
+```
+
+## Raw keys
+
+PBKDF2 (100,000 iterations) runs once in the constructor. To skip it, or to
+share keys with a microcontroller, derive the two 32-byte keys once and reuse
+them:
+
+```python
+from sdtmf import SecureDTMF, derive_keys
+
+k_enc, k_mac = derive_keys("secret-key")
+fast = SecureDTMF.from_keys(k_enc, k_mac, tag_len=8)
+```
+
+## API
+
+| Member | Description |
+|---|---|
+| `SecureDTMF(key, ctr_tx=2, tag_len=6, start="*", end="#")` | Create from a password. |
+| `SecureDTMF.from_keys(k_enc, k_mac, ...)` | Create from two 32-byte keys. |
+| `encrypt(msg)` | Return the next frame for `msg`. |
+| `decrypt(frame)` | Return the message, or `None` if the frame is rejected. |
+| `frame_len(n)` | Frame length for an `n`-symbol message. |
+| `get_state()` / `set_state(tx_ctr, rx_last)` | Read / restore the counters. |
+| `derive_keys(password)` | Return `(k_enc, k_mac)`. |
+| `ALPH`, `DEFAULT_*` | Payload alphabet and default options. |
+
+## Security notes
+
+- Built from standard primitives (PBKDF2-HMAC-SHA256, HMAC-SHA256, counter),
+  but the construction has **not been independently audited**.
+- Message length is visible from the frame length.
+- Never share one key between two senders.
+- Rate-limit failed frames on the receiver, especially with `tag_len` ≤ 4.
+- Prefer a random 32-byte key over a short password.
+- Encryption is not permitted on amateur radio bands.
+
+## Links
+
+- Specification: [SPEC.md](https://github.com/ndawinata/SDTMF/blob/main/SPEC.md)
+- Test vectors: [test-vectors.json](https://github.com/ndawinata/SDTMF/blob/main/test-vectors.json)
+- Other languages and full docs: [github.com/ndawinata/SDTMF](https://github.com/ndawinata/SDTMF)
+- Cite: [10.5281/zenodo.23637663](https://doi.org/10.5281/zenodo.23637663)
+
+## License
+
+MIT

sdtmf-2.0.1/pyproject.toml

@@ -0,0 +1,32 @@
+[project]
+name = "sdtmf"
+version = "2.0.1"
+description = "Authenticated, replay-protected encryption for DTMF tone frames (SDTMF v2)"
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+requires-python = ">=3.8"
+authors = [{ name = "Nanda Winata" }]
+keywords = ["dtmf", "encryption", "hmac", "authentication", "mt8870", "embedded"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "Intended Audience :: Science/Research",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Topic :: Communications :: Telephony",
+    "Topic :: Security :: Cryptography",
+]
+
+[project.urls]
+Homepage = "https://github.com/ndawinata/SDTMF"
+Specification = "https://github.com/ndawinata/SDTMF/blob/main/SPEC.md"
+Issues = "https://github.com/ndawinata/SDTMF/issues"
+DOI = "https://doi.org/10.5281/zenodo.23637663"
+
+[build-system]
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+
+[tool.setuptools]
+py-modules = ["sdtmf"]

sdtmf-2.0.1/sdtmf.egg-info/PKG-INFO

@@ -0,0 +1,161 @@
+Metadata-Version: 2.4
+Name: sdtmf
+Version: 2.0.1
+Summary: Authenticated, replay-protected encryption for DTMF tone frames (SDTMF v2)
+Author: Nanda Winata
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/ndawinata/SDTMF
+Project-URL: Specification, https://github.com/ndawinata/SDTMF/blob/main/SPEC.md
+Project-URL: Issues, https://github.com/ndawinata/SDTMF/issues
+Project-URL: DOI, https://doi.org/10.5281/zenodo.23637663
+Keywords: dtmf,encryption,hmac,authentication,mt8870,embedded
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Science/Research
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Communications :: Telephony
+Classifier: Topic :: Security :: Cryptography
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# sdtmf
+
+[![PyPI](https://img.shields.io/pypi/v/sdtmf)](https://pypi.org/project/sdtmf/)
+[![DOI](https://zenodo.org/badge/1432957615.svg)](https://doi.org/10.5281/zenodo.23637663)
+
+Authenticated, replay-protected encryption for DTMF tone frames (SDTMF v2).
+
+A sender turns a short message (`0-9A-D`) into a tone string such as
+`*015D0857C1CB#`. A receiver with the same key recovers the message and rejects
+replays, wrong keys, and flipped digits. The output uses only standard DTMF
+keys, so any tone generator or decoder (e.g. MT8870) can carry it.
+
+Frames are byte-for-byte compatible with the JavaScript, C/Arduino, and Go
+implementations in the [SDTMF repository](https://github.com/ndawinata/SDTMF).
+
+## Install
+
+```bash
+pip install sdtmf
+```
+
+Python 3.8+, standard library only.
+
+## Quick start
+
+```python
+from sdtmf import SecureDTMF
+
+tx = SecureDTMF("secret-key")   # sender
+rx = SecureDTMF("secret-key")   # receiver
+
+frame = tx.encrypt("1234")      # '*015D0857C1CB#'
+rx.decrypt(frame)               # '1234'
+rx.decrypt(frame)               # None  (replay rejected)
+
+nxt = tx.encrypt("1234")        # '*0275D6549036#'  (different every time)
+rx.decrypt(nxt)                 # '1234'
+
+SecureDTMF("wrong-key").decrypt(nxt)   # None  (wrong key)
+```
+
+`decrypt` returns `None` for any frame that is forged, modified, replayed,
+malformed, or encrypted with a different key. `encrypt` raises `ValueError` if
+the message contains characters outside `0-9 A-D`.
+
+## Frame format
+
+```
+start  counter  ciphertext  tag     end
+  *       01       5D08    57C1CB   #      ->  *015D0857C1CB#
+```
+
+Frame length = `start + ctr_tx + message length + tag_len + end`.
+
+## Options
+
+```python
+custom = SecureDTMF(
+    "secret-key",
+    ctr_tx=1,     # counter symbols per frame, 0..8   (default 2)
+    tag_len=4,    # tag symbols per frame, 1..8       (default 6)
+    start="#",    # '' or one char outside 0-9 A-D    (default '*')
+    end="*",      # '' or one char outside 0-9 A-D    (default '#')
+)
+
+custom.encrypt("1234")    # '#15D08C1CB*'
+custom.frame_len(4)       # 11
+```
+
+**Sender and receiver must use the same options.** They are not sent in the
+frame; a mismatch makes every frame fail to decrypt.
+
+| `ctr_tx` / `tag_len` | Tones for a 4-char message | Forgery chance per attempt | Lost frames tolerated |
+|---|---|---|---|
+| 2 / 6 (default) | 14 | 1 in 7,529,536 | 195 |
+| 2 / 8 | 16 | 1 in 1,475,789,056 | 195 |
+| 2 / 4 | 12 | 1 in 38,416 | 195 |
+| 1 / 4 | 11 | 1 in 38,416 | 13 |
+| 0 / 4 | 10 | 1 in 38,416 | 0 |
+
+## Persisting state
+
+Each side keeps a counter. Save it after every `encrypt` / successful
+`decrypt` and restore it on startup; otherwise old frames could be replayed
+and the keystream would repeat.
+
+```python
+state = tx.get_state()        # {'tx_ctr': 2, 'rx_last': -1}
+# ...store state, then after a restart:
+tx.set_state(state["tx_ctr"], state["rx_last"])
+```
+
+## Raw keys
+
+PBKDF2 (100,000 iterations) runs once in the constructor. To skip it, or to
+share keys with a microcontroller, derive the two 32-byte keys once and reuse
+them:
+
+```python
+from sdtmf import SecureDTMF, derive_keys
+
+k_enc, k_mac = derive_keys("secret-key")
+fast = SecureDTMF.from_keys(k_enc, k_mac, tag_len=8)
+```
+
+## API
+
+| Member | Description |
+|---|---|
+| `SecureDTMF(key, ctr_tx=2, tag_len=6, start="*", end="#")` | Create from a password. |
+| `SecureDTMF.from_keys(k_enc, k_mac, ...)` | Create from two 32-byte keys. |
+| `encrypt(msg)` | Return the next frame for `msg`. |
+| `decrypt(frame)` | Return the message, or `None` if the frame is rejected. |
+| `frame_len(n)` | Frame length for an `n`-symbol message. |
+| `get_state()` / `set_state(tx_ctr, rx_last)` | Read / restore the counters. |
+| `derive_keys(password)` | Return `(k_enc, k_mac)`. |
+| `ALPH`, `DEFAULT_*` | Payload alphabet and default options. |
+
+## Security notes
+
+- Built from standard primitives (PBKDF2-HMAC-SHA256, HMAC-SHA256, counter),
+  but the construction has **not been independently audited**.
+- Message length is visible from the frame length.
+- Never share one key between two senders.
+- Rate-limit failed frames on the receiver, especially with `tag_len` ≤ 4.
+- Prefer a random 32-byte key over a short password.
+- Encryption is not permitted on amateur radio bands.
+
+## Links
+
+- Specification: [SPEC.md](https://github.com/ndawinata/SDTMF/blob/main/SPEC.md)
+- Test vectors: [test-vectors.json](https://github.com/ndawinata/SDTMF/blob/main/test-vectors.json)
+- Other languages and full docs: [github.com/ndawinata/SDTMF](https://github.com/ndawinata/SDTMF)
+- Cite: [10.5281/zenodo.23637663](https://doi.org/10.5281/zenodo.23637663)
+
+## License
+
+MIT

sdtmf-2.0.1/sdtmf.egg-info/SOURCES.txt

@@ -0,0 +1,8 @@
+LICENSE
+README.md
+pyproject.toml
+sdtmf.py
+sdtmf.egg-info/PKG-INFO
+sdtmf.egg-info/SOURCES.txt
+sdtmf.egg-info/dependency_links.txt
+sdtmf.egg-info/top_level.txt

sdtmf-2.0.1/sdtmf.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

sdtmf-2.0.1/sdtmf.egg-info/top_level.txt

@@ -0,0 +1 @@
+sdtmf

sdtmf-2.0.1/sdtmf.py

@@ -0,0 +1,182 @@
+"""SDTMF v2 — Secure DTMF frames. See SPEC.md."""
+
+from __future__ import annotations
+
+import hmac
+import hashlib
+from typing import Optional
+
+ALPH = "0123456789ABCD"
+B = len(ALPH)
+IDX = {c: i for i, c in enumerate(ALPH)}
+SALT = b"SDTMF-v2"
+ITERS = 100_000
+
+DEFAULT_CTR_TX = 2
+DEFAULT_TAG_LEN = 6
+DEFAULT_START = "*"
+DEFAULT_END = "#"
+
+__all__ = [
+    "ALPH",
+    "DEFAULT_CTR_TX",
+    "DEFAULT_TAG_LEN",
+    "DEFAULT_START",
+    "DEFAULT_END",
+    "derive_keys",
+    "SecureDTMF",
+]
+
+
+def _to_sym(n: int, w: int) -> str:
+    if w == 0:
+        return ""
+    chars = ["0"] * w
+    for i in range(w - 1, -1, -1):
+        n, r = divmod(n, B)
+        chars[i] = ALPH[r]
+    return "".join(chars)
+
+
+def _to_int(s: str) -> int:
+    n = 0
+    for c in s:
+        n = n * B + IDX[c]
+    return n
+
+
+def _check_marker(m: str, name: str) -> None:
+    if not isinstance(m, str) or len(m) > 1 or (m and m in IDX):
+        raise ValueError(f"{name} must be '' or one character outside 0-9 A-D")
+
+
+def derive_keys(password: str) -> tuple[bytes, bytes]:
+    master = hashlib.pbkdf2_hmac("sha256", password.encode("utf-8"), SALT, ITERS)
+    k_enc = hmac.new(master, b"enc", hashlib.sha256).digest()
+    k_mac = hmac.new(master, b"mac", hashlib.sha256).digest()
+    return k_enc, k_mac
+
+
+class SecureDTMF:
+    """
+    Frame:  start  [ctr_tx]  [ciphertext]  [tag]  end
+    tx_ctr and rx_last MUST be persisted across restarts.
+    """
+
+    def __init__(
+        self,
+        key: Optional[str] = None,
+        ctr_tx: int = DEFAULT_CTR_TX,
+        tag_len: int = DEFAULT_TAG_LEN,
+        k_enc: Optional[bytes] = None,
+        k_mac: Optional[bytes] = None,
+        start: str = DEFAULT_START,
+        end: str = DEFAULT_END,
+    ):
+        if not (0 <= ctr_tx <= 8 and 1 <= tag_len <= 8):
+            raise ValueError("ctr_tx must be 0..8 and tag_len 1..8")
+        _check_marker(start, "start")
+        _check_marker(end, "end")
+        if start and start == end:
+            raise ValueError("start and end must differ")
+        if k_enc is not None and k_mac is not None:
+            if len(k_enc) != 32 or len(k_mac) != 32:
+                raise ValueError("k_enc and k_mac must be 32 bytes")
+            self.k_enc, self.k_mac = k_enc, k_mac
+        elif key is not None:
+            self.k_enc, self.k_mac = derive_keys(key)
+        else:
+            raise ValueError("provide key= or k_enc= and k_mac=")
+        self.ctr_tx = ctr_tx
+        self.tag_len = tag_len
+        self.start = start
+        self.end = end
+        self.mod = B ** ctr_tx
+        self.tag_mod = B ** tag_len
+        self.tx_ctr = 0
+        self.rx_last = -1
+
+    @classmethod
+    def from_keys(
+        cls,
+        k_enc: bytes,
+        k_mac: bytes,
+        ctr_tx: int = DEFAULT_CTR_TX,
+        tag_len: int = DEFAULT_TAG_LEN,
+        start: str = DEFAULT_START,
+        end: str = DEFAULT_END,
+    ) -> "SecureDTMF":
+        return cls(
+            k_enc=k_enc, k_mac=k_mac, ctr_tx=ctr_tx, tag_len=tag_len, start=start, end=end
+        )
+
+    def frame_len(self, msg_len: int) -> int:
+        return len(self.start) + self.ctr_tx + msg_len + self.tag_len + len(self.end)
+
+    def get_state(self) -> dict:
+        return {"tx_ctr": self.tx_ctr, "rx_last": self.rx_last}
+
+    def set_state(self, tx_ctr: int, rx_last: int) -> None:
+        self.tx_ctr = int(tx_ctr)
+        self.rx_last = int(rx_last)
+
+    def _ks(self, ctr: int, n: int) -> list[int]:
+        out: list[int] = []
+        blk = 0
+        while len(out) < n:
+            d = hmac.new(
+                self.k_enc,
+                ctr.to_bytes(8, "big") + blk.to_bytes(2, "big"),
+                hashlib.sha256,
+            ).digest()
+            out += [b % B for b in d if b < 252]
+            blk += 1
+        return out[:n]
+
+    def _tag(self, ctr: int, ct: str) -> str:
+        d = hmac.new(
+            self.k_mac, ctr.to_bytes(8, "big") + ct.encode("ascii"), hashlib.sha256
+        ).digest()
+        r = 0
+        m = self.tag_mod
+        for b in d:
+            r = (r * 256 + b) % m
+        return _to_sym(r, self.tag_len)
+
+    def encrypt(self, msg: str) -> str:
+        if not msg or any(c not in IDX for c in msg):
+            raise ValueError("message must be 1+ symbols from 0-9 A-D")
+        self.tx_ctr += 1
+        c = self.tx_ctr
+        ct = "".join(
+            ALPH[(IDX[m] + k) % B] for m, k in zip(msg, self._ks(c, len(msg)))
+        )
+        return (
+            self.start
+            + _to_sym(c % self.mod, self.ctr_tx)
+            + ct
+            + self._tag(c, ct)
+            + self.end
+        )
+
+    def decrypt(self, frame: str) -> Optional[str]:
+        ls, le = len(self.start), len(self.end)
+        if (
+            len(frame) < ls + le
+            or not frame.startswith(self.start)
+            or not frame.endswith(self.end)
+        ):
+            return None
+        s = frame[ls : len(frame) - le]
+        if any(ch not in IDX for ch in s) or len(s) <= self.ctr_tx + self.tag_len:
+            return None
+        low = _to_int(s[: self.ctr_tx])
+        ct, tag = s[self.ctr_tx : -self.tag_len], s[-self.tag_len :]
+        base = max(self.rx_last + 1, 1)
+        c = base + ((low - base) % self.mod)
+        if not hmac.compare_digest(tag, self._tag(c, ct)):
+            return None
+        self.rx_last = c
+        return "".join(
+            ALPH[(IDX[x] - k) % B] for x, k in zip(ct, self._ks(c, len(ct)))
+        )

sdtmf-2.0.1/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+