1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
|
srptools
========
https://github.com/idlesign/srptools
.. image:: https://idlesign.github.io/lbc/py2-lbc.svg
:target: https://idlesign.github.io/lbc/
:alt: LBC Python 2
----
|release| |stats| |lic| |ci| |coverage| |health|
.. |release| image:: https://img.shields.io/pypi/v/srptools.svg
:target: https://pypi.python.org/pypi/srptools
.. |stats| image:: https://img.shields.io/pypi/dm/srptools.svg
:target: https://pypi.python.org/pypi/srptools
.. |lic| image:: https://img.shields.io/pypi/l/srptools.svg
:target: https://pypi.python.org/pypi/srptools
.. |ci| image:: https://img.shields.io/travis/idlesign/srptools/master.svg
:target: https://travis-ci.org/idlesign/srptools
.. |coverage| image:: https://img.shields.io/coveralls/idlesign/srptools/master.svg
:target: https://coveralls.io/r/idlesign/srptools
.. |health| image:: https://landscape.io/github/idlesign/srptools/master/landscape.svg?style=flat
:target: https://landscape.io/github/idlesign/srptools/master
Description
-----------
*Tools to implement Secure Remote Password (SRP) authentication*
SRP is a secure password-based authentication and key-exchange protocol -
a password-authenticated key agreement protocol (PAKE).
This package contains protocol implementation for Python 2 and 3.
You may import it into you applications and use its API or you may use
``srptools`` command-line utility (CLI):
CLI usage
---------
Command-line utility requires ``click`` package to be installed.
Basic scenario:
.. code-block::
> srptools get_user_data_triplet
> srptools server get_private_and_public
> srptools client get_private_and_public
> srptools client get_session_data
> srptools server get_session_data
Help is available:
.. code-block::
> srptools --help
API usage
---------
Preliminary step. Agree on communication details:
.. code-block:: python
from srptools import SRPContext
context = SRPContext('alice', 'password123')
username, password_verifier, salt = context.get_user_data_triplet()
prime = context.prime
gen = context.generator
Simplified workflow:
.. code-block:: python
from srptools import SRPContext, SRPServerSession, SRPClientSession
# Receive username from client and generate server public.
server_session = SRPServerSession(SRPContext(username, prime=prime, generator=gen), password_verifier)
server_public = server_session.public
# Receive server public and salt and process them.
client_session = SRPClientSession(SRPContext('alice', 'password123', prime=prime, generator=gen))
client_session.process(server_public, salt)
# Generate client public and session key.
client_public = client_session.public
# Process client public and compare session keys.
server_session.process(client_public, salt)
assert server_session.key == client_session.key
Extended workflow
.. code-block:: python
from srptools import SRPContext, SRPServerSession, SRPClientSession
# Receive username from client and generate server public.
server_session = SRPServerSession(SRPContext(username, prime=prime, generator=gen), password_verifier)
server_public = server_session.public
# Receive server public and salt and process them.
client_session = SRPClientSession(SRPContext('alice', 'password123', prime=prime, generator=gen))
client_session.process(server_public, salt)
# Generate client public and session key proof.
client_public = client_session.public
client_session_key_proof = client_session.key_proof
# Process client public and verify session key proof.
server_session.process(client_public, salt)
assert server_session.verify_proof(client_session_key_proof)
# Generate session key proof hash.
server_session_key_proof_hash = client_session.key_proof_hash
# Verify session key proof hash received from server.
assert client_session.verify_proof(server_session_key_proof_hash)
Usage hints
-----------
* ``srptools.constants`` contains basic constants which can be used with ``SRPContext`` for server and client to agree
upon communication details.
* ``.process()`` methods of session classes may raise ``SRPException`` in certain circumstances. Auth process on
such occasions must be stopped.
* ``.private`` attribute of session classes may be used to restore sessions:
.. code-block:: python
server_private = server_session.private
# Restore session on new request.
server_session = SRPServerSession(context, password_verifier, private=server_private)
* ``SRPContext`` is rather flexible, so you can implement some custom server/client session logic with its help.
* Basic values are represented as hex strings but base64 encoded values are also supported:
.. code-block:: python
server_public = server_session.public_b64
# Receive server public and salt and process them.
client_session = SRPClientSession(SRPContext('alice', 'password123', prime=prime, generator=gen))
client_session.process(server_public, salt, base64=True)
# Use srptools.hex_from_b64() to represent base64 value as hex.
server_public_hex = hex_from_b64(server_public)
Links
-----
* RFC 2945 - The SRP Authentication and Key Exchange System
https://tools.ietf.org/html/rfc2945
* RFC 5054 - Using the Secure Remote Password (SRP) Protocol for TLS Authentication
https://tools.ietf.org/html/rfc5054
|
